[PATCH v2] dmaengine: fsl-dpaa2-qdma: fix ppriv memory leaks

[Guangshuo Li]

dpaa2_qdma_setup() allocates priv->ppriv, but failures after the
allocation can return from the function without releasing it. The
existing probe cleanup for priv->ppriv is only reached when a later
initialization step fails.

The normal remove path does not release priv->ppriv either, causing the
allocation to be leaked when the driver is unbound.

Since dpaa2_qdma_setup() is only called from probe, allocate priv->ppriv
with devm_kcalloc(). This automatically releases the memory on probe
failure and driver removal. Remove the now redundant manual cleanup from
the probe error path.

Fixes: 7fdf9b05c73b ("dmaengine: fsl-dpaa2-qdma: Add NXP dpaa2 qDMA controller driver for Layerscape SoCs")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
v2:
  - Use devm_kcalloc() for priv->ppriv, as suggested by Frank Li.
  - Remove the now redundant manual cleanup from the probe error path.
 drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c
index bf771251264d..d6843da29122 100644
--- a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c
+++ b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c
@@ -353,7 +353,8 @@ static int __cold dpaa2_qdma_setup(struct fsl_mc_device *ls_dev)
 	}
 
 	priv->num_pairs = min(priv->dpdmai_attr.num_of_priorities, prio_def);
-	ppriv = kzalloc_objs(*ppriv, priv->num_pairs);
+	ppriv = devm_kcalloc(dev, priv->num_pairs, sizeof(*ppriv),
+			     GFP_KERNEL);
 	if (!ppriv) {
 		err = -ENOMEM;
 		goto exit;
@@ -757,7 +758,6 @@ static int dpaa2_qdma_probe(struct fsl_mc_device *dpdmai_dev)
 	dpaa2_dpmai_store_free(priv);
 	dpaa2_dpdmai_dpio_free(priv);
 err_dpio_setup:
-	kfree(priv->ppriv);
 	dpdmai_close(priv->mc_io, 0, dpdmai_dev->mc_handle);
 err_dpdmai_setup:
 	fsl_mc_portal_free(priv->mc_io);
-- 
2.43.0