Re: [PATCH] dmaengine: fsl-dpaa2-qdma: fix ppriv memory leaks

[Guangshuo Li]

Hi Frank,

Thanks for the review.

On Mon, 14 Sept 2026 at 23:12, Frank Li <Frank.li@xxxxxxxxxxx> wrote:
>
> On Sun, Sep 13, 2026 at 12:50:01PM +0800, Guangshuo Li wrote:
> > dpaa2_qdma_setup() allocates priv->ppriv separately from priv, but the
> > allocation is not released on all teardown paths.
> >
> > If dpdmai_get_rx_queue() or dpdmai_get_tx_queue() fails after
> > priv->ppriv has been allocated, dpaa2_qdma_setup() returns through the
> > error path without freeing it.
> >
> > The normal remove path has the same issue. dpaa2_qdma_remove() frees
> > priv without first releasing priv->ppriv, losing the only reference to
> > the separately allocated array.
> >
> > Free priv->ppriv on setup failures that occur after its allocation and
> > during normal driver removal before freeing priv.
> >
> > This issue was found by manual code inspection.
> >
> > Fixes: 7fdf9b05c73b ("dmaengine: fsl-dpaa2-qdma: Add NXP dpaa2 qDMA controller driver for Layerscape SoCs")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> > ---
>
> qdma_setup() is called by probe() only use devm_ allocate function
>
> Frank
>
> >  drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c | 8 ++++++--
> >  1 file changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c
> > index bf771251264d..0f0fe0291a06 100644
> > --- a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c
> > +++ b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c
> > @@ -365,7 +365,7 @@ static int __cold dpaa2_qdma_setup(struct fsl_mc_device *ls_dev)
> >                                         i, 0, &priv->rx_queue_attr[i]);
> >               if (err) {
> >                       dev_err(dev, "dpdmai_get_rx_queue() failed\n");
> > -                     goto exit;
> > +                     goto err_free_ppriv;
> >               }
> >               ppriv->rsp_fqid = priv->rx_queue_attr[i].fqid;
> >
> > @@ -373,7 +373,7 @@ static int __cold dpaa2_qdma_setup(struct fsl_mc_device *ls_dev)
> >                                         i, 0, &priv->tx_queue_attr[i]);
> >               if (err) {
> >                       dev_err(dev, "dpdmai_get_tx_queue() failed\n");
> > -                     goto exit;
> > +                     goto err_free_ppriv;
> >               }
> >               ppriv->req_fqid = priv->tx_queue_attr[i].fqid;
> >               ppriv->prio = DPAA2_QDMA_DEFAULT_PRIORITY;
> > @@ -382,6 +382,9 @@ static int __cold dpaa2_qdma_setup(struct fsl_mc_device *ls_dev)
> >       }
> >
> >       return 0;
> > +
> > +err_free_ppriv:
> > +     kfree(priv->ppriv);
> >  exit:
> >       dpdmai_close(priv->mc_io, 0, ls_dev->mc_handle);
> >       return err;
> > @@ -787,6 +790,7 @@ static void dpaa2_qdma_remove(struct fsl_mc_device *ls_dev)
> >       dpaa2_dpdmai_free_channels(dpaa2_qdma);
> >
> >       dma_async_device_unregister(&dpaa2_qdma->dma_dev);
> > +     kfree(priv->ppriv);
> >       kfree(priv);
> >       kfree(dpaa2_qdma);
> >  }
> > --
> > 2.43.0
> >

Agreed. I'll switch priv->ppriv to devm_kcalloc() and send a v2.

Thanks,
Guangshuo