Re: [PATCH v2] dmaengine: fsl-dpaa2-qdma: fix ppriv memory leaks

[Frank Li]

On Mon, Sep 21, 2026 at 07:14:24PM +0800, Guangshuo Li wrote:
> dpaa2_qdma_setup() allocates priv->ppriv, but failures after the
> allocation can return from the function without releasing it. The
> existing probe cleanup for priv->ppriv is only reached when a later
> initialization step fails.
>
> The normal remove path does not release priv->ppriv either, causing the
> allocation to be leaked when the driver is unbound.
>
> Since dpaa2_qdma_setup() is only called from probe, allocate priv->ppriv
> with devm_kcalloc(). This automatically releases the memory on probe
> failure and driver removal. Remove the now redundant manual cleanup from
> the probe error path.
>
> Fixes: 7fdf9b05c73b ("dmaengine: fsl-dpaa2-qdma: Add NXP dpaa2 qDMA controller driver for Layerscape SoCs")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
> ---

Reviewed-by: Frank Li <Frank.Li@xxxxxxx>

> v2:
>   - Use devm_kcalloc() for priv->ppriv, as suggested by Frank Li.
>   - Remove the now redundant manual cleanup from the probe error path.
>  drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c
> index bf771251264d..d6843da29122 100644
> --- a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c
> +++ b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c
> @@ -353,7 +353,8 @@ static int __cold dpaa2_qdma_setup(struct fsl_mc_device *ls_dev)
>  	}
>
>  	priv->num_pairs = min(priv->dpdmai_attr.num_of_priorities, prio_def);
> -	ppriv = kzalloc_objs(*ppriv, priv->num_pairs);
> +	ppriv = devm_kcalloc(dev, priv->num_pairs, sizeof(*ppriv),
> +			     GFP_KERNEL);
>  	if (!ppriv) {
>  		err = -ENOMEM;
>  		goto exit;
> @@ -757,7 +758,6 @@ static int dpaa2_qdma_probe(struct fsl_mc_device *dpdmai_dev)
>  	dpaa2_dpmai_store_free(priv);
>  	dpaa2_dpdmai_dpio_free(priv);
>  err_dpio_setup:
> -	kfree(priv->ppriv);
>  	dpdmai_close(priv->mc_io, 0, dpdmai_dev->mc_handle);
>  err_dpdmai_setup:
>  	fsl_mc_portal_free(priv->mc_io);
> --
> 2.43.0
>