Re: [PATCH] crypto: qat - free dc_data with kfree() in the error path

[Giovanni Cabiddu]

On Mon, Oct 19, 2026 at 01:51:32PM +0800, ZhaoJinming wrote:
> qat_compression_alloc_dc_data() allocates dc_data with kzalloc_node(), but
> its error path releases it with devm_kfree():
> 
> 	dc_data = kzalloc_node(sizeof(*dc_data), GFP_KERNEL,
> 			       dev_to_node(dev));
> 	...
> err:
> 	accel_dev->dc_data = NULL;
> 	kfree(obuff);
> 	devm_kfree(dev, dc_data);
> 
> devm_kfree() only frees memory that was allocated with devm_kmalloc() and
> registered with the device resource manager.  dc_data is a plain kmalloc
> allocation that was never registered, so devres_destroy() does not find it,
> returns -ENOENT and devm_kfree() ends up in WARN_ON() without freeing
> anything.  The dc_data structure is leaked.
> 
> Commit 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data")
> switched dc_data to unmanaged allocation and replaced the devm_kfree() in
> qat_free_dc_data(), but missed the identical call in the error path of
> qat_compression_alloc_dc_data().  That path is taken when the overflow
> buffer allocation or its DMA mapping fails.
> 
> Free dc_data with kfree() here as well, matching the allocation and the
> other release path.
> 
> Fixes: 4cc871ad0173 ("crypto: qat - use unmanaged allocation for dc_data")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: ZhaoJinming <zhaojinming@xxxxxxxxxxxxx>
Acked-by: Giovanni Cabiddu <giovanni.cabiddu@xxxxxxxxx>

Regards,

-- 
Giovanni