linux-kernel - [PATCH] iommufd: viommu: free memory allocated by kvcalloc() using kvfree()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <aJifyVV2PL6WGEs6@bhairav-test.ee.iitb.ac.in>
Date: Sun, 10 Aug 2025 19:04:01 +0530
From: Akhilesh Patil <akhilesh@...iitb.ac.in>
To: jgg@...pe.ca, kevin.tian@...el.com, joro@...tes.org, will@...nel.org,
	robin.murphy@....com, praan@...gle.com, baolu.lu@...ux.intel.com,
	nicolinc@...dia.com, jgg@...dia.com
Cc: iommu@...ts.linux.dev, linux-kernel@...r.kernel.org,
	akhileshpatilvnit@...il.com, skhan@...uxfoundation.org
Subject: [PATCH] iommufd: viommu: free memory allocated by kvcalloc() using
 kvfree()

Use kvfree() instead of kfree() to free pages allocated by kvcalloc()
in iommufs_hw_queue_alloc_phys() to fix potential memory corruption.
Ensure the memory is properly freed, as kvcalloc may internally use
vmalloc or kmalloc depending on available memory in the system.

Fixes: 2238ddc2b056 ("iommufd/viommu: Add IOMMUFD_CMD_HW_QUEUE_ALLOC ioctl")
Signed-off-by: Akhilesh Patil <akhilesh@...iitb.ac.in>
---
 drivers/iommu/iommufd/viommu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/iommufd/viommu.c b/drivers/iommu/iommufd/viommu.c
index 2ca5809b238b..462b457ffd0c 100644
--- a/drivers/iommu/iommufd/viommu.c
+++ b/drivers/iommu/iommufd/viommu.c
@@ -339,7 +339,7 @@ iommufd_hw_queue_alloc_phys(struct iommu_hw_queue_alloc *cmd,
 	}
 
 	*base_pa = (page_to_pfn(pages[0]) << PAGE_SHIFT) + offset;
-	kfree(pages);
+	kvfree(pages);
 	return access;
 
 out_unpin:
@@ -349,7 +349,7 @@ iommufd_hw_queue_alloc_phys(struct iommu_hw_queue_alloc *cmd,
 out_destroy:
 	iommufd_access_destroy_internal(viommu->ictx, access);
 out_free:
-	kfree(pages);
+	kvfree(pages);
 	return ERR_PTR(rc);
 }
 
-- 
2.34.1