linux-kernel - [PATCH] RDMA/core: fix memory alloc/free for pfn

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <aJjcPjL1BVh8QrMN@bhairav-test.ee.iitb.ac.in>
Date: Sun, 10 Aug 2025 23:21:58 +0530
From: Akhilesh Patil <akhilesh@...iitb.ac.in>
To: jgg@...pe.ca, leon@...nel.org, akhilesh@...iitb.ac.in,
	michaelgur@...dia.com, ohartoov@...dia.com, shayd@...dia.com,
	dskmtsd@...il.com, hch@...radead.org
Cc: linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org,
	akhileshpatilvnit@...il.com, skhan@...uxfoundation.org
Subject: [PATCH] RDMA/core: fix memory alloc/free for pfn_list

Ensure memory allocated for umem_odp->map->pfn_list using kvcalloc()
is freed using corresponding kvfree() to avoid potential memory
corruption. Match memory allocation and free routines kvcalloc -> kvfree

Fixes: 259e9bd07c57 ("RDMA/core: Avoid hmm_dma_map_alloc() for virtual DMA devices")
Signed-off-by: Akhilesh Patil <akhilesh@...iitb.ac.in>
---
 drivers/infiniband/core/umem_odp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index b1c44ec1a3f3..572a91a62a7b 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -115,7 +115,7 @@ static int ib_init_umem_odp(struct ib_umem_odp *umem_odp,
 
 out_free_map:
 	if (ib_uses_virt_dma(dev))
-		kfree(map->pfn_list);
+		kvfree(map->pfn_list);
 	else
 		hmm_dma_map_free(dev->dma_device, map);
 	return ret;
@@ -287,7 +287,7 @@ static void ib_umem_odp_free(struct ib_umem_odp *umem_odp)
 	mutex_unlock(&umem_odp->umem_mutex);
 	mmu_interval_notifier_remove(&umem_odp->notifier);
 	if (ib_uses_virt_dma(dev))
-		kfree(umem_odp->map.pfn_list);
+		kvfree(umem_odp->map.pfn_list);
 	else
 		hmm_dma_map_free(dev->dma_device, &umem_odp->map);
 }
-- 
2.34.1