linux-kernel - [PATCH 1/1] firmware: stratix10-svc: Fix devm memory leak in Intel service layer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <df381bab9175b12c378ba233e7ea77075e7b3229.1761806203.git.kuhanh.murugasen.krishnan@altera.com>
Date: Tue,  4 Nov 2025 10:19:05 +0800
From: Kuhanh Murugasen Krishnan <kuhanh.murugasen.krishnan@...era.com>
To: Dinh Nguyen <dinguyen@...nel.org>,
	linux-kernel@...r.kernel.org,
	Kuhanh Murugasen Krishnan <kuhanh.murugasen.krishnan@...era.com>
Subject: [PATCH 1/1] firmware: stratix10-svc: Fix devm memory leak in Intel service layer

From: "Murugasen Krishnan, Kuhanh" <kuhanh.murugasen.krishnan@...era.com>

The Intel service layer is a static driver that remains active for the
entire runtime of the target device. Using devm_kzalloc() in this case
is inappropriate, as the managed memory would be freed automatically
when the device is removed, which never happens for this static driver.

Replace devm_kzalloc() with kzalloc() to ensure the allocated memory
persists as long as the service layer is active. Also add corresponding
kfree() calls on error and cleanup paths to avoid leaks.

Suggested-by: Tanmay Kathpalia <tanmay.kathpalia@...era.com>
Reviewed-by: Tanmay Kathpalia <tanmay.kathpalia@...era.com>
Signed-off-by: Mahesh Rao <mahesh.rao@...era.com>
Signed-off-by: Murugasen Krishnan, Kuhanh <kuhanh.murugasen.krishnan@...era.com>

---
 drivers/firmware/stratix10-svc.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
index 3acfa067c5dd..17f4c9359dad 100644
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -1798,14 +1798,16 @@ void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan,
 	struct gen_pool *genpool = chan->ctrl->genpool;
 	size_t s = roundup(size, 1 << genpool->min_alloc_order);
 
-	pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL);
+	pmem = kzalloc(sizeof(*pmem), GFP_KERNEL);
 	if (!pmem)
 		return ERR_PTR(-ENOMEM);
 
 	guard(mutex)(&svc_mem_lock);
 	va = gen_pool_alloc(genpool, s);
-	if (!va)
+	if (!va) {
+		kfree(pmem);
 		return ERR_PTR(-ENOMEM);
+	}
 
 	memset((void *)va, 0, s);
 	pa = gen_pool_virt_to_phys(genpool, va);
@@ -1831,6 +1833,10 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate_memory);
 void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
 {
 	struct stratix10_svc_data_mem *pmem;
+
+	if (!chan || !kaddr)
+		return;
+
 	guard(mutex)(&svc_mem_lock);
 
 	list_for_each_entry(pmem, &svc_data_mem, node)
@@ -1839,10 +1845,9 @@ void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
 				       (unsigned long)kaddr, pmem->size);
 			pmem->vaddr = NULL;
 			list_del(&pmem->node);
+			kfree(pmem);
 			return;
 		}
-
-	list_del(&svc_data_mem);
 }
 EXPORT_SYMBOL_GPL(stratix10_svc_free_memory);
 
-- 
2.25.1