linux-kernel - Re: [v2 PATCH 1/1] crypto: caam: fix netdev memory leak in dpaa2_caam

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <c6ca990e-0d53-430e-9ae9-4eb0f79f2cdb@windriver.com>
Date: Thu, 29 Jan 2026 14:08:37 +0800
From: "Chang, Jianpeng (CN)" <Jianpeng.Chang.CN@...driver.com>
To: horia.geanta@....com, pankaj.gupta@....com, gaurav.jain@....com,
        herbert@...dor.apana.org.au, davem@...emloft.net, leitao@...ian.org,
        kuba@...nel.org
Cc: linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [v2 PATCH 1/1] crypto: caam: fix netdev memory leak in
 dpaa2_caam_probe

Gentle ping, any comments on this patch?

Thanks,
Jianpeng

On 1/20/2026 9:55 AM, Jianpeng Chang wrote:
> When commit 0e1a4d427f58 ("crypto: caam: Unembed net_dev structure in
> dpaa2") converted embedded net_device to dynamically allocated pointers,
> it added cleanup in dpaa2_dpseci_disable() but missed adding cleanup in
> dpaa2_dpseci_free() for error paths.
> 
> This causes memory leaks when dpaa2_dpseci_dpio_setup() fails during probe
> due to DPIO devices not being ready yet. The kernel's deferred probe
> mechanism handles the retry successfully, but the netdevs allocated during
> the failed probe attempt are never freed, resulting in kmemleak reports
> showing multiple leaked netdev-related allocations all traced back to
> dpaa2_caam_probe().
> 
> Fix this by preserving the CPU mask of allocated netdevs during setup and
> using it for cleanup in dpaa2_dpseci_free(). This approach ensures that
> only the CPUs that actually had netdevs allocated will be cleaned up,
> avoiding potential issues with CPU hotplug scenarios.
> 
> Fixes: 0e1a4d427f58 ("crypto: caam: Unembed net_dev structure in dpaa2")
> Signed-off-by: Jianpeng Chang <jianpeng.chang.cn@...driver.com>
> ---
> v2:
>    - fix the build error with CPUMASK_OFFSTACK disabled
>    - instead of the movement of free_dpaa2_pcpu_netdev, implement it
>      directly in dpaa2_dpseci_free
> v1: https://lore.kernel.org/all/20260116014455.2575351-1-jianpeng.chang.cn@windriver.com/
> 
>   drivers/crypto/caam/caamalg_qi2.c | 27 +++++++++++++++------------
>   drivers/crypto/caam/caamalg_qi2.h |  2 ++
>   2 files changed, 17 insertions(+), 12 deletions(-)
> 
> diff --git a/drivers/crypto/caam/caamalg_qi2.c b/drivers/crypto/caam/caamalg_qi2.c
> index 107ccb2ade42..c6117c23eb25 100644
> --- a/drivers/crypto/caam/caamalg_qi2.c
> +++ b/drivers/crypto/caam/caamalg_qi2.c
> @@ -4814,7 +4814,8 @@ static void dpaa2_dpseci_free(struct dpaa2_caam_priv *priv)
>   {
>   	struct device *dev = priv->dev;
>   	struct fsl_mc_device *ls_dev = to_fsl_mc_device(dev);
> -	int err;
> +	struct dpaa2_caam_priv_per_cpu *ppriv;
> +	int i, err;
>   
>   	if (DPSECI_VER(priv->major_ver, priv->minor_ver) > DPSECI_VER(5, 3)) {
>   		err = dpseci_reset(priv->mc_io, 0, ls_dev->mc_handle);
> @@ -4822,6 +4823,12 @@ static void dpaa2_dpseci_free(struct dpaa2_caam_priv *priv)
>   			dev_err(dev, "dpseci_reset() failed\n");
>   	}
>   
> +	for_each_cpu(i, priv->clean_mask) {
> +		ppriv = per_cpu_ptr(priv->ppriv, i);
> +		free_netdev(ppriv->net_dev);
> +	}
> +	free_cpumask_var(priv->clean_mask);
> +
>   	dpaa2_dpseci_congestion_free(priv);
>   	dpseci_close(priv->mc_io, 0, ls_dev->mc_handle);
>   }
> @@ -5007,16 +5014,15 @@ static int __cold dpaa2_dpseci_setup(struct fsl_mc_device *ls_dev)
>   	struct device *dev = &ls_dev->dev;
>   	struct dpaa2_caam_priv *priv;
>   	struct dpaa2_caam_priv_per_cpu *ppriv;
> -	cpumask_var_t clean_mask;
>   	int err, cpu;
>   	u8 i;
>   
>   	err = -ENOMEM;
> -	if (!zalloc_cpumask_var(&clean_mask, GFP_KERNEL))
> -		goto err_cpumask;
> -
>   	priv = dev_get_drvdata(dev);
>   
> +	if (!zalloc_cpumask_var(&priv->clean_mask, GFP_KERNEL))
> +		goto err_cpumask;
> +
>   	priv->dev = dev;
>   	priv->dpsec_id = ls_dev->obj_desc.id;
>   
> @@ -5118,7 +5124,7 @@ static int __cold dpaa2_dpseci_setup(struct fsl_mc_device *ls_dev)
>   			err = -ENOMEM;
>   			goto err_alloc_netdev;
>   		}
> -		cpumask_set_cpu(cpu, clean_mask);
> +		cpumask_set_cpu(cpu, priv->clean_mask);
>   		ppriv->net_dev->dev = *dev;
>   
>   		netif_napi_add_tx_weight(ppriv->net_dev, &ppriv->napi,
> @@ -5126,18 +5132,16 @@ static int __cold dpaa2_dpseci_setup(struct fsl_mc_device *ls_dev)
>   					 DPAA2_CAAM_NAPI_WEIGHT);
>   	}
>   
> -	err = 0;
> -	goto free_cpumask;
> +	return 0;
>   
>   err_alloc_netdev:
> -	free_dpaa2_pcpu_netdev(priv, clean_mask);
> +	free_dpaa2_pcpu_netdev(priv, priv->clean_mask);
>   err_get_rx_queue:
>   	dpaa2_dpseci_congestion_free(priv);
>   err_get_vers:
>   	dpseci_close(priv->mc_io, 0, ls_dev->mc_handle);
>   err_open:
> -free_cpumask:
> -	free_cpumask_var(clean_mask);
> +	free_cpumask_var(priv->clean_mask);
>   err_cpumask:
>   	return err;
>   }
> @@ -5182,7 +5186,6 @@ static int __cold dpaa2_dpseci_disable(struct dpaa2_caam_priv *priv)
>   		ppriv = per_cpu_ptr(priv->ppriv, i);
>   		napi_disable(&ppriv->napi);
>   		netif_napi_del(&ppriv->napi);
> -		free_netdev(ppriv->net_dev);
>   	}
>   
>   	return 0;
> diff --git a/drivers/crypto/caam/caamalg_qi2.h b/drivers/crypto/caam/caamalg_qi2.h
> index 61d1219a202f..8e65b4b28c7b 100644
> --- a/drivers/crypto/caam/caamalg_qi2.h
> +++ b/drivers/crypto/caam/caamalg_qi2.h
> @@ -42,6 +42,7 @@
>    * @mc_io: pointer to MC portal's I/O object
>    * @domain: IOMMU domain
>    * @ppriv: per CPU pointers to privata data
> + * @clean_mask: CPU mask of CPUs that have allocated netdevs
>    */
>   struct dpaa2_caam_priv {
>   	int dpsec_id;
> @@ -65,6 +66,7 @@ struct dpaa2_caam_priv {
>   
>   	struct dpaa2_caam_priv_per_cpu __percpu *ppriv;
>   	struct dentry *dfs_root;
> +	cpumask_var_t clean_mask;
>   };
>   
>   /**