firmware: stratix10-svc: fix memory leaks and list corruption bugs

Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error
path. Switch pmem allocation from devm_kzalloc() to kzalloc() with
explicit kfree() in the free path to match its list-managed lifetime.
Remove the erroneous list_del(&svc_data_mem) which corrupted the list head
on failed lookups.

Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
Cc: stable@vger.kernel.org # 5.0+
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>

diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
index c24ca5823078f22a4fc86d7d78ded60a6a87f389..6306b79a14a12ead5369c87a9fd65ed24dc5d1c5 100644 (file)
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -1857,14 +1857,16 @@ void *stratix10_svc_allocate_memory(struct stratix10_svc_chan *chan,
        struct gen_pool *genpool = chan->ctrl->genpool;
        size_t s = roundup(size, 1 << genpool->min_alloc_order);
 
-       pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL);
+       pmem = kzalloc_obj(*pmem);
        if (!pmem)
                return ERR_PTR(-ENOMEM);
 
        guard(mutex)(&svc_mem_lock);
        va = gen_pool_alloc(genpool, s);
-       if (!va)
+       if (!va) {
+               kfree(pmem);
                return ERR_PTR(-ENOMEM);
+       }
 
        memset((void *)va, 0, s);
        pa = gen_pool_virt_to_phys(genpool, va);
@@ -1890,6 +1892,7 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate_memory);
 void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
 {
        struct stratix10_svc_data_mem *pmem;
+
        guard(mutex)(&svc_mem_lock);
 
        list_for_each_entry(pmem, &svc_data_mem, node)
@@ -1898,10 +1901,9 @@ void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr)
                                       (unsigned long)kaddr, pmem->size);
                        pmem->vaddr = NULL;
                        list_del(&pmem->node);
+                       kfree(pmem);
                        return;
                }
-
-       list_del(&svc_data_mem);
 }
 EXPORT_SYMBOL_GPL(stratix10_svc_free_memory);