From: lynn Date: Sat, 14 Feb 2026 08:09:19 +0000 (+0000) Subject: iommu/iova: Add NULL check in iova_magazine_free() X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fa8fb60d36375ca3166a60589a624f0d0bc9ddb5;p=thirdparty%2Fkernel%2Flinux.git iommu/iova: Add NULL check in iova_magazine_free() When iova_domain_init_rcaches() fails to allocate an iova_magazine during the initialization of per-cpu rcaches, it jumps to out_err and calls free_iova_rcaches() for cleanup. In free_iova_rcaches(), the code iterates through all possible CPUs to free both cpu_rcache->loaded and cpu_rcache->prev. However, if the original allocation failed mid-way through the CPU loop, the pointers for the remaining CPUs remain NULL. Since kmem_cache_free() does not explicitly handle NULL pointers like kfree() does, passing these NULL pointers leads to a kernel paging request fault. Add a NULL check in iova_magazine_free() to safely handle partially initialized rcaches in error paths. Signed-off-by: lynn Signed-off-by: Joerg Roedel --- diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c index f9cd18316d16b..021daf6528de1 100644 --- a/drivers/iommu/iova.c +++ b/drivers/iommu/iova.c @@ -611,7 +611,8 @@ static struct iova_magazine *iova_magazine_alloc(gfp_t flags) static void iova_magazine_free(struct iova_magazine *mag) { - kmem_cache_free(iova_magazine_cache, mag); + if (mag) + kmem_cache_free(iova_magazine_cache, mag); } static void