accel/amdxdna: Fix memory leak in amdxdna_iommu_alloc()

In amdxdna_iommu_alloc(), if iommu_map() fails after successfully
allocating both iova and cpu_addr, the code jumps to free_iova
which only frees the iova, leaking the allocated pages.

Fixes: ece3e8980907 ("accel/amdxdna: Allow forcing IOVA-based DMA via module parameter")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260416-amdxdna-v1-1-30c13008365c@gmail.com

diff --git a/drivers/accel/amdxdna/amdxdna_iommu.c b/drivers/accel/amdxdna/amdxdna_iommu.c
index 2676cfcfabee0d22dccb78c56332da158a304e1b..5a9f06183487fd8ac3d49314af00f65c72ec2dbc 100644 (file)
--- a/drivers/accel/amdxdna/amdxdna_iommu.c
+++ b/drivers/accel/amdxdna/amdxdna_iommu.c
@@ -117,10 +117,12 @@ void *amdxdna_iommu_alloc(struct amdxdna_dev *xdna, size_t size, dma_addr_t *dma
                        iova_align(&xdna->iovad, size),
                        IOMMU_READ | IOMMU_WRITE, GFP_KERNEL);
        if (ret)
-               goto free_iova;
+               goto free_cpu_addr;
 
        return cpu_addr;
 
+free_cpu_addr:
+       free_pages((unsigned long)cpu_addr, get_order(size));
 free_iova:
        __free_iova(&xdna->iovad, iova);
        return ERR_PTR(ret);