From: Li RongQing <lirongqing@baidu.com>

In irq_remapping_alloc() each per-IRQ iteration allocates two objects:
the amd_ir_data (chip_data) and its data->entry (union irte / struct
irte_ga). The out_free_data error path only freed chip_data via
kfree(irq_data->chip_data), leaking data->entry for every already
initialized IRQ.

Free data->entry alongside data on the error path.

Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/iommu/amd/iommu.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index fd27373..92e93d2 100644
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -3906,8 +3906,11 @@ static int irq_remapping_alloc(struct irq_domain *domain, unsigned int virq,
 out_free_data:
 	for (i--; i >= 0; i--) {
 		irq_data = irq_domain_get_irq_data(domain, virq + i);
-		if (irq_data)
-			kfree(irq_data->chip_data);
+		if (irq_data && irq_data->chip_data) {
+			data = irq_data->chip_data;
+			kfree(data->entry);
+			kfree(data);
+		}
 	}
 	for (i = 0; i < nr_irqs; i++)
 		free_irte(iommu, devid, index + i);
-- 
2.9.4

On Tue, Sep 22, 2026 at 05:00:35PM +0800, lirongqing wrote:
>  drivers/iommu/amd/iommu.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)

Applied, thanks.