Use kvfree() instead of kfree() to free pages allocated by kvcalloc()
in iommufs_hw_queue_alloc_phys() to fix potential memory corruption.
Ensure the memory is properly freed, as kvcalloc may internally use
vmalloc or kmalloc depending on available memory in the system.

Fixes: 2238ddc2b056 ("iommufd/viommu: Add IOMMUFD_CMD_HW_QUEUE_ALLOC ioctl")
Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
---
 drivers/iommu/iommufd/viommu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/iommufd/viommu.c b/drivers/iommu/iommufd/viommu.c
index 2ca5809b238b..462b457ffd0c 100644
--- a/drivers/iommu/iommufd/viommu.c
+++ b/drivers/iommu/iommufd/viommu.c
@@ -339,7 +339,7 @@ iommufd_hw_queue_alloc_phys(struct iommu_hw_queue_alloc *cmd,
 	}
 
 	*base_pa = (page_to_pfn(pages[0]) << PAGE_SHIFT) + offset;
-	kfree(pages);
+	kvfree(pages);
 	return access;
 
 out_unpin:
@@ -349,7 +349,7 @@ iommufd_hw_queue_alloc_phys(struct iommu_hw_queue_alloc *cmd,
 out_destroy:
 	iommufd_access_destroy_internal(viommu->ictx, access);
 out_free:
-	kfree(pages);
+	kvfree(pages);
 	return ERR_PTR(rc);
 }
 
-- 
2.34.1

On Sun, Aug 10, 2025 at 07:04:01PM +0530, Akhilesh Patil wrote:
> Use kvfree() instead of kfree() to free pages allocated by kvcalloc()
> in iommufs_hw_queue_alloc_phys() to fix potential memory corruption.
> Ensure the memory is properly freed, as kvcalloc may internally use
> vmalloc or kmalloc depending on available memory in the system.
> 
> Fixes: 2238ddc2b056 ("iommufd/viommu: Add IOMMUFD_CMD_HW_QUEUE_ALLOC ioctl")
> Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
> ---
>  drivers/iommu/iommufd/viommu.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Applied to for-rc

Thanks,
Jason

> Use kvfree() instead of kfree() to free pages allocated by kvcalloc()
> in iommufs_hw_queue_alloc_phys() to fix potential memory corruption.
> Ensure the memory is properly freed, as kvcalloc may internally use
> vmalloc or kmalloc depending on available memory in the system.

Will another bit of background information become helpful
for an improved change description?

Test command example:
Markus_Elfring@Sonne:…/Projekte/Linux/next-analyses> /usr/bin/spatch -D report scripts/coccinelle/api/kfree_mismatch.cocci drivers/iommu/iommufd/viommu.c
…

Regards,
Markus

On 15/08/2025 2:42 pm, Markus Elfring wrote:
>> Use kvfree() instead of kfree() to free pages allocated by kvcalloc()
>> in iommufs_hw_queue_alloc_phys() to fix potential memory corruption.
>> Ensure the memory is properly freed, as kvcalloc may internally use
>> vmalloc or kmalloc depending on available memory in the system.
> 
> Will another bit of background information become helpful
> for an improved change description?

No it will not. Please stop pointlessly nitpicking. A thing that is 
allocated with kv*alloc() must be freed with kvfree(); that alone is all 
that needs to be said to explain and justify any patch fixing this 
particular bug.

Thanks,
Robin.

>> Will another bit of background information become helpful
>> for an improved change description?
> 
> No it will not. Please stop pointlessly nitpicking. …

Do you care for help and further influence of automatic source code analysis tools?

Regards,
Markus

On Sun, Aug 10, 2025 at 07:04:01PM +0530, Akhilesh Patil wrote:
> Use kvfree() instead of kfree() to free pages allocated by kvcalloc()
> in iommufs_hw_queue_alloc_phys() to fix potential memory corruption.
> Ensure the memory is properly freed, as kvcalloc may internally use
> vmalloc or kmalloc depending on available memory in the system.
> 
> Fixes: 2238ddc2b056 ("iommufd/viommu: Add IOMMUFD_CMD_HW_QUEUE_ALLOC ioctl")
> Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>

Reviewed-by: Pranjal Shrivastava <praan@google.com>

Thanks,
Praan

> From: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
> Sent: Sunday, August 10, 2025 9:34 PM
> 
> Use kvfree() instead of kfree() to free pages allocated by kvcalloc()
> in iommufs_hw_queue_alloc_phys() to fix potential memory corruption.
> Ensure the memory is properly freed, as kvcalloc may internally use
> vmalloc or kmalloc depending on available memory in the system.
> 
> Fixes: 2238ddc2b056 ("iommufd/viommu: Add
> IOMMUFD_CMD_HW_QUEUE_ALLOC ioctl")
> Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>

Reviewed-by: Kevin Tian <kevin.tian@intel.com>

On Sun, Aug 10, 2025 at 07:04:01PM +0530, Akhilesh Patil wrote:
> Use kvfree() instead of kfree() to free pages allocated by kvcalloc()
> in iommufs_hw_queue_alloc_phys() to fix potential memory corruption.
> Ensure the memory is properly freed, as kvcalloc may internally use
> vmalloc or kmalloc depending on available memory in the system.
> 
> Fixes: 2238ddc2b056 ("iommufd/viommu: Add IOMMUFD_CMD_HW_QUEUE_ALLOC ioctl")
> Signed-off-by: Akhilesh Patil <akhilesh@ee.iitb.ac.in>
 
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>

Thanks!