dpaa2_qdma_setup() allocates priv->ppriv, but failures after the allocation can return from the function without releasing it. The existing probe cleanup for priv->ppriv is only reached when a later initialization step fails. The normal remove path does not release priv->ppriv either, causing the allocation to be leaked when the driver is unbound. Since dpaa2_qdma_setup() is only called from probe, allocate priv->ppriv with devm_kcalloc(). This automatically releases the memory on probe failure and driver removal. Remove the now redundant manual cleanup from the probe error path. Fixes: 7fdf9b05c73b ("dmaengine: fsl-dpaa2-qdma: Add NXP dpaa2 qDMA controller driver for Layerscape SoCs") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- v2: - Use devm_kcalloc() for priv->ppriv, as suggested by Frank Li. - Remove the now redundant manual cleanup from the probe error path. drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c index bf771251264d..d6843da29122 100644 --- a/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c +++ b/drivers/dma/fsl-dpaa2-qdma/dpaa2-qdma.c @@ -353,7 +353,8 @@ static int __cold dpaa2_qdma_setup(struct fsl_mc_device *ls_dev) } priv->num_pairs = min(priv->dpdmai_attr.num_of_priorities, prio_def); - ppriv = kzalloc_objs(*ppriv, priv->num_pairs); + ppriv = devm_kcalloc(dev, priv->num_pairs, sizeof(*ppriv), + GFP_KERNEL); if (!ppriv) { err = -ENOMEM; goto exit; @@ -757,7 +758,6 @@ static int dpaa2_qdma_probe(struct fsl_mc_device *dpdmai_dev) dpaa2_dpmai_store_free(priv); dpaa2_dpdmai_dpio_free(priv); err_dpio_setup: - kfree(priv->ppriv); dpdmai_close(priv->mc_io, 0, dpdmai_dev->mc_handle); err_dpdmai_setup: fsl_mc_portal_free(priv->mc_io); -- 2.43.0