[PATCH] ARM: dma-mapping: Fix wrong free function in __iommu_alloc_simple() error path

[Marek Szyprowski]

On 26.06.2026 12:11, lirongqing wrote:
> From: Li RongQing <lirongqing at baidu.com>
>
> In __iommu_alloc_simple(), when IOMMU mapping creation fails, the error
> path unconditionally called __free_from_pool() regardless of the
> allocation path taken.
>
> For the COHERENT case, memory is allocated via __alloc_simple_buffer(),
> which does not use the atomic pool. Calling __free_from_pool() on such
> memory silently returns without freeing, causing a page memory leak.
>
> Fix this by matching the free function to the allocation path:
> - COHERENT: use __dma_free_buffer(virt_to_page(addr), size)
> - non-COHERENT: use __free_from_pool(addr, size)
>
> Fixes: 565068221b905 ("ARM: 8561/4: dma-mapping: Fix the coherent case when iommu is used")
> Signed-off-by: Li RongQing <lirongqing at baidu.com>

Reviewed-by: Marek Szyprowski <m.szyprowski at samsung.com>

Please upload Your patch to https://www.arm.linux.org.uk/developer/patches/


> ---
>  arch/arm/mm/dma-mapping.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
> index f9bc53b..55d3d3b 100644
> --- a/arch/arm/mm/dma-mapping.c
> +++ b/arch/arm/mm/dma-mapping.c
> @@ -1056,7 +1056,10 @@ static void *__iommu_alloc_simple(struct device *dev, size_t size, gfp_t gfp,
>  	return addr;
>  
>  err_mapping:
> -	__free_from_pool(addr, size);
> +	if (coherent_flag == COHERENT)
> +		__dma_free_buffer(virt_to_page(addr), size);
> +	else
> +		__free_from_pool(addr, size);
>  	return NULL;
>  }
>  

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland