On Mon, Feb 01, 2021 at 08:26:41PM +0800, Keqian Zhu wrote: > > +static int arm_smmu_insert_master(struct arm_smmu_device *smmu, > > + struct arm_smmu_master *master) > > +{ > > + int i; > > + int ret = 0; > > + struct arm_smmu_stream *new_stream, *cur_stream; > > + struct rb_node **new_node, *parent_node = NULL; > > + struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(master->dev); > > + > > + master->streams = kcalloc(fwspec->num_ids, > > + sizeof(struct arm_smmu_stream), GFP_KERNEL); > > + if (!master->streams) > > + return -ENOMEM; > > + master->num_streams = fwspec->num_ids; > This is not roll-backed when fail. No need, the caller frees master > > + > > + mutex_lock(&smmu->streams_mutex); > > + for (i = 0; i < fwspec->num_ids && !ret; i++) { > Check ret at here, makes it hard to decide the start index of rollback. > > If we fail at here, then start index is (i-2). > If we fail in the loop, then start index is (i-1). > [...] > > + if (ret) { > > + for (; i > 0; i--) > should be (i >= 0)? > And the start index seems not correct. Indeed, this whole bit is wrong. I'll fix it while resending the IOPF series. Thanks, Jean