diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2026-02-15 01:19:32 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-02-15 04:05:00 +0300 |
| commit | a983aae397767e9da931128ff2b5bf9066513ce3 (patch) | |
| tree | d633067c0bc576b9c877e9c3877fac672d26b231 | |
| parent | d7d95207caf41a8b5a595ed257cb4ce69726d3d7 (diff) | |
| download | linux-a983aae397767e9da931128ff2b5bf9066513ce3.tar.xz | |
io_uring/zcrx: fix sgtable leak on mapping failures
In an unlikely case when io_populate_area_dma() fails, which could only
happen on a PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machine,
io_zcrx_map_area() will have an initialised and not freed table. It was
supposed to be cleaned up in the error path, but !is_mapped prevents
that.
Fixes: 439a98b972fbb ("io_uring/zcrx: deduplicate area mapping")
Cc: stable@vger.kernel.org
Reported-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/zcrx.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c index 69567e19b4ca..006e1bfefa5f 100644 --- a/io_uring/zcrx.c +++ b/io_uring/zcrx.c @@ -288,6 +288,9 @@ static int io_zcrx_map_area(struct io_zcrx_ifq *ifq, struct io_zcrx_area *area) } ret = io_populate_area_dma(ifq, area); + if (ret && !area->mem.is_dmabuf) + dma_unmap_sgtable(ifq->dev, &area->mem.page_sg_table, + DMA_FROM_DEVICE, IO_DMA_ATTR); if (ret == 0) area->is_mapped = true; return ret; |