tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

io_uring/zcrx: fix sgtable leak on mapping failures

In an unlikely case when io_populate_area_dma() fails, which could only
happen on a PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machine,
io_zcrx_map_area() will have an initialised and not freed table. It was
supposed to be cleaned up in the error path, but !is_mapped prevents
that.

Fixes: 439a98b972fbb ("io_uring/zcrx: deduplicate area mapping")
Cc: stable@vger.kernel.org
Reported-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

authored by

Pavel Begunkov and committed by
Jens Axboe a983aae3 d7d95207

+3
+3
io_uring/zcrx.c
··· 288 288 } 289 289 290 290 ret = io_populate_area_dma(ifq, area); 291 + if (ret && !area->mem.is_dmabuf) 292 + dma_unmap_sgtable(ifq->dev, &area->mem.page_sg_table, 293 + DMA_FROM_DEVICE, IO_DMA_ATTR); 291 294 if (ret == 0) 292 295 area->is_mapped = true; 293 296 return ret;