[PATCH] fix: ntb: perf_copy_chunk: fix tx descriptor and unmap kref leak on dmaengine_submit failure

[PATCH] fix: ntb: perf_copy_chunk: fix tx descriptor and unmap kref leak on dmaengine_submit failure

[WenTao Liang]

When dmaengine_submit fails after dma_set_unmap has been called, the
  unmap object has two references (one from dmaengine_get_unmap_data and
  one from dma_set_unmap held by the tx descriptor). The error path
  err_free_resource only calls dmaengine_unmap_put once, leaving the tx
  descriptor's reference and the descriptor itself leaked.

Add dmaengine_desc_put(tx) in the err_free_resource path to properly
  release the tx descriptor and its held unmap reference.

Cc: stable@vger.kernel.org
Fixes: 282a2feeb9bf ("NTB: Use DMA Engine to Transmit and Receive")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 drivers/ntb/test/ntb_perf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
index dfd175f79e8f..64783bfa5a2c 100644
--- a/drivers/ntb/test/ntb_perf.c
+++ b/drivers/ntb/test/ntb_perf.c
@@ -851,6 +851,7 @@ static int perf_copy_chunk(struct perf_thread *pthr,
 	return likely(atomic_read(&pthr->perf->tsync) > 0) ? 0 : -EINTR;
 
 err_free_resource:
+	dmaengine_desc_put(tx);
 	dmaengine_unmap_put(unmap);
 
 	return ret;
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] fix: ntb: perf_copy_chunk: fix tx descriptor and unmap kref leak on dmaengine_submit failure

[Dave Jiang]

On 6/26/26 8:39 AM, WenTao Liang wrote:
> When dmaengine_submit fails after dma_set_unmap has been called, the
>   unmap object has two references (one from dmaengine_get_unmap_data and
>   one from dma_set_unmap held by the tx descriptor). The error path
>   err_free_resource only calls dmaengine_unmap_put once, leaving the tx
>   descriptor's reference and the descriptor itself leaked.
> 
> Add dmaengine_desc_put(tx) in the err_free_resource path to properly
>   release the tx descriptor and its held unmap reference.
> 
> Cc: stable@vger.kernel.org
> Fixes: 282a2feeb9bf ("NTB: Use DMA Engine to Transmit and Receive")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>

Same comment. Please resend to ntb@lists.linux.dev.


> ---
>  drivers/ntb/test/ntb_perf.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
> index dfd175f79e8f..64783bfa5a2c 100644
> --- a/drivers/ntb/test/ntb_perf.c
> +++ b/drivers/ntb/test/ntb_perf.c
> @@ -851,6 +851,7 @@ static int perf_copy_chunk(struct perf_thread *pthr,
>  	return likely(atomic_read(&pthr->perf->tsync) > 0) ? 0 : -EINTR;
>  
>  err_free_resource:
> +	dmaengine_desc_put(tx);
>  	dmaengine_unmap_put(unmap);
>  
>  	return ret;