From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 22094424E5C; Sat, 28 Feb 2026 17:46:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300782; cv=none; b=EsyzBRcIa9R02KNeNnTzMl06x76mhYsA+W72PnNX4uRCSR3u3qd8XMZEEI5vwx+OoZHNH1NkJrIdtc4e15kwNmsFKfZRUgIZdk3W+KQsA4AyA6RQYLwmhyPSihB5RcCihahDwMo+TT8IfISpv34F792HAQrYObud0SW5PWxbXp8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772300782; c=relaxed/simple; bh=oTP09YI/Pkrs6Rd3W3Jt/xedViZH/Wz+wk5aZE2TSg4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DwSl1H7OYCL7YUgvZiQl/RkQe8H4Kuy5qZnpd4TVaes/EbKpSbOZ12nk36zGq5YqSYGQYkemZeWuAw2g0qvq8g6QUv+JA7TuM2f7qSMWG3pFOdN6/VZt2j/U6tACqbGst8UgdOKiZqE38blV/EWOe782KloSnzRz9wJ3hkTk9D0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=N6JdFSCv; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="N6JdFSCv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 681C3C116D0; Sat, 28 Feb 2026 17:46:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772300782; bh=oTP09YI/Pkrs6Rd3W3Jt/xedViZH/Wz+wk5aZE2TSg4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=N6JdFSCvGlMKvHs/VbMubiM3WAAxgGxBgaLJtousV6dftfBOnUnYnLU4quV/9FMTE sN+PoKSzZLasEV5LN3/UpK7iPh8rW1nMdWczWGI5aNk36w+7CGNvKpQnidmU09MNHh RUo9i488/F2EqjVsGuST2NpqolGh3AncCceXP+3lXIiRbV4JdMmzm/2KUYz4Lmf5WK xfptG7NIltWURhrxUyGjAfGIK2v+8x/+JK1o7IBRQiRdOUD6+VOP+ycXU580AnJ0+S CQ9RsA8aH39xZWQIJ8+vk/k+HPfW8iq07uSAX8BONghkmJ77TkDdmFuI95e9hFK/UE qSat0q45vr9OA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Pavel Begunkov , Jens Axboe , Sasha Levin Subject: [PATCH 6.19 813/844] io_uring/zcrx: fix sgtable leak on mapping failures Date: Sat, 28 Feb 2026 12:32:06 -0500 Message-ID: <20260228173244.1509663-814-sashal@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20260228173244.1509663-1-sashal@kernel.org> References: <20260228173244.1509663-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit From: Pavel Begunkov [ Upstream commit a983aae397767e9da931128ff2b5bf9066513ce3 ] In an unlikely case when io_populate_area_dma() fails, which could only happen on a PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machine, io_zcrx_map_area() will have an initialised and not freed table. It was supposed to be cleaned up in the error path, but !is_mapped prevents that. Fixes: 439a98b972fbb ("io_uring/zcrx: deduplicate area mapping") Cc: stable@vger.kernel.org Reported-by: Jens Axboe Signed-off-by: Pavel Begunkov Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin --- io_uring/zcrx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c index 3d398283cf340..b133c85793c9c 100644 --- a/io_uring/zcrx.c +++ b/io_uring/zcrx.c @@ -288,6 +288,9 @@ static int io_zcrx_map_area(struct io_zcrx_ifq *ifq, struct io_zcrx_area *area) } ret = io_populate_area_dma(ifq, area); + if (ret && !area->mem.is_dmabuf) + dma_unmap_sgtable(ifq->dev, &area->mem.page_sg_table, + DMA_FROM_DEVICE, IO_DMA_ATTR); if (ret == 0) area->is_mapped = true; return ret; -- 2.51.0