Re: [RESEND PATCH] xhci: sideband: fix ring sg table pages leak

[Mathias Nyman <mathias.nyman@linux.intel.com>]

On 6/10/26 12:38, raoxu wrote:
> From: Xu Rao <raoxu@uniontech.com>
> 
> xhci_ring_to_sgtable() allocates a temporary pages array and
> uses it to build the returned sg_table with
> sg_alloc_table_from_pages().
> 
> The error paths free the pages array, but the success path
> returns the sg_table without freeing it. This leaks the temporary
> array every time a sideband client gets an endpoint or event ring
> buffer.
> 
> Free the pages array after sg_alloc_table_from_pages() succeeds.
> The returned sg_table has its own scatterlist entries and does not
> depend on the temporary array after construction.
> 
> Fixes: de66754e9f80 ("xhci: sideband: add initial api to register a secondary interrupter entity")
> 
> Signed-off-by: Xu Rao <raoxu@uniontech.com>
> ---
>   drivers/usb/host/xhci-sideband.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/host/xhci-sideband.c b/drivers/usb/host/xhci-sideband.c
> index 23153e136d4b..a5deeee4d5dc 100644
> --- a/drivers/usb/host/xhci-sideband.c
> +++ b/drivers/usb/host/xhci-sideband.c
> @@ -58,6 +58,8 @@ xhci_ring_to_sgtable(struct xhci_sideband *sb, struct xhci_ring *ring)
>   	if (sg_alloc_table_from_pages(sgt, pages, n_pages, 0, sz, GFP_KERNEL))
>   		goto err;
> 
> +	kvfree(pages);
> +
>   	/*
>   	 * Save first segment dma address to sg dma_address field for the sideband
>   	 * client to have access to the IOVA of the ring.
> --
> 2.50.1
> 

Thanks

Adding to queue,
will send forward after 7.2-rc1

-Mathias