* [PATCH V1] accel/amdxdna: Fix leak when pinning ubuf pages
@ 2026-03-26 1:06 Lizhi Hou
2026-03-26 2:31 ` Mario Limonciello
0 siblings, 1 reply; 3+ messages in thread
From: Lizhi Hou @ 2026-03-26 1:06 UTC (permalink / raw)
To: ogabbay, quic_jhugo, dri-devel, mario.limonciello, maciej.falkowski
Cc: Max Zhen, linux-kernel, sonal.santan, Lizhi Hou
From: Max Zhen <max.zhen@amd.com>
When pin_user_pages_fast() returns fewer pages than requested, the pages
that were successfully pinned are not released, leading to a leak.
Fix this by unpinning any partially pinned pages before returning failure.
Fixes: bd72d4acda10 ("accel/amdxdna: Support user space allocated buffer")
Signed-off-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
---
drivers/accel/amdxdna/amdxdna_ubuf.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/accel/amdxdna/amdxdna_ubuf.c b/drivers/accel/amdxdna/amdxdna_ubuf.c
index fb999aa25318..4c0647057759 100644
--- a/drivers/accel/amdxdna/amdxdna_ubuf.c
+++ b/drivers/accel/amdxdna/amdxdna_ubuf.c
@@ -196,13 +196,17 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev,
ret = pin_user_pages_fast(va_ent[i].vaddr, npages,
FOLL_WRITE | FOLL_LONGTERM,
&ubuf->pages[start]);
- if (ret < 0 || ret != npages) {
- ret = -ENOMEM;
+ if (ret >= 0) {
+ start += ret;
+ if (ret != npages) {
+ XDNA_ERR(xdna, "Partially pinned pages %d/%u", ret, npages);
+ ret = -ENOMEM;
+ goto destroy_pages;
+ }
+ } else {
XDNA_ERR(xdna, "Failed to pin pages ret %d", ret);
goto destroy_pages;
}
-
- start += ret;
}
exp_info.ops = &amdxdna_ubuf_dmabuf_ops;
--
2.34.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH V1] accel/amdxdna: Fix leak when pinning ubuf pages
2026-03-26 1:06 [PATCH V1] accel/amdxdna: Fix leak when pinning ubuf pages Lizhi Hou
@ 2026-03-26 2:31 ` Mario Limonciello
2026-03-26 16:11 ` Lizhi Hou
0 siblings, 1 reply; 3+ messages in thread
From: Mario Limonciello @ 2026-03-26 2:31 UTC (permalink / raw)
To: Lizhi Hou, ogabbay, quic_jhugo, dri-devel, maciej.falkowski
Cc: Max Zhen, linux-kernel, sonal.santan
On 3/25/26 20:06, Lizhi Hou wrote:
> From: Max Zhen <max.zhen@amd.com>
>
> When pin_user_pages_fast() returns fewer pages than requested, the pages
> that were successfully pinned are not released, leading to a leak.
>
> Fix this by unpinning any partially pinned pages before returning failure.
>
> Fixes: bd72d4acda10 ("accel/amdxdna: Support user space allocated buffer")
> Signed-off-by: Max Zhen <max.zhen@amd.com>
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
> ---
> drivers/accel/amdxdna/amdxdna_ubuf.c | 12 ++++++++----
> 1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/accel/amdxdna/amdxdna_ubuf.c b/drivers/accel/amdxdna/amdxdna_ubuf.c
> index fb999aa25318..4c0647057759 100644
> --- a/drivers/accel/amdxdna/amdxdna_ubuf.c
> +++ b/drivers/accel/amdxdna/amdxdna_ubuf.c
> @@ -196,13 +196,17 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev,
> ret = pin_user_pages_fast(va_ent[i].vaddr, npages,
> FOLL_WRITE | FOLL_LONGTERM,
> &ubuf->pages[start]);
> - if (ret < 0 || ret != npages) {
> - ret = -ENOMEM;
> + if (ret >= 0) {
> + start += ret;
> + if (ret != npages) {
> + XDNA_ERR(xdna, "Partially pinned pages %d/%u", ret, npages);
> + ret = -ENOMEM;
> + goto destroy_pages;
> + }
> + } else {
> XDNA_ERR(xdna, "Failed to pin pages ret %d", ret);
> goto destroy_pages;
> }
> -
> - start += ret;
> }
>
> exp_info.ops = &amdxdna_ubuf_dmabuf_ops;
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH V1] accel/amdxdna: Fix leak when pinning ubuf pages
2026-03-26 2:31 ` Mario Limonciello
@ 2026-03-26 16:11 ` Lizhi Hou
0 siblings, 0 replies; 3+ messages in thread
From: Lizhi Hou @ 2026-03-26 16:11 UTC (permalink / raw)
To: Mario Limonciello, ogabbay, quic_jhugo, dri-devel, maciej.falkowski
Cc: Max Zhen, linux-kernel, sonal.santan
Applied to drm-misc-next
On 3/25/26 19:31, Mario Limonciello wrote:
>
>
> On 3/25/26 20:06, Lizhi Hou wrote:
>> From: Max Zhen <max.zhen@amd.com>
>>
>> When pin_user_pages_fast() returns fewer pages than requested, the pages
>> that were successfully pinned are not released, leading to a leak.
>>
>> Fix this by unpinning any partially pinned pages before returning
>> failure.
>>
>> Fixes: bd72d4acda10 ("accel/amdxdna: Support user space allocated
>> buffer")
>> Signed-off-by: Max Zhen <max.zhen@amd.com>
>> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
>> ---
>> drivers/accel/amdxdna/amdxdna_ubuf.c | 12 ++++++++----
>> 1 file changed, 8 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/accel/amdxdna/amdxdna_ubuf.c
>> b/drivers/accel/amdxdna/amdxdna_ubuf.c
>> index fb999aa25318..4c0647057759 100644
>> --- a/drivers/accel/amdxdna/amdxdna_ubuf.c
>> +++ b/drivers/accel/amdxdna/amdxdna_ubuf.c
>> @@ -196,13 +196,17 @@ struct dma_buf *amdxdna_get_ubuf(struct
>> drm_device *dev,
>> ret = pin_user_pages_fast(va_ent[i].vaddr, npages,
>> FOLL_WRITE | FOLL_LONGTERM,
>> &ubuf->pages[start]);
>> - if (ret < 0 || ret != npages) {
>> - ret = -ENOMEM;
>> + if (ret >= 0) {
>> + start += ret;
>> + if (ret != npages) {
>> + XDNA_ERR(xdna, "Partially pinned pages %d/%u", ret,
>> npages);
>> + ret = -ENOMEM;
>> + goto destroy_pages;
>> + }
>> + } else {
>> XDNA_ERR(xdna, "Failed to pin pages ret %d", ret);
>> goto destroy_pages;
>> }
>> -
>> - start += ret;
>> }
>> exp_info.ops = &amdxdna_ubuf_dmabuf_ops;
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-26 16:11 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-03-26 1:06 [PATCH V1] accel/amdxdna: Fix leak when pinning ubuf pages Lizhi Hou
2026-03-26 2:31 ` Mario Limonciello
2026-03-26 16:11 ` Lizhi Hou
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®