From: Leon Romanovsky <[email protected]>
dma_buf_phys_vec_to_sgt() clears orig_nents to mark the returned table
as DMA-only. Since sg_free_table() uses orig_nents to walk and free the
scatterlist, dma_buf_free_sgt() leaks the allocation on every successful
map/unmap cycle.
Restore orig_nents from nents before freeing the table. The helper
allocates the DMA list directly, so nents retains the allocation count,
including for chained scatterlists.
The reported kmemleak output was:
KMEMLEAK LEAK: 2 driver-related leak(s)
KMEMLEAK LEAK: unreferenced object 0xff11000125ceff00 (size 32):
KMEMLEAK LEAK: comm dtr, pid 4432, jiffies 4295031027
KMEMLEAK LEAK: hex dump (first 32 bytes):
KMEMLEAK LEAK: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
................
KMEMLEAK LEAK: 00 00 01 00 28 38 00 00 00 10 00 00 00 00 00 00
....(8..........
KMEMLEAK LEAK: backtrace (crc 4e8077f2):
KMEMLEAK LEAK: __kmalloc_noprof+0x451/0x8b0
KMEMLEAK LEAK: __sg_alloc_table+0x2a0/0x4d0
KMEMLEAK LEAK: sg_alloc_table+0x24/0x170
KMEMLEAK LEAK: dma_buf_phys_vec_to_sgt+0x84f/0xed0
KMEMLEAK LEAK: 0xffffffffa1ad21a8
KMEMLEAK LEAK: dma_buf_map_attachment+0x138/0x690
KMEMLEAK LEAK: ib_umem_dmabuf_map_pages+0x249/0xc90 [ib_core]
KMEMLEAK LEAK: 0xffffffffa138f8d2
KMEMLEAK LEAK: 0xffffffffa1396abe
KMEMLEAK LEAK: 0xffffffffa1331a5f
KMEMLEAK LEAK: 0xffffffffa13320dd
KMEMLEAK LEAK: 0xffffffffa1ad696d
KMEMLEAK LEAK: 0xffffffffa1acecc7
KMEMLEAK LEAK: 0xffffffffa1acfd17
KMEMLEAK LEAK: __x64_sys_ioctl+0x72c/0x11f0
KMEMLEAK LEAK: do_syscall_64+0xa1/0x4f0
KMEMLEAK LEAK: unreferenced object 0xff1100016dbf3a80 (size 32):
KMEMLEAK LEAK: comm dtr, pid 4432, jiffies 4295034705
KMEMLEAK LEAK: hex dump (first 32 bytes):
KMEMLEAK LEAK: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
................
KMEMLEAK LEAK: 00 20 10 00 28 38 00 00 00 10 00 00 00 00 00 00 .
..(8..........
Fixes: 3aa31a8bb11e ("dma-buf: provide phys_vec to scatter-gather mapping
routine")
Signed-off-by: Leon Romanovsky <[email protected]>
---
drivers/dma-buf/dma-buf-mapping.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/dma-buf/dma-buf-mapping.c
b/drivers/dma-buf/dma-buf-mapping.c
index 833be519e1e6..cbdf99cb0e05 100644
--- a/drivers/dma-buf/dma-buf-mapping.c
+++ b/drivers/dma-buf/dma-buf-mapping.c
@@ -251,6 +251,8 @@ void dma_buf_free_sgt(struct dma_buf_attachment *attach,
struct sg_table *sgt,
sg_dma_len(sgl), dir, DMA_ATTR_MMIO);
}
+ /* Restore the allocation count cleared for the DMA-only table. */
+ sgt->orig_nents = sgt->nents;
sg_free_table(sgt);
kfree(dma->state);
kfree(dma);
---
base-commit: 39d3758108bb0ef9da484062d65288bbe9cada0e
change-id: 20261013-dma-buf-fixes-99dd3fd00f48
Best regards,
--
Leon Romanovsky <[email protected]>
