On 8/1/2026 9:16 PM, Pavel Begunkov wrote:
> + map = kmalloc_flex(*map, dma_list, nr_entries);
> + if (!map)
> + return ERR_PTR(-ENOMEM);
> +
> + sgt = dma_buf_map_attachment(attach, ctx->dir);
> + if (IS_ERR(sgt)) {
> + ret = PTR_ERR(sgt);
> + sgt = NULL;
> + goto err;
> + }
> +
> + for_each_sgtable_dma_sg(sgt, sg, tmp) {
> + dma_addr_t dma_addr = sg_dma_address(sg);
> + unsigned long sg_len = sg_dma_len(sg);
> +
> + if (sg_len % NVME_CTRL_PAGE_SIZE) {
> + ret = -EINVAL;
> + goto err;
> + }
> + seg_shift = min(seg_shift, __ffs(sg_len));
> +
> + while (sg_len) {
> + map->dma_list[i++] = dma_addr;
> + dma_addr += NVME_CTRL_PAGE_SIZE;
> + sg_len -= NVME_CTRL_PAGE_SIZE;
> + }
> + }
> +
> + if (WARN_ON_ONCE(seg_shift < NVME_CTRL_PAGE_SHIFT))
> + return ERR_PTR(-EFAULT);
This should be 'goto err;' instead of a direct return. If this ever
triggers, it leaks the map and already established sgt mapping.
> +
> + ret = dma_buf_io_init_map(ctx, &map->base);
> + if (ret)
> + goto err;
> + map->base.seg_shift = seg_shift;
> + map->nr_entries = nr_entries;
> + map->sgt = sgt;
> + return &map->base;
> +err:
> + if (sgt)
> + dma_buf_unmap_attachment(attach, sgt, ctx->dir);
> + kfree(map);
> + return ERR_PTR(ret);
> +}
