If dma_buf_pin() fails, iopt_map_dmabuf() replaces its error with PTR_ERR(pages->dmabuf.exp_phys). The newly allocated pages object still has a NULL exp_phys, so the function detaches and returns zero. Its caller then accepts a DMA-buf pages object with no attachment.
Keep the error returned by dma_buf_pin() when unwinding the attachment. Signed-off-by: Karl Mehltretter <[email protected]> --- drivers/iommu/iommufd/pages.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index 98c2a8027..0b32c65af 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1510,10 +1510,8 @@ static int iopt_map_dmabuf(struct iommufd_ctx *ictx, struct iopt_pages *pages, } rc = dma_buf_pin(attach); - if (rc) { - rc = PTR_ERR(pages->dmabuf.exp_phys); + if (rc) goto err_detach; - } pages->dmabuf.exp_phys = dma_buf_pal_map_phys(attach); if (IS_ERR(pages->dmabuf.exp_phys)) { -- 2.39.5 (Apple Git-154)
