On Tue, Oct 20, 2026 at 01:31:03PM +0100, Gary Guo wrote: > On Mon Oct 19, 2026 at 9:21 PM BST, Sami Tolvanen via B4 Relay wrote: > > From: Sami Tolvanen <[email protected]> > > > > `SGTableMap::new()` takes a pages reference and maps the table before > > `Devres::new()` allocates. If the allocation fails, dropping the map > > frees the table but keeps the reference, and the next `sg_table()` > > takes another one. `drm_gem_shmem_release()` puts only one, so the > > pages leak. > > Sorry, could you explain it in more detail? > > Creating a SGTableMap and dropping it doesn't restore the state? If so, it > sounds like an API design issue.
Yes, there are really two bugs here: 1. `SGTableMap::new()` returns `Result<Self, Error>` instead of using `init_scope()`, so `drm_gem_shmem_get_pages_sgt()` runs eagerly before `Devres::new()` allocates. 2. `SGTableMap::drop()` (`__drm_gem_shmem_free_sgt_locked()`) unmaps and frees `shmem->sgt` without dropping the `pages_use_count` reference taken by `drm_gem_shmem_get_pages_sgt()`. I'll go ahead and merge this patch since it fixes the first bug, unless I hear any complaints. Alice
