On 10/21/26 17:01, Jason Gunthorpe wrote: > On Tue, Oct 20, 2026 at 08:42:18AM +0200, Christian König wrote: >> On 10/19/26 20:31, Leon Romanovsky wrote: >>> On Tue, Oct 13, 2026 at 02:46:24PM +0300, Leon Romanovsky wrote: >>>> From: Leon Romanovsky <[email protected]> >>>> >>>> dma_buf_phys_vec_to_sgt() clears orig_nents to mark the returned table >>>> as DMA-only. Since sg_free_table() uses orig_nents to walk and free the >>>> scatterlist, dma_buf_free_sgt() leaks the allocation on every successful >>>> map/unmap cycle. >>>> >>>> Restore orig_nents from nents before freeing the table. The helper >>>> allocates the DMA list directly, so nents retains the allocation count, >>>> including for chained scatterlists. >>>> >>>> >>>> The reported kmemleak output was: >>>> >>>> KMEMLEAK LEAK: 2 driver-related leak(s) >>>> KMEMLEAK LEAK: unreferenced object 0xff11000125ceff00 (size 32): >>>> KMEMLEAK LEAK: comm dtr, pid 4432, jiffies 4295031027 >>>> KMEMLEAK LEAK: hex dump (first 32 bytes): >>>> KMEMLEAK LEAK: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>>> ................ >>>> KMEMLEAK LEAK: 00 00 01 00 28 38 00 00 00 10 00 00 00 00 00 00 >>>> ....(8.......... >>>> KMEMLEAK LEAK: backtrace (crc 4e8077f2): >>>> KMEMLEAK LEAK: __kmalloc_noprof+0x451/0x8b0 >>>> KMEMLEAK LEAK: __sg_alloc_table+0x2a0/0x4d0 >>>> KMEMLEAK LEAK: sg_alloc_table+0x24/0x170 >>>> KMEMLEAK LEAK: dma_buf_phys_vec_to_sgt+0x84f/0xed0 >>>> KMEMLEAK LEAK: 0xffffffffa1ad21a8 >>>> KMEMLEAK LEAK: dma_buf_map_attachment+0x138/0x690 >>>> KMEMLEAK LEAK: ib_umem_dmabuf_map_pages+0x249/0xc90 [ib_core] >>>> KMEMLEAK LEAK: 0xffffffffa138f8d2 >>>> KMEMLEAK LEAK: 0xffffffffa1396abe >>>> KMEMLEAK LEAK: 0xffffffffa1331a5f >>>> KMEMLEAK LEAK: 0xffffffffa13320dd >>>> KMEMLEAK LEAK: 0xffffffffa1ad696d >>>> KMEMLEAK LEAK: 0xffffffffa1acecc7 >>>> KMEMLEAK LEAK: 0xffffffffa1acfd17 >>>> KMEMLEAK LEAK: __x64_sys_ioctl+0x72c/0x11f0 >>>> KMEMLEAK LEAK: do_syscall_64+0xa1/0x4f0 >>>> KMEMLEAK LEAK: unreferenced object 0xff1100016dbf3a80 (size 32): >>>> KMEMLEAK LEAK: comm dtr, pid 4432, jiffies 4295034705 >>>> KMEMLEAK LEAK: hex dump (first 32 bytes): >>>> KMEMLEAK LEAK: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>>> ................ >>>> KMEMLEAK LEAK: 00 20 10 00 28 38 00 00 00 10 00 00 00 00 00 00 . >>>> ..(8.......... >>>> >>>> Fixes: 3aa31a8bb11e ("dma-buf: provide phys_vec to scatter-gather mapping >>>> routine") >>>> Signed-off-by: Leon Romanovsky <[email protected]> >>>> --- >>>> drivers/dma-buf/dma-buf-mapping.c | 2 ++ >>>> 1 file changed, 2 insertions(+) >>> >>> Reminder, thanks >> >> I'm waiting for anybody familiar with the code to review this. > > Reviewed-by: Jason Gunthorpe <[email protected]>
Pushed to drm-misc-fixes, sorry for the delay. Regards, Christian. > > Jason
