Re: [PATCH] dma-buf: Restore the scatterlist entry count before freeing

[Jason Gunthorpe]

On Tue, Oct 20, 2026 at 08:42:18AM +0200, Christian König wrote:
> On 10/19/26 20:31, Leon Romanovsky wrote:
> > On Tue, Oct 13, 2026 at 02:46:24PM +0300, Leon Romanovsky wrote:
> >> From: Leon Romanovsky <leonro@xxxxxxxxxx>
> >>
> >> dma_buf_phys_vec_to_sgt() clears orig_nents to mark the returned table
> >> as DMA-only. Since sg_free_table() uses orig_nents to walk and free the
> >> scatterlist, dma_buf_free_sgt() leaks the allocation on every successful
> >> map/unmap cycle.
> >>
> >> Restore orig_nents from nents before freeing the table. The helper
> >> allocates the DMA list directly, so nents retains the allocation count,
> >> including for chained scatterlists.
> >>
> >>
> >> The reported kmemleak output was:
> >>
> >> KMEMLEAK LEAK: 2 driver-related leak(s)
> >> KMEMLEAK LEAK: unreferenced object 0xff11000125ceff00 (size 32):
> >> KMEMLEAK LEAK:   comm dtr, pid 4432, jiffies 4295031027
> >> KMEMLEAK LEAK:   hex dump (first 32 bytes):
> >> KMEMLEAK LEAK:     02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
> >> KMEMLEAK LEAK:     00 00 01 00 28 38 00 00 00 10 00 00 00 00 00 00  ....(8..........
> >> KMEMLEAK LEAK:   backtrace (crc 4e8077f2):
> >> KMEMLEAK LEAK:     __kmalloc_noprof+0x451/0x8b0
> >> KMEMLEAK LEAK:     __sg_alloc_table+0x2a0/0x4d0
> >> KMEMLEAK LEAK:     sg_alloc_table+0x24/0x170
> >> KMEMLEAK LEAK:     dma_buf_phys_vec_to_sgt+0x84f/0xed0
> >> KMEMLEAK LEAK:     0xffffffffa1ad21a8
> >> KMEMLEAK LEAK:     dma_buf_map_attachment+0x138/0x690
> >> KMEMLEAK LEAK:     ib_umem_dmabuf_map_pages+0x249/0xc90 [ib_core]
> >> KMEMLEAK LEAK:     0xffffffffa138f8d2
> >> KMEMLEAK LEAK:     0xffffffffa1396abe
> >> KMEMLEAK LEAK:     0xffffffffa1331a5f
> >> KMEMLEAK LEAK:     0xffffffffa13320dd
> >> KMEMLEAK LEAK:     0xffffffffa1ad696d
> >> KMEMLEAK LEAK:     0xffffffffa1acecc7
> >> KMEMLEAK LEAK:     0xffffffffa1acfd17
> >> KMEMLEAK LEAK:     __x64_sys_ioctl+0x72c/0x11f0
> >> KMEMLEAK LEAK:     do_syscall_64+0xa1/0x4f0
> >> KMEMLEAK LEAK: unreferenced object 0xff1100016dbf3a80 (size 32):
> >> KMEMLEAK LEAK:   comm dtr, pid 4432, jiffies 4295034705
> >> KMEMLEAK LEAK:   hex dump (first 32 bytes):
> >> KMEMLEAK LEAK:     02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
> >> KMEMLEAK LEAK:     00 20 10 00 28 38 00 00 00 10 00 00 00 00 00 00  . ..(8..........
> >>
> >> Fixes: 3aa31a8bb11e ("dma-buf: provide phys_vec to scatter-gather mapping routine")
> >> Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxx>
> >> ---
> >>  drivers/dma-buf/dma-buf-mapping.c | 2 ++
> >>  1 file changed, 2 insertions(+)
> > 
> > Reminder, thanks
> 
> I'm waiting for anybody familiar with the code to review this.

Reviewed-by: Jason Gunthorpe <jgg@xxxxxxxxxx>

Jason