Re: [PATCH] rust: drm: gem: shmem: do not leak pages when sg_table() fails

[Alice Ryhl]

On Tue, Oct 20, 2026 at 01:31:03PM +0100, Gary Guo wrote:
> On Mon Oct 19, 2026 at 9:21 PM BST, Sami Tolvanen via B4 Relay wrote:
> > From: Sami Tolvanen <samitolvanen@xxxxxxxxxx>
> >
> > `SGTableMap::new()` takes a pages reference and maps the table before
> > `Devres::new()` allocates. If the allocation fails, dropping the map
> > frees the table but keeps the reference, and the next `sg_table()`
> > takes another one. `drm_gem_shmem_release()` puts only one, so the
> > pages leak.
> 
> Sorry, could you explain it in more detail?
> 
> Creating a SGTableMap and dropping it doesn't restore the state? If so, it
> sounds like an API design issue.

Yes, there are really two bugs here:

1. `SGTableMap::new()` returns `Result<Self, Error>` instead of using
   `init_scope()`, so `drm_gem_shmem_get_pages_sgt()` runs eagerly before
   `Devres::new()` allocates.
2. `SGTableMap::drop()` (`__drm_gem_shmem_free_sgt_locked()`) unmaps and
   frees `shmem->sgt` without dropping the `pages_use_count` reference
   taken by `drm_gem_shmem_get_pages_sgt()`.

I'll go ahead and merge this patch since it fixes the first bug, unless
I hear any complaints.

Alice