Re: [PATCH] fix: ntb: perf_copy_chunk: fix tx descriptor and unmap kref leak on dmaengine_submit failure

[Dave Jiang]

On 6/26/26 8:39 AM, WenTao Liang wrote:
> When dmaengine_submit fails after dma_set_unmap has been called, the
>   unmap object has two references (one from dmaengine_get_unmap_data and
>   one from dma_set_unmap held by the tx descriptor). The error path
>   err_free_resource only calls dmaengine_unmap_put once, leaving the tx
>   descriptor's reference and the descriptor itself leaked.
> 
> Add dmaengine_desc_put(tx) in the err_free_resource path to properly
>   release the tx descriptor and its held unmap reference.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 282a2feeb9bf ("NTB: Use DMA Engine to Transmit and Receive")
> Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>

Same comment. Please resend to ntb@xxxxxxxxxxxxxxx.


> ---
>  drivers/ntb/test/ntb_perf.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
> index dfd175f79e8f..64783bfa5a2c 100644
> --- a/drivers/ntb/test/ntb_perf.c
> +++ b/drivers/ntb/test/ntb_perf.c
> @@ -851,6 +851,7 @@ static int perf_copy_chunk(struct perf_thread *pthr,
>  	return likely(atomic_read(&pthr->perf->tsync) > 0) ? 0 : -EINTR;
>  
>  err_free_resource:
> +	dmaengine_desc_put(tx);
>  	dmaengine_unmap_put(unmap);
>  
>  	return ret;