Re: [PATCH v2 07/11] media: intel/ipu6: fix IOVA leak on first entry failure in ipu6_dma_map_sg()

[Sakari Ailus]

Hi Valerii,

On Tue, Nov 03, 2026 at 09:11:03PM +0000, Valerii Sokolov wrote:
> If ipu6_mmu_map() fails for the first scatterlist entry,
> ipu6_dma_map_sg() calls ipu6_dma_unmap_sg() with nents == 0. That
> returns immediately, so the IOVA range allocated with alloc_iova() is
> never freed.
> 
> Free the IOVA directly when no entry has been mapped yet.
> 
> Fixes: 9163d83573e4 ("media: intel/ipu6: add IPU6 DMA mapping API and MMU table")
> Reviewed-by: Antti Laakso <antti.laakso@xxxxxxxxxxxxxxx>
> Signed-off-by: Valerii Sokolov <valerii.sokolov@xxxxx>
> ---
>  drivers/media/pci/intel/ipu6/ipu6-dma.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/pci/intel/ipu6/ipu6-dma.c b/drivers/media/pci/intel/ipu6/ipu6-dma.c
> index 90f530a937..a923a1e4bd 100644
> --- a/drivers/media/pci/intel/ipu6/ipu6-dma.c
> +++ b/drivers/media/pci/intel/ipu6/ipu6-dma.c
> @@ -444,7 +444,10 @@ int ipu6_dma_map_sg(struct ipu6_bus_device *sys, struct scatterlist *sglist,
>  	return nents;
>  
>  out_fail:
> -	ipu6_dma_unmap_sg(sys, sglist, i, dir, attrs);
> +	if (i)
> +		ipu6_dma_unmap_sg(sys, sglist, i, dir, attrs);
> +	else
> +		__free_iova(&mmu->dmap->iovad, iova);

This should be handled in ipu6_dma_unmap_sg(). I'd release the iova in the
beginning and reverse the order of the nents / iova checks.

I'll merge the rest now.

>  
>  	return 0;
>  }

-- 
Regards,

Sakari Ailus