[PATCH 1/1] io_uring/zcrx: fix sgtable leak on mapping failures

[PATCH 1/1] io_uring/zcrx: fix sgtable leak on mapping failures

[Pavel Begunkov]

In an unlikely case when io_populate_area_dma() fails, which could only
happen on a PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machine,
io_zcrx_map_area() will have an initialised and not freed table. It was
supposed to be cleaned up in the error path, but !is_mapped prevents
that.

Fixes: 439a98b972fbb ("io_uring/zcrx: deduplicate area mapping")
Cc: stable@vger.kernel.org
Reported-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/zcrx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 69567e19b4ca..006e1bfefa5f 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -288,6 +288,9 @@ static int io_zcrx_map_area(struct io_zcrx_ifq *ifq, struct io_zcrx_area *area)
 	}
 
 	ret = io_populate_area_dma(ifq, area);
+	if (ret && !area->mem.is_dmabuf)
+		dma_unmap_sgtable(ifq->dev, &area->mem.page_sg_table,
+				  DMA_FROM_DEVICE, IO_DMA_ATTR);
 	if (ret == 0)
 		area->is_mapped = true;
 	return ret;
-- 
2.52.0

Re: [PATCH 1/1] io_uring/zcrx: fix sgtable leak on mapping failures

[Jens Axboe]

On Sat, 14 Feb 2026 22:19:32 +0000, Pavel Begunkov wrote:
> In an unlikely case when io_populate_area_dma() fails, which could only
> happen on a PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machine,
> io_zcrx_map_area() will have an initialised and not freed table. It was
> supposed to be cleaned up in the error path, but !is_mapped prevents
> that.
> 
> 
> [...]

Applied, thanks!

[1/1] io_uring/zcrx: fix sgtable leak on mapping failures
      commit: a983aae397767e9da931128ff2b5bf9066513ce3

Best regards,
-- 
Jens Axboe