All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2 0/3] drm/gpusvm: fix IOVA/DMA unmap leaks in __drm_gpusvm_unmap_pages()
@ 2026-06-30  3:40 Honglei Huang
  2026-06-30  3:40 ` [PATCH v2 1/3] drm/gpusvm: free the whole IOVA reservation on unmap Honglei Huang
                   ` (5 more replies)
  0 siblings, 6 replies; 10+ messages in thread
From: Honglei Huang @ 2026-06-30  3:40 UTC (permalink / raw)
  To: intel-xe; +Cc: honghuan

Three small fixes for the IOVA/DMA unmap path in
__drm_gpusvm_unmap_pages() and the get_pages() error path, all spotted by
AI review:

  - Free the whole IOVA reservation on unmap. In a mixed range only the
    system pages are linked, so freeing just the linked part leaks the
    IOVA reserved for the device pages. Unlink the linked portion and
    free the whole reservation. On the get_pages() error path
    state_offset is 0, so skip the unlink, also avoiding the
    uninitialised dma_addr[0].dir read, allocate dma_addr with the
    zeroing kvzalloc_objs().
  - Do not route system pages to device_unmap() on the IOVA path. Branch
    off addr->proto so only real device pages reach device_unmap().
  - Publish dpagemap early to avoid leaking device mappings on the
    get_pages() error path. It was only stored on success, so a mid-way
    failure left svm_pages->dpagemap NULL and skipped device_unmap().
    Assign it when the first device page is mapped.

All three issues are preexisting and independent of the gpusvm MM/device
state split series; they were surfaced by the AI review of that series,
so this series addresses them separately.

V2:
  - patch 1: extend the uninitialized dma_addr[0].dir fix into freeing
    the whole IOVA reservation, fixing the IOVA leak for mixed ranges
    (the earlier version only guarded the direction argument).
  - add patch 3: publish dpagemap early to fix the device-mapping leak on
    the get_pages() error path.

Honglei Huang (3):
  drm/gpusvm: free the whole IOVA reservation on unmap
  drm/gpusvm: do not route system pages to device_unmap() on IOVA unmap
  drm/gpusvm: publish dpagemap early to avoid device mapping leak on
    error

 drivers/gpu/drm/drm_gpusvm.c | 53 +++++++++++++++++++++++++-----------
 1 file changed, 37 insertions(+), 16 deletions(-)

-- 
2.34.1


^ permalink raw reply	[flat|nested] 10+ messages in thread
* [PATCH v2 0/3] drm/gpusvm: fix IOVA/DMA unmap leaks in __drm_gpusvm_unmap_pages()
@ 2026-06-28  6:17 Honglei Huang
  2026-06-28  6:17 ` [PATCH v2 1/3] drm/gpusvm: free the whole IOVA reservation on unmap Honglei Huang
  0 siblings, 1 reply; 10+ messages in thread
From: Honglei Huang @ 2026-06-28  6:17 UTC (permalink / raw)
  To: sima, matthew.brost, rodrigo.vivi, thomas.hellstrom, dakr,
	intel-xe
  Cc: Ray.Huang, dri-devel, honghuan

From: Honglei Huang <honghuan@amd.com>

Three small fixes for the IOVA/DMA unmap path in
__drm_gpusvm_unmap_pages() and the get_pages() error path, all spotted by
AI review:

  - Free the whole IOVA reservation on unmap. In a mixed range only the
    system pages are linked, so freeing just the linked part leaks the
    IOVA reserved for the device pages. Unlink the linked portion and
    free the whole reservation. On the get_pages() error path
    state_offset is 0, so skip the unlink, also avoiding the
    uninitialised dma_addr[0].dir read, allocate dma_addr with the
    zeroing kvzalloc_objs().
  - Do not route system pages to device_unmap() on the IOVA path. Branch
    off addr->proto so only real device pages reach device_unmap().
  - Publish dpagemap early to avoid leaking device mappings on the
    get_pages() error path. It was only stored on success, so a mid-way
    failure left svm_pages->dpagemap NULL and skipped device_unmap().
    Assign it when the first device page is mapped.

All three issues are preexisting and independent of the gpusvm MM/device
state split series; they were surfaced by the AI review of that series,
so this series addresses them separately.

V2:
  - patch 1: extend the uninitialized dma_addr[0].dir fix into freeing
    the whole IOVA reservation, fixing the IOVA leak for mixed ranges
    (the earlier version only guarded the direction argument).
  - add patch 3: publish dpagemap early to fix the device-mapping leak on
    the get_pages() error path.

Honglei Huang (3):
  drm/gpusvm: free the whole IOVA reservation on unmap
  drm/gpusvm: do not route system pages to device_unmap() on IOVA unmap
  drm/gpusvm: publish dpagemap early to avoid device mapping leak on
    error

 drivers/gpu/drm/drm_gpusvm.c | 53 +++++++++++++++++++++++++-----------
 1 file changed, 37 insertions(+), 16 deletions(-)

-- 
2.34.1


^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2026-06-30  7:15 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-30  3:40 [PATCH v2 0/3] drm/gpusvm: fix IOVA/DMA unmap leaks in __drm_gpusvm_unmap_pages() Honglei Huang
2026-06-30  3:40 ` [PATCH v2 1/3] drm/gpusvm: free the whole IOVA reservation on unmap Honglei Huang
2026-06-30  4:04   ` Matthew Brost
2026-06-30  5:43     ` Huang, Honglei
2026-06-30  3:40 ` [PATCH v2 2/3] drm/gpusvm: do not route system pages to device_unmap() on IOVA unmap Honglei Huang
2026-06-30  3:40 ` [PATCH v2 3/3] drm/gpusvm: publish dpagemap early to avoid device mapping leak on error Honglei Huang
2026-06-30  6:18 ` ✗ CI.checkpatch: warning for drm/gpusvm: fix IOVA/DMA unmap leaks in __drm_gpusvm_unmap_pages() Patchwork
2026-06-30  6:19 ` ✓ CI.KUnit: success " Patchwork
2026-06-30  7:15 ` ✓ Xe.CI.BAT: " Patchwork
  -- strict thread matches above, loose matches on Subject: below --
2026-06-28  6:17 [PATCH v2 0/3] " Honglei Huang
2026-06-28  6:17 ` [PATCH v2 1/3] drm/gpusvm: free the whole IOVA reservation on unmap Honglei Huang

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.