Re: [PATCH v4 0/3] drm/gpusvm: fix IOVA/DMA unmap leaks in __drm_gpusvm_unmap_pages()

["Huang, Honglei" <honghuan@amd.com>]

On 7/13/2026 11:59 PM, Matthew Brost wrote:
> On Mon, Jul 06, 2026 at 10:46:39AM +0800, Honglei Huang wrote:
>> Three small fixes for the IOVA/DMA unmap path in
>> __drm_gpusvm_unmap_pages() and the get_pages() error path, all spotted by
>> AI review:
>>
>>    - Free the whole IOVA reservation on unmap. In a mixed range only the
>>      system pages are linked, so freeing just the linked part leaks the
>>      IOVA reserved for the device pages. Unlink the linked portion and
>>      free the whole reservation. On the get_pages() error path
>>      state_offset is 0, so skip the unlink, also avoiding the
>>      uninitialised dma_addr[0].dir read, allocate dma_addr with the
>>      zeroing kvzalloc_objs().
>>    - Do not route system pages to device_unmap() on the IOVA path. Branch
>>      off addr->proto so only real device pages reach device_unmap().
>>    - Publish dpagemap early to avoid leaking device mappings on the
>>      get_pages() error path. It was only stored on success, so a mid-way
>>      failure left svm_pages->dpagemap NULL and skipped device_unmap().
>>      Assign it when the first device page is mapped.
>>
>> All three issues are preexisting and independent of the gpusvm MM/device
>> state split series; they were surfaced by the AI review of that series,
>> so this series addresses them separately.
>>
>> V4:
>>    - Add reviewed-by for Matt's review.
> 
> Thanks for the patches, going to merge this to drm-misc-fixes by EOD.
> 

Really thanks for the review and merging!

Regards,
Honglei

> Matt
> 
>>
>> V3:
>>    - Add fixes for all patches, add Cc stable.
>>    - Add reviewed by in patch 1.
>>    - Move AI review note into commit message instead of reported by.
>>
>> V2:
>>    - patch 1: extend the uninitialized dma_addr[0].dir fix into freeing
>>      the whole IOVA reservation, fixing the IOVA leak for mixed ranges
>>      (the earlier version only guarded the direction argument).
>>    - add patch 3: publish dpagemap early to fix the device-mapping leak on
>>      the get_pages() error path.
>>
>> Honglei Huang (3):
>>    drm/gpusvm: free the whole IOVA reservation on unmap
>>    drm/gpusvm: do not route system pages to device_unmap() on IOVA unmap
>>    drm/gpusvm: publish dpagemap early to avoid device mapping leak on
>>      error
>>
>>   drivers/gpu/drm/drm_gpusvm.c | 53 +++++++++++++++++++++++++-----------
>>   1 file changed, 37 insertions(+), 16 deletions(-)
>>
>> -- 
>> 2.34.1
>>