Re: [PATCH v4 0/3] drm/gpusvm: fix IOVA/DMA unmap leaks in __drm_gpusvm_unmap_pages()

[Matthew Brost <matthew.brost@intel.com>]

On Mon, Jul 06, 2026 at 10:46:39AM +0800, Honglei Huang wrote:
> Three small fixes for the IOVA/DMA unmap path in
> __drm_gpusvm_unmap_pages() and the get_pages() error path, all spotted by
> AI review:
> 
>   - Free the whole IOVA reservation on unmap. In a mixed range only the
>     system pages are linked, so freeing just the linked part leaks the
>     IOVA reserved for the device pages. Unlink the linked portion and
>     free the whole reservation. On the get_pages() error path
>     state_offset is 0, so skip the unlink, also avoiding the
>     uninitialised dma_addr[0].dir read, allocate dma_addr with the
>     zeroing kvzalloc_objs().
>   - Do not route system pages to device_unmap() on the IOVA path. Branch
>     off addr->proto so only real device pages reach device_unmap().
>   - Publish dpagemap early to avoid leaking device mappings on the
>     get_pages() error path. It was only stored on success, so a mid-way
>     failure left svm_pages->dpagemap NULL and skipped device_unmap().
>     Assign it when the first device page is mapped.
> 
> All three issues are preexisting and independent of the gpusvm MM/device
> state split series; they were surfaced by the AI review of that series,
> so this series addresses them separately.
> 
> V4:
>   - Add reviewed-by for Matt's review.

Thanks for the patches, going to merge this to drm-misc-fixes by EOD.

Matt

> 
> V3:
>   - Add fixes for all patches, add Cc stable.
>   - Add reviewed by in patch 1.
>   - Move AI review note into commit message instead of reported by.
> 
> V2:
>   - patch 1: extend the uninitialized dma_addr[0].dir fix into freeing
>     the whole IOVA reservation, fixing the IOVA leak for mixed ranges
>     (the earlier version only guarded the direction argument).
>   - add patch 3: publish dpagemap early to fix the device-mapping leak on
>     the get_pages() error path.
> 
> Honglei Huang (3):
>   drm/gpusvm: free the whole IOVA reservation on unmap
>   drm/gpusvm: do not route system pages to device_unmap() on IOVA unmap
>   drm/gpusvm: publish dpagemap early to avoid device mapping leak on
>     error
> 
>  drivers/gpu/drm/drm_gpusvm.c | 53 +++++++++++++++++++++++++-----------
>  1 file changed, 37 insertions(+), 16 deletions(-)
> 
> -- 
> 2.34.1
>