From: Keith Busch <kbusch@meta.com>
To: <linux-nvme@lists.infradead.org>, <hch@lst.de>
Cc: Keith Busch <kbusch@kernel.org>
Subject: [PATCH] nvme-pci: fix dma mapping leak on data setup error
Date: Tue, 19 May 2026 13:06:14 -0700 [thread overview]
Message-ID: <20260519200614.755159-1-kbusch@meta.com> (raw)
From: Keith Busch <kbusch@kernel.org>
Whether we're using PRP or SGL format, we're leaking the initial DMA
mapping during iteration if we fail to allocate the tracking descriptor.
Unmap it directly; we can't use the helper because it depends on the
tracking descriptor being successfully allocated.
Signed-off-by: Keith Busch <kbusch@kernel.org>
---
I apparently have a lot more systems pushing memory utilization to the
limits and finding interesting issues.
drivers/nvme/host/pci.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 139a10cd687f9..0dbe9ad45b548 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1006,8 +1006,12 @@ static blk_status_t nvme_pci_setup_data_prp(struct request *req,
unsigned int prp_len, i;
__le64 *prp_list;
- if (!nvme_pci_prp_save_mapping(req, nvmeq->dev->dev, iter))
+ if (!nvme_pci_prp_save_mapping(req, nvmeq->dev->dev, iter)) {
+ dma_unmap_phys(nvmeq->dev->dev, iter->addr, iter->len,
+ rq_dma_dir(req),
+ iod->flags & IOD_DATA_MMIO ? DMA_ATTR_MMIO : 0);
return iter->status;
+ }
/*
* PRP1 always points to the start of the DMA transfers.
@@ -1112,6 +1116,7 @@ static blk_status_t nvme_pci_setup_data_prp(struct request *req,
dev_err_once(nvmeq->dev->dev,
"Incorrectly formed request for payload:%d nents:%d\n",
blk_rq_payload_bytes(req), blk_rq_nr_phys_segments(req));
+ nvme_unmap_data(req);
return BLK_STS_IOERR;
}
@@ -1155,8 +1160,13 @@ static blk_status_t nvme_pci_setup_data_sgl(struct request *req,
sg_list = dma_pool_alloc(nvme_dma_pool(nvmeq, iod), GFP_ATOMIC,
&sgl_dma);
- if (!sg_list)
+ if (!sg_list) {
+ dma_unmap_phys(nvmeq->dev->dev, iter->addr, iter->len,
+ rq_dma_dir(req),
+ iod->flags & IOD_DATA_MMIO ? DMA_ATTR_MMIO : 0);
return BLK_STS_RESOURCE;
+ }
+
iod->descriptors[iod->nr_descriptors++] = sg_list;
do {
--
2.53.0-Meta
next reply other threads:[~2026-05-19 20:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-19 20:06 Keith Busch [this message]
2026-05-19 22:33 ` [PATCH] nvme-pci: fix dma mapping leak on data setup error Keith Busch
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260519200614.755159-1-kbusch@meta.com \
--to=kbusch@meta.com \
--cc=hch@lst.de \
--cc=kbusch@kernel.org \
--cc=linux-nvme@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox