[PATCH] nvme-pci: fix dma mapping leak on data setup error

[PATCH] nvme-pci: fix dma mapping leak on data setup error

[Keith Busch]

From: Keith Busch <kbusch@kernel.org>

Whether we're using PRP or SGL format, we're leaking the initial DMA
mapping during iteration if we fail to allocate the tracking descriptor.
Unmap it directly; we can't use the helper because it depends on the
tracking descriptor being successfully allocated.

Signed-off-by: Keith Busch <kbusch@kernel.org>
---
I apparently have a lot more systems pushing memory utilization to the
limits and finding interesting issues.

 drivers/nvme/host/pci.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 139a10cd687f9..0dbe9ad45b548 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1006,8 +1006,12 @@ static blk_status_t nvme_pci_setup_data_prp(struct request *req,
 	unsigned int prp_len, i;
 	__le64 *prp_list;
 
-	if (!nvme_pci_prp_save_mapping(req, nvmeq->dev->dev, iter))
+	if (!nvme_pci_prp_save_mapping(req, nvmeq->dev->dev, iter)) {
+		dma_unmap_phys(nvmeq->dev->dev, iter->addr, iter->len,
+			       rq_dma_dir(req),
+			       iod->flags & IOD_DATA_MMIO ? DMA_ATTR_MMIO : 0);
 		return iter->status;
+	}
 
 	/*
 	 * PRP1 always points to the start of the DMA transfers.
@@ -1112,6 +1116,7 @@ static blk_status_t nvme_pci_setup_data_prp(struct request *req,
 	dev_err_once(nvmeq->dev->dev,
 		"Incorrectly formed request for payload:%d nents:%d\n",
 		blk_rq_payload_bytes(req), blk_rq_nr_phys_segments(req));
+	nvme_unmap_data(req);
 	return BLK_STS_IOERR;
 }
 
@@ -1155,8 +1160,13 @@ static blk_status_t nvme_pci_setup_data_sgl(struct request *req,
 
 	sg_list = dma_pool_alloc(nvme_dma_pool(nvmeq, iod), GFP_ATOMIC,
 			&sgl_dma);
-	if (!sg_list)
+	if (!sg_list) {
+		dma_unmap_phys(nvmeq->dev->dev, iter->addr, iter->len,
+			       rq_dma_dir(req),
+			       iod->flags & IOD_DATA_MMIO ? DMA_ATTR_MMIO : 0);
 		return BLK_STS_RESOURCE;
+	}
+
 	iod->descriptors[iod->nr_descriptors++] = sg_list;
 
 	do {
-- 
2.53.0-Meta

Re: [PATCH] nvme-pci: fix dma mapping leak on data setup error

[Keith Busch]

On Tue, May 19, 2026 at 01:06:14PM -0700, Keith Busch wrote:
> -	if (!nvme_pci_prp_save_mapping(req, nvmeq->dev->dev, iter))
> +	if (!nvme_pci_prp_save_mapping(req, nvmeq->dev->dev, iter)) {
> +		dma_unmap_phys(nvmeq->dev->dev, iter->addr, iter->len,
> +			       rq_dma_dir(req),
> +			       iod->flags & IOD_DATA_MMIO ? DMA_ATTR_MMIO : 0);
>  		return iter->status;
> +	}
>  
>  	/*
>  	 * PRP1 always points to the start of the DMA transfers.
> @@ -1112,6 +1116,7 @@ static blk_status_t nvme_pci_setup_data_prp(struct request *req,
>  	dev_err_once(nvmeq->dev->dev,
>  		"Incorrectly formed request for payload:%d nents:%d\n",
>  		blk_rq_payload_bytes(req), blk_rq_nr_phys_segments(req));
> +	nvme_unmap_data(req);
>  	return BLK_STS_IOERR;
>  }
>  
> @@ -1155,8 +1160,13 @@ static blk_status_t nvme_pci_setup_data_sgl(struct request *req,
>  
>  	sg_list = dma_pool_alloc(nvme_dma_pool(nvmeq, iod), GFP_ATOMIC,
>  			&sgl_dma);
> -	if (!sg_list)
> +	if (!sg_list) {
> +		dma_unmap_phys(nvmeq->dev->dev, iter->addr, iter->len,
> +			       rq_dma_dir(req),
> +			       iod->flags & IOD_DATA_MMIO ? DMA_ATTR_MMIO : 0);
>  		return BLK_STS_RESOURCE;
> +	}

Oh, these need to check dma_need_unmap() first. I'll send a v2.