Re: [PATCH] ALSA: memalloc: Free the new pages when WC DMA mapping fails

[Takashi Iwai <tiwai@suse.de>]

On Wed, 28 Oct 2026 15:44:41 +0100,
Sasha Levin wrote:
> 
> snd_dma_wc_alloc() keeps the newly allocated pages in a local variable,
> and snd_dma_alloc_dir_pages() stores them in dmab->area only after
> ->alloc() returns.  If dma_map_single() fails, the error path passes
> dmab->area to do_free_pages() instead, and that is still NULL at this
> point for the usual callers.
> 
> The pages are then leaked with their write-combining attribute still
> set, set_memory_wb() warns about the zero address, and for buffers
> larger than a page free_pages_exact() goes on to free the struct pages
> of the bogus addresses 4096, 8192 and so on.  With CONFIG_DEBUG_VM that
> hits the VM_BUG_ON() in free_pages():
> 
>   kernel BUG at mm/page_alloc.c:5600!
>   RIP: 0010:free_pages_exact+0xcb/0xd0
>   Call Trace:
>    snd_dma_wc_alloc+0x14f/0x160 [snd_pcm]
>    snd_dma_alloc_dir_pages+0x4f/0x80 [snd_pcm]
> 
> This was reproduced on an x86 guest without swiotlb by allocating
> SNDRV_DMA_TYPE_DEV_WC buffers for a device with a 24-bit streaming DMA
> mask, so that dma_map_single() fails.
> 
> Free the pages that were just allocated.
> 
> Fixes: c880a5146642 ("ALSA: memalloc: Use proper DMA mapping API for x86 WC buffer allocations")
> Signed-off-by: Sasha Levin <sashal@kernel.org>

Applied now.  Thanks.


Takashi