[PATCH] fix: ntb: perf_copy_chunk: fix tx descriptor and unmap kref leak on dmaengine_submit failure

[PATCH] fix: ntb: perf_copy_chunk: fix tx descriptor and unmap kref leak on dmaengine_submit failure

[WenTao Liang]

When dmaengine_submit fails after dma_set_unmap has been called, the
  unmap object has two references (one from dmaengine_get_unmap_data and
  one from dma_set_unmap held by the tx descriptor). The error path
  err_free_resource only calls dmaengine_unmap_put once, leaving the tx
  descriptor's reference and the descriptor itself leaked.

Add dmaengine_desc_put(tx) in the err_free_resource path to properly
  release the tx descriptor and its held unmap reference.

Cc: stable@vger.kernel.org
Fixes: 282a2feeb9bf ("NTB: Use DMA Engine to Transmit and Receive")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
---
 drivers/ntb/test/ntb_perf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
index dfd175f79e8f..64783bfa5a2c 100644
--- a/drivers/ntb/test/ntb_perf.c
+++ b/drivers/ntb/test/ntb_perf.c
@@ -851,6 +851,7 @@ static int perf_copy_chunk(struct perf_thread *pthr,
 	return likely(atomic_read(&pthr->perf->tsync) > 0) ? 0 : -EINTR;
 
 err_free_resource:
+	dmaengine_desc_put(tx);
 	dmaengine_unmap_put(unmap);
 
 	return ret;
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] fix: ntb: perf_copy_chunk: fix tx descriptor and unmap kref leak on dmaengine_submit failure

[Dave Jiang]

On 6/26/26 8:39 AM, WenTao Liang wrote:
> When dmaengine_submit fails after dma_set_unmap has been called, the
>   unmap object has two references (one from dmaengine_get_unmap_data and
>   one from dma_set_unmap held by the tx descriptor). The error path
>   err_free_resource only calls dmaengine_unmap_put once, leaving the tx
>   descriptor's reference and the descriptor itself leaked.
> 
> Add dmaengine_desc_put(tx) in the err_free_resource path to properly
>   release the tx descriptor and its held unmap reference.
> 
> Cc: stable@vger.kernel.org
> Fixes: 282a2feeb9bf ("NTB: Use DMA Engine to Transmit and Receive")
> Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>

Same comment. Please resend to ntb@lists.linux.dev.


> ---
>  drivers/ntb/test/ntb_perf.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c
> index dfd175f79e8f..64783bfa5a2c 100644
> --- a/drivers/ntb/test/ntb_perf.c
> +++ b/drivers/ntb/test/ntb_perf.c
> @@ -851,6 +851,7 @@ static int perf_copy_chunk(struct perf_thread *pthr,
>  	return likely(atomic_read(&pthr->perf->tsync) > 0) ? 0 : -EINTR;
>  
>  err_free_resource:
> +	dmaengine_desc_put(tx);
>  	dmaengine_unmap_put(unmap);
>  
>  	return ret;

Re: [PATCH] fix: ntb: perf_copy_chunk: fix tx descriptor and unmap kref leak on dmaengine_submit failure

[kernel test robot]

Hi WenTao,

kernel test robot noticed the following build errors:

[auto build test ERROR on jonmason-ntb/ntb-next]
[also build test ERROR on linus/master v7.2-rc6 next-20260805]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/WenTao-Liang/fix-ntb-perf_copy_chunk-fix-tx-descriptor-and-unmap-kref-leak-on-dmaengine_submit-failure/20260806-074331
base:   https://github.com/jonmason/ntb ntb-next
patch link:    https://lore.kernel.org/r/20260626153917.53128-1-vulab%40iscas.ac.cn
patch subject: [PATCH] fix: ntb: perf_copy_chunk: fix tx descriptor and unmap kref leak on   dmaengine_submit failure
config: alpha-allmodconfig (https://download.01.org/0day-ci/archive/20260806/202608061007.81Ieq7bt-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260806/202608061007.81Ieq7bt-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608061007.81Ieq7bt-lkp@intel.com/

All errors (new ones prefixed by >>):

   drivers/ntb/test/ntb_perf.c: In function 'perf_copy_chunk':
>> drivers/ntb/test/ntb_perf.c:854:9: error: implicit declaration of function 'dmaengine_desc_put'; did you mean 'dmaengine_desc_free'? [-Wimplicit-function-declaration]
     854 |         dmaengine_desc_put(tx);
         |         ^~~~~~~~~~~~~~~~~~
         |         dmaengine_desc_free


vim +854 drivers/ntb/test/ntb_perf.c

   784	
   785	static int perf_copy_chunk(struct perf_thread *pthr,
   786				   void __iomem *dst, void *src, size_t len)
   787	{
   788		struct dma_async_tx_descriptor *tx;
   789		struct dmaengine_unmap_data *unmap;
   790		struct device *dma_dev;
   791		int try = 0, ret = 0;
   792		struct perf_peer *peer = pthr->perf->test_peer;
   793		void __iomem *vbase;
   794		void __iomem *dst_vaddr;
   795		dma_addr_t dst_dma_addr;
   796	
   797		if (!use_dma) {
   798			memcpy_toio(dst, src, len);
   799			goto ret_check_tsync;
   800		}
   801	
   802		dma_dev = pthr->dma_chan->device->dev;
   803	
   804		if (!is_dma_copy_aligned(pthr->dma_chan->device, offset_in_page(src),
   805					 offset_in_page(dst), len))
   806			return -EIO;
   807	
   808		vbase = peer->outbuf;
   809		dst_vaddr = dst;
   810		dst_dma_addr = peer->dma_dst_addr + (dst_vaddr - vbase);
   811	
   812		unmap = dmaengine_get_unmap_data(dma_dev, 1, GFP_NOWAIT);
   813		if (!unmap)
   814			return -ENOMEM;
   815	
   816		unmap->len = len;
   817		unmap->addr[0] = dma_map_page(dma_dev, virt_to_page(src),
   818			offset_in_page(src), len, DMA_TO_DEVICE);
   819		if (dma_mapping_error(dma_dev, unmap->addr[0])) {
   820			ret = -EIO;
   821			goto err_free_resource;
   822		}
   823		unmap->to_cnt = 1;
   824	
   825		do {
   826			tx = dmaengine_prep_dma_memcpy(pthr->dma_chan, dst_dma_addr,
   827				unmap->addr[0], len, DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
   828			if (!tx)
   829				msleep(DMA_MDELAY);
   830		} while (!tx && (try++ < DMA_TRIES));
   831	
   832		if (!tx) {
   833			ret = -EIO;
   834			goto err_free_resource;
   835		}
   836	
   837		tx->callback = perf_dma_copy_callback;
   838		tx->callback_param = pthr;
   839		dma_set_unmap(tx, unmap);
   840	
   841		ret = dma_submit_error(dmaengine_submit(tx));
   842		if (ret)
   843			goto err_free_resource;
   844	
   845		dmaengine_unmap_put(unmap);
   846	
   847		atomic_inc(&pthr->dma_sync);
   848		dma_async_issue_pending(pthr->dma_chan);
   849	
   850	ret_check_tsync:
   851		return likely(atomic_read(&pthr->perf->tsync) > 0) ? 0 : -EINTR;
   852	
   853	err_free_resource:
 > 854		dmaengine_desc_put(tx);
   855		dmaengine_unmap_put(unmap);
   856	
   857		return ret;
   858	}
   859	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH] fix: ntb: perf_copy_chunk: fix tx descriptor and unmap kref leak on dmaengine_submit failure

[kernel test robot]

Hi WenTao,

kernel test robot noticed the following build errors:

[auto build test ERROR on jonmason-ntb/ntb-next]
[also build test ERROR on linus/master v7.2-rc6]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/WenTao-Liang/fix-ntb-perf_copy_chunk-fix-tx-descriptor-and-unmap-kref-leak-on-dmaengine_submit-failure/20260806-074331
base:   https://github.com/jonmason/ntb ntb-next
patch link:    https://lore.kernel.org/r/20260626153917.53128-1-vulab%40iscas.ac.cn
patch subject: [PATCH] fix: ntb: perf_copy_chunk: fix tx descriptor and unmap kref leak on   dmaengine_submit failure
config: x86_64-buildonly-randconfig-004-20260806 (https://download.01.org/0day-ci/archive/20260806/202608062211.ndlKUG0U-lkp@intel.com/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
rustc: rustc 1.96.0 (ac68faa20 2026-05-25)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260806/202608062211.ndlKUG0U-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608062211.ndlKUG0U-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/ntb/test/ntb_perf.c:854:2: error: call to undeclared function 'dmaengine_desc_put'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
     854 |         dmaengine_desc_put(tx);
         |         ^
   drivers/ntb/test/ntb_perf.c:854:2: note: did you mean 'dmaengine_desc_free'?
   include/linux/dmaengine.h:1607:19: note: 'dmaengine_desc_free' declared here
    1607 | static inline int dmaengine_desc_free(struct dma_async_tx_descriptor *desc)
         |                   ^
   1 error generated.


vim +/dmaengine_desc_put +854 drivers/ntb/test/ntb_perf.c

   784	
   785	static int perf_copy_chunk(struct perf_thread *pthr,
   786				   void __iomem *dst, void *src, size_t len)
   787	{
   788		struct dma_async_tx_descriptor *tx;
   789		struct dmaengine_unmap_data *unmap;
   790		struct device *dma_dev;
   791		int try = 0, ret = 0;
   792		struct perf_peer *peer = pthr->perf->test_peer;
   793		void __iomem *vbase;
   794		void __iomem *dst_vaddr;
   795		dma_addr_t dst_dma_addr;
   796	
   797		if (!use_dma) {
   798			memcpy_toio(dst, src, len);
   799			goto ret_check_tsync;
   800		}
   801	
   802		dma_dev = pthr->dma_chan->device->dev;
   803	
   804		if (!is_dma_copy_aligned(pthr->dma_chan->device, offset_in_page(src),
   805					 offset_in_page(dst), len))
   806			return -EIO;
   807	
   808		vbase = peer->outbuf;
   809		dst_vaddr = dst;
   810		dst_dma_addr = peer->dma_dst_addr + (dst_vaddr - vbase);
   811	
   812		unmap = dmaengine_get_unmap_data(dma_dev, 1, GFP_NOWAIT);
   813		if (!unmap)
   814			return -ENOMEM;
   815	
   816		unmap->len = len;
   817		unmap->addr[0] = dma_map_page(dma_dev, virt_to_page(src),
   818			offset_in_page(src), len, DMA_TO_DEVICE);
   819		if (dma_mapping_error(dma_dev, unmap->addr[0])) {
   820			ret = -EIO;
   821			goto err_free_resource;
   822		}
   823		unmap->to_cnt = 1;
   824	
   825		do {
   826			tx = dmaengine_prep_dma_memcpy(pthr->dma_chan, dst_dma_addr,
   827				unmap->addr[0], len, DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
   828			if (!tx)
   829				msleep(DMA_MDELAY);
   830		} while (!tx && (try++ < DMA_TRIES));
   831	
   832		if (!tx) {
   833			ret = -EIO;
   834			goto err_free_resource;
   835		}
   836	
   837		tx->callback = perf_dma_copy_callback;
   838		tx->callback_param = pthr;
   839		dma_set_unmap(tx, unmap);
   840	
   841		ret = dma_submit_error(dmaengine_submit(tx));
   842		if (ret)
   843			goto err_free_resource;
   844	
   845		dmaengine_unmap_put(unmap);
   846	
   847		atomic_inc(&pthr->dma_sync);
   848		dma_async_issue_pending(pthr->dma_chan);
   849	
   850	ret_check_tsync:
   851		return likely(atomic_read(&pthr->perf->tsync) > 0) ? 0 : -EINTR;
   852	
   853	err_free_resource:
 > 854		dmaengine_desc_put(tx);
   855		dmaengine_unmap_put(unmap);
   856	
   857		return ret;
   858	}
   859	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki