Re: [PATCH 3/3] io_uring/zcrx: fix resource leak and double-free hazard in io_import_umem

[Pavel Begunkov <asml.silence@gmail.com>]

On 4/8/26 07:54, KobaK wrote:
> From: Koba Ko <kobak@nvidia.com>
> 
> io_import_umem() has two problems:
> 
> 1. When io_account_mem() fails, the function returns an error but leaves
>     live pinned pages and sg_table in the mem struct without cleaning them
>     up. The caller happens to handle this today via io_zcrx_free_area() ->
>     io_release_area_mem(), but the contract is fragile.

That was the intention for the caller to clean it up, but in either
case the function has already been rewritten. In general, it seems
you based your patches on top of an outdated tree.

> 2. io_release_area_mem() doesn't NULL out mem->pages after kvfree(),
>     making it unsafe to call twice. Since io_zcrx_free_area() always
>     calls it during teardown, any earlier cleanup call would cause a
>     double-free.
> 
> Fix both: populate mem fields before io_account_mem() so
> io_release_area_mem() can do a proper cleanup on failure, and add
> mem->pages = NULL in io_release_area_mem() to make it idempotent.
> 
> Fixes: 262ab205180d2 ("io_uring/zcrx: account area memory")
> Signed-off-by: Koba Ko <kobak@nvidia.com>
> ---
...
>   
>   static void io_release_area_mem(struct io_zcrx_mem *mem)
> @@ -236,6 +242,7 @@ static void io_release_area_mem(struct io_zcrx_mem *mem)
>   		sg_free_table(mem->sgt);
>   		mem->sgt = NULL;
>   		kvfree(mem->pages);
> +		mem->pages = NULL;

The entire struct io_zcrx_mem / area is freed right after,
calling io_zcrx_free_area() multiple times for the same area
is not allowed.

-- 
Pavel Begunkov