Re: [PATCH v5 09/16] nvme-pci: implement dma-buf backed requests

[Anuj Gupta/Anuj Gupta <anuj20.g@samsung.com>]

On 8/1/2026 9:16 PM, Pavel Begunkov wrote:
> +	map = kmalloc_flex(*map, dma_list, nr_entries);
> +	if (!map)
> +		return ERR_PTR(-ENOMEM);
> +
> +	sgt = dma_buf_map_attachment(attach, ctx->dir);
> +	if (IS_ERR(sgt)) {
> +		ret = PTR_ERR(sgt);
> +		sgt = NULL;
> +		goto err;
> +	}
> +
> +	for_each_sgtable_dma_sg(sgt, sg, tmp) {
> +		dma_addr_t dma_addr = sg_dma_address(sg);
> +		unsigned long sg_len = sg_dma_len(sg);
> +
> +		if (sg_len % NVME_CTRL_PAGE_SIZE) {
> +			ret = -EINVAL;
> +			goto err;
> +		}
> +		seg_shift = min(seg_shift, __ffs(sg_len));
> +
> +		while (sg_len) {
> +			map->dma_list[i++] = dma_addr;
> +			dma_addr += NVME_CTRL_PAGE_SIZE;
> +			sg_len -= NVME_CTRL_PAGE_SIZE;
> +		}
> +	}
> +
> +	if (WARN_ON_ONCE(seg_shift < NVME_CTRL_PAGE_SHIFT))
> +		return ERR_PTR(-EFAULT);

This should be 'goto err;' instead of a direct return. If this ever 
triggers, it leaks the map and already established sgt mapping.

> +
> +	ret = dma_buf_io_init_map(ctx, &map->base);
> +	if (ret)
> +		goto err;
> +	map->base.seg_shift = seg_shift;
> +	map->nr_entries = nr_entries;
> +	map->sgt = sgt;
> +	return &map->base;
> +err:
> +	if (sgt)
> +		dma_buf_unmap_attachment(attach, sgt, ctx->dir);
> +	kfree(map);
> +	return ERR_PTR(ret);
> +}