From: Pavel Begunkov <asml.silence@gmail.com>
Date: Mon, 21 Jul 2025 09:56:22 +0000 (+0100)
Subject: io_uring/zcrx: fix leaking pages on sg init fail
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d9f595b9a65e9c9eb03e21f3db98fde158d128db;p=thirdparty%2Fkernel%2Flinux.git

io_uring/zcrx: fix leaking pages on sg init fail

If sg_alloc_table_from_pages() fails, io_import_umem() returns without
cleaning up pinned pages first. Fix it.

Fixes: b84621d96ee02 ("io_uring/zcrx: allocate sgtable for umem areas")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/9fd94d1bc8c316611eccfec7579799182ff3fb0a.1753091564.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 6a983f1ab592e..2d8bc42194633 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -194,8 +194,10 @@ static int io_import_umem(struct io_zcrx_ifq *ifq,
 	ret = sg_alloc_table_from_pages(&mem->page_sg_table, pages, nr_pages,
 					0, nr_pages << PAGE_SHIFT,
 					GFP_KERNEL_ACCOUNT);
-	if (ret)
+	if (ret) {
+		unpin_user_pages(pages, nr_pages);
 		return ret;
+	}
 
 	mem->account_pages = io_count_account_pages(pages, nr_pages);
 	ret = io_account_mem(ifq->ctx, mem->account_pages);