Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] Memory leak of the scatterlist array when max_segment < PAGE_SIZE. --
--- Patch [1]: [PATCH v4 1/5] drm/i915/gem: Count mapped pages in a folio --- commit 3685bb29aed2da7225e7f1cb1cc9319380f378f3 Author: Krzysztof Karas <[email protected]> drm/i915/gem: Count mapped pages in a folio This commit addresses scatterlist overloading by correctly handling folio pages above the max_segment boundary, tracking the count to ensure a folio is fully covered before reading the next. Link: https://gitlab.freedesktop.org/drm/i915/kernel/-/work_items/15816 > diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c > b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c > index 06543ae60706e..af195db63038e 100644 > --- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c > +++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c [ ... ] > @@ -88,6 +91,9 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, > struct sg_table *st, > if (sg_alloc_table(st, page_count, GFP_KERNEL | __GFP_NOWARN)) > return -ENOMEM; > > + if (max_segment < PAGE_SIZE) > + return -EINVAL; > + [Severity: Medium] Does this code leak the scatterlist array when max_segment < PAGE_SIZE? Because this validation check is placed in shmem_sg_alloc_table() after sg_alloc_table() has already successfully allocated memory for st->sgl, returning directly bypasses the cleanup. It looks like we might need to call sg_free_table(st) before returning -EINVAL to avoid leaking the array. > /* > * Get the list of pages out of our struct file. They'll be pinned > * at this point until we release them. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
