On 2021-11-25 13:49, guangming.cao@mediatek.com wrote:

From: Guangming Guangming.Cao@mediatek.com

Use (for_each_sgtable_sg) rather than (for_each_sg) to traverse sg_table to free sg_table. Use (for_each_sg) maybe will casuse some pages can't be freed when send wrong nents number.

It's still worth spelling out that this is fixing a bug where the current code should have been using table->orig_nents - it's just that switching to the sgtable helper is the best way to make the fix, since it almost entirely removes the possibility of making that (previously rather common) mistake.

If it helps, for the change itself:

Reviewed-by: Robin Murphy robin.murphy@arm.com

Thanks, Robin.

Signed-off-by: Guangming Guangming.Cao@mediatek.com

drivers/dma-buf/heaps/system_heap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c index 23a7e74ef966..8660508f3684 100644 --- a/drivers/dma-buf/heaps/system_heap.c +++ b/drivers/dma-buf/heaps/system_heap.c @@ -289,7 +289,7 @@ static void system_heap_dma_buf_release(struct dma_buf *dmabuf) int i; table = &buffer->sg_table;

• for_each_sg(table->sgl, sg, table->nents, i) {

• for_each_sgtable_sg(table, sg, i) { struct page *page = sg_page(sg);

__free_pages(page, compound_order(page));