From: Koba Ko <kobak@nvidia.com>

Three resource leak fixes found by code audit:

1. memmap: pinned pages and pages array leak on WARN_ON path in
   io_region_pin_pages() — mr->pages is never assigned so the caller's
   cleanup is a no-op.

2. rsrc: kfree() used instead of io_cache_free() in
   io_buffer_register_bvec() error path — bypasses cache return.

3. zcrx: io_import_umem() leaves live pinned pages in a partially
   initialized struct on io_account_mem() failure, and
   io_release_area_mem() is not idempotent (missing pages = NULL),
   creating a double-free hazard.

Koba Ko (3):
  io_uring: fix pinned pages and pages array leak in
    io_region_pin_pages()
  io_uring/rsrc: use io_cache_free for node in io_buffer_register_bvec
    error path
  io_uring/zcrx: fix resource leak and double-free hazard in
    io_import_umem

 io_uring/memmap.c |  5 ++++-
 io_uring/rsrc.c   |  2 +-
 io_uring/zcrx.c   | 19 +++++++++++++------
 3 files changed, 18 insertions(+), 8 deletions(-)

-- 
2.43.0

On 4/8/26 12:54 AM, KobaK wrote:
> From: Koba Ko <kobak@nvidia.com>
> 
> Three resource leak fixes found by code audit:
> 
> 1. memmap: pinned pages and pages array leak on WARN_ON path in
>    io_region_pin_pages() ? mr->pages is never assigned so the caller's
>    cleanup is a no-op.
> 
> 2. rsrc: kfree() used instead of io_cache_free() in
>    io_buffer_register_bvec() error path ? bypasses cache return.
> 
> 3. zcrx: io_import_umem() leaves live pinned pages in a partially
>    initialized struct on io_account_mem() failure, and
>    io_release_area_mem() is not idempotent (missing pages = NULL),
>    creating a double-free hazard.

General advice - anyone can point an LLM at a code base and get some
reports, but please apply some actual critical thinking to the "issues"
found before blindly sending them out.

-- 
Jens Axboe