* [PATCH] nvme-tcp: fix memory leak when freeing a queue
@ 2021-11-03 8:18 Maurizio Lombardi
2021-11-03 9:23 ` Sagi Grimberg
2021-11-11 10:00 ` Christoph Hellwig
0 siblings, 2 replies; 8+ messages in thread
From: Maurizio Lombardi @ 2021-11-03 8:18 UTC (permalink / raw)
To: linux-nvme; +Cc: kbusch, axboe, hch, sagi
Release the page frag cache when tearing down the io queues
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
---
drivers/nvme/host/tcp.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 07156ea9d1a8..999417626b15 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1229,6 +1229,7 @@ static int nvme_tcp_alloc_async_req(struct nvme_tcp_ctrl *ctrl)
static void nvme_tcp_free_queue(struct nvme_ctrl *nctrl, int qid)
{
+ struct page *page;
struct nvme_tcp_ctrl *ctrl = to_tcp_ctrl(nctrl);
struct nvme_tcp_queue *queue = &ctrl->queues[qid];
@@ -1238,6 +1239,11 @@ static void nvme_tcp_free_queue(struct nvme_ctrl *nctrl, int qid)
if (queue->hdr_digest || queue->data_digest)
nvme_tcp_free_crypto(queue);
+ if (queue->pf_cache.va) {
+ page = virt_to_head_page(queue->pf_cache.va);
+ __page_frag_cache_drain(page, queue->pf_cache.pagecnt_bias);
+ queue->pf_cache.va = NULL;
+ }
sock_release(queue->sock);
kfree(queue->pdu);
mutex_destroy(&queue->send_mutex);
--
2.27.0
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH] nvme-tcp: fix memory leak when freeing a queue
2021-11-03 8:18 [PATCH] nvme-tcp: fix memory leak when freeing a queue Maurizio Lombardi
@ 2021-11-03 9:23 ` Sagi Grimberg
2021-11-03 10:45 ` Maurizio Lombardi
2021-11-11 10:00 ` Christoph Hellwig
1 sibling, 1 reply; 8+ messages in thread
From: Sagi Grimberg @ 2021-11-03 9:23 UTC (permalink / raw)
To: Maurizio Lombardi, linux-nvme; +Cc: kbusch, axboe, hch
> Release the page frag cache when tearing down the io queues
>
> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
> ---
> drivers/nvme/host/tcp.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
> index 07156ea9d1a8..999417626b15 100644
> --- a/drivers/nvme/host/tcp.c
> +++ b/drivers/nvme/host/tcp.c
> @@ -1229,6 +1229,7 @@ static int nvme_tcp_alloc_async_req(struct nvme_tcp_ctrl *ctrl)
>
> static void nvme_tcp_free_queue(struct nvme_ctrl *nctrl, int qid)
> {
> + struct page *page;
> struct nvme_tcp_ctrl *ctrl = to_tcp_ctrl(nctrl);
> struct nvme_tcp_queue *queue = &ctrl->queues[qid];
>
> @@ -1238,6 +1239,11 @@ static void nvme_tcp_free_queue(struct nvme_ctrl *nctrl, int qid)
> if (queue->hdr_digest || queue->data_digest)
> nvme_tcp_free_crypto(queue);
>
> + if (queue->pf_cache.va) {
> + page = virt_to_head_page(queue->pf_cache.va);
> + __page_frag_cache_drain(page, queue->pf_cache.pagecnt_bias);
> + queue->pf_cache.va = NULL;
> + }
Thanks Maurizio,
Why do we need to the pf_cache.va protection? nvme_tcp_free_queue
is already protected against re-entry with the NVME_TCP_Q_ALLOCATED
bit.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] nvme-tcp: fix memory leak when freeing a queue
2021-11-03 9:23 ` Sagi Grimberg
@ 2021-11-03 10:45 ` Maurizio Lombardi
2021-11-03 11:03 ` Maurizio Lombardi
0 siblings, 1 reply; 8+ messages in thread
From: Maurizio Lombardi @ 2021-11-03 10:45 UTC (permalink / raw)
To: Sagi Grimberg; +Cc: linux-nvme, kbusch, axboe, hch
On Wed, Nov 03, 2021 at 11:23:45AM +0200, Sagi Grimberg wrote:
>
> > Release the page frag cache when tearing down the io queues
> >
> > Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
> > ---
> > drivers/nvme/host/tcp.c | 6 ++++++
> > 1 file changed, 6 insertions(+)
> >
> > diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
> > index 07156ea9d1a8..999417626b15 100644
> > --- a/drivers/nvme/host/tcp.c
> > +++ b/drivers/nvme/host/tcp.c
> > @@ -1229,6 +1229,7 @@ static int nvme_tcp_alloc_async_req(struct nvme_tcp_ctrl *ctrl)
> > static void nvme_tcp_free_queue(struct nvme_ctrl *nctrl, int qid)
> > {
> > + struct page *page;
> > struct nvme_tcp_ctrl *ctrl = to_tcp_ctrl(nctrl);
> > struct nvme_tcp_queue *queue = &ctrl->queues[qid];
> > @@ -1238,6 +1239,11 @@ static void nvme_tcp_free_queue(struct nvme_ctrl *nctrl, int qid)
> > if (queue->hdr_digest || queue->data_digest)
> > nvme_tcp_free_crypto(queue);
> > + if (queue->pf_cache.va) {
> > + page = virt_to_head_page(queue->pf_cache.va);
> > + __page_frag_cache_drain(page, queue->pf_cache.pagecnt_bias);
> > + queue->pf_cache.va = NULL;
> > + }
>
> Thanks Maurizio,
>
> Why do we need to the pf_cache.va protection? nvme_tcp_free_queue
> is already protected against re-entry with the NVME_TCP_Q_ALLOCATED
> bit.
>
It's not the re-entry what worried me, I thought that nvme_tcp_free_queue()
might be called before page_frag_alloc() had the chance to initialize the pf_cache, triggering
a NULL pointer dereference. I am doing some tests right now and it seems not to be
possible so maybe we can drop the "if".
However, we still need to set pf_cache.va to NULL because the queues might be re-used
in the error code path and we have to prevent page_frag_alloc() from dereferencing a
freed cache page and corrupting the memory.
Maurizio
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] nvme-tcp: fix memory leak when freeing a queue
2021-11-03 10:45 ` Maurizio Lombardi
@ 2021-11-03 11:03 ` Maurizio Lombardi
2021-11-09 8:13 ` Christoph Hellwig
0 siblings, 1 reply; 8+ messages in thread
From: Maurizio Lombardi @ 2021-11-03 11:03 UTC (permalink / raw)
To: Sagi Grimberg; +Cc: linux-nvme, kbusch, axboe, hch
> >
> > Thanks Maurizio,
> >
> > Why do we need to the pf_cache.va protection? nvme_tcp_free_queue
> > is already protected against re-entry with the NVME_TCP_Q_ALLOCATED
> > bit.
> >
>
> It's not the re-entry what worried me, I thought that nvme_tcp_free_queue()
> might be called before page_frag_alloc() had the chance to initialize the pf_cache, triggering
> a NULL pointer dereference. I am doing some tests right now and it seems not to be
> possible so maybe we can drop the "if".
Oh wait, if nvme_tcp_setup_ctrl() fails it could call nvme_tcp_destroy_io_queues() and
iI guess that in that case the pf_cache is not initialized, so the if(pf_cache.va) protection
is necessary.
Maurizio
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] nvme-tcp: fix memory leak when freeing a queue
2021-11-03 11:03 ` Maurizio Lombardi
@ 2021-11-09 8:13 ` Christoph Hellwig
2021-11-09 15:37 ` John Meneghini
2021-11-09 15:54 ` Sagi Grimberg
0 siblings, 2 replies; 8+ messages in thread
From: Christoph Hellwig @ 2021-11-09 8:13 UTC (permalink / raw)
To: Maurizio Lombardi; +Cc: Sagi Grimberg, linux-nvme, kbusch, axboe, hch
On Wed, Nov 03, 2021 at 12:03:10PM +0100, Maurizio Lombardi wrote:
> > >
> > > Thanks Maurizio,
> > >
> > > Why do we need to the pf_cache.va protection? nvme_tcp_free_queue
> > > is already protected against re-entry with the NVME_TCP_Q_ALLOCATED
> > > bit.
> > >
> >
> > It's not the re-entry what worried me, I thought that nvme_tcp_free_queue()
> > might be called before page_frag_alloc() had the chance to initialize the pf_cache, triggering
> > a NULL pointer dereference. I am doing some tests right now and it seems not to be
> > possible so maybe we can drop the "if".
>
> Oh wait, if nvme_tcp_setup_ctrl() fails it could call nvme_tcp_destroy_io_queues() and
> iI guess that in that case the pf_cache is not initialized, so the if(pf_cache.va) protection
> is necessary.
Sagi, does this look good to you now?
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] nvme-tcp: fix memory leak when freeing a queue
2021-11-09 8:13 ` Christoph Hellwig
@ 2021-11-09 15:37 ` John Meneghini
2021-11-09 15:54 ` Sagi Grimberg
1 sibling, 0 replies; 8+ messages in thread
From: John Meneghini @ 2021-11-09 15:37 UTC (permalink / raw)
To: Christoph Hellwig, Maurizio Lombardi
Cc: Sagi Grimberg, linux-nvme, kbusch, axboe
Looks good to me.
Reviewed-by: John Meneghini <jmeneghi@redhat.com>
On 11/9/21 03:13, Christoph Hellwig wrote:
> On Wed, Nov 03, 2021 at 12:03:10PM +0100, Maurizio Lombardi wrote:
>>>>
>>>> Thanks Maurizio,
>>>>
>>>> Why do we need to the pf_cache.va protection? nvme_tcp_free_queue
>>>> is already protected against re-entry with the NVME_TCP_Q_ALLOCATED
>>>> bit.
>>>>
>>>
>>> It's not the re-entry what worried me, I thought that nvme_tcp_free_queue()
>>> might be called before page_frag_alloc() had the chance to initialize the pf_cache, triggering
>>> a NULL pointer dereference. I am doing some tests right now and it seems not to be
>>> possible so maybe we can drop the "if".
>>
>> Oh wait, if nvme_tcp_setup_ctrl() fails it could call nvme_tcp_destroy_io_queues() and
>> iI guess that in that case the pf_cache is not initialized, so the if(pf_cache.va) protection
>> is necessary.
>
> Sagi, does this look good to you now?
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] nvme-tcp: fix memory leak when freeing a queue
2021-11-09 8:13 ` Christoph Hellwig
2021-11-09 15:37 ` John Meneghini
@ 2021-11-09 15:54 ` Sagi Grimberg
1 sibling, 0 replies; 8+ messages in thread
From: Sagi Grimberg @ 2021-11-09 15:54 UTC (permalink / raw)
To: Christoph Hellwig, Maurizio Lombardi; +Cc: linux-nvme, kbusch, axboe
>>>> Thanks Maurizio,
>>>>
>>>> Why do we need to the pf_cache.va protection? nvme_tcp_free_queue
>>>> is already protected against re-entry with the NVME_TCP_Q_ALLOCATED
>>>> bit.
>>>>
>>>
>>> It's not the re-entry what worried me, I thought that nvme_tcp_free_queue()
>>> might be called before page_frag_alloc() had the chance to initialize the pf_cache, triggering
>>> a NULL pointer dereference. I am doing some tests right now and it seems not to be
>>> possible so maybe we can drop the "if".
>>
>> Oh wait, if nvme_tcp_setup_ctrl() fails it could call nvme_tcp_destroy_io_queues() and
>> iI guess that in that case the pf_cache is not initialized, so the if(pf_cache.va) protection
>> is necessary.
>
> Sagi, does this look good to you now?
Yes,
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] nvme-tcp: fix memory leak when freeing a queue
2021-11-03 8:18 [PATCH] nvme-tcp: fix memory leak when freeing a queue Maurizio Lombardi
2021-11-03 9:23 ` Sagi Grimberg
@ 2021-11-11 10:00 ` Christoph Hellwig
1 sibling, 0 replies; 8+ messages in thread
From: Christoph Hellwig @ 2021-11-11 10:00 UTC (permalink / raw)
To: Maurizio Lombardi; +Cc: linux-nvme, kbusch, axboe, hch, sagi
Thanks,
applied to nvme-5.16.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2021-11-11 10:01 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-03 8:18 [PATCH] nvme-tcp: fix memory leak when freeing a queue Maurizio Lombardi
2021-11-03 9:23 ` Sagi Grimberg
2021-11-03 10:45 ` Maurizio Lombardi
2021-11-03 11:03 ` Maurizio Lombardi
2021-11-09 8:13 ` Christoph Hellwig
2021-11-09 15:37 ` John Meneghini
2021-11-09 15:54 ` Sagi Grimberg
2021-11-11 10:00 ` Christoph Hellwig
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.