[PATCH] svcrdma: Fix leak of transport addresses

[PATCH] svcrdma: Fix leak of transport addresses

[Chuck Lever]

Kernel memory leak detected:

unreferenced object 0xffff888849cdf480 (size 8):
  comm "kworker/u8:3", pid 2086, jiffies 4297898756 (age 4269.856s)
  hex dump (first 8 bytes):
    30 00 cd 49 88 88 ff ff                          0..I....
  backtrace:
    [<00000000acfc370b>] __kmalloc_track_caller+0x137/0x183
    [<00000000a2724354>] kstrdup+0x2b/0x43
    [<0000000082964f84>] xprt_rdma_format_addresses+0x114/0x17d [rpcrdma]
    [<00000000dfa6ed00>] xprt_setup_rdma_bc+0xc0/0x10c [rpcrdma]
    [<0000000073051a83>] xprt_create_transport+0x3f/0x1a0 [sunrpc]
    [<0000000053531a8e>] rpc_create+0x118/0x1cd [sunrpc]
    [<000000003a51b5f8>] setup_callback_client+0x1a5/0x27d [nfsd]
    [<000000001bd410af>] nfsd4_process_cb_update.isra.7+0x16c/0x1ac [nfsd]
    [<000000007f4bbd56>] nfsd4_run_cb_work+0x4c/0xbd [nfsd]
    [<0000000055c5586b>] process_one_work+0x1b2/0x2fe
    [<00000000b1e3e8ef>] worker_thread+0x1a6/0x25a
    [<000000005205fb78>] kthread+0xf6/0xfb
    [<000000006d2dc057>] ret_from_fork+0x3a/0x50

Introduce a call to xprt_rdma_free_addresses() similar to the way
that the TCP backchannel releases a transport's peer address
strings.

Fixes: 5d252f90a800 ("svcrdma: Add class for RDMA backwards direction transport")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
 net/sunrpc/xprtrdma/svc_rdma_backchannel.c |    1 +
 1 file changed, 1 insertion(+)

Here's a possible fix for v5.7-rc.

diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
index 46b59e91d34a..d510a3a15d4b 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
@@ -252,6 +252,7 @@ xprt_rdma_bc_put(struct rpc_xprt *xprt)
 {
 	dprintk("svcrdma: %s: xprt %p\n", __func__, xprt);
 
+	xprt_rdma_free_addresses(xprt);
 	xprt_free(xprt);
 }
 

Re: [PATCH] svcrdma: Fix leak of transport addresses

[Chuck Lever]

> On Mar 26, 2020, at 11:00 AM, Chuck Lever <chuck.lever@oracle.com> wrote:
> 
> Kernel memory leak detected:
> 
> unreferenced object 0xffff888849cdf480 (size 8):
>  comm "kworker/u8:3", pid 2086, jiffies 4297898756 (age 4269.856s)
>  hex dump (first 8 bytes):
>    30 00 cd 49 88 88 ff ff                          0..I....
>  backtrace:
>    [<00000000acfc370b>] __kmalloc_track_caller+0x137/0x183
>    [<00000000a2724354>] kstrdup+0x2b/0x43
>    [<0000000082964f84>] xprt_rdma_format_addresses+0x114/0x17d [rpcrdma]
>    [<00000000dfa6ed00>] xprt_setup_rdma_bc+0xc0/0x10c [rpcrdma]
>    [<0000000073051a83>] xprt_create_transport+0x3f/0x1a0 [sunrpc]
>    [<0000000053531a8e>] rpc_create+0x118/0x1cd [sunrpc]
>    [<000000003a51b5f8>] setup_callback_client+0x1a5/0x27d [nfsd]
>    [<000000001bd410af>] nfsd4_process_cb_update.isra.7+0x16c/0x1ac [nfsd]
>    [<000000007f4bbd56>] nfsd4_run_cb_work+0x4c/0xbd [nfsd]
>    [<0000000055c5586b>] process_one_work+0x1b2/0x2fe
>    [<00000000b1e3e8ef>] worker_thread+0x1a6/0x25a
>    [<000000005205fb78>] kthread+0xf6/0xfb
>    [<000000006d2dc057>] ret_from_fork+0x3a/0x50
> 
> Introduce a call to xprt_rdma_free_addresses() similar to the way
> that the TCP backchannel releases a transport's peer address
> strings.
> 
> Fixes: 5d252f90a800 ("svcrdma: Add class for RDMA backwards direction transport")
> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

This fix seems straightforward and small, so I'll apply it to
nfsd-5.7 with the other fixes I received this morning rather
than postponing it to 5.7-rc.


> ---
> net/sunrpc/xprtrdma/svc_rdma_backchannel.c |    1 +
> 1 file changed, 1 insertion(+)
> 
> Here's a possible fix for v5.7-rc.
> 
> diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
> index 46b59e91d34a..d510a3a15d4b 100644
> --- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
> +++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
> @@ -252,6 +252,7 @@ xprt_rdma_bc_put(struct rpc_xprt *xprt)
> {
> 	dprintk("svcrdma: %s: xprt %p\n", __func__, xprt);
> 
> +	xprt_rdma_free_addresses(xprt);
> 	xprt_free(xprt);
> }
> 
> 

--
Chuck Lever