[PATCH] net_dma: fix memory leak in dma_pin_iocvec_pages

[PATCH] net_dma: fix memory leak in dma_pin_iocvec_pages

[Roman Gushchin]

dma_pin_iovec_pages() calls get_user_pages() for each iovec. If
get_user_pages() returns a number smaller than the requested number,
dma_pin_iovec_pages() calls dma_unpin_iovec_pages(). It releases
previously allocated iovecs, but pages pinned by last get_user_pages()
call remain unreleased.
Fix this by calling put_page() for each such page.

Signed-off-by: Roman Gushchin <klamm@yandex-team.ru>
---
 drivers/dma/iovlock.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/dma/iovlock.c b/drivers/dma/iovlock.c
index bb48a57..c393cf9 100644
--- a/drivers/dma/iovlock.c
+++ b/drivers/dma/iovlock.c
@@ -107,8 +107,11 @@ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len)
 			NULL);
 		up_read(&current->mm->mmap_sem);
 
-		if (ret != page_list->nr_pages)
+		if (ret != page_list->nr_pages) {
+			for (i = 0; i < ret; i++)
+				put_page(page_list->pages[i]);
 			goto unpin;
+		}
 
 		local_list->nr_iovecs = i + 1;
 	}
-- 
1.9.3

Re: [PATCH] net_dma: fix memory leak in dma_pin_iocvec_pages

[Roman Gushchin]

Ping?

03.09.2014, 13:38, "Roman Gushchin" <klamm@yandex-team.ru>:
>  dma_pin_iovec_pages() calls get_user_pages() for each iovec. If
>  get_user_pages() returns a number smaller than the requested number,
>  dma_pin_iovec_pages() calls dma_unpin_iovec_pages(). It releases
>  previously allocated iovecs, but pages pinned by last get_user_pages()
>  call remain unreleased.
>  Fix this by calling put_page() for each such page.
>
>  Signed-off-by: Roman Gushchin <klamm@yandex-team.ru>
>  ---
>   drivers/dma/iovlock.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
>
>  diff --git a/drivers/dma/iovlock.c b/drivers/dma/iovlock.c
>  index bb48a57..c393cf9 100644
>  --- a/drivers/dma/iovlock.c
>  +++ b/drivers/dma/iovlock.c
>  @@ -107,8 +107,11 @@ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len)
>                           NULL);
>                   up_read(&current->mm->mmap_sem);
>
>  - if (ret != page_list->nr_pages)
>  + if (ret != page_list->nr_pages) {
>  + for (i = 0; i < ret; i++)
>  + put_page(page_list->pages[i]);
>                           goto unpin;
>  + }
>
>                   local_list->nr_iovecs = i + 1;
>           }
>  --
>  1.9.3
>
>  --
>  To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
>  the body of a message to majordomo@vger.kernel.org
>  More majordomo info at  http://vger.kernel.org/majordomo-info.html
>  Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH] net_dma: fix memory leak in dma_pin_iocvec_pages

[Vinod Koul]

On Wed, Sep 03, 2014 at 01:28:59PM +0400, Roman Gushchin wrote:
> dma_pin_iovec_pages() calls get_user_pages() for each iovec. If
> get_user_pages() returns a number smaller than the requested number,
> dma_pin_iovec_pages() calls dma_unpin_iovec_pages(). It releases
> previously allocated iovecs, but pages pinned by last get_user_pages()
> call remain unreleased.
> Fix this by calling put_page() for each such page.
> 
Applied, thanks

-- 
~Vinod

Re: [PATCH] net_dma: fix memory leak in dma_pin_iocvec_pages

[Dan Williams]

On Tue, Sep 23, 2014 at 9:57 PM, Vinod Koul <vinod.koul@intel.com> wrote:
> On Wed, Sep 03, 2014 at 01:28:59PM +0400, Roman Gushchin wrote:
>> dma_pin_iovec_pages() calls get_user_pages() for each iovec. If
>> get_user_pages() returns a number smaller than the requested number,
>> dma_pin_iovec_pages() calls dma_unpin_iovec_pages(). It releases
>> previously allocated iovecs, but pages pinned by last get_user_pages()
>> call remain unreleased.
>> Fix this by calling put_page() for each such page.
>>
> Applied, thanks

Vinod, I have a patch in my queue that completely removes the remnants
of NET_DMA.  It's been deprecated for more than a few cycles now
without any reports to reinstate it.  Time to push the final removal
patch.  I'll rebase it on top of this so it doesn't collide.

Re: [PATCH] net_dma: fix memory leak in dma_pin_iocvec_pages

[Vinod Koul]

On Tue, Sep 23, 2014 at 11:27:06PM -0700, Dan Williams wrote:
> On Tue, Sep 23, 2014 at 9:57 PM, Vinod Koul <vinod.koul@intel.com> wrote:
> > On Wed, Sep 03, 2014 at 01:28:59PM +0400, Roman Gushchin wrote:
> >> dma_pin_iovec_pages() calls get_user_pages() for each iovec. If
> >> get_user_pages() returns a number smaller than the requested number,
> >> dma_pin_iovec_pages() calls dma_unpin_iovec_pages(). It releases
> >> previously allocated iovecs, but pages pinned by last get_user_pages()
> >> call remain unreleased.
> >> Fix this by calling put_page() for each such page.
> >>
> > Applied, thanks
> 
> Vinod, I have a patch in my queue that completely removes the remnants
> of NET_DMA.  It's been deprecated for more than a few cycles now
> without any reports to reinstate it.  Time to push the final removal
> patch.  I'll rebase it on top of this so it doesn't collide.

Okay, thanks for update. If you wnat I can remove it, so you don't need to
rebase.

-- 
~Vinod

Re: [PATCH] net_dma: fix memory leak in dma_pin_iocvec_pages

[Vinod Koul]

On Sun, Sep 28, 2014 at 08:36:44AM -0700, Dan Williams wrote:
> On Thu, Sep 25, 2014 at 9:16 AM, Vinod Koul <vinod.koul@intel.com> wrote:
> > On Tue, Sep 23, 2014 at 11:27:06PM -0700, Dan Williams wrote:
> >> On Tue, Sep 23, 2014 at 9:57 PM, Vinod Koul <vinod.koul@intel.com> wrote:
> >> > On Wed, Sep 03, 2014 at 01:28:59PM +0400, Roman Gushchin wrote:
> >> >> dma_pin_iovec_pages() calls get_user_pages() for each iovec. If
> >> >> get_user_pages() returns a number smaller than the requested number,
> >> >> dma_pin_iovec_pages() calls dma_unpin_iovec_pages(). It releases
> >> >> previously allocated iovecs, but pages pinned by last get_user_pages()
> >> >> call remain unreleased.
> >> >> Fix this by calling put_page() for each such page.
> >> >>
> >> > Applied, thanks
> >>
> >> Vinod, I have a patch in my queue that completely removes the remnants
> >> of NET_DMA.  It's been deprecated for more than a few cycles now
> >> without any reports to reinstate it.  Time to push the final removal
> >> patch.  I'll rebase it on top of this so it doesn't collide.
> >
> > Okay, thanks for update. If you wnat I can remove it, so you don't need to
> > rebase.
> >
> 
> Yes, please drop it.  I'm sending the full removal to Linus.  I added
> Roman to the Reported-by and cc'd stable.
Done, i have pushed the updated tree.

-- 
~Vinod

Re: [PATCH] net_dma: fix memory leak in dma_pin_iocvec_pages

[Dan Williams]

On Thu, Sep 25, 2014 at 9:16 AM, Vinod Koul <vinod.koul@intel.com> wrote:
> On Tue, Sep 23, 2014 at 11:27:06PM -0700, Dan Williams wrote:
>> On Tue, Sep 23, 2014 at 9:57 PM, Vinod Koul <vinod.koul@intel.com> wrote:
>> > On Wed, Sep 03, 2014 at 01:28:59PM +0400, Roman Gushchin wrote:
>> >> dma_pin_iovec_pages() calls get_user_pages() for each iovec. If
>> >> get_user_pages() returns a number smaller than the requested number,
>> >> dma_pin_iovec_pages() calls dma_unpin_iovec_pages(). It releases
>> >> previously allocated iovecs, but pages pinned by last get_user_pages()
>> >> call remain unreleased.
>> >> Fix this by calling put_page() for each such page.
>> >>
>> > Applied, thanks
>>
>> Vinod, I have a patch in my queue that completely removes the remnants
>> of NET_DMA.  It's been deprecated for more than a few cycles now
>> without any reports to reinstate it.  Time to push the final removal
>> patch.  I'll rebase it on top of this so it doesn't collide.
>
> Okay, thanks for update. If you wnat I can remove it, so you don't need to
> rebase.
>

Yes, please drop it.  I'm sending the full removal to Linus.  I added
Roman to the Reported-by and cc'd stable.