Skip to contentSkip to conversation

Patch "NVMe: Fix memory leak on retried commands" has been added to the 4.2-stable tree

PATCH [email protected] 1 participant 1 message Nov 6, 2015

Subsystems (2)
Stable branch Block layer
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

NVMe: Fix memory leak on retried commands

to the 4.2-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
nvme-fix-memory-leak-on-retried-commands.patch
and it can be found in the queue-4.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 0dfc70c33409afc232ef0b9ec210535dfbf9bc61 Mon Sep 17 00:00:00 2001

From: Keith Busch <[email protected]>
Date: Thu, 15 Oct 2015 13:38:48 -0600
Subject: NVMe: Fix memory leak on retried commands

From: Keith Busch <[email protected]>

commit 0dfc70c33409afc232ef0b9ec210535dfbf9bc61 upstream.

Resources are reallocated for requeued commands, so unmap and release the iod for the failed command.

It's a pretty bad memory leak and causes a kernel hang if you remove a drive because of a busy dma pool. You'll get messages spewing like this:

nvme 0000:xx:xx.x: dma_pool_destroy prp list 256, ffff880420dec000 busy

and lock up pci and the driver since removal never completes while holding a lock.

Signed-off-by Keith Busch <[email protected]>
Reviewed-by Christoph Hellwig <[email protected]>
Signed-off-by Jens Axboe <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/block/nvme-core.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/block/nvme-core.c +6 -3
@@ -597,6 +597,7 @@ static void req_completion(struct nvme_q
 	struct nvme_iod *iod = ctx;
 	struct request *req = iod_get_private(iod);
 	struct nvme_cmd_info *cmd_rq = blk_mq_rq_to_pdu(req);
+	bool requeue = false;
 
 	u16 status = le16_to_cpup(&cqe->status) >> 1;
 

@@ -605,12 +606,13 @@ static void req_completion(struct nvme_q
 		    && (jiffies - req->start_time) < req->timeout) {
 			unsigned long flags;
 
+			requeue = true;
 			blk_mq_requeue_request(req);
 			spin_lock_irqsave(req->q->queue_lock, flags);
 			if (!blk_queue_stopped(req->q))
 				blk_mq_kick_requeue_list(req->q);
 			spin_unlock_irqrestore(req->q->queue_lock, flags);
-			return;
+			goto release_iod;
 		}
 		if (req->cmd_type == REQ_TYPE_DRV_PRIV) {
 			if (cmd_rq->ctx == CMD_CTX_CANCELLED)

@@ -631,7 +633,7 @@ static void req_completion(struct nvme_q
 		dev_warn(nvmeq->dev->dev,
 			"completing aborted command with status:%04x\n",
 			status);
-
+ release_iod:
 	if (iod->nents) {
 		dma_unmap_sg(nvmeq->dev->dev, iod->sg, iod->nents,
 			rq_data_dir(req) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);

@@ -644,7 +646,8 @@ static void req_completion(struct nvme_q
 	}
 	nvme_free_iod(nvmeq->dev, iod);
 
-	blk_mq_complete_request(req);
+	if (likely(!requeue))
+		blk_mq_complete_request(req);
 }
 
 /* length is in bytes.  gfp flags indicates whether we may sleep. */

Patches currently in stable-queue which might be from [email protected] are

queue-4.2/blk-mq-fix-use-after-free-in-blk_mq_free_tag_set.patch queue-4.2/nvme-fix-memory-leak-on-retried-commands.patch