scsi: memory leak with 1MB tape I/O
Subsystems (2)
PATCH 1/1 scsi: memory leak with 1MB tape I/O
There is a memory leak in the st driver when sending large enough reads or writes using st's direct I/O path. As part of mapping the application's memory, a buffer to hold page pointers is allocated and the count of mapped pages is stored in field do_dio. A non-zero do_dio marks that direct I/O is in use.
But do_dio is only 1 byte in size. Mapping 256 4k pages overflows do_dio and causes it to be set to 0, like direct I/O option was not used. When the I/O completes, the buffer to hold the page pointers is not freed, and the page counts of the mapped pages are not reduced. Every I/O of this size then leaks memory.
The size of do_dio needs to be increased to prevent it wrapping around.
---
drivers/scsi/st.h +1 -1
@@ -35,8 +35,8 @@/* The tape buffer descriptor. */ struct st_buffer {unsigned char dma;/* DMA-able buffer */ -unsigned char do_dio;/* direct i/o set up? */ unsigned char cleared;/* internal buffer cleared after open? */ +unsigned short do_dio;/* direct i/o set up? */ int buffer_size;int buffer_blocks;int buffer_bytes;
Quoted 20 lines · David Jeffery
There is a memory leak in the st driver when sending large enough reads or writes using st's direct I/O path. As part of mapping the application's memory, a buffer to hold page pointers is allocated and the count of mapped pages is stored in field
do_dio. A non-zerodo_diomarks that direct I/O is in use.But
do_diois only 1 byte in size. Mapping 256 4k pages overflowsdo_dioand causes it to be set to 0, like direct I/O option was not used. When the I/O completes, the buffer to hold the page pointers is not freed, and the page counts of the mapped pages are not reduced. Every I/O of this size then leaks memory.The size of
do_dioneeds to be increased to prevent it wrapping around.Signed-off-by David Jeffery <[email protected]>---
drivers/scsi/st.h line 42
Quoted 9 lines
drivers/scsi/st.h +1
-1@@ -35,8 +35,8 @@/* The tape buffer descriptor. */ struct st_buffer {unsigned char dma;/* DMA-able buffer */ -unsigned char do_dio;/* direct i/o set up? */ unsigned char cleared;/* internal buffer cleared after open? */ +unsigned short do_dio;/* direct i/o set up? */ int buffer_size;int buffer_blocks;int buffer_bytes;
Thanks,
Kai