RE: [PATCH 0/2] hv_netvsc: Fix leaking of send/receive buffers after GPADL teardown error

From: Michael Kelley <redacted> Sent: Thursday, September 3, 2026 9:07 AM

When a Hyper-V netvsc device is shutdown, the GPADLs for the device's
large send and receive buffers are torn down. If the teardown fails,
Hyper-V retain access to the buffers and may continue to read or write
them. Consequently the buffers should be leaked after such an error.

Leaking the buffers used to work correctly, but was broken by a
commit applied in the 4.16 kernel. This patch series restores the
correct leaking behavior.

Because the large buffers are allocated with wrapper functions
that allow allocations larger than MAX_ORDER_NR_PAGES, leaking the
memory is not as simple as setting the memory pointer to NULL so
vfree() or kfree() does nothing. Patch 1 introduces a new
vmbus_leak_buffer() function that causes vmbus_free_buffer() to
properly leak the buffers. Then Patch 2 uses this function in
the netvsc driver.

Michael Kelley (2):
  Drivers: hv: Add vmbus_leak_buffer()
  hv_netvsc: Leak send/recv buffers if GPADL teardown fails

 drivers/hv/channel.c        | 26 ++++++++++++++++++++++++++
 drivers/net/hyperv/netvsc.c |  6 ++++++
 include/linux/hyperv.h      |  4 ++++
 3 files changed, 36 insertions(+)

--
2.25.1

I will be posting a v2 of this patch set that fixes an additional
bug in vmbus_teardown_gpadl() that Sashiko pointed out.
That fix is necessary for the full "leak on failure" scenario
to work correctly.

Michael