Re: [PATCH] nvme-tcp: fix memory leak when freeing a queue

On Wed, Nov 03, 2021 at 11:23:45AM +0200, Sagi Grimberg wrote:

quoted

Release the page frag cache when tearing down the io queues

Signed-off-by: Maurizio Lombardi <redacted>
---
  drivers/nvme/host/tcp.c | 6 ++++++
  1 file changed, 6 insertions(+)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 07156ea9d1a8..999417626b15 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c

@@ -1229,6 +1229,7 @@ static int nvme_tcp_alloc_async_req(struct nvme_tcp_ctrl *ctrl)
  static void nvme_tcp_free_queue(struct nvme_ctrl *nctrl, int qid)
  {
+	struct page *page;
  	struct nvme_tcp_ctrl *ctrl = to_tcp_ctrl(nctrl);
  	struct nvme_tcp_queue *queue = &ctrl->queues[qid];

@@ -1238,6 +1239,11 @@ static void nvme_tcp_free_queue(struct nvme_ctrl *nctrl, int qid)
  	if (queue->hdr_digest || queue->data_digest)
  		nvme_tcp_free_crypto(queue);
+	if (queue->pf_cache.va) {
+		page = virt_to_head_page(queue->pf_cache.va);
+		__page_frag_cache_drain(page, queue->pf_cache.pagecnt_bias);
+		queue->pf_cache.va = NULL;
+	}

Thanks Maurizio,

Why do we need to the pf_cache.va protection? nvme_tcp_free_queue
is already protected against re-entry with the NVME_TCP_Q_ALLOCATED
bit.

It's not the re-entry what worried me, I thought that nvme_tcp_free_queue()
might be called before page_frag_alloc() had the chance to initialize the pf_cache, triggering
a NULL pointer dereference. I am doing some tests right now and it seems not to be
possible so maybe we can drop the "if".

However, we still need to set pf_cache.va to NULL because the queues might be re-used
in the error code path and we have to prevent page_frag_alloc() from dereferencing a
freed cache page and corrupting the memory.

Maurizio