[PATCH v2] nvmet-tcp: fix page fragment cache leak in error path

[PATCH v2] nvmet-tcp: fix page fragment cache leak in error path

[Geliang Tang]

From: Geliang Tang <tanggeliang@kylinos.cn>

In nvmet_tcp_alloc_queue(), when a connection is closed during the
allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN),
the error handling jumps to out_destroy_sq and then to out_ida_remove
without draining the page fragment cache.

Although nvmet_tcp_free_cmd() is called in some error paths to release
individual page fragments, the underlying page cache reference held by
queue->pf_cache is never released. The first allocation using pf_cache
is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens
after ida_alloc() returns successfully. This results in a page leak each
time a connection fails during allocation, which could lead to memory
exhaustion over time if connections are repeatedly opened and closed.

Fix this by calling page_frag_cache_drain() before freeing the queue
structure in the out_ida_remove label.

Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
---
v2:
 - As suggested by Christoph, move page_frag_cache_drain() to after the
   out_ida_remove label and add a comment.
v1:
 - https://patchwork.kernel.org/project/linux-nvme/patch/39d57858464bb3933160d6f7583640db086fbb80.1779702494.git.tanggeliang@kylinos.cn/
---
 drivers/nvme/target/tcp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 20f150d17a96..e613da4c44e0 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1999,6 +1999,11 @@ static void nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port,
 	nvmet_tcp_free_cmd(&queue->connect);
 out_ida_remove:
 	ida_free(&nvmet_tcp_queue_ida, queue->idx);
+	/* Drain the page fragment cache if any allocations were done.
+	 * The first allocation using pf_cache is nvmet_tcp_alloc_cmd()
+	 * for queue->connect after ida_alloc().
+	 */
+	page_frag_cache_drain(&queue->pf_cache);
 out_sock:
 	fput(queue->sock->file);
 out_free_queue:
-- 
2.53.0

Re: [PATCH v2] nvmet-tcp: fix page fragment cache leak in error path

[Christoph Hellwig]

On Tue, May 26, 2026 at 05:22:22PM +0800, Geliang Tang wrote:
>  out_ida_remove:
>  	ida_free(&nvmet_tcp_queue_ida, queue->idx);
> +	/* Drain the page fragment cache if any allocations were done.

Kernel style is to keep the

	/*

on it's own line, but otherwise this looks great.  I think we can just
fix this up when applying.

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH v2] nvmet-tcp: fix page fragment cache leak in error path

[Keith Busch]

On Tue, May 26, 2026 at 05:22:22PM +0800, Geliang Tang wrote:
> From: Geliang Tang <tanggeliang@kylinos.cn>
> 
> In nvmet_tcp_alloc_queue(), when a connection is closed during the
> allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN),
> the error handling jumps to out_destroy_sq and then to out_ida_remove
> without draining the page fragment cache.
> 
> Although nvmet_tcp_free_cmd() is called in some error paths to release
> individual page fragments, the underlying page cache reference held by
> queue->pf_cache is never released. The first allocation using pf_cache
> is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens
> after ida_alloc() returns successfully. This results in a page leak each
> time a connection fails during allocation, which could lead to memory
> exhaustion over time if connections are repeatedly opened and closed.
> 
> Fix this by calling page_frag_cache_drain() before freeing the queue
> structure in the out_ida_remove label.

Thanks, applied to nvme-7.2 with the fixed up comment style suggestion.