[PATCH v3 0/1] smb/client: fix memory leaks

[PATCH v3 0/1] smb/client: fix memory leaks

[chenxiaosong.chenxiaosong]

From: ChenXiaoSong <chenxiaosong@chenxiaosong.com>

v2->v3: rebased on mainline

v2: https://lore.kernel.org/linux-cifs/20260202082407.1881618-1-chenxiaosong.chenxiaosong@linux.dev/

The following patches from v2 have already been merged into cifs-2.6.git for-next:
  - smb/client: fix memory leak in smb2_open_file(): https://lore.kernel.org/linux-cifs/20260202082407.1881618-3-chenxiaosong.chenxiaosong@linux.dev/

For detailed information, please see the link: https://chenxiaosong.com/en/smb-buildbot.html (I will ensure this link is always accessible).

ChenXiaoSong (1):
  smb/client: fix memory leak in SendReceive()

 fs/smb/client/cifstransport.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

-- 
2.52.0

[PATCH v3 1/1] smb/client: fix memory leak in SendReceive()

[chenxiaosong.chenxiaosong]

From: ChenXiaoSong <chenxiaosong@chenxiaosong.com>

Reproducer:

  1. server: supports SMB1, directories are exported read-only
  2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt
  3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
  4. client: umount /mnt
  5. client: sleep 1
  6. client: modprobe -r cifs

The error message is as follows:

  =============================================================================
  BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()
  -----------------------------------------------------------------------------

  Object 0x00000000d34491e6 @offset=896
  Object 0x00000000bde9fab3 @offset=4480
  Object 0x00000000104a1f70 @offset=6272
  Object 0x0000000092a51bb5 @offset=7616
  Object 0x000000006714a7db @offset=13440
  ...
  WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712
  ...
  Call Trace:
   <TASK>
   kmem_cache_destroy+0x69/0x160
   cifs_destroy_request_bufs+0x39/0x40 [cifs]
   cleanup_module+0x43/0xfc0 [cifs]
   __se_sys_delete_module+0x1d5/0x300
   __x64_sys_delete_module+0x1a/0x30
   x64_sys_call+0x2299/0x2ff0
   do_syscall_64+0x6e/0x270
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
  ...
  kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs]
  WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712

Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6
Fixes: 6be09580df5c ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()")
Reported-by: Paulo Alcantara <pc@manguebit.org>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
---
 fs/smb/client/cifstransport.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c
index 28d1cee90625..98287132626e 100644
--- a/fs/smb/client/cifstransport.c
+++ b/fs/smb/client/cifstransport.c
@@ -251,13 +251,15 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,
 	rc = cifs_send_recv(xid, ses, ses->server,
 			    &rqst, &resp_buf_type, flags, &resp_iov);
 	if (rc < 0)
-		return rc;
+		goto out;
 
 	if (out_buf) {
 		*pbytes_returned = resp_iov.iov_len;
 		if (resp_iov.iov_len)
 			memcpy(out_buf, resp_iov.iov_base, resp_iov.iov_len);
 	}
+
+out:
 	free_rsp_buf(resp_buf_type, resp_iov.iov_base);
 	return rc;
 }
-- 
2.52.0

Re: [PATCH v3 1/1] smb/client: fix memory leak in SendReceive()

[Paulo Alcantara]

chenxiaosong.chenxiaosong@linux.dev writes:

> From: ChenXiaoSong <chenxiaosong@chenxiaosong.com>
>
> Reproducer:
>
>   1. server: supports SMB1, directories are exported read-only
>   2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt
>   3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
>   4. client: umount /mnt
>   5. client: sleep 1
>   6. client: modprobe -r cifs
>
> The error message is as follows:
>
>   =============================================================================
>   BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()
>   -----------------------------------------------------------------------------
>
>   Object 0x00000000d34491e6 @offset=896
>   Object 0x00000000bde9fab3 @offset=4480
>   Object 0x00000000104a1f70 @offset=6272
>   Object 0x0000000092a51bb5 @offset=7616
>   Object 0x000000006714a7db @offset=13440
>   ...
>   WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712
>   ...
>   Call Trace:
>    <TASK>
>    kmem_cache_destroy+0x69/0x160
>    cifs_destroy_request_bufs+0x39/0x40 [cifs]
>    cleanup_module+0x43/0xfc0 [cifs]
>    __se_sys_delete_module+0x1d5/0x300
>    __x64_sys_delete_module+0x1a/0x30
>    x64_sys_call+0x2299/0x2ff0
>    do_syscall_64+0x6e/0x270
>    entry_SYSCALL_64_after_hwframe+0x76/0x7e
>   ...
>   kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs]
>   WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712
>
> Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6
> Fixes: 6be09580df5c ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()")
> Reported-by: Paulo Alcantara <pc@manguebit.org>
> Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
> ---
>  fs/smb/client/cifstransport.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>

Re: [PATCH v3 1/1] smb/client: fix memory leak in SendReceive()

[David Howells]

chenxiaosong.chenxiaosong@linux.dev wrote:

> From: ChenXiaoSong <chenxiaosong@chenxiaosong.com>
> 
> Reproducer:
> 
>   1. server: supports SMB1, directories are exported read-only
>   2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt
>   3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
>   4. client: umount /mnt
>   5. client: sleep 1
>   6. client: modprobe -r cifs
> 
> The error message is as follows:
> 
>   =============================================================================
>   BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()
>   -----------------------------------------------------------------------------
> 
>   Object 0x00000000d34491e6 @offset=896
>   Object 0x00000000bde9fab3 @offset=4480
>   Object 0x00000000104a1f70 @offset=6272
>   Object 0x0000000092a51bb5 @offset=7616
>   Object 0x000000006714a7db @offset=13440
>   ...
>   WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712
>   ...
>   Call Trace:
>    <TASK>
>    kmem_cache_destroy+0x69/0x160
>    cifs_destroy_request_bufs+0x39/0x40 [cifs]
>    cleanup_module+0x43/0xfc0 [cifs]
>    __se_sys_delete_module+0x1d5/0x300
>    __x64_sys_delete_module+0x1a/0x30
>    x64_sys_call+0x2299/0x2ff0
>    do_syscall_64+0x6e/0x270
>    entry_SYSCALL_64_after_hwframe+0x76/0x7e
>   ...
>   kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs]
>   WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712
> 
> Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6
> Fixes: 6be09580df5c ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()")
> Reported-by: Paulo Alcantara <pc@manguebit.org>
> Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>

Reviewed-by: David Howells <dhowells@redhat.com>

Re: [PATCH v3 1/1] smb/client: fix memory leak in SendReceive()

[Steve French]

merged updated patch into cifs-2.6.git for-next

On Mon, Feb 2, 2026 at 9:36 AM David Howells <dhowells@redhat.com> wrote:
>
> chenxiaosong.chenxiaosong@linux.dev wrote:
>
> > From: ChenXiaoSong <chenxiaosong@chenxiaosong.com>
> >
> > Reproducer:
> >
> >   1. server: supports SMB1, directories are exported read-only
> >   2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt
> >   3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
> >   4. client: umount /mnt
> >   5. client: sleep 1
> >   6. client: modprobe -r cifs
> >
> > The error message is as follows:
> >
> >   =============================================================================
> >   BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()
> >   -----------------------------------------------------------------------------
> >
> >   Object 0x00000000d34491e6 @offset=896
> >   Object 0x00000000bde9fab3 @offset=4480
> >   Object 0x00000000104a1f70 @offset=6272
> >   Object 0x0000000092a51bb5 @offset=7616
> >   Object 0x000000006714a7db @offset=13440
> >   ...
> >   WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712
> >   ...
> >   Call Trace:
> >    <TASK>
> >    kmem_cache_destroy+0x69/0x160
> >    cifs_destroy_request_bufs+0x39/0x40 [cifs]
> >    cleanup_module+0x43/0xfc0 [cifs]
> >    __se_sys_delete_module+0x1d5/0x300
> >    __x64_sys_delete_module+0x1a/0x30
> >    x64_sys_call+0x2299/0x2ff0
> >    do_syscall_64+0x6e/0x270
> >    entry_SYSCALL_64_after_hwframe+0x76/0x7e
> >   ...
> >   kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs]
> >   WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712
> >
> > Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6
> > Fixes: 6be09580df5c ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()")
> > Reported-by: Paulo Alcantara <pc@manguebit.org>
> > Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
>
> Reviewed-by: David Howells <dhowells@redhat.com>
>


-- 
Thanks,

Steve