Re: [PATCH v3 1/1] smb/client: fix memory leak in SendReceive()

[Paulo Alcantara <pc@manguebit.org>]

chenxiaosong.chenxiaosong@linux.dev writes:

> From: ChenXiaoSong <chenxiaosong@chenxiaosong.com>
>
> Reproducer:
>
>   1. server: supports SMB1, directories are exported read-only
>   2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt
>   3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
>   4. client: umount /mnt
>   5. client: sleep 1
>   6. client: modprobe -r cifs
>
> The error message is as follows:
>
>   =============================================================================
>   BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()
>   -----------------------------------------------------------------------------
>
>   Object 0x00000000d34491e6 @offset=896
>   Object 0x00000000bde9fab3 @offset=4480
>   Object 0x00000000104a1f70 @offset=6272
>   Object 0x0000000092a51bb5 @offset=7616
>   Object 0x000000006714a7db @offset=13440
>   ...
>   WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712
>   ...
>   Call Trace:
>    <TASK>
>    kmem_cache_destroy+0x69/0x160
>    cifs_destroy_request_bufs+0x39/0x40 [cifs]
>    cleanup_module+0x43/0xfc0 [cifs]
>    __se_sys_delete_module+0x1d5/0x300
>    __x64_sys_delete_module+0x1a/0x30
>    x64_sys_call+0x2299/0x2ff0
>    do_syscall_64+0x6e/0x270
>    entry_SYSCALL_64_after_hwframe+0x76/0x7e
>   ...
>   kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs]
>   WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712
>
> Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6
> Fixes: 6be09580df5c ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()")
> Reported-by: Paulo Alcantara <pc@manguebit.org>
> Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
> ---
>  fs/smb/client/cifstransport.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>