* [PATCH v3 0/1] smb/client: fix memory leaks @ 2026-02-02 9:49 chenxiaosong.chenxiaosong 2026-02-02 9:49 ` [PATCH v3 1/1] smb/client: fix memory leak in SendReceive() chenxiaosong.chenxiaosong 0 siblings, 1 reply; 5+ messages in thread From: chenxiaosong.chenxiaosong @ 2026-02-02 9:49 UTC (permalink / raw) To: smfrench, linkinjeon, pc, ronniesahlberg, sprasad, tom, bharathsm, senozhatsky, dhowells, nspmangalore, henrique.carvalho, meetakshisetiyaoss, ematsumiya, pali Cc: linux-cifs, ChenXiaoSong From: ChenXiaoSong <chenxiaosong@chenxiaosong.com> v2->v3: rebased on mainline v2: https://lore.kernel.org/linux-cifs/20260202082407.1881618-1-chenxiaosong.chenxiaosong@linux.dev/ The following patches from v2 have already been merged into cifs-2.6.git for-next: - smb/client: fix memory leak in smb2_open_file(): https://lore.kernel.org/linux-cifs/20260202082407.1881618-3-chenxiaosong.chenxiaosong@linux.dev/ For detailed information, please see the link: https://chenxiaosong.com/en/smb-buildbot.html (I will ensure this link is always accessible). ChenXiaoSong (1): smb/client: fix memory leak in SendReceive() fs/smb/client/cifstransport.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.52.0 ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v3 1/1] smb/client: fix memory leak in SendReceive() 2026-02-02 9:49 [PATCH v3 0/1] smb/client: fix memory leaks chenxiaosong.chenxiaosong @ 2026-02-02 9:49 ` chenxiaosong.chenxiaosong 2026-02-02 12:17 ` Paulo Alcantara 2026-02-02 15:36 ` David Howells 0 siblings, 2 replies; 5+ messages in thread From: chenxiaosong.chenxiaosong @ 2026-02-02 9:49 UTC (permalink / raw) To: smfrench, linkinjeon, pc, ronniesahlberg, sprasad, tom, bharathsm, senozhatsky, dhowells, nspmangalore, henrique.carvalho, meetakshisetiyaoss, ematsumiya, pali Cc: linux-cifs, ChenXiaoSong, ChenXiaoSong From: ChenXiaoSong <chenxiaosong@chenxiaosong.com> Reproducer: 1. server: supports SMB1, directories are exported read-only 2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt 3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct 4. client: umount /mnt 5. client: sleep 1 6. client: modprobe -r cifs The error message is as follows: ============================================================================= BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown() ----------------------------------------------------------------------------- Object 0x00000000d34491e6 @offset=896 Object 0x00000000bde9fab3 @offset=4480 Object 0x00000000104a1f70 @offset=6272 Object 0x0000000092a51bb5 @offset=7616 Object 0x000000006714a7db @offset=13440 ... WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712 ... Call Trace: <TASK> kmem_cache_destroy+0x69/0x160 cifs_destroy_request_bufs+0x39/0x40 [cifs] cleanup_module+0x43/0xfc0 [cifs] __se_sys_delete_module+0x1d5/0x300 __x64_sys_delete_module+0x1a/0x30 x64_sys_call+0x2299/0x2ff0 do_syscall_64+0x6e/0x270 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs] WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712 Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6 Fixes: 6be09580df5c ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()") Reported-by: Paulo Alcantara <pc@manguebit.org> Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn> --- fs/smb/client/cifstransport.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/cifstransport.c b/fs/smb/client/cifstransport.c index 28d1cee90625..98287132626e 100644 --- a/fs/smb/client/cifstransport.c +++ b/fs/smb/client/cifstransport.c @@ -251,13 +251,15 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, rc = cifs_send_recv(xid, ses, ses->server, &rqst, &resp_buf_type, flags, &resp_iov); if (rc < 0) - return rc; + goto out; if (out_buf) { *pbytes_returned = resp_iov.iov_len; if (resp_iov.iov_len) memcpy(out_buf, resp_iov.iov_base, resp_iov.iov_len); } + +out: free_rsp_buf(resp_buf_type, resp_iov.iov_base); return rc; } -- 2.52.0 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v3 1/1] smb/client: fix memory leak in SendReceive() 2026-02-02 9:49 ` [PATCH v3 1/1] smb/client: fix memory leak in SendReceive() chenxiaosong.chenxiaosong @ 2026-02-02 12:17 ` Paulo Alcantara 2026-02-02 15:36 ` David Howells 1 sibling, 0 replies; 5+ messages in thread From: Paulo Alcantara @ 2026-02-02 12:17 UTC (permalink / raw) To: chenxiaosong.chenxiaosong, smfrench, linkinjeon, ronniesahlberg, sprasad, tom, bharathsm, senozhatsky, dhowells, nspmangalore, henrique.carvalho, meetakshisetiyaoss, ematsumiya, pali Cc: linux-cifs, ChenXiaoSong, ChenXiaoSong chenxiaosong.chenxiaosong@linux.dev writes: > From: ChenXiaoSong <chenxiaosong@chenxiaosong.com> > > Reproducer: > > 1. server: supports SMB1, directories are exported read-only > 2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt > 3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct > 4. client: umount /mnt > 5. client: sleep 1 > 6. client: modprobe -r cifs > > The error message is as follows: > > ============================================================================= > BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown() > ----------------------------------------------------------------------------- > > Object 0x00000000d34491e6 @offset=896 > Object 0x00000000bde9fab3 @offset=4480 > Object 0x00000000104a1f70 @offset=6272 > Object 0x0000000092a51bb5 @offset=7616 > Object 0x000000006714a7db @offset=13440 > ... > WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712 > ... > Call Trace: > <TASK> > kmem_cache_destroy+0x69/0x160 > cifs_destroy_request_bufs+0x39/0x40 [cifs] > cleanup_module+0x43/0xfc0 [cifs] > __se_sys_delete_module+0x1d5/0x300 > __x64_sys_delete_module+0x1a/0x30 > x64_sys_call+0x2299/0x2ff0 > do_syscall_64+0x6e/0x270 > entry_SYSCALL_64_after_hwframe+0x76/0x7e > ... > kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs] > WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712 > > Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6 > Fixes: 6be09580df5c ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()") > Reported-by: Paulo Alcantara <pc@manguebit.org> > Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn> > --- > fs/smb/client/cifstransport.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org> ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v3 1/1] smb/client: fix memory leak in SendReceive() 2026-02-02 9:49 ` [PATCH v3 1/1] smb/client: fix memory leak in SendReceive() chenxiaosong.chenxiaosong 2026-02-02 12:17 ` Paulo Alcantara @ 2026-02-02 15:36 ` David Howells 2026-02-02 16:15 ` Steve French 1 sibling, 1 reply; 5+ messages in thread From: David Howells @ 2026-02-02 15:36 UTC (permalink / raw) To: chenxiaosong.chenxiaosong Cc: dhowells, smfrench, linkinjeon, pc, ronniesahlberg, sprasad, tom, bharathsm, senozhatsky, nspmangalore, henrique.carvalho, meetakshisetiyaoss, ematsumiya, pali, linux-cifs, ChenXiaoSong, ChenXiaoSong chenxiaosong.chenxiaosong@linux.dev wrote: > From: ChenXiaoSong <chenxiaosong@chenxiaosong.com> > > Reproducer: > > 1. server: supports SMB1, directories are exported read-only > 2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt > 3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct > 4. client: umount /mnt > 5. client: sleep 1 > 6. client: modprobe -r cifs > > The error message is as follows: > > ============================================================================= > BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown() > ----------------------------------------------------------------------------- > > Object 0x00000000d34491e6 @offset=896 > Object 0x00000000bde9fab3 @offset=4480 > Object 0x00000000104a1f70 @offset=6272 > Object 0x0000000092a51bb5 @offset=7616 > Object 0x000000006714a7db @offset=13440 > ... > WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712 > ... > Call Trace: > <TASK> > kmem_cache_destroy+0x69/0x160 > cifs_destroy_request_bufs+0x39/0x40 [cifs] > cleanup_module+0x43/0xfc0 [cifs] > __se_sys_delete_module+0x1d5/0x300 > __x64_sys_delete_module+0x1a/0x30 > x64_sys_call+0x2299/0x2ff0 > do_syscall_64+0x6e/0x270 > entry_SYSCALL_64_after_hwframe+0x76/0x7e > ... > kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs] > WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712 > > Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6 > Fixes: 6be09580df5c ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()") > Reported-by: Paulo Alcantara <pc@manguebit.org> > Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn> Reviewed-by: David Howells <dhowells@redhat.com> ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v3 1/1] smb/client: fix memory leak in SendReceive() 2026-02-02 15:36 ` David Howells @ 2026-02-02 16:15 ` Steve French 0 siblings, 0 replies; 5+ messages in thread From: Steve French @ 2026-02-02 16:15 UTC (permalink / raw) To: David Howells Cc: chenxiaosong.chenxiaosong, linkinjeon, pc, ronniesahlberg, sprasad, tom, bharathsm, senozhatsky, nspmangalore, henrique.carvalho, meetakshisetiyaoss, ematsumiya, pali, linux-cifs, ChenXiaoSong, ChenXiaoSong merged updated patch into cifs-2.6.git for-next On Mon, Feb 2, 2026 at 9:36 AM David Howells <dhowells@redhat.com> wrote: > > chenxiaosong.chenxiaosong@linux.dev wrote: > > > From: ChenXiaoSong <chenxiaosong@chenxiaosong.com> > > > > Reproducer: > > > > 1. server: supports SMB1, directories are exported read-only > > 2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt > > 3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct > > 4. client: umount /mnt > > 5. client: sleep 1 > > 6. client: modprobe -r cifs > > > > The error message is as follows: > > > > ============================================================================= > > BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown() > > ----------------------------------------------------------------------------- > > > > Object 0x00000000d34491e6 @offset=896 > > Object 0x00000000bde9fab3 @offset=4480 > > Object 0x00000000104a1f70 @offset=6272 > > Object 0x0000000092a51bb5 @offset=7616 > > Object 0x000000006714a7db @offset=13440 > > ... > > WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712 > > ... > > Call Trace: > > <TASK> > > kmem_cache_destroy+0x69/0x160 > > cifs_destroy_request_bufs+0x39/0x40 [cifs] > > cleanup_module+0x43/0xfc0 [cifs] > > __se_sys_delete_module+0x1d5/0x300 > > __x64_sys_delete_module+0x1a/0x30 > > x64_sys_call+0x2299/0x2ff0 > > do_syscall_64+0x6e/0x270 > > entry_SYSCALL_64_after_hwframe+0x76/0x7e > > ... > > kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs] > > WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712 > > > > Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6 > > Fixes: 6be09580df5c ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()") > > Reported-by: Paulo Alcantara <pc@manguebit.org> > > Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn> > > Reviewed-by: David Howells <dhowells@redhat.com> > -- Thanks, Steve ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-02-02 16:15 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-02-02 9:49 [PATCH v3 0/1] smb/client: fix memory leaks chenxiaosong.chenxiaosong 2026-02-02 9:49 ` [PATCH v3 1/1] smb/client: fix memory leak in SendReceive() chenxiaosong.chenxiaosong 2026-02-02 12:17 ` Paulo Alcantara 2026-02-02 15:36 ` David Howells 2026-02-02 16:15 ` Steve French
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox