Re: blktests failures with v7.0-rc1 kernel

Maurizio Lombardi
2026-03-11T07:36:49Z

On Wed Mar 11, 2026 at 1:35 AM CET, Yi Zhang wrote:
> On Thu, Feb 26, 2026 at 4:09 PM Shinichiro Kawasaki
> <shinichiro.kawasaki@wdc.com> wrote:
>>
>
> I also reproduced this kmemleak issue with the blktests nvme/rdma
> test. Here is the log:
>
> unreferenced object 0xffff8882e7545a40 (size 32):
> comm "kworker/0:0H", pid 36658, jiffies 4303559899
> hex dump (first 32 bytes):
> 02 81 aa 09 00 ea ff ff 00 00 00 00 00 10 00 00 ................
> 00 40 a0 6a 82 88 ff ff 00 10 00 00 00 00 00 00 .@.j............
> backtrace (crc e5de3e0c):
> __kmalloc_noprof+0x6f1/0xa10
> sgl_alloc_order+0x9e/0x370
> nvmet_req_alloc_sgls+0x294/0x4f0 [nvmet]
> nvmet_rdma_map_sgl_keyed+0x25a/0x940 [nvmet_rdma]
> nvmet_rdma_handle_command+0x1ed/0x4e0 [nvmet_rdma]
> __ib_process_cq+0x139/0x4b0 [ib_core]
> ib_cq_poll_work+0x4d/0x160 [ib_core]
> process_one_work+0x8b1/0x15e0
> worker_thread+0x5e9/0xfc0
> kthread+0x36b/0x470
> ret_from_fork+0x5bf/0x910
> ret_from_fork_asm+0x1a/0x30
> unreferenced object 0xffff8882e7545280 (size 32):
> comm "kworker/0:0H", pid 36658, jiffies 4303559900
> hex dump (first 32 bytes):
> 02 2b 82 0b 00 ea ff ff 00 00 00 00 00 10 00 00 .+..............
> 00 c0 8a e0 82 88 ff ff 00 10 00 00 00 00 00 00 ................
> backtrace (crc 42d20147):
> __kmalloc_noprof+0x6f1/0xa10
> sgl_alloc_order+0x9e/0x370
> nvmet_req_alloc_sgls+0x294/0x4f0 [nvmet]
> nvmet_rdma_map_sgl_keyed+0x25a/0x940 [nvmet_rdma]
> nvmet_rdma_handle_command+0x1ed/0x4e0 [nvmet_rdma]
> __ib_process_cq+0x139/0x4b0 [ib_core]
> ib_cq_poll_work+0x4d/0x160 [ib_core]
> process_one_work+0x8b1/0x15e0
> worker_thread+0x5e9/0xfc0
> kthread+0x36b/0x470
> ret_from_fork+0x5bf/0x910
> ret_from_fork_asm+0x1a/0x30

Maybe the problem is in the nvmet_rdma_map_sgl_keyed() function

static u16 nvmet_rdma_map_sgl_keyed(struct nvmet_rdma_rsp *rsp,
struct nvme_keyed_sgl_desc *sgl, bool invalidate)
{
u64 addr = le64_to_cpu(sgl->addr);
u32 key = get_unaligned_le32(sgl->key);
struct ib_sig_attrs sig_attrs;
int ret;

rsp->req.transfer_len = get_unaligned_le24(sgl->length);

/* no data command? */
if (!rsp->req.transfer_len)
return 0;

if (rsp->req.metadata_len)
nvmet_rdma_set_sig_attrs(&rsp->req, &sig_attrs);

ret = nvmet_req_alloc_sgls(&rsp->req);
if (unlikely(ret < 0))
goto error_out;

ret = nvmet_rdma_rw_ctx_init(rsp, addr, key, &sig_attrs);
if (unlikely(ret < 0))
goto error_out;
rsp->n_rdma += ret;

if (invalidate)
rsp->invalidate_rkey = key;

return 0;

error_out:
rsp->req.transfer_len = 0;
return NVME_SC_INTERNAL;
}

If nvmet_rdma_rw_ctx_init() fails, shouldn't it call
nvmet_req_free_sgls() before returning an error?

Maurizio