[PATCH] vmxnet3: repair memory leak

[PATCH] vmxnet3: repair memory leak

[Neil Horman]

with the introduction of commit
b0eb57cb97e7837ebb746404c2c58c6f536f23fa, it appears that rq->buf_info
is improperly handled.  While it is heap allocated when an rx queue is
setup, and freed when torn down, an old line of code in
vmxnet3_rq_destroy was not properly removed, leading to rq->buf_info[0]
being set to NULL prior to its being freed, causing a memory leak, which
eventually exhausts the system on repeated create/destroy operations
(for example, when  the mtu of a vmxnet3 interface is changed
frequently.

Fix is pretty straight forward, just move the NULL set to after the
free.

Tested by myself with successful results

Applies to net, and should likely be queued for stable, please

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-By: boyang@redhat.com
CC: boyang@redhat.com
CC: Shrikrishna Khare <skhare@vmware.com>
CC: "VMware, Inc." <pv-drivers@vmware.com>
CC: David S. Miller <davem@davemloft.net>
---
 drivers/net/vmxnet3/vmxnet3_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index d1c7029ded7c..cf95290b160c 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -1616,7 +1616,6 @@ static void vmxnet3_rq_destroy(struct vmxnet3_rx_queue *rq,
 					  rq->rx_ring[i].basePA);
 			rq->rx_ring[i].base = NULL;
 		}
-		rq->buf_info[i] = NULL;
 	}
 
 	if (rq->data_ring.base) {
@@ -1638,6 +1637,7 @@ static void vmxnet3_rq_destroy(struct vmxnet3_rx_queue *rq,
 			(rq->rx_ring[0].size + rq->rx_ring[1].size);
 		dma_free_coherent(&adapter->pdev->dev, sz, rq->buf_info[0],
 				  rq->buf_info_pa);
+		rq->buf_info[0] = rq->buf_info[1] = NULL;
 	}
 }
 
-- 
2.14.3

Re: [PATCH] vmxnet3: repair memory leak

[Shrikrishna Khare]

On Mon, 22 Jan 2018, Neil Horman wrote:

> with the introduction of commit
> b0eb57cb97e7837ebb746404c2c58c6f536f23fa, it appears that rq->buf_info
> is improperly handled.  While it is heap allocated when an rx queue is
> setup, and freed when torn down, an old line of code in
> vmxnet3_rq_destroy was not properly removed, leading to rq->buf_info[0]
> being set to NULL prior to its being freed, causing a memory leak, which
> eventually exhausts the system on repeated create/destroy operations
> (for example, when  the mtu of a vmxnet3 interface is changed
> frequently.
> 
> Fix is pretty straight forward, just move the NULL set to after the
> free.
> 
> Tested by myself with successful results
> 
> Applies to net, and should likely be queued for stable, please
> 
> Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
> Reported-By: boyang@redhat.com

Thank you for root causing and fixing this.

Acked-by: Shrikrishna Khare <skhare@vmware.com>

Re: [PATCH] vmxnet3: repair memory leak

[David Miller]

From: Neil Horman <nhorman@tuxdriver.com>
Date: Mon, 22 Jan 2018 16:06:37 -0500

> with the introduction of commit
> b0eb57cb97e7837ebb746404c2c58c6f536f23fa, it appears that rq->buf_info
> is improperly handled.  While it is heap allocated when an rx queue is
> setup, and freed when torn down, an old line of code in
> vmxnet3_rq_destroy was not properly removed, leading to rq->buf_info[0]
> being set to NULL prior to its being freed, causing a memory leak, which
> eventually exhausts the system on repeated create/destroy operations
> (for example, when  the mtu of a vmxnet3 interface is changed
> frequently.
> 
> Fix is pretty straight forward, just move the NULL set to after the
> free.
> 
> Tested by myself with successful results
> 
> Applies to net, and should likely be queued for stable, please
> 
> Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
> Reported-By: boyang@redhat.com

Applied and queued up for -stable, thanks Neil.