[PATCH] nvmet: free the bvec on file namespace range errors

[PATCH] nvmet: free the bvec on file namespace range errors

[Jérémy Jean]

nvmet_file_execute_rw() allocates the bvec before
nvmet_file_execute_io() checks whether the request fits in the backing
file. If the request extends beyond the file, nvmet_file_execute_io()
calls nvmet_req_complete() to return an error. This skips
nvmet_file_io_done(), so the allocated memory is never freed. Repeated
requests can exhaust memory.

Use nvmet_file_io_done() to free the bvec before returning the range
error to the client.

Fixes: 50a909db36f2 ("nvmet: use IOCB_NOWAIT for file-ns buffered I/O")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 drivers/nvme/target/io-cmd-file.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c
index 0b22d18..695963d 100644
--- a/drivers/nvme/target/io-cmd-file.c
+++ b/drivers/nvme/target/io-cmd-file.c
@@ -133,8 +133,8 @@ static bool nvmet_file_execute_io(struct nvmet_req *req, int ki_flags)
 
 	pos = le64_to_cpu(req->cmd->rw.slba) << req->ns->blksize_shift;
 	if (unlikely(pos + req->transfer_len > req->ns->size)) {
-		nvmet_req_complete(req, errno_to_nvme_status(req, -ENOSPC));
-		return true;
+		ret = -ENOSPC;
+		goto complete;
 	}
 
 	memset(&req->f.iocb, 0, sizeof(struct kiocb));

Re: [PATCH] nvmet: free the bvec on file namespace range errors

[Christoph Hellwig]

On Wed, Oct 07, 2026 at 07:27:46PM +0000, Jérémy Jean wrote:
> nvmet_file_execute_rw() allocates the bvec before
> nvmet_file_execute_io() checks whether the request fits in the backing
> file. If the request extends beyond the file, nvmet_file_execute_io()
> calls nvmet_req_complete() to return an error. This skips
> nvmet_file_io_done(), so the allocated memory is never freed. Repeated
> requests can exhaust memory.
> 
> Use nvmet_file_io_done() to free the bvec before returning the range
> error to the client.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH] nvmet: free the bvec on file namespace range errors

[Keith Busch]

On Wed, Oct 07, 2026 at 07:27:46PM +0000, Jérémy Jean wrote:
> nvmet_file_execute_rw() allocates the bvec before
> nvmet_file_execute_io() checks whether the request fits in the backing
> file. If the request extends beyond the file, nvmet_file_execute_io()
> calls nvmet_req_complete() to return an error. This skips
> nvmet_file_io_done(), so the allocated memory is never freed. Repeated
> requests can exhaust memory.
> 
> Use nvmet_file_io_done() to free the bvec before returning the range
> error to the client.

Thanks, applied to nvme-7.4.