From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from arkamax.eu (128-116-240-228.dyn.eolo.it [128.116.240.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF8C73DB63F for ; Fri, 12 Jun 2026 09:52:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=128.116.240.228 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781257933; cv=none; b=Nvs8v0utNIsOcOuMNSJOZxg73/wUiwUxRrvc0gj0AJ+qWQgCV38e6FprXyGDoPCPK8PMNiXifSBuBQEk6+UGBIIMjY4m5rNU6ofzu8RoGzqm8HdflU2sNexFZHHRQgut21/0KZHnjOBdTbeRX8HRnEksu/+Peij+ZgGpIjv4XpI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781257933; c=relaxed/simple; bh=MCI2inSJlJLyBeNPP6V9PSatmiA6lvsbDiT7RKNcBvo=; h=Mime-Version:Content-Type:Date:Message-Id:Cc:Subject:From:To: References:In-Reply-To; b=VSD+z2ChfjNk3q0D9+Hrq1mLxhOICsAZJLY6ditwu/hRa01RsBZU6AkEMHfZGJ/OWZbkQJqX26o+1QI7oXnB55N8PexXJauLKnsytKsDaE9ZWhO5JXBZykpNp3zobpDC6WZTycs8ceqpInK2NEAZ0JPTYghbgbuR7g96FGR7vzE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=arkamax.eu; spf=pass smtp.mailfrom=arkamax.eu; dkim=pass (2048-bit key) header.d=arkamax.eu header.i=@arkamax.eu header.b=W7kK/D8K; arc=none smtp.client-ip=128.116.240.228 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=arkamax.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arkamax.eu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=arkamax.eu header.i=@arkamax.eu header.b="W7kK/D8K" DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; s=mail1; bh=MCI2inSJlJLyBe NPP6V9PSatmiA6lvsbDiT7RKNcBvo=; h=in-reply-to:references:to:from: subject:cc:date; d=arkamax.eu; b=W7kK/D8K6cvaQGozcHoygLNpYuoQKR4N6/Pi0 wuzC5L9JUdYJPMgoYgqiGEyWtXrFnUgvohpj7NEcPyf0IDa4WG6YtzC7e0AybKEUg7FIse CZigv757i8r0kHvTjDmpkFmTil+xqyvXj0bxTgzlkdkRppjJRhzIH6/c4N/C1PCwTYb1jh 1gw27fIJhQ2+AZgsheIuNPvKPeRpXeoEJW7wDwYO4ig6j29YregvnlDQbeZ0Q8jL7SL1nA +R3HTHRdEgr9GPkJnT7TiRaXdZYsXl4E+vkNIlUHGEEdVynuxCJq+iU14RCEW9sqgPfn/n YLnekulljZjBX+WnVHE7AE2ug== Received: from localhost (128-116-240-228.dyn.eolo.it [128.116.240.228]) by arkamax.eu (OpenSMTPD) with ESMTPSA id e76f0e4d (TLSv1.3:TLS_AES_256_GCM_SHA384:256:NO); Fri, 12 Jun 2026 11:45:26 +0200 (CEST) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Fri, 12 Jun 2026 11:45:26 +0200 Message-Id: Cc: "Daniel Gomez" , , Subject: Re: [PATCH] nvme: unmap the data buffer when metadata mapping fails From: "Maurizio Lombardi" To: "Joel Granados" , "Keith Busch" , "Jens Axboe" , "Christoph Hellwig" , "Sagi Grimberg" X-Mailer: aerc 0.21.0 References: <20260612-jag-fixes-v1-1-24423dc8afdb@kernel.org> In-Reply-To: <20260612-jag-fixes-v1-1-24423dc8afdb@kernel.org> On Fri Jun 12, 2026 at 11:40 AM CEST, Joel Granados wrote: > Commit d0d1d522316e ("blk-map: provide the bdev to bio if one exists") > dropped the "bio =3D req->bio" assignment in nvme_map_user_request(), but > left the local bio variable initialized to NULL and still used it in the > out_unmap error path. The "if (bio)" test is therefore always false, so > a failure of blk_rq_integrity_map_user() no longer unmaps the already > mapped data buffer. The callers only call blk_mq_free_request(), which > does not unmap user pages, leaking the bio and its pinned user pages. > > Use req->bio directly to unmap the data buffer on the error path, and > drop the now unused local variable. > > Fixes: d0d1d522316e ("blk-map: provide the bdev to bio if one exists") > > Signed-off-by: Joel Granados > --- > Did we forget to unmap? > --- Isn't this already fixed in mainline tree? 2279cd9c61a330e5 ("nvme: fix bio leak on mapping failure") Maurizio > drivers/nvme/host/ioctl.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/drivers/nvme/host/ioctl.c b/drivers/nvme/host/ioctl.c > index 9597a87cf05dc32a7eb0373485f575502c32a105..9ae3c0aadfb8f35790c8e5761= 9d1af69ca41af0c 100644 > --- a/drivers/nvme/host/ioctl.c > +++ b/drivers/nvme/host/ioctl.c > @@ -122,7 +122,6 @@ static int nvme_map_user_request(struct request *req,= u64 ubuffer, > bool supports_metadata =3D bdev && blk_get_integrity(bdev->bd_disk); > struct nvme_ctrl *ctrl =3D nvme_req(req)->ctrl; > bool has_metadata =3D meta_buffer && meta_len; > - struct bio *bio =3D NULL; > int ret; > =20 > if (!nvme_ctrl_sgl_supported(ctrl)) > @@ -154,8 +153,8 @@ static int nvme_map_user_request(struct request *req,= u64 ubuffer, > return ret; > =20 > out_unmap: > - if (bio) > - blk_rq_unmap_user(bio); > + if (req->bio) > + blk_rq_unmap_user(req->bio); > return ret; > } > =20 > > --- > base-commit: adeac771f4901bb66267eaddb9fcc538925f92a4 > change-id: 20260612-jag-fixes-6b459ea16d53 > > Best regards,