Commit 0dfc70c3 authored by Keith Busch's avatar Keith Busch Committed by Jens Axboe

NVMe: Fix memory leak on retried commands

Resources are reallocated for requeued commands, so unmap and release
the iod for the failed command.

It's a pretty bad memory leak and causes a kernel hang if you remove a
drive because of a busy dma pool. You'll get messages spewing like this:

  nvme 0000:xx:xx.x: dma_pool_destroy prp list 256, ffff880420dec000 busy

and lock up pci and the driver since removal never completes while
holding a lock.

Cc: stable@vger.kernel.org
Cc: <stable@vger.kernel.org> # 4.0.x-
Signed-off-by: default avatarKeith Busch <keith.busch@intel.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarJens Axboe <axboe@fb.com>
parent b02176f3
...@@ -604,6 +604,7 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx, ...@@ -604,6 +604,7 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx,
struct request *req = iod_get_private(iod); struct request *req = iod_get_private(iod);
struct nvme_cmd_info *cmd_rq = blk_mq_rq_to_pdu(req); struct nvme_cmd_info *cmd_rq = blk_mq_rq_to_pdu(req);
u16 status = le16_to_cpup(&cqe->status) >> 1; u16 status = le16_to_cpup(&cqe->status) >> 1;
bool requeue = false;
int error = 0; int error = 0;
if (unlikely(status)) { if (unlikely(status)) {
...@@ -611,12 +612,13 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx, ...@@ -611,12 +612,13 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx,
&& (jiffies - req->start_time) < req->timeout) { && (jiffies - req->start_time) < req->timeout) {
unsigned long flags; unsigned long flags;
requeue = true;
blk_mq_requeue_request(req); blk_mq_requeue_request(req);
spin_lock_irqsave(req->q->queue_lock, flags); spin_lock_irqsave(req->q->queue_lock, flags);
if (!blk_queue_stopped(req->q)) if (!blk_queue_stopped(req->q))
blk_mq_kick_requeue_list(req->q); blk_mq_kick_requeue_list(req->q);
spin_unlock_irqrestore(req->q->queue_lock, flags); spin_unlock_irqrestore(req->q->queue_lock, flags);
return; goto release_iod;
} }
if (req->cmd_type == REQ_TYPE_DRV_PRIV) { if (req->cmd_type == REQ_TYPE_DRV_PRIV) {
...@@ -639,6 +641,7 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx, ...@@ -639,6 +641,7 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx,
"completing aborted command with status:%04x\n", "completing aborted command with status:%04x\n",
error); error);
release_iod:
if (iod->nents) { if (iod->nents) {
dma_unmap_sg(nvmeq->dev->dev, iod->sg, iod->nents, dma_unmap_sg(nvmeq->dev->dev, iod->sg, iod->nents,
rq_data_dir(req) ? DMA_TO_DEVICE : DMA_FROM_DEVICE); rq_data_dir(req) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
...@@ -651,6 +654,7 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx, ...@@ -651,6 +654,7 @@ static void req_completion(struct nvme_queue *nvmeq, void *ctx,
} }
nvme_free_iod(nvmeq->dev, iod); nvme_free_iod(nvmeq->dev, iod);
if (likely(!requeue))
blk_mq_complete_request(req, error); blk_mq_complete_request(req, error);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment