linux-kernel - [PATCH] nvmet: fix memory leak of bio integrity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250625114533.24041-1-d.bogdanov@yadro.com>
Date: Wed, 25 Jun 2025 14:45:33 +0300
From: Dmitry Bogdanov <d.bogdanov@...ro.com>
To: Christoph Hellwig <hch@....de>, Sagi Grimberg <sagi@...mberg.me>,
	Chaitanya Kulkarni <kch@...dia.com>, <linux-nvme@...ts.infradead.org>,
	<linux-kernel@...r.kernel.org>
CC: <linux@...ro.com>, Dmitry Bogdanov <d.bogdanov@...ro.com>,
	<stable@...r.kernel.org>
Subject: [PATCH] nvmet: fix memory leak of bio integrity

If nvmet receives commands with metadata there is a continuous memory leak
of kmalloc-128 slab or more precisely bio->bi_integrity.

Since that [1] patch series the integrity is not get free at bio_end_io
for submitter owned integrity. It has to free explicitly.

After commit bf4c89fc8797  ("block: don't call bio_uninit from bio_endio")
each user of bio_init has to use bio_uninit as well. Otherwise the bio
integrity is not getting free. Nvmet uses bio_init for inline bios.

Uninit the inline bio to complete deallocation of integrity in bio.

[1] https://lore.kernel.org/all/20240702151047.1746127-1-hch@lst.de/

Cc: stable@...r.kernel.org # 6.11
Signed-off-by: Dmitry Bogdanov <d.bogdanov@...ro.com>
---
 drivers/nvme/target/nvmet.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index df69a9dee71c..51df72f5e89b 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -867,6 +867,8 @@ static inline void nvmet_req_bio_put(struct nvmet_req *req, struct bio *bio)
 {
 	if (bio != &req->b.inline_bio)
 		bio_put(bio);
+	else
+		bio_uninit(bio);
 }

 #ifdef CONFIG_NVME_TARGET_TCP_TLS
-- 
2.25.1