linux-kernel - Re: [RESEND] [PATCH] nvme-tcp: fix usage of page_frag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251028075918.GA14902@yadro.com>
Date: Tue, 28 Oct 2025 10:59:18 +0300
From: Dmitry Bogdanov <d.bogdanov@...ro.com>
To: Keith Busch <kbusch@...nel.org>
CC: Jens Axboe <axboe@...nel.dk>, Christoph Hellwig <hch@....de>, "Sagi
 Grimberg" <sagi@...mberg.me>, Stuart Hayes <stuart.w.hayes@...il.com>,
	<linux-nvme@...ts.infradead.org>, <linux-kernel@...r.kernel.org>,
	<linux@...ro.com>, <stable@...r.kernel.org>
Subject: Re: [RESEND] [PATCH] nvme-tcp: fix usage of page_frag_cache

On Mon, Oct 27, 2025 at 11:08:05AM -0600, Keith Busch wrote:
> On Mon, Oct 27, 2025 at 07:36:27PM +0300, Dmitry Bogdanov wrote:
> > nvme uses page_frag_cache to preallocate PDU for each preallocated request
> > of block device. Block devices are created in parallel threads,
> > consequently page_frag_cache is used in not thread-safe manner.
> > That leads to incorrect refcounting of backstore pages and premature free.
> >
> > That can be catched by !sendpage_ok inside network stack:
> >
> > WARNING: CPU: 7 PID: 467 at ../net/core/skbuff.c:6931 skb_splice_from_iter+0xfa/0x310.
> >       tcp_sendmsg_locked+0x782/0xce0
> >       tcp_sendmsg+0x27/0x40
> >       sock_sendmsg+0x8b/0xa0
> >       nvme_tcp_try_send_cmd_pdu+0x149/0x2a0
> > Then random panic may occur.
> >
> > Fix that by serializing the usage of page_frag_cache.
> >
> > Cc: stable@...r.kernel.org # 6.12
> > Fixes: 4e893ca81170 ("nvme_core: scan namespaces asynchronously")
> > Signed-off-by: Dmitry Bogdanov <d.bogdanov@...ro.com>
> > ---
> >  drivers/nvme/host/tcp.c | 8 ++++++++
> >  1 file changed, 8 insertions(+)
> >
> > diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
> > index 1413788ca7d52..823e07759e0d3 100644
> > --- a/drivers/nvme/host/tcp.c
> > +++ b/drivers/nvme/host/tcp.c
> > @@ -145,6 +145,7 @@ struct nvme_tcp_queue {
> >
> >       struct mutex            queue_lock;
> >       struct mutex            send_mutex;
> > +     struct mutex            pf_cache_lock;
> >       struct llist_head       req_list;
> >       struct list_head        send_list;
> >
> > @@ -556,9 +557,11 @@ static int nvme_tcp_init_request(struct blk_mq_tag_set *set,
> >       struct nvme_tcp_queue *queue = &ctrl->queues[queue_idx];
> >       u8 hdgst = nvme_tcp_hdgst_len(queue);
> >
> > +     mutex_lock(&queue->pf_cache_lock);
> >       req->pdu = page_frag_alloc(&queue->pf_cache,
> >               sizeof(struct nvme_tcp_cmd_pdu) + hdgst,
> >               GFP_KERNEL | __GFP_ZERO);
> > +     mutex_unlock(&queue->pf_cache_lock);
> >       if (!req->pdu)
> >               return -ENOMEM;
> 
> Just a bit confused by this. Everything related to a specific TCP queue
> should still be single threaded on the initialization of its tagset, so
> there shouldn't be any block devices accessing the queue's driver
> specific data before the tagset is initialized.

Hmm, we are both right. You are right that the preallocated requests that
are part of hw queue's tagset are preallocated at hw queue creation.
But there is one(per hw queueue actually) more request objects that
are preallocated for each block device - it's hctx->fq->flush_rq. I am
talking about that one.

The call stack is the following:
nvme_scan_ns_list =parallel on all CPUs=>
 nvme_scan_ns_async->nvme_scan_ns -> nvme_alloc_ns -> nvme_alloc_ns ->
 __blk_mq_alloc_disk -> blk_mq_alloc_queue -> blk_mq_init_allocated_queue ->
 blk_mq_realloc_hw_ctxs for each hw(TCP) queue do ->
  blk_mq_alloc_and_init_hctx(queue) -> blk_mq_init_hctx ->
  blk_mq_init_request(flush_rq) -> nvme_tcp_init_request ->
  page_frag_alloc(tcp_queue)



BR,
 Dmitry