From nobody Sun Nov 01 04:06:20 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jHLqc3cNpz6xXCs for ; Sun, 01 Nov 2026 04:06:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jHLqc16GDz4jLH for ; Sun, 01 Nov 2026 04:06:20 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793505980; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ucj6cKZxQF1v2unbHCp21M/CXd87lbNHskc72vDWk9s=; b=DKdhS3LtUFyFbDJ4/zEIzMzJb7yNUR2nURUwxCMPxq5HH/wdAzbcL7+0YYIAlTvPrYba/I jaYiFX0VHI5iZ/mMBnZ0B4Vu3YLZoZ2KNB37inL3hD5OrH8R0QuKHqvARJHFSN6ug8Ddzt QkZNUpiWL8lt8jyRyjVkfK/Lf9cHE99hNF7L3oiU83gXGjPt1vFujxop/iR/e6jpgDLgsC lKq/YV99xedYD18cIeozXLeM6B8ACNQBePMtKnWOykxroR58/iU6tudWPQv/FCUXdwgoTg 07ktl6geC/ETbDwwYSyAjjHEeNmUDn/dxW/TJggigH7VgusR4sEFJhZRatGtDQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793505980; b=aBuBt6qmXp/oLB5Ff15RnjIZoa6WFTOMKU5+uHjzh7f7PsR4GQO8WMDBkSCiWIYmZfrALr 6VvSFw1NEE6e5FQT2SlINfw71pBdUIVXGYWwvGPyjawm42Z0T0MjawLsaDCFXYacfvnf8J DxHrIkenVPEOkswCa4VpkBQwinLcx2tSBCKfjivQ2CEq/PFAK5p+u+hBU0ZQHCDS/srEit DagTXzCFdEnC1lc3Hyeug6K5AOua+KrlSzq+xRH1XUuHByWTAsW2HsJP7WUpr2Jd8GFNS/ vsH6uuKy5p6KpZ9e8lwYi6G0xOJt1W3m6szEkuUFAUzEb4sfIHgQ3EOxHGFF+A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793505980; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Ucj6cKZxQF1v2unbHCp21M/CXd87lbNHskc72vDWk9s=; b=rclgAhVz34tejKT2+h3yKCTCy6h40TQjKIa8CIzKzvEqwf+u6pZqdw3vTtiGE+eI18VVJZ 9MOjgi+YahwowHP1d8TlzCOPspIJtCjTfPsfTmSVSQxik8YPXYFSz5pyjWmoMHNga5Tiio lSXAIl7WWeih6kD+wedTdytRGesDt59W8VyhKv6x8QAtv436IcgHdtYWc2gOo6Am3SJ92Q VBcZG/tslPPace2IvORzDLCJh4CpMgmy80FhW92h5EdvMYi/wWQrQWqZ0cY14V+GiLKhca aT1UJtx3hbTCr8rWrvzZklXhpHtMfrsYPsy3jD/QPZN0/JxO9Ljx4Ipy25RwcQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jHLqc0TN0zjqv for ; Sun, 01 Nov 2026 04:06:20 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3c9bb by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 01 Nov 2026 04:06:20 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Rick Macklem Subject: git: 63302e904a52 - main - nfs_clrpcops.c: Fix an mbuf leak introduced by fec497b89b1a List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rmacklem X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 63302e904a52a30692659a9144825b657269aa4c Auto-Submitted: auto-generated Date: Sun, 01 Nov 2026 04:06:20 +0000 Message-Id: <6ae6babc.3c9bb.229b0ac6@gitrepo.freebsd.org> The branch main has been updated by rmacklem: URL: https://cgit.FreeBSD.org/src/commit/?id=63302e904a52a30692659a9144825b657269aa4c commit 63302e904a52a30692659a9144825b657269aa4c Author: Rick Macklem AuthorDate: 2026-11-01 03:47:34 +0000 Commit: Rick Macklem CommitDate: 2026-11-01 04:04:38 +0000 nfs_clrpcops.c: Fix an mbuf leak introduced by fec497b89b1a The calls to rpc_free_rdma_reduction() were removed, but I forgot that newnfs_request() removes the reduction mbuf from the list upon success, so it has to be free'd separately. This patch does that. The patch also disables reduction after the first loop interation. This is necessary until nfsm_build_rdma_reduction() is patched to handle an offset within the page array. Reported by: markj MFC after: 1 month Fixes: 884ee8d6c9b4 ("nfscl: Add some glue for client side NFS over RDMA") --- sys/fs/nfsclient/nfs_clrpcops.c | 57 +++++++++++++++++++++++++++-------------- 1 file changed, 38 insertions(+), 19 deletions(-) diff --git a/sys/fs/nfsclient/nfs_clrpcops.c b/sys/fs/nfsclient/nfs_clrpcops.c index 0acca38ae248..464481eca0e2 100644 --- a/sys/fs/nfsclient/nfs_clrpcops.c +++ b/sys/fs/nfsclient/nfs_clrpcops.c @@ -1830,25 +1830,10 @@ nfsrpc_readrpc(vnode_t vp, struct uio *uiop, vm_page_t *pgp, struct ucred *cred, struct nfsrv_descript *nd = &nfsd; int rsize; off_t tmp_off; - bool did_rdma, reduced; + bool did_rdma, reduced, first_loop; *attrflagp = 0; tsiz = uiop->uio_resid; - did_rdma = false; - mbflag = 0; - if (NFSHASRDMA(nmp) && tsiz > 0) { - /* Assume the rest of the RPC without data is <= 1024 bytes. */ - if (pgp != NULL && (uiop->uio_offset & PAGE_MASK) == 0 && - uiop->uio_segflg == UIO_SYSSPACE && - !NFSHASNOREADREDUCE(nmp)) - did_rdma = true; - else if (tsiz <= PAGE_SIZE - 1024) - mbflag = M_PROTO7; - else if (tsiz <= NFS_DIRBLKSIZ + PAGE_SIZE - 1024) - mbflag = M_PROTO8; - else - mbflag = M_PROTO9; - } tmp_off = uiop->uio_offset + tsiz; NFSLOCKMNT(nmp); if (tmp_off > nmp->nm_maxfilesize || tmp_off < uiop->uio_offset) { @@ -1858,10 +1843,32 @@ nfsrpc_readrpc(vnode_t vp, struct uio *uiop, vm_page_t *pgp, struct ucred *cred, rsize = nmp->nm_rsize; NFSUNLOCKMNT(nmp); nd->nd_mrep = NULL; - mr = NULL; + first_loop = true; while (tsiz > 0) { + mr = NULL; *attrflagp = 0; len = (tsiz > rsize) ? rsize : tsiz; + did_rdma = false; + mbflag = 0; + if (NFSHASRDMA(nmp) && len > 0) { + /* + * Until nfsm_build_rdma_reduction() handles an offset + * within the pages, this can only be done for the first + * iteration. + */ + if (first_loop && pgp != NULL && + (uiop->uio_offset & PAGE_MASK) == 0 && + uiop->uio_segflg == UIO_SYSSPACE && + !NFSHASNOREADREDUCE(nmp)) + did_rdma = true; + else if (len <= PAGE_SIZE - 1024) + mbflag = M_PROTO7; + else if (len <= NFS_DIRBLKSIZ + PAGE_SIZE - 1024) + mbflag = M_PROTO8; + else + mbflag = M_PROTO9; + } + first_loop = false; NFSCL_REQSTART(nd, NFSPROC_READ, vp, cred); nd->nd_mreq->m_flags |= mbflag; if (nd->nd_flag & ND_NFSV4) @@ -1916,6 +1923,9 @@ nfsrpc_readrpc(vnode_t vp, struct uio *uiop, vm_page_t *pgp, struct ucred *cred, error = rpc_copy_uio_pages(mr, uiop, retlen, true); } + if (mr != NULL) + m_free(mr); + mr = NULL; if (error) goto nfsmout; m_freem(nd->nd_mrep); @@ -1929,6 +1939,8 @@ nfsrpc_readrpc(vnode_t vp, struct uio *uiop, vm_page_t *pgp, struct ucred *cred, } return (0); nfsmout: + if (mr != NULL) + m_free(mr); if (nd->nd_mrep != NULL) m_freem(nd->nd_mrep); return (error); @@ -2042,7 +2054,7 @@ nfsrpc_writerpc(vnode_t vp, struct uio *uiop, vm_page_t *pgp, int *iomode, nfsattrbit_t attrbits; uint64_t tmp_off; ssize_t tsiz, wsize; - bool do_append, did_rdma; + bool do_append, did_rdma, first_loop; KASSERT(uiop->uio_iovcnt == 1, ("nfs: writerpc iovcnt > 1")); *attrflagp = 0; @@ -2066,7 +2078,9 @@ nfsrpc_writerpc(vnode_t vp, struct uio *uiop, vm_page_t *pgp, int *iomode, nd = malloc(sizeof(*nd), M_TEMP, M_WAITOK); nd->nd_mrep = NULL; /* NFSv2 sometimes does a write with */ nd->nd_repstat = 0; /* uio_resid == 0, so the while is not done */ + first_loop = true; while (tsiz > 0) { + mr = NULL; *attrflagp = 0; len = (tsiz > wsize) ? wsize : tsiz; if (do_append) @@ -2116,7 +2130,7 @@ nfsrpc_writerpc(vnode_t vp, struct uio *uiop, vm_page_t *pgp, int *iomode, *tl = x; /* size of this write */ } /* For RDMA, make the data a separate chunk. */ - if (did_rdma) { + if (did_rdma && first_loop) { rlen = m_length(nd->nd_mreq, NULL); mr = nfsm_build_rdma_reduction(pgp, nd, len, rlen, false); @@ -2124,6 +2138,7 @@ nfsrpc_writerpc(vnode_t vp, struct uio *uiop, vm_page_t *pgp, int *iomode, } else { error = nfsm_uiombuf(nd, uiop, len); } + first_loop = false; if (error != 0) { nfsv4_freeunsentslot(nmp, NULL, nd); m_freem(nd->nd_mreq); @@ -2161,6 +2176,10 @@ nfsrpc_writerpc(vnode_t vp, struct uio *uiop, vm_page_t *pgp, int *iomode, free(nd, M_TEMP); return (error); } + if (mr != NULL) { + m_free(mr); + mr = NULL; + } if (nd->nd_repstat) { /* * In case the rpc gets retried, roll