[Bug 2153962] Re: net/rds: reset op_nents when zerocopy page pin fails

Currently I am able to verify the reproducer no longer works on Q/R, but not N/J/F. -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2153962 Title: net/rds: reset op_nents when zerocopy page pin fails Status in linux package in Ubuntu: In Progress Status in linux source package in Focal: In Progress Status in linux source package in Jammy: In Progress Status in linux source package in Noble: In Progress Status in linux source package in Questing: In Progress Status in linux source package in Resolute: In Progress Bug description: From https://lore.kernel.org/netdev/20260505234336.2132721-1-achender@kernel.org/ When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user(). Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.") Signed-off-by: Allison Henderson <achender@kernel.org> --- net/rds/message.c | 1 + 1 file changed, 1 insertion(+) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2153962/+subscriptions