[Bug 2153962] Re: net/rds: reset op_nents when zerocopy page pin fails

This bug is awaiting verification that the linux/7.0.0-19.19 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-resolute-linux' to 'verification-done-resolute- linux'. If the problem still exists, change the tag 'verification- needed-resolute-linux' to 'verification-failed-resolute-linux'. If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you! ** Tags added: kernel-spammed-resolute-linux-v2 verification-needed-resolute-linux -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2153962 Title: net/rds: reset op_nents when zerocopy page pin fails Status in linux package in Ubuntu: In Progress Status in linux source package in Focal: Fix Committed Status in linux source package in Jammy: In Progress Status in linux source package in Noble: In Progress Status in linux source package in Questing: In Progress Status in linux source package in Resolute: In Progress Bug description: From https://lore.kernel.org/netdev/20260505234336.2132721-1-achender@kernel.org/ When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user(). Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.") Signed-off-by: Allison Henderson <achender@kernel.org> --- net/rds/message.c | 1 + 1 file changed, 1 insertion(+) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2153962/+subscriptions