Linux kernel (drivers/pci): A failed mmap of peer-to-peer DMA memory leaks the pgmap reference it took, and the leak is

Impact

A failed mmap of peer-to-peer DMA memory leaks the pgmap reference it took, and the leak is permanent - memunmap_pages() then blocks forever when the PCI device is removed. The node keeps a P2PDMA-capable device it can never release, and the removal thread is stuck unkillably, so device reclaim and driver replacement on that node stop working until it is rebooted.

Who can reach it

Reached from userspace by mmap()ing a p2pmem region, so it needs a process with access to the P2PDMA-exposing device - relevant on GPU/NVMe nodes because peer-to-peer DMA is what GPUDirect-style paths use. The leak occurs on the vm_insert_page() failure path, so an attacker needs to make that insert fail, which in practice means driving the node under memory pressure while looping the mapping. Conditional on CONFIG_PCI_P2PDMA and a driver that publishes p2pmem; nodes without it are unaffected.

What to do

Boot a kernel with the percpu_ref_put() added to the p2pmem_alloc_mmap() failure path. Interim: do not expose p2pmem device nodes to tenant containers, and treat a hung PCI remove on a P2PDMA node as needing a reboot rather than waiting it out.

References