Summary
_grow_allocation_fast_path maps a new chunk into a second, adjacent VA reservation and updates buf._size in place. The Buffer's deleter captured the original size when the buffer was created, so close() calls deallocate(ptr, original_size) and frees only the first reservation. The extension's reservation, mapping, and physical memory leak with no warning.
No deallocate(ptr, size) call can fix this: cuMemAddressFree frees a reservation only when ptr and size match exactly one reservation, so a range that spans two reservations cannot be freed in one call. The buffer needs to own each reservation and mapping it consists of.
Status
Today the fast path is unreachable (#2388 defect 2). #2237 and #2407 make it live and would expose this leak, so they should wait for this fix. The existing fast-path test mocks the driver and cannot catch it.
Refs: #2388, #2237, #2407, #2882.
Summary
_grow_allocation_fast_pathmaps a new chunk into a second, adjacent VA reservation and updatesbuf._sizein place. The Buffer's deleter captured the original size when the buffer was created, soclose()callsdeallocate(ptr, original_size)and frees only the first reservation. The extension's reservation, mapping, and physical memory leak with no warning.No
deallocate(ptr, size)call can fix this:cuMemAddressFreefrees a reservation only whenptrandsizematch exactly one reservation, so a range that spans two reservations cannot be freed in one call. The buffer needs to own each reservation and mapping it consists of.Status
Today the fast path is unreachable (#2388 defect 2). #2237 and #2407 make it live and would expose this leak, so they should wait for this fix. The existing fast-path test mocks the driver and cannot catch it.
Refs: #2388, #2237, #2407, #2882.