Skip to contentSkip to conversation

infiniband: remove dead code

PATCH In review Dan Carpenter 4 participants 6 messages Mar 15, 2010 – Apr 3, 2010 2 messages not in the archive

Subsystems (3)
Kernel janitors InfiniBand iSCSI extensions for RDMA (iSER) initiator
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 infiniband: remove dead code

"ret" is initialized to -ENOMEM so we don't need to set it here.

Signed-off-by Dan Carpenter <[email protected]>
drivers/infiniband/ulp/iser/iser_verbs.c +3 -6
index 308d17b..8fa6997 100644
@@ -148,10 +148,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	device = ib_conn->device;
 
 	ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
-	if (!ib_conn->login_buf) {
+	if (!ib_conn->login_buf)
 		goto alloc_err;
-		ret = -ENOMEM;
-	}
 
 	ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
 				(void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,

@@ -160,10 +158,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
 				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
 				    GFP_KERNEL);
-	if (!ib_conn->page_vec) {
-		ret = -ENOMEM;
+	if (!ib_conn->page_vec)
 		goto alloc_err;
-	}
+
 	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
 
 	params.page_shift        = SHIFT_4K;
#1 lore raw
Quoted 23 lines · Dan Carpenter

"ret" is initialized to -ENOMEM so we don't need to set it here.

Signed-off-by Dan Carpenter <[email protected]>
drivers/infiniband/ulp/iser/iser_verbs.c +1 -3
index 308d17b..8fa6997 100644
@@ -148,10 +148,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	device = ib_conn->device;
 
 	ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
-	if (!ib_conn->login_buf) {
+	if (!ib_conn->login_buf)
 		goto alloc_err;
-		ret = -ENOMEM;
-	}
 
 	ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
 				(void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,

@@ -160,10 +158,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
 				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),

drivers/infiniband/ulp/iser/iser_verbs.c static int iser_create_ib_conn_res(struct iser_conn *ib_conn) · line 166

Quoted 10 lines
drivers/infiniband/ulp/iser/iser_verbs.c +2 -3
 				    GFP_KERNEL);
-	if (!ib_conn->page_vec) {
-		ret = -ENOMEM;
+	if (!ib_conn->page_vec)
 		goto alloc_err;
-	}
+
 	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
 
 	params.page_shift        = SHIFT_4K;

If there's a failure while allocating page_vec, login_buf will not be released. A single extra label should solve this.

Regards,
Cascardo.

A message that is not in the archive (sent off-list or not yet received): [email protected]

author
#3 lore raw
Quoted 33 lines · Thadeu Lima de Souza Cascardo
Quoted 32 lines · Dan Carpenter

"ret" is initialized to -ENOMEM so we don't need to set it here.

Signed-off-by Dan Carpenter <[email protected]>
drivers/infiniband/ulp/iser/iser_verbs.c +3 -6
index 308d17b..8fa6997 100644
@@ -148,10 +148,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	device = ib_conn->device;
 
 	ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
-	if (!ib_conn->login_buf) {
+	if (!ib_conn->login_buf)
 		goto alloc_err;
-		ret = -ENOMEM;
-	}
 
 	ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
 				(void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,

@@ -160,10 +158,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
 				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
 				    GFP_KERNEL);
-	if (!ib_conn->page_vec) {
-		ret = -ENOMEM;
+	if (!ib_conn->page_vec)
 		goto alloc_err;
-	}
+
 	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
Quoted 7 lines

drivers/infiniband/ulp/iser/iser_verbs.c static int iser_create_ib_conn_res(struct iser_conn *ib_conn) · line 166

Quoted 1 line
drivers/infiniband/ulp/iser/iser_verbs.c +0 -0
 	params.page_shift        = SHIFT_4K;

If there's a failure while allocating page_vec, login_buf will not be released. A single extra label should solve this.

Regards,
Cascardo.

Hm... Actually it looks like we should just remove both those calls to kfree() and the ib_destroy_fmr_pool(). Otherwise we'll do a double free when we get to iser_conn_release().

The call tree looks like this:
iser_connect() => iser_cma_handler() => iser_route_handler()

	=> iser_create_ib_conn_res()

		We fail here and return failures back down the tree.

iser_connect() => iser_conn_release()

Double free.

I will send a patch for this tomorrow.

regards,
dan carpenter

#4 lore raw
Quoted 3 lines · Dan Carpenter

Hm...  Actually it looks like we should just remove both those
calls to kfree() and the ib_destroy_fmr_pool().  Otherwise we'll do
a double free when we get to iser_conn_release(). [...] I will send a patch for this tomorrow.

Dan, thanks for reporting that. I will be able to look on the problem and the suggested patch later this week

Or.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): 15ddcffd1003160027q47286fcqa1344c964fe472b0-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org

#6 lore raw

PATCH 1/1 infiniband: potential double free

We shouldn't free things here because we free them later. The call tree looks like this:
iser_connect() => iser_cma_handler() => iser_route_handler()
=> iser_create_ib_conn_res()

We fail here and return failures back down the tree.

iser_connect() => iser_conn_release()

Double free.

Also "ret" is already initialized to -ENOMEM so there is no need to set that here.

Signed-off-by Dan Carpenter <[email protected]>
drivers/infiniband/ulp/iser/iser_verbs.c +8 -16
index 308d17b..fde2c93 100644
@@ -148,10 +148,8 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	device = ib_conn->device;
 
 	ib_conn->login_buf = kmalloc(ISER_RX_LOGIN_SIZE, GFP_KERNEL);
-	if (!ib_conn->login_buf) {
-		goto alloc_err;
-		ret = -ENOMEM;
-	}
+	if (!ib_conn->login_buf)
+		goto out_err;
 
 	ib_conn->login_dma = ib_dma_map_single(ib_conn->device->ib_device,
 				(void *)ib_conn->login_buf, ISER_RX_LOGIN_SIZE,

@@ -160,10 +158,9 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	ib_conn->page_vec = kmalloc(sizeof(struct iser_page_vec) +
 				    (sizeof(u64) * (ISCSI_ISER_SG_TABLESIZE +1)),
 				    GFP_KERNEL);
-	if (!ib_conn->page_vec) {
-		ret = -ENOMEM;
-		goto alloc_err;
-	}
+	if (!ib_conn->page_vec)
+		goto out_err;
+
 	ib_conn->page_vec->pages = (u64 *) (ib_conn->page_vec + 1);
 
 	params.page_shift        = SHIFT_4K;

@@ -183,7 +180,7 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 	ib_conn->fmr_pool = ib_create_fmr_pool(device->pd, &params);
 	if (IS_ERR(ib_conn->fmr_pool)) {
 		ret = PTR_ERR(ib_conn->fmr_pool);
-		goto fmr_pool_err;
+		goto out_err;
 	}
 
 	memset(&init_attr, 0, sizeof init_attr);

@@ -201,7 +198,7 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 
 	ret = rdma_create_qp(ib_conn->cma_id, device->pd, &init_attr);
 	if (ret)
-		goto qp_err;
+		goto out_err;
 
 	ib_conn->qp = ib_conn->cma_id->qp;
 	iser_err("setting conn %p cma_id %p: fmr_pool %p qp %p\n",

@@ -209,12 +206,7 @@ static int iser_create_ib_conn_res(struct iser_conn *ib_conn)
 		 ib_conn->fmr_pool, ib_conn->cma_id->qp);
 	return ret;
 
-qp_err:
-	(void)ib_destroy_fmr_pool(ib_conn->fmr_pool);
-fmr_pool_err:
-	kfree(ib_conn->page_vec);
-	kfree(ib_conn->login_buf);
-alloc_err:
+out_err:
 	iser_err("unable to alloc mem or create resource, err %d\n", ret);
 	return ret;
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

#7 lore raw

Re: [patch] infiniband: potential double free

Quoted 1 line · Dan Carpenter

We shouldn't free things here because we free them later.  The call tree looks like this:

Hi Dan, Roland,

We're at a somehow high holiday (e.g Passover) season, and as such I haven't resolve the issue Dan brought yet. However, all in all this is --not-- a regression but rather a bug in the error handling code of a path (synchronous connection establishment) which isn't used (e.g non_blocking is always true when called by the iscsi stack).

I will make sure to fix the issue for the next merge window, and
actually queue a fixed/reviewed patch (e.g review what Dan works on)
way before that. So in that respect, Roland, you need not to deal with
this directly. Please make sure to cc [email protected] on each related mail, thanks

Or.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html