Skip to contentSkip to conversation

RDMA/mlx5: Fix prefetch memory leak if get_prefetchable_mr fails

PATCH Applied Leon Romanovsky 2 participants 2 messages Jul 27, 2020

Subsystems (2)
InfiniBand Mellanox MLX5 IB driver
lore
Share & tools
lore

Leon Romanovsky

author
#0 lore raw

PATCH 1/1 RDMA/mlx5: Fix prefetch memory leak if get_prefetchable_mr fails

From: Jason Gunthorpe <[email protected]>

destroy_prefetch_work() must always be called if the work is not going to be queued. The num_sge also should have been set to i, not i-1 which avoids the condition where it shouldn't have been called in the first place.

Cc [email protected]
Fixes fb985e278a30 ("RDMA/mlx5: Use SRCU properly in ODP prefetch")
Signed-off-by Jason Gunthorpe <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
---
 drivers/infiniband/hw/mlx5/odp.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/infiniband/hw/mlx5/odp.c +2 -3
index 4f1e46733830..cfd7efab114e 100644
@@ -1806,9 +1806,7 @@ static bool init_prefetch_work(struct ib_pd *pd,
 		work->frags[i].mr =
 			get_prefetchable_mr(pd, advice, sg_list[i].lkey);
 		if (!work->frags[i].mr) {
-			work->num_sge = i - 1;
-			if (i)
-				destroy_prefetch_work(work);
+			work->num_sge = i;
 			return false;
 		}
 

@@ -1875,6 +1873,7 @@ int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
 	srcu_key = srcu_read_lock(&dev->odp_srcu);
 	if (!init_prefetch_work(pd, advice, pf_flags, work, sg_list, num_sge)) {
 		srcu_read_unlock(&dev->odp_srcu, srcu_key);
+		destroy_prefetch_work(work);
 		return -EINVAL;
 	}
 	queue_work(system_unbound_wq, &work->work);

--
2.26.2

maintainer Applied
#1 lore raw
Quoted 7 lines · Leon Romanovsky

From: Jason Gunthorpe <[email protected]>

destroy_prefetch_work() must always be called if the work is not going to be queued. The num_sge also should have been set to i, not i-1 which avoids the condition where it shouldn't have been called in the first place.

Quoted 7 lines
Cc [email protected]
Fixes fb985e278a30 ("RDMA/mlx5: Use SRCU properly in ODP prefetch")
Signed-off-by Jason Gunthorpe <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
---
 drivers/infiniband/hw/mlx5/odp.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

Applied to for-rc

Jason