Skip to contentSkip to conversation

net: rds: fix MR cleanup on copy error

PATCH Applied Ren Wei 3 participants 3 messages Apr 22 – Apr 23 1 message not in the archive

Subsystems (4)
Networking Network drivers InfiniBand RDS - reliable datagram sockets
lore
Share & tools
lore

Ren Wei

author
#1 lore raw

PATCH 1/1 net: rds: fix MR cleanup on copy error

In reply to a message not in the archive

From: Ao Zhou <[email protected]>

__rds_rdma_map() hands sg/pages ownership to the transport after get_mr() succeeds. If copying the generated cookie back to user space fails after that point, the error path must not free those resources again before dropping the MR reference.

Remove the duplicate unpin/free from the put_user() failure branch so that MR teardown is handled only through the existing final cleanup path.

Fixes 0d4597c8c5ab ("net/rds: Track user mapped pages through special API")
Cc [email protected]
Reported-by Yuan Tan <[email protected]>
Reported-by Yifan Wu <[email protected]>
Reported-by Juefei Pu <[email protected]>
Reported-by Xin Liu <[email protected]>
Signed-off-by Ao Zhou <[email protected]>
Signed-off-by Ren Wei <[email protected]>
---
 net/rds/rdma.c | 4 ----
 1 file changed, 4 deletions(-)
net/rds/rdma.c +0 -4
index aa6465dc742c..61fb6e45281b 100644
@@ -326,10 +326,6 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
 
 	if (args->cookie_addr &&
 	    put_user(cookie, (u64 __user *)(unsigned long)args->cookie_addr)) {
-		if (!need_odp) {
-			unpin_user_pages(pages, nr_pages);
-			kfree(sg);
-		}
 		ret = -EFAULT;
 		goto out;
 	}
Signature · 1 line
2.43.0
maintainer Reviewed-by on v1 1/1
#2 lore raw
Quoted 11 lines · Ren Wei

From: Ao Zhou <[email protected]>

__rds_rdma_map() hands sg/pages ownership to the transport after get_mr() succeeds. If copying the generated cookie back to user space fails after that point, the error path must not free those resources again before dropping the MR reference.

Remove the duplicate unpin/free from the put_user() failure branch so that MR teardown is handled only through the existing final cleanup path.

Quoted 8 lines
Fixes 0d4597c8c5ab ("net/rds: Track user mapped pages through special API")
Cc [email protected]
Reported-by Yuan Tan <[email protected]>
Reported-by Yifan Wu <[email protected]>
Reported-by Juefei Pu <[email protected]>
Reported-by Xin Liu <[email protected]>
Signed-off-by Ao Zhou <[email protected]>
Signed-off-by Ren Wei <[email protected]>

Hi Aso,

This fix looks good to me. Since this is a bug fix, this patch should be cc'd to [email protected]. Also be sure to note the target tree and component in the subject line like this:

[PATCH net v2 1/1] net/net: rds: fix MR cleanup on copy error

Other than that, the patch looks good to me. Thanks Aso.

Reviewed-by Allison Henderson <[email protected]>

Allison

Quoted 19 lines
---
 net/rds/rdma.c | 4 ----
 1 file changed, 4 deletions(-)
net/rds/rdma.c +0 -4
index aa6465dc742c..61fb6e45281b 100644
@@ -326,10 +326,6 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
 
 	if (args->cookie_addr &&
 	    put_user(cookie, (u64 __user *)(unsigned long)args->cookie_addr)) {
-		if (!need_odp) {
-			unpin_user_pages(pages, nr_pages);
-			kfree(sg);
-		}
 		ret = -EFAULT;
 		goto out;
 	}
CI Applied
#3 lore raw
In reply to Ren Wei
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 8 lines · On Wed, 22 Apr 2026 22:52:07 +0800 you wrote:

From: Ao Zhou <[email protected]>

__rds_rdma_map() hands sg/pages ownership to the transport after get_mr() succeeds. If copying the generated cookie back to user space fails after that point, the error path must not free those resources again before dropping the MR reference.

[...]

Here is the summary with links:
- [net,1/1] net: rds: fix MR cleanup on copy error

    https://git.kernel.org/netdev/net/c/8141a2dc7008

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html