linux-kernel - [PATCH for-next] RDMA/rxe: Fix mr leak in RESPST_ERR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Oct 2022 12:03:33 +0800
From:   Li Zhijian <lizhijian@...itsu.com>
To:     zyjzyj2000@...il.com, jgg@...pe.ca, leon@...nel.org,
        linux-rdma@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, Li Zhijian <lizhijian@...itsu.com>,
        Bob Pearson <rpearsonhpe@...il.com>
Subject: [PATCH for-next] RDMA/rxe: Fix mr leak in RESPST_ERR_RNR

rxe_recheck_mr() will increase mr's ref_cnt, so we should call rxe_put(mr)
to drop mr's ref_cnt in RESPST_ERR_RNR to avoid below warning:
[  633.447883] WARNING: CPU: 0 PID: 4156 at drivers/infiniband/sw/rxe/rxe_pool.c:259 __rxe_cleanup+0x1df/0x240 [rdma_rxe]
...
[  633.509482] Call Trace:
[  633.510246]  <TASK>
[  633.510962]  rxe_dereg_mr+0x4c/0x60 [rdma_rxe]
[  633.512123]  ib_dereg_mr_user+0xa8/0x200 [ib_core]
[  633.513444]  ib_mr_pool_destroy+0x77/0xb0 [ib_core]
[  633.514763]  nvme_rdma_destroy_queue_ib+0x89/0x240 [nvme_rdma]
[  633.516230]  nvme_rdma_free_queue+0x40/0x50 [nvme_rdma]
[  633.517577]  nvme_rdma_teardown_io_queues.part.0+0xc3/0x120 [nvme_rdma]
[  633.519204]  nvme_rdma_error_recovery_work+0x4d/0xf0 [nvme_rdma]
[  633.520695]  process_one_work+0x582/0xa40
[  633.522987]  ? pwq_dec_nr_in_flight+0x100/0x100
[  633.524227]  ? rwlock_bug.part.0+0x60/0x60
[  633.525372]  worker_thread+0x2a9/0x700
[  633.526437]  ? process_one_work+0xa40/0xa40
[  633.527589]  kthread+0x168/0x1a0
[  633.528518]  ? kthread_complete_and_exit+0x20/0x20
[  633.529792]  ret_from_fork+0x22/0x30

CC: Bob Pearson <rpearsonhpe@...il.com>
Fixes: 8a1a0be894da ("RDMA/rxe: Replace mr by rkey in responder resources")
Signed-off-by: Li Zhijian <lizhijian@...itsu.com>
---
 drivers/infiniband/sw/rxe/rxe_resp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index ed5a09e86417..bbb9665c64ad 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -806,8 +806,11 @@ static enum resp_states read_reply(struct rxe_qp *qp,
 
 	skb = prepare_ack_packet(qp, &ack_pkt, opcode, payload,
 				 res->cur_psn, AETH_ACK_UNLIMITED);
-	if (!skb)
+	if (!skb) {
+		if (mr)
+			rxe_put(mr);
 		return RESPST_ERR_RNR;
+	}
 
 	rxe_mr_copy(mr, res->read.va, payload_addr(&ack_pkt),
 		    payload, RXE_FROM_MR_OBJ);
-- 
2.31.1