Currently the rxe driver has incorrect code in error paths for allocating MR objects. The PD and umem are always freed in rxe_mr_cleanup() but in some error paths they are already freed or never set. This patch makes sure that the PD is always set and checks to see if umem is set before freeing it in rxe_mr_cleanup(). umem and maps are freed if an error occurs in an allocate mr call. Reported-by: Li Zhijian <lizhijian@xxxxxxxxxxx> Link: https://lore.kernel.org/linux-rdma/11dafa5f-c52d-16c1-fe37-2cd45ab20474@xxxxxxxxxxx/ Fixes: 3902b429ca14 ("Implement invalidate MW operations") Signed-off-by: Bob Pearson <rpearsonhpe@xxxxxxxxx> --- v5: Dropped cleanup code from patch per Li Zhijian. Split up into two small patches. v4: Added set mr->ibmr.pd back to avoid an -ENOMEM error causing rxe_put(mr_pd(mr)); to seg fault in rxe_mr_cleanup() since pd is not getting set in the error path. v3: Rebased to apply to current for-next after Revert "RDMA/rxe: Create duplicate mapping tables for FMRs" v2: Moved setting mr->umem until after checks to avoid sending an ERR_PTR to ib_umem_release(). Cleaned up umem and map sets if errors occur in alloc mr calls. Rebased to current for-next. Bob Pearson (2): RDMA/rxe: Set pd early in mr alloc routines RDMA/rxe: Test mr->umem before releaseing umem drivers/infiniband/sw/rxe/rxe_loc.h | 6 +++--- drivers/infiniband/sw/rxe/rxe_mr.c | 15 +++++++-------- drivers/infiniband/sw/rxe/rxe_verbs.c | 10 +++++++--- 3 files changed, 17 insertions(+), 14 deletions(-) base-commit: 6b822d408b58c3c4f26dae93245c6b7d8b39e0f9 -- 2.34.1
