On Thu, Oct 03, 2019 at 11:54:49AM +0300, Leon Romanovsky wrote:
> > diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
> > index 3a27bddfcf31f5..630599311586ec 100644
> > +++ b/drivers/infiniband/hw/mlx5/mr.c
> > @@ -1962,14 +1962,25 @@ struct ib_mw *mlx5_ib_alloc_mw(struct ib_pd *pd, enum ib_mw_type type,
> >
> > int mlx5_ib_dealloc_mw(struct ib_mw *mw)
> > {
> > + struct mlx5_ib_dev *dev = to_mdev(mw->device);
> > struct mlx5_ib_mw *mmw = to_mmw(mw);
> > int err;
> >
> > - err = mlx5_core_destroy_mkey((to_mdev(mw->device))->mdev,
> > - &mmw->mmkey);
> > - if (!err)
> > - kfree(mmw);
> > - return err;
> > + if (IS_ENABLED(CONFIG_INFINIBAND_ON_DEMAND_PAGING)) {
> > + xa_erase(&dev->mdev->priv.mkey_table,
> > + mlx5_base_mkey(mmw->mmkey.key));
> > + /*
> > + * pagefault_single_data_segment() may be accessing mmw under
> > + * SRCU if the user bound an ODP MR to this MW.
> > + */
> > + synchronize_srcu(&dev->mr_srcu);
> > + }
> > +
> > + err = mlx5_core_destroy_mkey(dev->mdev, &mmw->mmkey);
> > + if (err)
> > + return err;
> > + kfree(mmw);
>
> You are skipping kfree() in case of error returned by mlx5_core_destroy_mkey().
> IMHO, it is right for -ENOENT, but is not right for mlx5_cmd_exec() failures.
This is pre-existing behavior, it seems reasonable to always free.
Again, allow error on destroy is such an annoying anti-pattern..
But fixing this should be a followup patch
Jason
