Patch "RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()" has been added to the 5.18-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()

to the 5.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rdma-qedr-fix-potential-memory-leak-in-__qedr_alloc_.patch
and it can be found in the queue-5.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 67120e5736944fb960e437e54059155efd303267
Author: Jianglei Nie <niejianglei2021@xxxxxxx>
Date:   Thu Jul 14 14:15:05 2022 +0800

    RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()
    
    [ Upstream commit b3236a64ddd125a455ef5b5316c1b9051b732974 ]
    
    __qedr_alloc_mr() allocates a memory chunk for "mr->info.pbl_table" with
    init_mr_info(). When rdma_alloc_tid() and rdma_register_tid() fail, "mr"
    is released while "mr->info.pbl_table" is not released, which will lead
    to a memory leak.
    
    We should release the "mr->info.pbl_table" with qedr_free_pbl() when error
    occurs to fix the memory leak.
    
    Fixes: e0290cce6ac0 ("qedr: Add support for memory registeration verbs")
    Link: https://lore.kernel.org/r/20220714061505.2342759-1-niejianglei2021@xxxxxxx
    Signed-off-by: Jianglei Nie <niejianglei2021@xxxxxxx>
    Acked-by: Michal Kalderon <michal.kalderon@xxxxxxxxxxx>
    Signed-off-by: Leon Romanovsky <leon@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index df4d7970c1ad..cc99b293f0be 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -3083,7 +3083,7 @@ static struct qedr_mr *__qedr_alloc_mr(struct ib_pd *ibpd,
 		else
 			DP_ERR(dev, "roce alloc tid returned error %d\n", rc);
 
-		goto err0;
+		goto err1;
 	}
 
 	/* Index only, 18 bit long, lkey = itid << 8 | key */
@@ -3107,7 +3107,7 @@ static struct qedr_mr *__qedr_alloc_mr(struct ib_pd *ibpd,
 	rc = dev->ops->rdma_register_tid(dev->rdma_ctx, &mr->hw_mr);
 	if (rc) {
 		DP_ERR(dev, "roce register tid returned an error %d\n", rc);
-		goto err1;
+		goto err2;
 	}
 
 	mr->ibmr.lkey = mr->hw_mr.itid << 8 | mr->hw_mr.key;
@@ -3116,8 +3116,10 @@ static struct qedr_mr *__qedr_alloc_mr(struct ib_pd *ibpd,
 	DP_DEBUG(dev, QEDR_MSG_MR, "alloc frmr: %x\n", mr->ibmr.lkey);
 	return mr;
 
-err1:
+err2:
 	dev->ops->rdma_free_tid(dev->rdma_ctx, mr->hw_mr.itid);
+err1:
+	qedr_free_pbl(dev, &mr->info.pbl_info, mr->info.pbl_table);
 err0:
 	kfree(mr);
 	return ERR_PTR(rc);