Patch "RDMA/rxe: Fix mr leak in RESPST_ERR_RNR" has been added to the 6.0-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    RDMA/rxe: Fix mr leak in RESPST_ERR_RNR

to the 6.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rdma-rxe-fix-mr-leak-in-respst_err_rnr.patch
and it can be found in the queue-6.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5ffe1b9c58e2771dbf630743fc77d9bba830efb6
Author: Li Zhijian <lizhijian@xxxxxxxxxxx>
Date:   Thu Oct 13 12:03:33 2022 +0800

    RDMA/rxe: Fix mr leak in RESPST_ERR_RNR
    
    [ Upstream commit b5f9a01fae42684648c2ee3cd9985f80c67ab9f7 ]
    
    rxe_recheck_mr() will increase mr's ref_cnt, so we should call rxe_put(mr)
    to drop mr's ref_cnt in RESPST_ERR_RNR to avoid below warning:
    
      WARNING: CPU: 0 PID: 4156 at drivers/infiniband/sw/rxe/rxe_pool.c:259 __rxe_cleanup+0x1df/0x240 [rdma_rxe]
    ...
      Call Trace:
       rxe_dereg_mr+0x4c/0x60 [rdma_rxe]
       ib_dereg_mr_user+0xa8/0x200 [ib_core]
       ib_mr_pool_destroy+0x77/0xb0 [ib_core]
       nvme_rdma_destroy_queue_ib+0x89/0x240 [nvme_rdma]
       nvme_rdma_free_queue+0x40/0x50 [nvme_rdma]
       nvme_rdma_teardown_io_queues.part.0+0xc3/0x120 [nvme_rdma]
       nvme_rdma_error_recovery_work+0x4d/0xf0 [nvme_rdma]
       process_one_work+0x582/0xa40
       ? pwq_dec_nr_in_flight+0x100/0x100
       ? rwlock_bug.part.0+0x60/0x60
       worker_thread+0x2a9/0x700
       ? process_one_work+0xa40/0xa40
       kthread+0x168/0x1a0
       ? kthread_complete_and_exit+0x20/0x20
       ret_from_fork+0x22/0x30
    
    Link: https://lore.kernel.org/r/20221024052049.20577-1-lizhijian@xxxxxxxxxxx
    Fixes: 8a1a0be894da ("RDMA/rxe: Replace mr by rkey in responder resources")
    Signed-off-by: Li Zhijian <lizhijian@xxxxxxxxxxx>
    Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
    Signed-off-by: Leon Romanovsky <leon@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index 7c336db5cb54..f8b1d9fa0494 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -806,8 +806,10 @@ static enum resp_states read_reply(struct rxe_qp *qp,
 
 	skb = prepare_ack_packet(qp, &ack_pkt, opcode, payload,
 				 res->cur_psn, AETH_ACK_UNLIMITED);
-	if (!skb)
+	if (!skb) {
+		rxe_put(mr);
 		return RESPST_ERR_RNR;
+	}
 
 	rxe_mr_copy(mr, res->read.va, payload_addr(&ack_pkt),
 		    payload, RXE_FROM_MR_OBJ);