The patch below does not apply to the 4.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@xxxxxxxxxxxxxxx>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 9d8e7d0dacf09ddac7e617d17dbeec6af56e81e8 Mon Sep 17 00:00:00 2001
From: Bart Van Assche <bart.vanassche@xxxxxxxxxxx>
Date: Thu, 12 May 2016 10:48:13 -0700
Subject: [PATCH] IB/srp: Fix a memory descriptor leak in an error path
If an error occurs after srp_fr_pool_get() succeeded and before the
descriptor is stored in srp_map_state (*state->fr.next++ = desc)
then srp_unmap_data() won't free the newly allocated memory
descriptor. Hence free the descriptor explicitly.
Fixes: f7f7aab1a5c0 ("IB/srp: Convert to new registration API")
Signed-off-by: Bart Van Assche <bart.vanassche@xxxxxxxxxxx>
Tested-by: Laurence Oberman <loberman@xxxxxxxxxx>
Cc: Sagi Grimberg <sai@xxxxxxxxxxx>
Cc: Christoph Hellwig <hch@xxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx> # v4.4+
Signed-off-by: Doug Ledford <dledford@xxxxxxxxxx>
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 44970358f0c7..527503d06952 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1330,8 +1330,13 @@ static int srp_map_finish_fr(struct srp_map_state *state,
ib_update_fast_reg_key(desc->mr, rkey);
n = ib_map_mr_sg(desc->mr, state->sg, sg_nents, 0, dev->mr_page_size);
- if (unlikely(n < 0))
+ if (unlikely(n < 0)) {
+ srp_fr_pool_put(ch->fr_pool, &desc, 1);
+ pr_debug("%s: ib_map_mr_sg(%d) returned %d.\n",
+ dev_name(&req->scmnd->device->sdev_gendev), sg_nents,
+ n);
return n;
+ }
req->reg_cqe.done = srp_reg_mr_err_done;
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html