redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

IB/srp: Fix a memory descriptor leak in an error path 

If an error occurs after srp_fr_pool_get() succeeded and before the
descriptor is stored in srp_map_state (*state->fr.next++ = desc)
then srp_unmap_data() won't free the newly allocated memory
descriptor. Hence free the descriptor explicitly.

Fixes: f7f7aab1a5 ("IB/srp: Convert to new registration API")
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Cc: Sagi Grimberg <sai@grimberg.me>
Cc: Christoph Hellwig <hch@lst.de>
Cc: <stable@vger.kernel.org> # v4.4+
Signed-off-by: Doug Ledford <dledford@redhat.com>
hifive-unleashed-5.1
Bart Van Assche 2016-05-12 10:48:13 -07:00 committed by Doug Ledford
parent cf1acab7d7
commit 9d8e7d0dac
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/infiniband/ulp/srp/ib_srp.c
View File

@ -1330,8 +1330,13 @@ static int srp_map_finish_fr(struct srp_map_state *state,
ib_update_fast_reg_key(desc->mr, rkey);
n = ib_map_mr_sg(desc->mr, state->sg, sg_nents, 0, dev->mr_page_size);
if (unlikely(n < 0))
if (unlikely(n < 0)) {
srp_fr_pool_put(ch->fr_pool, &desc, 1);
pr_debug("%s: ib_map_mr_sg(%d) returned %d.\n",
dev_name(&req->scmnd->device->sdev_gendev), sg_nents,
n);
return n;
}
req->reg_cqe.done = srp_reg_mr_err_done;