diff mbox series

[PATCHv2,1/1] IB/rxe: avoid srq memory leak

Message ID 1538288836-2757-1-git-send-email-yanjun.zhu@oracle.com (mailing list archive)
State Accepted
Delegated to: Jason Gunthorpe
Headers show
Series [PATCHv2,1/1] IB/rxe: avoid srq memory leak | expand

Commit Message

Zhu Yanjun Sept. 30, 2018, 6:27 a.m. UTC
In rxe_queue_init, q and q->buf are allocated. In do_mmap_info,
q->ip is allocated. When error occurs, rxe_srq_from_init and
the later error handler do not free these allocated memories.
This will make memory leak.

CC: Srinivas Eeda <srinivas.eeda@oracle.com>
CC: Junxiao Bi <junxiao.bi@oracle.com>
Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
---
V1->V2: Add vmalloc.h
---
 drivers/infiniband/sw/rxe/rxe_srq.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

Comments

Jason Gunthorpe Oct. 3, 2018, 10:17 p.m. UTC | #1
On Sun, Sep 30, 2018 at 02:27:16AM -0400, Zhu Yanjun wrote:
> In rxe_queue_init, q and q->buf are allocated. In do_mmap_info,
> q->ip is allocated. When error occurs, rxe_srq_from_init and
> the later error handler do not free these allocated memories.
> This will make memory leak.
> 
> CC: Srinivas Eeda <srinivas.eeda@oracle.com>
> CC: Junxiao Bi <junxiao.bi@oracle.com>
> Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
> ---
> V1->V2: Add vmalloc.h
> ---
>  drivers/infiniband/sw/rxe/rxe_srq.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)

Applied to for-next

Thanks,
Jason
diff mbox series

Patch

diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c
index 0d6c04b..c41a5fe 100644
--- a/drivers/infiniband/sw/rxe/rxe_srq.c
+++ b/drivers/infiniband/sw/rxe/rxe_srq.c
@@ -31,6 +31,7 @@ 
  * SOFTWARE.
  */
 
+#include <linux/vmalloc.h>
 #include "rxe.h"
 #include "rxe_loc.h"
 #include "rxe_queue.h"
@@ -129,13 +130,18 @@  int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq,
 
 	err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, context, q->buf,
 			   q->buf_size, &q->ip);
-	if (err)
+	if (err) {
+		vfree(q->buf);
+		kfree(q);
 		return err;
+	}
 
 	if (uresp) {
 		if (copy_to_user(&uresp->srq_num, &srq->srq_num,
-				 sizeof(uresp->srq_num)))
+				 sizeof(uresp->srq_num))) {
+			rxe_queue_cleanup(q);
 			return -EFAULT;
+		}
 	}
 
 	return 0;