From patchwork Tue Apr 7 11:22:24 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?U8OpYmFzdGllbiBEdWd1w6k=?= X-Patchwork-Id: 6169041 Return-Path: X-Original-To: patchwork-linux-rdma@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id CDD7D9F2EC for ; Tue, 7 Apr 2015 11:47:18 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id EB0DD202A1 for ; Tue, 7 Apr 2015 11:47:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0091120272 for ; Tue, 7 Apr 2015 11:47:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753447AbbDGLrP (ORCPT ); Tue, 7 Apr 2015 07:47:15 -0400 Received: from odin2.bull.net ([129.184.85.11]:50577 "EHLO odin2.bull.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752786AbbDGLrN (ORCPT ); Tue, 7 Apr 2015 07:47:13 -0400 X-Greylist: delayed 1472 seconds by postgrey-1.27 at vger.kernel.org; Tue, 07 Apr 2015 07:47:11 EDT Received: from BUMSG1WM.fr.ad.bull.net (bumsg1wm.fr.ad.bull.net [10.192.1.15]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin2.bull.net (Bull S.A.) with ESMTP id 645AA1C35C; Tue, 7 Apr 2015 13:22:37 +0200 (CEST) Received: from dingo (10.192.1.123) by BUMSG1WM.fr.ad.bull.net (10.192.1.15) with Microsoft SMTP Server (TLS) id 14.3.210.2; Tue, 7 Apr 2015 13:20:35 +0200 Date: Tue, 7 Apr 2015 13:22:24 +0200 From: =?UTF-8?B?U8OpYmFzdGllbiBEdWd1w6k=?= To: linux-rdma , Roland Dreier CC: Vladimir Sokolovsky Subject: [PATCH] ib_uverbs: Fix pages leak when using XRC SRQs Message-ID: <20150407132224.5f201e40@dingo> Organization: BULL X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) MIME-Version: 1.0 X-Originating-IP: [10.192.1.123] Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hello, When an application using XRCs abruptly terminates, the mmaped pages of the CQ buffers are leaked. This comes from the fact that when resources are released in ib_uverbs_cleanup_ucontext(), we fail to release the CQs because their refcount is not 0. When creating an XRC SRQ, we increment the associated CQ refcount. This refcount is only decremented when the SRQ is released. Therefore we need to release the SRQs prior to the CQs to make sure that all references to the CQs are gone before trying to release these. Signed-off-by: Sebastien Dugue Reviewed-by: Sagi Grimberg --- drivers/infiniband/core/uverbs_main.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c index 259dcc7..88cce9b 100644 --- a/drivers/infiniband/core/uverbs_main.c +++ b/drivers/infiniband/core/uverbs_main.c @@ -246,6 +246,17 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file, kfree(uqp); } + list_for_each_entry_safe(uobj, tmp, &context->srq_list, list) { + struct ib_srq *srq = uobj->object; + struct ib_uevent_object *uevent = + container_of(uobj, struct ib_uevent_object, uobject); + + idr_remove_uobj(&ib_uverbs_srq_idr, uobj); + ib_destroy_srq(srq); + ib_uverbs_release_uevent(file, uevent); + kfree(uevent); + } + list_for_each_entry_safe(uobj, tmp, &context->cq_list, list) { struct ib_cq *cq = uobj->object; struct ib_uverbs_event_file *ev_file = cq->cq_context; @@ -258,17 +269,6 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file, kfree(ucq); } - list_for_each_entry_safe(uobj, tmp, &context->srq_list, list) { - struct ib_srq *srq = uobj->object; - struct ib_uevent_object *uevent = - container_of(uobj, struct ib_uevent_object, uobject); - - idr_remove_uobj(&ib_uverbs_srq_idr, uobj); - ib_destroy_srq(srq); - ib_uverbs_release_uevent(file, uevent); - kfree(uevent); - } - list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) { struct ib_mr *mr = uobj->object;