From patchwork Thu Apr 9 09:13:41 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?U8OpYmFzdGllbiBEdWd1w6k=?= X-Patchwork-Id: 6185801 Return-Path: X-Original-To: patchwork-linux-rdma@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id E5AE5BF4A6 for ; Thu, 9 Apr 2015 09:12:03 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 2214D202A1 for ; Thu, 9 Apr 2015 09:12:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 48E19200E6 for ; Thu, 9 Apr 2015 09:11:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934163AbbDIJLz (ORCPT ); Thu, 9 Apr 2015 05:11:55 -0400 Received: from odin2.bull.net ([129.184.85.11]:38872 "EHLO odin2.bull.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933807AbbDIJLw (ORCPT ); Thu, 9 Apr 2015 05:11:52 -0400 Received: from BUMSG3WM.fr.ad.bull.net (bumsg3wm.fr.ad.bull.net [10.192.1.139]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin2.bull.net (Bull S.A.) with ESMTP id 1D3CB1C2B8 for ; Thu, 9 Apr 2015 11:11:49 +0200 (CEST) Received: from dingo (10.192.1.123) by BUMSG3WM.fr.ad.bull.net (10.192.1.139) with Microsoft SMTP Server (TLS) id 14.3.210.2; Thu, 9 Apr 2015 11:11:48 +0200 Date: Thu, 9 Apr 2015 11:13:41 +0200 From: =?UTF-8?B?U8OpYmFzdGllbiBEdWd1w6k=?= To: linux-rdma Subject: [PATCH] ib_uverbs: Fix pages leak when using XRC SRQs Message-ID: <20150409111341.159c26a7@dingo> Organization: BULL X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) MIME-Version: 1.0 X-Originating-IP: [10.192.1.123] Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hello, When an application using XRCs abruptly terminates, the mmaped pages of the CQ buffers are leaked. This comes from the fact that when resources are released in ib_uverbs_cleanup_ucontext(), we fail to release the CQs because their refcount is not 0. When creating an XRC SRQ, we increment the associated CQ refcount. This refcount is only decremented when the SRQ is released. Therefore we need to release the SRQs prior to the CQs to make sure that all references to the CQs are gone before trying to release these. Signed-off-by: Sebastien Dugue --- drivers/infiniband/core/uverbs_main.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c index 259dcc7..88cce9b 100644 --- a/drivers/infiniband/core/uverbs_main.c +++ b/drivers/infiniband/core/uverbs_main.c @@ -246,6 +246,17 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file, kfree(uqp); } + list_for_each_entry_safe(uobj, tmp, &context->srq_list, list) { + struct ib_srq *srq = uobj->object; + struct ib_uevent_object *uevent = + container_of(uobj, struct ib_uevent_object, uobject); + + idr_remove_uobj(&ib_uverbs_srq_idr, uobj); + ib_destroy_srq(srq); + ib_uverbs_release_uevent(file, uevent); + kfree(uevent); + } + list_for_each_entry_safe(uobj, tmp, &context->cq_list, list) { struct ib_cq *cq = uobj->object; struct ib_uverbs_event_file *ev_file = cq->cq_context; @@ -258,17 +269,6 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file, kfree(ucq); } - list_for_each_entry_safe(uobj, tmp, &context->srq_list, list) { - struct ib_srq *srq = uobj->object; - struct ib_uevent_object *uevent = - container_of(uobj, struct ib_uevent_object, uobject); - - idr_remove_uobj(&ib_uverbs_srq_idr, uobj); - ib_destroy_srq(srq); - ib_uverbs_release_uevent(file, uevent); - kfree(uevent); - } - list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) { struct ib_mr *mr = uobj->object;