diff options
| author | Bart Van Assche <bart.vanassche@sandisk.com> | 2016-05-12 20:48:13 +0300 |
|---|---|---|
| committer | Doug Ledford <dledford@redhat.com> | 2016-05-13 20:37:21 +0300 |
| commit | 9d8e7d0dacf09ddac7e617d17dbeec6af56e81e8 (patch) | |
| tree | e94611ab63aeeafd2fae69089178d136a9bb5cfa /drivers/infiniband/ulp | |
| parent | cf1acab7d75652a372ee5b9c996689d518914e83 (diff) | |
| download | linux-9d8e7d0dacf09ddac7e617d17dbeec6af56e81e8.tar.xz | |
IB/srp: Fix a memory descriptor leak in an error path
If an error occurs after srp_fr_pool_get() succeeded and before the
descriptor is stored in srp_map_state (*state->fr.next++ = desc)
then srp_unmap_data() won't free the newly allocated memory
descriptor. Hence free the descriptor explicitly.
Fixes: f7f7aab1a5c0 ("IB/srp: Convert to new registration API")
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Cc: Sagi Grimberg <sai@grimberg.me>
Cc: Christoph Hellwig <hch@lst.de>
Cc: <stable@vger.kernel.org> # v4.4+
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband/ulp')
| -rw-r--r-- | drivers/infiniband/ulp/srp/ib_srp.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 44970358f0c7..527503d06952 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -1330,8 +1330,13 @@ static int srp_map_finish_fr(struct srp_map_state *state, ib_update_fast_reg_key(desc->mr, rkey); n = ib_map_mr_sg(desc->mr, state->sg, sg_nents, 0, dev->mr_page_size); - if (unlikely(n < 0)) + if (unlikely(n < 0)) { + srp_fr_pool_put(ch->fr_pool, &desc, 1); + pr_debug("%s: ib_map_mr_sg(%d) returned %d.\n", + dev_name(&req->scmnd->device->sdev_gendev), sg_nents, + n); return n; + } req->reg_cqe.done = srp_reg_mr_err_done; |