Commit 3cbb7be5 authored by Chengchang Tang's avatar Chengchang Tang Committed by Juan Zhou
Browse files

RDMA/hns: Fix memory leak in free_mr_init() 

mainline inclusion
from mainline-v6.8-rc1
commit 288f535951aa81ed674f5e5477ab11b9d9351b8c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I90X3R
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=288f535951aa81ed674f5e5477ab11b9d9351b8c



----------------------------------------------------------------------

When a reserved QP fails to be created, the memory of the remaining
created reserved QPs is leaked.

Fixes: 70f92521 ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT")
Signed-off-by: default avatarChengchang Tang <tangchengchang@huawei.com>
Signed-off-by: default avatarJunxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20231207114231.2872104-6-huangjunxian6@hisilicon.com


Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Signed-off-by: default avatarJuan Zhou <zhoujuan51@h-partners.com>
parent 9d93f862

drivers/infiniband/hw/hns/hns_roce_hw_v2.c

+4 −0
Original line number Diff line number Diff line
@@ -2710,6 +2710,10 @@ static int free_mr_alloc_res(struct hns_roce_dev *hr_dev) 
	return 0;



create_failed_qp:

	for (i--; i >= 0; i--) {

		hns_roce_v2_destroy_qp(&free_mr->rsv_qp[i]->ibqp, NULL);

		kfree(free_mr->rsv_qp[i]);

	}

	hns_roce_destroy_cq(cq, NULL);

	kfree(cq);