Commit 60a8b5a1 authored by Mike Marciniszyn's avatar Mike Marciniszyn Committed by Jason Gunthorpe
Browse files

IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr 

This buffer is currently allocated in hfi1_init():

	if (reinit)
		ret = init_after_reset(dd);
	else
		ret = loadtime_init(dd);
	if (ret)
		goto done;

	/* allocate dummy tail memory for all receive contexts */
	dd->rcvhdrtail_dummy_kvaddr = dma_alloc_coherent(&dd->pcidev->dev,
							 sizeof(u64),
							 &dd->rcvhdrtail_dummy_dma,
							 GFP_KERNEL);

	if (!dd->rcvhdrtail_dummy_kvaddr) {
		dd_dev_err(dd, "cannot allocate dummy tail memory\n");
		ret = -ENOMEM;
		goto done;
	}

The reinit triggered path will overwrite the old allocation and leak it.

Fix by moving the allocation to hfi1_alloc_devdata() and the deallocation
to hfi1_free_devdata().

Link: https://lore.kernel.org/r/20211129192008.101968.91302.stgit@awfm-01.cornelisnetworks.com


Cc: stable@vger.kernel.org
Fixes: 46b010d3 ("staging/rdma/hfi1: Workaround to prevent corruption during packet delivery")
Signed-off-by: default avatarMike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
Signed-off-by: default avatarDennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent f6a3cfec

drivers/infiniband/hw/hfi1/init.c

+14 −19
Original line number Diff line number Diff line
@@ -875,18 +875,6 @@ int hfi1_init(struct hfi1_devdata *dd, int reinit) 
	if (ret)

		goto done;



	/* allocate dummy tail memory for all receive contexts */

	dd->rcvhdrtail_dummy_kvaddr = dma_alloc_coherent(&dd->pcidev->dev,

							 sizeof(u64),

							 &dd->rcvhdrtail_dummy_dma,

							 GFP_KERNEL);



	if (!dd->rcvhdrtail_dummy_kvaddr) {

		dd_dev_err(dd, "cannot allocate dummy tail memory\n");

		ret = -ENOMEM;

		goto done;

	}



	/* dd->rcd can be NULL if early initialization failed */

	for (i = 0; dd->rcd && i < dd->first_dyn_alloc_ctxt; ++i) {

		/*
@@ -1200,6 +1188,11 @@ void hfi1_free_devdata(struct hfi1_devdata *dd) 
	dd->tx_opstats    = NULL;

	kfree(dd->comp_vect);

	dd->comp_vect = NULL;

	if (dd->rcvhdrtail_dummy_kvaddr)

		dma_free_coherent(&dd->pcidev->dev, sizeof(u64),

				  (void *)dd->rcvhdrtail_dummy_kvaddr,

				  dd->rcvhdrtail_dummy_dma);

	dd->rcvhdrtail_dummy_kvaddr = NULL;

	sdma_clean(dd, dd->num_sdma);

	rvt_dealloc_device(&dd->verbs_dev.rdi);

}
@@ -1297,6 +1290,15 @@ static struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, 
		goto bail;

	}



	/* allocate dummy tail memory for all receive contexts */

	dd->rcvhdrtail_dummy_kvaddr =

		dma_alloc_coherent(&dd->pcidev->dev, sizeof(u64),

				   &dd->rcvhdrtail_dummy_dma, GFP_KERNEL);

	if (!dd->rcvhdrtail_dummy_kvaddr) {

		ret = -ENOMEM;

		goto bail;

	}



	atomic_set(&dd->ipoib_rsm_usr_num, 0);

	return dd;
@@ -1504,13 +1506,6 @@ static void cleanup_device_data(struct hfi1_devdata *dd) 


	free_credit_return(dd);



	if (dd->rcvhdrtail_dummy_kvaddr) {

		dma_free_coherent(&dd->pcidev->dev, sizeof(u64),

				  (void *)dd->rcvhdrtail_dummy_kvaddr,

				  dd->rcvhdrtail_dummy_dma);

		dd->rcvhdrtail_dummy_kvaddr = NULL;

	}



	/*

	 * Free any resources still in use (usually just kernel contexts)

	 * at unload; we do for ctxtcnt, because that's what we allocate.