Commit 8b0e700a authored by Chengchang Tang's avatar Chengchang Tang Committed by Juan Zhou
Browse files

RDMA/hns: Fix memory leak in free_mr_exit() and free_mr_init() 

driver inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I6GT7F



--------------------------------------------------------------------------

Reserved QPs and Reserved PD memory was leaked in free_mr_exit().
When a reserved QP fails to be created, the memory of the remaining
created reserved QPs is leaked.

Fixes: e89e2d3b ("RDMA/hns: Fix gid idx issue caused by free mr")
Signed-off-by: default avatarChengchang Tang <tangchengchang@huawei.com>
parent 6e81b2e0

drivers/infiniband/hw/hns/hns_roce_hw_v2.c

+5 −3
Original line number Diff line number Diff line
@@ -2942,14 +2942,14 @@ static void free_mr_exit(struct hns_roce_dev *hr_dev) 
{

	struct hns_roce_v2_priv *priv = hr_dev->priv;

	struct hns_roce_v2_free_mr *free_mr = &priv->free_mr;

	struct hns_roce_qp *hr_qp;

	struct ib_qp *qp;

	int ret;

	int i;



	for (i = 0; i < ARRAY_SIZE(free_mr->rsv_qp); i++) {

		if (free_mr->rsv_qp[i]) {

			hr_qp = to_hr_qp(&free_mr->rsv_qp[i]->ibqp);

			ret = hns_roce_v2_destroy_qp_common(hr_dev, hr_qp, NULL);

			qp = &free_mr->rsv_qp[i]->ibqp;

			ret = hns_roce_v2_destroy_qp(qp, NULL);

			if (ret)

				ibdev_err(&hr_dev->ib_dev,

					  "failed to destroy qp in free mr.\n");
@@ -2994,6 +2994,8 @@ static int free_mr_alloc_res(struct hns_roce_dev *hr_dev) 
	return 0;



create_failed_qp:

	for (i--; i >= 0; i--)

		hns_roce_v2_destroy_qp(&free_mr->rsv_qp[i]->ibqp, NULL);

	free_mr_uninit_cq(hr_dev);



create_failed_cq: