Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b3a45996 authored by Bart Van Assche's avatar Bart Van Assche Committed by Doug Ledford
Browse files

IB/rxe: Fix a MR reference leak in check_rkey() 



Avoid that calling check_rkey() for mem->state == RXE_MEM_STATE_FREE
triggers an MR reference leak.

Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: default avatarAndrew Boyer <andrew.boyer@dell.com>
Cc: Moni Shoua <monis@mellanox.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 18d3451c

drivers/infiniband/sw/rxe/rxe_resp.c

+10 −10
Original line number Diff line number Diff line
@@ -418,7 +418,7 @@ static enum resp_states check_length(struct rxe_qp *qp, 
static enum resp_states check_rkey(struct rxe_qp *qp,

				   struct rxe_pkt_info *pkt)

{

	struct rxe_mem *mem;

	struct rxe_mem *mem = NULL;

	u64 va;

	u32 rkey;

	u32 resid;
@@ -459,38 +459,38 @@ static enum resp_states check_rkey(struct rxe_qp *qp, 
	mem = lookup_mem(qp->pd, access, rkey, lookup_remote);

	if (!mem) {

		state = RESPST_ERR_RKEY_VIOLATION;

		goto err1;

		goto err;

	}



	if (unlikely(mem->state == RXE_MEM_STATE_FREE)) {

		state = RESPST_ERR_RKEY_VIOLATION;

		goto err1;

		goto err;

	}



	if (mem_check_range(mem, va, resid)) {

		state = RESPST_ERR_RKEY_VIOLATION;

		goto err2;

		goto err;

	}



	if (pkt->mask & RXE_WRITE_MASK)	 {

		if (resid > mtu) {

			if (pktlen != mtu || bth_pad(pkt)) {

				state = RESPST_ERR_LENGTH;

				goto err2;

				goto err;

			}



			resid = mtu;

		} else {

			if (pktlen != resid) {

				state = RESPST_ERR_LENGTH;

				goto err2;

				goto err;

			}

			if ((bth_pad(pkt) != (0x3 & (-resid)))) {

				/* This case may not be exactly that

				 * but nothing else fits.

				 */

				state = RESPST_ERR_LENGTH;

				goto err2;

				goto err;

			}

		}

	}
@@ -500,9 +500,9 @@ static enum resp_states check_rkey(struct rxe_qp *qp, 
	qp->resp.mr = mem;

	return RESPST_EXECUTE;



err2:

err:

	if (mem)

		rxe_drop_ref(mem);

err1:

	return state;

}