From: Jason Gunthorpe <jgg@nvidia.com>
To: Junxian Huang <huangjunxian6@hisilicon.com>
Cc: leon@kernel.org, linux-rdma@vger.kernel.org, linuxarm@huawei.com,
tangchengchang@huawei.com
Subject: Re: [PATCH v2 for-next] RDMA/hns: Fix memory leak of bonding resources
Date: Tue, 16 Jun 2026 16:07:41 -0300 [thread overview]
Message-ID: <20260616190741.GB3986358@nvidia.com> (raw)
In-Reply-To: <20260613102045.811623-1-huangjunxian6@hisilicon.com>
On Sat, Jun 13, 2026 at 06:20:45PM +0800, Junxian Huang wrote:
> In a corner case of concurrent driver removal and driver reset,
> bonding resource is first released in hns_roce_hw_v2_exit() during
> driver removal, and then is allocated again in hns_roce_register_device()
> during driver reset. This leads to memory leak because the release
> timing has already passed. This may also lead to a kernel panic
> as below because of the leaked notifier callback:
>
> Call trace:
> 0xffffa20fccc04978 (P)
> raw_notifier_call_chain+0x20/0x38
> call_netdevice_notifiers_info+0x60/0xb8
> netdev_lower_state_changed+0x4c/0xb8
>
> As Sashiko suggested, the teardown order of bonding resources should
> be inverted to make sure the resources are released when the driver
> is removed.
>
> Fixes: b37ad2e290fc ("RDMA/hns: Initialize bonding resources")
> Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
> ---
> drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Applied to for-next, thanks
Jason
prev parent reply other threads:[~2026-06-16 19:07 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-13 10:20 [PATCH v2 for-next] RDMA/hns: Fix memory leak of bonding resources Junxian Huang
2026-06-16 19:07 ` Jason Gunthorpe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260616190741.GB3986358@nvidia.com \
--to=jgg@nvidia.com \
--cc=huangjunxian6@hisilicon.com \
--cc=leon@kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=linuxarm@huawei.com \
--cc=tangchengchang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.