All of lore.kernel.org
 help / color / mirror / Atom feed
From: Leon Romanovsky <leon@kernel.org>
To: Dawei Feng <dawei.feng@seu.edu.cn>
Cc: dennis.dalessandro@cornelisnetworks.com, jgg@ziepe.ca,
	linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org,
	stable@vger.kernel.org, jianhao.xu@seu.edu.cn, zilin@seu.edu.cn
Subject: Re: [PATCH] RDMA/hfi1: fix init_one() probe failure cleanup
Date: Sun, 5 Jul 2026 15:23:28 +0300	[thread overview]
Message-ID: <20260705122328.GD15188@unreal> (raw)
In-Reply-To: <20260627060159.2543686-1-dawei.feng@seu.edu.cn>

On Sat, Jun 27, 2026 at 02:01:59PM +0800, Dawei Feng wrote:
> init_one() allocates hfi1_devdata before validating several module
> parameters and initializing PCIe.  Failures in these paths currently jump
> to bail and leak the devdata allocated by hfi1_alloc_devdata().
> 
> Probe failures after hfi1_init_dd() need a different cleanup path.  On
> failure, hfi1_init_dd() frees devdata itself, but after it succeeds the
> driver also owns RX state and MSI-X interrupt resources that must be
> released before postinit_cleanup().
> 
> Fix the early paths to free devdata directly, keep the hfi1_init_dd()
> failure path to PCIe cleanup only, and release MSI-X and RX resources on
> post-hfi1_init_dd() failures.
> 
> The bug was first flagged by an experimental analysis tool we are
> developing for kernel memory-management bugs while analyzing
> v6.13-rc1. The tool is still under development and is not yet publicly
> available. Manual inspection confirms that the bug is still
> present in v7.1.1.
> 
> An x86_64 allyesconfig build showed no new warnings. As we do not have an
> HFI1 adapter to test with, no runtime testing was able to be performed.
> 
> Fixes: 7724105686e7 ("IB/hfi1: add driver files")
> Fixes: 57f97e96625f ("IB/hfi1: Get the hfi1_devdata structure as early as possible")
> Fixes: 4730f4a6c6b2 ("IB/hfi1: Activate the dummy netdev")
> Cc: stable@vger.kernel.org
> Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
> ---
>  drivers/infiniband/hw/hfi1/init.c | 21 ++++++++++++++++-----
>  1 file changed, 16 insertions(+), 5 deletions(-)

Just move hfi1_validate_rcvhdrcnt() to be before hfi1_alloc_devdata()
and remove error prints.

Thanks

  reply	other threads:[~2026-07-05 12:23 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-27  6:01 [PATCH] RDMA/hfi1: fix init_one() probe failure cleanup Dawei Feng
2026-07-05 12:23 ` Leon Romanovsky [this message]
2026-07-06 14:34   ` Dawei Feng
2026-07-08 10:50     ` Leon Romanovsky

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260705122328.GD15188@unreal \
    --to=leon@kernel.org \
    --cc=dawei.feng@seu.edu.cn \
    --cc=dennis.dalessandro@cornelisnetworks.com \
    --cc=jgg@ziepe.ca \
    --cc=jianhao.xu@seu.edu.cn \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-rdma@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=zilin@seu.edu.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.