Re: [PATCH v2] RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

[Leon Romanovsky <leon@kernel.org>]

On Thu, Jul 16, 2026 at 09:22:00PM +0300, Leon Romanovsky wrote:
> On Thu, Jul 16, 2026 at 10:37:39AM -0700, Bart Van Assche wrote:
> > On 7/15/26 3:15 AM, kensanya@163.com wrote:
> > > From: TanZheng <tanzheng@kylinos.cn>
> > > 
> > > When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect
> > > descriptor, the unwind path destroys RDMA contexts but leaves stale
> > > n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later
> > > sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()
> > > can then subtract the wrong number of send queue credits.
> > > 
> > > Reset the counters and clear rw_ctxs after freeing the heap
> > > allocation before returning an error.
> > > 
> > > Fixes: b99f8e4d7bcd ("IB/srpt: convert to the generic RDMA READ/WRITE API")
> > > Signed-off-by: TanZheng <tanzheng@kylinos.cn>
> > > ---
> > > v2:
> > > - After kfree(), set rw_ctxs to NULL instead of &s_rw_ctx
> > >    (Leon Romanovsky)
> > > 
> > >   drivers/infiniband/ulp/srpt/ib_srpt.c | 6 +++++-
> > >   1 file changed, 5 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
> > > index f66cfd70c263..a9c4995af7a3 100644
> > > --- a/drivers/infiniband/ulp/srpt/ib_srpt.c
> > > +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
> > > @@ -1014,8 +1014,12 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx,
> > >   				ctx->sg, ctx->nents, dir);
> > >   		target_free_sgl(ctx->sg, ctx->nents);
> > >   	}
> > > -	if (ioctx->rw_ctxs != &ioctx->s_rw_ctx)
> > > +	if (ioctx->rw_ctxs != &ioctx->s_rw_ctx) {
> > >   		kfree(ioctx->rw_ctxs);
> > > +		ioctx->rw_ctxs = NULL;
> > > +	}
> > > +	ioctx->n_rw_ctx = 0;
> > > +	ioctx->n_rdma = 0;
> > >   	return ret;
> > >   }
> > 
> > The above looks wrong to me. In the error path ioctx->n_rw_ctx should be
> > restored to the value it had at the start of the function instead of
> > resetting it to zero.
> 
> Does this patch address your concerns?
> https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?h=wip/leon-for-next&id=f65ababb556ae0110d14294747dd6df5dcb8f597

I'm sorry, this one
https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?h=wip/leon-for-next&id=07f5f0308bef

Thanks

> 
> Thanks
> 
> > 
> > Bart.
>