From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-m8367.xmail.ntesmail.com (mail-m8367.xmail.ntesmail.com [156.224.83.67]) by mail19.linbit.com (LINBIT Mail Daemon) with ESMTP id 2ED7B160919 for ; Thu, 17 Apr 2025 08:23:33 +0200 (CEST) From: "zhengbing.huang" To: drbd-dev@lists.linbit.com Subject: [PATCH] rdma: Fix cm leaks in some abnormal scenarios Date: Thu, 17 Apr 2025 14:08:19 +0800 Message-ID: <20250417060819.2157347-1-zhengbing.huang@easystack.cn> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit List-Id: "*Coordination* of development, patches, contributions -- *Questions* \(even to developers\) go to drbd-user, please." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , In dtr_create_rx_desc() function, if ib_dma_map_single() return an error, it goes to error code branch, which does not subtract 1 from the reference count of cm. In dtr_post_tx_desc() function, in the retry code branch, has similar issues. Signed-off-by: zhengbing.huang --- drbd/drbd-headers | 2 +- drbd/drbd_transport_rdma.c | 14 ++++++++++---- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/drbd/drbd-headers b/drbd/drbd-headers index 94f447251..9188ee14f 160000 --- a/drbd/drbd-headers +++ b/drbd/drbd-headers @@ -1 +1 @@ -Subproject commit 94f4472513f351efba5788f783feba6ac6efe9fc +Subproject commit 9188ee14f6de582a493d260c091db0c655b30d50 diff --git a/drbd/drbd_transport_rdma.c b/drbd/drbd_transport_rdma.c index 9ce15a0ce..be919a926 100644 --- a/drbd/drbd_transport_rdma.c +++ b/drbd/drbd_transport_rdma.c @@ -2080,8 +2080,10 @@ static int dtr_create_rx_desc(struct dtr_flow *flow, gfp_t gfp_mask) rx_desc->sge.addr = ib_dma_map_single(cm->id->device, page_address(page), alloc_size, DMA_FROM_DEVICE); err = ib_dma_mapping_error(cm->id->device, rx_desc->sge.addr); - if (err) - goto out; + if (err) { + tr_err(transport, "ib_dma_map_single() failed %d\n", err); + goto out_put; + } rx_desc->sge.length = alloc_size; atomic_inc(&flow->rx_descs_allocated); @@ -2094,6 +2096,9 @@ static int dtr_create_rx_desc(struct dtr_flow *flow, gfp_t gfp_mask) dtr_free_rx_desc(rx_desc); } return err; + +out_put: + kref_put(&cm->kref, dtr_destroy_cm); out: kfree(rx_desc); drbd_free_pages(transport, page, 0); @@ -2396,9 +2401,10 @@ retry: return -EINTR; flow = &cm->path->flow[stream]; - if (atomic_dec_if_positive(&flow->peer_rx_descs) < 0) + if (atomic_dec_if_positive(&flow->peer_rx_descs) < 0) { + kref_put(&cm->kref, dtr_destroy_cm); goto retry; - + } device = cm->id->device; switch (tx_desc->type) { case SEND_PAGE: -- 2.43.0