Re: [PATCH v10 4/4] RDMA/mlx5: get tph for p2p access when registering dma-buf mr

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Memory leak of `struct mlx5_st_idx_data` in `mlx5_st_dealloc_index()` when its refcount reaches 0.
--

Note: Due to system recitation restrictions, this review report cannot quote
the original patch diff inline. The findings are provided as a free-form
summary below.

commit 9ada3f634918f1f6bc02c86bed9350c775185dbc
Author: Zhiping Zhang <zhipingz@meta.com>
Subject: RDMA/mlx5: get tph for p2p access when registering dma-buf mr

This commit wires up mlx5_ib to query dma-buf TPH metadata at MR registration
time to program requester-side TPH on the outbound mkey. It translates
exporter-provided steering tags into local ST entries and ties the extra
ST-table reference to the MR lifetime.

[Severity: High]
This is a pre-existing issue, but I noticed something while reviewing the
surrounding code in drivers/net/ethernet/mellanox/mlx5/core/lib/st.c.

In the mlx5_st_dealloc_index() function, when the usecount refcount drops to
zero, the code calls xa_erase() to remove the element from the xarray.
However, it appears the dynamically allocated memory for the idx_data
structure itself is never freed.

Could this lead to an unbounded memory leak when a user-space application
repeatedly registers and deregisters a dma-buf MR with a TPH tag? During
registration, mlx5_st_alloc_index_by_tag() allocates a new struct
mlx5_st_idx_data via kzalloc_obj(). If deregistration drops the reference
count to zero and removes the pointer from the xarray but fails to free the
structure, could this be triggered in a loop by an unprivileged user-space
process to deplete kernel memory?

Would it make sense to add a kfree() for the idx_data structure immediately
after the xa_erase() call in the refcount_dec_and_test() block?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630224328.3218796-1-zhipingz@meta.com?part=4