From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC7CBC0018C for ; Sun, 13 Dec 2020 13:31:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B90972075B for ; Sun, 13 Dec 2020 13:31:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2394646AbgLMNau (ORCPT ); Sun, 13 Dec 2020 08:30:50 -0500 Received: from mail.kernel.org ([198.145.29.99]:53656 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2394650AbgLMNak (ORCPT ); Sun, 13 Dec 2020 08:30:40 -0500 From: Leon Romanovsky Authentication-Results: mail.kernel.org; dkim=permerror (bad message/signature format) To: Doug Ledford , Jason Gunthorpe Cc: Maor Gottlieb , linux-rdma@vger.kernel.org Subject: [PATCH rdma-rc 5/5] RDMA/ucma: Fix memory leak of connection request Date: Sun, 13 Dec 2020 15:29:40 +0200 Message-Id: <20201213132940.345554-6-leon@kernel.org> X-Mailer: git-send-email 2.29.2 In-Reply-To: <20201213132940.345554-1-leon@kernel.org> References: <20201213132940.345554-1-leon@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org From: Maor Gottlieb Add missing call to xa_erase when destroy connection request. It fixes the below memory leak. unreferenced object 0xffff88812a340490 (size 576): comm “kworker/5:0”, pid 96291, jiffies 4296565270 (age 1835.596s) hex dump (first 32 bytes): 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 . ………….. a0 d3 1a a0 ff ff ff ff a8 04 34 2a 81 88 ff ff ……….4*…. backtrace: [<0000000059399d4c>] xas_alloc+0x94/0xb0 [<00000000d855673c>] xas_create+0x1f4/0×4c0 [<00000000336166d1>] xas_store+0x52/0×5e0 [<000000006b811da0>] __xa_alloc+0xab/0×140 [<00000000cf0e9936>] ucma_alloc_ctx+0x197/0×1f0 [rdma_ucm] [<000000008f99b6bb>] ucma_event_handler+0x17b/0×2e0 [rdma_ucm] [<000000000a07fc34>] cma_cm_event_handler+0x6f/0×390 [rdma_cm] [<00000000fe05d574>] cma_ib_req_handler+0x1163/0×2370 [rdma_cm] [<000000004516baf4>] cm_work_handler+0xeda/0×2340 [ib_cm] [<000000008a83945b>] process_one_work+0x27c/0×610 [<00000000b71b71e2>] worker_thread+0x2d/0×3c0 [<00000000caab54ff>] kthread+0x125/0×140 [<000000004303d699>] ret_from_fork+0x1f/0×30 Fixes: a1d33b70dbbc ("RDMA/ucma: Rework how new connections are passed through event delivery") Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky --- drivers/infiniband/core/ucma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c index 7dab9a27a145..b0b9ea90a27d 100644 --- a/drivers/infiniband/core/ucma.c +++ b/drivers/infiniband/core/ucma.c @@ -549,8 +549,10 @@ static int ucma_free_ctx(struct ucma_context *ctx) list_for_each_entry_safe(uevent, tmp, &list, list) { list_del(&uevent->list); if (uevent->resp.event == RDMA_CM_EVENT_CONNECT_REQUEST && - uevent->conn_req_ctx != ctx) + uevent->conn_req_ctx != ctx) { + xa_erase(&ctx_table, uevent->conn_req_ctx->id); __destroy_id(uevent->conn_req_ctx); + } kfree(uevent); } -- 2.29.2