* [PATCH] RDMA/cxgb4: fix dst refcount leak in pass_accept_req() error path
@ 2025-12-15 15:33 Wentao Liang
2025-12-18 16:05 ` Leon Romanovsky
0 siblings, 1 reply; 2+ messages in thread
From: Wentao Liang @ 2025-12-15 15:33 UTC (permalink / raw)
To: bharat, jgg, leon; +Cc: linux-rdma, linux-kernel, Wentao Liang, stable
Add missing dst_release() when alloc_ep_skb_list() fails to prevent
reference count leak of the dst obtained from route lookup.
Fixes: 4a740838bf44 ("RDMA/iw_cxgb4: Low resource fixes for connection manager")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
drivers/infiniband/hw/cxgb4/cm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index b3b45c49077d..3490b8920cf0 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2665,6 +2665,7 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
}
goto out;
fail:
+ dst_release(dst);
c4iw_put_ep(&child_ep->com);
reject:
reject_cr(dev, hwtid, skb);
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] RDMA/cxgb4: fix dst refcount leak in pass_accept_req() error path
2025-12-15 15:33 [PATCH] RDMA/cxgb4: fix dst refcount leak in pass_accept_req() error path Wentao Liang
@ 2025-12-18 16:05 ` Leon Romanovsky
0 siblings, 0 replies; 2+ messages in thread
From: Leon Romanovsky @ 2025-12-18 16:05 UTC (permalink / raw)
To: Wentao Liang; +Cc: bharat, jgg, linux-rdma, linux-kernel, stable
On Mon, Dec 15, 2025 at 03:33:56PM +0000, Wentao Liang wrote:
> Add missing dst_release() when alloc_ep_skb_list() fails to prevent
> reference count leak of the dst obtained from route lookup.
I'm not convinced this path is correct. I also don't see a call to
"kfree(child_ep);" in that case.
Thanks
>
> Fixes: 4a740838bf44 ("RDMA/iw_cxgb4: Low resource fixes for connection manager")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
> drivers/infiniband/hw/cxgb4/cm.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
> index b3b45c49077d..3490b8920cf0 100644
> --- a/drivers/infiniband/hw/cxgb4/cm.c
> +++ b/drivers/infiniband/hw/cxgb4/cm.c
> @@ -2665,6 +2665,7 @@ static int pass_accept_req(struct c4iw_dev *dev, struct sk_buff *skb)
> }
> goto out;
> fail:
> + dst_release(dst);
> c4iw_put_ep(&child_ep->com);
> reject:
> reject_cr(dev, hwtid, skb);
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-12-18 16:05 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-12-15 15:33 [PATCH] RDMA/cxgb4: fix dst refcount leak in pass_accept_req() error path Wentao Liang
2025-12-18 16:05 ` Leon Romanovsky
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox