[PATCH rdma v1] RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure

[PATCH rdma v1] RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure

[Prathamesh Deshpande]

mlx5r_umr_update_xlt() allocates and DMA maps an XLT buffer with
mlx5r_umr_create_xlt(). The buffer is released by the common cleanup path
through mlx5r_umr_unmap_free_xlt().

After mlx5_odp_populate_xlt() became fallible, its error path returned
directly and skipped that cleanup. This leaks the XLT DMA mapping and
buffer. If the emergency XLT page was used, it also leaves
xlt_emergency_page_mutex locked.

Jump to the existing cleanup path instead of returning directly.

Fixes: 1efe8c0670d6 ("RDMA/core: Convert UMEM ODP DMA mapping to caching IOVA and page linkage")
Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
---
 drivers/infiniband/hw/mlx5/umr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/umr.c b/drivers/infiniband/hw/mlx5/umr.c
index 29488fba21a0..14ed8e8182f8 100644
--- a/drivers/infiniband/hw/mlx5/umr.c
+++ b/drivers/infiniband/hw/mlx5/umr.c
@@ -915,7 +915,7 @@ int mlx5r_umr_update_xlt(struct mlx5_ib_mr *mr, u64 idx, int npages,
 		 */
 		err = mlx5_odp_populate_xlt(xlt, idx, npages, mr, flags);
 		if (err)
-			return err;
+			goto out;
 		dma_sync_single_for_device(ddev, sg.addr, sg.length,
 					   DMA_TO_DEVICE);
 		sg.length = ALIGN(size_to_map, MLX5_UMR_FLEX_ALIGNMENT);
@@ -925,6 +925,7 @@ int mlx5r_umr_update_xlt(struct mlx5_ib_mr *mr, u64 idx, int npages,
 		mlx5r_umr_update_offset(&wqe.ctrl_seg, idx * desc_size);
 		err = mlx5r_umr_post_send_wait(dev, mr->mmkey.key, &wqe, true);
 	}
+out:
 	sg.length = orig_sg_length;
 	mlx5r_umr_unmap_free_xlt(dev, xlt, &sg);
 	return err;
-- 
2.43.0

Re: [PATCH rdma v1] RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure

[Michael Gur]

On 4/25/2026 4:17 AM, Prathamesh Deshpande wrote:
> mlx5r_umr_update_xlt() allocates and DMA maps an XLT buffer with
> mlx5r_umr_create_xlt(). The buffer is released by the common cleanup path
> through mlx5r_umr_unmap_free_xlt().
>
> After mlx5_odp_populate_xlt() became fallible, its error path returned
> directly and skipped that cleanup. This leaks the XLT DMA mapping and
> buffer. If the emergency XLT page was used, it also leaves
> xlt_emergency_page_mutex locked.
>
> Jump to the existing cleanup path instead of returning directly.
>
> Fixes: 1efe8c0670d6 ("RDMA/core: Convert UMEM ODP DMA mapping to caching IOVA and page linkage")
> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
> ---
>   drivers/infiniband/hw/mlx5/umr.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/hw/mlx5/umr.c b/drivers/infiniband/hw/mlx5/umr.c
> index 29488fba21a0..14ed8e8182f8 100644
> --- a/drivers/infiniband/hw/mlx5/umr.c
> +++ b/drivers/infiniband/hw/mlx5/umr.c
> @@ -915,7 +915,7 @@ int mlx5r_umr_update_xlt(struct mlx5_ib_mr *mr, u64 idx, int npages,
>   		 */
>   		err = mlx5_odp_populate_xlt(xlt, idx, npages, mr, flags);
>   		if (err)
> -			return err;
> +			goto out;

The loop already checks !err in its condition, so a 'break' is 
sufficient here to avoid adding a new label.

Thanks

>   		dma_sync_single_for_device(ddev, sg.addr, sg.length,
>   					   DMA_TO_DEVICE);
>   		sg.length = ALIGN(size_to_map, MLX5_UMR_FLEX_ALIGNMENT);
> @@ -925,6 +925,7 @@ int mlx5r_umr_update_xlt(struct mlx5_ib_mr *mr, u64 idx, int npages,
>   		mlx5r_umr_update_offset(&wqe.ctrl_seg, idx * desc_size);
>   		err = mlx5r_umr_post_send_wait(dev, mr->mmkey.key, &wqe, true);
>   	}
> +out:
>   	sg.length = orig_sg_length;
>   	mlx5r_umr_unmap_free_xlt(dev, xlt, &sg);
>   	return err;

Re: [PATCH rdma v1] RDMA/mlx5: Fix UMR XLT cleanup on ODP populate failure

[Prathamesh Deshpande]

On Sun, 26 Apr 2026 at 12:19:09 +0300, Michael Gur wrote:
> The loop already checks !err in its condition, so a 'break' is 
> sufficient here to avoid adding a new label.

Thanks for the feedback, Michael. I've sent a v2 with the 'break' change.