[PATCH rdma-next] RDMA/core: Fix FRMR handle leak on push_handle_to_queue_locked failure

[PATCH rdma-next] RDMA/core: Fix FRMR handle leak on push_handle_to_queue_locked failure

[Tao Cui]

From: Tao Cui <cuitao@kylinos.cn>

In ib_frmr_pools_set_pinned(), after create_frmrs() successfully
allocates handles, the push loop may fail partway through due to
-ENOMEM from kzalloc in push_handle_to_queue_locked(). The remaining
created-but-unpushed handles are silently leaked as they are never
destroyed.

Call destroy_frmrs() for the remaining unpushed handles before returning
the error.

Fixes: ce5df0b891ed ("IB/core: Introduce FRMR pools")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 drivers/infiniband/core/frmr_pools.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/core/frmr_pools.c b/drivers/infiniband/core/frmr_pools.c
index 5e992ff3d7cf..d7906fab033f 100644
--- a/drivers/infiniband/core/frmr_pools.c
+++ b/drivers/infiniband/core/frmr_pools.c
@@ -443,6 +443,9 @@ int ib_frmr_pools_set_pinned(struct ib_device *device, struct ib_frmr_key *key,
 
 end:
 	spin_unlock(&pool->lock);
+	if (ret && i < needed_handles)
+		pools->pool_ops->destroy_frmrs(device, &handles[i],
+					       needed_handles - i);
 	kfree(handles);
 
 schedule_aging:
-- 
2.43.0