Re: [PATCH rdma-next] RDMA/core: Fix FRMR handle leak on push_handle_to_queue_locked failure

[Tao Cui <cui.tao@linux.dev>]

Hi Michael,

Thanks for the review and the pointer to your series.

You're right — the i < needed_handles check is redundant since ret != 0 already implies we broke out of the loop before completion. Your approach of using break instead of goto end is also cleaner.

Thanks,
--
Tao

在 2026/6/10 20:25, Michael Gur 写道:
> 
> On 6/8/2026 7:56 AM, Tao Cui wrote:
>> From: Tao Cui <cuitao@kylinos.cn>
>>
>> In ib_frmr_pools_set_pinned(), after create_frmrs() successfully
>> allocates handles, the push loop may fail partway through due to
>> -ENOMEM from kzalloc in push_handle_to_queue_locked(). The remaining
>> created-but-unpushed handles are silently leaked as they are never
>> destroyed.
>>
>> Call destroy_frmrs() for the remaining unpushed handles before returning
>> the error.
>>
>> Fixes: ce5df0b891ed ("IB/core: Introduce FRMR pools")
>> Signed-off-by: Tao Cui <cuitao@kylinos.cn>
>> ---
>>   drivers/infiniband/core/frmr_pools.c | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/drivers/infiniband/core/frmr_pools.c b/drivers/infiniband/core/frmr_pools.c
>> index 5e992ff3d7cf..d7906fab033f 100644
>> --- a/drivers/infiniband/core/frmr_pools.c
>> +++ b/drivers/infiniband/core/frmr_pools.c
>> @@ -443,6 +443,9 @@ int ib_frmr_pools_set_pinned(struct ib_device *device, struct ib_frmr_key *key,
>>     end:
>>       spin_unlock(&pool->lock);
>> +    if (ret && i < needed_handles)
>> +        pools->pool_ops->destroy_frmrs(device, &handles[i],
>> +                           needed_handles - i);
> 
> The second condition is redundant, only failure to reach this point is push() failure.
> 
> I've sent a similar fix in a series of fixes for frmr pools. Please take a look.
> https://lore.kernel.org/linux-rdma/20260610000145.820592-1-michaelgur@nvidia.com/T/#m34f6910f8b8e998b079fcf5f468cb3c5056f78b9
> 
> Michael
> 
>>       kfree(handles);
>>     schedule_aging: