[PATCH net 1/1] net: rds: fix MR cleanup on copy error

[PATCH net 1/1] net: rds: fix MR cleanup on copy error

[Ren Wei]

From: Ao Zhou <draw51280@163.com>

__rds_rdma_map() hands sg/pages ownership to the transport after
get_mr() succeeds. If copying the generated cookie back to user space
fails after that point, the error path must not free those resources
again before dropping the MR reference.

Remove the duplicate unpin/free from the put_user() failure branch so
that MR teardown is handled only through the existing final cleanup
path.

Fixes: 0d4597c8c5ab ("net/rds: Track user mapped pages through special API")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Ao Zhou <draw51280@163.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
---
 net/rds/rdma.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index aa6465dc742c..61fb6e45281b 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -326,10 +326,6 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
 
 	if (args->cookie_addr &&
 	    put_user(cookie, (u64 __user *)(unsigned long)args->cookie_addr)) {
-		if (!need_odp) {
-			unpin_user_pages(pages, nr_pages);
-			kfree(sg);
-		}
 		ret = -EFAULT;
 		goto out;
 	}
-- 
2.43.0

Re: [PATCH net 1/1] net: rds: fix MR cleanup on copy error

[Allison Henderson]

On Wed, 2026-04-22 at 22:52 +0800, Ren Wei wrote:
> From: Ao Zhou <draw51280@163.com>
> 
> __rds_rdma_map() hands sg/pages ownership to the transport after
> get_mr() succeeds. If copying the generated cookie back to user space
> fails after that point, the error path must not free those resources
> again before dropping the MR reference.
> 
> Remove the duplicate unpin/free from the put_user() failure branch so
> that MR teardown is handled only through the existing final cleanup
> path.
> 
> Fixes: 0d4597c8c5ab ("net/rds: Track user mapped pages through special API")
> Cc: stable@kernel.org
> Reported-by: Yuan Tan <yuantan098@gmail.com>
> Reported-by: Yifan Wu <yifanwucs@gmail.com>
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Reported-by: Xin Liu <bird@lzu.edu.cn>
> Signed-off-by: Ao Zhou <draw51280@163.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>

Hi Aso,

This fix looks good to me.  Since this is a bug fix, this patch should be cc'd to stable@vger.kernel.org.  Also be sure
to note the target tree and component in the subject line like this:  

[PATCH net v2 1/1] net/net: rds: fix MR cleanup on copy error

Other than that, the patch looks good to me.  Thanks Aso.

Reviewed-by: Allison Henderson <achender@kernel.org>

Allison

> ---
>  net/rds/rdma.c | 4 ----
>  1 file changed, 4 deletions(-)
> 
> diff --git a/net/rds/rdma.c b/net/rds/rdma.c
> index aa6465dc742c..61fb6e45281b 100644
> --- a/net/rds/rdma.c
> +++ b/net/rds/rdma.c
> @@ -326,10 +326,6 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
>  
>  	if (args->cookie_addr &&
>  	    put_user(cookie, (u64 __user *)(unsigned long)args->cookie_addr)) {
> -		if (!need_odp) {
> -			unpin_user_pages(pages, nr_pages);
> -			kfree(sg);
> -		}
>  		ret = -EFAULT;
>  		goto out;
>  	}