[PATCH] net/smc: deregister the MR when SG mapping fails

[PATCH] net/smc: deregister the MR when SG mapping fails

[Wentao Liang]

When smc_ib_map_mr_sg() maps fewer entries than the SG table holds,
smc_ib_get_memory_region() returns -EINVAL with the memory region
still allocated and its pointer left in buf_slot->mr[link_idx].
The caller only undoes the DMA mapping and frees the SG table, and
because buf_desc->is_map_ib[] is set only after this function
succeeds, smcr_buf_unmap_link() later skips the buffer.  Both the
MR and the pd->usecnt reference taken by ib_alloc_mr() are lost.

The stale pointer is also harmful: a retry takes the "already done"
shortcut and treats a memory region that was never mapped as valid.

Deregister the memory region and clear the slot before returning.

Fixes: 897e1c245773 ("net/smc: use separate memory regions for RMBs")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 net/smc/smc_ib.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
index daaa8a72da90..fa21d269196e 100644
--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -735,8 +735,11 @@ int smc_ib_get_memory_region(struct ib_pd *pd, int access_flags,
 	}
 
 	if (smc_ib_map_mr_sg(buf_slot, link_idx) !=
-			     buf_slot->sgt[link_idx].orig_nents)
+			     buf_slot->sgt[link_idx].orig_nents) {
+		smc_ib_put_memory_region(buf_slot->mr[link_idx]);
+		buf_slot->mr[link_idx] = NULL;
 		return -EINVAL;
+	}
 
 	return 0;
 }
-- 
2.34.1

Re: [PATCH] net/smc: deregister the MR when SG mapping fails

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] net/smc: deregister the MR when SG mapping fails

[Dust Li]

On 2026-11-04 02:28:12, Wentao Liang wrote:
>When smc_ib_map_mr_sg() maps fewer entries than the SG table holds,
>smc_ib_get_memory_region() returns -EINVAL with the memory region
>still allocated and its pointer left in buf_slot->mr[link_idx].
>The caller only undoes the DMA mapping and frees the SG table, and
>because buf_desc->is_map_ib[] is set only after this function
>succeeds, smcr_buf_unmap_link() later skips the buffer.  Both the
>MR and the pd->usecnt reference taken by ib_alloc_mr() are lost.
>
>The stale pointer is also harmful: a retry takes the "already done"
>shortcut and treats a memory region that was never mapped as valid.
>
>Deregister the memory region and clear the slot before returning.
>
>Fixes: 897e1c245773 ("net/smc: use separate memory regions for RMBs")
>Cc: stable@vger.kernel.org
>Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
>Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

For the patch itself,

Reviewed-by: Dust Li <dust.li@linux.alibaba.com>


But checkpatch.pl failed with the following errors:

WARNING: Non-standard signature: Assisted-by:
#66:
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex

ERROR: Unrecognized email address: 'DeepSeek-V4.1-Flash and OpenAI
Codex'
#66:
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex

total: 1 errors, 1 warnings, 0 checks, 12 lines checked

Best regards,
Dust

Re: [PATCH] net/smc: deregister the MR when SG mapping fails

[Mahanta Jambigi]

Going forward Subject should mentioned PATCH net.

On 04/11/26 7:58 am, Wentao Liang wrote:
> When smc_ib_map_mr_sg() maps fewer entries than the SG table holds,
> smc_ib_get_memory_region() returns -EINVAL with the memory region
> still allocated and its pointer left in buf_slot->mr[link_idx].
> The caller only undoes the DMA mapping and frees the SG table, and
> because buf_desc->is_map_ib[] is set only after this function
> succeeds, smcr_buf_unmap_link() later skips the buffer.  Both the
> MR and the pd->usecnt reference taken by ib_alloc_mr() are lost.
> 
> The stale pointer is also harmful: a retry takes the "already done"
> shortcut and treats a memory region that was never mapped as valid.
> 
> Deregister the memory region and clear the slot before returning.
> 
> Fixes: 897e1c245773 ("net/smc: use separate memory regions for RMBs")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex

This is not required.

> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>

> ---
>  net/smc/smc_ib.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
> index daaa8a72da90..fa21d269196e 100644
> --- a/net/smc/smc_ib.c
> +++ b/net/smc/smc_ib.c
> @@ -735,8 +735,11 @@ int smc_ib_get_memory_region(struct ib_pd *pd, int access_flags,
>  	}
>  
>  	if (smc_ib_map_mr_sg(buf_slot, link_idx) !=
> -			     buf_slot->sgt[link_idx].orig_nents)
> +			     buf_slot->sgt[link_idx].orig_nents) {
> +		smc_ib_put_memory_region(buf_slot->mr[link_idx]);
> +		buf_slot->mr[link_idx] = NULL;
>  		return -EINVAL;
> +	}
>  
>  	return 0;
>  }