From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-dm3nam03on0101.outbound.protection.outlook.com ([104.47.41.101]:12851 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1728958AbeJAHNj (ORCPT ); Mon, 1 Oct 2018 03:13:39 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Somnath Kotur , Jason Gunthorpe , Sasha Levin Subject: [PATCH AUTOSEL 4.18 26/65] bnxt_re: Fix couple of memory leaks that could lead to IOMMU call traces Date: Mon, 1 Oct 2018 00:38:18 +0000 Message-ID: <20181001003754.146961-26-alexander.levin@microsoft.com> References: <20181001003754.146961-1-alexander.levin@microsoft.com> In-Reply-To: <20181001003754.146961-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Somnath Kotur [ Upstream commit f40f299bbe806a2e2c8b0d7cdda822fa3bdd171b ] 1. DMA-able memory allocated for Shadow QP was not being freed. 2. bnxt_qplib_alloc_qp_hdr_buf() had a bug wherein the SQ pointer was erroneously pointing to the RQ. But since the corresponding free_qp_hdr_buf() was correct, memory being free was less than what was allocated. Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Somnath Kotur Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin --- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 ++ drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/= hw/bnxt_re/ib_verbs.c index a76e206704d4..cb1e69bdad0b 100644 --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c @@ -844,6 +844,8 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp) "Failed to destroy Shadow QP"); return rc; } + bnxt_qplib_free_qp_res(&rdev->qplib_res, + &rdev->qp1_sqp->qplib_qp); mutex_lock(&rdev->qp_lock); list_del(&rdev->qp1_sqp->list); atomic_dec(&rdev->qp_count); diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/= hw/bnxt_re/qplib_fp.c index 50d8f1fc98d5..9e453a61f118 100644 --- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c +++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c @@ -196,7 +196,7 @@ static int bnxt_qplib_alloc_qp_hdr_buf(struct bnxt_qpli= b_res *res, struct bnxt_qplib_qp *qp) { struct bnxt_qplib_q *rq =3D &qp->rq; - struct bnxt_qplib_q *sq =3D &qp->rq; + struct bnxt_qplib_q *sq =3D &qp->sq; int rc =3D 0; =20 if (qp->sq_hdr_buf_size && sq->hwq.max_elements) { --=20 2.17.1