| Message ID | 20241217075538.2909996-1-make_ruc2021@163.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | RDMA/srp: Fix error handling in srp_add_port | expand |
On Tue, Dec 17, 2024 at 03:55:38PM +0800, Ma Ke wrote: > The reference count of the device incremented in device_initialize() is > not decremented when device_add() fails. Add a put_device() call before > returning from the function to decrement reference count for cleanup. > Or it could cause memory leak. That is not what you did here. Please be more careful when sending out "bugfixes" like this. thanks, greg k-h
On Tue, 17 Dec 2024 15:55:38 +0800, Ma Ke wrote: > The reference count of the device incremented in device_initialize() is > not decremented when device_add() fails. Add a put_device() call before > returning from the function to decrement reference count for cleanup. > Or it could cause memory leak. > > As comment of device_add() says, if device_add() succeeds, you should > call device_del() when you want to get rid of it. If device_add() has > not succeeded, use only put_device() to drop the reference count. > > [...] Applied, thanks! [1/1] RDMA/srp: Fix error handling in srp_add_port https://git.kernel.org/rdma/rdma/c/a3cbf68c696111 Best regards,
On Tue, Dec 17, 2024 at 03:55:38PM +0800, Ma Ke wrote: > The reference count of the device incremented in device_initialize() is > not decremented when device_add() fails. Add a put_device() call before > returning from the function to decrement reference count for cleanup. > Or it could cause memory leak. > > As comment of device_add() says, if device_add() succeeds, you should > call device_del() when you want to get rid of it. If device_add() has > not succeeded, use only put_device() to drop the reference count. > > Found by code review. > > Cc: stable@vger.kernel.org I slightly rewrote commit message and dropped this stable@ tag. Thanks > Fixes: c8e4c2397655 ("RDMA/srp: Rework the srp_add_port() error path") > Signed-off-by: Ma Ke <make_ruc2021@163.com> > --- > drivers/infiniband/ulp/srp/ib_srp.c | 1 - > 1 file changed, 1 deletion(-) > > diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c > index 2916e77f589b..7289ae0b83ac 100644 > --- a/drivers/infiniband/ulp/srp/ib_srp.c > +++ b/drivers/infiniband/ulp/srp/ib_srp.c > @@ -3978,7 +3978,6 @@ static struct srp_host *srp_add_port(struct srp_device *device, u32 port) > return host; > > put_host: > - device_del(&host->dev); > put_device(&host->dev); > return NULL; > } > -- > 2.25.1 >
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 2916e77f589b..7289ae0b83ac 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -3978,7 +3978,6 @@ static struct srp_host *srp_add_port(struct srp_device *device, u32 port) return host; put_host: - device_del(&host->dev); put_device(&host->dev); return NULL; }
The reference count of the device incremented in device_initialize() is not decremented when device_add() fails. Add a put_device() call before returning from the function to decrement reference count for cleanup. Or it could cause memory leak. As comment of device_add() says, if device_add() succeeds, you should call device_del() when you want to get rid of it. If device_add() has not succeeded, use only put_device() to drop the reference count. Found by code review. Cc: stable@vger.kernel.org Fixes: c8e4c2397655 ("RDMA/srp: Rework the srp_add_port() error path") Signed-off-by: Ma Ke <make_ruc2021@163.com> --- drivers/infiniband/ulp/srp/ib_srp.c | 1 - 1 file changed, 1 deletion(-)