From patchwork Tue Dec 28 01:44:06 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Li Zhijian X-Patchwork-Id: 12700115 X-Patchwork-Delegate: jgg@ziepe.ca Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B123EC433F5 for ; Tue, 28 Dec 2021 01:39:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234400AbhL1Bja (ORCPT ); Mon, 27 Dec 2021 20:39:30 -0500 Received: from mail.cn.fujitsu.com ([183.91.158.132]:32305 "EHLO heian.cn.fujitsu.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S232933AbhL1Bja (ORCPT ); Mon, 27 Dec 2021 20:39:30 -0500 IronPort-Data: A9a23:+67MA6MQyhPLZznvrR05lcFynXyQoLVcMsFnjC/WdVO+3Toh3zwOmzNLW2nSaKyMNzHwLYslb43io04G7ZfXm99gGjLY11k3ESsS9pCt6fd1j6vIF3rLaJWFFSqL1u1GAjX7BJ1yHi+0SiuFaOC79CAmj/HQH9IQNcafUsxPbV49IMseoUI78wIJqtYAbemRW2thi/uryyHsEAPNNwpPD44hw/nrRCWDExjFkGhwUlQWPZintbJF/pUfJMp3yaqZdxMUTmTId9NWSdovzJnhlo/Y1xwrTN24kLfnaVBMSbnXVeSMoiMOHfH83V4Z/Wpvuko4HKN0hUN/jzSbn9FzydxLnZKtSwY1JbCKk+MYO/VdO3gnbPMcpuSXfhBTtuTWlSUqaUDE2e1jBVstOosY4utfDmRH9PheIzcIBjiRluCk0bDhErE0rssmJcjveogYvxlI3DjfD+sgB4LDXo3O5NlFzHE8i94mNfTRaOIfdztjbR2GaBpKUn8TCZQjjKKri2P5fjlwtl2Yv+w07nLVwQg316LiWPLRe9qXVYBPkkORjnzJ8n6/ARwAMtGbjz2f/RqEhODAtTH6VZofUraxnsOGKnX7Knc7UUVQDAXk56LizBPWZj6WEGRMkgJGkET43BXDogHBYiCF IronPort-HdrOrdr: A9a23:rUOV6K+sPtGT5ha5jXVuk+DkI+orL9Y04lQ7vn2ZKCYlFvBw8vrCoB1173HJYUkqMk3I9ergBEDiewK4yXcW2/hzAV7KZmCP11dAR7sSj7cKrQeBJwTOssZZ1YpFN5N1EcDMCzFB5vrS0U2VFMkBzbC8nJyVuQ== X-IronPort-AV: E=Sophos;i="5.88,241,1635177600"; d="scan'208";a="119626387" Received: from unknown (HELO cn.fujitsu.com) ([10.167.33.5]) by heian.cn.fujitsu.com with ESMTP; 28 Dec 2021 09:39:28 +0800 Received: from G08CNEXMBPEKD06.g08.fujitsu.local (unknown [10.167.33.206]) by cn.fujitsu.com (Postfix) with ESMTP id ACCD34D11981; Tue, 28 Dec 2021 09:39:25 +0800 (CST) Received: from G08CNEXCHPEKD09.g08.fujitsu.local (10.167.33.85) by G08CNEXMBPEKD06.g08.fujitsu.local (10.167.33.206) with Microsoft SMTP Server (TLS) id 15.0.1497.23; Tue, 28 Dec 2021 09:39:23 +0800 Received: from localhost.localdomain (10.167.225.141) by G08CNEXCHPEKD09.g08.fujitsu.local (10.167.33.209) with Microsoft SMTP Server id 15.0.1497.23 via Frontend Transport; Tue, 28 Dec 2021 09:39:23 +0800 From: Li Zhijian To: , CC: , , , , Li Zhijian , Jason Gunthorpe Subject: [PATCH v2] RDMA/rxe: Prevent from double freeing rxe_map_set Date: Tue, 28 Dec 2021 09:44:06 +0800 Message-ID: <20211228014406.1033444-1-lizhijian@cn.fujitsu.com> X-Mailer: git-send-email 2.31.1 MIME-Version: 1.0 X-yoursite-MailScanner-ID: ACCD34D11981.AD0F5 X-yoursite-MailScanner: Found to be clean X-yoursite-MailScanner-From: lizhijian@fujitsu.com Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org a same rxe_map_set could be freed twice: rxe_reg_user_mr() -> rxe_mr_init_user() -> rxe_mr_free_map_set() # 1st -> rxe_drop_ref() ... -> rxe_mr_cleanup() -> rxe_mr_free_map_set() # 2nd By convention, we should cleanup/free resources in the error path in the same function where the resources are alloted in. So rxe_mr_init_user() doesn't need to free the map_set directly. In addition, we have to reset map_set to NULL inside rxe_mr_alloc() if needed to prevent from map_set being double freed in rxe_mr_cleanup(). CC: Jason Gunthorpe Signed-off-by: Li Zhijian Acked-by: Zhu Yanjun --- V2: Fix it by a simpler way by following suggestion from Bob, --- drivers/infiniband/sw/rxe/rxe_mr.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c index 25c78aade822..7c4cd19a9db2 100644 --- a/drivers/infiniband/sw/rxe/rxe_mr.c +++ b/drivers/infiniband/sw/rxe/rxe_mr.c @@ -141,6 +141,7 @@ static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf, int both) ret = rxe_mr_alloc_map_set(num_map, &mr->next_map_set); if (ret) { rxe_mr_free_map_set(mr->num_map, mr->cur_map_set); + mr->cur_map_set = NULL; goto err_out; } } @@ -214,7 +215,7 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova, pr_warn("%s: Unable to get virtual address\n", __func__); err = -ENOMEM; - goto err_cleanup_map; + goto err_release_umem; } buf->addr = (uintptr_t)vaddr; @@ -237,8 +238,6 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova, return 0; -err_cleanup_map: - rxe_mr_free_map_set(mr->num_map, mr->cur_map_set); err_release_umem: ib_umem_release(umem); err_out: