korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-18 09:44:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

IB/rxe: Fix a MR reference leak in check_rkey()

Browse Source 
Avoid that calling check_rkey() for mem->state == RXE_MEM_STATE_FREE
triggers an MR reference leak.

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Andrew Boyer <andrew.boyer@dell.com>
Cc: Moni Shoua <monis@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
This commit is contained in:
Bart Van Assche 2017-01-10 11:15:51 -08:00 committed by Doug Ledford
parent 18d3451c0d
commit b3a4599610
1 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/infiniband/sw/rxe/rxe_resp.c
View File

@ -418,7 +418,7 @@ static enum resp_states check_length(struct rxe_qp *qp,
static enum resp_states check_rkey(struct rxe_qp *qp,
struct rxe_pkt_info *pkt)
{
struct rxe_mem *mem;
struct rxe_mem *mem = NULL;
u64 va;
u32 rkey;
u32 resid;
@ -459,38 +459,38 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
mem = lookup_mem(qp->pd, access, rkey, lookup_remote);
if (!mem) {
state = RESPST_ERR_RKEY_VIOLATION;
goto err1;
goto err;
}
if (unlikely(mem->state == RXE_MEM_STATE_FREE)) {
state = RESPST_ERR_RKEY_VIOLATION;
goto err1;
goto err;
}
if (mem_check_range(mem, va, resid)) {
state = RESPST_ERR_RKEY_VIOLATION;
goto err2;
goto err;
}
if (pkt->mask & RXE_WRITE_MASK) {
if (resid > mtu) {
if (pktlen != mtu || bth_pad(pkt)) {
state = RESPST_ERR_LENGTH;
goto err2;
goto err;
}
resid = mtu;
} else {
if (pktlen != resid) {
state = RESPST_ERR_LENGTH;
goto err2;
goto err;
}
if ((bth_pad(pkt) != (0x3 & (-resid)))) {
/* This case may not be exactly that
* but nothing else fits.
*/
state = RESPST_ERR_LENGTH;
goto err2;
goto err;
}
}
}
@ -500,9 +500,9 @@ static enum resp_states check_rkey(struct rxe_qp *qp,
qp->resp.mr = mem;
return RESPST_EXECUTE;
err2:
rxe_drop_ref(mem);
err1:
err:
if (mem)
rxe_drop_ref(mem);
return state;
}