Commit 8141a2dc authored by Ao Zhou's avatar Ao Zhou Committed by Jakub Kicinski
Browse files

net: rds: fix MR cleanup on copy error 



__rds_rdma_map() hands sg/pages ownership to the transport after
get_mr() succeeds. If copying the generated cookie back to user space
fails after that point, the error path must not free those resources
again before dropping the MR reference.

Remove the duplicate unpin/free from the put_user() failure branch so
that MR teardown is handled only through the existing final cleanup
path.

Fixes: 0d4597c8 ("net/rds: Track user mapped pages through special API")
Cc: stable@kernel.org
Reported-by: default avatarYuan Tan <yuantan098@gmail.com>
Reported-by: default avatarYifan Wu <yifanwucs@gmail.com>
Reported-by: default avatarJuefei Pu <tomapufckgml@gmail.com>
Reported-by: default avatarXin Liu <bird@lzu.edu.cn>
Signed-off-by: default avatarAo Zhou <draw51280@163.com>
Signed-off-by: default avatarRen Wei <n05ec@lzu.edu.cn>
Reviewed-by: default avatarAllison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/79c8ef73ec8e5844d71038983940cc2943099baf.1776764247.git.draw51280@163.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 7256eb3e

net/rds/rdma.c

+0 −4
Original line number Diff line number Diff line
@@ -326,10 +326,6 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args, 


	if (args->cookie_addr &&

	    put_user(cookie, (u64 __user *)(unsigned long)args->cookie_addr)) {

		if (!need_odp) {

			unpin_user_pages(pages, nr_pages);

			kfree(sg);

		}

		ret = -EFAULT;

		goto out;

	}