xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr

Browse Source 
commit 60a8b5a1611b4a26de4839ab9c1fc2a9cf3e17c1 upstream.

This buffer is currently allocated in hfi1_init():

	if (reinit)
		ret = init_after_reset(dd);
	else
		ret = loadtime_init(dd);
	if (ret)
		goto done;

	/* allocate dummy tail memory for all receive contexts */
	dd->rcvhdrtail_dummy_kvaddr = dma_alloc_coherent(&dd->pcidev->dev,
							 sizeof(u64),
							 &dd->rcvhdrtail_dummy_dma,
							 GFP_KERNEL);

	if (!dd->rcvhdrtail_dummy_kvaddr) {
		dd_dev_err(dd, "cannot allocate dummy tail memory\n");
		ret = -ENOMEM;
		goto done;
	}

The reinit triggered path will overwrite the old allocation and leak it.

Fix by moving the allocation to hfi1_alloc_devdata() and the deallocation
to hfi1_free_devdata().

Link: https://lore.kernel.org/r/20211129192008.101968.91302.stgit@awfm-01.cornelisnetworks.com
Cc: stable@vger.kernel.org
Fixes: 46b010d3ee ("staging/rdma/hfi1: Workaround to prevent corruption during packet delivery")
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Mike Marciniszyn
2021-11-29 14:20:08 -05:00
committed by Greg Kroah-Hartman
parent d87c10607b
commit 2c08271f4e
1 changed files with 14 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
drivers/infiniband/hw/hfi1/init.c
View File

@@ -916,18 +916,6 @@ int hfi1_init(struct hfi1_devdata *dd, int reinit)
if (ret) if (ret)
goto done; goto done;
/* allocate dummy tail memory for all receive contexts */
dd->rcvhdrtail_dummy_kvaddr = dma_alloc_coherent(&dd->pcidev->dev,
sizeof(u64),
&dd->rcvhdrtail_dummy_dma,
GFP_KERNEL);
if (!dd->rcvhdrtail_dummy_kvaddr) {
dd_dev_err(dd, "cannot allocate dummy tail memory\n");
ret = -ENOMEM;
goto done;
}
/* dd->rcd can be NULL if early initialization failed */ /* dd->rcd can be NULL if early initialization failed */
for (i = 0; dd->rcd && i < dd->first_dyn_alloc_ctxt; ++i) { for (i = 0; dd->rcd && i < dd->first_dyn_alloc_ctxt; ++i) {
/* /*
@@ -1241,6 +1229,11 @@ void hfi1_free_devdata(struct hfi1_devdata *dd)
dd->tx_opstats = NULL; dd->tx_opstats = NULL;
kfree(dd->comp_vect); kfree(dd->comp_vect);
dd->comp_vect = NULL; dd->comp_vect = NULL;
if (dd->rcvhdrtail_dummy_kvaddr)
dma_free_coherent(&dd->pcidev->dev, sizeof(u64),
(void *)dd->rcvhdrtail_dummy_kvaddr,
dd->rcvhdrtail_dummy_dma);
dd->rcvhdrtail_dummy_kvaddr = NULL;
sdma_clean(dd, dd->num_sdma); sdma_clean(dd, dd->num_sdma);
rvt_dealloc_device(&dd->verbs_dev.rdi); rvt_dealloc_device(&dd->verbs_dev.rdi);
} }
@@ -1338,6 +1331,15 @@ static struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev,
goto bail; goto bail;
} }
/* allocate dummy tail memory for all receive contexts */
dd->rcvhdrtail_dummy_kvaddr =
dma_alloc_coherent(&dd->pcidev->dev, sizeof(u64),
&dd->rcvhdrtail_dummy_dma, GFP_KERNEL);
if (!dd->rcvhdrtail_dummy_kvaddr) {
ret = -ENOMEM;
goto bail;
}
atomic_set(&dd->ipoib_rsm_usr_num, 0); atomic_set(&dd->ipoib_rsm_usr_num, 0);
return dd; return dd;
@@ -1545,13 +1547,6 @@ static void cleanup_device_data(struct hfi1_devdata *dd)
free_credit_return(dd); free_credit_return(dd);
if (dd->rcvhdrtail_dummy_kvaddr) {
dma_free_coherent(&dd->pcidev->dev, sizeof(u64),
(void *)dd->rcvhdrtail_dummy_kvaddr,
dd->rcvhdrtail_dummy_dma);
dd->rcvhdrtail_dummy_kvaddr = NULL;
}
/* /*
* Free any resources still in use (usually just kernel contexts) * Free any resources still in use (usually just kernel contexts)
* at unload; we do for ctxtcnt, because that's what we allocate. * at unload; we do for ctxtcnt, because that's what we allocate.