| From 027918605e719867a162666a40c529d85d7e7c78 Mon Sep 17 00:00:00 2001 |
| From: Doug Ledford <dledford@redhat.com> |
| Date: Mon, 9 Oct 2017 09:11:32 -0400 |
| Subject: IB/rxe: put the pool on allocation failure |
| |
| [ Upstream commit 6b9f8970cd30929cb6b372fa44fa66da9e59c650 ] |
| |
| If the allocation of elem fails, it is not sufficient to simply check |
| for NULL and return. We need to also put our reference on the pool or |
| else we will leave the pool with a permanent ref count and we will never |
| be able to free it. |
| |
| Fixes: 4831ca9e4a8e ("IB/rxe: check for allocation failure on elem") |
| Suggested-by: Leon Romanovsky <leon@kernel.org> |
| Signed-off-by: Doug Ledford <dledford@redhat.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/infiniband/sw/rxe/rxe_pool.c | 16 +++++++++------- |
| 1 file changed, 9 insertions(+), 7 deletions(-) |
| |
| diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c |
| index 1c4e5b2e6835..527ca662da69 100644 |
| --- a/drivers/infiniband/sw/rxe/rxe_pool.c |
| +++ b/drivers/infiniband/sw/rxe/rxe_pool.c |
| @@ -402,23 +402,25 @@ void *rxe_alloc(struct rxe_pool *pool) |
| |
| kref_get(&pool->rxe->ref_cnt); |
| |
| - if (atomic_inc_return(&pool->num_elem) > pool->max_elem) { |
| - atomic_dec(&pool->num_elem); |
| - rxe_dev_put(pool->rxe); |
| - rxe_pool_put(pool); |
| - return NULL; |
| - } |
| + if (atomic_inc_return(&pool->num_elem) > pool->max_elem) |
| + goto out_put_pool; |
| |
| elem = kmem_cache_zalloc(pool_cache(pool), |
| (pool->flags & RXE_POOL_ATOMIC) ? |
| GFP_ATOMIC : GFP_KERNEL); |
| if (!elem) |
| - return NULL; |
| + goto out_put_pool; |
| |
| elem->pool = pool; |
| kref_init(&elem->ref_cnt); |
| |
| return elem; |
| + |
| +out_put_pool: |
| + atomic_dec(&pool->num_elem); |
| + rxe_dev_put(pool->rxe); |
| + rxe_pool_put(pool); |
| + return NULL; |
| } |
| |
| void rxe_elem_release(struct kref *kref) |
| -- |
| 2.17.1 |
| |