All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] ib_uverbs: Fix pages leak when using XRC SRQs
@ 2015-04-07 11:22 Sébastien Dugué
  2015-04-14 11:24 ` Sagi Grimberg
  0 siblings, 1 reply; 3+ messages in thread
From: Sébastien Dugué @ 2015-04-07 11:22 UTC (permalink / raw)
  To: linux-rdma, Roland Dreier; +Cc: Vladimir Sokolovsky


  Hello,

  When an application using XRCs abruptly terminates, the mmaped pages
of the CQ buffers are leaked.

  This comes from the fact that when resources are released in
ib_uverbs_cleanup_ucontext(), we fail to release the CQs because their
refcount is not 0.

  When creating an XRC SRQ, we increment the associated CQ refcount.
This refcount is only decremented when the SRQ is released.

  Therefore we need to release the SRQs prior to the CQs to make sure
that all references to the CQs are gone before trying to release these.

Signed-off-by: Sebastien Dugue <sebastien.dugue-6ktuUTfB/bM@public.gmane.org>
---
 drivers/infiniband/core/uverbs_main.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 259dcc7..88cce9b 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -246,6 +246,17 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
 		kfree(uqp);
 	}
 
+	list_for_each_entry_safe(uobj, tmp, &context->srq_list, list) {
+		struct ib_srq *srq = uobj->object;
+		struct ib_uevent_object *uevent =
+			container_of(uobj, struct ib_uevent_object, uobject);
+
+		idr_remove_uobj(&ib_uverbs_srq_idr, uobj);
+		ib_destroy_srq(srq);
+		ib_uverbs_release_uevent(file, uevent);
+		kfree(uevent);
+	}
+
 	list_for_each_entry_safe(uobj, tmp, &context->cq_list, list) {
 		struct ib_cq *cq = uobj->object;
 		struct ib_uverbs_event_file *ev_file = cq->cq_context;
@@ -258,17 +269,6 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
 		kfree(ucq);
 	}
 
-	list_for_each_entry_safe(uobj, tmp, &context->srq_list, list) {
-		struct ib_srq *srq = uobj->object;
-		struct ib_uevent_object *uevent =
-			container_of(uobj, struct ib_uevent_object, uobject);
-
-		idr_remove_uobj(&ib_uverbs_srq_idr, uobj);
-		ib_destroy_srq(srq);
-		ib_uverbs_release_uevent(file, uevent);
-		kfree(uevent);
-	}
-
 	list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
 		struct ib_mr *mr = uobj->object;
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: [PATCH] ib_uverbs: Fix pages leak when using XRC SRQs
  2015-04-07 11:22 [PATCH] ib_uverbs: Fix pages leak when using XRC SRQs Sébastien Dugué
@ 2015-04-14 11:24 ` Sagi Grimberg
  0 siblings, 0 replies; 3+ messages in thread
From: Sagi Grimberg @ 2015-04-14 11:24 UTC (permalink / raw)
  To: Sébastien Dugué, linux-rdma, Roland Dreier; +Cc: Vladimir Sokolovsky

On 4/7/2015 2:22 PM, Sébastien Dugué wrote:
>
>    Hello,
>
>    When an application using XRCs abruptly terminates, the mmaped pages
> of the CQ buffers are leaked.
>
>    This comes from the fact that when resources are released in
> ib_uverbs_cleanup_ucontext(), we fail to release the CQs because their
> refcount is not 0.
>
>    When creating an XRC SRQ, we increment the associated CQ refcount.
> This refcount is only decremented when the SRQ is released.
>
>    Therefore we need to release the SRQs prior to the CQs to make sure
> that all references to the CQs are gone before trying to release these.
>
> Signed-off-by: Sebastien Dugue <sebastien.dugue-6ktuUTfB/bM@public.gmane.org>
> ---
>   drivers/infiniband/core/uverbs_main.c | 22 +++++++++++-----------
>   1 file changed, 11 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
> index 259dcc7..88cce9b 100644
> --- a/drivers/infiniband/core/uverbs_main.c
> +++ b/drivers/infiniband/core/uverbs_main.c
> @@ -246,6 +246,17 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
>   		kfree(uqp);
>   	}
>
> +	list_for_each_entry_safe(uobj, tmp, &context->srq_list, list) {
> +		struct ib_srq *srq = uobj->object;
> +		struct ib_uevent_object *uevent =
> +			container_of(uobj, struct ib_uevent_object, uobject);
> +
> +		idr_remove_uobj(&ib_uverbs_srq_idr, uobj);
> +		ib_destroy_srq(srq);
> +		ib_uverbs_release_uevent(file, uevent);
> +		kfree(uevent);
> +	}
> +
>   	list_for_each_entry_safe(uobj, tmp, &context->cq_list, list) {
>   		struct ib_cq *cq = uobj->object;
>   		struct ib_uverbs_event_file *ev_file = cq->cq_context;
> @@ -258,17 +269,6 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
>   		kfree(ucq);
>   	}
>
> -	list_for_each_entry_safe(uobj, tmp, &context->srq_list, list) {
> -		struct ib_srq *srq = uobj->object;
> -		struct ib_uevent_object *uevent =
> -			container_of(uobj, struct ib_uevent_object, uobject);
> -
> -		idr_remove_uobj(&ib_uverbs_srq_idr, uobj);
> -		ib_destroy_srq(srq);
> -		ib_uverbs_release_uevent(file, uevent);
> -		kfree(uevent);
> -	}
> -
>   	list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
>   		struct ib_mr *mr = uobj->object;
>
>

Nice catch,

Reviewed-by: Sagi Grimberg <sagig-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

^ permalink raw reply	[flat|nested] 3+ messages in thread
* [PATCH] ib_uverbs: Fix pages leak when using XRC SRQs
@ 2015-04-09  9:13 Sébastien Dugué
  0 siblings, 0 replies; 3+ messages in thread
From: Sébastien Dugué @ 2015-04-09  9:13 UTC (permalink / raw)
  To: linux-rdma


  Hello,

  When an application using XRCs abruptly terminates, the mmaped pages
of the CQ buffers are leaked.

  This comes from the fact that when resources are released in
ib_uverbs_cleanup_ucontext(), we fail to release the CQs because their
refcount is not 0.

  When creating an XRC SRQ, we increment the associated CQ refcount.
This refcount is only decremented when the SRQ is released.

  Therefore we need to release the SRQs prior to the CQs to make sure
that all references to the CQs are gone before trying to release these.

Signed-off-by: Sebastien Dugue <sebastien.dugue-6ktuUTfB/bM@public.gmane.org>
---
 drivers/infiniband/core/uverbs_main.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 259dcc7..88cce9b 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -246,6 +246,17 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
 		kfree(uqp);
 	}
 
+	list_for_each_entry_safe(uobj, tmp, &context->srq_list, list) {
+		struct ib_srq *srq = uobj->object;
+		struct ib_uevent_object *uevent =
+			container_of(uobj, struct ib_uevent_object, uobject);
+
+		idr_remove_uobj(&ib_uverbs_srq_idr, uobj);
+		ib_destroy_srq(srq);
+		ib_uverbs_release_uevent(file, uevent);
+		kfree(uevent);
+	}
+
 	list_for_each_entry_safe(uobj, tmp, &context->cq_list, list) {
 		struct ib_cq *cq = uobj->object;
 		struct ib_uverbs_event_file *ev_file = cq->cq_context;
@@ -258,17 +269,6 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
 		kfree(ucq);
 	}
 
-	list_for_each_entry_safe(uobj, tmp, &context->srq_list, list) {
-		struct ib_srq *srq = uobj->object;
-		struct ib_uevent_object *uevent =
-			container_of(uobj, struct ib_uevent_object, uobject);
-
-		idr_remove_uobj(&ib_uverbs_srq_idr, uobj);
-		ib_destroy_srq(srq);
-		ib_uverbs_release_uevent(file, uevent);
-		kfree(uevent);
-	}
-
 	list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
 		struct ib_mr *mr = uobj->object;
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

^ permalink raw reply related	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-04-14 11:24 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-04-07 11:22 [PATCH] ib_uverbs: Fix pages leak when using XRC SRQs Sébastien Dugué
2015-04-14 11:24 ` Sagi Grimberg
2015-04-09  9:13 Sébastien Dugué

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.