The branch stable/12 has been updated by hselasky: URL: https://cgit.FreeBSD.org/src/commit/?id=dad7c072f482527b4964bbd4b067d06c6df2e592
commit dad7c072f482527b4964bbd4b067d06c6df2e592 Author: Hans Petter Selasky <[email protected]> AuthorDate: 2022-05-30 18:19:33 +0000 Commit: Hans Petter Selasky <[email protected]> CommitDate: 2022-06-07 06:46:22 +0000 ibcore: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() The algorithm pre-allocates a cm_id since allocation cannot be done while holding the cm.lock spinlock, however it doesn't free it on one error path, leading to a memory leak. Linux commit: c14dfddbd869bf0c2bafb7ef260c41d9cebbcfec PR: 264248 Sponsored by: NVIDIA Networking (cherry picked from commit c4a415505311e30093b6d9ee0493427a66f2b0de) --- sys/ofed/drivers/infiniband/core/ib_cm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/ofed/drivers/infiniband/core/ib_cm.c b/sys/ofed/drivers/infiniband/core/ib_cm.c index 28c52c0cb2f2..0d73dee91db6 100644 --- a/sys/ofed/drivers/infiniband/core/ib_cm.c +++ b/sys/ofed/drivers/infiniband/core/ib_cm.c @@ -1104,6 +1104,7 @@ struct ib_cm_id *ib_cm_insert_listen(struct ib_device *device, /* Sharing an ib_cm_id with different handlers is not * supported */ spin_unlock_irqrestore(&cm.lock, flags); + ib_destroy_cm_id(cm_id); return ERR_PTR(-EINVAL); } atomic_inc(&cm_id_priv->refcount);
