Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Memory leak of `struct mlx5_st_idx_data` in `mlx5_st_dealloc_index()` when its refcount reaches 0. -- Note: Due to system recitation restrictions, this review report cannot quote the original patch diff inline. The findings are provided as a free-form summary below. commit 9ada3f634918f1f6bc02c86bed9350c775185dbc Author: Zhiping Zhang <[email protected]> Subject: RDMA/mlx5: get tph for p2p access when registering dma-buf mr This commit wires up mlx5_ib to query dma-buf TPH metadata at MR registration time to program requester-side TPH on the outbound mkey. It translates exporter-provided steering tags into local ST entries and ties the extra ST-table reference to the MR lifetime. [Severity: High] This is a pre-existing issue, but I noticed something while reviewing the surrounding code in drivers/net/ethernet/mellanox/mlx5/core/lib/st.c. In the mlx5_st_dealloc_index() function, when the usecount refcount drops to zero, the code calls xa_erase() to remove the element from the xarray. However, it appears the dynamically allocated memory for the idx_data structure itself is never freed. Could this lead to an unbounded memory leak when a user-space application repeatedly registers and deregisters a dma-buf MR with a TPH tag? During registration, mlx5_st_alloc_index_by_tag() allocates a new struct mlx5_st_idx_data via kzalloc_obj(). If deregistration drops the reference count to zero and removes the pointer from the xarray but fails to free the structure, could this be triggered in a loop by an unprivileged user-space process to deplete kernel memory? Would it make sense to add a kfree() for the idx_data structure immediately after the xa_erase() call in the refcount_dec_and_test() block? -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4
