git: 072eaae40ba7 - stable/13 - ibcore: Fix memory leak in cm_add/remove_one.

[Hans Petter Selasky]

The branch stable/13 has been updated by hselasky:

URL: https://cgit.FreeBSD.org/src/commit/?id=072eaae40ba7b46101ec2cf4625e6e7e12debf0a

commit 072eaae40ba7b46101ec2cf4625e6e7e12debf0a
Author:     Hans Petter Selasky <hselasky at FreeBSD.org>
AuthorDate: 2021-06-16 13:01:36 +0000
Commit:     Hans Petter Selasky <hselasky at FreeBSD.org>
CommitDate: 2021-07-26 16:04:29 +0000

    ibcore: Fix memory leak in cm_add/remove_one.
    
    In the process of moving the debug counters sysfs entries, the commit
    mentioned below eliminated the cm_infiniband sysfs directory.
    
    This sysfs directory was tied to the cm_port object allocated in procedure
    cm_add_one().
    
    Before the commit below, this cm_port object was freed via a call to
    kobject_put(port->kobj) in procedure cm_remove_port_fs().
    
    Since port no longer uses its kobj, kobject_put(port->kobj) was eliminated.
    This, however, meant that kfree was never called for the cm_port buffers.
    
    Fix this by adding explicit kfree(port) calls to functions cm_add_one()
    and cm_remove_one().
    
    Note that the kfree call in the first chunk below, in the cm_add_one error
    flow, fixes an old, undetected memory leak.
    
    Linux commit:
    94635c36f3854934a46d9e812e028d4721bbb0e6
    
    Reviewed by:    kib
    Sponsored by:   Mellanox Technologies // NVIDIA Networking
    
    (cherry picked from commit 8d04583de542dcd087b401f6b830b8e6ab43d696)
---
 sys/ofed/drivers/infiniband/core/ib_cm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/sys/ofed/drivers/infiniband/core/ib_cm.c b/sys/ofed/drivers/infiniband/core/ib_cm.c
index 6a809b18d301..5fb37e3245e8 100644
--- a/sys/ofed/drivers/infiniband/core/ib_cm.c
+++ b/sys/ofed/drivers/infiniband/core/ib_cm.c
@@ -4132,6 +4132,7 @@ error2:
 error1:
 	port_modify.set_port_cap_mask = 0;
 	port_modify.clr_port_cap_mask = IB_PORT_CM_SUP;
+	kfree(port);
 	while (--i) {
 		if (!rdma_cap_ib_cm(ib_device, i))
 			continue;
@@ -4140,6 +4141,7 @@ error1:
 		ib_modify_port(ib_device, port->port_num, 0, &port_modify);
 		ib_unregister_mad_agent(port->mad_agent);
 		cm_remove_port_fs(port);
+		kfree(port);
 	}
 free:
 	device_unregister(cm_dev->device);
@@ -4194,6 +4196,7 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)
 		spin_unlock_irq(&cm.state_lock);
 		ib_unregister_mad_agent(cur_mad_agent);
 		cm_remove_port_fs(port);
+		kfree(port);
 	}
 
 	device_unregister(cm_dev->device);