Ao Zhou 8141a2dc70 net: rds: fix MR cleanup on copy error ...

__rds_rdma_map() hands sg/pages ownership to the transport after
get_mr() succeeds. If copying the generated cookie back to user space
fails after that point, the error path must not free those resources
again before dropping the MR reference.

Remove the duplicate unpin/free from the put_user() failure branch so
that MR teardown is handled only through the existing final cleanup
path.

Fixes: 0d4597c8c5 ("net/rds: Track user mapped pages through special API")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Ao Zhou <draw51280@163.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reviewed-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/79c8ef73ec8e5844d71038983940cc2943099baf.1776764247.git.draw51280@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

2026-04-23 12:18:08 -07:00

..

af_rds.c

net/rds: Restrict use of RDS/IB to the initial network namespace

2026-04-12 13:33:19 -07:00

bind.c

net: Convert proto_ops bind() callbacks to use sockaddr_unsized

2025-11-04 19:10:32 -08:00

cong.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

connection.c

net/rds: zero per-item info buffer before handing it to visitors

2026-04-22 21:05:16 -07:00

ib_cm.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

ib_frmr.c

rds: ib: Increment i_fastreg_wrs before bailing out

2025-09-15 16:47:53 -07:00

ib_mr.h

rds: ib: Remove unused extern definition

2025-09-08 18:16:49 -07:00

ib_rdma.c

net/rds: Optimize rds_ib_laddr_check

2026-04-12 13:33:19 -07:00

ib_recv.c

net/rds: Add per cp work queue

2026-01-13 12:27:03 +01:00

ib_ring.c

rds: Fix spelling mistakes

2021-05-31 22:45:05 -07:00

ib_send.c

net/rds: new extension header: rdma bytes

2026-02-04 20:46:38 -08:00

ib_stats.c

…

ib_sysctl.c

net: rds: Remove the now superfluous sentinel elements from ctl_table array

2024-05-03 13:29:42 +01:00

ib.c

net/rds: Restrict use of RDS/IB to the initial network namespace

2026-04-12 13:33:19 -07:00

ib.h

net/rds: Optimize rds_ib_laddr_check

2026-04-12 13:33:19 -07:00

info.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

info.h

…

Kconfig

net: rds: add option for GCOV profiling

2024-08-09 13:18:46 +01:00

loop.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

loop.h

…

Makefile

net: rds: add option for GCOV profiling

2024-08-09 13:18:46 +01:00

message.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

page.c

rds: Use nested-BH locking for rds_page_remainder

2025-05-15 15:23:31 +02:00

rdma_transport.c

net: rds: Fix possible NULL-pointer dereference

2023-09-20 08:49:03 +01:00

rdma_transport.h

net/rds: Remove unused function declarations

2023-08-13 12:25:42 +01:00

rdma.c

net: rds: fix MR cleanup on copy error

2026-04-23 12:18:08 -07:00

rds_single_path.h

…

rds.h

net/rds: Trigger rds_send_ping() more than once

2026-02-04 20:46:39 -08:00

recv.c

net/rds: Trigger rds_send_ping() more than once

2026-02-04 20:46:39 -08:00

send.c

rds: update outdated comment

2026-02-25 19:03:55 -08:00

stats.c

net/rds: Use the first lane until RDS_EXTHDR_NPATHS arrives

2026-02-04 20:46:39 -08:00

sysctl.c

net: rds: Remove the now superfluous sentinel elements from ctl_table array

2024-05-03 13:29:42 +01:00

tcp_connect.c

net/rds: rds_tcp_conn_path_shutdown must not discard messages

2026-02-04 20:46:38 -08:00

tcp_listen.c

net/rds: fix recursive lock in rds_tcp_conn_slots_available

2026-02-24 10:11:04 +01:00

tcp_recv.c

net/rds: rds_tcp_conn_path_shutdown must not discard messages

2026-02-04 20:46:38 -08:00

tcp_send.c

net/rds: rds_tcp_conn_path_shutdown must not discard messages

2026-02-04 20:46:38 -08:00

tcp_stats.c

…

tcp.c

net/rds: Fix circular locking dependency in rds_tcp_tune

2026-03-03 12:57:06 +01:00

tcp.h

net/rds: Trigger rds_send_ping() more than once

2026-02-04 20:46:39 -08:00

threads.c

net/rds: Add per cp work queue

2026-01-13 12:27:03 +01:00

transport.c

…