[rds-devel] [External] : Re: [PATCH net 1/1] net: rds: fix MR cleanup on copy error

[Allison Henderson]

On Wed, 2026-04-22 at 22:52 +0800, Ren Wei wrote:
> From: Ao Zhou <draw51280 at 163.com>
> 
> __rds_rdma_map() hands sg/pages ownership to the transport after
> get_mr() succeeds. If copying the generated cookie back to user space
> fails after that point, the error path must not free those resources
> again before dropping the MR reference.
> 
> Remove the duplicate unpin/free from the put_user() failure branch so
> that MR teardown is handled only through the existing final cleanup
> path.
> 
> Fixes: 0d4597c8c5ab ("net/rds: Track user mapped pages through special API")
> Cc: stable at kernel.org
> Reported-by: Yuan Tan <yuantan098 at gmail.com>
> Reported-by: Yifan Wu <yifanwucs at gmail.com>
> Reported-by: Juefei Pu <tomapufckgml at gmail.com>
> Reported-by: Xin Liu <bird at lzu.edu.cn>
> Signed-off-by: Ao Zhou <draw51280 at 163.com>
> Signed-off-by: Ren Wei <n05ec at lzu.edu.cn>

Hi Aso,

This fix looks good to me.  Since this is a bug fix, this patch should be cc'd to stable at vger.kernel.org.  Also be sure
to note the target tree and component in the subject line like this:  

[PATCH net v2 1/1] net/net: rds: fix MR cleanup on copy error

Other than that, the patch looks good to me.  Thanks Aso.

Reviewed-by: Allison Henderson <achender at kernel.org>

Allison

> ---
>  net/rds/rdma.c | 4 ----
>  1 file changed, 4 deletions(-)
> 
> diff --git a/net/rds/rdma.c b/net/rds/rdma.c
> index aa6465dc742c..61fb6e45281b 100644
> --- a/net/rds/rdma.c
> +++ b/net/rds/rdma.c
> @@ -326,10 +326,6 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
>  
>  	if (args->cookie_addr &&
>  	    put_user(cookie, (u64 __user *)(unsigned long)args->cookie_addr)) {
> -		if (!need_odp) {
> -			unpin_user_pages(pages, nr_pages);
> -			kfree(sg);
> -		}
>  		ret = -EFAULT;
>  		goto out;
>  	}