LU-15509 lnet: Ping buffer ref leak in lnet_peer_data_present

lnet_peer_merge_data() and lnet_peer_set_primary_data() are
responsible for dropping the reference on the ping buffer that is
taken by lnet_peer_push_event() and lnet_discovery_event_reply().
However, there are some error paths in lnet_peer_data_present()
where we do not call either lnet_peer_merge_data() or
lnet_peer_set_primary_data(). In these cases, we need to drop
the reference on the ping buffer otherwise it will leak.

HPE-bug-id: LUS-10715
Test-Parameters: trivial testlist=sanity-lnet
Signed-off-by: Chris Horn <chris.horn@hpe.com>
Change-Id: I36ba0017caa9d6ce139f94090912496f14eda626
Reviewed-on: https://review.whamcloud.com/46431
Tested-by: jenkins <devops@whamcloud.com>
Reviewed-by: Andriy Skulysh <andriy.skulysh@hpe.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: James Simmons <jsimmons@infradead.org>
Reviewed-by: Serguei Smirnov <ssmirnov@whamcloud.com>
Reviewed-by: Cyril Bordage <cbordage@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>

diff --git a/lnet/lnet/peer.c b/lnet/lnet/peer.c
index e32423f..ae71e25 100644 (file)
--- a/lnet/lnet/peer.c
+++ b/lnet/lnet/peer.c
@@ -3334,8 +3334,10 @@ __must_hold(&lp->lp_lock)
         * down, and our reference count may be all that is keeping it
         * alive. Don't do any work on it.
         */
-       if (list_empty(&lp->lp_peer_list))
+       if (list_empty(&lp->lp_peer_list)) {
+               lnet_ping_buffer_decref(pbuf);
                goto out;
+       }
 
        flags = LNET_PEER_DISCOVERED;
        if (pbuf->pb_info.pi_features & LNET_PING_FEAT_MULTI_RAIL)
@@ -3362,7 +3364,9 @@ __must_hold(&lp->lp_lock)
        nid = pbuf->pb_info.pi_ni[1].ns_nid;
        if (nid_is_lo0(&lp->lp_primary_nid)) {
                rc = lnet_peer_set_primary_nid(lp, nid, flags);
-               if (!rc)
+               if (rc)
+                       lnet_ping_buffer_decref(pbuf);
+               else
                        rc = lnet_peer_merge_data(lp, pbuf);
        /*
         * if the primary nid of the peer is present in the ping info returned
@@ -3385,6 +3389,7 @@ __must_hold(&lp->lp_lock)
                                CERROR("Primary NID error %s versus %s: %d\n",
                                       libcfs_nidstr(&lp->lp_primary_nid),
                                       libcfs_nid2str(nid), rc);
+                               lnet_ping_buffer_decref(pbuf);
                        } else {
                                rc = lnet_peer_merge_data(lp, pbuf);
                        }