From 4de9793654ec1b2f08d93f74f7391c4245ab8769 Mon Sep 17 00:00:00 2001 From: Chris Horn Date: Wed, 2 Feb 2022 22:05:15 +0000 Subject: [PATCH] LU-15509 lnet: Ping buffer ref leak in lnet_peer_data_present lnet_peer_merge_data() and lnet_peer_set_primary_data() are responsible for dropping the reference on the ping buffer that is taken by lnet_peer_push_event() and lnet_discovery_event_reply(). However, there are some error paths in lnet_peer_data_present() where we do not call either lnet_peer_merge_data() or lnet_peer_set_primary_data(). In these cases, we need to drop the reference on the ping buffer otherwise it will leak. HPE-bug-id: LUS-10715 Test-Parameters: trivial testlist=sanity-lnet Signed-off-by: Chris Horn Change-Id: I36ba0017caa9d6ce139f94090912496f14eda626 Reviewed-on: https://review.whamcloud.com/46431 Tested-by: jenkins Reviewed-by: Andriy Skulysh Tested-by: Maloo Reviewed-by: James Simmons Reviewed-by: Serguei Smirnov Reviewed-by: Cyril Bordage Reviewed-by: Oleg Drokin --- lnet/lnet/peer.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/lnet/lnet/peer.c b/lnet/lnet/peer.c index e32423f..ae71e25 100644 --- a/lnet/lnet/peer.c +++ b/lnet/lnet/peer.c @@ -3334,8 +3334,10 @@ __must_hold(&lp->lp_lock) * down, and our reference count may be all that is keeping it * alive. Don't do any work on it. */ - if (list_empty(&lp->lp_peer_list)) + if (list_empty(&lp->lp_peer_list)) { + lnet_ping_buffer_decref(pbuf); goto out; + } flags = LNET_PEER_DISCOVERED; if (pbuf->pb_info.pi_features & LNET_PING_FEAT_MULTI_RAIL) @@ -3362,7 +3364,9 @@ __must_hold(&lp->lp_lock) nid = pbuf->pb_info.pi_ni[1].ns_nid; if (nid_is_lo0(&lp->lp_primary_nid)) { rc = lnet_peer_set_primary_nid(lp, nid, flags); - if (!rc) + if (rc) + lnet_ping_buffer_decref(pbuf); + else rc = lnet_peer_merge_data(lp, pbuf); /* * if the primary nid of the peer is present in the ping info returned @@ -3385,6 +3389,7 @@ __must_hold(&lp->lp_lock) CERROR("Primary NID error %s versus %s: %d\n", libcfs_nidstr(&lp->lp_primary_nid), libcfs_nid2str(nid), rc); + lnet_ping_buffer_decref(pbuf); } else { rc = lnet_peer_merge_data(lp, pbuf); } -- 1.8.3.1