Re: [Qemu-devel] [PATCH v2] hw: pvrdma: fix memory leak in error path

[Yuval Shaia]

On Tue, Jan 08, 2019 at 07:02:28AM -0800, Li Qiang wrote:
> Currently, pvrdma_qp_send() function leak the 'comp_ctx',
> Since 'comp_ctx' is used after the two checks, just relocate
> the allocation & initialization after the two check.
> 
> Spotted by Coverity: CID 1398595
> 
> Fixes: 2b05705dc8
> Signed-off-by: Li Qiang 
> ---
>  hw/rdma/vmw/pvrdma_qp_ops.c | 16 
>  1 file changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/hw/rdma/vmw/pvrdma_qp_ops.c b/hw/rdma/vmw/pvrdma_qp_ops.c
> index 300471a4c9..471bdbaaa0 100644
> --- a/hw/rdma/vmw/pvrdma_qp_ops.c
> +++ b/hw/rdma/vmw/pvrdma_qp_ops.c
> @@ -157,14 +157,6 @@ int pvrdma_qp_send(PVRDMADev *dev, uint32_t qp_handle)
>  
>  pr_dbg("wr_id=%" PRIx64 "\n", wqe->hdr.wr_id);
>  
> -/* Prepare CQE */
> -comp_ctx = g_malloc(sizeof(CompHandlerCtx));
> -comp_ctx->dev = dev;
> -comp_ctx->cq_handle = qp->send_cq_handle;
> -comp_ctx->cqe.wr_id = wqe->hdr.wr_id;
> -comp_ctx->cqe.qp = qp_handle;
> -comp_ctx->cqe.opcode = IBV_WC_SEND;
> -
>  sgid = rdma_rm_get_gid(>rdma_dev_res, 
> wqe->hdr.wr.ud.av.gid_index);
>  if (!sgid) {
>  pr_dbg("Fail to get gid for idx %d\n", 
> wqe->hdr.wr.ud.av.gid_index);
> @@ -182,6 +174,14 @@ int pvrdma_qp_send(PVRDMADev *dev, uint32_t qp_handle)
>  return -EIO;
>  }
>  
> +/* Prepare CQE */
> +comp_ctx = g_malloc(sizeof(CompHandlerCtx));
> +comp_ctx->dev = dev;
> +comp_ctx->cq_handle = qp->send_cq_handle;
> +comp_ctx->cqe.wr_id = wqe->hdr.wr_id;
> +comp_ctx->cqe.qp = qp_handle;
> +comp_ctx->cqe.opcode = IBV_WC_SEND;
> +

This fix lgtm,
Thanks.

Reviewed-by: Yuval Shaia 

>  rdma_backend_post_send(>backend_dev, >backend_qp, 
> qp->qp_type,
> (struct ibv_sge *)>sge[0], 
> wqe->hdr.num_sge,
> sgid_idx, sgid,
> -- 
> 2.17.1
> 
> 
> 

Re: [Qemu-devel] [PATCH v2] hw: pvrdma: fix memory leak in error path

[Philippe Mathieu-Daudé]

On 1/8/19 4:02 PM, Li Qiang wrote:
> Currently, pvrdma_qp_send() function leak the 'comp_ctx',
> Since 'comp_ctx' is used after the two checks, just relocate
> the allocation & initialization after the two check.
> 
> Spotted by Coverity: CID 1398595
> 
> Fixes: 2b05705dc8

Suggested-by: Yuval Shaia 

> Signed-off-by: Li Qiang 

Reviewed-by: Philippe Mathieu-Daudé 

> ---
>  hw/rdma/vmw/pvrdma_qp_ops.c | 16 
>  1 file changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/hw/rdma/vmw/pvrdma_qp_ops.c b/hw/rdma/vmw/pvrdma_qp_ops.c
> index 300471a4c9..471bdbaaa0 100644
> --- a/hw/rdma/vmw/pvrdma_qp_ops.c
> +++ b/hw/rdma/vmw/pvrdma_qp_ops.c
> @@ -157,14 +157,6 @@ int pvrdma_qp_send(PVRDMADev *dev, uint32_t qp_handle)
>  
>  pr_dbg("wr_id=%" PRIx64 "\n", wqe->hdr.wr_id);
>  
> -/* Prepare CQE */
> -comp_ctx = g_malloc(sizeof(CompHandlerCtx));
> -comp_ctx->dev = dev;
> -comp_ctx->cq_handle = qp->send_cq_handle;
> -comp_ctx->cqe.wr_id = wqe->hdr.wr_id;
> -comp_ctx->cqe.qp = qp_handle;
> -comp_ctx->cqe.opcode = IBV_WC_SEND;
> -
>  sgid = rdma_rm_get_gid(>rdma_dev_res, 
> wqe->hdr.wr.ud.av.gid_index);
>  if (!sgid) {
>  pr_dbg("Fail to get gid for idx %d\n", 
> wqe->hdr.wr.ud.av.gid_index);
> @@ -182,6 +174,14 @@ int pvrdma_qp_send(PVRDMADev *dev, uint32_t qp_handle)
>  return -EIO;
>  }
>  
> +/* Prepare CQE */
> +comp_ctx = g_malloc(sizeof(CompHandlerCtx));
> +comp_ctx->dev = dev;
> +comp_ctx->cq_handle = qp->send_cq_handle;
> +comp_ctx->cqe.wr_id = wqe->hdr.wr_id;
> +comp_ctx->cqe.qp = qp_handle;
> +comp_ctx->cqe.opcode = IBV_WC_SEND;
> +
>  rdma_backend_post_send(>backend_dev, >backend_qp, 
> qp->qp_type,
> (struct ibv_sge *)>sge[0], 
> wqe->hdr.num_sge,
> sgid_idx, sgid,
> 

[Qemu-devel] [PATCH v2] hw: pvrdma: fix memory leak in error path

[Li Qiang]

Currently, pvrdma_qp_send() function leak the 'comp_ctx',
Since 'comp_ctx' is used after the two checks, just relocate
the allocation & initialization after the two check.

Spotted by Coverity: CID 1398595

Fixes: 2b05705dc8
Signed-off-by: Li Qiang 
---
 hw/rdma/vmw/pvrdma_qp_ops.c | 16 
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/hw/rdma/vmw/pvrdma_qp_ops.c b/hw/rdma/vmw/pvrdma_qp_ops.c
index 300471a4c9..471bdbaaa0 100644
--- a/hw/rdma/vmw/pvrdma_qp_ops.c
+++ b/hw/rdma/vmw/pvrdma_qp_ops.c
@@ -157,14 +157,6 @@ int pvrdma_qp_send(PVRDMADev *dev, uint32_t qp_handle)
 
 pr_dbg("wr_id=%" PRIx64 "\n", wqe->hdr.wr_id);
 
-/* Prepare CQE */
-comp_ctx = g_malloc(sizeof(CompHandlerCtx));
-comp_ctx->dev = dev;
-comp_ctx->cq_handle = qp->send_cq_handle;
-comp_ctx->cqe.wr_id = wqe->hdr.wr_id;
-comp_ctx->cqe.qp = qp_handle;
-comp_ctx->cqe.opcode = IBV_WC_SEND;
-
 sgid = rdma_rm_get_gid(>rdma_dev_res, 
wqe->hdr.wr.ud.av.gid_index);
 if (!sgid) {
 pr_dbg("Fail to get gid for idx %d\n", 
wqe->hdr.wr.ud.av.gid_index);
@@ -182,6 +174,14 @@ int pvrdma_qp_send(PVRDMADev *dev, uint32_t qp_handle)
 return -EIO;
 }
 
+/* Prepare CQE */
+comp_ctx = g_malloc(sizeof(CompHandlerCtx));
+comp_ctx->dev = dev;
+comp_ctx->cq_handle = qp->send_cq_handle;
+comp_ctx->cqe.wr_id = wqe->hdr.wr_id;
+comp_ctx->cqe.qp = qp_handle;
+comp_ctx->cqe.opcode = IBV_WC_SEND;
+
 rdma_backend_post_send(>backend_dev, >backend_qp, qp->qp_type,
(struct ibv_sge *)>sge[0], 
wqe->hdr.num_sge,
sgid_idx, sgid,
-- 
2.17.1