In `UVERBS_METHOD_CQ_CREATE`, umem should be released if anything goes
wrong. Currently, if `create_cq_umem` fails, umem would not be
released or referenced, causing a possible leak.

In this patch, we release umem at `UVERBS_METHOD_CQ_CREATE`, the driver
should not release umem if it returns an error code.

Fixes: 1a40c362ae26 ("RDMA/uverbs: Add a common way to create CQ with umem")
Signed-off-by: Shuhao Fu <sfual@cse.ust.hk>
---
Change to v1: [1]
- do not let driver free umem

[1] https://lore.kernel.org/linux-rdma/aOflenF0XHtm80G9@homelab/
---
 drivers/infiniband/core/uverbs_std_types_cq.c |  4 +++-
 drivers/infiniband/hw/efa/efa_verbs.c         | 12 +++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_std_types_cq.c b/drivers/infiniband/core/uverbs_std_types_cq.c
index 37cd37556..9344020de 100644
--- a/drivers/infiniband/core/uverbs_std_types_cq.c
+++ b/drivers/infiniband/core/uverbs_std_types_cq.c
@@ -193,8 +193,10 @@ static int UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE)(
 
 	ret = umem ? ib_dev->ops.create_cq_umem(cq, &attr, umem, attrs) :
 		ib_dev->ops.create_cq(cq, &attr, attrs);
-	if (ret)
+	if (ret) {
+		ib_umem_release(umem);
 		goto err_free;
+	}
 
 	obj->uevent.uobject.object = cq;
 	obj->uevent.uobject.user_handle = user_handle;
diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
index d9a12681f..89c58aedf 100644
--- a/drivers/infiniband/hw/efa/efa_verbs.c
+++ b/drivers/infiniband/hw/efa/efa_verbs.c
@@ -1216,13 +1216,13 @@ int efa_create_cq_umem(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 		if (umem->length < cq->size) {
 			ibdev_dbg(&dev->ibdev, "External memory too small\n");
 			err = -EINVAL;
-			goto err_free_mem;
+			goto err_out;
 		}
 
 		if (!ib_umem_is_contiguous(umem)) {
 			ibdev_dbg(&dev->ibdev, "Non contiguous CQ unsupported\n");
 			err = -EINVAL;
-			goto err_free_mem;
+			goto err_out;
 		}
 
 		cq->cpu_addr = NULL;
@@ -1251,7 +1251,7 @@ int efa_create_cq_umem(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 
 	err = efa_com_create_cq(&dev->edev, &params, &result);
 	if (err)
-		goto err_free_mem;
+		goto err_free_mapped;
 
 	resp.db_off = result.db_off;
 	resp.cq_idx = result.cq_idx;
@@ -1299,10 +1299,8 @@ int efa_create_cq_umem(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
 	efa_cq_user_mmap_entries_remove(cq);
 err_destroy_cq:
 	efa_destroy_cq_idx(dev, cq->cq_idx);
-err_free_mem:
-	if (umem)
-		ib_umem_release(umem);
-	else
+err_free_mapped:
+	if (!umem)
 		efa_free_mapped(dev, cq->cpu_addr, cq->dma_addr, cq->size, DMA_FROM_DEVICE);
 
 err_out:
-- 
2.39.5 (Apple Git-154)

On Fri, 10 Oct 2025 10:55:17 +0800, Shuhao Fu wrote:
> In `UVERBS_METHOD_CQ_CREATE`, umem should be released if anything goes
> wrong. Currently, if `create_cq_umem` fails, umem would not be
> released or referenced, causing a possible leak.
> 
> In this patch, we release umem at `UVERBS_METHOD_CQ_CREATE`, the driver
> should not release umem if it returns an error code.
> 
> [...]

Applied, thanks!

[1/1] RDMA/uverbs: fix umem release in UVERBS_METHOD_CQ_CREATE
      https://git.kernel.org/rdma/rdma/c/d8713158faad0f

Best regards,
-- 
Leon Romanovsky <leon@kernel.org>