[PATCH v2] IB/iwpm: fix memory leaks in error paths

From: Wentao Liang

Date: Mon Jun 22 2026 - 09:49:44 EST


In iwpm_register_pid(),iwpm_add_mapping() and
iwpm_add_and_query_mapping(), when the send operations fail,
the allocated message buffers are not freed before returning,
causing memory leaks.

Fix this by adding proper error handling with goto labels to
ensure kfree() is called on all error paths in both functions.
Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
drivers/infiniband/core/iwpm_msg.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/core/iwpm_msg.c b/drivers/infiniband/core/iwpm_msg.c
index 4625abd29ac0..bac3d1f321ab 100644
--- a/drivers/infiniband/core/iwpm_msg.c
+++ b/drivers/infiniband/core/iwpm_msg.c
@@ -122,7 +122,7 @@ int iwpm_register_pid(struct iwpm_dev_data *pm_msg, u8 nl_client)
pr_info("%s: %s (client = %u)\n", __func__, err_str, nl_client);
dev_kfree_skb(skb);
if (nlmsg_request)
- iwpm_free_nlmsg_request(&nlmsg_request->kref);
+ kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);
return ret;
}

@@ -207,7 +207,7 @@ int iwpm_add_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
add_mapping_error_nowarn:
dev_kfree_skb(skb);
if (nlmsg_request)
- iwpm_free_nlmsg_request(&nlmsg_request->kref);
+ kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);
return ret;
}

@@ -296,7 +296,7 @@ int iwpm_add_and_query_mapping(struct iwpm_sa_data *pm_msg, u8 nl_client)
query_mapping_error_nowarn:
dev_kfree_skb(skb);
if (nlmsg_request)
- iwpm_free_nlmsg_request(&nlmsg_request->kref);
+ kref_put(&nlmsg_request->kref, iwpm_free_nlmsg_request);
return ret;
}

--
2.39.5 (Apple Git-154)