[PATCH] RDMA/qedr: Release user memory on MR registration failure

[Wentao Liang]

qedr_reg_user_mr() acquires user memory before initializing the PBL and
allocating and registering a hardware TID. The error paths after that
acquisition release the MR storage and PBL resources, but skip
ib_umem_release(), leaving the user pages pinned and DMA mapped.

Release the umem at err1, which is reached after a successful acquisition.
The failure path of ib_umem_get_va() still jumps directly to err0 and
never passes its error pointer to ib_umem_release().

Fixes: e0290cce6ac0 ("qedr: Add support for memory registeration verbs")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/infiniband/hw/qedr/verbs.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index acab3cb98caa..3c777bfdef8f 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -3006,6 +3006,7 @@ struct ib_mr *qedr_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 len,
 err2:
 	dev->ops->rdma_free_tid(dev->rdma_ctx, mr->hw_mr.itid);
 err1:
+	ib_umem_release(mr->umem);
 	qedr_free_pbl(dev, &mr->info.pbl_info, mr->info.pbl_table);
 err0:
 	kfree(mr);
-- 
2.34.1