[PATCH] RDMA/ocrdma: Release user memory when MR registration fails

[Wentao Liang]

ocrdma_reg_user_mr() pins and maps user memory before preparing its page
buffer list and registering the MR. If any subsequent step fails, the
error paths free the MR and any allocated PBL tables, but never release
the user memory. The pages remain pinned and DMA mapped, and the locked
memory accounting is not restored.

Release the umem on these failures. Use a separate label for failure of
ib_umem_get_va() itself so its error pointer is never passed to the
release function.

Fixes: fe2caefcdf58 ("RDMA/ocrdma: Add driver for Emulex OneConnect IBoE RDMA adapter")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 97c2e18e67ad..94a61127fb39 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -868,7 +868,7 @@ struct ib_mr *ocrdma_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 len,
 	mr->umem = ib_umem_get_va(ibpd->device, start, len, acc);
 	if (IS_ERR(mr->umem)) {
 		status = -EFAULT;
-		goto umem_err;
+		goto err_free_mr;
 	}
 	status = ocrdma_get_pbl_info(
 		dev, mr, ib_umem_num_dma_blocks(mr->umem, PAGE_SIZE));
@@ -899,6 +899,8 @@ struct ib_mr *ocrdma_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 len,
 mbx_err:
 	ocrdma_free_mr_pbl_tbl(dev, &mr->hwmr);
 umem_err:
+	ib_umem_release(mr->umem);
+err_free_mr:
 	kfree(mr);
 	return ERR_PTR(status);
 }
-- 
2.34.1