qedr_init_user_queue() pins user memory and allocates its PBL before initializing the doorbell recovery record. If the last step fails, it returns directly without releasing either resource. The CQ and QP creation callers treat this as a failed queue initialization and do not release that queue, leaving its user pages pinned and PBL storage leaked. Free the PBL on doorbell recovery setup failure, then use the existing umem cleanup. Match the PBL allocation mode: RoCE uses the populated PBL allocator, while the other path allocates only the table descriptor. Clear the freed pointer as well. Fixes: 97f612509294 ("RDMA/qedr: Add doorbell overflow recovery support") Cc: stable@vger.kernel.org Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex Signed-off-by: Wentao Liang --- drivers/infiniband/hw/qedr/verbs.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c index 3c777bfdef8f..f7a4b2bd7398 100644 --- a/drivers/infiniband/hw/qedr/verbs.c +++ b/drivers/infiniband/hw/qedr/verbs.c @@ -818,7 +818,15 @@ static inline int qedr_init_user_queue(struct ib_udata *udata, } /* mmap the user address used to store doorbell data for recovery */ - return qedr_init_user_db_rec(udata, dev, q, requires_db_rec); + rc = qedr_init_user_db_rec(udata, dev, q, requires_db_rec); + if (!rc) + return 0; + + if (alloc_and_init) + qedr_free_pbl(dev, &q->pbl_info, q->pbl_tbl); + else + kfree(q->pbl_tbl); + q->pbl_tbl = NULL; err0: ib_umem_release(q->umem); -- 2.34.1