diff options
| author | Roland Dreier <rolandd@cisco.com> | 2007-07-21 06:19:43 +0200 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2007-07-21 06:19:43 +0200 |
| commit | 23f1b38481596ad77e5f51562977b12c8418eee3 (patch) | |
| tree | 7df6cea98a135f5a85657f0dde882410cdfd5d7e | |
| parent | mlx4_core: Change command token on timeout (diff) | |
| download | linux-23f1b38481596ad77e5f51562977b12c8418eee3.tar.xz linux-23f1b38481596ad77e5f51562977b12c8418eee3.zip | |
IB/mlx4: Fix error path in create_qp_common()
The error handling code at err_wrid in create_qp_common() does not
handle a userspace QP attached to an SRQ correctly, since it ends up
in the else clause of the if statement. This means it tries to
kfree() the uninitialized qp->sq.wrid and qp->rq.wrid pointers. Fix
this so we only free the wrid arrays for kernel QPs.
Pointed out by Michael S. Tsirkin <mst@dev.mellanox.co.il>.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
| -rw-r--r-- | drivers/infiniband/hw/mlx4/qp.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c index 5456bc4aff7c..f6315dfb213e 100644 --- a/drivers/infiniband/hw/mlx4/qp.c +++ b/drivers/infiniband/hw/mlx4/qp.c @@ -415,9 +415,11 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd, return 0; err_wrid: - if (pd->uobject && !init_attr->srq) - mlx4_ib_db_unmap_user(to_mucontext(pd->uobject->context), &qp->db); - else { + if (pd->uobject) { + if (!init_attr->srq) + mlx4_ib_db_unmap_user(to_mucontext(pd->uobject->context), + &qp->db); + } else { kfree(qp->sq.wrid); kfree(qp->rq.wrid); } |