diff options
| author |   Sean Hefty <sean.hefty@intel.com> | 2007-07-31 15:10:54 -0700 |
|---|---|---|
| committer |   Roland Dreier <rolandd@cisco.com> | 2007-08-03 10:45:17 -0700 |
| commit | 38d5af9565f3fa1bf258f3eaeb47c4a95fd7a2b2 (patch) | |
| tree | d0a855f33a96fa9d28f4327d775f6e4c8bab8aad /drivers/infiniband/core/mad_rmpp.c | |
| parent | IB/mad: agent_send_response() should be void (diff) | |
| download | linux-dev-38d5af9565f3fa1bf258f3eaeb47c4a95fd7a2b2.tar.xz linux-dev-38d5af9565f3fa1bf258f3eaeb47c4a95fd7a2b2.zip | |
IB/mad: Fix address handle leak in mad_rmpp
The address handle associated with dual-sided RMPP direction switch
ACKs is never destroyed. Free the AH for ACKs which fall into this
category.
Problem was reported by Dotan Barak <dotanb@dev.mellanox.co.il>.
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/core/mad_rmpp.c')
| -rw-r--r-- | drivers/infiniband/core/mad_rmpp.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/infiniband/core/mad_rmpp.c b/drivers/infiniband/core/mad_rmpp.c index 3663fd7022be..d43bc62005b3 100644 --- a/drivers/infiniband/core/mad_rmpp.c +++ b/drivers/infiniband/core/mad_rmpp.c @@ -163,8 +163,10 @@ static struct ib_mad_send_buf *alloc_response_msg(struct ib_mad_agent *agent, hdr_len, 0, GFP_KERNEL); if (IS_ERR(msg)) ib_destroy_ah(ah); - else + else { msg->ah = ah; + msg->context[0] = ah; + } return msg; } @@ -197,9 +199,7 @@ static void ack_ds_ack(struct ib_mad_agent_private *agent, void ib_rmpp_send_handler(struct ib_mad_send_wc *mad_send_wc) { - struct ib_rmpp_mad *rmpp_mad = mad_send_wc->send_buf->mad; - - if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_ACK) + if (mad_send_wc->send_buf->context[0] == mad_send_wc->send_buf->ah) ib_destroy_ah(mad_send_wc->send_buf->ah); ib_free_send_mad(mad_send_wc->send_buf); } |