aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/infiniband/core/uverbs_std_types_mr.c
diff options
context:
space:
mode:
authorJason Gunthorpe <jgg@mellanox.com>2019-05-21 17:55:22 +0000
committerJason Gunthorpe <jgg@mellanox.com>2019-05-27 14:35:26 -0300
commit6875cb175ca7e0c24aa4460ac2b3257fdf662832 (patch)
tree31a4c1aa8de14bd4aa0c4dacb0aa51feb4a8471d /drivers/infiniband/core/uverbs_std_types_mr.c
parentRDMA/hns: Fix PD memory leak for internal allocation (diff)
downloadlinux-dev-6875cb175ca7e0c24aa4460ac2b3257fdf662832.tar.xz
linux-dev-6875cb175ca7e0c24aa4460ac2b3257fdf662832.zip
RDMA/core: Clear out the udata before error unwind
The core code should not pass a udata to the driver destroy function that contains the input from the create command. Otherwise the driver will attempt to interpret the create udata as destroy udata, and at least in the case of EFA, will leak resources. Zero this stuff out before invoking destroy. Reported-by: Leon Romanovsky <leonro@mellanox.com> Fixes: c4367a26357b ("IB: Pass uverbs_attr_bundle down ib_x destroy path") Reviewed-by: Gal Pressman <galpress@amazon.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/core/uverbs_std_types_mr.c')
-rw-r--r--drivers/infiniband/core/uverbs_std_types_mr.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/core/uverbs_std_types_mr.c b/drivers/infiniband/core/uverbs_std_types_mr.c
index 610d3b9f7654..997f7a3a558a 100644
--- a/drivers/infiniband/core/uverbs_std_types_mr.c
+++ b/drivers/infiniband/core/uverbs_std_types_mr.c
@@ -148,7 +148,7 @@ static int UVERBS_HANDLER(UVERBS_METHOD_DM_MR_REG)(
return 0;
err_dereg:
- ib_dereg_mr_user(mr, &attrs->driver_udata);
+ ib_dereg_mr_user(mr, uverbs_get_cleared_udata(attrs));
return ret;
}