diff options
| author |   Ralph Campbell <ralph.campbell@qlogic.com> | 2007-10-24 15:49:39 -0700 |
|---|---|---|
| committer |   Roland Dreier <rolandd@cisco.com> | 2007-11-13 15:26:57 -0800 |
| commit | a6e7550d8f73d6b75c20afff321f0f06fe144775 (patch) | |
| tree | 418033c4e3dd2c35b5d52e8cc7b0de6715f619a4 /drivers/infiniband/hw/ipath | |
| parent | mlx4_core: Fix possible bad free in mlx4_buf_free() (diff) | |
| download | linux-dev-a6e7550d8f73d6b75c20afff321f0f06fe144775.tar.xz linux-dev-a6e7550d8f73d6b75c20afff321f0f06fe144775.zip | |
IB/ipath: Fix memory leak in ipath_resize_cq() if copy_to_user() fails
Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: Patrick Marchand Latifi <patrick.latifi@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/hw/ipath')
| -rw-r--r-- | drivers/infiniband/hw/ipath/ipath_cq.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/infiniband/hw/ipath/ipath_cq.c b/drivers/infiniband/hw/ipath/ipath_cq.c index 645ed71fd797..08d8ae148cd0 100644 --- a/drivers/infiniband/hw/ipath/ipath_cq.c +++ b/drivers/infiniband/hw/ipath/ipath_cq.c @@ -404,7 +404,7 @@ int ipath_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata) ret = ib_copy_to_udata(udata, &offset, sizeof(offset)); if (ret) - goto bail; + goto bail_free; } spin_lock_irq(&cq->lock); @@ -424,10 +424,8 @@ int ipath_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata) else n = head - tail; if (unlikely((u32)cqe < n)) { - spin_unlock_irq(&cq->lock); - vfree(wc); ret = -EOVERFLOW; - goto bail; + goto bail_unlock; } for (n = 0; tail != head; n++) { if (cq->ip) @@ -459,7 +457,12 @@ int ipath_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata) } ret = 0; + goto bail; +bail_unlock: + spin_unlock_irq(&cq->lock); +bail_free: + vfree(wc); bail: return ret; } |