diff options
| author |   Wei Yongjun <weiyongjun1@huawei.com> | 2016-10-28 16:33:47 +0000 |
|---|---|---|
| committer |   Doug Ledford <dledford@redhat.com> | 2016-12-14 11:18:17 -0500 |
| commit | 181d80151f9c6ff3c765c1bd2e4e200ada23c2f3 (patch) | |
| tree | f7143a7025ec0a67bb7d5cf856b2e8f39fb93e3a /drivers/infiniband/hw | |
| parent | qedr: return -EINVAL if pd is null and avoid null ptr dereference (diff) | |
| download | wireguard-linux-181d80151f9c6ff3c765c1bd2e4e200ada23c2f3.tar.xz wireguard-linux-181d80151f9c6ff3c765c1bd2e4e200ada23c2f3.zip | |
qedr: Fix possible memory leak in qedr_create_qp()
'qp' is malloced in qedr_create_qp() and should be freed before leaving
from the error handling cases, otherwise it will cause memory leak.
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Acked-by: Ram Amrani <Ram.Amrani@cavium.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband/hw')
| -rw-r--r-- | drivers/infiniband/hw/qedr/verbs.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c index b2a0eb8f73d2..8c6c5ccaf57a 100644 --- a/drivers/infiniband/hw/qedr/verbs.c +++ b/drivers/infiniband/hw/qedr/verbs.c @@ -1479,6 +1479,7 @@ struct ib_qp *qedr_create_qp(struct ib_pd *ibpd, struct qedr_ucontext *ctx = NULL; struct qedr_create_qp_ureq ureq; struct qedr_qp *qp; + struct ib_qp *ibqp; int rc = 0; DP_DEBUG(dev, QEDR_MSG_QP, "create qp: called from %s, pd=%p\n", @@ -1488,13 +1489,13 @@ struct ib_qp *qedr_create_qp(struct ib_pd *ibpd, if (rc) return ERR_PTR(rc); + if (attrs->srq) + return ERR_PTR(-EINVAL); + qp = kzalloc(sizeof(*qp), GFP_KERNEL); if (!qp) return ERR_PTR(-ENOMEM); - if (attrs->srq) - return ERR_PTR(-EINVAL); - DP_DEBUG(dev, QEDR_MSG_QP, "create qp: sq_cq=%p, sq_icid=%d, rq_cq=%p, rq_icid=%d\n", get_qedr_cq(attrs->send_cq), @@ -1510,7 +1511,10 @@ struct ib_qp *qedr_create_qp(struct ib_pd *ibpd, "create qp: unexpected udata when creating GSI QP\n"); goto err0; } - return qedr_create_gsi_qp(dev, attrs, qp); + ibqp = qedr_create_gsi_qp(dev, attrs, qp); + if (IS_ERR(ibqp)) + kfree(qp); + return ibqp; } memset(&in_params, 0, sizeof(in_params)); |