redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

IB/mlx4: Fix error path in create_qp_common() 

The error handling code at err_wrid in create_qp_common() does not
handle a userspace QP attached to an SRQ correctly, since it ends up
in the else clause of the if statement.  This means it tries to
kfree() the uninitialized qp->sq.wrid and qp->rq.wrid pointers.  Fix
this so we only free the wrid arrays for kernel QPs.

Pointed out by Michael S. Tsirkin <mst@dev.mellanox.co.il>.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
hifive-unleashed-5.1
Roland Dreier 2007-07-20 21:19:43 -07:00
parent 0981582dbf
commit 23f1b38481
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/infiniband/hw/mlx4/qp.c
View File

@ -415,9 +415,11 @@ static int create_qp_common(struct mlx4_ib_dev *dev, struct ib_pd *pd,
return 0;
err_wrid:
if (pd->uobject && !init_attr->srq)
mlx4_ib_db_unmap_user(to_mucontext(pd->uobject->context), &qp->db);
else {
if (pd->uobject) {
if (!init_attr->srq)
mlx4_ib_db_unmap_user(to_mucontext(pd->uobject->context),
&qp->db);
} else {
kfree(qp->sq.wrid);
kfree(qp->rq.wrid);
}