mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-04 16:15:11 +00:00
IB/rdmvat: Fix double vfree() in rvt_create_qp() error path
The unwind logic for creating a user QP has a double vfree of the non-shared receive queue when handling a "too many qps" failure. The code unwinds the mmmap info by decrementing a reference count which will call rvt_release_mmap_info() which in turn does the vfree() of the r_rq.wq. The unwind code then does the same free. Fix by guarding the vfree() with the same test that is done in close and only do the vfree() if qp->ip is NULL. Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
This commit is contained in:
parent
08fe16f619
commit
56c8ca510d
1 changed files with 2 additions and 1 deletions
|
@ -873,7 +873,8 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
|
|||
free_qpn(&rdi->qp_dev->qpn_table, qp->ibqp.qp_num);
|
||||
|
||||
bail_rq_wq:
|
||||
vfree(qp->r_rq.wq);
|
||||
if (!qp->ip)
|
||||
vfree(qp->r_rq.wq);
|
||||
|
||||
bail_driver_priv:
|
||||
rdi->driver_f.qp_priv_free(rdi, qp);
|
||||
|
|
Loading…
Reference in a new issue