Commit b7f9c112 authored Feb 19, 2008 by Roland Dreier

IB/mthca: Free correct MPT on error exit from mthca_fmr_alloc()

When mthca_fmr_alloc() returns an error, it should free the MPT at the
index key, not mr->ibmr.lkey, since the lkey has been mangled by
hw_index_to_key() and no longer is the real index. This bug causes
corruption of the MPT table free bitmap when mthca_fmr_alloc() fails.

Signed-off-by: Roland Dreier <rolandd@cisco.com>

parent ec229e5e

drivers/infiniband/hw/mthca/mthca_mr.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -686,7 +686,7 @@ int mthca_fmr_alloc(struct mthca_dev *dev, u32 pd,
		mthca_table_put(dev, dev->mr_table.mpt_table, key);

		err_out_mpt_free:
		mthca_free(&dev->mr_table.mpt_alloc, mr->ibmr.lkey);
		mthca_free(&dev->mr_table.mpt_alloc, key);
		return err;
		}