Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d63c4673 authored by Kamal Heib's avatar Kamal Heib Committed by Jason Gunthorpe
Browse files

RDMA/mlx5: Fix memory leak in mlx5_ib_create_srq() error path 



Fix memory leak in the error path of mlx5_ib_create_srq() by making sure
to free the allocated srq.

Fixes: c2b37f76 ("IB/mlx5: Fix integer overflows in mlx5_ib_create_srq")
Signed-off-by: default avatarKamal Heib <kamalheib1@gmail.com>
Acked-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
parent fe48aecb

drivers/infiniband/hw/mlx5/srq.c

+12 −6
Original line number Diff line number Diff line
@@ -266,18 +266,24 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd, 


	desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +

		    srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);

	if (desc_size == 0 || srq->msrq.max_gs > desc_size)

		return ERR_PTR(-EINVAL);

	if (desc_size == 0 || srq->msrq.max_gs > desc_size) {

		err = -EINVAL;

		goto err_srq;

	}

	desc_size = roundup_pow_of_two(desc_size);

	desc_size = max_t(size_t, 32, desc_size);

	if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg))

		return ERR_PTR(-EINVAL);

	if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) {

		err = -EINVAL;

		goto err_srq;

	}

	srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) /

		sizeof(struct mlx5_wqe_data_seg);

	srq->msrq.wqe_shift = ilog2(desc_size);

	buf_size = srq->msrq.max * desc_size;

	if (buf_size < desc_size)

		return ERR_PTR(-EINVAL);

	if (buf_size < desc_size) {

		err = -EINVAL;

		goto err_srq;

	}

	in.type = init_attr->srq_type;



	if (pd->uobject)