Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac4e7b35 authored by Jack Morgenstein's avatar Jack Morgenstein Committed by Roland Dreier
Browse files

IB/uverbs: Release event file reference on ib_uverbs_create_cq() error 



ib_uverbs_create_cq() should release the completion channel event file
if an error occurs after it looks it up.  Also, if userspace asks for
a completion channel and we don't find it, an error should be returned
instead of silently creating a CQ without a completion channel.

Signed-off-by: default avatarJack Morgenstein <jackm@mellanox.co.il>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent ea5d4a6a

drivers/infiniband/core/uverbs_cmd.c

+10 −3
Original line number Diff line number Diff line
@@ -594,13 +594,18 @@ ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file, 
	if (cmd.comp_vector >= file->device->num_comp_vectors)

		return -EINVAL;



	if (cmd.comp_channel >= 0)

		ev_file = ib_uverbs_lookup_comp_file(cmd.comp_channel);



	uobj = kmalloc(sizeof *uobj, GFP_KERNEL);

	if (!uobj)

		return -ENOMEM;



	if (cmd.comp_channel >= 0) {

		ev_file = ib_uverbs_lookup_comp_file(cmd.comp_channel);

		if (!ev_file) {

			ret = -EINVAL;

			goto err;

		}

	}



	uobj->uobject.user_handle   = cmd.user_handle;

	uobj->uobject.context       = file->ucontext;

	uobj->uverbs_file	    = file;
@@ -664,6 +669,8 @@ ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file, 
	ib_destroy_cq(cq);



err:

	if (ev_file)

		ib_uverbs_release_ucq(file, ev_file, uobj);

	kfree(uobj);

	return ret;

}