Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b4ca1a3f authored by Jack Morgenstein's avatar Jack Morgenstein Committed by Roland Dreier
Browse files

IB/uverbs: Fix reference counting on error paths 



If an operation fails after incrementing an object's reference count,
then it should decrement the reference count on the error path.

Signed-off-by: default avatarJack Morgenstein <jackm@mellanox.co.il>
Signed-off-by: default avatarMichael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 4de144bf

drivers/infiniband/core/uverbs_cmd.c

+7 −0
Original line number Diff line number Diff line
@@ -489,6 +489,7 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file, 


err_unreg:

	ib_dereg_mr(mr);

	atomic_dec(&pd->usecnt);



err_up:

	up(&ib_uverbs_idr_mutex);
@@ -935,6 +936,11 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file, 


err_destroy:

	ib_destroy_qp(qp);

	atomic_dec(&pd->usecnt);

	atomic_dec(&attr.send_cq->usecnt);

	atomic_dec(&attr.recv_cq->usecnt);

	if (attr.srq)

		atomic_dec(&attr.srq->usecnt);



err_up:

	up(&ib_uverbs_idr_mutex);
@@ -1729,6 +1735,7 @@ ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file, 


err_destroy:

	ib_destroy_srq(srq);

	atomic_dec(&pd->usecnt);



err_up:

	up(&ib_uverbs_idr_mutex);