Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 38d5af95 authored by Sean Hefty's avatar Sean Hefty Committed by Roland Dreier
Browse files

IB/mad: Fix address handle leak in mad_rmpp 



The address handle associated with dual-sided RMPP direction switch
ACKs is never destroyed.  Free the AH for ACKs which fall into this
category.

Problem was reported by Dotan Barak <dotanb@dev.mellanox.co.il>.

Signed-off-by: default avatarSean Hefty <sean.hefty@intel.com>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 8fc394b1

drivers/infiniband/core/mad_rmpp.c

+4 −4
Original line number Diff line number Diff line
@@ -163,8 +163,10 @@ static struct ib_mad_send_buf *alloc_response_msg(struct ib_mad_agent *agent, 
				 hdr_len, 0, GFP_KERNEL);

	if (IS_ERR(msg))

		ib_destroy_ah(ah);

	else

	else {

		msg->ah = ah;

		msg->context[0] = ah;

	}



	return msg;

}
@@ -197,9 +199,7 @@ static void ack_ds_ack(struct ib_mad_agent_private *agent, 


void ib_rmpp_send_handler(struct ib_mad_send_wc *mad_send_wc)

{

	struct ib_rmpp_mad *rmpp_mad = mad_send_wc->send_buf->mad;



	if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_ACK)

	if (mad_send_wc->send_buf->context[0] == mad_send_wc->send_buf->ah)

		ib_destroy_ah(mad_send_wc->send_buf->ah);

	ib_free_send_mad(mad_send_wc->send_buf);

}