linux-kernel - [PATCH V2 for-next 15/19] IB/hns: Cq has not been freed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160920160712.1190216-16-salil.mehta@huawei.com>
Date:   Tue, 20 Sep 2016 17:07:08 +0100
From:   Salil Mehta <salil.mehta@...wei.com>
To:     <dledford@...hat.com>
CC:     <salil.mehta@...wei.com>, <xavier.huwei@...wei.com>,
        <oulijun@...wei.com>, <yisen.zhuang@...wei.com>,
        <mehta.salil.lnk@...il.com>, <xuwei5@...ilicon.com>,
        <linux-rdma@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
        <linuxarm@...wei.com>, Peter Chen <luck.chen@...wei.com>
Subject: [PATCH V2 for-next 15/19] IB/hns: Cq has not been freed

From: Lijun Ou <oulijun@...wei.com>

Cq has not been freed when fail to ib_copy_to_udata, so need to
free it.

Signed-off-by: Lijun Ou <oulijun@...wei.com>
Signed-off-by: Peter Chen <luck.chen@...wei.com>
Reviewed-by:  Wei Hu (Xavier) <xavier.huwei@...wei.com>
Signed-off-by: Salil Mehta <salil.mehta@...wei.com>
---
 drivers/infiniband/hw/hns/hns_roce_cq.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c
index 3095f06..0973659 100644
--- a/drivers/infiniband/hw/hns/hns_roce_cq.c
+++ b/drivers/infiniband/hw/hns/hns_roce_cq.c
@@ -357,12 +357,15 @@ struct ib_cq *hns_roce_ib_create_cq(struct ib_device *ib_dev,
 	if (context) {
 		if (ib_copy_to_udata(udata, &hr_cq->cqn, sizeof(u64))) {
 			ret = -EFAULT;
-			goto err_mtt;
+			goto err_cqc;
 		}
 	}
 
 	return &hr_cq->ib_cq;
 
+err_cqc:
+	hns_roce_free_cq(hr_dev, hr_cq);
+
 err_mtt:
 	hns_roce_mtt_cleanup(hr_dev, &hr_cq->hr_buf.hr_mtt);
 	if (context)
-- 
1.9.1