linux/drivers/infiniband/sw
Mike Marciniszyn 56c8ca510d IB/rdmvat: Fix double vfree() in rvt_create_qp() error path
The unwind logic for creating a user QP has a double vfree
of the non-shared receive queue when handling a "too many qps"
failure.

The code unwinds the mmmap info by decrementing a reference
count which will call rvt_release_mmap_info() which in turn
does the vfree() of the r_rq.wq.  The unwind code then does
the same free.

Fix by guarding the vfree() with the same test that is done
in close and only do the vfree() if qp->ip is NULL.

Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-08-22 15:00:42 -04:00
..
rdmavt IB/rdmvat: Fix double vfree() in rvt_create_qp() error path 2016-08-22 15:00:42 -04:00
rxe Soft RoCE driver 2016-08-04 11:13:12 -04:00
Makefile Soft RoCE driver 2016-08-04 11:13:12 -04:00