| Message ID | 20180710085650.24720-1-kamalheib1@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Jason Gunthorpe |
| Headers | show |
On Tue, Jul 10, 2018 at 11:56:50AM +0300, Kamal Heib wrote: > Fix memory leak in the error path of mlx5_ib_create_srq() by make sure > to free the allocated srq. > > Fixes: c2b37f76485f ('IB/mlx5: Fix integer overflows in mlx5_ib_create_srq') > Signed-off-by: Kamal Heib <kamalheib1@gmail.com> > --- > drivers/infiniband/hw/mlx5/srq.c | 18 ++++++++++++------ > 1 file changed, 12 insertions(+), 6 deletions(-) > Thanks Kamal, Acked-by: Leon Romanovsky <leonro@mellanox.com>
On Tue, Jul 10, 2018 at 11:56:50AM +0300, Kamal Heib wrote: > Fix memory leak in the error path of mlx5_ib_create_srq() by make sure > to free the allocated srq. > > Fixes: c2b37f76485f ('IB/mlx5: Fix integer overflows in mlx5_ib_create_srq') > Signed-off-by: Kamal Heib <kamalheib1@gmail.com> > Acked-by: Leon Romanovsky <leonro@mellanox.com> > --- > drivers/infiniband/hw/mlx5/srq.c | 18 ++++++++++++------ > 1 file changed, 12 insertions(+), 6 deletions(-) Applied to for-next, thanks Jason -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c index 0af7b7905550..f5de5adc9b1a 100644 --- a/drivers/infiniband/hw/mlx5/srq.c +++ b/drivers/infiniband/hw/mlx5/srq.c @@ -266,18 +266,24 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd, desc_size = sizeof(struct mlx5_wqe_srq_next_seg) + srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg); - if (desc_size == 0 || srq->msrq.max_gs > desc_size) - return ERR_PTR(-EINVAL); + if (desc_size == 0 || srq->msrq.max_gs > desc_size) { + err = -EINVAL; + goto err_srq; + } desc_size = roundup_pow_of_two(desc_size); desc_size = max_t(size_t, 32, desc_size); - if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) - return ERR_PTR(-EINVAL); + if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) { + err = -EINVAL; + goto err_srq; + } srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) / sizeof(struct mlx5_wqe_data_seg); srq->msrq.wqe_shift = ilog2(desc_size); buf_size = srq->msrq.max * desc_size; - if (buf_size < desc_size) - return ERR_PTR(-EINVAL); + if (buf_size < desc_size) { + err = -EINVAL; + goto err_srq; + } in.type = init_attr->srq_type; if (pd->uobject)
Fix memory leak in the error path of mlx5_ib_create_srq() by make sure to free the allocated srq. Fixes: c2b37f76485f ('IB/mlx5: Fix integer overflows in mlx5_ib_create_srq') Signed-off-by: Kamal Heib <kamalheib1@gmail.com> --- drivers/infiniband/hw/mlx5/srq.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)