lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

IB/ipath: Fix memory leak in ipath_resize_cq() if copy_to_user() fails

Browse Source 
Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: Patrick Marchand Latifi <patrick.latifi@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
Ralph Campbell
2007-10-24 15:49:39 -07:00
committed by Roland Dreier
parent 3bba11e5c4
commit a6e7550d8f
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/infiniband/hw/ipath/ipath_cq.c
View File

@@ -404,7 +404,7 @@ int ipath_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
ret = ib_copy_to_udata(udata, &offset, sizeof(offset)); ret = ib_copy_to_udata(udata, &offset, sizeof(offset));
if (ret) if (ret)
goto bail; goto bail_free;
} }
spin_lock_irq(&cq->lock); spin_lock_irq(&cq->lock);
@@ -424,10 +424,8 @@ int ipath_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
else else
n = head - tail; n = head - tail;
if (unlikely((u32)cqe < n)) { if (unlikely((u32)cqe < n)) {
spin_unlock_irq(&cq->lock);
vfree(wc);
ret = -EOVERFLOW; ret = -EOVERFLOW;
goto bail; goto bail_unlock;
} }
for (n = 0; tail != head; n++) { for (n = 0; tail != head; n++) {
if (cq->ip) if (cq->ip)
@@ -459,7 +457,12 @@ int ipath_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
} }
ret = 0; ret = 0;
goto bail;
bail_unlock:
spin_unlock_irq(&cq->lock);
bail_free:
vfree(wc);
bail: bail:
return ret; return ret;
} }