IB/rxe: avoid srq memory leak

In rxe_queue_init, q and q->buf are allocated. In do_mmap_info, q->ip is
allocated. When error occurs, rxe_srq_from_init and the later error
handler do not free these allocated memories.  This will make memory leak.

Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>

diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c
index 0d6c04b..c41a5fe 100644 (file)
--- a/drivers/infiniband/sw/rxe/rxe_srq.c
+++ b/drivers/infiniband/sw/rxe/rxe_srq.c
@@ -31,6 +31,7 @@
  * SOFTWARE.
  */
 
+#include <linux/vmalloc.h>
 #include "rxe.h"
 #include "rxe_loc.h"
 #include "rxe_queue.h"
@@ -129,13 +130,18 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq,
 
        err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, context, q->buf,
                           q->buf_size, &q->ip);
-       if (err)
+       if (err) {
+               vfree(q->buf);
+               kfree(q);
                return err;
+       }
 
        if (uresp) {
                if (copy_to_user(&uresp->srq_num, &srq->srq_num,
-                                sizeof(uresp->srq_num)))
+                                sizeof(uresp->srq_num))) {
+                       rxe_queue_cleanup(q);
                        return -EFAULT;
+               }
        }
 
        return 0;