RDMA/qedr: Fix resource leak in qedr_create_qp

When xa_insert() fails, the acquired resource in qedr_create_qp should
also be freed. However, current implementation does not handle the error.

Fix this by adding a new goto label that calls qedr_free_qp_resources.

Fixes: 1212767e23bb ("qedr: Add wrapping generic structure for qpidr and adjust idr routines.")
Link: https://lore.kernel.org/r/20200911125159.4577-1-keitasuzuki.park@sslab.ics.keio.ac.jp
Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index ba86268..da42cc7 100644 (file)
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -2205,6 +2205,28 @@ static int qedr_create_kernel_qp(struct qedr_dev *dev,
        return rc;
 }
 
+static int qedr_free_qp_resources(struct qedr_dev *dev, struct qedr_qp *qp,
+                                 struct ib_udata *udata)
+{
+       struct qedr_ucontext *ctx =
+               rdma_udata_to_drv_context(udata, struct qedr_ucontext,
+                                         ibucontext);
+       int rc;
+
+       if (qp->qp_type != IB_QPT_GSI) {
+               rc = dev->ops->rdma_destroy_qp(dev->rdma_ctx, qp->qed_qp);
+               if (rc)
+                       return rc;
+       }
+
+       if (qp->create_type == QEDR_QP_CREATE_USER)
+               qedr_cleanup_user(dev, ctx, qp);
+       else
+               qedr_cleanup_kernel(dev, qp);
+
+       return 0;
+}
+
 struct ib_qp *qedr_create_qp(struct ib_pd *ibpd,
                             struct ib_qp_init_attr *attrs,
                             struct ib_udata *udata)
@@ -2260,19 +2282,21 @@ struct ib_qp *qedr_create_qp(struct ib_pd *ibpd,
                rc = qedr_create_kernel_qp(dev, qp, ibpd, attrs);
 
        if (rc)
-               goto err;
+               goto out_free_qp;
 
        qp->ibqp.qp_num = qp->qp_id;
 
        if (rdma_protocol_iwarp(&dev->ibdev, 1)) {
                rc = xa_insert(&dev->qps, qp->qp_id, qp, GFP_KERNEL);
                if (rc)
-                       goto err;
+                       goto out_free_qp_resources;
        }
 
        return &qp->ibqp;
 
-err:
+out_free_qp_resources:
+       qedr_free_qp_resources(dev, qp, udata);
+out_free_qp:
        kfree(qp);
 
        return ERR_PTR(-EFAULT);
@@ -2773,28 +2797,6 @@ err:
        return rc;
 }
 
-static int qedr_free_qp_resources(struct qedr_dev *dev, struct qedr_qp *qp,
-                                 struct ib_udata *udata)
-{
-       struct qedr_ucontext *ctx =
-               rdma_udata_to_drv_context(udata, struct qedr_ucontext,
-                                         ibucontext);
-       int rc;
-
-       if (qp->qp_type != IB_QPT_GSI) {
-               rc = dev->ops->rdma_destroy_qp(dev->rdma_ctx, qp->qed_qp);
-               if (rc)
-                       return rc;
-       }
-
-       if (qp->create_type == QEDR_QP_CREATE_USER)
-               qedr_cleanup_user(dev, ctx, qp);
-       else
-               qedr_cleanup_kernel(dev, qp);
-
-       return 0;
-}
-
 int qedr_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
 {
        struct qedr_qp *qp = get_qedr_qp(ibqp);