Commit 117942ca authored by Jason Gunthorpe's avatar Jason Gunthorpe Committed by Leon Romanovsky
Browse files

IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() 



Fix a user triggerable leak on the system call failure path.

Cc: stable@vger.kernel.org
Fixes: ec34a922 ("[PATCH] IB/mthca: Add SRQ implementation")
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Link: https://patch.msgid.link/2-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com


Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
parent f22c77ce

drivers/infiniband/hw/mthca/mthca_provider.c

+3 −2
Original line number Diff line number Diff line
@@ -428,6 +428,8 @@ static int mthca_create_srq(struct ib_srq *ibsrq, 


	if (context && ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {

		mthca_free_srq(to_mdev(ibsrq->device), srq);

		mthca_unmap_user_db(to_mdev(ibsrq->device), &context->uar,

				    context->db_tab, ucmd.db_index);

		return -EFAULT;

	}
@@ -436,6 +438,7 @@ static int mthca_create_srq(struct ib_srq *ibsrq, 


static int mthca_destroy_srq(struct ib_srq *srq, struct ib_udata *udata)

{

	mthca_free_srq(to_mdev(srq->device), to_msrq(srq));

	if (udata) {

		struct mthca_ucontext *context =

			rdma_udata_to_drv_context(
@@ -446,8 +449,6 @@ static int mthca_destroy_srq(struct ib_srq *srq, struct ib_udata *udata) 
		mthca_unmap_user_db(to_mdev(srq->device), &context->uar,

				    context->db_tab, to_msrq(srq)->db_index);

	}



	mthca_free_srq(to_mdev(srq->device), to_msrq(srq));

	return 0;

}