IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()

Fix a user triggerable leak on the system call failure path.

Cc: stable@vger.kernel.org
Fixes: ec34a922d243 ("[PATCH] IB/mthca: Add SRQ implementation")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://patch.msgid.link/2-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>

diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index ef0635064fbaf39763c0518f30b8b902130cc490..5c182ae4fc2f663c0e4a23ed12d63a93998662fb 100644 (file)
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -428,6 +428,8 @@ static int mthca_create_srq(struct ib_srq *ibsrq,
 
        if (context && ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) {
                mthca_free_srq(to_mdev(ibsrq->device), srq);
+               mthca_unmap_user_db(to_mdev(ibsrq->device), &context->uar,
+                                   context->db_tab, ucmd.db_index);
                return -EFAULT;
        }
 
@@ -436,6 +438,7 @@ static int mthca_create_srq(struct ib_srq *ibsrq,
 
 static int mthca_destroy_srq(struct ib_srq *srq, struct ib_udata *udata)
 {
+       mthca_free_srq(to_mdev(srq->device), to_msrq(srq));
        if (udata) {
                struct mthca_ucontext *context =
                        rdma_udata_to_drv_context(
@@ -446,8 +449,6 @@ static int mthca_destroy_srq(struct ib_srq *srq, struct ib_udata *udata)
                mthca_unmap_user_db(to_mdev(srq->device), &context->uar,
                                    context->db_tab, to_msrq(srq)->db_index);
        }
-
-       mthca_free_srq(to_mdev(srq->device), to_msrq(srq));
        return 0;
 }