RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe

Move the zero CQE validation before rdma_zalloc_drv_obj() to avoid
leaking the CQ object when returning -EINVAL.

Fixes: a2917582887a ("RDMA/core: Reject zero CQE count")
Link: https://patch.msgid.link/r/20260625020148.224537-1-zhaochenguang@kylinos.cn
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 3b613b57e269781e94e9d63ea75c7dcc46b1dacb..86811d31092ce03c8156b444fece47b824231219 100644 (file)
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -2196,13 +2196,13 @@ struct ib_cq *__ib_create_cq(struct ib_device *device,
        struct ib_cq *cq;
        int ret;
 
+       if (WARN_ON_ONCE(!cq_attr->cqe))
+               return ERR_PTR(-EINVAL);
+
        cq = rdma_zalloc_drv_obj(device, ib_cq);
        if (!cq)
                return ERR_PTR(-ENOMEM);
 
-       if (WARN_ON_ONCE(!cq_attr->cqe))
-               return ERR_PTR(-EINVAL);
-
        cq->device = device;
        cq->comp_handler = comp_handler;
        cq->event_handler = event_handler;