]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp
authorYanLong Dai <daiyanlong@kylinos.cn>
Wed, 24 Sep 2025 06:14:44 +0000 (14:14 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 13 Nov 2025 20:37:35 +0000 (15:37 -0500)
[ Upstream commit 88de89f184661ebb946804a5abdf2bdec7f0a7ab ]

The current error handling path in bnxt_re_destroy_gsi_sqp() could lead
to a resource leak. When bnxt_qplib_destroy_qp() fails, the function
jumps to the 'fail' label and returns immediately, skipping the call
to bnxt_qplib_free_qp_res().

Continue the resource teardown even if bnxt_qplib_destroy_qp() fails,
which aligns with the driver's general error handling strategy and
prevents the potential leak.

Fixes: 8dae419f9ec73 ("RDMA/bnxt_re: Refactor queue pair creation code")
Signed-off-by: YanLong Dai <daiyanlong@kylinos.cn>
Link: https://patch.msgid.link/20250924061444.11288-1-daiyanlong@kylinos.cn
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/infiniband/hw/bnxt_re/ib_verbs.c

index 260dc67b8b87c9d9991b8164b51e24777ac8125b..12fee23de81e77dbbc88b048464ebcae5224fb10 100644 (file)
@@ -911,7 +911,7 @@ void bnxt_re_unlock_cqs(struct bnxt_re_qp *qp,
        spin_unlock_irqrestore(&qp->scq->cq_lock, flags);
 }
 
-static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
+static void bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
 {
        struct bnxt_re_qp *gsi_sqp;
        struct bnxt_re_ah *gsi_sah;
@@ -931,10 +931,9 @@ static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
 
        ibdev_dbg(&rdev->ibdev, "Destroy the shadow QP\n");
        rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, &gsi_sqp->qplib_qp);
-       if (rc) {
+       if (rc)
                ibdev_err(&rdev->ibdev, "Destroy Shadow QP failed");
-               goto fail;
-       }
+
        bnxt_qplib_free_qp_res(&rdev->qplib_res, &gsi_sqp->qplib_qp);
 
        /* remove from active qp list */
@@ -949,10 +948,6 @@ static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
        rdev->gsi_ctx.gsi_sqp = NULL;
        rdev->gsi_ctx.gsi_sah = NULL;
        rdev->gsi_ctx.sqp_tbl = NULL;
-
-       return 0;
-fail:
-       return rc;
 }
 
 /* Queue Pairs */