RDMA/hns: Fix memory leak in free_mr_init()

[ Upstream commit 288f535951aa81ed674f5e5477ab11b9d9351b8c ]

When a reserved QP fails to be created, the memory of the remaining
created reserved QPs is leaked.

Fixes: 70f92521584f ("RDMA/hns: Use the reserved loopback QPs to free MR before destroying MPT")
Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20231207114231.2872104-6-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index e4753c8029428f82f1eadd5f0ced6f0987001ce9..aa9527ac2fe06422d02070725cc068960b8baa93 100644 (file)
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -2698,6 +2698,10 @@ static int free_mr_alloc_res(struct hns_roce_dev *hr_dev)
        return 0;
 
 create_failed_qp:
+       for (i--; i >= 0; i--) {
+               hns_roce_v2_destroy_qp(&free_mr->rsv_qp[i]->ibqp, NULL);
+               kfree(free_mr->rsv_qp[i]);
+       }
        hns_roce_destroy_cq(cq, NULL);
        kfree(cq);