diff options
| author | Matan Barak <matanb@mellanox.com> | 2017-11-14 14:51:57 +0200 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2017-12-18 15:37:05 -0700 |
| commit | 8b00914654ef56ff5473f4fe1f1168254dbb8a17 (patch) | |
| tree | 4626eaef99cce2c7284b3848c355b1b8d2d9c2bb /drivers/infiniband/core | |
| parent | 7baaa49af3716fb31877c61f59b74d029ce15b75 (diff) | |
IB/core: Fix memory leak in cm_req_handler error flows
In cm_req_handler error flows, sometimes cm_id_priv->timewait_info
isn't free'd.
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Mukesh Kacker <mukesh.kacker@oracle.com>
Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/core')
| -rw-r--r-- | drivers/infiniband/core/cm.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c index 1cafa8350c52..dbbebbb5c315 100644 --- a/drivers/infiniband/core/cm.c +++ b/drivers/infiniband/core/cm.c @@ -1876,8 +1876,7 @@ static int cm_req_handler(struct cm_work *work) listen_cm_id_priv = cm_match_req(work, cm_id_priv); if (!listen_cm_id_priv) { ret = -EINVAL; - kfree(cm_id_priv->timewait_info); - goto destroy; + goto free_timeinfo; } cm_id_priv->id.cm_handler = listen_cm_id_priv->id.cm_handler; @@ -1979,6 +1978,8 @@ static int cm_req_handler(struct cm_work *work) rejected: atomic_dec(&cm_id_priv->refcount); cm_deref_id(listen_cm_id_priv); +free_timeinfo: + kfree(cm_id_priv->timewait_info); destroy: ib_destroy_cm_id(cm_id); return ret; |