A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 11:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

IB/mlx4: Fix bug unwinding on error in mlx4_ib_init_sriov()

Browse source 
We have to decrement "i" before calling mlx4_ib_free_demux_ctx() or we
free something that wasn't allocated.  That's fine for free_pv_object()
but it would lead to a NULL dereference calling mlx4_ib_free_demux_ctx().
The null dereference is because ->tun is NULL when we check:

	if (!ctx->tun[i])

Also we didn't free ->sriov.demux[0] so it was a small leak.

Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Roland Dreier <[email protected]>
This commit is contained in:
Dan Carpenter 2013-02-04 11:22:36 +00:00 • committed by Roland Dreier
commit cab66d1273
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
drivers/infiniband/hw/mlx4/mad.c
View file

@ -1999,16 +1999,17 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev)
goto demux_err;
err = mlx4_ib_alloc_demux_ctx(dev, &dev->sriov.demux[i], i + 1);
if (err)
goto demux_err;
goto free_pv;
}
mlx4_ib_master_tunnels(dev, 1);
return 0;
free_pv:
free_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1);
demux_err:
while (i > 0) {
while (--i >= 0) {
free_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1);
mlx4_ib_free_demux_ctx(&dev->sriov.demux[i]);
--i;
}
mlx4_ib_device_unregister_sysfs(dev);