[PATCH 4/4] RDMA: Fix double-free in srq creation error flow

Leon Romanovsky
2019-09-16T07:12:12Z

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

The cited commit introduced a double-free of the srq buffer
in the error flow of procedure __uverbs_create_xsrq().

The problem is that procedure ib_destroy_srq_user() called
in the error flow also frees the srq buffer.

Thus, if uverbs_response() fails in __uverbs_create_srq(),
the srq buffer will be freed twice.

Fixes: 68e326dea1db ("RDMA: Handle SRQ allocations by IB/core")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
---
drivers/infiniband/core/uverbs_cmd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 8f4fd4fac159..13af88da5f79 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -3482,7 +3482,8 @@ static int __uverbs_create_xsrq(struct uverbs_attr_bundle *attrs,

err_copy:
ib_destroy_srq_user(srq, uverbs_get_cleared_udata(attrs));
-
+ /* It was released in ib_destroy_srq_user */
+ srq = NULL;
err_free:
kfree(srq);
err_put:
--
2.20.1