[PATCH rdma-rc] RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp

[PATCH rdma-rc] RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp

[YanLong Dai]

From: daiyanlong <daiyanlong@kylinos.cn>

The current error handling path in bnxt_re_destroy_gsi_sqp() could lead
to a resource leak. When bnxt_qplib_destroy_qp() fails, the function
jumps to the 'fail' label and returns immediately, skipping the call
to bnxt_qplib_free_qp_res().

Continue the resource teardown even if bnxt_qplib_destroy_qp() fails,
which aligns with the driver's general error handling strategy and
prevents the potential leak.

Fixes: 8dae419f9ec73 ("RDMA/bnxt_re: Refactor queue pair creation code")

Signed-off-by: daiyanlong <daiyanlong@kylinos.cn>
---
 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 260dc67b8b87..15d3f5d5c0ee 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -931,10 +931,9 @@ static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
 
 	ibdev_dbg(&rdev->ibdev, "Destroy the shadow QP\n");
 	rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, &gsi_sqp->qplib_qp);
-	if (rc) {
+	if (rc)
 		ibdev_err(&rdev->ibdev, "Destroy Shadow QP failed");
-		goto fail;
-	}
+
 	bnxt_qplib_free_qp_res(&rdev->qplib_res, &gsi_sqp->qplib_qp);
 
 	/* remove from active qp list */
@@ -951,8 +950,6 @@ static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
 	rdev->gsi_ctx.sqp_tbl = NULL;
 
 	return 0;
-fail:
-	return rc;
 }
 
 /* Queue Pairs */
-- 
2.43.0

Re: [PATCH rdma-rc] RDMA/bnxt_re: Fix a potential memory leak in destroy_gsi_sqp

[Leon Romanovsky]

On Fri, Sep 19, 2025 at 01:42:38PM +0800, YanLong Dai wrote:
> From: daiyanlong <daiyanlong@kylinos.cn>
> 
> The current error handling path in bnxt_re_destroy_gsi_sqp() could lead
> to a resource leak. When bnxt_qplib_destroy_qp() fails, the function
> jumps to the 'fail' label and returns immediately, skipping the call
> to bnxt_qplib_free_qp_res().
> 
> Continue the resource teardown even if bnxt_qplib_destroy_qp() fails,
> which aligns with the driver's general error handling strategy and
> prevents the potential leak.
> 
> Fixes: 8dae419f9ec73 ("RDMA/bnxt_re: Refactor queue pair creation code")
> 
> Signed-off-by: daiyanlong <daiyanlong@kylinos.cn>

Documentation/process/submitting-patches.rst
  396 Sign your work - the Developer's Certificate of Origin
  397 ------------------------------------------------------
  398
  ...
  440 using a known identity (sorry, no anonymous contributions.)

Thanks

> ---
>  drivers/infiniband/hw/bnxt_re/ib_verbs.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> index 260dc67b8b87..15d3f5d5c0ee 100644
> --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
> @@ -931,10 +931,9 @@ static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
>  
>  	ibdev_dbg(&rdev->ibdev, "Destroy the shadow QP\n");
>  	rc = bnxt_qplib_destroy_qp(&rdev->qplib_res, &gsi_sqp->qplib_qp);
> -	if (rc) {
> +	if (rc)
>  		ibdev_err(&rdev->ibdev, "Destroy Shadow QP failed");
> -		goto fail;
> -	}
> +
>  	bnxt_qplib_free_qp_res(&rdev->qplib_res, &gsi_sqp->qplib_qp);
>  
>  	/* remove from active qp list */
> @@ -951,8 +950,6 @@ static int bnxt_re_destroy_gsi_sqp(struct bnxt_re_qp *qp)
>  	rdev->gsi_ctx.sqp_tbl = NULL;
>  
>  	return 0;
> -fail:
> -	return rc;
>  }
>  
>  /* Queue Pairs */
> -- 
> 2.43.0
>