[PATCH] RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe

[PATCH] RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe

[Chenguang Zhao]

Free the allocated CQ object when cqe is zero before returning
-EINVAL.

Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
---
 drivers/infiniband/core/verbs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 3b613b57e269..d6b2eb820061 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -2200,8 +2200,10 @@ struct ib_cq *__ib_create_cq(struct ib_device *device,
 	if (!cq)
 		return ERR_PTR(-ENOMEM);
 
-	if (WARN_ON_ONCE(!cq_attr->cqe))
+	if (WARN_ON_ONCE(!cq_attr->cqe)) {
+		kfree(cq);
 		return ERR_PTR(-EINVAL);
+	}
 
 	cq->device = device;
 	cq->comp_handler = comp_handler;
-- 
2.25.1

Re: [PATCH] RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe

[Kalesh Anakkur Purayil]

[-- Attachment #1: Type: text/plain, Size: 1106 bytes --]

On Wed, Jun 24, 2026 at 8:30 AM Chenguang Zhao <zhaochenguang@kylinos.cn> wrote:
>
> Free the allocated CQ object when cqe is zero before returning
> -EINVAL.
>
> Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
> ---
>  drivers/infiniband/core/verbs.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
> index 3b613b57e269..d6b2eb820061 100644
> --- a/drivers/infiniband/core/verbs.c
> +++ b/drivers/infiniband/core/verbs.c
> @@ -2200,8 +2200,10 @@ struct ib_cq *__ib_create_cq(struct ib_device *device,
>         if (!cq)
>                 return ERR_PTR(-ENOMEM);
>
> -       if (WARN_ON_ONCE(!cq_attr->cqe))
> +       if (WARN_ON_ONCE(!cq_attr->cqe)) {
> +               kfree(cq);
>                 return ERR_PTR(-EINVAL);
> +       }
[Kalesh] I think you can move this check to the beginning of the function.

Also, please add a Fixes tag.
>
>         cq->device = device;
>         cq->comp_handler = comp_handler;
> --
> 2.25.1
>
>


-- 
Regards,
Kalesh AP

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5509 bytes --]

[PATCH v2] RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe

[Chenguang Zhao]

Move the zero CQE validation before rdma_zalloc_drv_obj() to avoid
leaking the CQ object when returning -EINVAL.

Fixes: a2917582887a ("RDMA/core: Reject zero CQE count")
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
---
v2:
 - move validation before rdma_zalloc_drv_obj() as suggested by Kalesh.
---
 drivers/infiniband/core/verbs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 3b613b57e269..86811d31092c 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -2196,13 +2196,13 @@ struct ib_cq *__ib_create_cq(struct ib_device *device,
 	struct ib_cq *cq;
 	int ret;
 
+	if (WARN_ON_ONCE(!cq_attr->cqe))
+		return ERR_PTR(-EINVAL);
+
 	cq = rdma_zalloc_drv_obj(device, ib_cq);
 	if (!cq)
 		return ERR_PTR(-ENOMEM);
 
-	if (WARN_ON_ONCE(!cq_attr->cqe))
-		return ERR_PTR(-EINVAL);
-
 	cq->device = device;
 	cq->comp_handler = comp_handler;
 	cq->event_handler = event_handler;
-- 
2.25.1

Re: [PATCH v2] RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe

[Kalesh Anakkur Purayil]

[-- Attachment #1: Type: text/plain, Size: 426 bytes --]

On Thu, Jun 25, 2026 at 7:33 AM Chenguang Zhao <zhaochenguang@kylinos.cn> wrote:
>
> Move the zero CQE validation before rdma_zalloc_drv_obj() to avoid
> leaking the CQ object when returning -EINVAL.
>
> Fixes: a2917582887a ("RDMA/core: Reject zero CQE count")
> Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
LGTM,
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>

-- 
Regards,
Kalesh AP

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5509 bytes --]

Re: [PATCH v2] RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe

[Jason Gunthorpe]

On Thu, Jun 25, 2026 at 10:01:48AM +0800, Chenguang Zhao wrote:
> Move the zero CQE validation before rdma_zalloc_drv_obj() to avoid
> leaking the CQ object when returning -EINVAL.
> 
> Fixes: a2917582887a ("RDMA/core: Reject zero CQE count")
> Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
> ---
> v2:
>  - move validation before rdma_zalloc_drv_obj() as suggested by Kalesh.
> ---
>  drivers/infiniband/core/verbs.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)

Applied to for-rc, thanks

Jason