mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 02:17:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe

Browse Source 
Move the zero CQE validation before rdma_zalloc_drv_obj() to avoid
leaking the CQ object when returning -EINVAL.

Fixes: a291758288 ("RDMA/core: Reject zero CQE count")
Link: https://patch.msgid.link/r/20260625020148.224537-1-zhaochenguang@kylinos.cn
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
This commit is contained in:
Chenguang Zhao
2026-06-25 10:01:48 +08:00
committed by Jason Gunthorpe
parent 155fd5ce23
commit e939334ea7
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/infiniband/core/verbs.c
View File

@@ -2196,13 +2196,13 @@ struct ib_cq *__ib_create_cq(struct ib_device *device,
struct ib_cq *cq;
int ret;
if (WARN_ON_ONCE(!cq_attr->cqe))
return ERR_PTR(-EINVAL);
cq = rdma_zalloc_drv_obj(device, ib_cq);
if (!cq)
return ERR_PTR(-ENOMEM);
if (WARN_ON_ONCE(!cq_attr->cqe))
return ERR_PTR(-EINVAL);
cq->device = device;
cq->comp_handler = comp_handler;
cq->event_handler = event_handler;