23f1b38481
The error handling code at err_wrid in create_qp_common() does not handle a userspace QP attached to an SRQ correctly, since it ends up in the else clause of the if statement. This means it tries to kfree() the uninitialized qp->sq.wrid and qp->rq.wrid pointers. Fix this so we only free the wrid arrays for kernel QPs. Pointed out by Michael S. Tsirkin <mst@dev.mellanox.co.il>. Signed-off-by: Roland Dreier <rolandd@cisco.com> |
||
|---|---|---|
| .. | ||
| ah.c | ||
| cq.c | ||
| doorbell.c | ||
| Kconfig | ||
| mad.c | ||
| main.c | ||
| Makefile | ||
| mlx4_ib.h | ||
| mr.c | ||
| qp.c | ||
| srq.c | ||
| user.h | ||