提交 26d1e7ce 编写于 作者: L Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
  net/9p: fix memory handling/allocation in rdma_request()
...@@ -426,8 +426,10 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req) ...@@ -426,8 +426,10 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
/* Allocate an fcall for the reply */ /* Allocate an fcall for the reply */
rpl_context = kmalloc(sizeof *rpl_context, GFP_KERNEL); rpl_context = kmalloc(sizeof *rpl_context, GFP_KERNEL);
if (!rpl_context) if (!rpl_context) {
err = -ENOMEM;
goto err_close; goto err_close;
}
/* /*
* If the request has a buffer, steal it, otherwise * If the request has a buffer, steal it, otherwise
...@@ -445,8 +447,8 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req) ...@@ -445,8 +447,8 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
} }
rpl_context->rc = req->rc; rpl_context->rc = req->rc;
if (!rpl_context->rc) { if (!rpl_context->rc) {
kfree(rpl_context); err = -ENOMEM;
goto err_close; goto err_free2;
} }
/* /*
...@@ -458,11 +460,8 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req) ...@@ -458,11 +460,8 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
*/ */
if (atomic_inc_return(&rdma->rq_count) <= rdma->rq_depth) { if (atomic_inc_return(&rdma->rq_count) <= rdma->rq_depth) {
err = post_recv(client, rpl_context); err = post_recv(client, rpl_context);
if (err) { if (err)
kfree(rpl_context->rc); goto err_free1;
kfree(rpl_context);
goto err_close;
}
} else } else
atomic_dec(&rdma->rq_count); atomic_dec(&rdma->rq_count);
...@@ -471,8 +470,10 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req) ...@@ -471,8 +470,10 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
/* Post the request */ /* Post the request */
c = kmalloc(sizeof *c, GFP_KERNEL); c = kmalloc(sizeof *c, GFP_KERNEL);
if (!c) if (!c) {
goto err_close; err = -ENOMEM;
goto err_free1;
}
c->req = req; c->req = req;
c->busa = ib_dma_map_single(rdma->cm_id->device, c->busa = ib_dma_map_single(rdma->cm_id->device,
...@@ -499,9 +500,15 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req) ...@@ -499,9 +500,15 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
return ib_post_send(rdma->qp, &wr, &bad_wr); return ib_post_send(rdma->qp, &wr, &bad_wr);
error: error:
kfree(c);
kfree(rpl_context->rc);
kfree(rpl_context);
P9_DPRINTK(P9_DEBUG_ERROR, "EIO\n"); P9_DPRINTK(P9_DEBUG_ERROR, "EIO\n");
return -EIO; return -EIO;
err_free1:
kfree(rpl_context->rc);
err_free2:
kfree(rpl_context);
err_close: err_close:
spin_lock_irqsave(&rdma->req_lock, flags); spin_lock_irqsave(&rdma->req_lock, flags);
if (rdma->state < P9_RDMA_CLOSING) { if (rdma->state < P9_RDMA_CLOSING) {
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册