From 86d6d8ac4bb382392678a32cf940b26b54da0320 Mon Sep 17 00:00:00 2001 From: Weihang Li Date: Thu, 12 Nov 2020 19:29:42 +0800 Subject: [PATCH] RDMA/hns: Fix double free of the pointer to TSQ/TPQ mainline inclusion from mainline-v5.11-rc1 commit 7af80c02c7b3cf7ac580a33f15d155730574769f category: bugfix bugzilla: 174002 CVE:NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7af80c02c7b3cf7ac580a33f15d155730574769f ---------------------------------------------------------------------- A return statement is omitted after getting HEM table, then the newly allocated pointer will be freed directly, which will cause a calltrace when the driver was removed. Fixes: d6d91e46210f ("RDMA/hns: Add support for configuring GMV table") Link: https://lore.kernel.org/r/1605180582-46504-1-git-send-email-liweihang@huawei.com Signed-off-by: Weihang Li Signed-off-by: Jason Gunthorpe Signed-off-by: wangsirong Reviewed-by: ChunZhi Hu Signed-off-by: Zheng Zengkai --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index a44db0ffff37..25d15011a0f1 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -2556,6 +2556,8 @@ static int hns_roce_v2_init(struct hns_roce_dev *hr_dev) if (ret) goto err_get_hem_table_failed; + return 0; + err_get_hem_table_failed: hns_roce_free_link_table(hr_dev, &priv->tpq); -- GitLab