IB/ipath: Fix error path in QP creation

This patch fixes the code which frees the partially allocated QP
resources if there was an error while creating the QP. In particular,
the QPN wasn't deallocated and the QP wasn't removed from the hash
table.

Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c
index 6a41fdbc8e57dfca779759de14137fe33b811015..b997ff88401bf5f3ceca581a48ac05d4a94ba079 100644 (file)
--- a/drivers/infiniband/hw/ipath/ipath_qp.c
+++ b/drivers/infiniband/hw/ipath/ipath_qp.c
@@ -835,7 +835,8 @@ struct ib_qp *ipath_create_qp(struct ib_pd *ibpd,
                                      init_attr->qp_type);
                if (err) {
                        ret = ERR_PTR(err);
-                       goto bail_rwq;
+                       vfree(qp->r_rq.wq);
+                       goto bail_qp;
                }
                qp->ip = NULL;
                ipath_reset_qp(qp);
@@ -863,7 +864,7 @@ struct ib_qp *ipath_create_qp(struct ib_pd *ibpd,
                                               sizeof(offset));
                        if (err) {
                                ret = ERR_PTR(err);
-                               goto bail_rwq;
+                               goto bail_ip;
                        }
                } else {
                        u32 s = sizeof(struct ipath_rwq) +
@@ -875,7 +876,7 @@ struct ib_qp *ipath_create_qp(struct ib_pd *ibpd,
                                                   qp->r_rq.wq);
                        if (!qp->ip) {
                                ret = ERR_PTR(-ENOMEM);
-                               goto bail_rwq;
+                               goto bail_ip;
                        }
 
                        err = ib_copy_to_udata(udata, &(qp->ip->offset),
@@ -907,9 +908,11 @@ struct ib_qp *ipath_create_qp(struct ib_pd *ibpd,
        goto bail;
 
 bail_ip:
-       kfree(qp->ip);
-bail_rwq:
-       vfree(qp->r_rq.wq);
+       if (qp->ip)
+               kref_put(&qp->ip->ref, ipath_release_mmap_info);
+       else
+               vfree(qp->r_rq.wq);
+       ipath_free_qp(&dev->qp_table, qp);
 bail_qp:
        kfree(qp);
 bail_swq: