diff options
| author | Chenguang Zhao <zhaochenguang@kylinos.cn> | 2026-06-25 10:01:48 +0800 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2026-07-02 14:19:33 -0300 |
| commit | e939334ea7dd219f100f963dbb1cb43df520c20a (patch) | |
| tree | 830d35b85de39b67e3bc53b5cdf18c12a4576fd8 | |
| parent | 155fd5ce2382b0ffbec0d7ee7b3a6818a27a5aed (diff) | |
RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe
Move the zero CQE validation before rdma_zalloc_drv_obj() to avoid
leaking the CQ object when returning -EINVAL.
Fixes: a2917582887a ("RDMA/core: Reject zero CQE count")
Link: https://patch.msgid.link/r/20260625020148.224537-1-zhaochenguang@kylinos.cn
Signed-off-by: Chenguang Zhao <zhaochenguang@kylinos.cn>
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
| -rw-r--r-- | drivers/infiniband/core/verbs.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c index 3b613b57e269..86811d31092c 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -2196,13 +2196,13 @@ struct ib_cq *__ib_create_cq(struct ib_device *device, struct ib_cq *cq; int ret; + if (WARN_ON_ONCE(!cq_attr->cqe)) + return ERR_PTR(-EINVAL); + cq = rdma_zalloc_drv_obj(device, ib_cq); if (!cq) return ERR_PTR(-ENOMEM); - if (WARN_ON_ONCE(!cq_attr->cqe)) - return ERR_PTR(-EINVAL); - cq->device = device; cq->comp_handler = comp_handler; cq->event_handler = event_handler; |