From: Roland Dreier Date: Tue, 19 Feb 2008 18:42:50 +0000 (-0800) Subject: IB/mthca: Free correct MPT on error exit from mthca_fmr_alloc() X-Git-Tag: v5.15~42067^2 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=b7f9c112a5e7f68d77a31c79f5942a3272ae9a3b;p=mirror_ubuntu-kernels.git IB/mthca: Free correct MPT on error exit from mthca_fmr_alloc() When mthca_fmr_alloc() returns an error, it should free the MPT at the index key, not mr->ibmr.lkey, since the lkey has been mangled by hw_index_to_key() and no longer is the real index. This bug causes corruption of the MPT table free bitmap when mthca_fmr_alloc() fails. Signed-off-by: Roland Dreier --- diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c index 3b6985557cb2..3538da16e3fe 100644 --- a/drivers/infiniband/hw/mthca/mthca_mr.c +++ b/drivers/infiniband/hw/mthca/mthca_mr.c @@ -686,7 +686,7 @@ err_out_table: mthca_table_put(dev, dev->mr_table.mpt_table, key); err_out_mpt_free: - mthca_free(&dev->mr_table.mpt_alloc, mr->ibmr.lkey); + mthca_free(&dev->mr_table.mpt_alloc, key); return err; }