IB/mlx4: Fix create CQ error flow

Currently, if ib_copy_to_udata fails, the CQ
won't be deleted from the radix tree and the HW (HW2SW).

Fixes: 225c7b1feef1 ('IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters')
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
Reviewed-by: Mark Bloch <markb@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 1ea686b9e0f9..6a0fec357dae 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -253,11 +253,14 @@ struct ib_cq *mlx4_ib_create_cq(struct ib_device *ibdev,
         if (context)
                 if (ib_copy_to_udata(udata, &cq->mcq.cqn, sizeof (__u32))) {
                         err = -EFAULT;
-                        goto err_dbmap;
+                        goto err_cq_free;
                 }
 
         return &cq->ibcq;
 
+err_cq_free:
+        mlx4_cq_free(dev->dev, &cq->mcq);
+
 err_dbmap:
         if (context)
                 mlx4_ib_db_unmap_user(to_mucontext(context), &cq->db);