IB/rxe: Fix ref leak in rxe_create_qp()

The udata->inlen error path needs to clean up the ref
added by rxe_alloc().

Signed-off-by: Andrew Boyer <andrew.boyer@dell.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

1 files changed, 4 insertions, 3 deletions

diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
index de39b0a081de..071430c594b7 100644
--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
@@ -564,7 +564,7 @@ static struct ib_qp *rxe_create_qp(struct ib_pd *ibpd,
         if (udata) {
                 if (udata->inlen) {
                         err = -EINVAL;
-                        goto err1;
+                        goto err2;
                 }
                 qp->is_user = 1;
         }
@@ -573,12 +573,13 @@ static struct ib_qp *rxe_create_qp(struct ib_pd *ibpd,
 
         err = rxe_qp_from_init(rxe, qp, pd, init, udata, ibpd);
         if (err)
-                goto err2;
+                goto err3;
 
         return &qp->ibqp;
 
-err2:
+err3:
         rxe_drop_index(qp);
+err2:
         rxe_drop_ref(qp);
 err1:
         return ERR_PTR(err);