aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSean Hefty <sean.hefty@intel.com>2007-07-31 18:10:54 -0400
committerRoland Dreier <rolandd@cisco.com>2007-08-03 13:45:17 -0400
commit38d5af9565f3fa1bf258f3eaeb47c4a95fd7a2b2 (patch)
treed0a855f33a96fa9d28f4327d775f6e4c8bab8aad
parent8fc394b1971241999ef9b022feabf6a164791e3f (diff)
IB/mad: Fix address handle leak in mad_rmpp
The address handle associated with dual-sided RMPP direction switch ACKs is never destroyed. Free the AH for ACKs which fall into this category. Problem was reported by Dotan Barak <dotanb@dev.mellanox.co.il>. Signed-off-by: Sean Hefty <sean.hefty@intel.com> Signed-off-by: Roland Dreier <rolandd@cisco.com>
-rw-r--r--drivers/infiniband/core/mad_rmpp.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/infiniband/core/mad_rmpp.c b/drivers/infiniband/core/mad_rmpp.c
index 3663fd7022be..d43bc62005b3 100644
--- a/drivers/infiniband/core/mad_rmpp.c
+++ b/drivers/infiniband/core/mad_rmpp.c
@@ -163,8 +163,10 @@ static struct ib_mad_send_buf *alloc_response_msg(struct ib_mad_agent *agent,
163 hdr_len, 0, GFP_KERNEL); 163 hdr_len, 0, GFP_KERNEL);
164 if (IS_ERR(msg)) 164 if (IS_ERR(msg))
165 ib_destroy_ah(ah); 165 ib_destroy_ah(ah);
166 else 166 else {
167 msg->ah = ah; 167 msg->ah = ah;
168 msg->context[0] = ah;
169 }
168 170
169 return msg; 171 return msg;
170} 172}
@@ -197,9 +199,7 @@ static void ack_ds_ack(struct ib_mad_agent_private *agent,
197 199
198void ib_rmpp_send_handler(struct ib_mad_send_wc *mad_send_wc) 200void ib_rmpp_send_handler(struct ib_mad_send_wc *mad_send_wc)
199{ 201{
200 struct ib_rmpp_mad *rmpp_mad = mad_send_wc->send_buf->mad; 202 if (mad_send_wc->send_buf->context[0] == mad_send_wc->send_buf->ah)
201
202 if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_ACK)
203 ib_destroy_ah(mad_send_wc->send_buf->ah); 203 ib_destroy_ah(mad_send_wc->send_buf->ah);
204 ib_free_send_mad(mad_send_wc->send_buf); 204 ib_free_send_mad(mad_send_wc->send_buf);
205} 205}