IB/mthca: Fix memory leaks in error handling

Fix memory leaks in mthca_create_qp() and mthca_create_srq()
error handling.

Signed-off-by: Jack Morgenstein <jackm@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

1 files changed, 7 insertions, 3 deletions

diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index db35690c91de..484a7e6b7f8c 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -445,8 +445,10 @@ static struct ib_srq *mthca_create_srq(struct ib_pd *pd,
         if (pd->uobject) {
                 context = to_mucontext(pd->uobject->context);
 
-                if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd))
-                        return ERR_PTR(-EFAULT);
+                if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) {
+                        err = -EFAULT;
+                        goto err_free;
+                }
 
                 err = mthca_map_user_db(to_mdev(pd->device), &context->uar,
                                         context->db_tab, ucmd.db_index,
@@ -522,8 +524,10 @@ static struct ib_qp *mthca_create_qp(struct ib_pd *pd,
                 if (pd->uobject) {
                         context = to_mucontext(pd->uobject->context);
 
-                        if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd))
+                        if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) {
+                                kfree(qp);
                                 return ERR_PTR(-EFAULT);
+                        }
 
                         err = mthca_map_user_db(to_mdev(pd->device), &context->uar,
                                                 context->db_tab,