IB/uverbs: Release event file reference on ib_uverbs_create_cq() error

ib_uverbs_create_cq() should release the completion channel event file
if an error occurs after it looks it up.  Also, if userspace asks for
a completion channel and we don't find it, an error should be returned
instead of silently creating a CQ without a completion channel.

Signed-off-by: Jack Morgenstein <jackm@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

1 files changed, 10 insertions, 3 deletions

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 12d6cc0a7f80..a02c5a05c984 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -594,13 +594,18 @@ ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,
         if (cmd.comp_vector >= file->device->num_comp_vectors)
                 return -EINVAL;
 
-        if (cmd.comp_channel >= 0)
-                ev_file = ib_uverbs_lookup_comp_file(cmd.comp_channel);
-
         uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
         if (!uobj)
                 return -ENOMEM;
 
+        if (cmd.comp_channel >= 0) {
+                ev_file = ib_uverbs_lookup_comp_file(cmd.comp_channel);
+                if (!ev_file) {
+                        ret = -EINVAL;
+                        goto err;
+                }
+        }
+
         uobj->uobject.user_handle   = cmd.user_handle;
         uobj->uobject.context       = file->ucontext;
         uobj->uverbs_file           = file;
@@ -664,6 +669,8 @@ err_up:
         ib_destroy_cq(cq);
 
 err:
+        if (ev_file)
+                ib_uverbs_release_ucq(file, ev_file, uobj);
         kfree(uobj);
         return ret;
 }