1 files changed, 20 insertions, 5 deletions

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 112d3970222a..f71cf138d674 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -301,10 +301,15 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
 
         resp.num_comp_vectors = file->device->num_comp_vectors;
 
-        filp = ib_uverbs_alloc_event_file(file, 1, &resp.async_fd);
+        ret = get_unused_fd();
+        if (ret < 0)
+                goto err_free;
+        resp.async_fd = ret;
+
+        filp = ib_uverbs_alloc_event_file(file, 1);
         if (IS_ERR(filp)) {
                 ret = PTR_ERR(filp);
-                goto err_free;
+                goto err_fd;
         }
 
         if (copy_to_user((void __user *) (unsigned long) cmd.response,
@@ -332,9 +337,11 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
         return in_len;
 
 err_file:
-        put_unused_fd(resp.async_fd);
         fput(filp);
 
+err_fd:
+        put_unused_fd(resp.async_fd);
+
 err_free:
         ibdev->dealloc_ucontext(ucontext);
 
@@ -715,6 +722,7 @@ ssize_t ib_uverbs_create_comp_channel(struct ib_uverbs_file *file,
         struct ib_uverbs_create_comp_channel       cmd;
         struct ib_uverbs_create_comp_channel_resp  resp;
         struct file                               *filp;
+        int ret;
 
         if (out_len < sizeof resp)
                 return -ENOSPC;
@@ -722,9 +730,16 @@ ssize_t ib_uverbs_create_comp_channel(struct ib_uverbs_file *file,
         if (copy_from_user(&cmd, buf, sizeof cmd))
                 return -EFAULT;
 
-        filp = ib_uverbs_alloc_event_file(file, 0, &resp.fd);
-        if (IS_ERR(filp))
+        ret = get_unused_fd();
+        if (ret < 0)
+                return ret;
+        resp.fd = ret;
+
+        filp = ib_uverbs_alloc_event_file(file, 0);
+        if (IS_ERR(filp)) {
+                put_unused_fd(resp.fd);
                 return PTR_ERR(filp);
+        }
 
         if (copy_to_user((void __user *) (unsigned long) cmd.response,
                          &resp, sizeof resp)) {