IB/mthca: Fix memory leaks in error handling

Fix memory leaks in mthca_create_qp() and mthca_create_srq()
error handling.

Signed-off-by: Jack Morgenstein <jackm@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

authored by

Jack Morgenstein and committed by
Roland Dreier
17e2e819 59f174fa

+7 -3
+7 -3
drivers/infiniband/hw/mthca/mthca_provider.c
··· 445 if (pd->uobject) { 446 context = to_mucontext(pd->uobject->context); 447 448 - if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) 449 - return ERR_PTR(-EFAULT); 450 451 err = mthca_map_user_db(to_mdev(pd->device), &context->uar, 452 context->db_tab, ucmd.db_index, ··· 524 if (pd->uobject) { 525 context = to_mucontext(pd->uobject->context); 526 527 - if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) 528 return ERR_PTR(-EFAULT); 529 530 err = mthca_map_user_db(to_mdev(pd->device), &context->uar, 531 context->db_tab,
··· 445 if (pd->uobject) { 446 context = to_mucontext(pd->uobject->context); 447 448 + if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) { 449 + err = -EFAULT; 450 + goto err_free; 451 + } 452 453 err = mthca_map_user_db(to_mdev(pd->device), &context->uar, 454 context->db_tab, ucmd.db_index, ··· 522 if (pd->uobject) { 523 context = to_mucontext(pd->uobject->context); 524 525 + if (ib_copy_from_udata(&ucmd, udata, sizeof ucmd)) { 526 + kfree(qp); 527 return ERR_PTR(-EFAULT); 528 + } 529 530 err = mthca_map_user_db(to_mdev(pd->device), &context->uar, 531 context->db_tab,