qed: Fix memory/entry leak in qed_init_sp_request()

Free the allocated SPQ entry or return the acquired SPQ entry to the free
list in error flows.

Signed-off-by: Denis Bolotin <denis.bolotin@cavium.com>
Signed-off-by: Michal Kalderon <michal.kalderon@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
index 77b6248ad3b97d3a45caf27825faddabf9695a5b..e86a1ea23613303b0070618a8ffb9319993eec30 100644 (file)
--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
@@ -80,7 +80,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
 
        case QED_SPQ_MODE_BLOCK:
                if (!p_data->p_comp_data)
-                       return -EINVAL;
+                       goto err;
 
                p_ent->comp_cb.cookie = p_data->p_comp_data->cookie;
                break;
@@ -95,7 +95,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
        default:
                DP_NOTICE(p_hwfn, "Unknown SPQE completion mode %d\n",
                          p_ent->comp_mode);
-               return -EINVAL;
+               goto err;
        }
 
        DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
@@ -109,6 +109,18 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn,
        memset(&p_ent->ramrod, 0, sizeof(p_ent->ramrod));
 
        return 0;
+
+err:
+       /* qed_spq_get_entry() can either get an entry from the free_pool,
+        * or, if no entries are left, allocate a new entry and add it to
+        * the unlimited_pending list.
+        */
+       if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending)
+               kfree(p_ent);
+       else
+               qed_spq_return_entry(p_hwfn, p_ent);
+
+       return -EINVAL;
 }
 
 static enum tunnel_clss qed_tunn_clss_to_fw_clss(u8 type)