[openib-general] [PATCH] agent: Fix memory leaks associated with agent_mad_send errors

[Hal Rosenstock]

agent: Fix memory leaks (identified by Shirley Ma) associated with
agent_mad_send errors

Index: agent.c
===================================================================
--- agent.c	(revision 1104)
+++ agent.c	(working copy)
@@ -339,10 +339,10 @@
 	return entry;
 }
 
-void agent_mad_send(struct ib_mad_agent *mad_agent,
-		    struct ib_mad *mad,
-		    struct ib_grh *grh,
-		    struct ib_mad_recv_wc *mad_recv_wc)
+int agent_mad_send(struct ib_mad_agent *mad_agent,
+		   struct ib_mad *mad,
+		   struct ib_grh *grh,
+		   struct ib_mad_recv_wc *mad_recv_wc)
 {
 	struct ib_agent_port_private *port_priv;
 	struct ib_agent_send_wr *agent_send_wr;
@@ -351,18 +351,19 @@
 	struct ib_send_wr *bad_send_wr;
 	struct ib_ah_attr ah_attr;
 	unsigned long flags;
+	int ret = 1;
 
 	/* Find matching MAD agent */
 	port_priv = ib_get_agent_mad(NULL, 0, mad_agent);
 	if (!port_priv) {
 		printk(KERN_ERR SPFX "agent_mad_send: no matching MAD agent %p\n",
 		       mad_agent);
-		return;
+		goto out;
 	}
 
 	agent_send_wr = kmalloc(sizeof(*agent_send_wr), GFP_KERNEL);
 	if (!agent_send_wr)
-		return;
+		goto out;
 	agent_send_wr->mad = mad;
 
 	/* PCI mapping */
@@ -406,8 +407,8 @@
 	agent_send_wr->ah = ib_create_ah(mad_agent->qp->pd, &ah_attr);
 	if (IS_ERR(agent_send_wr->ah)) {
 		printk(KERN_ERR SPFX "No memory for address handle\n");
-		kfree(mad);
-		return;
+		kfree(agent_send_wr);
+		goto out;
 	}
                                                                                 
 	send_wr.wr.ud.ah = agent_send_wr->ah;
@@ -432,11 +433,16 @@
 				 sizeof(struct ib_mad),
 				 PCI_DMA_TODEVICE);
 		ib_destroy_ah(agent_send_wr->ah);
+		kfree(agent_send_wr);
 	} else {
 		list_add_tail(&agent_send_wr->send_list,
 			      &port_priv->send_posted_list);
 		spin_unlock_irqrestore(&port_priv->send_list_lock, flags);
+		ret = 0;
 	}
+
+out:
+	return ret;
 }
 
 int smi_send_smp(struct ib_mad_agent *mad_agent,
@@ -470,8 +476,9 @@
 				kfree(smp_response);
 				return 0;
 			}
-			agent_mad_send(mad_agent, smp_response,
-				       NULL, mad_recv_wc);
+			if (agent_mad_send(mad_agent, smp_response,
+					   NULL, mad_recv_wc))
+				kfree(smp_response);
 		} else
 			kfree(smp_response);
 		return 1;