[openib-general] [PATCH] core/ib_uverbs: fix error flow in ib_uverbs_create_cq

[Jack Morgenstein]

ib_uverbs_create_cq did not release the completion channel event file
reference count in the error flow.

Signed-off-by: Jack Morgenstein <jackm at mellanox.co.il>

Index: linux-kernel/drivers/infiniband/core/uverbs_cmd.c
===================================================================
--- linux-kernel.orig/drivers/infiniband/core/uverbs_cmd.c
+++ linux-kernel/drivers/infiniband/core/uverbs_cmd.c
@@ -593,13 +593,13 @@ ssize_t ib_uverbs_create_cq(struct ib_uv
 	if (cmd.comp_vector >= file->device->num_comp_vectors)
 		return -EINVAL;
 
-	if (cmd.comp_channel >= 0)
-		ev_file = ib_uverbs_lookup_comp_file(cmd.comp_channel);
-
 	uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
 	if (!uobj)
 		return -ENOMEM;
 
+	if (cmd.comp_channel >= 0)
+		ev_file = ib_uverbs_lookup_comp_file(cmd.comp_channel);
+
 	uobj->uobject.user_handle   = cmd.user_handle;
 	uobj->uobject.context       = file->ucontext;
 	uobj->uverbs_file	    = file;
@@ -663,6 +663,8 @@ err_up:
 	ib_destroy_cq(cq);
 
 err:
+	if (ev_file)
+		ib_uverbs_release_ucq(file, ev_file, uobj);
 	kfree(uobj);
 	return ret;
 }