[openib-general] [PATCH] RDMA/cma: rdma_bind_addr() leaks a cma_dev reference count

[Krishna Kumar]

rdma_bind_addr() leaks a cma_dev reference count
in failure case. Also hold lock when doing a
cma_detach_from_dev() as pointed out by Sean.

Signed-off-by: Krishna Kumar <krkumar2 at in.ibm.com>
---
diff -ruNp org/drivers/infiniband/core/cma.c new/drivers/infiniband/core/cma.c
--- org/drivers/infiniband/core/cma.c	2006-10-09 17:13:41.000000000 +0530
+++ new/drivers/infiniband/core/cma.c	2006-10-09 19:42:31.000000000 +0530
@@ -1750,6 +1750,7 @@ static int cma_get_port(struct rdma_id_p
 int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
 {
 	struct rdma_id_private *id_priv;
+	int did_acquire_dev = 0;
 	int ret;
 
 	if (addr->sa_family != AF_INET)
@@ -1768,6 +1769,7 @@ int rdma_bind_addr(struct rdma_cm_id *id
 		}
 		if (ret)
 			goto err;
+		did_acquire_dev = 1;
 	}
 
 	memcpy(&id->route.addr.src_addr, addr, ip_addr_size(addr));
@@ -1777,6 +1779,11 @@ int rdma_bind_addr(struct rdma_cm_id *id
 
 	return 0;
 err:
+	if (did_acquire_dev) {
+		mutex_lock(&lock);
+		cma_detach_from_dev(id_priv);
+		mutex_unlock(&lock);
+	}
 	cma_comp_exch(id_priv, CMA_ADDR_BOUND, CMA_IDLE);
 	return ret;
 }