RDMA/core: Clear out the udata before error unwind
authorJason Gunthorpe <jgg@mellanox.com>
Tue, 21 May 2019 17:55:22 +0000 (17:55 +0000)
committerJason Gunthorpe <jgg@mellanox.com>
Mon, 27 May 2019 17:35:26 +0000 (14:35 -0300)
commit6875cb175ca7e0c24aa4460ac2b3257fdf662832
tree31a4c1aa8de14bd4aa0c4dacb0aa51feb4a8471d
parent619122be3d40c835eb5fad9e326780909926495d
RDMA/core: Clear out the udata before error unwind

The core code should not pass a udata to the driver destroy function that
contains the input from the create command. Otherwise the driver will
attempt to interpret the create udata as destroy udata, and at least in
the case of EFA, will leak resources.

Zero this stuff out before invoking destroy.

Reported-by: Leon Romanovsky <leonro@mellanox.com>
Fixes: c4367a26357b ("IB: Pass uverbs_attr_bundle down ib_x destroy path")
Reviewed-by: Gal Pressman <galpress@amazon.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/core/rdma_core.h
drivers/infiniband/core/uverbs_cmd.c
drivers/infiniband/core/uverbs_std_types_mr.c