IB/mlx4: Fix error paths in mlx4_ib_create_flow()
authorRoland Dreier <roland@purestorage.com>
Sat, 30 May 2015 06:11:27 +0000 (23:11 -0700)
committerDoug Ledford <dledford@redhat.com>
Tue, 2 Jun 2015 13:22:31 +0000 (09:22 -0400)
commit1156256811e42908fd13c4cfcf32965d8b93f2a8
tree7ee9400f906c878f8a0eb739dd60a2f9b23c82b5
parent18eaf1f1959add9bbbfa5442fc5d9b59f7d4e1bd
IB/mlx4: Fix error paths in mlx4_ib_create_flow()

The unwinding clean up code are err_create_flow starts at the current
index i.  That means we shouldn't increment i until we're really sure
we won't have to destroy the current flow; otherwise we might
increment the index, fail inside an is_bonded block, and end up
accessing off the end of the reg_id[] array.

This was detected by Coverity (CID 1271229).

Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
drivers/infiniband/hw/mlx4/main.c