File 0043-pvrdma-release-ring-object-in-case-.patch of Package qemu.12238

Overview Repositories Revisions Requests Users Attributes Meta

File 0043-pvrdma-release-ring-object-in-case-.patch of Package qemu.12238

From: Prasad J Pandit <pjp@fedoraproject.org>
Date: Thu, 13 Dec 2018 01:00:37 +0530
Subject: pvrdma: release ring object in case of an error

create_cq and create_qp routines allocate ring object, but it's
not released in case of an error, leading to memory leakage.

Reported-by: Li Qiang <liq3ea@163.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
(cherry picked from commit 509f57c98e7536905bb4902363d0cba66ce7e089)
[BR: BSC#1119991 CVE-2018-20126]
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
 hw/rdma/vmw/pvrdma_cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
index bb9a9f1cd1..785d4d0cfc 100644
--- a/hw/rdma/vmw/pvrdma_cmd.c
+++ b/hw/rdma/vmw/pvrdma_cmd.c
@@ -514,7 +514,7 @@ static int create_qp(PVRDMADev *dev, union pvrdma_cmd_req *req,
                                      cmd->recv_cq_handle, rings, &resp->qpn);
     if (resp->hdr.err) {
         destroy_qp_rings(rings);
-        return rc;
+        return resp->hdr.err;
     }
 
     resp->max_send_wr = cmd->max_send_wr;

Places

File 0043-pvrdma-release-ring-object-in-case-.patch of Package qemu.12238

Places