Commit 38d5af95 authored by Sean Hefty's avatar Sean Hefty Committed by Roland Dreier
Browse files

IB/mad: Fix address handle leak in mad_rmpp

The address handle associated with dual-sided RMPP direction switch
ACKs is never destroyed.  Free the AH for ACKs which fall into this

Problem was reported by Dotan Barak <>.

Signed-off-by: default avatarSean Hefty <>
Signed-off-by: default avatarRoland Dreier <>
parent 8fc394b1
......@@ -163,8 +163,10 @@ static struct ib_mad_send_buf *alloc_response_msg(struct ib_mad_agent *agent,
hdr_len, 0, GFP_KERNEL);
if (IS_ERR(msg))
else {
msg->ah = ah;
msg->context[0] = ah;
return msg;
......@@ -197,9 +199,7 @@ static void ack_ds_ack(struct ib_mad_agent_private *agent,
void ib_rmpp_send_handler(struct ib_mad_send_wc *mad_send_wc)
struct ib_rmpp_mad *rmpp_mad = mad_send_wc->send_buf->mad;
if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_ACK)
if (mad_send_wc->send_buf->context[0] == mad_send_wc->send_buf->ah)
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment