IB/rxe: put the pool on allocation failure

If the allocation of elem fails, it is not sufficient to simply check
for NULL and return.  We need to also put our reference on the pool or
else we will leave the pool with a permanent ref count and we will never
be able to free it.

Fixes: 4831ca9e4a8e ("IB/rxe: check for allocation failure on elem")
Suggested-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>

diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c
index 3b4916680018a7c273d3b03f5a116cd4ffb4c9d8..b4a8acc7bb7d62fb479473df7ec6aaacde86e533 100644 (file)
--- a/drivers/infiniband/sw/rxe/rxe_pool.c
+++ b/drivers/infiniband/sw/rxe/rxe_pool.c
@@ -394,23 +394,25 @@ void *rxe_alloc(struct rxe_pool *pool)
 
        kref_get(&pool->rxe->ref_cnt);
 
-       if (atomic_inc_return(&pool->num_elem) > pool->max_elem) {
-               atomic_dec(&pool->num_elem);
-               rxe_dev_put(pool->rxe);
-               rxe_pool_put(pool);
-               return NULL;
-       }
+       if (atomic_inc_return(&pool->num_elem) > pool->max_elem)
+               goto out_put_pool;
 
        elem = kmem_cache_zalloc(pool_cache(pool),
                                 (pool->flags & RXE_POOL_ATOMIC) ?
                                 GFP_ATOMIC : GFP_KERNEL);
        if (!elem)
-               return NULL;
+               goto out_put_pool;
 
        elem->pool = pool;
        kref_init(&elem->ref_cnt);
 
        return elem;
+
+out_put_pool:
+       atomic_dec(&pool->num_elem);
+       rxe_dev_put(pool->rxe);
+       rxe_pool_put(pool);
+       return NULL;
 }
 
 void rxe_elem_release(struct kref *kref)