libhns: Fix double-free of rinl buf->wqe list

[ Upstream commit 4fe94ae ]

rinl_buf->wqe_list will be double-freed in error flow, first in
alloc_recv_rinl_buf() and then in free_recv_rinl_buf(). Actually
free_recv_rinl_buf() shouldn't be called when alloc_recv_rinl_buf()
failed.

Fixes: 83b0baf ("libhns: Refactor rq inline")
Signed-off-by: wenglianfa <[email protected]>
Signed-off-by: Junxian Huang <[email protected]>
Signed-off-by: Nicolas Morey <[email protected]>

Author: wenglianfa

providers/hns/hns_roce_u_verbs.c

@@ -1211,12 +1211,13 @@ static int qp_alloc_wqe(struct ibv_qp_cap *cap, struct hns_roce_qp *qp,
 	}
 
 	if (hns_roce_alloc_buf(&qp->buf, qp->buf_size, HNS_HW_PAGE_SIZE))
-		goto err_alloc;
+		goto err_alloc_recv_rinl_buf;
 
 	return 0;
 
-err_alloc:
+err_alloc_recv_rinl_buf:
 	free_recv_rinl_buf(&qp->rq_rinl_buf);
+err_alloc:
 	if (qp->rq.wrid)
 		free(qp->rq.wrid);