libhns: Fix pad refcnt leaking in error flow of create qp/cq/srq

[ Upstream commit f877d6e ]

Decrease pad refcnt by 1 in error flow of create qp/cq/srq.

Fixes: 8c865c3 ("libhns: Add support for lock-free CQ")
Fixes: 179f015 ("libhns: Add support for lock-free QP")
Fixes: b38bae4 ("libhns: Add support for lock-free SRQ")
Signed-off-by: Junxian Huang <[email protected]>
Signed-off-by: Nicolas Morey <[email protected]>

Author: Junxian Huang

providers/hns/hns_roce_u_verbs.c

@@ -429,12 +429,9 @@ static int verify_cq_create_attr(struct ibv_cq_init_attr_ex *attr,
 	if (!check_comp_mask(attr->wc_flags, CREATE_CQ_SUPPORTED_WC_FLAGS))
 		return EOPNOTSUPP;
 
-	if (attr->comp_mask & IBV_CQ_INIT_ATTR_MASK_PD) {
-		if (!pad) {
-			verbs_err(&context->ibv_ctx, "failed to check the pad of cq.\n");
-			return EINVAL;
-		}
-		atomic_fetch_add(&pad->pd.refcount, 1);
+	if (attr->comp_mask & IBV_CQ_INIT_ATTR_MASK_PD && !pad) {
+		verbs_err(&context->ibv_ctx, "failed to check the pad of cq.\n");
+		return EINVAL;
 	}
 
 	attr->cqe = max_t(uint32_t, HNS_ROCE_MIN_CQE_NUM,
@@ -501,6 +498,7 @@ static int exec_cq_create_cmd(struct ibv_context *context,
 static struct ibv_cq_ex *create_cq(struct ibv_context *context,
 			 struct ibv_cq_init_attr_ex *attr)
 {
+	struct hns_roce_pad *pad = to_hr_pad(attr->parent_domain);
 	struct hns_roce_context *hr_ctx = to_hr_ctx(context);
 	struct hns_roce_cq *cq;
 	int ret;
@@ -515,8 +513,10 @@ static struct ibv_cq_ex *create_cq(struct ibv_context *context,
 		goto err;
 	}
 
-	if (attr->comp_mask & IBV_CQ_INIT_ATTR_MASK_PD)
+	if (attr->comp_mask & IBV_CQ_INIT_ATTR_MASK_PD) {
 		cq->parent_domain = attr->parent_domain;
+		atomic_fetch_add(&pad->pd.refcount, 1);
+	}
 
 	ret = hns_roce_cq_spinlock_init(cq, attr);
 	if (ret)
@@ -550,6 +550,8 @@ static struct ibv_cq_ex *create_cq(struct ibv_context *context,
 err_buf:
 	hns_roce_spinlock_destroy(&cq->hr_lock);
 err_lock:
+	if (attr->comp_mask & IBV_CQ_INIT_ATTR_MASK_PD)
+		atomic_fetch_sub(&pad->pd.refcount, 1);
 	free(cq);
 err:
 	if (ret < 0)
@@ -871,6 +873,8 @@ static struct ibv_srq *create_srq(struct ibv_context *context,
 	hns_roce_spinlock_destroy(&srq->hr_lock);
 
 err_free_srq:
+	if (pad)
+		atomic_fetch_sub(&pad->pd.refcount, 1);
 	free(srq);
 
 err:
@@ -1593,6 +1597,8 @@ static struct ibv_qp *create_qp(struct ibv_context *ibv_ctx,
 err_buf:
 	hns_roce_qp_spinlock_destroy(qp);
 err_spinlock:
+	if (pad)
+		atomic_fetch_sub(&pad->pd.refcount, 1);
 	free(qp);
 err:
 	if (ret < 0)