From: wenglianfa <wenglianfa@huawei.com> rinl_buf->wqe_list will be double-freed in error flow, first in alloc_recv_rinl_buf() and then in free_recv_rinl_buf(). Actually free_recv_rinl_buf() shouldn't be called when alloc_recv_rinl_buf() failed. Fixes: 83b0baff3ccf ("libhns: Refactor rq inline") Signed-off-by: wenglianfa <wenglianfa@huawei.com> Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com> --- providers/hns/hns_roce_u_verbs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index 132fcaeba..a906e8d58 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -1256,12 +1256,13 @@ static int qp_alloc_wqe(struct ibv_qp_cap *cap, struct hns_roce_qp *qp, } if (hns_roce_alloc_buf(&qp->buf, qp->buf_size, HNS_HW_PAGE_SIZE)) - goto err_alloc; + goto err_alloc_recv_rinl_buf; return 0; -err_alloc: +err_alloc_recv_rinl_buf: free_recv_rinl_buf(&qp->rq_rinl_buf); +err_alloc: if (qp->rq.wrid) free(qp->rq.wrid); -- 2.33.0