IB/mthca: Free correct MPT on error exit from mthca_fmr_alloc()

When mthca_fmr_alloc() returns an error, it should free the MPT at the
index key, not mr->ibmr.lkey, since the lkey has been mangled by
hw_index_to_key() and no longer is the real index.  This bug causes
corruption of the MPT table free bitmap when mthca_fmr_alloc() fails.

Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index 3b6985557cb21cb77cc05df345a9dfb8dd573d3d..3538da16e3fe9ec4cea862fa7b0100fb3d3225c7 100644 (file)
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -686,7 +686,7 @@ err_out_table:
        mthca_table_put(dev, dev->mr_table.mpt_table, key);
 
 err_out_mpt_free:
-       mthca_free(&dev->mr_table.mpt_alloc, mr->ibmr.lkey);
+       mthca_free(&dev->mr_table.mpt_alloc, key);
        return err;
 }