[PATCH] RDMA/irdma: Free IRQ when CEQ vector mapping fails

[Serhat Kumral]

irdma_cfg_ceq_vector() registers an IRQ handler before requesting the
CEQ-to-vector mapping through the virtual channel. If the mapping
fails, the function returns without releasing the IRQ resources.
The caller destroys the CEQ, leaving the IRQ handler registered
and potentially referencing freed memory.

Call irdma_destroy_irq() on mapping failure to release
the IRQ resources and drain the associated tasklet
before the caller destroys the CEQ. Use the same dev_id
passed to request_irq(), accounting for CEQ0 sharing
its interrupt vector with the AEQ.

Fixes: b800e82feba7 ("RDMA/irdma: Add GEN3 support for AEQ and CEQ")
Signed-off-by: Serhat Kumral <serhatkumral1@xxxxxxxxx>
Assisted-by: Claude:claude-opus-5
---
Found by smatch:
.../drivers/infiniband/hw/irdma/hw.c:1261 irdma_cfg_ceq_vector() warn: 'msix_vec->irq' from request_irq() not released on lines: 1261.

I performed only compilation test, it hasn't been tested on hardware. 

 drivers/infiniband/hw/irdma/hw.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c
index cae4f316def4..522a1685d400 100644
--- a/drivers/infiniband/hw/irdma/hw.c
+++ b/drivers/infiniband/hw/irdma/hw.c
@@ -1252,12 +1252,20 @@ static int irdma_cfg_ceq_vector(struct irdma_pci_f *rf, struct irdma_ceq *iwceq,
 	}
 
 	msix_vec->ceq_id = ceq_id;
-	if (rf->sc_dev.privileged)
+	if (rf->sc_dev.privileged) {
 		rf->sc_dev.irq_ops->irdma_cfg_ceq(&rf->sc_dev, ceq_id,
 						  msix_vec->idx, true);
-	else
+	} else {
 		status = irdma_vchnl_req_ceq_vec_map(&rf->sc_dev, ceq_id,
 						     msix_vec->idx);
+		if (status) {
+			void *dev_id = (rf->msix_shared && !ceq_id) ?
+				(void *)rf : (void *)iwceq;
+
+			irdma_destroy_irq(rf, msix_vec, dev_id);
+		}
+	}
+
 	return status;
 }
 
-- 
2.53.0