[PATCH] RDMA/hfi1: Free the trap send buffer when no address handle is available

[Wentao Liang]

send_trap() allocates a MAD send buffer before checking the subnet
manager address handle. If creating that handle fails, or if the subnet
manager LID is permissive, it unlocks and returns without submitting or
freeing the buffer. No send completion can release an unsubmitted MAD.

Free the send buffer after releasing the lock on both early returns,
matching the other failures after ib_create_send_mad().

Fixes: bf90aadd630c ("IB/hfi1: Send MAD traps until repressed")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/infiniband/hw/hfi1/mad.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/infiniband/hw/hfi1/mad.c b/drivers/infiniband/hw/hfi1/mad.c
index 585f1d99b91b..dbc2dd55689e 100644
--- a/drivers/infiniband/hw/hfi1/mad.c
+++ b/drivers/infiniband/hw/hfi1/mad.c
@@ -335,12 +335,14 @@ static void send_trap(struct hfi1_ibport *ibp, struct trap_node *trap)
 			ah = hfi1_create_qp0_ah(ibp, ibp->rvp.sm_lid);
 			if (IS_ERR(ah)) {
 				spin_unlock_irqrestore(&ibp->rvp.lock, flags);
+				ib_free_send_mad(send_buf);
 				return;
 			}
 			send_buf->ah = ah;
 			ibp->rvp.sm_ah = ibah_to_rvtah(ah);
 		} else {
 			spin_unlock_irqrestore(&ibp->rvp.lock, flags);
+			ib_free_send_mad(send_buf);
 			return;
 		}
 	} else {
-- 
2.34.1