[PATCH] RDMA/qedr: Unwind user queue setup if doorbell recovery setup fails

[Wentao Liang <vulab@iscas.ac.cn>]

qedr_init_user_queue() pins user memory and allocates its PBL before
initializing the doorbell recovery record. If the last step fails, it
returns directly without releasing either resource. The CQ and QP
creation callers treat this as a failed queue initialization and do not
release that queue, leaving its user pages pinned and PBL storage leaked.

Free the PBL on doorbell recovery setup failure, then use the existing
umem cleanup. Match the PBL allocation mode: RoCE uses the populated PBL
allocator, while the other path allocates only the table descriptor.
Clear the freed pointer as well.

Fixes: 97f612509294 ("RDMA/qedr: Add doorbell overflow recovery support")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/infiniband/hw/qedr/verbs.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 3c777bfdef8f..f7a4b2bd7398 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -818,7 +818,15 @@ static inline int qedr_init_user_queue(struct ib_udata *udata,
 	}
 
 	/* mmap the user address used to store doorbell data for recovery */
-	return qedr_init_user_db_rec(udata, dev, q, requires_db_rec);
+	rc = qedr_init_user_db_rec(udata, dev, q, requires_db_rec);
+	if (!rc)
+		return 0;
+
+	if (alloc_and_init)
+		qedr_free_pbl(dev, &q->pbl_info, q->pbl_tbl);
+	else
+		kfree(q->pbl_tbl);
+	q->pbl_tbl = NULL;
 
 err0:
 	ib_umem_release(q->umem);
-- 
2.34.1