In the error path of qedr_alloc_pbl_tbl(), a loop calls
dma_free_coherent() to release previously allocated PBL pages.
However, after the loop, qedr_free_pbl() is called, which attempts
to free the same pages again, resulting in a double-free.

The qedr_free_pbl() function checks if the page pointer is NULL before
freeing. Fix this by setting pbl_table[i].va to NULL after it is freed
in the error-handling loop, thus preventing the subsequent double-free.

Fixes: a7efd7773e31b ("qedr: Add support for PD,PKEY and CQ verbs")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
---
 drivers/infiniband/hw/qedr/verbs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index ab9bf0922979..2dd005a97688 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -561,9 +561,11 @@ static struct qedr_pbl *qedr_alloc_pbl_tbl(struct qedr_dev *dev,
 	return pbl_table;
 
 err:
-	for (i--; i >= 0; i--)
+	for (i--; i >= 0; i--) {
 		dma_free_coherent(&pdev->dev, pbl_info->pbl_size,
 				  pbl_table[i].va, pbl_table[i].pa);
+		pbl_table[i].va = NULL;
+	}
 
 	qedr_free_pbl(dev, pbl_info, pbl_table);
 
-- 
2.34.1