From: Li RongQing <lirongqing@baidu.com>

iser_send_data_out() maps the tx_desc header for DMA via
iser_initialize_task_headers() (which sets tx_desc->mapped and calls
ib_dma_map_single()).  The normal completion path hands unmap and free
off to the iser_dataout_comp() completion callback.

However, if a later step fails -- the bounds check
(buf_offset + data_seg_len > data_len) or iser_post_send() -- control
jumps to send_data_out_error, which only calls kmem_cache_free() without
ib_dma_unmap_single().  Because the WR was never posted, the completion
callback never fires to unmap it, so the DMA mapping is leaked.

Unmap the header DMA in the error path when tx_desc->mapped is set,
mirroring the pattern already used in iscsi_iser_cleanup_task().

Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/infiniband/ulp/iser/iser_initiator.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index 7ea6888..9685e0a 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -464,6 +464,10 @@ int iser_send_data_out(struct iscsi_conn *conn, struct iscsi_task *task,
 		return 0;
 
 send_data_out_error:
+	if (tx_desc->mapped)
+		ib_dma_unmap_single(iser_conn->ib_conn.device->ib_device,
+				    tx_desc->dma_addr, ISER_HEADERS_LEN,
+				    DMA_TO_DEVICE);
 	kmem_cache_free(ig.desc_cache, tx_desc);
 	iser_err("conn %p failed err %d\n", conn, err);
 	return err;
-- 
2.9.4