Fix one potential crash and one real one in ibv_destroy_ah

Signed-off-by: Roland Dreier <rolandd@cisco.com>

2 files changed, 3 insertions, 2 deletions

diff --git a/src/ah.c b/src/ah.c
index 72a7559..fe7ea8b 100644
--- a/src/ah.c
+++ b/src/ah.c
@@ -125,7 +125,8 @@ int mthca_alloc_av(struct mthca_pd *pd, struct ibv_ah_attr *attr,
 				break;
 			}
 
-		ah->key = page->mr->lkey;
+		ah->key  = page->mr->lkey;
+		ah->page = page;
 
 		pthread_mutex_unlock(&pd->ah_mutex);
 	}
diff --git a/src/verbs.c b/src/verbs.c
index 5a6ca26..0bc7baa 100644
--- a/src/verbs.c
+++ b/src/verbs.c
@@ -439,8 +439,8 @@ struct ibv_ah *mthca_create_ah(struct ibv_pd *pd, struct ibv_ah_attr *attr)
 int mthca_destroy_ah(struct ibv_ah *ah)
 {
 	mthca_free_av(to_mah(ah));
+	free(to_mah(ah));
 
-	free(ah);
 	return 0;
 }