Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a793097d authored by Bernard Metzler's avatar Bernard Metzler Committed by Greg Kroah-Hartman
Browse files

RDMA/siw: Fix failure handling during device creation 

commit 12e5eef0f4d8087ea7b559f6630be08ffea2d851 upstream.

A failing call to ib_device_set_netdev() during device creation caused
system crash due to xa_destroy of uninitialized xarray hit by device
deallocation. Fixed by moving xarray initialization before potential
device deallocation.

Fixes: bdcf26bf ("rdma/siw: network and RDMA core interface")
Link: https://lore.kernel.org/r/20200302155814.9896-1-bmt@zurich.ibm.com


Reported-by: default avatar <syzbot+2e80962bedd9559fe0b3@syzkaller.appspotmail.com>
Signed-off-by: default avatarBernard Metzler <bmt@zurich.ibm.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 10faa91c

drivers/infiniband/sw/siw/siw_main.c

+3 −3
Original line number Diff line number Diff line
@@ -379,6 +379,9 @@ static struct siw_device *siw_device_create(struct net_device *netdev) 
	base_dev->dev.dma_ops = &dma_virt_ops;

	base_dev->num_comp_vectors = num_possible_cpus();



	xa_init_flags(&sdev->qp_xa, XA_FLAGS_ALLOC1);

	xa_init_flags(&sdev->mem_xa, XA_FLAGS_ALLOC1);



	ib_set_device_ops(base_dev, &siw_device_ops);

	rv = ib_device_set_netdev(base_dev, netdev, 1);

	if (rv)
@@ -406,9 +409,6 @@ static struct siw_device *siw_device_create(struct net_device *netdev) 
	sdev->attrs.max_srq_wr = SIW_MAX_SRQ_WR;

	sdev->attrs.max_srq_sge = SIW_MAX_SGE;



	xa_init_flags(&sdev->qp_xa, XA_FLAGS_ALLOC1);

	xa_init_flags(&sdev->mem_xa, XA_FLAGS_ALLOC1);



	INIT_LIST_HEAD(&sdev->cep_list);

	INIT_LIST_HEAD(&sdev->qp_list);