Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f83b2561 authored by Bart Van Assche's avatar Bart Van Assche Committed by Doug Ledford
Browse files

IB/srp: Fix srp_create_target() error handling 



Avoid that the following kernel oops occurs if memory pool
allocation fails:

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<ffffffffa048d0a0>] ib_drain_rq+0x0/0x20 [ib_core]
Call Trace:
 [<ffffffffa04af386>] srp_create_target+0xca6/0x13a9 [ib_srp]
 [<ffffffff813cc863>] dev_attr_store+0x13/0x20
 [<ffffffff81214b50>] sysfs_kf_write+0x40/0x50
 [<ffffffff81213f1c>] kernfs_fop_write+0x13c/0x180
 [<ffffffff81197683>] __vfs_write+0x23/0xf0
 [<ffffffff81198744>] vfs_write+0xa4/0x1a0
 [<ffffffff81199a44>] SyS_write+0x44/0xa0
 [<ffffffff8159e3e9>] entry_SYSCALL_64_fastpath+0x1c/0xac

Fixes: 1dc7b1f1 ("IB/srp: use the new CQ API")
Signed-off-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Tested-by: default avatarLaurence Oberman <loberman@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Sagi Grimberg <sagi@grimberg.me>
Cc: <stable@vger.kernel.org> # v4.5+
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 9d8e7d0d

drivers/infiniband/ulp/srp/ib_srp.c

+7 −7
Original line number Diff line number Diff line
@@ -447,16 +447,16 @@ static struct srp_fr_pool *srp_alloc_fr_pool(struct srp_target_port *target) 


/**

 * srp_destroy_qp() - destroy an RDMA queue pair

 * @ch: SRP RDMA channel.

 * @qp: RDMA queue pair.

 *

 * Drain the qp before destroying it.  This avoids that the receive

 * completion handler can access the queue pair while it is

 * being destroyed.

 */

static void srp_destroy_qp(struct srp_rdma_ch *ch)

static void srp_destroy_qp(struct ib_qp *qp)

{

	ib_drain_rq(ch->qp);

	ib_destroy_qp(ch->qp);

	ib_drain_rq(qp);

	ib_destroy_qp(qp);

}



static int srp_create_ch_ib(struct srp_rdma_ch *ch)
@@ -529,7 +529,7 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch) 
	}



	if (ch->qp)

		srp_destroy_qp(ch);

		srp_destroy_qp(ch->qp);

	if (ch->recv_cq)

		ib_free_cq(ch->recv_cq);

	if (ch->send_cq)
@@ -553,7 +553,7 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch) 
	return 0;



err_qp:

	srp_destroy_qp(ch);

	srp_destroy_qp(qp);



err_send_cq:

	ib_free_cq(send_cq);
@@ -596,7 +596,7 @@ static void srp_free_ch_ib(struct srp_target_port *target, 
			ib_destroy_fmr_pool(ch->fmr_pool);

	}



	srp_destroy_qp(ch);

	srp_destroy_qp(ch->qp);

	ib_free_cq(ch->send_cq);

	ib_free_cq(ch->recv_cq);