Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c2bb5628 authored by Erez Shitrit's avatar Erez Shitrit Committed by Roland Dreier
Browse files

IPoIB: Fix crash in dev_open error flow 



If napi has never been enabled when calling ipoib_ib_dev_stop, a
kernel crash occurs, because the verbs layer completion handler
(ipoib_ib_completion) calls napi_schedule unconditionally.

If the napi structure passed in the napi_schedule call has not
been initialized, napi will crash.

The cleanest solution is to simply enable napi before calling
ipoib_ib_dev_stop in the dev_open error flow. (dev_stop then
immediately disables napi).

Signed-off-by: default avatarJack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: default avatarErez Shitrit <erezsh@mellanox.com>
Signed-off-by: default avatarOr Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent 959f5854

drivers/infiniband/ulp/ipoib/ipoib_ib.c

+7 −4
Original line number Diff line number Diff line
@@ -685,15 +685,13 @@ int ipoib_ib_dev_open(struct net_device *dev) 
	ret = ipoib_ib_post_receives(dev);

	if (ret) {

		ipoib_warn(priv, "ipoib_ib_post_receives returned %d\n", ret);

		ipoib_ib_dev_stop(dev, 1);

		return -1;

		goto dev_stop;

	}



	ret = ipoib_cm_dev_open(dev);

	if (ret) {

		ipoib_warn(priv, "ipoib_cm_dev_open returned %d\n", ret);

		ipoib_ib_dev_stop(dev, 1);

		return -1;

		goto dev_stop;

	}



	clear_bit(IPOIB_STOP_REAPER, &priv->flags);
@@ -704,6 +702,11 @@ int ipoib_ib_dev_open(struct net_device *dev) 
		napi_enable(&priv->napi);



	return 0;

dev_stop:

	if (!test_and_set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags))

		napi_enable(&priv->napi);

	ipoib_ib_dev_stop(dev, 1);

	return -1;

}



static void ipoib_pkey_dev_check_presence(struct net_device *dev)