Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ec924b47 authored by Michael S. Tsirkin's avatar Michael S. Tsirkin Committed by Roland Dreier
Browse files

IB/uverbs: Fix unlocking in error paths 



ib_uverbs_create_ah() and ib_uverbs_create_srq() did not release the
PD's read lock in their error paths, which lead to deadlock when
destroying the PD.

Signed-off-by: default avatarMichael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent abb5a5cc

drivers/infiniband/core/uverbs_cmd.c

+8 −2
Original line number Diff line number Diff line
@@ -1775,7 +1775,7 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file, 
	ah = ib_create_ah(pd, &attr);

	if (IS_ERR(ah)) {

		ret = PTR_ERR(ah);

		goto err;

		goto err_put;

	}



	ah->uobject  = uobj;
@@ -1811,6 +1811,9 @@ err_copy: 
err_destroy:

	ib_destroy_ah(ah);



err_put:

	put_pd_read(pd);



err:

	put_uobj_write(uobj);

	return ret;
@@ -1984,7 +1987,7 @@ ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file, 
	srq = pd->device->create_srq(pd, &attr, &udata);

	if (IS_ERR(srq)) {

		ret = PTR_ERR(srq);

		goto err;

		goto err_put;

	}



	srq->device    	   = pd->device;
@@ -2029,6 +2032,9 @@ err_copy: 
err_destroy:

	ib_destroy_srq(srq);



err_put:

	put_pd_read(pd);



err:

	put_uobj_write(&obj->uobject);

	return ret;