raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 18:09:56 +00:00
Code Issues Projects Releases Wiki Activity

RDMA/mlx5: Fix UMR cleanup on error flow of driver init

Browse Source 
The cited commit removed from the cleanup flow of umr the checks
if the resources were created. This could lead to null-ptr-deref
in case that we had failure in mlx5_ib_stage_ib_reg_init stage.

Fix it by adding new state to the umr that can say if the resources
were created or not and check it in the umr cleanup flow before
destroying the resources.

Fixes: 04876c12c1 ("RDMA/mlx5: Move init and cleanup of UMR to umr.c")
Reviewed-by: Michael Guralnik <michaelgur@nvidia.com>
Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
Link: https://lore.kernel.org/r/4cfa61386cf202e9ce330e8d228ce3b25a36326e.1661763459.git.leonro@nvidia.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
This commit is contained in:
Maor Gottlieb
2022-08-29 12:02:29 +03:00
committed by Leon Romanovsky
parent 74b30b3ad5
commit 9b7d4be967
2 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/infiniband/hw/mlx5/mlx5_ib.h
View File

@@ -708,6 +708,7 @@ struct mlx5_ib_umr_context {
}; };
enum { enum {
MLX5_UMR_STATE_UNINIT,
MLX5_UMR_STATE_ACTIVE, MLX5_UMR_STATE_ACTIVE,
MLX5_UMR_STATE_RECOVER, MLX5_UMR_STATE_RECOVER,
MLX5_UMR_STATE_ERR, MLX5_UMR_STATE_ERR,

3
drivers/infiniband/hw/mlx5/umr.c
View File

@@ -177,6 +177,7 @@ int mlx5r_umr_resource_init(struct mlx5_ib_dev *dev)
sema_init(&dev->umrc.sem, MAX_UMR_WR); sema_init(&dev->umrc.sem, MAX_UMR_WR);
mutex_init(&dev->umrc.lock); mutex_init(&dev->umrc.lock);
dev->umrc.state = MLX5_UMR_STATE_ACTIVE;
return 0; return 0;
@@ -191,6 +192,8 @@ destroy_pd:
void mlx5r_umr_resource_cleanup(struct mlx5_ib_dev *dev) void mlx5r_umr_resource_cleanup(struct mlx5_ib_dev *dev)
{ {
if (dev->umrc.state == MLX5_UMR_STATE_UNINIT)
return;
ib_destroy_qp(dev->umrc.qp); ib_destroy_qp(dev->umrc.qp);
ib_free_cq(dev->umrc.cq); ib_free_cq(dev->umrc.cq);
ib_dealloc_pd(dev->umrc.pd); ib_dealloc_pd(dev->umrc.pd);