From patchwork Tue Nov 1 20:44:12 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jim Foraker X-Patchwork-Id: 9408027 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 6F5C860234 for ; Tue, 1 Nov 2016 20:54:30 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6403D29A99 for ; Tue, 1 Nov 2016 20:54:30 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 58C7229A9F; Tue, 1 Nov 2016 20:54:30 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CBC7D29A99 for ; Tue, 1 Nov 2016 20:54:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751157AbcKAUy2 (ORCPT ); Tue, 1 Nov 2016 16:54:28 -0400 Received: from prdiron-2.llnl.gov ([128.15.143.172]:33176 "EHLO prdiron-2.llnl.gov" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750979AbcKAUy2 (ORCPT ); Tue, 1 Nov 2016 16:54:28 -0400 X-Greylist: delayed 583 seconds by postgrey-1.27 at vger.kernel.org; Tue, 01 Nov 2016 16:54:28 EDT X-Attachments: Received: from prziron-3.llnl.gov ([128.115.249.86]) by prdiron-2.llnl.gov with ESMTP; 01 Nov 2016 13:44:43 -0700 X-Attachments: IronPort-PHdr: =?us-ascii?q?9a23=3Aus3kfRTpz0qyg8EKD8qwM6xLvdpsv+yvbD5Q0YIu?= =?us-ascii?q?jvd0So/mwa64YxeN2/xhgRfzUJnB7Loc0qyN4vqmCTVLuM3R+Fk5M7V0Hycfjs?= =?us-ascii?q?sXmwFySOWkMmbcaMDQUiohAc5ZX0Vk9XzoeWJcGcL5ekGA6ibqtW1aJBzzOEJP?= =?us-ascii?q?K/jvHcaK1oLshrr0q8SYOl4YzBOGIppKZC2sqgvQssREyaBDEY0WjiXzn31TZu?= =?us-ascii?q?5NznlpL1/A1zz158O34YIxu38I46Fp34d6XK77Z6U1S6BDRHRjajhtpZ7Wrx2L?= =?us-ascii?q?cS+jrjtZCD1XwVJ0BF3B7RfnTtLrvi7znvRy1TPcPsDsS70wHzO44PRFUhjt3Q?= =?us-ascii?q?UGMnYX93veicFqxPZVpwiopBFlmqbQZIeRcvV5YPWOLpshWWNdU5MJBGR6CYSm?= =?us-ascii?q?Yt5KVrBZMA=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A2G6AQAS/hhY/w07CYZdHAEBBAEBCgEBF?= =?us-ascii?q?wEBBAEBCgEBgn8BAQEBAYFzjTapNoIPggcYhgqCVxQBAQEBAQEBAQEBAQJfKII?= =?us-ascii?q?zBAEVAQSCPVKBUYhUBbhmDCWQJYUUAQSBJQGOIIpSApA1ApACAkmQTh42gRiEe?= =?us-ascii?q?x40hg+BTQEBAQ?= X-IPAS-Result: =?us-ascii?q?A2G6AQAS/hhY/w07CYZdHAEBBAEBCgEBFwEBBAEBCgEBgn8?= =?us-ascii?q?BAQEBAYFzjTapNoIPggcYhgqCVxQBAQEBAQEBAQEBAQJfKIIzBAEVAQSCPVKBU?= =?us-ascii?q?YhUBbhmDCWQJYUUAQSBJQGOIIpSApA1ApACAkmQTh42gRiEex40hg+BTQEBAQ?= Received: from hype355-pub.llnl.gov (HELO hype355.llnl.gov) ([134.9.59.13]) by prziron-3.llnl.gov with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 01 Nov 2016 13:44:43 -0700 Received: from hype355.llnl.gov (hype355.llnl.gov [192.168.121.156]) by hype355.llnl.gov (8.14.4/8.14.4) with ESMTP id uA1Kigju147389; Tue, 1 Nov 2016 13:44:42 -0700 Received: (from foraker1@localhost) by hype355.llnl.gov (8.14.4/8.14.4/Submit) id uA1KigiM147388; Tue, 1 Nov 2016 13:44:42 -0700 From: Jim Foraker To: linux-rdma@vger.kernel.org Cc: Dennis Dalessandro , Jim Foraker Subject: [PATCH] IB/rdmavt: Only put mmap_info ref if it exists Date: Tue, 1 Nov 2016 13:44:12 -0700 Message-Id: <1478033052-147252-1-git-send-email-foraker1@llnl.gov> X-Mailer: git-send-email 1.7.1 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP rvt_create_qp() creates qp->ip only when a qp creation request comes from userspace (udata is not NULL). If we exceed the number of available queue pairs however, the error path always attempts to put a kref to this structure. If the requestor is inside the kernel, this leads to a crash. We fix this by checking that qp->ip is not NULL before caling kref_put(). Signed-off-by: Jim Foraker Acked-by: Dennis Dalessandro Acked-by: Jonathan Toppins Acked-by: Alex Estrin --- drivers/infiniband/sw/rdmavt/qp.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c index 6500c3b..0004e8b 100644 --- a/drivers/infiniband/sw/rdmavt/qp.c +++ b/drivers/infiniband/sw/rdmavt/qp.c @@ -884,7 +884,8 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd, return ret; bail_ip: - kref_put(&qp->ip->ref, rvt_release_mmap_info); + if (qp->ip) + kref_put(&qp->ip->ref, rvt_release_mmap_info); bail_qpn: free_qpn(&rdi->qp_dev->qpn_table, qp->ibqp.qp_num);