| Message ID | 57327940.3030206@sandisk.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
On Tue, May 10, 2016 at 05:13:52PM -0700, Bart Van Assche wrote: > Avoid that the following kernel oops occurs if memory pool > allocation fails: > > BUG: unable to handle kernel NULL pointer dereference at (null) > IP: [<ffffffffa048d0a0>] ib_drain_rq+0x0/0x20 [ib_core] > Call Trace: > [<ffffffffa04af386>] srp_create_target+0xca6/0x13a9 [ib_srp] > [<ffffffff813cc863>] dev_attr_store+0x13/0x20 > [<ffffffff81214b50>] sysfs_kf_write+0x40/0x50 > [<ffffffff81213f1c>] kernfs_fop_write+0x13c/0x180 > [<ffffffff81197683>] __vfs_write+0x23/0xf0 > [<ffffffff81198744>] vfs_write+0xa4/0x1a0 > [<ffffffff81199a44>] SyS_write+0x44/0xa0 > [<ffffffff8159e3e9>] entry_SYSCALL_64_fastpath+0x1c/0xac > > Fixes: 1dc7b1f10dcb ("IB/srp: use the new CQ API") > Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> > Cc: Christoph Hellwig <hch@lst.de> > Cc: Sagi Grimberg <sagi@grimberg.me> > Cc: Laurence Oberman <loberman@redhat.com> > Cc: <stable@vger.kernel.org> # v4.5+ Looks good, Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 74e3ec8..f4dc6f9 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -447,16 +447,16 @@ static struct srp_fr_pool *srp_alloc_fr_pool(struct srp_target_port *target) /** * srp_destroy_qp() - destroy an RDMA queue pair - * @ch: SRP RDMA channel. + * @qp: RDMA queue pair. * * Drain the qp before destroying it. This avoids that the receive * completion handler can access the queue pair while it is * being destroyed. */ -static void srp_destroy_qp(struct srp_rdma_ch *ch) +static void srp_destroy_qp(struct ib_qp *qp) { - ib_drain_rq(ch->qp); - ib_destroy_qp(ch->qp); + ib_drain_rq(qp); + ib_destroy_qp(qp); } static int srp_create_ch_ib(struct srp_rdma_ch *ch) @@ -529,7 +529,7 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch) } if (ch->qp) - srp_destroy_qp(ch); + srp_destroy_qp(ch->qp); if (ch->recv_cq) ib_free_cq(ch->recv_cq); if (ch->send_cq) @@ -553,7 +553,7 @@ static int srp_create_ch_ib(struct srp_rdma_ch *ch) return 0; err_qp: - srp_destroy_qp(ch); + srp_destroy_qp(qp); err_send_cq: ib_free_cq(send_cq); @@ -596,7 +596,7 @@ static void srp_free_ch_ib(struct srp_target_port *target, ib_destroy_fmr_pool(ch->fmr_pool); } - srp_destroy_qp(ch); + srp_destroy_qp(ch->qp); ib_free_cq(ch->send_cq); ib_free_cq(ch->recv_cq);
Avoid that the following kernel oops occurs if memory pool allocation fails: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffffa048d0a0>] ib_drain_rq+0x0/0x20 [ib_core] Call Trace: [<ffffffffa04af386>] srp_create_target+0xca6/0x13a9 [ib_srp] [<ffffffff813cc863>] dev_attr_store+0x13/0x20 [<ffffffff81214b50>] sysfs_kf_write+0x40/0x50 [<ffffffff81213f1c>] kernfs_fop_write+0x13c/0x180 [<ffffffff81197683>] __vfs_write+0x23/0xf0 [<ffffffff81198744>] vfs_write+0xa4/0x1a0 [<ffffffff81199a44>] SyS_write+0x44/0xa0 [<ffffffff8159e3e9>] entry_SYSCALL_64_fastpath+0x1c/0xac Fixes: 1dc7b1f10dcb ("IB/srp: use the new CQ API") Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Sagi Grimberg <sagi@grimberg.me> Cc: Laurence Oberman <loberman@redhat.com> Cc: <stable@vger.kernel.org> # v4.5+ --- drivers/infiniband/ulp/srp/ib_srp.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)