diff mbox

[V2] IB/srp: Fix NULL deref at srp_destroy_qp()

Message ID 1494517956-26669-1-git-send-email-israelr@mellanox.com (mailing list archive)
State Accepted
Headers show

Commit Message

Israel Rukshin May 11, 2017, 3:52 p.m. UTC
If srp_init_qp() fails at srp_create_ch_ib() then ch->send_cq
may be NULL.
Calling directly to ib_destroy_qp() is sufficient because
no work requests were posted on the created qp.

Fixes: 9294000d6d89 ("IB/srp: Drain the send queue before destroying a QP")
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Cc: <stable@vger.kernel.org>
---

v2 change:
-add Fixes to commit message

 drivers/infiniband/ulp/srp/ib_srp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Bart Van Assche May 11, 2017, 4:06 p.m. UTC | #1
On Thu, 2017-05-11 at 18:52 +0300, Israel Rukshin wrote:
> If srp_init_qp() fails at srp_create_ch_ib() then ch->send_cq
> may be NULL.
> Calling directly to ib_destroy_qp() is sufficient because
> no work requests were posted on the created qp.

Reviewed-by: Bart van Assche <bart.vanassche@sandisk.com>--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Doug Ledford June 1, 2017, 10:10 p.m. UTC | #2
On Thu, 2017-05-11 at 18:52 +0300, Israel Rukshin wrote:
> If srp_init_qp() fails at srp_create_ch_ib() then ch->send_cq
> may be NULL.
> Calling directly to ib_destroy_qp() is sufficient because
> no work requests were posted on the created qp.
> 
> Fixes: 9294000d6d89 ("IB/srp: Drain the send queue before destroying
> a QP")
> Signed-off-by: Israel Rukshin <israelr@mellanox.com>
> Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
> Cc: <stable@vger.kernel.org>

Thanks, applied.
diff mbox

Patch

diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index def723a..4306285 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -575,7 +575,7 @@  static int srp_create_ch_ib(struct srp_rdma_ch *ch)
 	return 0;
 
 err_qp:
-	srp_destroy_qp(ch, qp);
+	ib_destroy_qp(qp);
 
 err_send_cq:
 	ib_free_cq(send_cq);