On Mon, Mar 22, 2021 at 06:53:55AM -0700, Lv Yunlong wrote: > The device is got by isert_device_get() with refcount is 1, > and is assigned to isert_conn by isert_conn->device = device. > When isert_create_qp() failed, device will be freed with > isert_device_put(). > > Later, the device is used in isert_free_login_buf(isert_conn) > by the isert_conn->device->ib_device statement. My patch > exchanges the callees order to free the device late. > > Signed-off-by: Lv Yunlong <lyl2019@xxxxxxxxxxxxxxxx> > --- > drivers/infiniband/ulp/isert/ib_isert.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) The fix needs to be change of isert_free_login_buf() from isert_free_login_buf(isert_conn) to be isert_free_login_buf(isert_conn, cma_id->device) Thanks > > diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c > index 7305ed8976c2..d8a533e346b0 100644 > --- a/drivers/infiniband/ulp/isert/ib_isert.c > +++ b/drivers/infiniband/ulp/isert/ib_isert.c > @@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) > > out_destroy_qp: > isert_destroy_qp(isert_conn); > -out_conn_dev: > - isert_device_put(device); > out_rsp_dma_map: > isert_free_login_buf(isert_conn); > +out_conn_dev: > + isert_device_put(device); > out: > kfree(isert_conn); > rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED); > -- > 2.25.1 > >
