On Tue, Nov 01, 2016 at 01:44:12PM -0700, Jim Foraker wrote: > rvt_create_qp() creates qp->ip only when a qp creation request comes from > userspace (udata is not NULL). If we exceed the number of available > queue pairs however, the error path always attempts to put a kref to this > structure. If the requestor is inside the kernel, this leads to a crash. It will be great to have a crash report if you have one. > > We fix this by checking that qp->ip is not NULL before caling kref_put(). > Please add Fixes line which refers to the commit you are fixing. It will ensure automatic pickup to various stable trees. Thanks > Signed-off-by: Jim Foraker <foraker1@xxxxxxxx> > --- > drivers/infiniband/sw/rdmavt/qp.c | 3 ++- > 1 files changed, 2 insertions(+), 1 deletions(-) > > diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c > index 6500c3b..0004e8b 100644 > --- a/drivers/infiniband/sw/rdmavt/qp.c > +++ b/drivers/infiniband/sw/rdmavt/qp.c > @@ -884,7 +884,8 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd, > return ret; > > bail_ip: > - kref_put(&qp->ip->ref, rvt_release_mmap_info); > + if (qp->ip) > + kref_put(&qp->ip->ref, rvt_release_mmap_info); > > bail_qpn: > free_qpn(&rdi->qp_dev->qpn_table, qp->ibqp.qp_num); > -- > 1.7.1 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-rdma" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html
Attachment:
signature.asc
Description: PGP signature
