On Wed, May 06, 2020 at 11:24:43AM +0300, Leon Romanovsky wrote: > +static int UVERBS_HANDLER(UVERBS_METHOD_WQ_CREATE)( > + struct uverbs_attr_bundle *attrs) > +{ > + struct ib_uwq_object *obj = container_of( > + uverbs_attr_get_uobject(attrs, UVERBS_ATTR_CREATE_WQ_HANDLE), > + typeof(*obj), uevent.uobject); > + struct ib_pd *pd = > + uverbs_attr_get_obj(attrs, UVERBS_ATTR_CREATE_WQ_PD_HANDLE); > + struct ib_cq *cq = > + uverbs_attr_get_obj(attrs, UVERBS_ATTR_CREATE_WQ_CQ_HANDLE); > + struct ib_wq_init_attr wq_init_attr = {}; > + struct ib_wq *wq; > + u64 user_handle; > + int ret; > + > + ret = uverbs_get_flags32(&wq_init_attr.create_flags, attrs, > + UVERBS_ATTR_CREATE_WQ_FLAGS, > + IB_UVERBS_WQ_FLAGS_CVLAN_STRIPPING | > + IB_UVERBS_WQ_FLAGS_SCATTER_FCS | > + IB_UVERBS_WQ_FLAGS_DELAY_DROP | > + IB_UVERBS_WQ_FLAGS_PCI_WRITE_END_PADDING); > + if (!ret) > + ret = uverbs_copy_from(&wq_init_attr.max_sge, attrs, > + UVERBS_ATTR_CREATE_WQ_MAX_SGE); > + if (!ret) > + ret = uverbs_copy_from(&wq_init_attr.max_wr, attrs, > + UVERBS_ATTR_CREATE_WQ_MAX_WR); > + if (!ret) > + ret = uverbs_copy_from(&user_handle, attrs, > + UVERBS_ATTR_CREATE_WQ_USER_HANDLE); > + if (!ret) > + ret = uverbs_get_const(&wq_init_attr.wq_type, attrs, > + UVERBS_ATTR_CREATE_WQ_TYPE); > + if (ret) > + return ret; > + > + if (wq_init_attr.wq_type != IB_WQT_RQ) > + return -EINVAL; > + > + obj->uevent.event_file = ib_uverbs_get_async_event(attrs, > + UVERBS_ATTR_CREATE_WQ_EVENT_FD); > + obj->uevent.uobject.user_handle = user_handle; > + INIT_LIST_HEAD(&obj->uevent.event_list); > + wq_init_attr.event_handler = ib_uverbs_wq_event_handler; > + wq_init_attr.wq_context = attrs->ufile; > + wq_init_attr.cq = cq; > + > + wq = pd->device->ops.create_wq(pd, &wq_init_attr, &attrs->driver_udata); > + if (IS_ERR(wq)) { > + ret = PTR_ERR(wq); > + goto err; > + } > + > + uverbs_finalize_uobj_create(attrs, UVERBS_ATTR_CREATE_WQ_HANDLE); The object should be really finalized before calling this, ie all of this stuff: > + obj->uevent.uobject.object = wq; > + wq->wq_type = wq_init_attr.wq_type; > + wq->cq = cq; > + wq->pd = pd; > + wq->device = pd->device; > + wq->wq_context = wq_init_attr.wq_context; > + atomic_set(&wq->usecnt, 0); > + atomic_inc(&pd->usecnt); > + atomic_inc(&cq->usecnt); > + wq->uobject = obj; Should be before. Same remark for the other patches Jason