Patch "RDMA/core: Fix null-ptr-deref in ib_core_cleanup()" has been added to the 6.0-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    RDMA/core: Fix null-ptr-deref in ib_core_cleanup()

to the 6.0-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rdma-core-fix-null-ptr-deref-in-ib_core_cleanup.patch
and it can be found in the queue-6.0 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c5d120d0e42e8988bd93f550ab1a80c680581199
Author: Chen Zhongjin <chenzhongjin@xxxxxxxxxx>
Date:   Tue Oct 25 10:41:46 2022 +0800

    RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
    
    [ Upstream commit 07c0d131cc0fe1f3981a42958fc52d573d303d89 ]
    
    KASAN reported a null-ptr-deref error:
    
      KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
      CPU: 1 PID: 379
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
      RIP: 0010:destroy_workqueue+0x2f/0x740
      RSP: 0018:ffff888016137df8 EFLAGS: 00000202
      ...
      Call Trace:
       ib_core_cleanup+0xa/0xa1 [ib_core]
       __do_sys_delete_module.constprop.0+0x34f/0x5b0
       do_syscall_64+0x3a/0x90
       entry_SYSCALL_64_after_hwframe+0x63/0xcd
      RIP: 0033:0x7fa1a0d221b7
      ...
    
    It is because the fail of roce_gid_mgmt_init() is ignored:
    
     ib_core_init()
       roce_gid_mgmt_init()
         gid_cache_wq = alloc_ordered_workqueue # fail
     ...
     ib_core_cleanup()
       roce_gid_mgmt_cleanup()
         destroy_workqueue(gid_cache_wq)
         # destroy an unallocated wq
    
    Fix this by catching the fail of roce_gid_mgmt_init() in ib_core_init().
    
    Fixes: 03db3a2d81e6 ("IB/core: Add RoCE GID table management")
    Signed-off-by: Chen Zhongjin <chenzhongjin@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20221025024146.109137-1-chenzhongjin@xxxxxxxxxx
    Signed-off-by: Leon Romanovsky <leon@xxxxxxxxxx>
    Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index d275db195f1a..4053a09b8d33 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -2815,10 +2815,18 @@ static int __init ib_core_init(void)
 
 	nldev_init();
 	rdma_nl_register(RDMA_NL_LS, ibnl_ls_cb_table);
-	roce_gid_mgmt_init();
+	ret = roce_gid_mgmt_init();
+	if (ret) {
+		pr_warn("Couldn't init RoCE GID management\n");
+		goto err_parent;
+	}
 
 	return 0;
 
+err_parent:
+	rdma_nl_unregister(RDMA_NL_LS);
+	nldev_exit();
+	unregister_pernet_device(&rdma_dev_net_ops);
 err_compat:
 	unregister_blocking_lsm_notifier(&ibdev_lsm_nb);
 err_sa:
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index b92358f606d0..12dc97067ed2 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -2537,7 +2537,7 @@ void __init nldev_init(void)
 	rdma_nl_register(RDMA_NL_NLDEV, nldev_cb_table);
 }
 
-void __exit nldev_exit(void)
+void nldev_exit(void)
 {
 	rdma_nl_unregister(RDMA_NL_NLDEV);
 }