releases/4.19.41/ib-core-destroy-qp-if-xrc-qp-fails.patch

   1 From 535005ca8e5e71918d64074032f4b9d4fef8981e Mon Sep 17 00:00:00 2001
   2 From: Yuval Avnery <yuvalav@mellanox.com>
   3 Date: Tue, 22 Jan 2019 09:02:05 +0200
   4 Subject: IB/core: Destroy QP if XRC QP fails
   5
   6 From: Yuval Avnery <yuvalav@mellanox.com>
   7
   8 commit 535005ca8e5e71918d64074032f4b9d4fef8981e upstream.
   9
  10 The open-coded variant missed destroy of SELinux created QP, reuse already
  11 existing ib_detroy_qp() call and use this opportunity to clean
  12 ib_create_qp() from double prints and unclear exit paths.
  13
  14 Reported-by: Parav Pandit <parav@mellanox.com>
  15 Fixes: d291f1a65232 ("IB/core: Enforce PKey security on QPs")
  16 Signed-off-by: Yuval Avnery <yuvalav@mellanox.com>
  17 Reviewed-by: Parav Pandit <parav@mellanox.com>
  18 Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
  19 Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
  20 Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22
  23 ---
  24  drivers/infiniband/core/verbs.c |   41 +++++++++++++++++++++++-----------------
  25  1 file changed, 24 insertions(+), 17 deletions(-)
  26
  27 --- a/drivers/infiniband/core/verbs.c
  28 +++ b/drivers/infiniband/core/verbs.c
  29 @@ -1087,8 +1087,8 @@ struct ib_qp *ib_open_qp(struct ib_xrcd
  30  }
  31  EXPORT_SYMBOL(ib_open_qp);
  32
  33 -static struct ib_qp *ib_create_xrc_qp(struct ib_qp *qp,
  34 -               struct ib_qp_init_attr *qp_init_attr)
  35 +static struct ib_qp *create_xrc_qp(struct ib_qp *qp,
  36 +                                  struct ib_qp_init_attr *qp_init_attr)
  37  {
  38         struct ib_qp *real_qp = qp;
  39
  40 @@ -1103,10 +1103,10 @@ static struct ib_qp *ib_create_xrc_qp(st
  41
  42         qp = __ib_open_qp(real_qp, qp_init_attr->event_handler,
  43                           qp_init_attr->qp_context);
  44 -       if (!IS_ERR(qp))
  45 -               __ib_insert_xrcd_qp(qp_init_attr->xrcd, real_qp);
  46 -       else
  47 -               real_qp->device->destroy_qp(real_qp);
  48 +       if (IS_ERR(qp))
  49 +               return qp;
  50 +
  51 +       __ib_insert_xrcd_qp(qp_init_attr->xrcd, real_qp);
  52         return qp;
  53  }
  54
  55 @@ -1137,10 +1137,8 @@ struct ib_qp *ib_create_qp(struct ib_pd
  56                 return qp;
  57
  58         ret = ib_create_qp_security(qp, device);
  59 -       if (ret) {
  60 -               ib_destroy_qp(qp);
  61 -               return ERR_PTR(ret);
  62 -       }
  63 +       if (ret)
  64 +               goto err;
  65
  66         qp->real_qp    = qp;
  67         qp->qp_type    = qp_init_attr->qp_type;
  68 @@ -1153,8 +1151,15 @@ struct ib_qp *ib_create_qp(struct ib_pd
  69         INIT_LIST_HEAD(&qp->sig_mrs);
  70         qp->port = 0;
  71
  72 -       if (qp_init_attr->qp_type == IB_QPT_XRC_TGT)
  73 -               return ib_create_xrc_qp(qp, qp_init_attr);
  74 +       if (qp_init_attr->qp_type == IB_QPT_XRC_TGT) {
  75 +               struct ib_qp *xrc_qp = create_xrc_qp(qp, qp_init_attr);
  76 +
  77 +               if (IS_ERR(xrc_qp)) {
  78 +                       ret = PTR_ERR(xrc_qp);
  79 +                       goto err;
  80 +               }
  81 +               return xrc_qp;
  82 +       }
  83
  84         qp->event_handler = qp_init_attr->event_handler;
  85         qp->qp_context = qp_init_attr->qp_context;
  86 @@ -1181,11 +1186,8 @@ struct ib_qp *ib_create_qp(struct ib_pd
  87
  88         if (qp_init_attr->cap.max_rdma_ctxs) {
  89                 ret = rdma_rw_init_mrs(qp, qp_init_attr);
  90 -               if (ret) {
  91 -                       pr_err("failed to init MR pool ret= %d\n", ret);
  92 -                       ib_destroy_qp(qp);
  93 -                       return ERR_PTR(ret);
  94 -               }
  95 +               if (ret)
  96 +                       goto err;
  97         }
  98
  99         /*
 100 @@ -1198,6 +1200,11 @@ struct ib_qp *ib_create_qp(struct ib_pd
 101                                  device->attrs.max_sge_rd);
 102
 103         return qp;
 104 +
 105 +err:
 106 +       ib_destroy_qp(qp);
 107 +       return ERR_PTR(ret);
 108 +
 109  }
 110  EXPORT_SYMBOL(ib_create_qp);
 111