]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Sat, 20 Dec 2025 02:11:33 +0000 (11:11 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 8 Jan 2026 09:14:36 +0000 (10:14 +0100)
commit20436f2742a92b7afeb2504eb559a98d2196b001
tree8eb33873972e4a1ed891ae2163cf32d86c8e802e
parent116a7a351dce3c970b9cf33cb3acc3f05d6b3af5
RDMA/core: always drop device refcount in ib_del_sub_device_and_put()

[ Upstream commit fa3c411d21ebc26ffd175c7256c37cefa35020aa ]

Since nldev_deldev() (introduced by commit 060c642b2ab8 ("RDMA/nldev: Add
support to add/delete a sub IB device through netlink") grabs a reference
using ib_device_get_by_index() before calling ib_del_sub_device_and_put(),
we need to drop that reference before returning -EOPNOTSUPP error.

Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
Fixes: bca51197620a ("RDMA/core: Support IB sub device with type "SMI"")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://patch.msgid.link/80749a85-cbe2-460c-8451-42516013f9fa@I-love.SAKURA.ne.jp
Reviewed-by: Parav Pandit <parav@nvidia.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/infiniband/core/device.c