RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()

commit 34ecf795692ee57c393109f4a24ccc313091e137 upstream.

Sashiko points out there are two bugs here in the error unwind flow, both
related to how the WQ table is unwound.

First there is a double i-- on the first failure path due to the while loop
having a i--, remove it.

Second if mana_ib_install_cq_cb() fails then mana_create_wq_obj() is not
undone due to the above i--.

Cc: stable@vger.kernel.org
Fixes: c15d7802a424 ("RDMA/mana_ib: Add CQ interrupt support for RAW QP")
Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=1
Link: https://patch.msgid.link/r/6-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com
Reviewed-by: Long Li <longli@microsoft.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
index 8af29061febe207098d6ed9a970f026feb6740fe..bb1737176e2b4287e56c656cd2370b819085b663 100644 (file)
--- a/drivers/infiniband/hw/mana/qp.c
+++ b/drivers/infiniband/hw/mana/qp.c
@@ -193,11 +193,8 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
 
                ret = mana_create_wq_obj(mpc, mpc->port_handle, GDMA_RQ,
                                         &wq_spec, &cq_spec, &wq->rx_object);
-               if (ret) {
-                       /* Do cleanup starting with index i-1 */
-                       i--;
+               if (ret)
                        goto fail;
-               }
 
                /* The GDMA regions are now owned by the WQ object */
                wq->queue.gdma_region = GDMA_INVALID_DMA_REGION;
@@ -217,8 +214,10 @@ static int mana_ib_create_qp_rss(struct ib_qp *ibqp, struct ib_pd *pd,
 
                /* Create CQ table entry */
                ret = mana_ib_install_cq_cb(mdev, cq);
-               if (ret)
+               if (ret) {
+                       mana_destroy_wq_obj(mpc, GDMA_RQ, wq->rx_object);
                        goto fail;
+               }
        }
        resp.num_entries = i;