]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
RDMA/core: Don't make a dummy ib_udata on the stack in create_qp
authorJason Gunthorpe <jgg@nvidia.com>
Tue, 26 May 2026 16:15:05 +0000 (13:15 -0300)
committerJason Gunthorpe <jgg@nvidia.com>
Wed, 3 Jun 2026 18:12:43 +0000 (15:12 -0300)
commit43b57d73ebbe5e7964a8b3ee3ffde0948fae6e2e
tree5b0d21e2e8fba419def744de9bee5c394614d046
parentb548a6c4eee5c428663f3944e173e6c92e2e8d6f
RDMA/core: Don't make a dummy ib_udata on the stack in create_qp

Sashiko points out the udata for destruction has to be created using
uverbs_get_cleared_udata(). Move it to ib_core_uverbs.c so that the core
qp code can call it. Rework the call chain to pass the struct
uverbs_attr_bundle right up to the driver op callback.

Fixes a possible wild stack reference in drivers during error unwinding,
mlx5 can call rdma_udata_to_drv_context() from destroy_qp() when
destroying a QP.

Fixes: 00a79d6b996d ("RDMA/core: Configure selinux QP during creation")
Link: https://patch.msgid.link/r/1-v1-922fa8e828ba+f7-ib_udata_stack_jgg@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
drivers/infiniband/core/core_priv.h
drivers/infiniband/core/ib_core_uverbs.c
drivers/infiniband/core/rdma_core.h
drivers/infiniband/core/uverbs_cmd.c
drivers/infiniband/core/uverbs_std_types_qp.c
drivers/infiniband/core/verbs.c