Commit 7c4a539e authored Mar 03, 2022 by Yajun Deng Committed by Jason Gunthorpe Mar 04, 2022

RDMA/core: Fix ib_qp_usecnt_dec() called when error

ib_destroy_qp() would called by ib_create_qp_user() if error, the former
contains ib_qp_usecnt_dec(), but ib_qp_usecnt_inc() was not called before.

So move ib_qp_usecnt_inc() into create_qp().

Fixes: d2b10794 ("RDMA/core: Create clean QP creations interface for uverbs")
Link: https://lore.kernel.org/r/20220303024232.2847388-1-yajun.deng@linux.dev


Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

parent b135e324

drivers/infiniband/core/uverbs_cmd.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -1437,7 +1437,6 @@ static int create_qp(struct uverbs_attr_bundle *attrs,
		ret = PTR_ERR(qp);
		goto err_put;
		}
		ib_qp_usecnt_inc(qp);

		obj->uevent.uobject.object = qp;
		obj->uevent.event_file = READ_ONCE(attrs->ufile->default_async_file);

drivers/infiniband/core/uverbs_std_types_qp.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -254,7 +254,6 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QP_CREATE)(
		ret = PTR_ERR(qp);
		goto err_put;
		}
		ib_qp_usecnt_inc(qp);

		if (attr.qp_type == IB_QPT_XRC_TGT) {
		obj->uxrcd = container_of(xrcd_uobj, struct ib_uxrcd_object,

drivers/infiniband/core/verbs.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -1245,6 +1245,7 @@ static struct ib_qp create_qp(struct ib_device dev, struct ib_pd *pd,
		if (ret)
		goto err_security;

		ib_qp_usecnt_inc(qp);
		rdma_restrack_add(&qp->res);
		return qp;

		@@ -1345,8 +1346,6 @@ struct ib_qp ib_create_qp_kernel(struct ib_pd pd,
		if (IS_ERR(qp))
		return qp;

		ib_qp_usecnt_inc(qp);

		if (qp_init_attr->cap.max_rdma_ctxs) {
		ret = rdma_rw_init_mrs(qp, qp_init_attr);
		if (ret)