Commit ec6f8401 authored by Jason Gunthorpe's avatar Jason Gunthorpe

IB/uverbs: Fix unbalanced unlock on error path for rdma_explicit_destroy

If remove_commit fails then the lock is left locked while the uobj still
exists. Eventually the kernel will deadlock.

lockdep detects this and says:

 test/4221 is leaving the kernel with locks still held!
 1 lock held by test/4221:
  #0:  (&ucontext->cleanup_rwsem){.+.+}, at: [<000000001e5c7523>] rdma_explicit_destroy+0x37/0x120 [ib_uverbs]

Fixes: 4da70da2 ("IB/core: Explicitly destroy an object while keeping uobject")
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
Reviewed-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
parent 104f268d
...@@ -491,12 +491,13 @@ int rdma_explicit_destroy(struct ib_uobject *uobject) ...@@ -491,12 +491,13 @@ int rdma_explicit_destroy(struct ib_uobject *uobject)
ret = uobject->type->type_class->remove_commit(uobject, ret = uobject->type->type_class->remove_commit(uobject,
RDMA_REMOVE_DESTROY); RDMA_REMOVE_DESTROY);
if (ret) if (ret)
return ret; goto out;
uobject->type = &null_obj_type; uobject->type = &null_obj_type;
out:
up_read(&ucontext->cleanup_rwsem); up_read(&ucontext->cleanup_rwsem);
return 0; return ret;
} }
static void alloc_commit_idr_uobject(struct ib_uobject *uobj) static void alloc_commit_idr_uobject(struct ib_uobject *uobj)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment