[PATCH rdma-next 14/15] RDMA/mlx5: Initialize QP/RQ/SQ resource refcount before publishing it

[Yishai Hadas <yishaih@nvidia.com>]

create_resource_common() inserted the resource into dev->qp_table.tree
before initializing its refcount and completion:

  spin_lock_irq(&table->lock);
  err = radix_tree_insert(&table->tree, ..., qp);
  spin_unlock_irq(&table->lock);
  ...
  refcount_set(&qp->common.refcount, 1);
  init_completion(&qp->common.free);

Once inserted, the resource is reachable by mlx5_get_rsc(), called from
rsc_event_notifier() on any matching firmware event, which does:

  common = radix_tree_lookup(&table->tree, rsn);
  if (common && !common->invalid)
	  refcount_inc(&common->refcount);

qp->common.refcount is zero-initialized (the object is allocated with
kzalloc_obj()) until refcount_set() runs. An EQE arriving in the window
between insertion and refcount_set() calls refcount_inc() on a
still-zero refcount_t, which the refcount API treats as a use-after-free
class bug: it saturates the counter and emits a WARN, permanently
wedging that resource's refcounting for the rest of its lifetime.

Move refcount_set(), init_completion(), and the qp->pid assignment
before the radix_tree_insert() call, so the resource is always fully
initialized by the time it becomes visible to lookups.

Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Yishai Hadas <yishaih@nvidia.com>
---
 drivers/infiniband/hw/mlx5/qpc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/qpc.c b/drivers/infiniband/hw/mlx5/qpc.c
index 77ddab666ecd..8b5bd33a7f0f 100644
--- a/drivers/infiniband/hw/mlx5/qpc.c
+++ b/drivers/infiniband/hw/mlx5/qpc.c
@@ -167,6 +167,10 @@ static int create_resource_common(struct mlx5_ib_dev *dev,
 	int err;
 
 	qp->common.res = rsc_type;
+	refcount_set(&qp->common.refcount, 1);
+	init_completion(&qp->common.free);
+	qp->pid = current->pid;
+
 	spin_lock_irq(&table->lock);
 	err = radix_tree_insert(&table->tree,
 				qp->qpn | (rsc_type << MLX5_USER_INDEX_LEN),
@@ -175,10 +179,6 @@ static int create_resource_common(struct mlx5_ib_dev *dev,
 	if (err)
 		return err;
 
-	refcount_set(&qp->common.refcount, 1);
-	init_completion(&qp->common.free);
-	qp->pid = current->pid;
-
 	return 0;
 }
 
-- 
2.18.1