From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:52017 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933361AbcE3Uby (ORCPT ); Mon, 30 May 2016 16:31:54 -0400 Subject: Patch "IB/srp: Fix srp_create_target() error handling" has been added to the 4.6-stable tree To: bart.vanassche@sandisk.com, dledford@redhat.com, gregkh@linuxfoundation.org, hch@lst.de, leonro@mellanox.com, loberman@redhat.com, sagi@grimberg.me Cc: , From: Date: Mon, 30 May 2016 13:23:46 -0700 Message-ID: <14646398263033@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled IB/srp: Fix srp_create_target() error handling to the 4.6-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ib-srp-fix-srp_create_target-error-handling.patch and it can be found in the queue-4.6 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From f83b2561a6d4ff12959660ad597580097b744941 Mon Sep 17 00:00:00 2001 From: Bart Van Assche Date: Thu, 12 May 2016 10:48:48 -0700 Subject: IB/srp: Fix srp_create_target() error handling From: Bart Van Assche commit f83b2561a6d4ff12959660ad597580097b744941 upstream. Avoid that the following kernel oops occurs if memory pool allocation fails: BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] ib_drain_rq+0x0/0x20 [ib_core] Call Trace: [] srp_create_target+0xca6/0x13a9 [ib_srp] [] dev_attr_store+0x13/0x20 [] sysfs_kf_write+0x40/0x50 [] kernfs_fop_write+0x13c/0x180 [] __vfs_write+0x23/0xf0 [] vfs_write+0xa4/0x1a0 [] SyS_write+0x44/0xa0 [] entry_SYSCALL_64_fastpath+0x1c/0xac Fixes: 1dc7b1f10dcb ("IB/srp: use the new CQ API") Signed-off-by: Bart Van Assche Reviewed-by: Leon Romanovsky Tested-by: Laurence Oberman Cc: Christoph Hellwig Cc: Sagi Grimberg Signed-off-by: Doug Ledford Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/ulp/srp/ib_srp.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -448,16 +448,16 @@ static struct srp_fr_pool *srp_alloc_fr_ /** * srp_destroy_qp() - destroy an RDMA queue pair - * @ch: SRP RDMA channel. + * @qp: RDMA queue pair. * * Drain the qp before destroying it. This avoids that the receive * completion handler can access the queue pair while it is * being destroyed. */ -static void srp_destroy_qp(struct srp_rdma_ch *ch) +static void srp_destroy_qp(struct ib_qp *qp) { - ib_drain_rq(ch->qp); - ib_destroy_qp(ch->qp); + ib_drain_rq(qp); + ib_destroy_qp(qp); } static int srp_create_ch_ib(struct srp_rdma_ch *ch) @@ -530,7 +530,7 @@ static int srp_create_ch_ib(struct srp_r } if (ch->qp) - srp_destroy_qp(ch); + srp_destroy_qp(ch->qp); if (ch->recv_cq) ib_free_cq(ch->recv_cq); if (ch->send_cq) @@ -554,7 +554,7 @@ static int srp_create_ch_ib(struct srp_r return 0; err_qp: - srp_destroy_qp(ch); + srp_destroy_qp(qp); err_send_cq: ib_free_cq(send_cq); @@ -597,7 +597,7 @@ static void srp_free_ch_ib(struct srp_ta ib_destroy_fmr_pool(ch->fmr_pool); } - srp_destroy_qp(ch); + srp_destroy_qp(ch->qp); ib_free_cq(ch->send_cq); ib_free_cq(ch->recv_cq); Patches currently in stable-queue which might be from bart.vanassche@sandisk.com are queue-4.6/ib-srp-fix-a-debug-kernel-crash.patch queue-4.6/ib-srp-fix-srp_create_target-error-handling.patch