Skip to content

Commit b2b1ddc

Browse files
zhuyjrleon
authored andcommitted
RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task"
In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like rxe_init_task are not setup until rxe_qp_init_req(). If an error occurred before this point then the unwind will call rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task() which will oops when trying to access the uninitialized spinlock. If rxe_init_task is not executed, rxe_cleanup_task will not be called. Reported-by: syzbot+cfcc1a3c85be15a40cba@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=fd85757b74b3eb59f904138486f755f71e090df8 Fixes: 8700e3e ("Soft RoCE driver") Fixes: 2d4b21e ("IB/rxe: Prevent from completer to operate on non valid QP") Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev> Link: https://lore.kernel.org/r/20230413101115.1366068-1-yanjun.zhu@intel.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
1 parent a2e20b2 commit b2b1ddc

1 file changed

Lines changed: 8 additions & 3 deletions

File tree

drivers/infiniband/sw/rxe/rxe_qp.c

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -761,9 +761,14 @@ static void rxe_qp_do_cleanup(struct work_struct *work)
761761
del_timer_sync(&qp->rnr_nak_timer);
762762
}
763763

764-
rxe_cleanup_task(&qp->resp.task);
765-
rxe_cleanup_task(&qp->req.task);
766-
rxe_cleanup_task(&qp->comp.task);
764+
if (qp->resp.task.func)
765+
rxe_cleanup_task(&qp->resp.task);
766+
767+
if (qp->req.task.func)
768+
rxe_cleanup_task(&qp->req.task);
769+
770+
if (qp->comp.task.func)
771+
rxe_cleanup_task(&qp->comp.task);
767772

768773
/* flush out any receive wr's or pending requests */
769774
rxe_requester(qp);

0 commit comments

Comments
 (0)