From: Michael S. Tsirkin <mst@mellanox.co.il>
Date: Mon, 17 Jul 2006 15:20:51 +0000 (+0300)
Subject: IB/uverbs: Fix unlocking in error paths
X-Git-Url: http://drtracing.org/?a=commitdiff_plain;h=ec924b4726e3df000d3ac7ae10cb8ef1adcd60ca;p=deliverable%2Flinux.git

IB/uverbs: Fix unlocking in error paths

ib_uverbs_create_ah() and ib_uverbs_create_srq() did not release the
PD's read lock in their error paths, which lead to deadlock when
destroying the PD.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
---

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index bdf5d5098190..0371806cf398 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1775,7 +1775,7 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
 	ah = ib_create_ah(pd, &attr);
 	if (IS_ERR(ah)) {
 		ret = PTR_ERR(ah);
-		goto err;
+		goto err_put;
 	}
 
 	ah->uobject  = uobj;
@@ -1811,6 +1811,9 @@ err_copy:
 err_destroy:
 	ib_destroy_ah(ah);
 
+err_put:
+	put_pd_read(pd);
+
 err:
 	put_uobj_write(uobj);
 	return ret;
@@ -1984,7 +1987,7 @@ ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
 	srq = pd->device->create_srq(pd, &attr, &udata);
 	if (IS_ERR(srq)) {
 		ret = PTR_ERR(srq);
-		goto err;
+		goto err_put;
 	}
 
 	srq->device    	   = pd->device;
@@ -2029,6 +2032,9 @@ err_copy:
 err_destroy:
 	ib_destroy_srq(srq);
 
+err_put:
+	put_pd_read(pd);
+
 err:
 	put_uobj_write(&obj->uobject);
 	return ret;