Commit 34ecf795 authored Apr 28, 2026 by Jason Gunthorpe

RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss()

Sashiko points out there are two bugs here in the error unwind flow, both
related to how the WQ table is unwound.

First there is a double i-- on the first failure path due to the while loop
having a i--, remove it.

Second if mana_ib_install_cq_cb() fails then mana_create_wq_obj() is not
undone due to the above i--.

Cc: stable@vger.kernel.org
Fixes: c15d7802 ("RDMA/mana_ib: Add CQ interrupt support for RAW QP")
Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=1
Link: https://patch.msgid.link/r/6-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com


Reviewed-by: Long Li <longli@microsoft.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

parent 159f2efa

drivers/infiniband/hw/mana/qp.c

+4 −5

Original line number	Diff line number	Diff line
		@@ -176,11 +176,8 @@ static int mana_ib_create_qp_rss(struct ib_qp ibqp, struct ib_pd pd,

		ret = mana_create_wq_obj(mpc, mpc->port_handle, GDMA_RQ,
		&wq_spec, &cq_spec, &wq->rx_object);
		if (ret) {
		/* Do cleanup starting with index i-1 */
		i--;
		if (ret)
		goto fail;
		}

		/* The GDMA regions are now owned by the WQ object */
		wq->queue.gdma_region = GDMA_INVALID_DMA_REGION;
		@@ -200,9 +197,11 @@ static int mana_ib_create_qp_rss(struct ib_qp ibqp, struct ib_pd pd,

		/* Create CQ table entry */
		ret = mana_ib_install_cq_cb(mdev, cq);
		if (ret)
		if (ret) {
		mana_destroy_wq_obj(mpc, GDMA_RQ, wq->rx_object);
		goto fail;
		}
		}
		resp.num_entries = i;

		ret = mana_ib_cfg_vport_steering(mdev, ndev, wq->rx_object,