Commit fa3c411d authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Leon Romanovsky
Browse files

RDMA/core: always drop device refcount in ib_del_sub_device_and_put() 



Since nldev_deldev() (introduced by commit 060c642b ("RDMA/nldev: Add
support to add/delete a sub IB device through netlink") grabs a reference
using ib_device_get_by_index() before calling ib_del_sub_device_and_put(),
we need to drop that reference before returning -EOPNOTSUPP error.

Reported-by: default avatar <syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84


Fixes: bca51197 ("RDMA/core: Support IB sub device with type "SMI"")
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://patch.msgid.link/80749a85-cbe2-460c-8451-42516013f9fa@I-love.SAKURA.ne.jp


Reviewed-by: default avatarParav Pandit <parav@nvidia.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
parent de41cbc6

drivers/infiniband/core/device.c

+3 −1
Original line number Diff line number Diff line
@@ -2881,8 +2881,10 @@ int ib_del_sub_device_and_put(struct ib_device *sub) 
{

	struct ib_device *parent = sub->parent;



	if (!parent)

	if (!parent) {

		ib_device_put(sub);

		return -EOPNOTSUPP;

	}



	mutex_lock(&parent->subdev_lock);

	list_del(&sub->subdev_list);