diff options
| author | Li RongQing <lirongqing@baidu.com> | 2026-09-03 16:25:50 +0800 |
|---|---|---|
| committer | Leon Romanovsky <leon@kernel.org> | 2026-09-06 03:39:32 -0400 |
| commit | 0ff7fcd6aac16dd149ad322687a10c8ea7d806b2 (patch) | |
| tree | 4d48a50da2f997cb35e00c55820be010e50fd49a | |
| parent | 89b48ad5671fa082645f1be7e933236ac21de974 (diff) | |
| download | linux-next-0ff7fcd6aac16dd149ad322687a10c8ea7d806b2.tar.gz linux-next-0ff7fcd6aac16dd149ad322687a10c8ea7d806b2.zip | |
RDMA/nldev: Put the device when dellink fails
nldev_dellink() takes a device reference through
ib_device_get_by_index() and normally hands it over to
ib_unregister_device_and_put(). The error path of the ->dellink
callback returns without releasing it, so the reference is leaked.
Once that happens, any later unregistration of the device blocks
forever, because disable_device() drops its own reference and then
waits for the refcount to drain. No in-tree driver returns an error
from ->dellink today, so the leak is currently latent.
Put the device before returning the error.
Fixes: a60e3f3d6fba ("RDMA/nldev: Add dellink function pointer")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Link: https://patch.msgid.link/20260903082550.2257-1-lirongqing@baidu.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
| -rw-r--r-- | drivers/infiniband/core/nldev.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c index a4014a230639..a1542ed80fcc 100644 --- a/drivers/infiniband/core/nldev.c +++ b/drivers/infiniband/core/nldev.c @@ -1895,8 +1895,10 @@ static int nldev_dellink(struct sk_buff *skb, struct nlmsghdr *nlh, mutex_lock(&nldev_dellink_mutex); err = device->link_ops->dellink(device); mutex_unlock(&nldev_dellink_mutex); - if (err) + if (err) { + ib_device_put(device); return err; + } } ib_unregister_device_and_put(device); |