summaryrefslogtreecommitdiff
path: root/drivers/infiniband/core/ucma.c
diff options
context:
space:
mode:
authorJason Gunthorpe <jgg@nvidia.com>2020-08-18 15:05:13 +0300
committerJason Gunthorpe <jgg@nvidia.com>2020-08-27 08:38:13 -0300
commitca2968c1efcbeb547906cf6211874ec881beafec (patch)
treef5d7b5f93d3d2270117006ddb69d56e79a7258a2 /drivers/infiniband/core/ucma.c
parent7c4b1ab9f16732fb921b3f11cd127fa65f26ad5c (diff)
RDMA/ucma: Fix refcount 0 incr in ucma_get_ctx()
Both ucma_destroy_id() and ucma_close_id() (triggered from an event via a wq) can drive the refcount to zero. ucma_get_ctx() was wrongly assuming that the refcount can only go to zero from ucma_destroy_id() which also removes it from the xarray. Use refcount_inc_not_zero() instead. Link: https://lore.kernel.org/r/20200818120526.702120-2-leon@kernel.org Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'drivers/infiniband/core/ucma.c')
-rw-r--r--drivers/infiniband/core/ucma.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index d03dacaef788..625168563443 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -153,8 +153,8 @@ static struct ucma_context *ucma_get_ctx(struct ucma_file *file, int id)
if (!IS_ERR(ctx)) {
if (ctx->closing)
ctx = ERR_PTR(-EIO);
- else
- refcount_inc(&ctx->ref);
+ else if (!refcount_inc_not_zero(&ctx->ref))
+ ctx = ERR_PTR(-ENXIO);
}
xa_unlock(&ctx_table);
return ctx;