IB/uverbs: Fix unlocking in error paths

ib_uverbs_create_ah() and ib_uverbs_create_srq() did not release the
PD's read lock in their error paths, which lead to deadlock when
destroying the PD.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index bdf5d5098190b7f6e9a2bd6312fd5c413d97d6aa..0371806cf398e76081f49ecc8666125b8a1f3406 100644 (file)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1775,7 +1775,7 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
        ah = ib_create_ah(pd, &attr);
        if (IS_ERR(ah)) {
                ret = PTR_ERR(ah);
-               goto err;
+               goto err_put;
        }
 
        ah->uobject  = uobj;
@@ -1811,6 +1811,9 @@ err_copy:
 err_destroy:
        ib_destroy_ah(ah);
 
+err_put:
+       put_pd_read(pd);
+
 err:
        put_uobj_write(uobj);
        return ret;
@@ -1984,7 +1987,7 @@ ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file,
        srq = pd->device->create_srq(pd, &attr, &udata);
        if (IS_ERR(srq)) {
                ret = PTR_ERR(srq);
-               goto err;
+               goto err_put;
        }
 
        srq->device        = pd->device;
@@ -2029,6 +2032,9 @@ err_copy:
 err_destroy:
        ib_destroy_srq(srq);
 
+err_put:
+       put_pd_read(pd);
+
 err:
        put_uobj_write(&obj->uobject);
        return ret;