hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC914B CVE: NA -------------------------------- This reverts commit bd697183bcfac98265c164c8d3393b46e48d880d. When SMC-R links down happened, smc_ib_destroy_queue_pair() delete QP and set lnk->roce_qp to NULL. No Need to move it in __smcr_link_clear(). Other SMC-R connections call ib_create_qp() to invoke them, which will not cause use-after-free panic. Revert it and keep the same with mainline. Fixes: bd697183bcfa ("anolis: net/smc: delay RDMA resource release until connecitons freed") Signed-off-by: Wang Liang <wangliang74@huawei.com> --- net/smc/smc_core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c index 30697a76598c..c212a9bebae1 100644 --- a/net/smc/smc_core.c +++ b/net/smc/smc_core.c @@ -1169,9 +1169,6 @@ static void smcr_rtoken_clear_link(struct smc_link *lnk) void __smcr_link_clear(struct smc_link *lnk) { - smcr_buf_unmap_lgr(lnk); - smc_ib_destroy_queue_pair(lnk); - smc_ib_dealloc_protection_domain(lnk); smc_wr_free_link_mem(lnk); smc_ibdev_cnt_dec(lnk); smc_lgr_put(lnk->lgr); /* lgr_hold in smcr_link_init() */ @@ -1190,9 +1187,12 @@ void smcr_link_clear(struct smc_link *lnk, bool log) lnk->clearing = 1; lnk->peer_qpn = 0; smc_llc_link_clear(lnk, log); + smcr_buf_unmap_lgr(lnk); smcr_rtoken_clear_link(lnk); smc_ib_modify_qp_error(lnk); smc_wr_free_link(lnk); + smc_ib_destroy_queue_pair(lnk); + smc_ib_dealloc_protection_domain(lnk); put_device(&lnk->smcibdev->ibdev->dev); smcibdev = lnk->smcibdev; if (!atomic_dec_return(&smcibdev->lnk_cnt)) -- 2.34.1