5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Carpenter [ Upstream commit 36941dfe0e8c3e2da7851b9648fd74bd3a3e78ce ] This error path needs to unlock before returning. Fixes: ec0fa2445c18 ("RDMA/rxe: Fix over copying in get_srq_wqe") Link: https://lore.kernel.org/r/YNXUCmnPsSkPyhkm@mwanda Signed-off-by: Dan Carpenter Reviewed-by: Majd Dibbiny Reviewed-by: Bob Pearson Signed-off-by: Jason Gunthorpe [doebel: Clean cherry-pick. Needed as a prerequisiste for "RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe" ] Signed-off-by: Bjoern Doebel Signed-off-by: Sasha Levin --- drivers/infiniband/sw/rxe/rxe_resp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c index 38e6535196849..207889332b963 100644 --- a/drivers/infiniband/sw/rxe/rxe_resp.c +++ b/drivers/infiniband/sw/rxe/rxe_resp.c @@ -307,6 +307,7 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp) /* don't trust user space data */ if (unlikely(wqe->dma.num_sge > srq->rq.max_sge)) { + spin_unlock_bh(&srq->rq.consumer_lock); pr_warn("%s: invalid num_sge in SRQ entry\n", __func__); return RESPST_ERR_MALFORMED_WQE; } -- 2.53.0