OSDN Git Service
(root)
/
tomoyo
/
tomoyo-test1.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
5de61a4
)
RDMA/qedr: Fix kernel panic when trying to access recv_cq
author
Kamal Heib
<kamalheib1@gmail.com>
Sun, 4 Apr 2021 12:55:01 +0000
(15:55 +0300)
committer
Jason Gunthorpe
<jgg@nvidia.com>
Wed, 7 Apr 2021 23:28:26 +0000
(20:28 -0300)
As INI QP does not require a recv_cq, avoid the following null pointer
dereference by checking if the qp_type is not INI before trying to extract
the recv_cq.
BUG: kernel NULL pointer dereference, address:
00000000000000e0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 0 PID: 54250 Comm: mpitests-IMB-MP Not tainted 5.12.0-rc5 #1
Hardware name: Dell Inc. PowerEdge R320/0KM5PX, BIOS 2.7.0 08/19/2019
RIP: 0010:qedr_create_qp+0x378/0x820 [qedr]
Code: 02 00 00 50 e8 29 d4 a9 d1 48 83 c4 18 e9 65 fe ff ff 48 8b 53 10 48 8b 43 18 44 8b 82 e0 00 00 00 45 85 c0 0f 84 10 74 00 00 <8b> b8 e0 00 00 00 85 ff 0f 85 50 fd ff ff e9 fd 73 00 00 48 8d bd
RSP: 0018:
ffff9c8f056f7a70
EFLAGS:
00010202
RAX:
0000000000000000
RBX:
ffff9c8f056f7b58
RCX:
0000000000000009
RDX:
ffff8c41a9744c00
RSI:
ffff9c8f056f7b58
RDI:
ffff8c41c0dfa280
RBP:
ffff8c41c0dfa280
R08:
0000000000000002
R09:
0000000000000001
R10:
0000000000000000
R11:
ffff8c41e06fc608
R12:
ffff8c4194052000
R13:
0000000000000000
R14:
ffff8c4191546070
R15:
ffff8c41c0dfa280
FS:
00007f78b2787b80
(0000) GS:
ffff8c43a3200000
(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
00000000000000e0
CR3:
00000001011d6002
CR4:
00000000001706f0
Call Trace:
ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x4e4/0xb90 [ib_uverbs]
? ib_uverbs_cq_event_handler+0x30/0x30 [ib_uverbs]
ib_uverbs_run_method+0x6f6/0x7a0 [ib_uverbs]
? ib_uverbs_handler_UVERBS_METHOD_QP_DESTROY+0x70/0x70 [ib_uverbs]
? __cond_resched+0x15/0x30
? __kmalloc+0x5a/0x440
ib_uverbs_cmd_verbs+0x195/0x360 [ib_uverbs]
? xa_load+0x6e/0x90
? cred_has_capability+0x7c/0x130
? avc_has_extended_perms+0x17f/0x440
? vma_link+0xae/0xb0
? vma_set_page_prot+0x2a/0x60
? mmap_region+0x298/0x6c0
? do_mmap+0x373/0x520
? selinux_file_ioctl+0x17f/0x220
ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs]
__x64_sys_ioctl+0x84/0xc0
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f78b120262b
Fixes:
06e8d1df46ed
("RDMA/qedr: Add support for user mode XRC-SRQ's")
Link:
https://lore.kernel.org/r/20210404125501.154789-1-kamalheib1@gmail.com
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
drivers/infiniband/hw/qedr/verbs.c
patch
|
blob
|
history
diff --git
a/drivers/infiniband/hw/qedr/verbs.c
b/drivers/infiniband/hw/qedr/verbs.c
index
0eb6a7a
..
9ea5422
100644
(file)
--- a/
drivers/infiniband/hw/qedr/verbs.c
+++ b/
drivers/infiniband/hw/qedr/verbs.c
@@
-1244,7
+1244,8
@@
static int qedr_check_qp_attrs(struct ib_pd *ibpd, struct qedr_dev *dev,
* TGT QP isn't associated with RQ/SQ
*/
if ((attrs->qp_type != IB_QPT_GSI) && (dev->gsi_qp_created) &&
- (attrs->qp_type != IB_QPT_XRC_TGT)) {
+ (attrs->qp_type != IB_QPT_XRC_TGT) &&
+ (attrs->qp_type != IB_QPT_XRC_INI)) {
struct qedr_cq *send_cq = get_qedr_cq(attrs->send_cq);
struct qedr_cq *recv_cq = get_qedr_cq(attrs->recv_cq);