kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-12 06:01:58 +00:00
Code Issues Releases Packages Activity
linux/drivers/infiniband/hw
History
Shifeng Li 1ff56298ab RDMA/irdma: Avoid free the non-cqp_request scratch 
[ Upstream commit e3e82fcb79 ]

When creating ceq_0 during probing irdma, cqp.sc_cqp will be sent as a
cqp_request to cqp->sc_cqp.sq_ring. If the request is pending when
removing the irdma driver or unplugging its aux device, cqp.sc_cqp will be
dereferenced as wrong struct in irdma_free_pending_cqp_request().

  PID: 3669   TASK: ffff88aef892c000  CPU: 28  COMMAND: "kworker/28:0"
   #0 [fffffe0000549e38] crash_nmi_callback at ffffffff810e3a34
   #1 [fffffe0000549e40] nmi_handle at ffffffff810788b2
   #2 [fffffe0000549ea0] default_do_nmi at ffffffff8107938f
   #3 [fffffe0000549eb8] do_nmi at ffffffff81079582
   #4 [fffffe0000549ef0] end_repeat_nmi at ffffffff82e016b4
      [exception RIP: native_queued_spin_lock_slowpath+1291]
      RIP: ffffffff8127e72b  RSP: ffff88aa841ef778  RFLAGS: 00000046
      RAX: 0000000000000000  RBX: ffff88b01f849700  RCX: ffffffff8127e47e
      RDX: 0000000000000000  RSI: 0000000000000004  RDI: ffffffff83857ec0
      RBP: ffff88afe3e4efc8   R8: ffffed15fc7c9dfa   R9: ffffed15fc7c9dfa
      R10: 0000000000000001  R11: ffffed15fc7c9df9  R12: 0000000000740000
      R13: ffff88b01f849708  R14: 0000000000000003  R15: ffffed1603f092e1
      ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0000
  -- <NMI exception stack> --
   #5 [ffff88aa841ef778] native_queued_spin_lock_slowpath at ffffffff8127e72b
   #6 [ffff88aa841ef7b0] _raw_spin_lock_irqsave at ffffffff82c22aa4
   #7 [ffff88aa841ef7c8] __wake_up_common_lock at ffffffff81257363
   #8 [ffff88aa841ef888] irdma_free_pending_cqp_request at ffffffffa0ba12cc [irdma]
   #9 [ffff88aa841ef958] irdma_cleanup_pending_cqp_op at ffffffffa0ba1469 [irdma]
   #10 [ffff88aa841ef9c0] irdma_ctrl_deinit_hw at ffffffffa0b2989f [irdma]
   #11 [ffff88aa841efa28] irdma_remove at ffffffffa0b252df [irdma]
   #12 [ffff88aa841efae8] auxiliary_bus_remove at ffffffff8219afdb
   #13 [ffff88aa841efb00] device_release_driver_internal at ffffffff821882e6
   #14 [ffff88aa841efb38] bus_remove_device at ffffffff82184278
   #15 [ffff88aa841efb88] device_del at ffffffff82179d23
   #16 [ffff88aa841efc48] ice_unplug_aux_dev at ffffffffa0eb1c14 [ice]
   #17 [ffff88aa841efc68] ice_service_task at ffffffffa0d88201 [ice]
   #18 [ffff88aa841efde8] process_one_work at ffffffff811c589a
   #19 [ffff88aa841efe60] worker_thread at ffffffff811c71ff
   #20 [ffff88aa841eff10] kthread at ffffffff811d87a0
   #21 [ffff88aa841eff50] ret_from_fork at ffffffff82e0022f

Fixes: 44d9e52977 ("RDMA/irdma: Implement device initialization definitions")
Link: https://lore.kernel.org/r/20231130081415.891006-1-lishifeng@sangfor.com.cn
Suggested-by: "Ismail, Mustafa" <mustafa.ismail@intel.com>
Signed-off-by: Shifeng Li <lishifeng@sangfor.com.cn>
Reviewed-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-12-13 18:39:15 +01:00
..
bnxt_re RDMA/bnxt_re: Correct module description string 2023-12-13 18:39:14 +01:00
cxgb4 RDMA/cxgb4: Check skb value for failure to allocate 2023-10-19 23:08:49 +02:00
efa RDMA/efa: Fix wrong resources deallocation order 2023-09-13 09:42:57 +02:00
erdma RDMA/erdma: Use fixed hardware page size 2023-05-11 23:03:33 +09:00
hfi1 RDMA/hfi1: Use FIELD_GET() to extract Link Width 2023-11-28 17:06:59 +00:00
hns RDMA/hns: Fix unnecessary err return when using invalid congest control algorithm 2023-12-13 18:39:12 +01:00
irdma RDMA/irdma: Avoid free the non-cqp_request scratch 2023-12-13 18:39:15 +01:00
mlx4 IB/mlx4: Fix the size of a buffer in add_port_entries() 2023-10-10 22:00:44 +02:00
mlx5 IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF 2023-11-20 11:52:08 +01:00
mthca RDMA/mthca: Fix crash when polling CQ for shared QPs 2023-08-03 10:24:03 +02:00
ocrdma IB: move from strlcpy with unused retval to strscpy 2022-08-21 14:18:02 +03:00
qedr RDMA/qedr: clean up work queue on failure in qedr_alloc_resources() 2022-10-28 12:59:40 -03:00
qib RDMA/qib: fix repeated words in comments 2022-09-20 14:11:14 +03:00
usnic RDMA/usnic: use iommu_map_atomic() under spin_lock() 2023-02-14 19:11:43 +01:00
vmw_pvrdma RDMA/pvrdma: Remove useless DMA-32 fallback configuration 2022-01-28 10:49:04 -04:00
Makefile RDMA/erdma: Add driver to kernel build environment 2022-07-27 16:04:05 -03:00