hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux-sg2042/drivers/infiniband/hw/mlx5
History
Leon Romanovsky 6eefa839c4 RDMA/mlx5: Protect from kernel crash if XRC_TGT doesn't have udata 
Don't deref udata if it is NULL

  BUG: kernel NULL pointer dereference, address: 0000000000000030
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000   SMP PTI
  CPU: 2 PID: 1592 Comm: python3 Not tainted 5.7.0-rc6+ #1
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
  RIP: 0010:create_qp+0x39e/0xae0 [mlx5_ib]
  Code: c0 0d 00 00 bf 10 01 00 00 e8 be a9 e4 e0 48 85 c0 49 89 c2 0f 84 0c 07 00 00 41 8b 85 74 63 01 00 0f c8 a9 00 00 00 10 74 0a <41> 8b 46 30 0f c8 41 89 42 14 41 8b 52 18 41 0f b6 4a 1c 0f ca 89
  RSP: 0018:ffffc9000067f8b0 EFLAGS: 00010206
  RAX: 0000000010170000 RBX: ffff888441313000 RCX: 0000000000000000
  RDX: 0000000000000200 RSI: 0000000000000000 RDI: ffff88845b1d4400
  RBP: ffffc9000067fa60 R08: 0000000000000200 R09: ffff88845b1d4200
  R10: ffff88845b1d4200 R11: ffff888441313000 R12: ffffc9000067f950
  R13: ffff88846ac00140 R14: 0000000000000000 R15: ffff88846c2bc000
  FS:  00007faa1a3c0540(0000) GS:ffff88846fd00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000030 CR3: 0000000446dca003 CR4: 0000000000760ea0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  PKRU: 55555554
  Call Trace:
   ? __switch_to_asm+0x40/0x70
   ? __switch_to_asm+0x34/0x70
   mlx5_ib_create_qp+0x897/0xfa0 [mlx5_ib]
   ib_create_qp+0x9e/0x300 [ib_core]
   create_qp+0x92d/0xb20 [ib_uverbs]
   ? ib_uverbs_cq_event_handler+0x30/0x30 [ib_uverbs]
   ? release_resource+0x30/0x30
   ib_uverbs_create_qp+0xc4/0xe0 [ib_uverbs]
   ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xc8/0xf0 [ib_uverbs]
   ib_uverbs_run_method+0x223/0x770 [ib_uverbs]
   ? track_pfn_remap+0xa7/0x100
   ? uverbs_disassociate_api+0xd0/0xd0 [ib_uverbs]
   ? remap_pfn_range+0x358/0x490
   ib_uverbs_cmd_verbs.isra.6+0x19b/0x370 [ib_uverbs]
   ? rdma_umap_priv_init+0x82/0xe0 [ib_core]
   ? vm_mmap_pgoff+0xec/0x120
   ib_uverbs_ioctl+0xc0/0x120 [ib_uverbs]
   ksys_ioctl+0x92/0xb0
   __x64_sys_ioctl+0x16/0x20
   do_syscall_64+0x48/0x130
   entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: e383085c24 ("RDMA/mlx5: Set ECE options during QP create")
Link: https://lore.kernel.org/r/20200621115959.60126-1-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
 		2020-06-22 14:40:53 -03:00
..
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile RDMA/mlx5: Move all WR logic from qp.c to separate file 2020-05-06 17:42:45 -03:00
ah.c RDMA/mlx5: Set UDP source port based on the grh.flow_label 2020-05-06 16:51:44 -03:00
cmd.c RDMA/mlx5: Update mlx5_ib to use new cmd interface 2020-05-06 17:42:45 -03:00
cmd.h RDMA/mlx5: Update mlx5_ib to use new cmd interface 2020-05-06 17:42:45 -03:00
cong.c RDMA/mlx5: Update mlx5_ib to use new cmd interface 2020-05-06 17:42:45 -03:00
cq.c net/mlx5: Refactor imm_inval_pkey field in cqe struct 2020-04-28 12:45:15 -07:00
devx.c IB/mlx5: Fix DEVX support for MLX5_CMD_OP_INIT2INIT_QP command 2020-05-27 15:53:21 -03:00
doorbell.c IB: Allow calls to ib_umem_get from kernel ULPs 2020-01-16 16:14:28 +02:00
flow.c Merge branch 'mellanox/mlx5-next' into rdma.git for/next 2020-05-27 16:01:17 -03:00
gsi.c RDMA/mlx5: Set lag tx affinity according to slave 2020-05-02 20:19:54 -03:00
ib_rep.c IB/mlx5: Rename profile and init methods 2019-11-11 12:15:29 -08:00
ib_rep.h RDMA/mlx5: Assign profile before calling stages 2020-05-06 17:52:01 -03:00
ib_virt.c net/mlx5: Update vport.c to new cmd interface 2020-04-23 21:42:02 +03:00
mad.c net/mlx5: Update vport.c to new cmd interface 2020-04-23 21:42:02 +03:00
main.c RDMA: Remove 'max_map_per_fmr' 2020-06-02 20:32:54 -03:00
mem.c IB/mlx5: Generally use the WC auto detection test result 2020-03-24 20:22:21 -03:00
mlx5_ib.h RDMA/mlx5: Remove FMR leftovers 2020-06-02 20:32:53 -03:00
mr.c RDMA/mlx5: Fix NULL pointer dereference in destroy_prefetch_work 2020-05-21 20:51:50 -03:00
odp.c RDMA/mlx5: Update mlx5_ib to use new cmd interface 2020-05-06 17:42:45 -03:00
qos.c RDMA/core: Allow the ioctl layer to abort a fully created uobject 2020-05-21 20:10:46 -03:00
qp.c RDMA/mlx5: Protect from kernel crash if XRC_TGT doesn't have udata 2020-06-22 14:40:53 -03:00
qp.h RDMA/mlx5: Set ECE options during modify QP 2020-05-27 16:07:49 -03:00
qpc.c RDMA/mlx5: Add missed RST2INIT and INIT2INIT steps during ECE handshake 2020-06-18 09:52:29 -03:00
restrack.c RDMA/nldev: Provide MR statistics 2019-10-22 15:33:31 -03:00
srq.c RDMA/mlx5: Fix udata response upon SRQ creation 2020-04-14 15:56:34 -03:00
srq.h RDMA: Handle SRQ allocations by IB/core 2019-04-08 13:05:25 -03:00
srq_cmd.c RDMA/mlx5: Fix query_srq_cmd() function 2020-05-13 16:01:50 -03:00
wr.c RDMA/mlx5: Move all WR logic from qp.c to separate file 2020-05-06 17:42:45 -03:00
wr.h RDMA/mlx5: Move all WR logic from qp.c to separate file 2020-05-06 17:42:45 -03:00