leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6c41965d64
linux/drivers/infiniband/hw
History
Leon Romanovsky 6c41965d64 RDMA/mlx5: Don't access ib_qp fields in internal destroy QP path 
destroy_qp_common is called for flows where QP is already created by
HW. While it is called from IB/core, the ibqp.* fields will be fully
initialized, but it is not the case if this function is called during QP
creation.

Don't rely on ibqp fields as much as possible and initialize
send_cq/recv_cq as temporal solution till all drivers will be converted to
IB/core QP allocation scheme.

refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 5372 at lib/refcount.c:28 refcount_warn_saturate+0xfe/0x1a0
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 5372 Comm: syz-executor.2 Not tainted 5.5.0-rc5 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Call Trace:
 mlx5_core_put_rsc+0x70/0x80
 destroy_resource_common+0x8e/0xb0
 mlx5_core_destroy_qp+0xaf/0x1d0
 mlx5_ib_destroy_qp+0xeb0/0x1460
 ib_destroy_qp_user+0x2d5/0x7d0
 create_qp+0xed3/0x2130
 ib_uverbs_create_qp+0x13e/0x190
 ? ib_uverbs_ex_create_qp
 ib_uverbs_write+0xaa5/0xdf0
 __vfs_write+0x7c/0x100
 ksys_write+0xc8/0x200
 do_syscall_64+0x9c/0x390
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Fixes: 08d5397660 ("RDMA/mlx5: Copy response to the user in one place")
Link: https://lore.kernel.org/r/20200617130148.2846643-1-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-06-18 14:26:04 -03:00
..
bnxt_re treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
cxgb4 treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
efa RDMA/efa: Set maximum pkeys device attribute 2020-06-18 09:41:07 -03:00
hfi1 RDMA/hfi1: Fix trivial mis-spelling of 'descriptor' 2020-06-15 15:56:54 -03:00
hns RDMA/hns: Fix an cmd queue issue when resetting 2020-06-18 10:48:39 -03:00
i40iw treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
mlx4 treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
mlx5 RDMA/mlx5: Don't access ib_qp fields in internal destroy QP path 2020-06-18 14:26:04 -03:00
mthca treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
ocrdma treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
qedr RDMA/qedr: Fix KASAN: use-after-free in ucma_event_handler+0x532 2020-06-18 09:44:45 -03:00
qib treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
usnic treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
vmw_pvrdma treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile RDMA/iw_cxgb3: Remove the iw_cxgb3 module from kernel 2019-10-04 15:08:59 -03:00