linux/drivers/infiniband/sw
Mikhail Malygin 5f0b2a6093 RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue
rxe_post_send_kernel() iterates over linked list of wr's, until the
wr->next ptr is NULL.  However if we've got an interrupt after last wr is
posted, control may be returned to the code after send completion callback
is executed and wr memory is freed.

As a result, wr->next pointer may contain incorrect value leading to
panic. Store the wr->next on the stack before posting it.

Fixes: 8700e3e7c4 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20200716190340.23453-1-m.malygin@yadro.com
Signed-off-by: Mikhail Malygin <m.malygin@yadro.com>
Signed-off-by: Sergey Kojushev <s.kojushev@yadro.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2020-07-16 16:12:07 -03:00
..
rdmavt RDMA: Remove the udata parameter from alloc_mr callback 2020-07-06 19:25:53 -03:00
rxe RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue 2020-07-16 16:12:07 -03:00
siw RDMA: Remove the udata parameter from alloc_mr callback 2020-07-06 19:25:53 -03:00
Makefile rdma/siw: addition to kernel build environment 2019-07-02 17:03:41 -03:00