leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
f0061c18c1
linux/net/smc
History
Yacan Liu e9b1a4f867 net/smc: Fix possible access to freed memory in link clear 
After modifying the QP to the Error state, all RX WR would be completed
with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not
wait for it is done, but destroy the QP and free the link group directly.
So there is a risk that accessing the freed memory in tasklet context.

Here is a crash example:

 BUG: unable to handle page fault for address: ffffffff8f220860
 #PF: supervisor write access in kernel mode
 #PF: error_code(0x0002) - not-present page
 PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060
 Oops: 0002 [#1] SMP PTI
 CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S         OE     5.10.0-0607+ #23
 Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018
 RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0
 Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32
 RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086
 RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000
 RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00
 RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b
 R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010
 R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040
 FS:  0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0
 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 Call Trace:
  <IRQ>
  _raw_spin_lock_irqsave+0x30/0x40
  mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib]
  smc_wr_rx_tasklet_fn+0x56/0xa0 [smc]
  tasklet_action_common.isra.21+0x66/0x100
  __do_softirq+0xd5/0x29c
  asm_call_irq_on_stack+0x12/0x20
  </IRQ>
  do_softirq_own_stack+0x37/0x40
  irq_exit_rcu+0x9d/0xa0
  sysvec_call_function_single+0x34/0x80
  asm_sysvec_call_function_single+0x12/0x20

Fixes: bd4ad57718 ("smc: initialize IB transport incl. PD, MR, QP, CQ, event, WR")
Signed-off-by: Yacan Liu <liuyacan@corp.netease.com>
Reviewed-by: Tony Lu <tonylu@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-09-07 16:00:48 +01:00
..
af_smc.c net/smc: Remove redundant refcount increase 2022-09-01 10:04:45 +02:00
Kconfig
Makefile net/smc: fix compile warning for smc_sysctl 2022-03-07 11:59:17 +00:00
smc_cdc.c net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *" 2022-05-28 12:36:26 +01:00
smc_cdc.h net/smc: fix kernel panic caused by race of smc_sock 2021-12-28 12:42:45 +00:00
smc_clc.c net/smc: Allow virtually contiguous sndbufs or RMBs for SMC-R 2022-07-18 11:19:17 +01:00
smc_clc.h net/smc: Allow virtually contiguous sndbufs or RMBs for SMC-R 2022-07-18 11:19:17 +01:00
smc_close.c net/smc: Fix slab-out-of-bounds issue in fallback 2022-04-25 11:03:48 -07:00
smc_close.h
smc_core.c net/smc: Fix possible access to freed memory in link clear 2022-09-07 16:00:48 +01:00
smc_core.h net/smc: Fix possible access to freed memory in link clear 2022-09-07 16:00:48 +01:00
smc_diag.c net/smc: Enable module load on netlink usage 2022-07-27 13:24:42 +01:00
smc_ib.c net/smc: Allow virtually contiguous sndbufs or RMBs for SMC-R 2022-07-18 11:19:17 +01:00
smc_ib.h net/smc: optimize for smc_sndbuf_sync_sg_for_device and smc_rmb_sync_sg_for_cpu 2022-07-18 11:19:17 +01:00
smc_ism.c net/smc: Pass on DMBE bit mask in IRQ handler 2022-07-27 13:24:42 +01:00
smc_ism.h net/smc: Eliminate struct smc_ism_position 2022-07-27 13:24:42 +01:00
smc_llc.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-07-21 13:03:39 -07:00
smc_llc.h net/smc: extend LLC layer for SMC-Rv2 2021-10-16 14:58:13 +01:00
smc_netlink.c net/smc: Add global configure for handshake limitation by netlink 2022-02-11 11:14:58 +00:00
smc_netlink.h net/smc: add support for user defined EIDs 2021-09-14 12:49:10 +01:00
smc_netns.h net/smc: introduce list of pnetids for Ethernet devices 2020-09-28 15:19:03 -07:00
smc_pnet.c net: rename reference+tracking helpers 2022-06-09 21:52:55 -07:00
smc_pnet.h net/smc: Use a mutex for locking "struct smc_pnettable" 2022-02-24 09:09:33 -08:00
smc_rx.c net/smc: Allow virtually contiguous sndbufs or RMBs for SMC-R 2022-07-18 11:19:17 +01:00
smc_rx.h
smc_stats.c net/smc: Fix ENODATA tests in smc_nl_get_fback_stats() 2021-06-21 12:16:58 -07:00
smc_stats.h net/smc: Make SMC statistics network namespace aware 2021-06-16 12:54:02 -07:00
smc_sysctl.c net/smc: Introduce a sysctl for setting SMC-R buffer type 2022-07-18 11:19:17 +01:00
smc_sysctl.h net/smc: fix -Wmissing-prototypes warning when CONFIG_SYSCTL not set 2022-03-09 20:02:35 -08:00
smc_tracepoint.c net/smc: Introduce tracepoint for smcr link down 2021-11-01 13:39:14 +00:00
smc_tracepoint.h net/smc: Add net namespace for tracepoints 2022-01-02 12:07:39 +00:00
smc_tx.c net/smc: Eliminate struct smc_ism_position 2022-07-27 13:24:42 +01:00
smc_tx.h net/smc: Cork when sendpage with MSG_SENDPAGE_NOTLAST flag 2022-01-31 15:08:20 +00:00
smc_wr.c net/smc: Fix possible access to freed memory in link clear 2022-09-07 16:00:48 +01:00
smc_wr.h net/smc: Fix possible access to freed memory in link clear 2022-09-07 16:00:48 +01:00
smc.h net/smc: Only save the original clcsock callback functions 2022-04-25 11:03:48 -07:00