* [PATCH v1 for-rc] RDMA/iw_cxgb4: Fix incorrect function parameters
@ 2020-05-11 18:56 Potnuri Bharat Teja
2020-05-12 13:36 ` Jason Gunthorpe
0 siblings, 1 reply; 2+ messages in thread
From: Potnuri Bharat Teja @ 2020-05-11 18:56 UTC (permalink / raw)
To: jgg, dledford; +Cc: linux-rdma, bharat, nirranjan
Commit '11a27e21', while reading TCB field in t4_tcb_get_field32() passes
wrong mask parameter which leads the driver eventually to access illegal
SRQ index while flushing the SRQ completions during connection teardown.
Fixes kernel panic/app segfault due to incorrect function parameters passed
while reading TCB fields and completing cached SRQ buffers.
Fixes: 11a27e2121a5 ("iw_cxgb4: complete the cached SRQ buffers")
Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
---
changelog:
v1: updated commit description
---
drivers/infiniband/hw/cxgb4/cm.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index d69dece3b1d5..30e08bcc9afb 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -2891,8 +2891,7 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
srqidx = ABORT_RSS_SRQIDX_G(
be32_to_cpu(req->srqidx_status));
if (srqidx) {
- complete_cached_srq_buffers(ep,
- req->srqidx_status);
+ complete_cached_srq_buffers(ep, srqidx);
} else {
/* Hold ep ref until finish_peer_abort() */
c4iw_get_ep(&ep->com);
@@ -3878,8 +3877,8 @@ static int read_tcb_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
return 0;
}
- ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_W,
- TCB_RQ_START_S);
+ ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_M,
+ TCB_RQ_START_S);
cleanup:
pr_debug("ep %p tid %u %016x\n", ep, ep->hwtid, ep->srqe_idx);
--
2.24.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v1 for-rc] RDMA/iw_cxgb4: Fix incorrect function parameters
2020-05-11 18:56 [PATCH v1 for-rc] RDMA/iw_cxgb4: Fix incorrect function parameters Potnuri Bharat Teja
@ 2020-05-12 13:36 ` Jason Gunthorpe
0 siblings, 0 replies; 2+ messages in thread
From: Jason Gunthorpe @ 2020-05-12 13:36 UTC (permalink / raw)
To: Potnuri Bharat Teja; +Cc: dledford, linux-rdma, nirranjan
On Tue, May 12, 2020 at 12:26:08AM +0530, Potnuri Bharat Teja wrote:
> Commit '11a27e21', while reading TCB field in t4_tcb_get_field32() passes
> wrong mask parameter which leads the driver eventually to access illegal
> SRQ index while flushing the SRQ completions during connection teardown.
> Fixes kernel panic/app segfault due to incorrect function parameters passed
> while reading TCB fields and completing cached SRQ buffers.
>
> Fixes: 11a27e2121a5 ("iw_cxgb4: complete the cached SRQ buffers")
> Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
> ---
> changelog:
> v1: updated commit description
> ---
> drivers/infiniband/hw/cxgb4/cm.c | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)
Applied to for-rc, thanks
Jason
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-05-12 13:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-11 18:56 [PATCH v1 for-rc] RDMA/iw_cxgb4: Fix incorrect function parameters Potnuri Bharat Teja
2020-05-12 13:36 ` Jason Gunthorpe
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.