From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC167C433E1 for ; Mon, 17 Aug 2020 16:59:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 97B0E20658 for ; Mon, 17 Aug 2020 16:59:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597683596; bh=FRCL61IC4KkMCwsvHbvzfLirFPw0GAkt4ULtxNsZt5o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=lBX2joonnxBDFxEIoEjAkFgG3uKCDwIrHtqt2ZQ6kh2bYTVXORgiNBBy98Pf/d5Yx CQNhGQA/rBZ3133jeZp+RkSxRtpoKrph+nlX70Lk1VVjkr31ApM2KzklMrgBmBGgXN 28cTIS0alTrKFsrwCT1a079GToMwa9nq4gxQoi38= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389193AbgHQQ7y (ORCPT ); Mon, 17 Aug 2020 12:59:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:53418 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388228AbgHQQFf (ORCPT ); Mon, 17 Aug 2020 12:05:35 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D39AD20657; Mon, 17 Aug 2020 16:05:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597680329; bh=FRCL61IC4KkMCwsvHbvzfLirFPw0GAkt4ULtxNsZt5o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eiDB9hBf+kGlKfAJZUG+qYPJKYOzzc6aRc6Do36pPIYoSeAiLWeCT9Y06c9C9DgPY RzJzKco9q1wQv+6M4Sv87nr4sv9DdaT6B2huzOsD1y4Vo4Q93PzmbGc9YYEwtsMOBG 6Io2OAxKr0cbCNNDwGqXury+9nwwLbHN8r0d7RK4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikhail Malygin , Sergey Kojushev , Jason Gunthorpe , Sasha Levin Subject: [PATCH 5.4 144/270] RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue Date: Mon, 17 Aug 2020 17:15:45 +0200 Message-Id: <20200817143802.974793631@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200817143755.807583758@linuxfoundation.org> References: <20200817143755.807583758@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mikhail Malygin [ Upstream commit 5f0b2a6093a4d9aab093964c65083fe801ef1e58 ] rxe_post_send_kernel() iterates over linked list of wr's, until the wr->next ptr is NULL. However if we've got an interrupt after last wr is posted, control may be returned to the code after send completion callback is executed and wr memory is freed. As a result, wr->next pointer may contain incorrect value leading to panic. Store the wr->next on the stack before posting it. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20200716190340.23453-1-m.malygin@yadro.com Signed-off-by: Mikhail Malygin Signed-off-by: Sergey Kojushev Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin --- drivers/infiniband/sw/rxe/rxe_verbs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c index 623129f27f5a1..71358b0b8910c 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.c +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c @@ -679,6 +679,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, unsigned int mask; unsigned int length = 0; int i; + struct ib_send_wr *next; while (wr) { mask = wr_opcode_mask(wr->opcode, qp); @@ -695,6 +696,8 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, break; } + next = wr->next; + length = 0; for (i = 0; i < wr->num_sge; i++) length += wr->sg_list[i].length; @@ -705,7 +708,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, *bad_wr = wr; break; } - wr = wr->next; + wr = next; } rxe_run_task(&qp->req.task, 1); -- 2.25.1