From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Maor Gottlieb <maorg@mellanox.com>,
Leon Romanovsky <leonro@mellanox.com>,
Jason Gunthorpe <jgg@mellanox.com>,
Sasha Levin <sashal@kernel.org>,
linux-rdma@vger.kernel.org
Subject: [PATCH AUTOSEL 5.6 313/606] RDMA/mlx5: Fix NULL pointer dereference in destroy_prefetch_work
Date: Mon, 8 Jun 2020 19:07:18 -0400 [thread overview]
Message-ID: <20200608231211.3363633-313-sashal@kernel.org> (raw)
In-Reply-To: <20200608231211.3363633-1-sashal@kernel.org>
From: Maor Gottlieb <maorg@mellanox.com>
[ Upstream commit 189277f3814c36133f4ff0352f4b5194a38486b6 ]
q_deferred_work isn't initialized when creating an explicit ODP memory
region. This can lead to a NULL pointer dereference when user performs
asynchronous prefetch MR. Fix it by initializing q_deferred_work for
explicit ODP.
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 4 PID: 6074 Comm: kworker/u16:6 Not tainted 5.7.0-rc1-for-upstream-perf-2020-04-17_07-03-39-64 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: events_unbound mlx5_ib_prefetch_mr_work [mlx5_ib]
RIP: 0010:__wake_up_common+0x49/0x120
Code: 04 89 54 24 0c 89 4c 24 08 74 0a 41 f6 01 04 0f 85 8e 00 00 00 48 8b 47 08 48 83 e8 18 4c 8d 67 08 48 8d 50 18 49 39 d4 74 66 <48> 8b 70 18 31 db 4c 8d 7e e8 eb 17 49 8b 47 18 48 8d 50 e8 49 8d
RSP: 0000:ffffc9000097bd88 EFLAGS: 00010082
RAX: ffffffffffffffe8 RBX: ffff888454cd9f90 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffff888454cd9f90
RBP: ffffc9000097bdd0 R08: 0000000000000000 R09: ffffc9000097bdd0
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888454cd9f98
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000003
FS: 0000000000000000(0000) GS:ffff88846fd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000044c19e002 CR4: 0000000000760ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
__wake_up_common_lock+0x7a/0xc0
destroy_prefetch_work+0x5a/0x60 [mlx5_ib]
mlx5_ib_prefetch_mr_work+0x64/0x80 [mlx5_ib]
process_one_work+0x15b/0x360
worker_thread+0x49/0x3d0
kthread+0xf5/0x130
? rescuer_thread+0x310/0x310
? kthread_bind+0x10/0x10
ret_from_fork+0x1f/0x30
Fixes: de5ed007a03d ("IB/mlx5: Fix implicit ODP race")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20200521072504.567406-1-leon@kernel.org
Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/mr.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 6fa0a83c19de..9a1747a97fb6 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1319,6 +1319,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
if (is_odp_mr(mr)) {
to_ib_umem_odp(mr->umem)->private = mr;
+ init_waitqueue_head(&mr->q_deferred_work);
atomic_set(&mr->num_deferred_work, 0);
err = xa_err(xa_store(&dev->odp_mkeys,
mlx5_base_mkey(mr->mmkey.key), &mr->mmkey,
--
2.25.1
next prev parent reply other threads:[~2020-06-09 0:18 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200608231211.3363633-1-sashal@kernel.org>
2020-06-08 23:02 ` [PATCH AUTOSEL 5.6 009/606] net/rds: Use ERR_PTR for rds_message_alloc_sgs() Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.6 071/606] RDMA/uverbs: Do not discard the IB_EVENT_DEVICE_FATAL event Sasha Levin
2020-06-08 23:03 ` [PATCH AUTOSEL 5.6 072/606] RDMA/uverbs: Move IB_EVENT_DEVICE_FATAL to destroy_uobj Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 217/606] net/mlx5: Add command entry handling completion Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 229/606] net/mlx5e: kTLS, Destroy key object after destroying the TIS Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 230/606] net/mlx5e: Fix inner tirs handling Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 231/606] net/mlx5: Fix memory leak in mlx5_events_init Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 232/606] net/mlx5e: Update netdev txq on completions during closure Sasha Levin
2020-06-08 23:05 ` [PATCH AUTOSEL 5.6 233/606] net/mlx5: Fix error flow in case of function_setup failure Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 238/606] net/mlx5: Fix a race when moving command interface to events mode Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 239/606] net/mlx5: Fix cleaning unmanaged flow tables Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 241/606] net/mlx5: Avoid processing commands before cmdif is ready Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 242/606] net/mlx5: Annotate mutex destroy for root ns Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 246/606] net/mlx4_core: fix a memory leak bug Sasha Levin
2020-06-08 23:06 ` [PATCH AUTOSEL 5.6 274/606] IB/i40iw: Remove bogus call to netdev_master_upper_dev_get() Sasha Levin
2020-06-08 23:07 ` [PATCH AUTOSEL 5.6 306/606] IB/qib: Call kobject_put() when kobject_init_and_add() fails Sasha Levin
2020-06-08 23:07 ` Sasha Levin [this message]
2020-06-08 23:07 ` [PATCH AUTOSEL 5.6 317/606] RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200608231211.3363633-313-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jgg@mellanox.com \
--cc=leonro@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=maorg@mellanox.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).