From: Bernard Metzler <bmt@zurich.ibm.com>
To: dledford@redhat.com, jgg@ziepe.ca, linux-kernel@vger.kernel.org,
linux-rdma@vger.kernel.org, netdev@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Cc: Bernard Metzler <bmt@zurich.ibm.com>
Subject: [PATCH for-rc] RDMA/siw: Fix failure handling during device creation
Date: Wed, 26 Feb 2020 15:29:20 +0100 [thread overview]
Message-ID: <20200226142920.11074-1-bmt@zurich.ibm.com> (raw)
A failing call to ib_device_set_netdev() during device creation
caused system crash due to xa_destroy of uninitialized xarray
hit by device deallocation. Fixed by moving xarray initialization
before potential device deallocation.
Fixes also correct propagation of ib_device_set_netdev() failure
to caller.
Reported-by: syzbot+2e80962bedd9559fe0b3@syzkaller.appspotmail.com
Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com>
---
drivers/infiniband/sw/siw/siw_main.c | 39 ++++++++++++++--------------
1 file changed, 20 insertions(+), 19 deletions(-)
diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
index 96ed349c0939..839decfd9032 100644
--- a/drivers/infiniband/sw/siw/siw_main.c
+++ b/drivers/infiniband/sw/siw/siw_main.c
@@ -303,7 +303,7 @@ static const struct ib_device_ops siw_device_ops = {
static struct siw_device *siw_device_create(struct net_device *netdev)
{
- struct siw_device *sdev = NULL;
+ struct siw_device *sdev;
struct ib_device *base_dev;
struct device *parent = netdev->dev.parent;
int rv;
@@ -319,13 +319,13 @@ static struct siw_device *siw_device_create(struct net_device *netdev)
if (netdev->type != ARPHRD_LOOPBACK) {
pr_warn("siw: device %s error: no parent device\n",
netdev->name);
- return NULL;
+ return ERR_PTR(-EINVAL);
}
parent = &netdev->dev;
}
sdev = ib_alloc_device(siw_device, base_dev);
if (!sdev)
- return NULL;
+ return ERR_PTR(-ENOMEM);
base_dev = &sdev->base_dev;
@@ -388,6 +388,9 @@ static struct siw_device *siw_device_create(struct net_device *netdev)
{ .max_segment_size = SZ_2G };
base_dev->num_comp_vectors = num_possible_cpus();
+ xa_init_flags(&sdev->qp_xa, XA_FLAGS_ALLOC1);
+ xa_init_flags(&sdev->mem_xa, XA_FLAGS_ALLOC1);
+
ib_set_device_ops(base_dev, &siw_device_ops);
rv = ib_device_set_netdev(base_dev, netdev, 1);
if (rv)
@@ -415,9 +418,6 @@ static struct siw_device *siw_device_create(struct net_device *netdev)
sdev->attrs.max_srq_wr = SIW_MAX_SRQ_WR;
sdev->attrs.max_srq_sge = SIW_MAX_SGE;
- xa_init_flags(&sdev->qp_xa, XA_FLAGS_ALLOC1);
- xa_init_flags(&sdev->mem_xa, XA_FLAGS_ALLOC1);
-
INIT_LIST_HEAD(&sdev->cep_list);
INIT_LIST_HEAD(&sdev->qp_list);
@@ -435,7 +435,7 @@ static struct siw_device *siw_device_create(struct net_device *netdev)
error:
ib_dealloc_device(base_dev);
- return NULL;
+ return ERR_PTR(rv);
}
/*
@@ -542,8 +542,8 @@ static struct notifier_block siw_netdev_nb = {
static int siw_newlink(const char *basedev_name, struct net_device *netdev)
{
struct ib_device *base_dev;
- struct siw_device *sdev = NULL;
- int rv = -ENOMEM;
+ struct siw_device *sdev;
+ int rv;
if (!siw_dev_qualified(netdev))
return -EINVAL;
@@ -554,18 +554,19 @@ static int siw_newlink(const char *basedev_name, struct net_device *netdev)
return -EEXIST;
}
sdev = siw_device_create(netdev);
- if (sdev) {
- dev_dbg(&netdev->dev, "siw: new device\n");
+ if (IS_ERR(sdev))
+ return PTR_ERR(sdev);
- if (netif_running(netdev) && netif_carrier_ok(netdev))
- sdev->state = IB_PORT_ACTIVE;
- else
- sdev->state = IB_PORT_DOWN;
+ dev_dbg(&netdev->dev, "siw: new device\n");
- rv = siw_device_register(sdev, basedev_name);
- if (rv)
- ib_dealloc_device(&sdev->base_dev);
- }
+ if (netif_running(netdev) && netif_carrier_ok(netdev))
+ sdev->state = IB_PORT_ACTIVE;
+ else
+ sdev->state = IB_PORT_DOWN;
+
+ rv = siw_device_register(sdev, basedev_name);
+ if (rv)
+ ib_dealloc_device(&sdev->base_dev);
return rv;
}
--
2.17.2
next reply other threads:[~2020-02-26 14:29 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-26 14:29 Bernard Metzler [this message]
2020-02-28 16:17 ` [PATCH for-rc] RDMA/siw: Fix failure handling during device creation Jason Gunthorpe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200226142920.11074-1-bmt@zurich.ibm.com \
--to=bmt@zurich.ibm.com \
--cc=dledford@redhat.com \
--cc=jgg@ziepe.ca \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).