From: <devesh.sharma-laKkSmNT4hbQT0dZR+AlfA@public.gmane.org> To: linux-nfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Cc: linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Devesh Sharma <devesh.sharma-laKkSmNT4hbQT0dZR+AlfA@public.gmane.org> Subject: [PATCH] NFS-RDMA: fix qp pointer validation checks Date: Tue, 8 Apr 2014 04:00:05 +0530 [thread overview] Message-ID: <d4afd436-8e14-4729-9bc1-71ab9079a246@CMEXHTCAS1.ad.emulex.com> (raw) From: Devesh Sharma <devesh.sharma-laKkSmNT4hbQT0dZR+AlfA@public.gmane.org> If the rdma_create_qp fails to create qp due to device firmware being in invalid state xprtrdma still tries to destroy the non-existant qp and ends up in a NULL pointer reference crash. Adding proper checks for vaidating QP pointer avoids this to happen. Signed-off-by: Devesh Sharma <devesh.sharma-laKkSmNT4hbQT0dZR+AlfA@public.gmane.org> --- net/sunrpc/xprtrdma/verbs.c | 34 ++++++++++++++++++++++++++++------ 1 files changed, 28 insertions(+), 6 deletions(-) diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c index 9372656..c01d91e 100644 --- a/net/sunrpc/xprtrdma/verbs.c +++ b/net/sunrpc/xprtrdma/verbs.c @@ -620,7 +620,7 @@ rpcrdma_ia_close(struct rpcrdma_ia *ia) __func__, rc); } if (ia->ri_id != NULL && !IS_ERR(ia->ri_id)) { - if (ia->ri_id->qp) + if (!IS_ERR(ia->ri_id->qp)) rdma_destroy_qp(ia->ri_id); rdma_destroy_id(ia->ri_id); ia->ri_id = NULL; @@ -794,7 +794,7 @@ rpcrdma_ep_destroy(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia) dprintk("RPC: %s: entering, connected is %d\n", __func__, ep->rep_connected); - if (ia->ri_id->qp) { + if (!IS_ERR(ia->ri_id->qp)) { rc = rpcrdma_ep_disconnect(ep, ia); if (rc) dprintk("RPC: %s: rpcrdma_ep_disconnect" @@ -831,10 +831,12 @@ rpcrdma_ep_connect(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia) if (ep->rep_connected != 0) { struct rpcrdma_xprt *xprt; retry: - rc = rpcrdma_ep_disconnect(ep, ia); - if (rc && rc != -ENOTCONN) - dprintk("RPC: %s: rpcrdma_ep_disconnect" + if (!IS_ERR(ia->ri_id->qp)) { + rc = rpcrdma_ep_disconnect(ep, ia); + if (rc && rc != -ENOTCONN) + dprintk("RPC: %s: rpcrdma_ep_disconnect" " status %i\n", __func__, rc); + } rpcrdma_clean_cq(ep->rep_cq); xprt = container_of(ia, struct rpcrdma_xprt, rx_ia); @@ -859,7 +861,9 @@ retry: goto out; } /* END TEMP */ - rdma_destroy_qp(ia->ri_id); + if (!IS_ERR(ia->ri_id->qp)) { + rdma_destroy_qp(ia->ri_id); + } rdma_destroy_id(ia->ri_id); ia->ri_id = id; } @@ -1557,6 +1561,13 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg, frmr_wr.wr.fast_reg.rkey = seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey; DECR_CQCOUNT(&r_xprt->rx_ep); + if (IS_ERR(ia->ri_is->qp)) { + rc = PTR_ERR(ia->ri_is->qp); + while (i--) + rpcrdma_unmap_one(ia, --seg); + goto out; + } + rc = ib_post_send(ia->ri_id->qp, post_wr, &bad_wr); if (rc) { @@ -1571,6 +1582,7 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg, seg1->mr_len = len; } *nsegs = i; +out: return rc; } @@ -1592,6 +1604,10 @@ rpcrdma_deregister_frmr_external(struct rpcrdma_mr_seg *seg, invalidate_wr.ex.invalidate_rkey = seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey; DECR_CQCOUNT(&r_xprt->rx_ep); + if (IS_ERR(ia->ri_id->qp)) { + return PTR_ERR(ia->ri_id->qp); + } + rc = ib_post_send(ia->ri_id->qp, &invalidate_wr, &bad_wr); if (rc) dprintk("RPC: %s: failed ib_post_send for invalidate," @@ -1923,6 +1939,9 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia, send_wr.send_flags = IB_SEND_SIGNALED; } + if (IS_ERR(ia->ri_id->qp)) + return PTR_ERR(ia->ri_id->qp); + rc = ib_post_send(ia->ri_id->qp, &send_wr, &send_wr_fail); if (rc) dprintk("RPC: %s: ib_post_send returned %i\n", __func__, @@ -1951,6 +1970,9 @@ rpcrdma_ep_post_recv(struct rpcrdma_ia *ia, rep->rr_iov.addr, rep->rr_iov.length, DMA_BIDIRECTIONAL); DECR_CQCOUNT(ep); + + if (IS_ERR(ia->ri_id->qp)) + return PTR_ERR(ia->ri_id->qp); rc = ib_post_recv(ia->ri_id->qp, &recv_wr, &recv_wr_fail); if (rc) -- 1.7.1 -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html
WARNING: multiple messages have this Message-ID (diff)
From: <devesh.sharma@emulex.com> To: <linux-nfs@vger.kernel.org> Cc: <linux-rdma@vger.kernel.org>, Devesh Sharma <devesh.sharma@emulex.com> Subject: [PATCH] NFS-RDMA: fix qp pointer validation checks Date: Tue, 8 Apr 2014 04:00:05 +0530 [thread overview] Message-ID: <d4afd436-8e14-4729-9bc1-71ab9079a246@CMEXHTCAS1.ad.emulex.com> (raw) From: Devesh Sharma <devesh.sharma@emulex.com> If the rdma_create_qp fails to create qp due to device firmware being in invalid state xprtrdma still tries to destroy the non-existant qp and ends up in a NULL pointer reference crash. Adding proper checks for vaidating QP pointer avoids this to happen. Signed-off-by: Devesh Sharma <devesh.sharma@emulex.com> --- net/sunrpc/xprtrdma/verbs.c | 34 ++++++++++++++++++++++++++++------ 1 files changed, 28 insertions(+), 6 deletions(-) diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c index 9372656..c01d91e 100644 --- a/net/sunrpc/xprtrdma/verbs.c +++ b/net/sunrpc/xprtrdma/verbs.c @@ -620,7 +620,7 @@ rpcrdma_ia_close(struct rpcrdma_ia *ia) __func__, rc); } if (ia->ri_id != NULL && !IS_ERR(ia->ri_id)) { - if (ia->ri_id->qp) + if (!IS_ERR(ia->ri_id->qp)) rdma_destroy_qp(ia->ri_id); rdma_destroy_id(ia->ri_id); ia->ri_id = NULL; @@ -794,7 +794,7 @@ rpcrdma_ep_destroy(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia) dprintk("RPC: %s: entering, connected is %d\n", __func__, ep->rep_connected); - if (ia->ri_id->qp) { + if (!IS_ERR(ia->ri_id->qp)) { rc = rpcrdma_ep_disconnect(ep, ia); if (rc) dprintk("RPC: %s: rpcrdma_ep_disconnect" @@ -831,10 +831,12 @@ rpcrdma_ep_connect(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia) if (ep->rep_connected != 0) { struct rpcrdma_xprt *xprt; retry: - rc = rpcrdma_ep_disconnect(ep, ia); - if (rc && rc != -ENOTCONN) - dprintk("RPC: %s: rpcrdma_ep_disconnect" + if (!IS_ERR(ia->ri_id->qp)) { + rc = rpcrdma_ep_disconnect(ep, ia); + if (rc && rc != -ENOTCONN) + dprintk("RPC: %s: rpcrdma_ep_disconnect" " status %i\n", __func__, rc); + } rpcrdma_clean_cq(ep->rep_cq); xprt = container_of(ia, struct rpcrdma_xprt, rx_ia); @@ -859,7 +861,9 @@ retry: goto out; } /* END TEMP */ - rdma_destroy_qp(ia->ri_id); + if (!IS_ERR(ia->ri_id->qp)) { + rdma_destroy_qp(ia->ri_id); + } rdma_destroy_id(ia->ri_id); ia->ri_id = id; } @@ -1557,6 +1561,13 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg, frmr_wr.wr.fast_reg.rkey = seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey; DECR_CQCOUNT(&r_xprt->rx_ep); + if (IS_ERR(ia->ri_is->qp)) { + rc = PTR_ERR(ia->ri_is->qp); + while (i--) + rpcrdma_unmap_one(ia, --seg); + goto out; + } + rc = ib_post_send(ia->ri_id->qp, post_wr, &bad_wr); if (rc) { @@ -1571,6 +1582,7 @@ rpcrdma_register_frmr_external(struct rpcrdma_mr_seg *seg, seg1->mr_len = len; } *nsegs = i; +out: return rc; } @@ -1592,6 +1604,10 @@ rpcrdma_deregister_frmr_external(struct rpcrdma_mr_seg *seg, invalidate_wr.ex.invalidate_rkey = seg1->mr_chunk.rl_mw->r.frmr.fr_mr->rkey; DECR_CQCOUNT(&r_xprt->rx_ep); + if (IS_ERR(ia->ri_id->qp)) { + return PTR_ERR(ia->ri_id->qp); + } + rc = ib_post_send(ia->ri_id->qp, &invalidate_wr, &bad_wr); if (rc) dprintk("RPC: %s: failed ib_post_send for invalidate," @@ -1923,6 +1939,9 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia, send_wr.send_flags = IB_SEND_SIGNALED; } + if (IS_ERR(ia->ri_id->qp)) + return PTR_ERR(ia->ri_id->qp); + rc = ib_post_send(ia->ri_id->qp, &send_wr, &send_wr_fail); if (rc) dprintk("RPC: %s: ib_post_send returned %i\n", __func__, @@ -1951,6 +1970,9 @@ rpcrdma_ep_post_recv(struct rpcrdma_ia *ia, rep->rr_iov.addr, rep->rr_iov.length, DMA_BIDIRECTIONAL); DECR_CQCOUNT(ep); + + if (IS_ERR(ia->ri_id->qp)) + return PTR_ERR(ia->ri_id->qp); rc = ib_post_recv(ia->ri_id->qp, &recv_wr, &recv_wr_fail); if (rc) -- 1.7.1
next reply other threads:[~2014-04-07 22:30 UTC|newest] Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top 2014-04-07 22:30 devesh.sharma-laKkSmNT4hbQT0dZR+AlfA [this message] 2014-04-07 22:30 ` [PATCH] NFS-RDMA: fix qp pointer validation checks devesh.sharma [not found] ` <d4afd436-8e14-4729-9bc1-71ab9079a246-3RiH6ntJJkP8BX6JNMqfyFjyZtpTMMwT@public.gmane.org> 2014-04-07 23:27 ` Trond Myklebust 2014-04-07 23:27 ` Trond Myklebust [not found] ` <61E8946F-3722-4707-A948-065D395C365A-7I+n7zu2hftEKMMhf/gKZA@public.gmane.org> 2014-04-07 23:45 ` Devesh Sharma 2014-04-07 23:45 ` Devesh Sharma [not found] ` <EE7902D3F51F404C82415C4803930ACD3FDE9AE4-DWYeeINJQrxExQ8dmkPuX0M9+F4ksjoh@public.gmane.org> 2014-04-08 0:00 ` Trond Myklebust 2014-04-08 0:00 ` Trond Myklebust [not found] ` <20CBB511-EB06-485E-A2F9-B8D66806D5B6-7I+n7zu2hftEKMMhf/gKZA@public.gmane.org> 2014-04-08 0:07 ` Devesh Sharma 2014-04-08 0:07 ` Devesh Sharma [not found] ` <EE7902D3F51F404C82415C4803930ACD3FDE9B21-DWYeeINJQrxExQ8dmkPuX0M9+F4ksjoh@public.gmane.org> 2014-04-08 0:13 ` Trond Myklebust 2014-04-08 0:13 ` Trond Myklebust [not found] ` <32A7DFD3-50C7-45D8-A0B1-5417173E14E6-7I+n7zu2hftEKMMhf/gKZA@public.gmane.org> 2014-04-08 2:07 ` Devesh Sharma 2014-04-08 2:07 ` Devesh Sharma
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=d4afd436-8e14-4729-9bc1-71ab9079a246@CMEXHTCAS1.ad.emulex.com \ --to=devesh.sharma-lakksmnt4hbqt0dzr+alfa@public.gmane.org \ --cc=linux-nfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ --cc=linux-rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.