linux_dsm_epyc7002/drivers/infiniband/sw/rxe
Mikhail Malygin 5f0b2a6093 RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue
rxe_post_send_kernel() iterates over linked list of wr's, until the
wr->next ptr is NULL.  However if we've got an interrupt after last wr is
posted, control may be returned to the code after send completion callback
is executed and wr memory is freed.

As a result, wr->next pointer may contain incorrect value leading to
panic. Store the wr->next on the stack before posting it.

Fixes: 8700e3e7c4 ("Soft RoCE driver")
Link: https://lore.kernel.org/r/20200716190340.23453-1-m.malygin@yadro.com
Signed-off-by: Mikhail Malygin <m.malygin@yadro.com>
Signed-off-by: Sergey Kojushev <s.kojushev@yadro.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2020-07-16 16:12:07 -03:00
..
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rxe_av.c RDMA/rxe: Improve loopback marking 2019-02-04 15:57:49 -07:00
rxe_comp.c RDMA/rxe: Fix soft lockup problem due to using tasklets in softirq 2020-02-13 10:51:09 -04:00
rxe_cq.c IB: Pass only ib_udata in function prototypes 2019-04-01 15:00:47 -03:00
rxe_hdr.h RDMA: Use __packed annotation instead of __attribute__ ((packed)) 2019-03-25 21:14:12 -03:00
rxe_hw_counters.c IB/rxe: Make counters thread safe 2018-12-20 14:09:45 -07:00
rxe_hw_counters.h RDMA/rxe: Add link_down, rdma_sends, rdma_recvs stats counters 2018-11-08 14:22:54 -07:00
rxe_icrc.c IB/rxe: Offload CRC calculation when possible 2017-04-21 10:45:02 -04:00
rxe_loc.h RDMA/rxe: Remove rxe_link_layer() 2020-07-16 13:57:21 -03:00
rxe_mcast.c IB/rxe: Remove a pointless indirection layer 2017-01-10 16:52:47 -05:00
rxe_mmap.c mm: don't include asm/pgtable.h if linux/mm.h is already included 2020-06-09 09:39:13 -07:00
rxe_mr.c RDMA/rxe: Return void from rxe_mem_init_dma() 2020-07-16 13:57:21 -03:00
rxe_net.c RDMA/rxe: Remove rxe_link_layer() 2020-07-16 13:57:21 -03:00
rxe_net.h rdma_rxe: Use netlink messages to add/delete links 2019-02-19 20:52:19 -07:00
rxe_opcode.c IB/rxe: add RXE_START_MASK for rxe_opcode IB_OPCODE_RC_SEND_ONLY_INV 2018-04-27 14:20:47 -04:00
rxe_opcode.h
rxe_param.h RDMA/rxe: Set default vendor ID 2020-04-14 15:52:38 -03:00
rxe_pool.c RDMA: Convert CQ allocations to be under core responsibility 2019-06-11 16:39:49 -04:00
rxe_pool.h RDMA: Handle PD allocations by IB/core 2019-02-08 16:51:04 -07:00
rxe_qp.c RDMA/rxe: Fix configuration of atomic queue pair attributes 2020-02-19 16:56:57 -04:00
rxe_queue.c RDMA/rxe: Always return ERR_PTR from rxe_create_mmap_info() 2020-05-12 11:47:00 -03:00
rxe_queue.h RDMA: Replace zero-length array with flexible-array member 2020-02-20 13:33:51 -04:00
rxe_recv.c RDMA/rxe: Skip dgid check in loopback mode 2020-07-07 13:13:32 -03:00
rxe_req.c rxe: correctly calculate iCRC for unaligned payloads 2019-12-09 13:55:26 -05:00
rxe_resp.c rxe: correctly calculate iCRC for unaligned payloads 2019-12-09 13:55:26 -05:00
rxe_srq.c IB: Pass only ib_udata in function prototypes 2019-04-01 15:00:47 -03:00
rxe_sysfs.c rdma_rxe: Use netlink messages to add/delete links 2019-02-19 20:52:19 -07:00
rxe_task.c RDMA/rxe: Suppress gcc 7 fall-through complaints 2017-10-14 20:47:07 -04:00
rxe_task.h
rxe_verbs.c RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue 2020-07-16 16:12:07 -03:00
rxe_verbs.h RDMA/rxe: Fix error type of mmap_offset 2020-01-03 19:43:51 -04:00
rxe.c RDMA/rxe: Return void from rxe_init_port_param() 2020-07-16 13:57:20 -03:00
rxe.h RDMA: Introduce ib_port_phys_state enum 2019-08-12 10:18:52 -04:00