lkml.org 
[lkml]   [2020]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.6 115/194] RDMA/iw_cxgb4: Fix incorrect function parameters
    Date
    From: Potnuri Bharat Teja <bharat@chelsio.com>

    [ Upstream commit c8b1f340e54158662acfa41d6dee274846370282 ]

    While reading the TCB field in t4_tcb_get_field32() the wrong mask is
    passed as a parameter which leads the driver eventually to a kernel
    panic/app segfault from access to an illegal SRQ index while flushing the
    SRQ completions during connection teardown.

    Fixes: 11a27e2121a5 ("iw_cxgb4: complete the cached SRQ buffers")
    Link: https://lore.kernel.org/r/20200511185608.5202-1-bharat@chelsio.com
    Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
    Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/infiniband/hw/cxgb4/cm.c | 7 +++----
    1 file changed, 3 insertions(+), 4 deletions(-)

    diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
    index d69dece3b1d54..30e08bcc9afb5 100644
    --- a/drivers/infiniband/hw/cxgb4/cm.c
    +++ b/drivers/infiniband/hw/cxgb4/cm.c
    @@ -2891,8 +2891,7 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
    srqidx = ABORT_RSS_SRQIDX_G(
    be32_to_cpu(req->srqidx_status));
    if (srqidx) {
    - complete_cached_srq_buffers(ep,
    - req->srqidx_status);
    + complete_cached_srq_buffers(ep, srqidx);
    } else {
    /* Hold ep ref until finish_peer_abort() */
    c4iw_get_ep(&ep->com);
    @@ -3878,8 +3877,8 @@ static int read_tcb_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
    return 0;
    }

    - ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_W,
    - TCB_RQ_START_S);
    + ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_M,
    + TCB_RQ_START_S);
    cleanup:
    pr_debug("ep %p tid %u %016x\n", ep, ep->hwtid, ep->srqe_idx);

    --
    2.20.1


    \
     
     \ /
      Last update: 2020-05-18 20:05    [W:4.079 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site