From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, syzkaller <syzkaller@googlegroups.com>,
Maor Gottlieb <maorg@mellanox.com>,
Leon Romanovsky <leonro@mellanox.com>,
Doug Ledford <dledford@redhat.com>
Subject: [PATCH 4.16 25/26] RDMA/mlx5: Fix NULL dereference while accessing XRC_TGT QPs
Date: Wed, 25 Apr 2018 12:33:34 +0200 [thread overview]
Message-ID: <20180425103315.851181264@linuxfoundation.org> (raw)
In-Reply-To: <20180425103314.842517924@linuxfoundation.org>
4.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
commit 75a4598209cbe45540baa316c3b51d9db222e96e upstream.
mlx5 modify_qp() relies on FW that the error will be thrown if wrong
state is supplied. The missing check in FW causes the following crash
while using XRC_TGT QPs.
[ 14.769632] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 14.771085] IP: mlx5_ib_modify_qp+0xf60/0x13f0
[ 14.771894] PGD 800000001472e067 P4D 800000001472e067 PUD 14529067 PMD 0
[ 14.773126] Oops: 0002 [#1] SMP PTI
[ 14.773763] CPU: 0 PID: 365 Comm: ubsan Not tainted 4.16.0-rc1-00038-g8151138c0793 #119
[ 14.775192] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
[ 14.777522] RIP: 0010:mlx5_ib_modify_qp+0xf60/0x13f0
[ 14.778417] RSP: 0018:ffffbf48001c7bd8 EFLAGS: 00010246
[ 14.779346] RAX: 0000000000000000 RBX: ffff9a8f9447d400 RCX: 0000000000000000
[ 14.780643] RDX: 0000000000000000 RSI: 000000000000000a RDI: 0000000000000000
[ 14.781930] RBP: 0000000000000000 R08: 00000000000217b0 R09: ffffffffbc9c1504
[ 14.783214] R10: fffff4a180519480 R11: ffff9a8f94523600 R12: ffff9a8f9493e240
[ 14.784507] R13: ffff9a8f9447d738 R14: 000000000000050a R15: 0000000000000000
[ 14.785800] FS: 00007f545b466700(0000) GS:ffff9a8f9fc00000(0000) knlGS:0000000000000000
[ 14.787073] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 14.787792] CR2: 0000000000000000 CR3: 00000000144be000 CR4: 00000000000006b0
[ 14.788689] Call Trace:
[ 14.789007] _ib_modify_qp+0x71/0x120
[ 14.789475] modify_qp.isra.20+0x207/0x2f0
[ 14.790010] ib_uverbs_modify_qp+0x90/0xe0
[ 14.790532] ib_uverbs_write+0x1d2/0x3c0
[ 14.791049] ? __handle_mm_fault+0x93c/0xe40
[ 14.791644] __vfs_write+0x36/0x180
[ 14.792096] ? handle_mm_fault+0xc1/0x210
[ 14.792601] vfs_write+0xad/0x1e0
[ 14.793018] SyS_write+0x52/0xc0
[ 14.793422] do_syscall_64+0x75/0x180
[ 14.793888] entry_SYSCALL_64_after_hwframe+0x21/0x86
[ 14.794527] RIP: 0033:0x7f545ad76099
[ 14.794975] RSP: 002b:00007ffd78787468 EFLAGS: 00000287 ORIG_RAX: 0000000000000001
[ 14.795958] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f545ad76099
[ 14.797075] RDX: 0000000000000078 RSI: 0000000020009000 RDI: 0000000000000003
[ 14.798140] RBP: 00007ffd78787470 R08: 00007ffd78787480 R09: 00007ffd78787480
[ 14.799207] R10: 00007ffd78787480 R11: 0000000000000287 R12: 00005599ada98760
[ 14.800277] R13: 00007ffd78787560 R14: 0000000000000000 R15: 0000000000000000
[ 14.801341] Code: 4c 8b 1c 24 48 8b 83 70 02 00 00 48 c7 83 cc 02 00
00 00 00 00 00 48 c7 83 24 03 00 00 00 00 00 00 c7 83 2c 03 00 00 00 00
00 00 <c7> 00 00 00 00 00 48 8b 83 70 02 00 00 c7 40 04 00 00 00 00 4c
[ 14.804012] RIP: mlx5_ib_modify_qp+0xf60/0x13f0 RSP: ffffbf48001c7bd8
[ 14.804838] CR2: 0000000000000000
[ 14.805288] ---[ end trace 3f1da0df5c8b7c37 ]---
Cc: syzkaller <syzkaller@googlegroups.com>
Reported-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx5/qp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -3157,7 +3157,8 @@ static int __mlx5_ib_modify_qp(struct ib
* If we moved a kernel QP to RESET, clean up all old CQ
* entries and reinitialize the QP.
*/
- if (new_state == IB_QPS_RESET && !ibqp->uobject) {
+ if (new_state == IB_QPS_RESET &&
+ !ibqp->uobject && ibqp->qp_type != IB_QPT_XRC_TGT) {
mlx5_ib_cq_clean(recv_cq, base->mqp.qpn,
ibqp->srq ? to_msrq(ibqp->srq) : NULL);
if (send_cq != recv_cq)
next prev parent reply other threads:[~2018-04-25 10:34 UTC|newest]
Thread overview: 34+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-25 10:33 [PATCH 4.16 00/26] 4.16.5-stable review Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 01/26] cifs: smbd: Check for iov length on sending the last iov Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 02/26] cifs: do not allow creating sockets except with SMB1 posix exensions Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 03/26] btrfs: fix unaligned access in readdir Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 04/26] btrfs: Fix race condition between delayed refs and blockgroup removal Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 05/26] x86/acpi: Prevent X2APIC id 0xffffffff from being accounted Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 06/26] clocksource/imx-tpm: Correct -ETIME return condition check Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 07/26] posix-cpu-timers: Ensure set_process_cpu_timer is always evaluated Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 08/26] x86/tsc: Prevent 32bit truncation in calc_hpet_ref() Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 09/26] drm/vc4: Fix memory leak during BO teardown Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 10/26] drm/i915/gvt: throw error on unhandled vfio ioctls Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 11/26] drm/i915/gvt: Add drm_format_mod update Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 12/26] drm/i915/bios: filter out invalid DDC pins from VBT child devices Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 13/26] drm/i915/audio: Fix audio detection issue on GLK Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 14/26] drm/i915: Do no use kfree() to free a kmem_cache_alloc() return value Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 15/26] drm/i915: Fix LSPCON TMDS output buffer enabling from low-power state Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 16/26] alarmtimer: Init nanosleep alarm timer on stack Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 17/26] mm,vmscan: Allow preallocating memory for register_shrinker() Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 18/26] netfilter: x_tables: cap allocations at 512 mbyte Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 19/26] netfilter: x_tables: add counters allocation wrapper Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 20/26] netfilter: compat: prepare xt_compat_init_offsets to return errors Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 21/26] netfilter: compat: reject huge allocation requests Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 22/26] netfilter: x_tables: limit allocation requests for blob rule heads Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 23/26] perf: Fix sample_max_stack maximum check Greg Kroah-Hartman
2018-04-25 10:33 ` [PATCH 4.16 24/26] perf: Return proper values for user stack errors Greg Kroah-Hartman
2018-04-25 10:33 ` Greg Kroah-Hartman [this message]
2018-04-25 10:33 ` [PATCH 4.16 26/26] Revert "KVM: X86: Fix SMRAM accessing even if VM is shutdown" Greg Kroah-Hartman
2018-04-25 15:34 ` [PATCH 4.16 00/26] 4.16.5-stable review Guenter Roeck
2018-04-25 15:43 ` Greg Kroah-Hartman
2018-04-25 15:44 ` kernelci.org bot
2018-04-25 18:36 ` Shuah Khan
2018-04-26 5:59 ` Greg Kroah-Hartman
2018-04-25 21:42 ` Dan Rue
2018-04-26 6:59 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180425103315.851181264@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dledford@redhat.com \
--cc=leonro@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maorg@mellanox.com \
--cc=stable@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.