From: Greg KH <greg@kroah.com>
To: Steve Wise <swise@opengridcomputing.com>
Cc: stable@vger.kernel.org
Subject: Re: [iw_cxgb4 linux-4.9.y] iw_cxgb4: only allow 1 flush on user qps
Date: Thu, 27 Sep 2018 10:54:02 +0200 [thread overview]
Message-ID: <20180927085402.GA14055@kroah.com> (raw)
In-Reply-To: <20180926204612.1507522668@smtp.opengridcomputing.com>
On Wed, Sep 26, 2018 at 01:43:54PM -0700, Steve Wise wrote:
> commit 308aa2b8f7b7db3332a7d41099fd37851fb793b2 upstream
>
> Once the qp has been flushed, it cannot be flushed again. The user qp
> flush logic wasn't enforcing it however. The bug can cause
> touch-after-free crashes like:
>
> Unable to handle kernel paging request for data at address 0x000001ec
> Faulting instruction address: 0xc008000016069100
> Oops: Kernel access of bad area, sig: 11 [#1]
> ...
> NIP [c008000016069100] flush_qp+0x80/0x480 [iw_cxgb4]
> LR [c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
> Call Trace:
> [c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
> [c00800001606e868] c4iw_ib_modify_qp+0x118/0x200 [iw_cxgb4]
> [c0080000119eae80] ib_security_modify_qp+0xd0/0x3d0 [ib_core]
> [c0080000119c4e24] ib_modify_qp+0xc4/0x2c0 [ib_core]
> [c008000011df0284] iwcm_modify_qp_err+0x44/0x70 [iw_cm]
> [c008000011df0fec] destroy_cm_id+0xcc/0x370 [iw_cm]
> [c008000011ed4358] rdma_destroy_id+0x3c8/0x520 [rdma_cm]
> [c0080000134b0540] ucma_close+0x90/0x1b0 [rdma_ucm]
> [c000000000444da4] __fput+0xe4/0x2f0
>
> So fix flush_qp() to only flush the wq once.
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Steve Wise <swise@opengridcomputing.com>
> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
>
> Conflicts:
> drivers/infiniband/hw/cxgb4/qp.c
This "conflicts:" lines are not needed. I'll go delete them, but please
be more careful next time...
greg k-h
prev parent reply other threads:[~2018-09-27 15:11 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-26 20:43 [iw_cxgb4 linux-4.9.y] iw_cxgb4: only allow 1 flush on user qps Steve Wise
2018-09-27 8:54 ` Greg KH [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180927085402.GA14055@kroah.com \
--to=greg@kroah.com \
--cc=stable@vger.kernel.org \
--cc=swise@opengridcomputing.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.