Linux RDMA and InfiniBand development
 help / color / mirror / Atom feed
From: Jason Gunthorpe <jgg@nvidia.com>
To: Kamal Heib <kamalheib1@gmail.com>
Cc: <linux-rdma@vger.kernel.org>, Doug Ledford <dledford@redhat.com>,
	Zhu Yanjun <yanjunz@nvidia.com>
Subject: Re: [PATCH v4 for-rc] RDMA/rxe: Fix panic when calling kmem_cache_create()
Date: Thu, 27 Aug 2020 09:18:22 -0300	[thread overview]
Message-ID: <20200827121822.GA4014126@nvidia.com> (raw)
In-Reply-To: <20200825151725.254046-1-kamalheib1@gmail.com>

On Tue, Aug 25, 2020 at 06:17:25PM +0300, Kamal Heib wrote:
> To avoid the following kernel panic when calling kmem_cache_create()
> with a NULL pointer from pool_cache(), Block the rxe_param_set_add()
> from running if the rdma_rxe module is not initialized.
> 
>  BUG: unable to handle kernel NULL pointer dereference at 000000000000000b
>  PGD 0 P4D 0
>  Oops: 0000 [#1] SMP NOPTI
>  CPU: 4 PID: 8512 Comm: modprobe Kdump: loaded Not tainted 4.18.0-231.el8.x86_64 #1
>  Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 10/02/2018
>  RIP: 0010:kmem_cache_alloc+0xd1/0x1b0
>  Code: 8b 57 18 45 8b 77 1c 48 8b 5c 24 30 0f 1f 44 00 00 5b 48 89 e8 5d 41 5c 41 5d 41 5e 41 5f c3 81 e3 00 00 10 00 75 0e 4d 89 fe <41> f6 47 0b 04 0f 84 6c ff ff ff 4c 89 ff e8 cc da 01 00 49 89 c6
>  RSP: 0018:ffffa2b8c773f9d0 EFLAGS: 00010246
>  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000005
>  RDX: 0000000000000004 RSI: 00000000006080c0 RDI: 0000000000000000
>  RBP: ffff8ea0a8634fd0 R08: ffffa2b8c773f988 R09: 00000000006000c0
>  R10: 0000000000000000 R11: 0000000000000230 R12: 00000000006080c0
>  R13: ffffffffc0a97fc8 R14: 0000000000000000 R15: 0000000000000000
>  FS:  00007f9138ed9740(0000) GS:ffff8ea4ae800000(0000) knlGS:0000000000000000
>  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>  CR2: 000000000000000b CR3: 000000046d59a000 CR4: 00000000003406e0
>  Call Trace:
>   rxe_alloc+0xc8/0x160 [rdma_rxe]
>   rxe_get_dma_mr+0x25/0xb0 [rdma_rxe]
>   __ib_alloc_pd+0xcb/0x160 [ib_core]
>   ib_mad_init_device+0x296/0x8b0 [ib_core]
>   add_client_context+0x11a/0x160 [ib_core]
>   enable_device_and_get+0xdc/0x1d0 [ib_core]
>   ib_register_device+0x572/0x6b0 [ib_core]
>   ? crypto_create_tfm+0x32/0xe0
>   ? crypto_create_tfm+0x7a/0xe0
>   ? crypto_alloc_tfm+0x58/0xf0
>   rxe_register_device+0x19d/0x1c0 [rdma_rxe]
>   rxe_net_add+0x3d/0x70 [rdma_rxe]
>   ? dev_get_by_name_rcu+0x73/0x90
>   rxe_param_set_add+0xaf/0xc0 [rdma_rxe]
>   parse_args+0x179/0x370
>   ? ref_module+0x1b0/0x1b0
>   load_module+0x135e/0x17e0
>   ? ref_module+0x1b0/0x1b0
>   ? __do_sys_init_module+0x13b/0x180
>   __do_sys_init_module+0x13b/0x180
>   do_syscall_64+0x5b/0x1a0
>   entry_SYSCALL_64_after_hwframe+0x65/0xca
>  RIP: 0033:0x7f9137ed296e
> 
> Fixes: 8700e3e7c485 ("Soft RoCE driver")
> Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
> ---
>  drivers/infiniband/sw/rxe/rxe.c       | 4 ++++
>  drivers/infiniband/sw/rxe/rxe.h       | 2 ++
>  drivers/infiniband/sw/rxe/rxe_sysfs.c | 5 +++++
>  3 files changed, 11 insertions(+)

Can you send a PR to rdma-core to delete rxe_cfg as well? In
preperation to remove the module parameters

Applied to for-rc

Thanks,
Jason

  reply	other threads:[~2020-08-27 14:57 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-25 15:17 [PATCH v4 for-rc] RDMA/rxe: Fix panic when calling kmem_cache_create() Kamal Heib
2020-08-27 12:18 ` Jason Gunthorpe [this message]
2020-08-27 14:29   ` Kamal Heib
2020-08-27 14:39     ` Zhu Yanjun
2020-08-27 14:54     ` Jason Gunthorpe
2020-08-27 16:22       ` Bart Van Assche
2020-08-27 16:29         ` Jason Gunthorpe
2020-09-02  5:33       ` Kamal Heib

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200827121822.GA4014126@nvidia.com \
    --to=jgg@nvidia.com \
    --cc=dledford@redhat.com \
    --cc=kamalheib1@gmail.com \
    --cc=linux-rdma@vger.kernel.org \
    --cc=yanjunz@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox