* [PATCH for-rc] RDMA/core: Fix unsafe linked list traversal after failing to allocate CQ
@ 2020-09-01 12:38 Weihang Li
2020-09-02 20:03 ` Jason Gunthorpe
0 siblings, 1 reply; 2+ messages in thread
From: Weihang Li @ 2020-09-01 12:38 UTC (permalink / raw)
To: dledford, jgg; +Cc: leon, linux-rdma, linuxarm
From: Xi Wang <wangxi11@huawei.com>
It's not safe to access the next CQ in list_for_each_entry() after invoking
ib_free_cq(), because the CQ has already been freed in current iteration.
It should be replaced by list_for_each_entry_safe().
Fixes: c7ff819aefea ("RDMA/core: Introduce shared CQ pool API")
Signed-off-by: Xi Wang <wangxi11@huawei.com>
Signed-off-by: Weihang Li <liweihang@huawei.com>
---
drivers/infiniband/core/cq.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c
index 513825e..a92fc3f 100644
--- a/drivers/infiniband/core/cq.c
+++ b/drivers/infiniband/core/cq.c
@@ -379,7 +379,7 @@ static int ib_alloc_cqs(struct ib_device *dev, unsigned int nr_cqes,
{
LIST_HEAD(tmp_list);
unsigned int nr_cqs, i;
- struct ib_cq *cq;
+ struct ib_cq *cq, *n;
int ret;
if (poll_ctx > IB_POLL_LAST_POOL_TYPE) {
@@ -412,7 +412,7 @@ static int ib_alloc_cqs(struct ib_device *dev, unsigned int nr_cqes,
return 0;
out_free_cqs:
- list_for_each_entry(cq, &tmp_list, pool_entry) {
+ list_for_each_entry_safe(cq, n, &tmp_list, pool_entry) {
cq->shared = false;
ib_free_cq(cq);
}
--
2.8.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH for-rc] RDMA/core: Fix unsafe linked list traversal after failing to allocate CQ
2020-09-01 12:38 [PATCH for-rc] RDMA/core: Fix unsafe linked list traversal after failing to allocate CQ Weihang Li
@ 2020-09-02 20:03 ` Jason Gunthorpe
0 siblings, 0 replies; 2+ messages in thread
From: Jason Gunthorpe @ 2020-09-02 20:03 UTC (permalink / raw)
To: Weihang Li; +Cc: dledford, leon, linux-rdma, linuxarm
On Tue, Sep 01, 2020 at 08:38:55PM +0800, Weihang Li wrote:
> From: Xi Wang <wangxi11@huawei.com>
>
> It's not safe to access the next CQ in list_for_each_entry() after invoking
> ib_free_cq(), because the CQ has already been freed in current iteration.
> It should be replaced by list_for_each_entry_safe().
>
> Fixes: c7ff819aefea ("RDMA/core: Introduce shared CQ pool API")
> Signed-off-by: Xi Wang <wangxi11@huawei.com>
> Signed-off-by: Weihang Li <liweihang@huawei.com>
> ---
> drivers/infiniband/core/cq.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
Applied to for-rc, thanks
Jason
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-09-02 20:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-09-01 12:38 [PATCH for-rc] RDMA/core: Fix unsafe linked list traversal after failing to allocate CQ Weihang Li
2020-09-02 20:03 ` Jason Gunthorpe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).