From: Jason Gunthorpe <jgg@nvidia.com>
To: Kamal Heib <kamalheib1@gmail.com>
Cc: linux-rdma@vger.kernel.org,
Michal Kalderon <mkalderon@marvell.com>,
Ariel Elior <aelior@marvell.com>
Subject: Re: [PATCH for-rc] RDMA/qedr: Fix kernel panic when trying to access recv_cq
Date: Wed, 7 Apr 2021 20:29:13 -0300 [thread overview]
Message-ID: <20210407232913.GA601885@nvidia.com> (raw)
In-Reply-To: <20210404125501.154789-1-kamalheib1@gmail.com>
On Sun, Apr 04, 2021 at 03:55:01PM +0300, Kamal Heib wrote:
> As INI QP does not require a recv_cq, avoid the following null pointer
> dereference by checking if the qp_type is not INI before trying to
> extract the recv_cq.
>
> BUG: kernel NULL pointer dereference, address: 00000000000000e0
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 0 P4D 0
> Oops: 0000 [#1] SMP PTI
> CPU: 0 PID: 54250 Comm: mpitests-IMB-MP Not tainted 5.12.0-rc5 #1
> Hardware name: Dell Inc. PowerEdge R320/0KM5PX, BIOS 2.7.0 08/19/2019
> RIP: 0010:qedr_create_qp+0x378/0x820 [qedr]
> Code: 02 00 00 50 e8 29 d4 a9 d1 48 83 c4 18 e9 65 fe ff ff 48 8b 53 10 48 8b 43 18 44 8b 82 e0 00 00 00 45 85 c0 0f 84 10 74 00 00 <8b> b8 e0 00 00 00 85 ff 0f 85 50 fd ff ff e9 fd 73 00 00 48 8d bd
> RSP: 0018:ffff9c8f056f7a70 EFLAGS: 00010202
> RAX: 0000000000000000 RBX: ffff9c8f056f7b58 RCX: 0000000000000009
> RDX: ffff8c41a9744c00 RSI: ffff9c8f056f7b58 RDI: ffff8c41c0dfa280
> RBP: ffff8c41c0dfa280 R08: 0000000000000002 R09: 0000000000000001
> R10: 0000000000000000 R11: ffff8c41e06fc608 R12: ffff8c4194052000
> R13: 0000000000000000 R14: ffff8c4191546070 R15: ffff8c41c0dfa280
> FS: 00007f78b2787b80(0000) GS:ffff8c43a3200000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00000000000000e0 CR3: 00000001011d6002 CR4: 00000000001706f0
> Call Trace:
> ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x4e4/0xb90 [ib_uverbs]
> ? ib_uverbs_cq_event_handler+0x30/0x30 [ib_uverbs]
> ib_uverbs_run_method+0x6f6/0x7a0 [ib_uverbs]
> ? ib_uverbs_handler_UVERBS_METHOD_QP_DESTROY+0x70/0x70 [ib_uverbs]
> ? __cond_resched+0x15/0x30
> ? __kmalloc+0x5a/0x440
> ib_uverbs_cmd_verbs+0x195/0x360 [ib_uverbs]
> ? xa_load+0x6e/0x90
> ? cred_has_capability+0x7c/0x130
> ? avc_has_extended_perms+0x17f/0x440
> ? vma_link+0xae/0xb0
> ? vma_set_page_prot+0x2a/0x60
> ? mmap_region+0x298/0x6c0
> ? do_mmap+0x373/0x520
> ? selinux_file_ioctl+0x17f/0x220
> ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs]
> __x64_sys_ioctl+0x84/0xc0
> do_syscall_64+0x33/0x40
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7f78b120262b
>
> Fixes: 06e8d1df46ed ("RDMA/qedr: Add support for user mode XRC-SRQ's")
> Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
> ---
> drivers/infiniband/hw/qedr/verbs.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
Applied to for-rc, thanks
Jason
prev parent reply other threads:[~2021-04-07 23:29 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-04 12:55 [PATCH for-rc] RDMA/qedr: Fix kernel panic when trying to access recv_cq Kamal Heib
2021-04-07 23:29 ` Jason Gunthorpe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210407232913.GA601885@nvidia.com \
--to=jgg@nvidia.com \
--cc=aelior@marvell.com \
--cc=kamalheib1@gmail.com \
--cc=linux-rdma@vger.kernel.org \
--cc=mkalderon@marvell.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox