From: Jason Gunthorpe <jgg@nvidia.com>
To: Li Zhijian <lizhijian@fujitsu.com>
Cc: zyjzyj2000@gmail.com, leon@kernel.org,
linux-rdma@vger.kernel.org, Bob Pearson <rpearsonhpe@gmail.com>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH for-next v2] RDMA/rxe: Fix mr->map double free
Date: Fri, 18 Nov 2022 20:15:43 -0400 [thread overview]
Message-ID: <Y3ggL8RJw6mDaWxT@nvidia.com> (raw)
In-Reply-To: <1667099073-2-1-git-send-email-lizhijian@fujitsu.com>
On Sun, Oct 30, 2022 at 03:04:33AM +0000, Li Zhijian wrote:
> rxe_mr_cleanup() which tries to free mr->map again will be called
> when rxe_mr_init_user() fails.
>
> [43895.939883] CPU: 0 PID: 4917 Comm: rdma_flush_serv Kdump: loaded Not tainted 6.1.0-rc1-roce-flush+ #25
> [43895.942341] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
> [43895.945208] Call Trace:
> [43895.946130] <TASK>
> [43895.946931] dump_stack_lvl+0x45/0x5d
> [43895.948049] panic+0x19e/0x349
> [43895.949010] ? panic_print_sys_info.part.0+0x77/0x77
> [43895.950356] ? asm_sysvec_apic_timer_interrupt+0x16/0x20
> [43895.952589] ? preempt_count_sub+0x14/0xc0
> [43895.953809] end_report.part.0+0x54/0x7c
> [43895.954993] ? rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe]
> [43895.956406] kasan_report.cold+0xa/0xf
> [43895.957668] ? rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe]
> [43895.959090] rxe_mr_cleanup+0x9d/0xf0 [rdma_rxe]
> [43895.960502] __rxe_cleanup+0x10a/0x1e0 [rdma_rxe]
> [43895.961983] rxe_reg_user_mr+0xb7/0xd0 [rdma_rxe]
> [43895.963456] ib_uverbs_reg_mr+0x26a/0x480 [ib_uverbs]
> [43895.964921] ? __lock_acquire+0x876/0x31e0
> [43895.966182] ? ib_uverbs_ex_create_wq+0x630/0x630 [ib_uverbs]
> [43895.967739] ? uverbs_fill_udata+0x1c6/0x330 [ib_uverbs]
> [43895.969204] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x1a2/0x250 [ib_uverbs]
> [43895.971126] ? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x1a0/0x1a0 [ib_uverbs]
> [43895.973094] ? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x1a0/0x1a0 [ib_uverbs]
> [43895.975096] ? uverbs_fill_udata+0x25f/0x330 [ib_uverbs]
> [43895.976466] ib_uverbs_cmd_verbs+0x1397/0x15a0 [ib_uverbs]
> [43895.977930] ? ib_uverbs_handler_UVERBS_METHOD_QUERY_CONTEXT+0x1a0/0x1a0 [ib_uverbs]
> [43895.979937] ? uverbs_fill_udata+0x330/0x330 [ib_uverbs]
Please dont include timestamps in commit messages
> @@ -163,9 +163,8 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length, u64 iova,
> pr_warn("%s: Unable to get virtual address\n",
> __func__);
> err = -ENOMEM;
> - goto err_cleanup_map;
> + goto err_release_umem;
> }
> -
page_address() fails if this is a highmem system and the page hasn't
been kmap'd yet. So the right thing to do is to use kmap..
But this looks right, so applied to for-next
Thanks,
Jason
next prev parent reply other threads:[~2022-11-19 1:19 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-30 3:04 [PATCH for-next v2] RDMA/rxe: Fix mr->map double free Li Zhijian
2022-11-12 3:29 ` lizhijian
2022-11-13 12:40 ` Yanjun Zhu
2022-11-16 0:10 ` Yanjun Zhu
2022-11-16 2:39 ` lizhijian
2022-11-19 0:15 ` Jason Gunthorpe [this message]
2022-11-19 8:25 ` Yanjun Zhu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y3ggL8RJw6mDaWxT@nvidia.com \
--to=jgg@nvidia.com \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=lizhijian@fujitsu.com \
--cc=rpearsonhpe@gmail.com \
--cc=zyjzyj2000@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox