leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
master
linux/drivers/infiniband/core
History
Chen Zhongjin 07c0d131cc RDMA/core: Fix null-ptr-deref in ib_core_cleanup() 
KASAN reported a null-ptr-deref error:

  KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
  CPU: 1 PID: 379
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
  RIP: 0010:destroy_workqueue+0x2f/0x740
  RSP: 0018:ffff888016137df8 EFLAGS: 00000202
  ...
  Call Trace:
   ib_core_cleanup+0xa/0xa1 [ib_core]
   __do_sys_delete_module.constprop.0+0x34f/0x5b0
   do_syscall_64+0x3a/0x90
   entry_SYSCALL_64_after_hwframe+0x63/0xcd
  RIP: 0033:0x7fa1a0d221b7
  ...

It is because the fail of roce_gid_mgmt_init() is ignored:

 ib_core_init()
   roce_gid_mgmt_init()
     gid_cache_wq = alloc_ordered_workqueue # fail
 ...
 ib_core_cleanup()
   roce_gid_mgmt_cleanup()
     destroy_workqueue(gid_cache_wq)
     # destroy an unallocated wq

Fix this by catching the fail of roce_gid_mgmt_init() in ib_core_init().

Fixes: 03db3a2d81 ("IB/core: Add RoCE GID table management")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Link: https://lore.kernel.org/r/20221025024146.109137-1-chenzhongjin@huawei.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2022-10-28 12:59:40 -03:00
..
addr.c RDMA/core: Delete useless module.h include 2022-01-28 13:03:12 -04:00
agent.c
agent.h
cache.c RDMA/core: Delete useless module.h include 2022-01-28 13:03:12 -04:00
cgroup.c
cm_msgs.h RDMA/core: Add necessary spaces 2021-04-12 14:52:22 -03:00
cm_trace.c RDMA/cm: Replace pr_debug() call sites with tracepoints 2020-08-24 19:41:41 -03:00
cm_trace.h RDMA/cm: Add tracepoints to track MAD send operations 2020-08-24 19:41:41 -03:00
cm.c RDMA/cm: Use DLID from inbound/outbound PathRecords as the datapath DLID 2022-09-22 12:35:31 +03:00
cma_configfs.c IB: move from strlcpy with unused retval to strscpy 2022-08-21 14:18:02 +03:00
cma_priv.h RDMA/core: Add an rb_tree that stores cm_ids sorted by ifindex and remote IP 2022-06-16 09:54:35 +03:00
cma_trace.c
cma_trace.h RDMA/core: Move the rdma_show_ib_cm_event() macro 2020-08-24 16:01:47 -03:00
cma.c RDMA/cma: Use output interface for net_dev check 2022-10-19 10:02:52 +03:00
core_priv.h RDMA/core: Create clean QP creations interface for uverbs 2021-08-03 15:26:19 -03:00
counters.c RDMA/counter: Add optional counter support 2021-10-12 12:48:05 -03:00
cq.c RDMA/core: Delete useless module.h include 2022-01-28 13:03:12 -04:00
device.c RDMA/core: Fix null-ptr-deref in ib_core_cleanup() 2022-10-28 12:59:40 -03:00
ib_core_uverbs.c RDMA/core: Ensure that rdma_user_mmap_entry_remove() is a fence 2020-01-25 14:48:33 -04:00
iwcm.c RDMA/iwcm: Release resources if iw_cm module initialization fails 2021-07-30 10:01:40 -03:00
iwcm.h RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private 2021-06-08 14:35:44 -03:00
iwpm_msg.c RDMA/iwpm: Rely on the rdma_nl_[un]register() to ensure that requests are valid 2021-07-30 10:01:41 -03:00
iwpm_util.c RDMA/iwpm: Remove redundant initialization of pointer err_str 2021-10-12 13:11:46 -03:00
iwpm_util.h RDMA/core: Delete useless module.h include 2022-01-28 13:03:12 -04:00
lag.c RDMA/core: Remove 'device' argument from rdma_build_skb() 2022-08-28 14:29:07 +03:00
mad_priv.h RDMA/core: Remove refcount from struct ib_mad_snoop_private 2021-06-08 14:43:28 -03:00
mad_rmpp.c RDMA/core: Remove redundant spaces 2021-04-12 14:56:48 -03:00
mad_rmpp.h
mad.c RDMA/core: Fix incorrect print format specifier 2021-06-21 15:38:30 -03:00
Makefile RDMA/umem: Support importing dma-buf as user memory region 2021-01-20 16:07:52 -04:00
mr_pool.c
multicast.c RDMA/core: Use refcount_t instead of atomic_t on refcount of mcast_port 2021-06-08 14:45:07 -03:00
netlink.c RDMA/core: Fix incorrect print format specifier 2021-06-21 15:38:30 -03:00
nldev.c RDMA/core: Fix null-ptr-deref in ib_core_cleanup() 2022-10-28 12:59:40 -03:00
opa_smi.h RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
packer.c
rdma_core.c RDMA: Correct duplicated words in comments 2022-06-24 16:52:28 -03:00
rdma_core.h IB/uverbs: Introduce create/destroy QP commands over ioctl 2020-05-21 20:39:36 -03:00
restrack.c RDMA: Globally allocate and release QP memory 2021-08-03 13:44:27 -03:00
restrack.h RDMA/restrack: Improve readability in task name management 2020-09-22 19:47:35 -03:00
roce_gid_mgmt.c IB: Fix repeated words 'the the' comments 2022-07-22 12:02:29 -03:00
rw.c RDMA/rw: drop pci_p2pdma_[un]map_sg() 2022-07-26 07:28:07 -04:00
sa_query.c RDMA/cma: Multiple path records support with netlink channel 2022-09-22 12:35:21 +03:00
sa.h RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
security.c IB/core: Removed port validity check from ib_get_cached_subnet_prefix 2021-06-21 20:49:32 -03:00
smi.c RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
smi.h RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
sysfs.c RDMA: Use default_groups in kobj_type 2022-01-05 15:15:15 -04:00
trace.c RDMA/core: Clean up tracepoint headers 2020-07-06 14:54:46 -03:00
ucma.c RDMA/core: Rename rdma_route.num_paths field to num_pri_alt_paths 2022-09-22 12:35:13 +03:00
ud_header.c RDMA/core: Fix incorrect print format specifier 2021-06-21 15:38:30 -03:00
umem_dmabuf.c RDMA: Handle the return code from dma_resv_wait_timeout() properly 2022-08-16 17:13:23 +03:00
umem_odp.c Linux 6.0 2022-10-06 19:48:45 -03:00
umem.c RDMA: Use the sg_table directly and remove the opencoded version from umem 2021-08-24 19:52:40 -03:00
user_mad.c RDMA/core: Fix incorrect print format specifier 2021-06-21 15:38:30 -03:00
uverbs_cmd.c IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers 2022-09-22 12:46:39 +03:00
uverbs_ioctl.c RDMA/core: Add UVERBS_ATTR_RAW_FD 2022-09-27 10:15:24 -03:00
uverbs_main.c RDMA/core: Use refcount_t instead of atomic_t on refcount of ib_uverbs_device 2021-06-08 15:04:36 -03:00
uverbs_marshall.c RDMA/core: Don't infoleak GRH fields 2022-01-05 16:30:19 -04:00
uverbs_std_types_async_fd.c RDMA/core: Make FD destroy callback void 2020-11-12 12:32:17 -04:00
uverbs_std_types_counters.c RDMA/core: Postpone uobject cleanup on failure till FD close 2020-11-12 12:32:17 -04:00
uverbs_std_types_cq.c RDMA/core: Postpone uobject cleanup on failure till FD close 2020-11-12 12:32:17 -04:00
uverbs_std_types_device.c RDMA/uverbs: Fix a NULL vs IS_ERR() bug 2021-05-19 15:32:07 -03:00
uverbs_std_types_dm.c RDMA/core: Postpone uobject cleanup on failure till FD close 2020-11-12 12:32:17 -04:00
uverbs_std_types_flow_action.c RDMA/core: Delete IPsec flow action logic from the core 2022-04-09 08:25:06 +03:00
uverbs_std_types_mr.c RDMA/uverbs: Track dmabuf memory regions 2021-08-19 09:59:53 -03:00
uverbs_std_types_qp.c Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error" 2022-03-14 20:39:21 -03:00
uverbs_std_types_srq.c RDMA/core: Postpone uobject cleanup on failure till FD close 2020-11-12 12:32:17 -04:00
uverbs_std_types_wq.c RDMA/core: Postpone uobject cleanup on failure till FD close 2020-11-12 12:32:17 -04:00
uverbs_std_types.c RDMA/core: Make FD destroy callback void 2020-11-12 12:32:17 -04:00
uverbs_uapi.c RDMA/uverbs: Check for null return of kmalloc_array 2022-01-05 14:16:53 -04:00
uverbs.h RDMA/core: Use refcount_t instead of atomic_t on refcount of ib_uverbs_device 2021-06-08 15:04:36 -03:00
verbs.c RDMA/core: Clean up a variable name in ib_create_srq_user() 2022-09-22 14:31:05 +03:00