| Message ID | 20200511185608.5202-1-bharat@chelsio.com (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | c8b1f340e54158662acfa41d6dee274846370282 |
| Delegated to: | Jason Gunthorpe |
| Headers | show |
| Series | [v1,for-rc] RDMA/iw_cxgb4: Fix incorrect function parameters | expand |
On Tue, May 12, 2020 at 12:26:08AM +0530, Potnuri Bharat Teja wrote: > Commit '11a27e21', while reading TCB field in t4_tcb_get_field32() passes > wrong mask parameter which leads the driver eventually to access illegal > SRQ index while flushing the SRQ completions during connection teardown. > Fixes kernel panic/app segfault due to incorrect function parameters passed > while reading TCB fields and completing cached SRQ buffers. > > Fixes: 11a27e2121a5 ("iw_cxgb4: complete the cached SRQ buffers") > Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com> > --- > changelog: > v1: updated commit description > --- > drivers/infiniband/hw/cxgb4/cm.c | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) Applied to for-rc, thanks Jason
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c index d69dece3b1d5..30e08bcc9afb 100644 --- a/drivers/infiniband/hw/cxgb4/cm.c +++ b/drivers/infiniband/hw/cxgb4/cm.c @@ -2891,8 +2891,7 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb) srqidx = ABORT_RSS_SRQIDX_G( be32_to_cpu(req->srqidx_status)); if (srqidx) { - complete_cached_srq_buffers(ep, - req->srqidx_status); + complete_cached_srq_buffers(ep, srqidx); } else { /* Hold ep ref until finish_peer_abort() */ c4iw_get_ep(&ep->com); @@ -3878,8 +3877,8 @@ static int read_tcb_rpl(struct c4iw_dev *dev, struct sk_buff *skb) return 0; } - ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_W, - TCB_RQ_START_S); + ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_M, + TCB_RQ_START_S); cleanup: pr_debug("ep %p tid %u %016x\n", ep, ep->hwtid, ep->srqe_idx);
Commit '11a27e21', while reading TCB field in t4_tcb_get_field32() passes wrong mask parameter which leads the driver eventually to access illegal SRQ index while flushing the SRQ completions during connection teardown. Fixes kernel panic/app segfault due to incorrect function parameters passed while reading TCB fields and completing cached SRQ buffers. Fixes: 11a27e2121a5 ("iw_cxgb4: complete the cached SRQ buffers") Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com> --- changelog: v1: updated commit description --- drivers/infiniband/hw/cxgb4/cm.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)