iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/infiniband/core
History
Chen Zhongjin 07c0d131cc RDMA/core: Fix null-ptr-deref in ib_core_cleanup() 
KASAN reported a null-ptr-deref error:

  KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
  CPU: 1 PID: 379
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
  RIP: 0010:destroy_workqueue+0x2f/0x740
  RSP: 0018:ffff888016137df8 EFLAGS: 00000202
  ...
  Call Trace:
   ib_core_cleanup+0xa/0xa1 [ib_core]
   __do_sys_delete_module.constprop.0+0x34f/0x5b0
   do_syscall_64+0x3a/0x90
   entry_SYSCALL_64_after_hwframe+0x63/0xcd
  RIP: 0033:0x7fa1a0d221b7
  ...

It is because the fail of roce_gid_mgmt_init() is ignored:

 ib_core_init()
   roce_gid_mgmt_init()
     gid_cache_wq = alloc_ordered_workqueue # fail
 ...
 ib_core_cleanup()
   roce_gid_mgmt_cleanup()
     destroy_workqueue(gid_cache_wq)
     # destroy an unallocated wq

Fix this by catching the fail of roce_gid_mgmt_init() in ib_core_init().

Fixes: 03db3a2d81e6 ("IB/core: Add RoCE GID table management")
Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com>
Link: https://lore.kernel.org/r/20221025024146.109137-1-chenzhongjin@huawei.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2022-10-28 12:59:40 -03:00
..
addr.c
RDMA/core: Delete useless module.h include
2022-01-28 13:03:12 -04:00
agent.c
…
agent.h
…
cache.c
RDMA/core: Delete useless module.h include
2022-01-28 13:03:12 -04:00
cgroup.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288
2019-06-05 17:36:37 +02:00
cm_msgs.h
RDMA/core: Add necessary spaces
2021-04-12 14:52:22 -03:00
cm_trace.c
RDMA/cm: Replace pr_debug() call sites with tracepoints
2020-08-24 19:41:41 -03:00
cm_trace.h
RDMA/cm: Add tracepoints to track MAD send operations
2020-08-24 19:41:41 -03:00
cm.c
RDMA/cm: Use DLID from inbound/outbound PathRecords as the datapath DLID
2022-09-22 12:35:31 +03:00
cma_configfs.c
IB: move from strlcpy with unused retval to strscpy
2022-08-21 14:18:02 +03:00
cma_priv.h
RDMA/core: Add an rb_tree that stores cm_ids sorted by ifindex and remote IP
2022-06-16 09:54:35 +03:00
cma_trace.c
RDMA/cma: Add trace points in RDMA Connection Manager
2020-01-07 16:10:53 -04:00
cma_trace.h
RDMA/core: Move the rdma_show_ib_cm_event() macro
2020-08-24 16:01:47 -03:00
cma.c
RDMA/cma: Use output interface for net_dev check
2022-10-19 10:02:52 +03:00
core_priv.h
RDMA/core: Create clean QP creations interface for uverbs
2021-08-03 15:26:19 -03:00
counters.c
RDMA/counter: Add optional counter support
2021-10-12 12:48:05 -03:00
cq.c
RDMA/core: Delete useless module.h include
2022-01-28 13:03:12 -04:00
device.c
RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
2022-10-28 12:59:40 -03:00
ib_core_uverbs.c
RDMA/core: Ensure that rdma_user_mmap_entry_remove() is a fence
2020-01-25 14:48:33 -04:00
iwcm.c
RDMA/iwcm: Release resources if iw_cm module initialization fails
2021-07-30 10:01:40 -03:00
iwcm.h
RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private
2021-06-08 14:35:44 -03:00
iwpm_msg.c
RDMA/iwpm: Rely on the rdma_nl_[un]register() to ensure that requests are valid
2021-07-30 10:01:41 -03:00
iwpm_util.c
RDMA/iwpm: Remove redundant initialization of pointer err_str
2021-10-12 13:11:46 -03:00
iwpm_util.h
RDMA/core: Delete useless module.h include
2022-01-28 13:03:12 -04:00
lag.c
RDMA/core: Remove 'device' argument from rdma_build_skb()
2022-08-28 14:29:07 +03:00
mad_priv.h
RDMA/core: Remove refcount from struct ib_mad_snoop_private
2021-06-08 14:43:28 -03:00
mad_rmpp.c
RDMA/core: Remove redundant spaces
2021-04-12 14:56:48 -03:00
mad_rmpp.h
…
mad.c
RDMA/core: Fix incorrect print format specifier
2021-06-21 15:38:30 -03:00
Makefile
RDMA/umem: Support importing dma-buf as user memory region
2021-01-20 16:07:52 -04:00
mr_pool.c
Linux 5.2-rc6
2019-06-28 21:18:23 -03:00
multicast.c
RDMA/core: Use refcount_t instead of atomic_t on refcount of mcast_port
2021-06-08 14:45:07 -03:00
netlink.c
RDMA/core: Fix incorrect print format specifier
2021-06-21 15:38:30 -03:00
nldev.c
RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
2022-10-28 12:59:40 -03:00
opa_smi.h
RDMA: Support more than 255 rdma ports
2021-03-26 09:31:21 -03:00
packer.c
…
rdma_core.c
RDMA: Correct duplicated words in comments
2022-06-24 16:52:28 -03:00
rdma_core.h
IB/uverbs: Introduce create/destroy QP commands over ioctl
2020-05-21 20:39:36 -03:00
restrack.c
RDMA: Globally allocate and release QP memory
2021-08-03 13:44:27 -03:00
restrack.h
RDMA/restrack: Improve readability in task name management
2020-09-22 19:47:35 -03:00
roce_gid_mgmt.c
IB: Fix repeated words 'the the' comments
2022-07-22 12:02:29 -03:00
rw.c
RDMA/rw: drop pci_p2pdma_[un]map_sg()
2022-07-26 07:28:07 -04:00
sa_query.c
RDMA/cma: Multiple path records support with netlink channel
2022-09-22 12:35:21 +03:00
sa.h
RDMA: Support more than 255 rdma ports
2021-03-26 09:31:21 -03:00
security.c
IB/core: Removed port validity check from ib_get_cached_subnet_prefix
2021-06-21 20:49:32 -03:00
smi.c
RDMA: Support more than 255 rdma ports
2021-03-26 09:31:21 -03:00
smi.h
RDMA: Support more than 255 rdma ports
2021-03-26 09:31:21 -03:00
sysfs.c
RDMA: Use default_groups in kobj_type
2022-01-05 15:15:15 -04:00
trace.c
RDMA/core: Clean up tracepoint headers
2020-07-06 14:54:46 -03:00
ucma.c
RDMA/core: Rename rdma_route.num_paths field to num_pri_alt_paths
2022-09-22 12:35:13 +03:00
ud_header.c
RDMA/core: Fix incorrect print format specifier
2021-06-21 15:38:30 -03:00
umem_dmabuf.c
RDMA: Handle the return code from dma_resv_wait_timeout() properly
2022-08-16 17:13:23 +03:00
umem_odp.c
Linux 6.0
2022-10-06 19:48:45 -03:00
umem.c
RDMA: Use the sg_table directly and remove the opencoded version from umem
2021-08-24 19:52:40 -03:00
user_mad.c
RDMA/core: Fix incorrect print format specifier
2021-06-21 15:38:30 -03:00
uverbs_cmd.c
IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
2022-09-22 12:46:39 +03:00
uverbs_ioctl.c
RDMA/core: Add UVERBS_ATTR_RAW_FD
2022-09-27 10:15:24 -03:00
uverbs_main.c
RDMA/core: Use refcount_t instead of atomic_t on refcount of ib_uverbs_device
2021-06-08 15:04:36 -03:00
uverbs_marshall.c
RDMA/core: Don't infoleak GRH fields
2022-01-05 16:30:19 -04:00
uverbs_std_types_async_fd.c
RDMA/core: Make FD destroy callback void
2020-11-12 12:32:17 -04:00
uverbs_std_types_counters.c
RDMA/core: Postpone uobject cleanup on failure till FD close
2020-11-12 12:32:17 -04:00
uverbs_std_types_cq.c
RDMA/core: Postpone uobject cleanup on failure till FD close
2020-11-12 12:32:17 -04:00
uverbs_std_types_device.c
RDMA/uverbs: Fix a NULL vs IS_ERR() bug
2021-05-19 15:32:07 -03:00
uverbs_std_types_dm.c
RDMA/core: Postpone uobject cleanup on failure till FD close
2020-11-12 12:32:17 -04:00
uverbs_std_types_flow_action.c
RDMA/core: Delete IPsec flow action logic from the core
2022-04-09 08:25:06 +03:00
uverbs_std_types_mr.c
RDMA/uverbs: Track dmabuf memory regions
2021-08-19 09:59:53 -03:00
uverbs_std_types_qp.c
Revert "RDMA/core: Fix ib_qp_usecnt_dec() called when error"
2022-03-14 20:39:21 -03:00
uverbs_std_types_srq.c
RDMA/core: Postpone uobject cleanup on failure till FD close
2020-11-12 12:32:17 -04:00
uverbs_std_types_wq.c
RDMA/core: Postpone uobject cleanup on failure till FD close
2020-11-12 12:32:17 -04:00
uverbs_std_types.c
RDMA/core: Make FD destroy callback void
2020-11-12 12:32:17 -04:00
uverbs_uapi.c
RDMA/uverbs: Check for null return of kmalloc_array
2022-01-05 14:16:53 -04:00
uverbs.h
RDMA/core: Use refcount_t instead of atomic_t on refcount of ib_uverbs_device
2021-06-08 15:04:36 -03:00
verbs.c
RDMA/core: Clean up a variable name in ib_create_srq_user()
2022-09-22 14:31:05 +03:00