Yacan Liu
e9b1a4f867
net/smc: Fix possible access to freed memory in link clear ...
After modifying the QP to the Error state, all RX WR would be completed
with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not
wait for it is done, but destroy the QP and free the link group directly.
So there is a risk that accessing the freed memory in tasklet context.
Here is a crash example:
BUG: unable to handle page fault for address: ffffffff8f220860
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060
Oops: 0002 [#1 ] SMP PTI
CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23
Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018
RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0
Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32
RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086
RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000
RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00
RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b
R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010
R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040
FS: 0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
_raw_spin_lock_irqsave+0x30/0x40
mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib]
smc_wr_rx_tasklet_fn+0x56/0xa0 [smc]
tasklet_action_common.isra.21+0x66/0x100
__do_softirq+0xd5/0x29c
asm_call_irq_on_stack+0x12/0x20
</IRQ>
do_softirq_own_stack+0x37/0x40
irq_exit_rcu+0x9d/0xa0
sysvec_call_function_single+0x34/0x80
asm_sysvec_call_function_single+0x12/0x20
Fixes: bd4ad57718cc ("smc: initialize IB transport incl. PD, MR, QP, CQ, event, WR")
Signed-off-by: Yacan Liu <liuyacan@corp.netease.com>
Reviewed-by: Tony Lu <tonylu@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-09-07 16:00:48 +01:00
2022-06-09 21:53:28 +02:00
2022-08-08 20:04:35 -07:00
2022-07-14 15:27:35 -07:00
2022-04-06 13:45:26 +01:00
2022-04-28 13:08:15 -07:00
2022-08-05 19:00:02 -07:00
2022-07-30 13:52:47 -04:00
2022-09-02 14:01:28 -07:00
2022-08-09 18:46:11 -07:00
2022-02-25 09:36:06 +01:00
2022-08-31 12:12:32 +02:00
2022-07-22 12:51:45 +01:00
2022-08-09 09:05:06 +02:00
2022-08-03 14:05:39 +02:00
2022-09-07 15:28:08 +01:00
2022-03-03 08:01:55 -08:00
2022-08-01 12:11:56 -07:00
2022-07-29 20:12:49 -07:00
2022-08-31 19:54:04 -07:00
2022-04-07 21:04:03 -07:00
2022-07-25 19:38:31 -07:00
2022-06-10 14:51:35 +02:00
2022-04-28 13:08:15 -07:00
2022-09-06 11:06:31 +02:00
2022-09-05 10:33:34 +01:00
2022-06-10 16:21:27 -07:00
2022-08-31 12:16:44 -07:00
2022-08-24 12:51:50 +01:00
2022-07-08 12:14:36 +01:00
2022-04-15 14:27:24 -07:00
2022-06-09 21:52:55 -07:00
2022-09-04 11:23:11 +01:00
2022-08-29 11:10:22 +02:00
2022-05-25 12:22:58 -07:00
2022-08-29 13:02:27 +01:00
2022-08-24 13:46:58 +01:00
2022-06-23 20:51:06 -07:00
2022-09-01 02:01:56 +02:00
2022-08-10 09:24:41 +01:00
2022-08-18 10:20:48 -07:00
2022-04-06 13:45:26 +01:00
2022-05-28 15:28:47 +01:00
2022-08-26 19:26:30 -07:00
2022-07-29 12:09:27 +01:00
2022-04-12 15:00:25 +02:00
2022-08-15 11:21:42 +01:00
2022-08-12 10:46:01 +01:00
2022-03-18 13:09:17 +02:00
2022-08-22 14:24:54 +01:00
2022-09-01 11:44:13 +01:00
2022-09-02 12:23:26 +01:00
2022-07-28 18:21:16 -07:00
2022-09-07 16:00:48 +01:00
2022-07-08 18:38:44 -07:00
2022-08-22 11:40:01 -07:00
2022-06-09 21:52:55 -07:00
2022-09-02 12:26:29 +01:00
2022-08-17 10:24:00 +01:00
2022-07-09 12:24:16 -07:00
2022-08-10 09:50:18 +01:00
2022-09-03 16:40:06 +02:00
2022-08-08 20:48:51 -07:00
2022-08-15 17:26:07 +02:00
2022-08-24 13:46:57 +01:00
2022-07-24 18:41:03 -06:00
2022-03-03 09:55:28 +00:00
2022-06-02 10:15:05 -07:00
2022-08-24 13:46:58 +01:00
e9b1a4f867