1. 06 Mar, 2018 2 commits
    • Bart Van Assche's avatar
      RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access · a1ae7d03
      Bart Van Assche authored
      This patch fixes the following KASAN complaint:
      
      ==================================================================
      BUG: KASAN: stack-out-of-bounds in rxe_post_send+0x77d/0x9b0 [rdma_rxe]
      Read of size 8 at addr ffff880061aef860 by task 01/1080
      
      CPU: 2 PID: 1080 Comm: 01 Not tainted 4.16.0-rc3-dbg+ #2
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
      Call Trace:
      dump_stack+0x85/0xc7
      print_address_description+0x65/0x270
      kasan_report+0x231/0x350
      rxe_post_send+0x77d/0x9b0 [rdma_rxe]
      __ib_drain_sq+0x1ad/0x250 [ib_core]
      ib_drain_qp+0x9/0x30 [ib_core]
      srp_destroy_qp+0x51/0x70 [ib_srp]
      srp_free_ch_ib+0xfc/0x380 [ib_srp]
      srp_create_target+0x1071/0x19e0 [ib_srp]
      kernfs_fop_write+0x180/0x210
      __vfs_write+0xb1/0x2e0
      vfs_write+0xf6/0x250
      SyS_write+0x99/0x110
      do_syscall_64+0xee/0x2b0
      entry_SYSCALL_64_after_hwframe+0x42/0xb7
      
      The buggy address belongs to the page:
      page:ffffea000186bbc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
      flags: 0x4000000000000000()
      raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff
      raw: 0000000000000000 ffffea000186bbe0 0000000000000000 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
      ffff880061aef700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      ffff880061aef780: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00
      >ffff880061aef800: f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2
                                                            ^
      ffff880061aef880: f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 f2 f2
      ffff880061aef900: f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00
      ==================================================================
      
      Fixes: 765d6774 ("IB: new common API for draining queues")
      Signed-off-by: default avatarBart Van Assche <bart.vanassche@wdc.com>
      Cc: Steve Wise <swise@opengridcomputing.com>
      Cc: Sagi Grimberg <sagi@grimberg.me>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      a1ae7d03
    • Colin Ian King's avatar
      infiniband: remove redundant assignment to pointer 'rdi' · 042932f7
      Colin Ian King authored
      The pointer rdi is being initialized with a value that is never read
      and re-assigned immediately after, hence the initialization is redundant
      and can be removed.
      
      Cleans up clang warning:
      drivers/infiniband/sw/rdmavt/vt.c:94:23: warning: Value stored to 'rdi'
      during its initialization is never read
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      042932f7
  2. 28 Feb, 2018 14 commits
  3. 23 Feb, 2018 24 commits