korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-17 09:14:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

[IB] uverbs: Avoid NULL pointer deref on CQ async event

Browse Source 
Userspace CQs that have no completion event channel attached end up
with their cq_context set to NULL.  However, asynchronous events like
"CQ overrun" can still occur on such CQs, so add a uverbs_file member
to struct ib_ucq_object that we can follow to deliver these events.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
Roland Dreier 2005-10-30 09:50:04 -08:00
parent a20583a7c2
commit 7162a3e0db
3 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/infiniband/core/uverbs.h
View File

@ -113,6 +113,7 @@ struct ib_uevent_object {
struct ib_ucq_object { struct ib_ucq_object {
struct ib_uobject uobject; struct ib_uobject uobject;
struct ib_uverbs_file *uverbs_file;
struct list_head comp_list; struct list_head comp_list;
struct list_head async_list; struct list_head async_list;
u32 comp_events_reported; u32 comp_events_reported;

1
drivers/infiniband/core/uverbs_cmd.c
View File

@ -602,6 +602,7 @@ ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file,
uobj->uobject.user_handle = cmd.user_handle; uobj->uobject.user_handle = cmd.user_handle;
uobj->uobject.context = file->ucontext; uobj->uobject.context = file->ucontext;
uobj->uverbs_file = file;
uobj->comp_events_reported = 0; uobj->comp_events_reported = 0;
uobj->async_events_reported = 0; uobj->async_events_reported = 0;
INIT_LIST_HEAD(&uobj->comp_list); INIT_LIST_HEAD(&uobj->comp_list);

9
drivers/infiniband/core/uverbs_main.c
View File

@ -442,13 +442,10 @@ static void ib_uverbs_async_handler(struct ib_uverbs_file *file,
void ib_uverbs_cq_event_handler(struct ib_event *event, void *context_ptr) void ib_uverbs_cq_event_handler(struct ib_event *event, void *context_ptr)
{ {
struct ib_uverbs_event_file *ev_file = context_ptr; struct ib_ucq_object *uobj = container_of(event->element.cq->uobject,
struct ib_ucq_object *uobj; struct ib_ucq_object, uobject);
uobj = container_of(event->element.cq->uobject, ib_uverbs_async_handler(uobj->uverbs_file, uobj->uobject.user_handle,
struct ib_ucq_object, uobject);
ib_uverbs_async_handler(ev_file->uverbs_file, uobj->uobject.user_handle,
event->event, &uobj->async_list, event->event, &uobj->async_list,
&uobj->async_events_reported); &uobj->async_events_reported);