mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-11 12:28:41 +08:00
aaca686713
[ Upstream commitd862060a4b] To avoid the following kernel panic when calling kmem_cache_create() with a NULL pointer from pool_cache(), Block the rxe_param_set_add() from running if the rdma_rxe module is not initialized. BUG: unable to handle kernel NULL pointer dereference at 000000000000000b PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 4 PID: 8512 Comm: modprobe Kdump: loaded Not tainted 4.18.0-231.el8.x86_64 #1 Hardware name: HPE ProLiant DL385 Gen10/ProLiant DL385 Gen10, BIOS A40 10/02/2018 RIP: 0010:kmem_cache_alloc+0xd1/0x1b0 Code: 8b 57 18 45 8b 77 1c 48 8b 5c 24 30 0f 1f 44 00 00 5b 48 89 e8 5d 41 5c 41 5d 41 5e 41 5f c3 81 e3 00 00 10 00 75 0e 4d 89 fe <41> f6 47 0b 04 0f 84 6c ff ff ff 4c 89 ff e8 cc da 01 00 49 89 c6 RSP: 0018:ffffa2b8c773f9d0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000005 RDX: 0000000000000004 RSI: 00000000006080c0 RDI: 0000000000000000 RBP: ffff8ea0a8634fd0 R08: ffffa2b8c773f988 R09: 00000000006000c0 R10: 0000000000000000 R11: 0000000000000230 R12: 00000000006080c0 R13: ffffffffc0a97fc8 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f9138ed9740(0000) GS:ffff8ea4ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000b CR3: 000000046d59a000 CR4: 00000000003406e0 Call Trace: rxe_alloc+0xc8/0x160 [rdma_rxe] rxe_get_dma_mr+0x25/0xb0 [rdma_rxe] __ib_alloc_pd+0xcb/0x160 [ib_core] ib_mad_init_device+0x296/0x8b0 [ib_core] add_client_context+0x11a/0x160 [ib_core] enable_device_and_get+0xdc/0x1d0 [ib_core] ib_register_device+0x572/0x6b0 [ib_core] ? crypto_create_tfm+0x32/0xe0 ? crypto_create_tfm+0x7a/0xe0 ? crypto_alloc_tfm+0x58/0xf0 rxe_register_device+0x19d/0x1c0 [rdma_rxe] rxe_net_add+0x3d/0x70 [rdma_rxe] ? dev_get_by_name_rcu+0x73/0x90 rxe_param_set_add+0xaf/0xc0 [rdma_rxe] parse_args+0x179/0x370 ? ref_module+0x1b0/0x1b0 load_module+0x135e/0x17e0 ? ref_module+0x1b0/0x1b0 ? __do_sys_init_module+0x13b/0x180 __do_sys_init_module+0x13b/0x180 do_syscall_64+0x5b/0x1a0 entry_SYSCALL_64_after_hwframe+0x65/0xca RIP: 0033:0x7f9137ed296e This can be triggered if a user tries to use the 'module option' which is not actually a real module option but some idiotic (and thankfully no obsolete) sysfs interface. Fixes:8700e3e7c4("Soft RoCE driver") Link: https://lore.kernel.org/r/20200825151725.254046-1-kamalheib1@gmail.com Signed-off-by: Kamal Heib <kamalheib1@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
115 lines
3.3 KiB
C
115 lines
3.3 KiB
C
/*
|
|
* Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved.
|
|
* Copyright (c) 2015 System Fabric Works, Inc. All rights reserved.
|
|
*
|
|
* This software is available to you under a choice of one of two
|
|
* licenses. You may choose to be licensed under the terms of the GNU
|
|
* General Public License (GPL) Version 2, available from the file
|
|
* COPYING in the main directory of this source tree, or the
|
|
* OpenIB.org BSD license below:
|
|
*
|
|
* Redistribution and use in source and binary forms, with or
|
|
* without modification, are permitted provided that the following
|
|
* conditions are met:
|
|
*
|
|
* - Redistributions of source code must retain the above
|
|
* copyright notice, this list of conditions and the following
|
|
* disclaimer.
|
|
*
|
|
* - Redistributions in binary form must reproduce the above
|
|
* copyright notice, this list of conditions and the following
|
|
* disclaimer in the documentation and/or other materials
|
|
* provided with the distribution.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
|
|
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
|
|
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
|
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
* SOFTWARE.
|
|
*/
|
|
|
|
#ifndef RXE_H
|
|
#define RXE_H
|
|
|
|
#ifdef pr_fmt
|
|
#undef pr_fmt
|
|
#endif
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
|
|
#include <linux/module.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/crc32.h>
|
|
|
|
#include <rdma/ib_verbs.h>
|
|
#include <rdma/ib_user_verbs.h>
|
|
#include <rdma/ib_pack.h>
|
|
#include <rdma/ib_smi.h>
|
|
#include <rdma/ib_umem.h>
|
|
#include <rdma/ib_cache.h>
|
|
#include <rdma/ib_addr.h>
|
|
#include <crypto/hash.h>
|
|
|
|
#include "rxe_net.h"
|
|
#include "rxe_opcode.h"
|
|
#include "rxe_hdr.h"
|
|
#include "rxe_param.h"
|
|
#include "rxe_verbs.h"
|
|
#include "rxe_loc.h"
|
|
|
|
/*
|
|
* Version 1 and Version 2 are identical on 64 bit machines, but on 32 bit
|
|
* machines Version 2 has a different struct layout.
|
|
*/
|
|
#define RXE_UVERBS_ABI_VERSION 2
|
|
|
|
#define RXE_ROCE_V2_SPORT (0xc000)
|
|
|
|
extern bool rxe_initialized;
|
|
|
|
static inline u32 rxe_crc32(struct rxe_dev *rxe,
|
|
u32 crc, void *next, size_t len)
|
|
{
|
|
u32 retval;
|
|
int err;
|
|
|
|
SHASH_DESC_ON_STACK(shash, rxe->tfm);
|
|
|
|
shash->tfm = rxe->tfm;
|
|
*(u32 *)shash_desc_ctx(shash) = crc;
|
|
err = crypto_shash_update(shash, next, len);
|
|
if (unlikely(err)) {
|
|
pr_warn_ratelimited("failed crc calculation, err: %d\n", err);
|
|
return crc32_le(crc, next, len);
|
|
}
|
|
|
|
retval = *(u32 *)shash_desc_ctx(shash);
|
|
barrier_data(shash_desc_ctx(shash));
|
|
return retval;
|
|
}
|
|
|
|
void rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu);
|
|
|
|
int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name);
|
|
|
|
void rxe_rcv(struct sk_buff *skb);
|
|
|
|
/* The caller must do a matching ib_device_put(&dev->ib_dev) */
|
|
static inline struct rxe_dev *rxe_get_dev_from_net(struct net_device *ndev)
|
|
{
|
|
struct ib_device *ibdev =
|
|
ib_device_get_by_netdev(ndev, RDMA_DRIVER_RXE);
|
|
|
|
if (!ibdev)
|
|
return NULL;
|
|
return container_of(ibdev, struct rxe_dev, ib_dev);
|
|
}
|
|
|
|
void rxe_port_up(struct rxe_dev *rxe);
|
|
void rxe_port_down(struct rxe_dev *rxe);
|
|
void rxe_set_port_state(struct rxe_dev *rxe);
|
|
|
|
#endif /* RXE_H */
|