Wen Gu 71c6aa0305 net/smc: Don't use RMBs not mapped to new link in SMCRv2 ADD LINK ... We encountered a crash when using SMCRv2. It is caused by a logical error in smc_llc_fill_ext_v2(). BUG: kernel NULL pointer dereference, address: 0000000000000014 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 453 Comm: kworker/7:4 Kdump: loaded Tainted: G W E 6.4.0-rc3+ #44 Workqueue: events smc_llc_add_link_work [smc] RIP: 0010:smc_llc_fill_ext_v2+0x117/0x280 [smc] RSP: 0018:ffffacb5c064bd88 EFLAGS: 00010282 RAX: ffff9a6bc1c3c02c RBX: ffff9a6be3558000 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000002 RDI: 000000000000000a RBP: ffffacb5c064bdb8 R08: 0000000000000040 R09: 000000000000000c R10: ffff9a6bc0910300 R11: 0000000000000002 R12: 0000000000000000 R13: 0000000000000002 R14: ffff9a6bc1c3c02c R15: ffff9a6be3558250 FS: 0000000000000000(0000) GS:ffff9a6eefdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000014 CR3: 000000010b078003 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> smc_llc_send_add_link+0x1ae/0x2f0 [smc] smc_llc_srv_add_link+0x2c9/0x5a0 [smc] ? cc_mkenc+0x40/0x60 smc_llc_add_link_work+0xb8/0x140 [smc] process_one_work+0x1e5/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> When an alernate RNIC is available in system, SMC will try to add a new link based on the RNIC for resilience. All the RMBs in use will be mapped to the new link. Then the RMBs' MRs corresponding to the new link will be filled into SMCRv2 LLC ADD LINK messages. However, smc_llc_fill_ext_v2() mistakenly accesses to unused RMBs which haven't been mapped to the new link and have no valid MRs, thus causing a crash. So this patch fixes the logic. Fixes: b4ba4652b3 ("net/smc: extend LLC layer for SMC-Rv2") Signed-off-by: Wen Gu <guwen@linux.alibaba.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2023-05-30 11:26:32 +02:00
..
af_smc.c	net/smc: Reset connection when trying to use SMCRv2 fails.	2023-05-19 08:54:04 +01:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	net/smc: fix compile warning for smc_sysctl	2022-03-07 11:59:17 +00:00
smc_cdc.c	net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()	2023-03-13 16:03:58 -07:00
smc_cdc.h	net/smc: fix kernel panic caused by race of smc_sock	2021-12-28 12:42:45 +00:00
smc_clc.c	net/smc: Separate SMC-D and ISM APIs	2023-01-25 09:46:48 +00:00
smc_clc.h	net/smc: Allow virtually contiguous sndbufs or RMBs for SMC-R	2022-07-18 11:19:17 +01:00
smc_close.c	net: deal with most data-races in sk_wait_event()	2023-05-10 10:03:32 +01:00
smc_close.h	net/smc: remove close abort worker	2019-10-22 11:23:44 -07:00
smc_core.c	net/smc: Reset connection when trying to use SMCRv2 fails.	2023-05-19 08:54:04 +01:00
smc_core.h	net/smc: Use percpu ref for wr tx reference	2023-03-17 08:59:01 +00:00
smc_diag.c	net/smc: Separate SMC-D and ISM APIs	2023-01-25 09:46:48 +00:00
smc_ib.c	mm, treewide: redefine MAX_ORDER sanely	2023-04-05 19:42:46 -07:00
smc_ib.h	net/smc: optimize for smc_sndbuf_sync_sg_for_device and smc_rmb_sync_sg_for_cpu	2022-07-18 11:19:17 +01:00
smc_ism.c	net/smc: Introduce explicit check for v2 support	2023-03-15 08:18:35 +00:00
smc_ism.h	net/smc: Register SMC-D as ISM client	2023-01-25 09:46:48 +00:00
smc_llc.c	net/smc: Don't use RMBs not mapped to new link in SMCRv2 ADD LINK	2023-05-30 11:26:32 +02:00
smc_llc.h	net/smc: Introduce a specific sysctl for TEST_LINK time	2022-09-22 12:58:21 +02:00
smc_netlink.c	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
smc_netlink.h	net/smc: add support for user defined EIDs	2021-09-14 12:49:10 +01:00
smc_netns.h	net/smc: introduce list of pnetids for Ethernet devices	2020-09-28 15:19:03 -07:00
smc_pnet.c	net/smc: De-tangle ism and smc device initialization	2023-01-25 09:46:49 +00:00
smc_pnet.h	net/smc: Use a mutex for locking "struct smc_pnettable"	2022-02-24 09:09:33 -08:00
smc_rx.c	net: deal with most data-races in sk_wait_event()	2023-05-10 10:03:32 +01:00
smc_rx.h	smc: add support for splice()	2018-05-04 11:45:06 -04:00
smc_stats.c	net/smc: Fix ENODATA tests in smc_nl_get_fback_stats()	2021-06-21 12:16:58 -07:00
smc_stats.h	net/smc: Make SMC statistics network namespace aware	2021-06-16 12:54:02 -07:00
smc_sysctl.c	net/smc: Unbind r/w buffer size from clcsock and make them tunable	2022-09-22 12:58:21 +02:00
smc_sysctl.h	net/smc: fix -Wmissing-prototypes warning when CONFIG_SYSCTL not set	2022-03-09 20:02:35 -08:00
smc_tracepoint.c	net/smc: Introduce tracepoint for smcr link down	2021-11-01 13:39:14 +00:00
smc_tracepoint.h	net/smc: Add net namespace for tracepoints	2022-01-02 12:07:39 +00:00
smc_tx.c	net: deal with most data-races in sk_wait_event()	2023-05-10 10:03:32 +01:00
smc_tx.h	net/smc: Cork when sendpage with MSG_SENDPAGE_NOTLAST flag	2022-01-31 15:08:20 +00:00
smc_wr.c	net/smc: Use percpu ref for wr tx reference	2023-03-17 08:59:01 +00:00
smc_wr.h	net/smc: Use percpu ref for wr tx reference	2023-03-17 08:59:01 +00:00
smc.h	smc: preserve const qualifier in smc_sk()	2023-03-18 12:23:33 +00:00