Re: [PATCH] RDMA/rxe: Zero out index member of struct rxe_queue
From: "yangx.jy@fujitsu.com" <yangx.jy@fujitsu.com>
Date: 2021-08-20 10:49:10
Hi Olga Kornievskaia, Could you check if this patch can fix your issues? https://www.spinics.net/lists/linux-rdma/msg104358.html https://www.spinics.net/lists/linux-rdma/msg104359.html https://www.spinics.net/lists/linux-rdma/msg104360.html By the way, this patch can fix my panic. Best Regards, Xiao Yang On 2021/8/20 19:15, Xiao Yang wrote:
quoted hunk ↗ jump to hunk
1) New index member of struct rxe_queue is introduced but not zeroed so the initial value of index may be random. 2) Current index is not masked off to index_mask. In such case, producer_addr() and consumer_addr() will get an invalid address by the random index and then accessing the invalid address triggers the following panic: "BUG: unable to handle page fault for address: ffff9ae2c07a1414" Fix the issue by using kzalloc() to zero out index member. Fixes: 5bcf5a59c41e ("RDMA/rxe: Protext kernel index from user space") Signed-off-by: Xiao Yang <yangx.jy@fujitsu.com> --- drivers/infiniband/sw/rxe/rxe_queue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c index 85b812586ed4..72d95398e604 100644 --- a/drivers/infiniband/sw/rxe/rxe_queue.c +++ b/drivers/infiniband/sw/rxe/rxe_queue.c@@ -63,7 +63,7 @@ struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe, int *num_elem, if (*num_elem < 0) goto err1; - q = kmalloc(sizeof(*q), GFP_KERNEL); + q = kzalloc(sizeof(*q), GFP_KERNEL); if (!q) goto err1;