AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

IB/iser: Fix possible NULL deref at iser_inv_desc()

Browse Source 
In case target remote invalidates bogus rkey and signature is not used,
pi_ctx is NULL deref.

The commit also fails the connection on bogus remote invalidation.

Fixes: 59caaed7a7 ("IB/iser: Support the remote invalidation exception")
Signed-off-by: Israel Rukshin <israelr@mellanox.com>
Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
This commit is contained in:
Israel Rukshin 2018-09-26 09:44:18 +00:00 committed by Jason Gunthorpe
parent 3df6e0234a
commit 65f07f5a09
1 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/infiniband/ulp/iser/iser_initiator.c
View File

@ -589,13 +589,19 @@ void iser_login_rsp(struct ib_cq *cq, struct ib_wc *wc)
ib_conn->post_recv_buf_count--; ib_conn->post_recv_buf_count--;
} }
static inline void static inline int
iser_inv_desc(struct iser_fr_desc *desc, u32 rkey) iser_inv_desc(struct iser_fr_desc *desc, u32 rkey)
{ {
if (likely(rkey == desc->rsc.mr->rkey)) if (likely(rkey == desc->rsc.mr->rkey)) {
desc->rsc.mr_valid = 0; desc->rsc.mr_valid = 0;
else if (likely(rkey == desc->pi_ctx->sig_mr->rkey)) } else if (likely(desc->pi_ctx && rkey == desc->pi_ctx->sig_mr->rkey)) {
desc->pi_ctx->sig_mr_valid = 0; desc->pi_ctx->sig_mr_valid = 0;
} else {
iser_err("Bogus remote invalidation for rkey %#x\n", rkey);
return -EINVAL;
}
return 0;
} }
static int static int
@ -623,12 +629,14 @@ iser_check_remote_inv(struct iser_conn *iser_conn,
if (iser_task->dir[ISER_DIR_IN]) { if (iser_task->dir[ISER_DIR_IN]) {
desc = iser_task->rdma_reg[ISER_DIR_IN].mem_h; desc = iser_task->rdma_reg[ISER_DIR_IN].mem_h;
iser_inv_desc(desc, rkey); if (unlikely(iser_inv_desc(desc, rkey)))
return -EINVAL;
} }
if (iser_task->dir[ISER_DIR_OUT]) { if (iser_task->dir[ISER_DIR_OUT]) {
desc = iser_task->rdma_reg[ISER_DIR_OUT].mem_h; desc = iser_task->rdma_reg[ISER_DIR_OUT].mem_h;
iser_inv_desc(desc, rkey); if (unlikely(iser_inv_desc(desc, rkey)))
return -EINVAL;
} }
} else { } else {
iser_err("failed to get task for itt=%d\n", hdr->itt); iser_err("failed to get task for itt=%d\n", hdr->itt);