| From 84e748b0bf219a39d5e2504801e0e66d9ceb7c4a Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 12 May 2020 00:26:08 +0530 |
| Subject: RDMA/iw_cxgb4: Fix incorrect function parameters |
| |
| From: Potnuri Bharat Teja <bharat@chelsio.com> |
| |
| [ Upstream commit c8b1f340e54158662acfa41d6dee274846370282 ] |
| |
| While reading the TCB field in t4_tcb_get_field32() the wrong mask is |
| passed as a parameter which leads the driver eventually to a kernel |
| panic/app segfault from access to an illegal SRQ index while flushing the |
| SRQ completions during connection teardown. |
| |
| Fixes: 11a27e2121a5 ("iw_cxgb4: complete the cached SRQ buffers") |
| Link: https://lore.kernel.org/r/20200511185608.5202-1-bharat@chelsio.com |
| Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com> |
| Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/infiniband/hw/cxgb4/cm.c | 7 +++---- |
| 1 file changed, 3 insertions(+), 4 deletions(-) |
| |
| diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c |
| index d69dece3b1d54..30e08bcc9afb5 100644 |
| --- a/drivers/infiniband/hw/cxgb4/cm.c |
| +++ b/drivers/infiniband/hw/cxgb4/cm.c |
| @@ -2891,8 +2891,7 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb) |
| srqidx = ABORT_RSS_SRQIDX_G( |
| be32_to_cpu(req->srqidx_status)); |
| if (srqidx) { |
| - complete_cached_srq_buffers(ep, |
| - req->srqidx_status); |
| + complete_cached_srq_buffers(ep, srqidx); |
| } else { |
| /* Hold ep ref until finish_peer_abort() */ |
| c4iw_get_ep(&ep->com); |
| @@ -3878,8 +3877,8 @@ static int read_tcb_rpl(struct c4iw_dev *dev, struct sk_buff *skb) |
| return 0; |
| } |
| |
| - ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_W, |
| - TCB_RQ_START_S); |
| + ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_M, |
| + TCB_RQ_START_S); |
| cleanup: |
| pr_debug("ep %p tid %u %016x\n", ep, ep->hwtid, ep->srqe_idx); |
| |
| -- |
| 2.20.1 |
| |