diff options
| author |   Xi Wang <wangxi11@huawei.com> | 2020-09-01 20:38:55 +0800 |
|---|---|---|
| committer |   Jason Gunthorpe <jgg@nvidia.com> | 2020-09-02 15:56:40 -0300 |
| commit | 8aa64be019567c4f90d45c5082a4b6f22e182d00 (patch) | |
| tree | b7ba451adcccf7febccdc91709063f0f2c11132f | |
| parent | RDMA/bnxt_re: Remove the qp from list only if the qp destroy succeeds (diff) | |
| download | linux-dev-8aa64be019567c4f90d45c5082a4b6f22e182d00.tar.xz linux-dev-8aa64be019567c4f90d45c5082a4b6f22e182d00.zip | |
RDMA/core: Fix unsafe linked list traversal after failing to allocate CQ
It's not safe to access the next CQ in list_for_each_entry() after
invoking ib_free_cq(), because the CQ has already been freed in current
iteration. It should be replaced by list_for_each_entry_safe().
Fixes: c7ff819aefea ("RDMA/core: Introduce shared CQ pool API")
Link: https://lore.kernel.org/r/1598963935-32335-1-git-send-email-liweihang@huawei.com
Signed-off-by: Xi Wang <wangxi11@huawei.com>
Signed-off-by: Weihang Li <liweihang@huawei.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
| -rw-r--r-- | drivers/infiniband/core/cq.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c index 513825e424bf..a92fc3f90bb5 100644 --- a/drivers/infiniband/core/cq.c +++ b/drivers/infiniband/core/cq.c @@ -379,7 +379,7 @@ static int ib_alloc_cqs(struct ib_device *dev, unsigned int nr_cqes, { LIST_HEAD(tmp_list); unsigned int nr_cqs, i; - struct ib_cq *cq; + struct ib_cq *cq, *n; int ret; if (poll_ctx > IB_POLL_LAST_POOL_TYPE) { @@ -412,7 +412,7 @@ static int ib_alloc_cqs(struct ib_device *dev, unsigned int nr_cqes, return 0; out_free_cqs: - list_for_each_entry(cq, &tmp_list, pool_entry) { + list_for_each_entry_safe(cq, n, &tmp_list, pool_entry) { cq->shared = false; ib_free_cq(cq); } |