diff options
| author |   Kaike Wan <kaike.wan@intel.com> | 2019-08-15 15:20:39 -0400 |
|---|---|---|
| committer |   Doug Ledford <dledford@redhat.com> | 2019-08-20 13:44:44 -0400 |
| commit | 35d5c8b82e2c32e8e29ca195bb4dac60ba7d97fc (patch) | |
| tree | 356e53f60ec949c0c2982af66742a60a6c6074b3 /drivers | |
| parent | IB/hfi1: Drop stale TID RDMA packets (diff) | |
| download | linux-dev-35d5c8b82e2c32e8e29ca195bb4dac60ba7d97fc.tar.xz linux-dev-35d5c8b82e2c32e8e29ca195bb4dac60ba7d97fc.zip | |
IB/hfi1: Unsafe PSN checking for TID RDMA READ Resp packet
When processing a TID RDMA READ RESP packet that causes KDETH EFLAGS
errors, the packet's IB PSN is checked against qp->s_last_psn and
qp->s_psn without the protection of qp->s_lock, which is not safe.
This patch fixes the issue by acquiring qp->s_lock first.
Fixes: 9905bf06e890 ("IB/hfi1: Add functions to receive TID RDMA READ response")
Cc: <stable@vger.kernel.org>
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Kaike Wan <kaike.wan@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Link: https://lore.kernel.org/r/20190815192039.105923.7852.stgit@awfm-01.aw.intel.com
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/infiniband/hw/hfi1/tid_rdma.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c index 94070144fef5..01c8b0280700 100644 --- a/drivers/infiniband/hw/hfi1/tid_rdma.c +++ b/drivers/infiniband/hw/hfi1/tid_rdma.c @@ -2687,12 +2687,12 @@ static bool handle_read_kdeth_eflags(struct hfi1_ctxtdata *rcd, u32 fpsn; lockdep_assert_held(&qp->r_lock); + spin_lock(&qp->s_lock); /* If the psn is out of valid range, drop the packet */ if (cmp_psn(ibpsn, qp->s_last_psn) < 0 || cmp_psn(ibpsn, qp->s_psn) > 0) - return ret; + goto s_unlock; - spin_lock(&qp->s_lock); /* * Note that NAKs implicitly ACK outstanding SEND and RDMA write * requests and implicitly NAK RDMA read and atomic requests issued |