android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

RDMA/bnxt_re: Dereg MR in FW before freeing the fast_reg_page_list

Browse Source 
If the host buffers are freed before destroying MR in HW,
HW could try accessing these buffers. This could cause a host
crash. Fixing the code to avoid this condition.

Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
This commit is contained in:
Selvin Xavier 2017-05-22 03:15:34 -07:00 committed by Doug Ledford
parent 9152e0b722
commit 1c980b010f
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/infiniband/hw/bnxt_re/ib_verbs.c
View File

@ -3052,6 +3052,12 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
struct bnxt_re_dev *rdev = mr->rdev; struct bnxt_re_dev *rdev = mr->rdev;
int rc; int rc;
rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
if (rc) {
dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc);
return rc;
}
if (mr->npages && mr->pages) { if (mr->npages && mr->pages) {
rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res, rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,
&mr->qplib_frpl); &mr->qplib_frpl);
@ -3059,8 +3065,6 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr)
mr->npages = 0; mr->npages = 0;
mr->pages = NULL; mr->pages = NULL;
} }
rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);
if (!IS_ERR_OR_NULL(mr->ib_umem)) if (!IS_ERR_OR_NULL(mr->ib_umem))
ib_umem_release(mr->ib_umem); ib_umem_release(mr->ib_umem);