1. 22 Aug, 2017 12 commits
  2. 18 Aug, 2017 26 commits
  3. 17 Aug, 2017 1 commit
  4. 16 Aug, 2017 1 commit
    • Maor Gottlieb's avatar
      IB/uverbs: Fix NULL pointer dereference during device removal · 870201f9
      Maor Gottlieb authored
      As part of ib_uverbs_remove_one which might be triggered upon
      reset flow, we trigger IB_EVENT_DEVICE_FATAL event to userspace
      application.
      If device was removed after uverbs fd was opened but before
      ib_uverbs_get_context was called, the event file will be accessed
      before it was allocated, result in NULL pointer dereference:
      
      [ 72.325873] BUG: unable to handle kernel NULL pointer dereference at (null)
      ...
      [ 72.325984] IP: _raw_spin_lock_irqsave+0x22/0x40
      [ 72.327123] Call Trace:
      [ 72.327168] ib_uverbs_async_handler.isra.8+0x2e/0x160 [ib_uverbs]
      [ 72.327216] ? synchronize_srcu_expedited+0x27/0x30
      [ 72.327269] ib_uverbs_remove_one+0x120/0x2c0 [ib_uverbs]
      [ 72.327330] ib_unregister_device+0xd0/0x180 [ib_core]
      [ 72.327373] mlx5_ib_remove+0x74/0x140 [mlx5_ib]
      [ 72.327422] mlx5_remove_device+0xfb/0x110 [mlx5_core]
      [ 72.327466] mlx5_unregister_interface+0x3c/0xa0 [mlx5_core]
      [ 72.327509] mlx5_ib_cleanup+0x10/0x962 [mlx5_ib]
      [ 72.327546] SyS_delete_module+0x155/0x230
      [ 72.328472] ? exit_to_usermode_loop+0x70/0xa6
      [ 72.329370] do_syscall_64+0x54/0xc0
      [ 72.330262] entry_SYSCALL64_slow_path+0x25/0x25
      
      Fix it by checking that user context was allocated before
      trigger the event.
      
      Fixes: 036b1063 ('IB/uverbs: Enable device removal when there are active user space applications')
      Signed-off-by: default avatarMaor Gottlieb <maorg@mellanox.com>
      Reviewed-by: default avatarMatan Barak <matanb@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      870201f9