Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/drivers/infiniband/hw/hfi1
History
Daniel Vacek 79cb2bbefa IB/hfi1: Fix sdma.h tx->num_descs off-by-one error 
commit e6f57c6881916df39db7d95981a8ad2b9c3458d6 upstream.

Unfortunately the commit `fd8958efe877` introduced another error
causing the `descs` array to overflow. This reults in further crashes
easily reproducible by `sendmsg` system call.

[ 1080.836473] general protection fault, probably for non-canonical address 0x400300015528b00a: 0000 [#1] PREEMPT SMP PTI
[ 1080.869326] RIP: 0010:hfi1_ipoib_build_ib_tx_headers.constprop.0+0xe1/0x2b0 [hfi1]
--
[ 1080.974535] Call Trace:
[ 1080.976990]  <TASK>
[ 1081.021929]  hfi1_ipoib_send_dma_common+0x7a/0x2e0 [hfi1]
[ 1081.027364]  hfi1_ipoib_send_dma_list+0x62/0x270 [hfi1]
[ 1081.032633]  hfi1_ipoib_send+0x112/0x300 [hfi1]
[ 1081.042001]  ipoib_start_xmit+0x2a9/0x2d0 [ib_ipoib]
[ 1081.046978]  dev_hard_start_xmit+0xc4/0x210
--
[ 1081.148347]  __sys_sendmsg+0x59/0xa0

crash> ipoib_txreq 0xffff9cfeba229f00
struct ipoib_txreq {
  txreq = {
    list = {
      next = 0xffff9cfeba229f00,
      prev = 0xffff9cfeba229f00
    },
    descp = 0xffff9cfeba229f40,
    coalesce_buf = 0x0,
    wait = 0xffff9cfea4e69a48,
    complete = 0xffffffffc0fe0760 <hfi1_ipoib_sdma_complete>,
    packet_len = 0x46d,
    tlen = 0x0,
    num_desc = 0x0,
    desc_limit = 0x6,
    next_descq_idx = 0x45c,
    coalesce_idx = 0x0,
    flags = 0x0,
    descs = {{
        qw = {0x8024000120dffb00, 0x4}  # SDMA_DESC0_FIRST_DESC_FLAG (bit 63)
      }, {
        qw = {  0x3800014231b108, 0x4}
      }, {
        qw = { 0x310000e4ee0fcf0, 0x8}
      }, {
        qw = {  0x3000012e9f8000, 0x8}
      }, {
        qw = {  0x59000dfb9d0000, 0x8}
      }, {
        qw = {  0x78000e02e40000, 0x8}
      }}
  },
  sdma_hdr =  0x400300015528b000,  <<< invalid pointer in the tx request structure
  sdma_status = 0x0,                   SDMA_DESC0_LAST_DESC_FLAG (bit 62)
  complete = 0x0,
  priv = 0x0,
  txq = 0xffff9cfea4e69880,
  skb = 0xffff9d099809f400
}

If an SDMA send consists of exactly 6 descriptors and requires dword
padding (in the 7th descriptor), the sdma_txreq descriptor array is not
properly expanded and the packet will overflow into the container
structure. This results in a panic when the send completion runs. The
exact panic varies depending on what elements of the container structure
get corrupted. The fix is to use the correct expression in
_pad_sdma_tx_descs() to test the need to expand the descriptor array.

With this patch the crashes are no longer reproducible and the machine is
stable.

Fixes: fd8958efe877 ("IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors")
Cc: stable@vger.kernel.org
Reported-by: Mats Kronberg <kronberg@nsc.liu.se>
Tested-by: Mats Kronberg <kronberg@nsc.liu.se>
Signed-off-by: Daniel Vacek <neelx@redhat.com>
Link: https://lore.kernel.org/r/20240201081009.1109442-1-neelx@redhat.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-18 22:25:37 +01:00
..
affinity.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
affinity.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
aspm.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
aspm.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
chip.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
chip.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
chip_registers.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
common.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
debugfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
debugfs.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
device.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
device.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
driver.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
efivar.c RDMA/hfi1: Workaround truncation compilation error 2024-11-18 11:43:04 +01:00
efivar.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eprom.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eprom.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exp_rcv.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exp_rcv.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fault.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fault.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
file_ops.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
firmware.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hfi.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
init.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
intr.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iowait.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iowait.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipoib.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipoib_main.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipoib_rx.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipoib_tx.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mad.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mad.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mmu_rb.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mmu_rb.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
msix.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
msix.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netdev.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netdev_rx.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
opa_compat.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
opfn.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
opfn.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pcie.c RDMA/hfi1: Use FIELD_GET() to extract Link Width 2024-11-18 11:43:13 +01:00
pio.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pio.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pio_copy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
platform.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
platform.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qp.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qsfp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qsfp.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rc.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ruc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sdma.c IB/hfi1: Fix sdma.h tx->num_descs off-by-one error 2024-11-18 22:25:37 +01:00
sdma.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sdma_txreq.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tid_rdma.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tid_rdma.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_ctxts.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_dbg.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_ibhdrs.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_iowait.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_misc.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_mmu.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_rc.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_rx.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_tid.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace_tx.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ud.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user_exp_rcv.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user_exp_rcv.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user_pages.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user_sdma.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user_sdma.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
verbs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
verbs.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
verbs_txreq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
verbs_txreq.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vnic.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vnic_main.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vnic_sdma.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00