p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
linux_old1/drivers/net
History
Leon Romanovsky 31135eb388 net/mlx5: Fix wrongly assigned CQ reference counter 
The kernel compiled with CONFIG_REFCOUNT_FULL produces the following
error. The reason to it that initial value of refcount_t is supposed
to be more than 0, change it.

[    3.106634] ------------[ cut here ]------------
[    3.107756] refcount_t: increment on 0; use-after-free.
[    3.109130] WARNING: CPU: 0 PID: 1 at lib/refcount.c:153 refcount_inc+0x27/0x30
[    3.110085] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.16.0-rc1-00028-gf683e04bdccc #137
[    3.110085] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
[    3.110085] RIP: 0010:refcount_inc+0x27/0x30
[    3.110085] RSP: 0000:ffffaa620000fba0 EFLAGS: 00010286
[    3.110085] RAX: 0000000000000000 RBX: ffff9a6d1a1821c8 RCX: ffffffff98a50f48
[    3.110085] RDX: 0000000000000001 RSI: 0000000000000086 RDI: 0000000000000246
[    3.110085] RBP: ffff9a6d1ac800a0 R08: 0000000000000289 R09: 000000000000000a
[    3.110085] R10: fffff03bc0682840 R11: ffffffff9949856d R12: ffff9a6d1b4a4000
[    3.110085] R13: 0000000000000000 R14: ffff9a6d1a0a6c00 R15: ffffaa620000fc5c
[    3.110085] FS:  0000000000000000(0000) GS:ffff9a6d1fc00000(0000) knlGS:0000000000000000
[    3.110085] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    3.110085] CR2: 0000000000000000 CR3: 000000000ba0a000 CR4: 00000000000006b0
[    3.110085] Call Trace:
[    3.110085]  mlx5_core_create_cq+0xde/0x250
[    3.110085]  ? __kmalloc+0x1ce/0x1e0
[    3.110085]  mlx5e_create_cq+0x15c/0x1e0
[    3.110085]  mlx5e_open_drop_rq+0xea/0x190
[    3.110085]  mlx5e_attach_netdev+0x53/0x140
[    3.110085]  mlx5e_attach+0x3d/0x60
[    3.110085]  mlx5e_add+0x11d/0x2f0
[    3.110085]  mlx5_add_device+0x77/0x170
[    3.110085]  mlx5_register_interface+0x74/0xc0
[    3.110085]  ? set_debug_rodata+0x11/0x11
[    3.110085]  init+0x67/0x72
[    3.110085]  ? mlx4_en_init_ptys2ethtool_map+0x346/0x346
[    3.110085]  do_one_initcall+0x98/0x147
[    3.110085]  ? set_debug_rodata+0x11/0x11
[    3.110085]  kernel_init_freeable+0x164/0x1e0
[    3.110085]  ? rest_init+0xb0/0xb0
[    3.110085]  kernel_init+0xa/0x100
[    3.110085]  ret_from_fork+0x35/0x40
[    3.110085] Code: 00 00 00 00 e8 ab ff ff ff 84 c0 74 02 f3 c3 80 3d 3b c3 64 01 00 75 f5 48 c7 c7 68 0b 81 98 c6 05 2b c3 64 01 01 e8 79 d7 a3 ff <0f> ff c3 66 0f 1f 44 00 00 8b 06 83 f8 ff 74 39 31 c9 39 f8 89
[    3.110085] ---[ end trace a0068e1c68438a74 ]---

Fixes: f105b45bf7 ("net/mlx5: CQ hold/put API")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
 		2018-03-07 15:54:36 -08:00
..
appletalk
…
arcnet
…
bonding net: bonding: Replace mac address parsing 2017-12-20 12:47:29 -05:00
caif net: caif: remove redundant re-assignment of pointer pfrm 2018-01-22 10:51:56 -05:00
can can: migrate documentation to restructured text 2018-01-26 10:46:44 +01:00
cris
…
dsa net: dsa: mv88e6xxx: Free ATU/VTU irq only when there is chip irq 2018-01-19 15:57:02 -05:00
ethernet net/mlx5: Fix wrongly assigned CQ reference counter 2018-03-07 15:54:36 -08:00
fddi
…
fjes
…
hamradio
…
hippi hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close 2017-12-13 14:52:57 -05:00
hyperv hv_netvsc: Use the num_online_cpus() for channel limit 2018-01-22 16:24:08 -05:00
ieee802154 vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
ipvlan ipvlan: remove excessive packet scrubbing 2017-12-15 11:36:53 -05:00
netdevsim netdevsim: fix overflow on the error path 2018-02-01 11:22:51 +01:00
phy net: phy: fix phy_start to consider PHY_IGNORE_INTERRUPT 2018-02-08 15:35:51 -05:00
plip
…
ppp vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
slip
…
team
…
usb r8152: set rx mode early when linking on 2018-02-02 19:19:00 -05:00
vmxnet3 vmxnet3: remove redundant initialization of pointer 'rq' 2018-02-01 14:54:28 -05:00
wan Merge branch 'misc.poll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-01-30 17:58:07 -08:00
wimax treewide: Use DEVICE_ATTR_WO 2018-01-09 16:34:35 +01:00
wireless vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
xen-netback
…
Kconfig
…
LICENSE.SRC
…
Makefile
…
Space.c
…
dummy.c
…
eql.c
…
geneve.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-01-29 10:15:51 -05:00
gtp.c
…
ifb.c
…
loopback.c
…
macsec.c macsec: restore uAPI after addition of GCM-AES-256 2018-01-22 15:40:16 -05:00
macvlan.c macvlan: Fix one possible double free 2018-01-02 13:30:14 -05:00
macvtap.c
…
mdio.c
…
mii.c
…
netconsole.c
…
nlmon.c
…
ntb_netdev.c
…
rionet.c
…
sb1000.c
…
sungem_phy.c
…
tap.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
thunderbolt.c
…
tun.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
veth.c
…
virtio_net.c virtio_net: Add ethtool stats 2018-01-22 15:25:37 -05:00
vrf.c net: vrf: Add support for sends to local broadcast address 2018-01-25 21:51:03 -05:00
vsockmon.c
…
vxlan.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-01-29 10:15:51 -05:00
xen-netfront.c xen-netfront: Fix race between device setup and open 2018-02-06 09:55:40 +01:00