RDMA/iw_cxgb4: Fix incorrect function parameters (c8b1f340) · Commits · 戴 / test

While reading the TCB field in t4_tcb_get_field32() the wrong mask is passed as a parameter which leads the driver eventually to a kernel panic/app segfault from access to an illegal SRQ index while flushing the SRQ completions during connection teardown. Fixes: ("iw_cxgb4: complete the cached SRQ buffers") Link: https://lore.kernel.org/r/20200511185608.5202-1-bharat@chelsio.com Signed-off-by:

Potnuri Bharat Teja <bharat@chelsio.com> Signed-off-by:

Jason Gunthorpe <jgg@mellanox.com>

drivers/infiniband/hw/cxgb4/cm.c

+3 −4

Original line number	Diff line number	Diff line
		@@ -2891,8 +2891,7 @@ static int peer_abort(struct c4iw_dev dev, struct sk_buff skb)
		srqidx = ABORT_RSS_SRQIDX_G(
		be32_to_cpu(req->srqidx_status));
		if (srqidx) {
		complete_cached_srq_buffers(ep,
		req->srqidx_status);
		complete_cached_srq_buffers(ep, srqidx);
		} else {
		/* Hold ep ref until finish_peer_abort() */
		c4iw_get_ep(&ep->com);
		@@ -3878,7 +3877,7 @@ static int read_tcb_rpl(struct c4iw_dev dev, struct sk_buff skb)
		return 0;
		}

		ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_W,
		ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_M,
		TCB_RQ_START_S);
		cleanup:
		pr_debug("ep %p tid %u %016x\n", ep, ep->hwtid, ep->srqe_idx);

Admin message