]> git.baikalelectronics.ru Git - kernel.git/commit
RDMA/rxe: Zero out index member of struct rxe_queue
authorXiao Yang <yangx.jy@fujitsu.com>
Fri, 20 Aug 2021 11:15:09 +0000 (19:15 +0800)
committerJason Gunthorpe <jgg@nvidia.com>
Fri, 20 Aug 2021 18:48:58 +0000 (15:48 -0300)
commit04ea134e9e2e56503da36cd49d0b7b3ee88860f2
tree926a27cccf0b31b81a774222e34362edaed3149d
parentad890d667b4d8307e82e2c3eb4b2f078b5b8acc3
RDMA/rxe: Zero out index member of struct rxe_queue

1) New index member of struct rxe_queue was introduced but not zeroed so
   the initial value of index may be random.

2) The current index is not masked off to index_mask.

In this case producer_addr() and consumer_addr() will get an invalid
address by the random index and then accessing the invalid address
triggers the following panic:

"BUG: unable to handle page fault for address: ffff9ae2c07a1414"

Fix the issue by using kzalloc() to zero out index member.

Fixes: 416368f51042 ("RDMA/rxe: Protext kernel index from user space")
Link: https://lore.kernel.org/r/20210820111509.172500-1-yangx.jy@fujitsu.com
Signed-off-by: Xiao Yang <yangx.jy@fujitsu.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
drivers/infiniband/sw/rxe/rxe_queue.c