Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1c980b01 authored by Selvin Xavier's avatar Selvin Xavier Committed by Doug Ledford
Browse files

RDMA/bnxt_re: Dereg MR in FW before freeing the fast_reg_page_list 



If the host buffers are freed before destroying MR in HW,
HW could try accessing these buffers. This could cause a host
crash. Fixing the code to avoid this condition.

Signed-off-by: default avatarSelvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 9152e0b7

drivers/infiniband/hw/bnxt_re/ib_verbs.c

+6 −2
Original line number Diff line number Diff line
@@ -3052,6 +3052,12 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr) 
	struct bnxt_re_dev *rdev = mr->rdev;

	int rc;



	rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);

	if (rc) {

		dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc);

		return rc;

	}



	if (mr->npages && mr->pages) {

		rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res,

							&mr->qplib_frpl);
@@ -3059,8 +3065,6 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr) 
		mr->npages = 0;

		mr->pages = NULL;

	}

	rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr);



	if (!IS_ERR_OR_NULL(mr->ib_umem))

		ib_umem_release(mr->ib_umem);