Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 54e7e48b authored by Ariel Levkovich's avatar Ariel Levkovich Committed by Doug Ledford
Browse files

IB/uverbs: Fix kernel crash during MR deregistration flow 



This patch fixes a crash that happens due to access to an
uninitialized DM pointer within the MR object.

The change makes sure the DM pointer in the MR object is set to
NULL during a non-DM MR creation to prevent a false indication
that this MR is related to a DM in the dereg flow.

Fixes: be934cca ("IB/uverbs: Add device memory registration ioctl support")
Reported-by: default avatarLijun Ou <oulijun@huawei.com>
Signed-off-by: default avatarAriel Levkovich <lariel@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 5ccbf63f

drivers/infiniband/core/uverbs_cmd.c

+1 −0
Original line number Diff line number Diff line
@@ -691,6 +691,7 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file, 


	mr->device  = pd->device;

	mr->pd      = pd;

	mr->dm	    = NULL;

	mr->uobject = uobj;

	atomic_inc(&pd->usecnt);

	mr->res.type = RDMA_RESTRACK_MR;

drivers/infiniband/core/verbs.c

+1 −0
Original line number Diff line number Diff line
@@ -1656,6 +1656,7 @@ struct ib_mr *ib_alloc_mr(struct ib_pd *pd, 
	if (!IS_ERR(mr)) {

		mr->device  = pd->device;

		mr->pd      = pd;

		mr->dm      = NULL;

		mr->uobject = NULL;

		atomic_inc(&pd->usecnt);

		mr->need_inval = false;