Skip to contentSkip to conversation

RDMA/rxe: missing unlock on error in get_srq_wqe()

PATCH Applied Dan Carpenter 4 participants 5 messages Jun 25, 2021

Subsystems (3)
Kernel janitors InfiniBand Soft-RoCE driver (rxe)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 RDMA/rxe: missing unlock on error in get_srq_wqe()

This error path needs to unlock before returning.

Fixes ec0fa2445c18 ("RDMA/rxe: Fix over copying in get_srq_wqe")
Signed-off-by Dan Carpenter <[email protected]>

---
I'm sort of surprised this one wasn't caught in testing...

 drivers/infiniband/sw/rxe/rxe_resp.c | 1 +
 1 file changed, 1 insertion(+)
drivers/infiniband/sw/rxe/rxe_resp.c +1 -0
index 72cdb170b67b..3743dc39b60c 100644
@@ -314,6 +314,7 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp)
 
 	/* don't trust user space data */
 	if (unlikely(wqe->dma.num_sge > srq->rq.max_sge)) {
+		spin_unlock_bh(&srq->rq.consumer_lock);
 		pr_warn("%s: invalid num_sge in SRQ entry\n", __func__);
 		return RESPST_ERR_MALFORMED_WQE;
 	}
Signature · 1 line
2.30.2
Reviewed-by on v1 1/1
#1 lore raw
Quoted 7 lines · Dan Carpenter

This error path needs to unlock before returning.

Fixes ec0fa2445c18 ("RDMA/rxe: Fix over copying in get_srq_wqe")
Signed-off-by Dan Carpenter <[email protected]>
Reviewed-by Majd Dibbiny <[email protected]>
Quoted 20 lines

---
I'm sort of surprised this one wasn't caught in testing...

drivers/infiniband/sw/rxe/rxe_resp.c | 1 +

1 file changed, 1 insertion(+)
drivers/infiniband/sw/rxe/rxe_resp.c +1 -0
index 72cdb170b67b..3743dc39b60c 100644
@@ -314,6 +314,7 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp)
 
  /* don't trust user space data */
  if (unlikely(wqe->dma.num_sge > srq->rq.max_sge)) {
+        spin_unlock_bh(&srq->rq.consumer_lock);
      pr_warn("%s: invalid num_sge in SRQ entry\n", __func__);
      return RESPST_ERR_MALFORMED_WQE;
  }
Signature · 1 line
2.30.2
#2 lore raw
In reply to Dan Carpenter
Quoted 16 lines · Dan Carpenter

This error path needs to unlock before returning.

Fixes ec0fa2445c18 ("RDMA/rxe: Fix over copying in get_srq_wqe")
Signed-off-by Dan Carpenter <[email protected]>

---
I'm sort of surprised this one wasn't caught in testing...

 drivers/infiniband/sw/rxe/rxe_resp.c | 1 +
 1 file changed, 1 insertion(+)
drivers/infiniband/sw/rxe/rxe_resp.c +0 -0
index 72cdb170b67b..3743dc39b60c 100644

drivers/infiniband/sw/rxe/rxe_resp.c static enum resp_states get_srq_wqe(struct rxe_qp *qp) · line 320

Quoted 7 lines
drivers/infiniband/sw/rxe/rxe_resp.c +1 -0
@@ -314,6 +314,7 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp)
 
 	/* don't trust user space data */
 	if (unlikely(wqe->dma.num_sge > srq->rq.max_sge)) {
+		spin_unlock_bh(&srq->rq.consumer_lock);
 		pr_warn("%s: invalid num_sge in SRQ entry\n", __func__);
 		return RESPST_ERR_MALFORMED_WQE;
 	}

This is correct. Thanks.
Bob Pearson

Reviewed-by
#3 lore raw
Quoted 17 lines · Bob Pearson
Quoted 16 lines · Dan Carpenter

This error path needs to unlock before returning.

Fixes ec0fa2445c18 ("RDMA/rxe: Fix over copying in get_srq_wqe")
Signed-off-by Dan Carpenter <[email protected]>

---
I'm sort of surprised this one wasn't caught in testing...

 drivers/infiniband/sw/rxe/rxe_resp.c | 1 +
 1 file changed, 1 insertion(+)
drivers/infiniband/sw/rxe/rxe_resp.c +0 -0
index 72cdb170b67b..3743dc39b60c 100644
@@ -314,6 +314,7 @@ static enum resp_states get_srq_wqe(struct rxe_qp *qp)
Quoted 11 lines

drivers/infiniband/sw/rxe/rxe_resp.c static enum resp_states get_srq_wqe(struct rxe_qp *qp) · line 320

Quoted 7 lines
drivers/infiniband/sw/rxe/rxe_resp.c +1 -0
 	/* don't trust user space data */
 	if (unlikely(wqe->dma.num_sge > srq->rq.max_sge)) {
+		spin_unlock_bh(&srq->rq.consumer_lock);
 		pr_warn("%s: invalid num_sge in SRQ entry\n", __func__);
 		return RESPST_ERR_MALFORMED_WQE;
 	}

This is correct. Thanks.
Bob Pearson

Should say

Reviewed-by Bob Pearson <[email protected]>
maintainer Applied
#4 lore raw
In reply to Dan Carpenter
Quoted 8 lines · Dan Carpenter

This error path needs to unlock before returning.

Fixes ec0fa2445c18 ("RDMA/rxe: Fix over copying in get_srq_wqe")
Signed-off-by Dan Carpenter <[email protected]>
Reviewed-by Majd Dibbiny <[email protected]>
Reviewed-by Bob Pearson <[email protected]>

---
I'm sort of surprised this one wasn't caught in testing...

Probably because you have to make malformed wqe's..

Applied to for-next, thanks

Jason