Skip to contentSkip to conversation

Patch "IB/rxe: avoid putting a large struct rxe_qp on stack" has been added to the 4.9-stable tree

PATCH [email protected] 1 participant 1 message Jan 20, 2017

Subsystems (3)
Stable branch InfiniBand Soft-RoCE driver (rxe)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

IB/rxe: avoid putting a large struct rxe_qp on stack

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ib-rxe-avoid-putting-a-large-struct-rxe_qp-on-stack.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From a0fa72683e78979ef1123d679b1c40ae28bd9096 Mon Sep 17 00:00:00 2001

From: Arnd Bergmann <[email protected]>
Date: Mon, 19 Sep 2016 13:57:26 +0200
Subject: IB/rxe: avoid putting a large struct rxe_qp on stack

From: Arnd Bergmann <[email protected]>

commit a0fa72683e78979ef1123d679b1c40ae28bd9096 upstream.

A race condition fix added an rxe_qp structure to the stack in order to be able to perform rollback in rxe_requester(), but the structure is large enough to trigger the warning for possible stack overflow:

drivers/infiniband/sw/rxe/rxe_req.c: In function 'rxe_requester':
drivers/infiniband/sw/rxe/rxe_req.c:757:1: error: the frame size of 2064 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]

This changes the rollback function to only save the psn inside the qp, which is the only field we access in the rollback_qp anyway.

Fixes 3050b9985024 ("IB/rxe: Fix race condition between requester and completer")
Signed-off-by Arnd Bergmann <[email protected]>
Reviewed-by Leon Romanovsky <[email protected]>
Signed-off-by Doug Ledford <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/infiniband/sw/rxe/rxe_req.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/infiniband/sw/rxe/rxe_req.c +7 -7
@@ -548,23 +548,23 @@ static void update_wqe_psn(struct rxe_qp
 static void save_state(struct rxe_send_wqe *wqe,
 		       struct rxe_qp *qp,
 		       struct rxe_send_wqe *rollback_wqe,
-		       struct rxe_qp *rollback_qp)
+		       u32 *rollback_psn)
 {
 	rollback_wqe->state     = wqe->state;
 	rollback_wqe->first_psn = wqe->first_psn;
 	rollback_wqe->last_psn  = wqe->last_psn;
-	rollback_qp->req.psn    = qp->req.psn;
+	*rollback_psn		= qp->req.psn;
 }
 
 static void rollback_state(struct rxe_send_wqe *wqe,
 			   struct rxe_qp *qp,
 			   struct rxe_send_wqe *rollback_wqe,
-			   struct rxe_qp *rollback_qp)
+			   u32 rollback_psn)
 {
 	wqe->state     = rollback_wqe->state;
 	wqe->first_psn = rollback_wqe->first_psn;
 	wqe->last_psn  = rollback_wqe->last_psn;
-	qp->req.psn    = rollback_qp->req.psn;
+	qp->req.psn    = rollback_psn;
 }
 
 static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,

@@ -593,8 +593,8 @@ int rxe_requester(void *arg)
 	int mtu;
 	int opcode;
 	int ret;
-	struct rxe_qp rollback_qp;
 	struct rxe_send_wqe rollback_wqe;
+	u32 rollback_psn;
 
 next_wqe:
 	if (unlikely(!qp->valid || qp->req.state == QP_STATE_ERROR))

@@ -719,7 +719,7 @@ next_wqe:
 	 * rxe_xmit_packet().
 	 * Otherwise, completer might initiate an unjustified retry flow.
 	 */
-	save_state(wqe, qp, &rollback_wqe, &rollback_qp);
+	save_state(wqe, qp, &rollback_wqe, &rollback_psn);
 	update_wqe_state(qp, wqe, &pkt);
 	update_wqe_psn(qp, wqe, &pkt, payload);
 	ret = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp, &pkt, skb);

@@ -727,7 +727,7 @@ next_wqe:
 		qp->need_req_skb = 1;
 		kfree_skb(skb);
 
-		rollback_state(wqe, qp, &rollback_wqe, &rollback_qp);
+		rollback_state(wqe, qp, &rollback_wqe, rollback_psn);
 
 		if (ret == -EAGAIN) {
 			rxe_run_task(&qp->req.task, 1);

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/ib-rxe-avoid-putting-a-large-struct-rxe_qp-on-stack.patch