On 8/20/21 6:15 AM, Xiao Yang wrote:
> 1) New index member of struct rxe_queue is introduced but not zeroed
> so the initial value of index may be random.
> 2) Current index is not masked off to index_mask.
> In such case, producer_addr() and consumer_addr() will get an invalid
> address by the random index and then accessing the invalid address
> triggers the following panic:
> "BUG: unable to handle page fault for address: ffff9ae2c07a1414"
>
> Fix the issue by using kzalloc() to zero out index member.
>
> Fixes: 5bcf5a59c41e ("RDMA/rxe: Protext kernel index from user space")
> Signed-off-by: Xiao Yang <yangx.jy@xxxxxxxxxxx>
> ---
> drivers/infiniband/sw/rxe/rxe_queue.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/infiniband/sw/rxe/rxe_queue.c b/drivers/infiniband/sw/rxe/rxe_queue.c
> index 85b812586ed4..72d95398e604 100644
> --- a/drivers/infiniband/sw/rxe/rxe_queue.c
> +++ b/drivers/infiniband/sw/rxe/rxe_queue.c
> @@ -63,7 +63,7 @@ struct rxe_queue *rxe_queue_init(struct rxe_dev *rxe, int *num_elem,
> if (*num_elem < 0)
> goto err1;
>
> - q = kmalloc(sizeof(*q), GFP_KERNEL);
> + q = kzalloc(sizeof(*q), GFP_KERNEL);
> if (!q)
> goto err1;
>
>
Thanks for this!! I am happy to take the blame but this has been there from the original 2016 rxe commit. Its a good catch.
Reviewed-by: Bob Pearson <rpearsonhpe@xxxxxxxxx>
