Patch "RDMA/rxe: Fix the use-before-initialization error of resp_pkts" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    RDMA/rxe: Fix the use-before-initialization error of resp_pkts

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rdma-rxe-fix-the-use-before-initialization-error-of-.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 77eee5c4907f7e98885ea3eb51275214d50807a7
Author: Zhu Yanjun <yanjun.zhu@xxxxxxxxx>
Date:   Fri Jun 2 11:54:08 2023 +0800

    RDMA/rxe: Fix the use-before-initialization error of resp_pkts
    
    [ Upstream commit 2a62b6210ce876c596086ab8fd4c8a0c3d10611a ]
    
    In the following:
    
      Call Trace:
       <TASK>
       __dump_stack lib/dump_stack.c:88 [inline]
       dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
       assign_lock_key kernel/locking/lockdep.c:982 [inline]
       register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295
       __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951
       lock_acquire kernel/locking/lockdep.c:5691 [inline]
       lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656
       __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
       _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162
       skb_dequeue+0x20/0x180 net/core/skbuff.c:3639
       drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline]
       rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652
       rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761
       execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473
       __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233
       rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
    
    This is a use-before-initialization problem.
    
    It happens because rxe_qp_do_cleanup is called during error unwind before
    the struct has been fully initialized.
    
    Move the initialization of the skb earlier.
    
    Fixes: 8700e3e7c485 ("Soft RoCE driver")
    Link: https://lore.kernel.org/r/20230602035408.741534-1-yanjun.zhu@xxxxxxxxx
    Reported-by: syzbot+eba589d8f49c73d356da@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Zhu Yanjun <yanjun.zhu@xxxxxxxxx>
    Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
index f48a624de493d..59b2024b34ef4 100644
--- a/drivers/infiniband/sw/rxe/rxe_qp.c
+++ b/drivers/infiniband/sw/rxe/rxe_qp.c
@@ -180,6 +180,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp,
 	spin_lock_init(&qp->rq.producer_lock);
 	spin_lock_init(&qp->rq.consumer_lock);
 
+	skb_queue_head_init(&qp->req_pkts);
+	skb_queue_head_init(&qp->resp_pkts);
+
 	atomic_set(&qp->ssn, 0);
 	atomic_set(&qp->skb_out, 0);
 }
@@ -240,8 +243,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
 	qp->req.opcode		= -1;
 	qp->comp.opcode		= -1;
 
-	skb_queue_head_init(&qp->req_pkts);
-
 	rxe_init_task(&qp->req.task, qp, rxe_requester);
 	rxe_init_task(&qp->comp.task, qp, rxe_completer);
 
@@ -288,8 +289,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
 		}
 	}
 
-	skb_queue_head_init(&qp->resp_pkts);
-
 	rxe_init_task(&qp->resp.task, qp, rxe_responder);
 
 	qp->resp.opcode		= OPCODE_NONE;