On Thu, Jan 17, 2019 at 12:42:16PM -0800, Dennis Dalessandro wrote:
> From: Mike Marciniszyn <mike.marciniszyn@xxxxxxxxx>
>
> Fix potential memory corruption and panic in loopback for
> IB_WR_SEND variants.
>
> The code blindly assumes the posted length will fit in the
> fetched rwqe, which is not a valid assumption.
>
> Fix by adding a limit test, and triggering the appropriate
> send completion and putting the QP in an error state. This
> mimics the handling for non-loopback QPs.
>
> Fixes: 15703461533a ("IB/{hfi1, qib, rdmavt}: Move ruc_loopback to rdmavt")
> Cc: <stable@xxxxxxxxxxxxxxx> #v4.20+
> Reviewed-by: Michael J. Ruhl <michael.j.ruhl@xxxxxxxxx>
> Signed-off-by: Mike Marciniszyn <mike.marciniszyn@xxxxxxxxx>
> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@xxxxxxxxx>
> ---
> drivers/infiniband/sw/rdmavt/qp.c | 7 ++++++-
> 1 files changed, 6 insertions(+), 1 deletions(-)
Applied to for-rc
Thanks,
Jason
