Messages in this thread Patch in this message | | | From | Jia-Ju Bai <> | Subject | [PATCH V5] rxe: Fix a sleep-in-atomic bug in post_one_send | Date | Mon, 5 Jun 2017 20:23:40 +0800 |
| |
The driver may sleep under a spin lock, and the function call path is: post_one_send (acquire the lock by spin_lock_irqsave) init_send_wqe copy_from_user --> may sleep
There is no flow that makes "qp->is_user" true, and copy_from_user may cause bug when a non-user pointer is used. So the lines of copy_from_user and check of "qp->is_user" are removed.
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com> --- V5: * Remove useless check of "qp->is_user". Thank Leon for pointing it out.
V4: * Remove the line of copy_from_user. Thank Moni for good advice.
V3: * It corrects the mistakes of remaining legacy code in V2. Thank Ram for pointing it out.
V2: * The parameter "flags" is added to restore and save the irq status. Thank Leon for good advice. --- drivers/infiniband/sw/rxe/rxe_verbs.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c index 83d709e..073e667 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.c +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c @@ -740,13 +740,8 @@ static int init_send_wqe(struct rxe_qp *qp, struct ib_send_wr *ibwr, sge = ibwr->sg_list; for (i = 0; i < num_sge; i++, sge++) { - if (qp->is_user && copy_from_user(p, (__user void *) - (uintptr_t)sge->addr, sge->length)) - return -EFAULT; - - else if (!qp->is_user) - memcpy(p, (void *)(uintptr_t)sge->addr, - sge->length); + memcpy(p, (void *)(uintptr_t)sge->addr, + sge->length); p += sge->length; } -- 1.7.9.5
| |