Bob Pearson b00683422f RDMA/rxe: Fix ref count error in check_rkey() ... There is a reference count error in error path code and a potential race in check_rkey() in rxe_resp.c. When looking up the rkey for a memory window the reference to the mw from rxe_lookup_mw() is dropped before a reference is taken on the mr referenced by the mw. If the mr is destroyed immediately after the call to rxe_put(mw) the mr pointer is unprotected and may end up pointing at freed memory. The rxe_get(mr) call should take place before the rxe_put(mw) call. All errors in check_rkey() call rxe_put(mw) if mw is not NULL but it was already called after the above. The mw pointer should be set to NULL after the rxe_put(mw) call to prevent this from happening. Fixes: cdd0b85675 ("RDMA/rxe: Implement memory access through MWs") Link: https://lore.kernel.org/r/20230517211509.1819998-1-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>		2023-06-01 14:27:36 -03:00
..
core	v6.4 merge window RDMA pull request	2023-04-29 17:21:24 -07:00
hw	RDMA/irdma: Fix Local Invalidate fencing	2023-05-29 14:06:29 -03:00
sw	RDMA/rxe: Fix ref count error in check_rkey()	2023-06-01 14:27:36 -03:00
ulp	RDMA/rtrs: Fix rxe_dealloc_pd warning	2023-06-01 13:13:02 -03:00
Kconfig	RDMA: Disable IB HW for UML	2022-12-04 15:22:03 +02:00
Makefile