Mikhail Malygin 7ecfbee3b9 RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue ... [ Upstream commit 5f0b2a6093 ] rxe_post_send_kernel() iterates over linked list of wr's, until the wr->next ptr is NULL. However if we've got an interrupt after last wr is posted, control may be returned to the code after send completion callback is executed and wr memory is freed. As a result, wr->next pointer may contain incorrect value leading to panic. Store the wr->next on the stack before posting it. Fixes: 8700e3e7c4 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20200716190340.23453-1-m.malygin@yadro.com Signed-off-by: Mikhail Malygin <m.malygin@yadro.com> Signed-off-by: Sergey Kojushev <s.kojushev@yadro.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-08-19 08:16:12 +02:00
..
core	RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued()	2020-08-19 08:16:09 +02:00
hw	RDMA/qedr: SRQ's bug fixes	2020-08-19 08:16:12 +02:00
sw	RDMA/rxe: Prevent access to wr->next ptr afrer wr is posted to send queue	2020-08-19 08:16:12 +02:00
ulp	IB/ipoib: Fix double free of skb in case of multicast traffic in CM mode	2020-06-03 08:21:26 +02:00
Kconfig	RDMA/odp: Use the common interval tree library instead of generic	2019-08-21 13:34:09 -03:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00