diff options
| author | Selvin Xavier <selvin.xavier@broadcom.com> | 2017-05-22 03:15:34 -0700 |
|---|---|---|
| committer | Doug Ledford <dledford@redhat.com> | 2017-06-14 13:01:58 -0400 |
| commit | 1c980b010f06696c9093c5d6a5ac7b5145f89a04 (patch) | |
| tree | 098966a8460a13fe67df327bee7e181281ad7b02 /drivers | |
| parent | 9152e0b722b29092115da3bfbf63d26be1a461df (diff) | |
| download | linux-1c980b010f06696c9093c5d6a5ac7b5145f89a04.tar.bz2 | |
RDMA/bnxt_re: Dereg MR in FW before freeing the fast_reg_page_list
If the host buffers are freed before destroying MR in HW,
HW could try accessing these buffers. This could cause a host
crash. Fixing the code to avoid this condition.
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/infiniband/hw/bnxt_re/ib_verbs.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c index 169798752895..d94b1b304135 100644 --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c @@ -3052,6 +3052,12 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr) struct bnxt_re_dev *rdev = mr->rdev; int rc; + rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr); + if (rc) { + dev_err(rdev_to_dev(rdev), "Dereg MR failed: %#x\n", rc); + return rc; + } + if (mr->npages && mr->pages) { rc = bnxt_qplib_free_fast_reg_page_list(&rdev->qplib_res, &mr->qplib_frpl); @@ -3059,8 +3065,6 @@ int bnxt_re_dereg_mr(struct ib_mr *ib_mr) mr->npages = 0; mr->pages = NULL; } - rc = bnxt_qplib_free_mrw(&rdev->qplib_res, &mr->qplib_mr); - if (!IS_ERR_OR_NULL(mr->ib_umem)) ib_umem_release(mr->ib_umem); |