linux/drivers/infiniband/core
Bernard Metzler 810dbc6908 RDMA/iwcm: Fix iwcm work deallocation
The dealloc_work_entries() function must update the work_free_list pointer
while freeing its entries, since potentially called again on same list. A
second iteration of the work list caused system crash. This happens, if
work allocation fails during cma_iw_listen() and free_cm_id() tries to
free the list again during cleanup.

Fixes: 922a8e9fb2 ("RDMA: iWARP Connection Manager.")
Link: https://lore.kernel.org/r/20200302181614.17042-1-bmt@zurich.ibm.com
Reported-by: syzbot+cb0c054eabfba4342146@syzkaller.appspotmail.com
Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-03-04 14:28:25 -04:00
..
addr.c
agent.c
agent.h
cache.c
cgroup.c
cm_msgs.h
cm.c RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() 2020-02-27 16:43:29 -04:00
cma_configfs.c
cma_priv.h
cma_trace.c
cma_trace.h
cma.c Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow" 2020-02-19 14:25:52 -04:00
core_priv.h RDMA/core: Fix protection fault in ib_mr_pool_destroy 2020-03-04 13:43:02 -04:00
counters.c
cq.c
device.c
fmr_pool.c
ib_core_uverbs.c
iwcm.c RDMA/iwcm: Fix iwcm work deallocation 2020-03-04 14:28:25 -04:00
iwcm.h
iwpm_msg.c
iwpm_util.c
iwpm_util.h
mad_priv.h
mad_rmpp.c
mad_rmpp.h
mad.c
Makefile
mr_pool.c
multicast.c
netlink.c
nldev.c RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing 2020-03-04 14:17:10 -04:00
opa_smi.h
packer.c
rdma_core.c
rdma_core.h
restrack.c
restrack.h
roce_gid_mgmt.c
rw.c RDMA/rw: Fix error flow during RDMA context initialization 2020-02-20 13:19:21 -04:00
sa_query.c
sa.h
security.c RDMA/core: Fix pkey and port assignment in get_new_pps 2020-02-28 11:16:08 -04:00
smi.c
smi.h
sysfs.c
trace.c
ucma.c
ud_header.c
umem_odp.c RDMA/odp: Ensure the mm is still alive before creating an implicit child 2020-03-04 13:56:07 -04:00
umem.c RDMA subsystem updates for 5.6 2020-01-31 14:40:36 -08:00
user_mad.c IB/umad: Fix kernel crash while unloading ib_umad 2020-02-13 10:00:50 -04:00
uverbs_cmd.c RDMA/core: Fix protection fault in ib_mr_pool_destroy 2020-03-04 13:43:02 -04:00
uverbs_ioctl.c
uverbs_main.c
uverbs_marshall.c
uverbs_std_types_async_fd.c
uverbs_std_types_counters.c
uverbs_std_types_cq.c
uverbs_std_types_device.c
uverbs_std_types_dm.c
uverbs_std_types_flow_action.c
uverbs_std_types_mr.c
uverbs_std_types.c RDMA/core: Add missing list deletion on freeing event queue 2020-02-13 09:44:49 -04:00
uverbs_uapi.c
uverbs.h
verbs.c RDMA/core: Fix protection fault in ib_mr_pool_destroy 2020-03-04 13:43:02 -04:00