Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=bd18c112774db5bb887adb981ffbe9bfe00b2f3a
Commit:     bd18c112774db5bb887adb981ffbe9bfe00b2f3a
Parent:     3e28c56b9b67347b42ba06f9a9373b408902beee
Author:     Michael S. Tsirkin <[EMAIL PROTECTED]>
AuthorDate: Mon May 14 17:14:50 2007 +0300
Committer:  Roland Dreier <[EMAIL PROTECTED]>
CommitDate: Mon May 14 14:10:34 2007 -0700

    IB/mthca: Set cleaned CQEs back to HW ownership when cleaning CQ
    
    mthca_cq_clean() updates the CQ consumer index without moving CQEs
    back to HW ownership.  As a result, the same WRID might get reported
    twice, resulting in a use-after-free.  This was observed in IPoIB CM.
    Fix by moving all freed CQEs to HW ownership.
    
    This fixes <https://bugs.openfabrics.org/show_bug.cgi?id=617>
    
    Signed-off-by: Michael S. Tsirkin <[EMAIL PROTECTED]>
    Signed-off-by: Roland Dreier <[EMAIL PROTECTED]>
---
 drivers/infiniband/hw/mthca/mthca_cq.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c 
b/drivers/infiniband/hw/mthca/mthca_cq.c
index cf0868f..ca224d0 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -284,7 +284,7 @@ void mthca_cq_clean(struct mthca_dev *dev, struct mthca_cq 
*cq, u32 qpn,
 {
        struct mthca_cqe *cqe;
        u32 prod_index;
-       int nfreed = 0;
+       int i, nfreed = 0;
 
        spin_lock_irq(&cq->lock);
 
@@ -321,6 +321,8 @@ void mthca_cq_clean(struct mthca_dev *dev, struct mthca_cq 
*cq, u32 qpn,
        }
 
        if (nfreed) {
+               for (i = 0; i < nfreed; ++i)
+                       set_cqe_hw(get_cqe(cq, (cq->cons_index + i) & 
cq->ibcq.cqe));
                wmb();
                cq->cons_index += nfreed;
                update_cons_index(dev, cq, nfreed);
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to