diff options
| author | Maor Gottlieb <maorg@nvidia.com> | 2021-04-11 15:29:21 +0300 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2021-04-13 19:36:36 -0300 |
| commit | 251b9d7887505d67dbe5089f78ad5f8d610b2c2f (patch) | |
| tree | 1c6fdcf6c01ffc052d5ef323afac8a5742d4a233 /drivers/infiniband/hw/mlx5/main.c | |
| parent | 831df88381f73bca0f5624b69ab985cac3d036bc (diff) | |
| download | lwn-251b9d7887505d67dbe5089f78ad5f8d610b2c2f.tar.gz lwn-251b9d7887505d67dbe5089f78ad5f8d610b2c2f.zip | |
RDMA/mlx5: Re-organize the DM code
1. Inline the checks from check_dm_type_support() into their
respective allocation functions.
2. Fix use after free when driver fails to copy the MEMIC address to the
user by moving the allocation code into their respective functions,
hence we avoid the explicit call to free the DM in the error flow.
3. Split mlx5_ib_dm struct to memic and icm proper typesafety
throughout.
Fixes: dc2316eba73f ("IB/mlx5: Fix device memory flows")
Link: https://lore.kernel.org/r/20210411122924.60230-5-leon@kernel.org
Signed-off-by: Maor Gottlieb <maorg@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'drivers/infiniband/hw/mlx5/main.c')
| -rw-r--r-- | drivers/infiniband/hw/mlx5/main.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index 2e53090c033c..c7544c37d0f1 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2088,13 +2088,13 @@ static void mlx5_ib_mmap_free(struct rdma_user_mmap_entry *entry) struct mlx5_user_mmap_entry *mentry = to_mmmap(entry); struct mlx5_ib_dev *dev = to_mdev(entry->ucontext->device); struct mlx5_var_table *var_table = &dev->var_table; - struct mlx5_ib_dm *mdm; + struct mlx5_ib_dm_memic *mdm; switch (mentry->mmap_flag) { case MLX5_IB_MMAP_TYPE_MEMIC: - mdm = container_of(mentry, struct mlx5_ib_dm, mentry); - mlx5_cmd_dealloc_memic(&dev->dm, mdm->dev_addr, - mdm->size); + mdm = container_of(mentry, struct mlx5_ib_dm_memic, mentry); + mlx5_cmd_dealloc_memic(&dev->dm, mdm->base.dev_addr, + mdm->base.size); kfree(mdm); break; case MLX5_IB_MMAP_TYPE_VAR: |