summaryrefslogtreecommitdiffstats
path: root/drivers/cpuidle/governor.c
diff options
context:
space:
mode:
authorIsrael Rukshin <israelr@mellanox.com>2018-06-19 14:34:11 +0200
committerChristoph Hellwig <hch@lst.de>2018-06-20 14:20:51 +0200
commitc947657b15379505a9bba36a02005882b66abe57 (patch)
tree252bc9998774c6eb77d2e0dd31c850ec0d2db67d /drivers/cpuidle/governor.c
parentnvme-rdma: fix possible free of a non-allocated async event buffer (diff)
downloadlinux-c947657b15379505a9bba36a02005882b66abe57.tar.xz
linux-c947657b15379505a9bba36a02005882b66abe57.zip
nvme-rdma: Fix command completion race at error recovery
The race is between completing the request at error recovery work and rdma completions. If we cancel the request before getting the good rdma completion we get a NULL deref of the request MR at nvme_rdma_process_nvme_rsp(). When Canceling the request we return its mr to the mr pool (set mr to NULL) and also unmap its data. Canceling the requests while the rdma queues are active is not safe. Because rdma queues are active and we get good rdma completions that can use the mr pointer which may be NULL. Completing the request too soon may lead also to performing DMA to/from user buffers which might have been already unmapped. The commit fixes the race by draining the QP before starting the abort commands mechanism. Signed-off-by: Israel Rukshin <israelr@mellanox.com> Reviewed-by: Max Gurtovoy <maxg@mellanox.com> Signed-off-by: Sagi Grimberg <sagi@grimberg.me> Signed-off-by: Christoph Hellwig <hch@lst.de>
Diffstat (limited to 'drivers/cpuidle/governor.c')
0 files changed, 0 insertions, 0 deletions