Bernard Metzler 810dbc6908 RDMA/iwcm: Fix iwcm work deallocation ... The dealloc_work_entries() function must update the work_free_list pointer while freeing its entries, since potentially called again on same list. A second iteration of the work list caused system crash. This happens, if work allocation fails during cma_iw_listen() and free_cm_id() tries to free the list again during cleanup. Fixes: 922a8e9fb2 ("RDMA: iWARP Connection Manager.") Link: https://lore.kernel.org/r/20200302181614.17042-1-bmt@zurich.ibm.com Reported-by: syzbot+cb0c054eabfba4342146@syzkaller.appspotmail.com Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com> Reviewed-by: Jason Gunthorpe <jgg@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>		2020-03-04 14:28:25 -04:00
..
Makefile	RDMA/core: Make ib_uverbs_async_event_file into a uobject	2020-01-13 16:20:16 -04:00
addr.c	RDMA/netlink: Do not always generate an ACK for some netlink operations	2020-01-03 16:02:32 -04:00
agent.c	…
agent.h	…
cache.c	IB/core: Cut down single member ib_cache structure	2020-01-07 20:18:11 -04:00
cgroup.c	…
cm.c	RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()	2020-02-27 16:43:29 -04:00
cm_msgs.h	RDMA/cm: Remove CM message structs	2020-01-25 15:11:37 -04:00
cma.c	Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow"	2020-02-19 14:25:52 -04:00
cma_configfs.c	…
cma_priv.h	…
cma_trace.c	RDMA/cma: Add trace points in RDMA Connection Manager	2020-01-07 16:10:53 -04:00
cma_trace.h	RDMA/cma: Add trace points in RDMA Connection Manager	2020-01-07 16:10:53 -04:00
core_priv.h	RDMA/core: Fix protection fault in ib_mr_pool_destroy	2020-03-04 13:43:02 -04:00
counters.c	RDMA/counter: Prevent auto-binding a QP which are not tracked with res	2019-12-12 15:38:15 -05:00
cq.c	RDMA/core: Trace points for diagnosing completion queue issues	2020-01-07 16:10:53 -04:00
device.c	RDMA/core: Remove err in iw_query_port	2020-01-10 11:19:04 -04:00
fmr_pool.c	…
ib_core_uverbs.c	RDMA/core: Ensure that rdma_user_mmap_entry_remove() is a fence	2020-01-25 14:48:33 -04:00
iwcm.c	RDMA/iwcm: Fix iwcm work deallocation	2020-03-04 14:28:25 -04:00
iwcm.h	…
iwpm_msg.c	…
iwpm_util.c	…
iwpm_util.h	…
mad.c	…
mad_priv.h	…
mad_rmpp.c	…
mad_rmpp.h	…
mr_pool.c	…
multicast.c	…
netlink.c	…
nldev.c	RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing	2020-03-04 14:17:10 -04:00
opa_smi.h	…
packer.c	…
rdma_core.c	RDMA/core: Remove ucontext_lock from the uverbs_destry_ufile_hw() path	2020-01-16 15:55:45 -04:00
rdma_core.h	RDMA/core: Make ib_uverbs_async_event_file into a uobject	2020-01-13 16:20:16 -04:00
restrack.c	…
restrack.h	…
roce_gid_mgmt.c	…
rw.c	RDMA/rw: Fix error flow during RDMA context initialization	2020-02-20 13:19:21 -04:00
sa.h	…
sa_query.c	RDMA/netlink: Do not always generate an ACK for some netlink operations	2020-01-03 16:02:32 -04:00
security.c	RDMA/core: Fix pkey and port assignment in get_new_pps	2020-02-28 11:16:08 -04:00
smi.c	…
smi.h	…
sysfs.c	…
trace.c	RDMA/core: Trace points for diagnosing completion queue issues	2020-01-07 16:10:53 -04:00
ucma.c	…
ud_header.c	…
umem.c	RDMA subsystem updates for 5.6	2020-01-31 14:40:36 -08:00
umem_odp.c	RDMA/odp: Ensure the mm is still alive before creating an implicit child	2020-03-04 13:56:07 -04:00
user_mad.c	IB/umad: Fix kernel crash while unloading ib_umad	2020-02-13 10:00:50 -04:00
uverbs.h	RDMA/core: Make the entire API tree static	2020-01-30 16:28:52 -04:00
uverbs_cmd.c	RDMA/core: Fix protection fault in ib_mr_pool_destroy	2020-03-04 13:43:02 -04:00
uverbs_ioctl.c	RDMA/core: Do not allow alloc_commit to fail	2020-01-13 16:20:15 -04:00
uverbs_main.c	RDMA/uverbs: Add ioctl command to get a device context	2020-01-16 15:55:45 -04:00
uverbs_marshall.c	…
uverbs_std_types.c	RDMA/core: Add missing list deletion on freeing event queue	2020-02-13 09:44:49 -04:00
uverbs_std_types_async_fd.c	RDMA/uverbs: Add ioctl command to get a device context	2020-01-16 15:55:45 -04:00
uverbs_std_types_counters.c	…
uverbs_std_types_cq.c	RDMA/core: Use READ_ONCE for ib_ufile.async_file	2020-01-13 16:20:16 -04:00
uverbs_std_types_device.c	RDMA/core: Add the core support field to METHOD_GET_CONTEXT	2020-01-16 15:55:46 -04:00
uverbs_std_types_dm.c	…
uverbs_std_types_flow_action.c	…
uverbs_std_types_mr.c	…
uverbs_uapi.c	RDMA/core: Make ib_uverbs_async_event_file into a uobject	2020-01-13 16:20:16 -04:00
verbs.c	RDMA/core: Fix protection fault in ib_mr_pool_destroy	2020-03-04 13:43:02 -04:00