Skip to content
Snippets Groups Projects
  • Håkon Bugge's avatar
    rds: ib: Fix NULL pointer dereference in debug code · 1cb483a5
    Håkon Bugge authored
    rds_ib_recv_refill() is a function that refills an IB receive
    queue. It can be called from both the CQE handler (tasklet) and a
    worker thread.
    
    Just after the call to ib_post_recv(), a debug message is printed with
    rdsdebug():
    
                ret = ib_post_recv(ic->i_cm_id->qp, &recv->r_wr, &failed_wr);
                rdsdebug("recv %p ibinc %p page %p addr %lu ret %d\n", recv,
                         recv->r_ibinc, sg_page(&recv->r_frag->f_sg),
                         (long) ib_sg_dma_address(
                                ic->i_cm_id->device,
                                &recv->r_frag->f_sg),
                        ret);
    
    Now consider an invocation of rds_ib_recv_refill() from the worker
    thread, which is preemptible. Further, assume that the worker thread
    is preempted between the ib_post_recv() and rdsdebug() statements.
    
    Then, if the preemption is due to a receive CQE event, the
    rds_ib_recv_cqe_handler() will be invoked. This function processes
    receive completions, inc...
    1cb483a5