• Yonatan Cohen's avatar
    IB/rxe: Fix kernel panic in UDP tunnel with GRO and RX checksum · 1454ca3a
    Yonatan Cohen authored
    Missing initialization of udp_tunnel_sock_cfg causes to following
    kernel panic, while kernel tries to execute gro_receive().
    
    While being there, we converted udp_port_cfg to use the same
    initialization scheme as udp_tunnel_sock_cfg.
    
    ------------[ cut here ]------------
    kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
    BUG: unable to handle kernel paging request at ffffffffa0588c50
    IP: [<ffffffffa0588c50>] __this_module+0x50/0xffffffffffff8400 [ib_rxe]
    PGD 1c09067 PUD 1c0a063 PMD bb394067 PTE 80000000ad5e8163
    Oops: 0011 [#1] SMP
    Modules linked in: ib_rxe ip6_udp_tunnel udp_tunnel
    CPU: 5 PID: 0 Comm: swapper/5 Not tainted 4.7.0-rc3+ #2
    Hardware name: Red Hat KVM, BIOS Bochs 01/01/2011
    task: ffff880235e4e680 ti: ffff880235e68000 task.ti: ffff880235e68000
    RIP: 0010:[<ffffffffa0588c50>]
    [<ffffffffa0588c50>] __this_module+0x50/0xffffffffffff8400 [ib_rxe]
    RSP: 0018:ffff880237343c80  EFLAGS: 00010282
    RAX: 00000000dffe482d RBX: ffff8800ae330900 RCX: 000000002001b712
    RDX: ffff8800ae330900 RSI: ffff8800ae102578 RDI: ffff880235589c00
    RBP: ffff880237343cb0 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000000 R11: 0000000000000000 R12: ffff8800ae33e262
    R13: ffff880235589c00 R14: 0000000000000014 R15: ffff8800ae102578
    FS:  0000000000000000(0000) GS:ffff880237340000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: ffffffffa0588c50 CR3: 0000000001c06000 CR4: 00000000000006e0
    Stack:
    ffffffff8160860e ffff8800ae330900 ffff8800ae102578 0000000000000014
    000000000000004e ffff8800ae102578 ffff880237343ce0 ffffffff816088fb
    0000000000000000 ffff8800ae330900 0000000000000000 00000000ffad0000
    Call Trace:
    <IRQ>
    [<ffffffff8160860e>] ? udp_gro_receive+0xde/0x130
    [<ffffffff816088fb>] udp4_gro_receive+0x10b/0x2d0
    [<ffffffff81611373>] inet_gro_receive+0x1d3/0x270
    [<ffffffff81594e29>] dev_gro_receive+0x269/0x3b0
    [<ffffffff81595188>] napi_gro_receive+0x38/0x120
    [<ffffffffa011caee>] mlx5e_handle_rx_cqe+0x27e/0x340 [mlx5_core]
    [<ffffffffa011d076>] mlx5e_poll_rx_cq+0x66/0x6d0 [mlx5_core]
    [<ffffffffa011d7ae>] mlx5e_napi_poll+0x8e/0x400 [mlx5_core]
    [<ffffffff815949a0>] net_rx_action+0x160/0x380
    [<ffffffff816a9197>] __do_softirq+0xd7/0x2c5
    [<ffffffff81085c35>] irq_exit+0xf5/0x100
    [<ffffffff816a8f16>] do_IRQ+0x56/0xd0
    [<ffffffff816a6dcc>] common_interrupt+0x8c/0x8c
    <EOI>
    [<ffffffff81061f96>] ? native_safe_halt+0x6/0x10
    [<ffffffff81037ade>] default_idle+0x1e/0xd0
    [<ffffffff8103828f>] arch_cpu_idle+0xf/0x20
    [<ffffffff810c37dc>] default_idle_call+0x3c/0x50
    [<ffffffff810c3b13>] cpu_startup_entry+0x323/0x3c0
    [<ffffffff81050d8c>] start_secondary+0x15c/0x1a0
    RIP  [<ffffffffa0588c50>] __this_module+0x50/0xffffffffffff8400 [ib_rxe]
    RSP <ffff880237343c80>
    CR2: ffffffffa0588c50
    ---[ end trace 489ee31fa7614ac5 ]---
    Kernel panic - not syncing: Fatal exception in interrupt
    Kernel Offset: disabled
    ---[ end Kernel panic - not syncing: Fatal exception in interrupt
    ------------[ cut here ]------------
    
    Fixes: 8700e3e7 ("Soft RoCE driver")
    Signed-off-by: default avatarYonatan Cohen <yonatanc@mellanox.com>
    Reviewed-by: default avatarMoni Shoua <monis@mellanox.com>
    Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
    Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
    1454ca3a
rxe_net.c 16 KB