diff options
| author | Li RongQing <lirongqing@baidu.com> | 2026-09-19 18:08:48 +0800 |
|---|---|---|
| committer | Leon Romanovsky <leon@kernel.org> | 2026-09-28 14:40:16 -0400 |
| commit | 9728effe43d8fc4d58e12b697d0d6127355abdd5 (patch) | |
| tree | 60750ada68f9bf30f788756ef4d42d4159ceb8bf /tools/lib/python | |
| parent | 86959c7d009f60c57e1fd97a8f65fc40f6d5881c (diff) | |
RDMA/mlx5: Restore mr->pi_mr after temporary stack-local assignment
In handle_reg_mr_integrity, when mr->pi_mr is NULL (physical-address
optimization path), the code points mr->pi_mr at a stack-local pa_pi_mr
so set_pi_umr_wr can read it during this call. The pointer is never
restored, so after the function returns mr->pi_mr dangles at a freed stack
frame. A second IB_WR_REG_MR_INTEGRITY posted on the same MR without
remapping reads the stale pointer and dereferences it.
Save the original pi_mr (captured at function entry) and restore it on
the out path.
Fixes: 2563e2f30acb ("RDMA/mlx5: Use PA mapping for PI handover")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Link: https://patch.msgid.link/20260919100848.2442-1-lirongqing@baidu.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions