diff options
| author | Bill Taylor <Bill.Taylor@Sun.COM> | 2010-02-10 07:57:42 -0800 |
|---|---|---|
| committer | Bill Taylor <Bill.Taylor@Sun.COM> | 2010-02-10 07:57:42 -0800 |
| commit | 949b58c70cf907006b9f724dfad665d44eca5881 (patch) | |
| tree | 83defa15eaaa33a9cdf0b4df73bbb22a90b3b77c | |
| parent | a567cb7199dcb7e0c1d645cd14307998ef4632a3 (diff) | |
| download | illumos-gate-949b58c70cf907006b9f724dfad665d44eca5881.tar.gz | |
6879375 MADs may be vulnerable to corruption
6922514 tavor, hermon : duplicate call to freerbuf when mtt_bind fails, causes panic
| -rw-r--r-- | usr/src/uts/common/io/ib/adapters/hermon/hermon_mr.c | 7 | ||||
| -rw-r--r-- | usr/src/uts/common/io/ib/adapters/hermon/hermon_wr.c | 4 | ||||
| -rw-r--r-- | usr/src/uts/common/io/ib/adapters/tavor/tavor_mr.c | 7 |
3 files changed, 15 insertions, 3 deletions
diff --git a/usr/src/uts/common/io/ib/adapters/hermon/hermon_mr.c b/usr/src/uts/common/io/ib/adapters/hermon/hermon_mr.c index 1383b1c8a0..7b136ed470 100644 --- a/usr/src/uts/common/io/ib/adapters/hermon/hermon_mr.c +++ b/usr/src/uts/common/io/ib/adapters/hermon/hermon_mr.c @@ -20,7 +20,7 @@ */ /* - * Copyright 2009 Sun Microsystems, Inc. All rights reserved. + * Copyright 2010 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ @@ -1656,6 +1656,11 @@ hermon_mr_common_reg(hermon_state_t *state, hermon_pdhdl_t pd, status = hermon_mr_mtt_bind(state, bh, bind_dmahdl, &mtt, &mtt_pgsize_bits, mpt != NULL); if (status != DDI_SUCCESS) { + /* + * When mtt_bind fails, freerbuf has already been done, + * so make sure not to call it again. + */ + bind->bi_type = bh->bi_type; goto mrcommon_fail5; } mr->mr_logmttpgsz = mtt_pgsize_bits; diff --git a/usr/src/uts/common/io/ib/adapters/hermon/hermon_wr.c b/usr/src/uts/common/io/ib/adapters/hermon/hermon_wr.c index 80384c6af4..7dadb76b41 100644 --- a/usr/src/uts/common/io/ib/adapters/hermon/hermon_wr.c +++ b/usr/src/uts/common/io/ib/adapters/hermon/hermon_wr.c @@ -20,7 +20,7 @@ */ /* - * Copyright 2009 Sun Microsystems, Inc. All rights reserved. + * Copyright 2010 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ @@ -825,6 +825,8 @@ post_many: solicited = 0; if (qp->qp_is_special) { + /* Ensure correctness, set the ReRead bit */ + nopcode |= (1 << 6); ah = (hermon_ahhdl_t) curr_wr->wr.ud.udwr_dest->ud_ah; mutex_enter(&ah->ah_lock); diff --git a/usr/src/uts/common/io/ib/adapters/tavor/tavor_mr.c b/usr/src/uts/common/io/ib/adapters/tavor/tavor_mr.c index 4b60d896d3..3b2e167d71 100644 --- a/usr/src/uts/common/io/ib/adapters/tavor/tavor_mr.c +++ b/usr/src/uts/common/io/ib/adapters/tavor/tavor_mr.c @@ -20,7 +20,7 @@ */ /* - * Copyright 2009 Sun Microsystems, Inc. All rights reserved. + * Copyright 2010 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ @@ -1772,6 +1772,11 @@ tavor_mr_common_reg(tavor_state_t *state, tavor_pdhdl_t pd, if (status != DDI_SUCCESS) { /* Set "status" and "errormsg" and goto failure */ TAVOR_TNF_FAIL(status, "failed mtt bind"); + /* + * When mtt_bind fails, freerbuf has already been done, + * so make sure not to call it again. + */ + bind->bi_type = bh->bi_type; goto mrcommon_fail5; } mr->mr_logmttpgsz = mtt_pgsize_bits; |