From 949b58c70cf907006b9f724dfad665d44eca5881 Mon Sep 17 00:00:00 2001 From: Bill Taylor Date: Wed, 10 Feb 2010 07:57:42 -0800 Subject: 6879375 MADs may be vulnerable to corruption 6922514 tavor, hermon : duplicate call to freerbuf when mtt_bind fails, causes panic --- usr/src/uts/common/io/ib/adapters/hermon/hermon_mr.c | 7 ++++++- usr/src/uts/common/io/ib/adapters/hermon/hermon_wr.c | 4 +++- usr/src/uts/common/io/ib/adapters/tavor/tavor_mr.c | 7 ++++++- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/usr/src/uts/common/io/ib/adapters/hermon/hermon_mr.c b/usr/src/uts/common/io/ib/adapters/hermon/hermon_mr.c index 1383b1c8a0..7b136ed470 100644 --- a/usr/src/uts/common/io/ib/adapters/hermon/hermon_mr.c +++ b/usr/src/uts/common/io/ib/adapters/hermon/hermon_mr.c @@ -20,7 +20,7 @@ */ /* - * Copyright 2009 Sun Microsystems, Inc. All rights reserved. + * Copyright 2010 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ @@ -1656,6 +1656,11 @@ hermon_mr_common_reg(hermon_state_t *state, hermon_pdhdl_t pd, status = hermon_mr_mtt_bind(state, bh, bind_dmahdl, &mtt, &mtt_pgsize_bits, mpt != NULL); if (status != DDI_SUCCESS) { + /* + * When mtt_bind fails, freerbuf has already been done, + * so make sure not to call it again. + */ + bind->bi_type = bh->bi_type; goto mrcommon_fail5; } mr->mr_logmttpgsz = mtt_pgsize_bits; diff --git a/usr/src/uts/common/io/ib/adapters/hermon/hermon_wr.c b/usr/src/uts/common/io/ib/adapters/hermon/hermon_wr.c index 80384c6af4..7dadb76b41 100644 --- a/usr/src/uts/common/io/ib/adapters/hermon/hermon_wr.c +++ b/usr/src/uts/common/io/ib/adapters/hermon/hermon_wr.c @@ -20,7 +20,7 @@ */ /* - * Copyright 2009 Sun Microsystems, Inc. All rights reserved. + * Copyright 2010 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ @@ -825,6 +825,8 @@ post_many: solicited = 0; if (qp->qp_is_special) { + /* Ensure correctness, set the ReRead bit */ + nopcode |= (1 << 6); ah = (hermon_ahhdl_t) curr_wr->wr.ud.udwr_dest->ud_ah; mutex_enter(&ah->ah_lock); diff --git a/usr/src/uts/common/io/ib/adapters/tavor/tavor_mr.c b/usr/src/uts/common/io/ib/adapters/tavor/tavor_mr.c index 4b60d896d3..3b2e167d71 100644 --- a/usr/src/uts/common/io/ib/adapters/tavor/tavor_mr.c +++ b/usr/src/uts/common/io/ib/adapters/tavor/tavor_mr.c @@ -20,7 +20,7 @@ */ /* - * Copyright 2009 Sun Microsystems, Inc. All rights reserved. + * Copyright 2010 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ @@ -1772,6 +1772,11 @@ tavor_mr_common_reg(tavor_state_t *state, tavor_pdhdl_t pd, if (status != DDI_SUCCESS) { /* Set "status" and "errormsg" and goto failure */ TAVOR_TNF_FAIL(status, "failed mtt bind"); + /* + * When mtt_bind fails, freerbuf has already been done, + * so make sure not to call it again. + */ + bind->bi_type = bh->bi_type; goto mrcommon_fail5; } mr->mr_logmttpgsz = mtt_pgsize_bits; -- cgit v1.2.3