Commit e9ad773d authored by huwentao0417's avatar huwentao0417
Browse files

Revert "RDMA/hns: Fix UAF for cq async event" 

driver inclusion
category: cleanup
bugzilla: https://gitee.com/openeuler/kernel/issues/I9SONH


CVE: NA

----------------------------------------------------------------------

This reverts commit ed1cac17.

Signed-off-by: default avatarhuwentao0417 <huwentao19@h-partners.com>
parent 2d82a83e

drivers/infiniband/hw/hns/hns_roce_cq.c

+4 −13
Original line number Diff line number Diff line
@@ -149,7 +149,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) 
		return ret;

	}



	ret = xa_err(xa_store_irq(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL));

	ret = xa_err(xa_store(&cq_table->array, hr_cq->cqn, hr_cq, GFP_KERNEL));

	if (ret) {

		ibdev_err(ibdev, "failed to xa_store CQ, ret = %d.\n", ret);

		goto err_put;
@@ -163,7 +163,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) 
	return 0;



err_xa:

	xa_erase_irq(&cq_table->array, hr_cq->cqn);

	xa_erase(&cq_table->array, hr_cq->cqn);

err_put:

	hns_roce_table_put(hr_dev, &cq_table->table, hr_cq->cqn);
@@ -185,7 +185,7 @@ static void free_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) 
	if (ret == -EBUSY)

		hr_cq->delayed_destroy_flag = true;



	xa_erase_irq(&cq_table->array, hr_cq->cqn);

	xa_erase(&cq_table->array, hr_cq->cqn);



	/* Waiting interrupt process procedure carried out */

	synchronize_irq(hr_dev->eq_table.eq[hr_cq->vector].irq);
@@ -624,16 +624,7 @@ void hns_roce_cq_event(struct hns_roce_dev *hr_dev, u32 cqn, int event_type) 
		return;

	}



	xa_lock(&hr_dev->cq_table.array);

	hr_cq = xa_load(&hr_dev->cq_table.array,

			cqn & (hr_dev->caps.num_cqs - 1));

	if (hr_cq)

	refcount_inc(&hr_cq->refcount);

	xa_unlock(&hr_dev->cq_table.array);

	if (!hr_cq) {

		dev_warn(dev, "async event for bogus CQ 0x%06x\n", cqn);

		return;

	}



	ibcq = &hr_cq->ib_cq;

	if (ibcq->event_handler) {