linux-toradex.git/drivers/infiniband/core, branch v4.2.6

IB/cm: Fix rb-tree duplicate free and use-after-free

2015-11-09T22:37:39+00:00

commit 0ca81a2840f77855bbad1b9f172c545c4dc9e6a4 upstream.

ib_send_cm_sidr_rep could sometimes erase the node from the sidr
(depending on errors in the process). Since ib_send_cm_sidr_rep is
called both from cm_sidr_req_handler and cm_destroy_id, cm_id_priv
could be either erased from the rb_tree twice or not erased at all.
Fixing that by making sure it's erased only once before freeing
cm_id_priv.

Fixes: a977049dacde ('[PATCH] IB: Add the kernel CM implementation')
Signed-off-by: Doron Tsur 
Signed-off-by: Matan Barak 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/uverbs: Fix race between ib_uverbs_open and remove_one

2015-09-29T17:33:35+00:00

commit 35d4a0b63dc0c6d1177d4f532a9deae958f0662c upstream.

Fixes: 2a72f212263701b927559f6850446421d5906c41 ("IB/uverbs: Remove dev_table")

Before this commit there was a device look-up table that was protected
by a spin_lock used by ib_uverbs_open and by ib_uverbs_remove_one. When
it was dropped and container_of was used instead, it enabled the race
with remove_one as dev might be freed just after:
dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev) but
before the kref_get.

In addition, this buggy patch added some dead code as
container_of(x,y,z) can never be NULL and so dev can never be NULL.
As a result the comment above ib_uverbs_open saying "the open method
will either immediately run -ENXIO" is wrong as it can never happen.

The solution follows Jason Gunthorpe suggestion from below URL:
https://www.mail-archive.com/linux-rdma@vger.kernel.org/msg25692.html

cdev will hold a kref on the parent (the containing structure,
ib_uverbs_device) and only when that kref is released it is
guaranteed that open will never be called again.

In addition, fixes the active count scheme to use an atomic
not a kref to prevent WARN_ON as pointed by above comment
from Jason.

Signed-off-by: Yishai Hadas 
Signed-off-by: Shachar Raindel 
Reviewed-by: Jason Gunthorpe 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/uverbs: reject invalid or unknown opcodes

2015-09-29T17:33:35+00:00

commit b632ffa7cee439ba5dce3b3bc4a5cbe2b3e20133 upstream.

We have many WR opcodes that are only supported in kernel space
and/or require optional information to be copied into the WR
structure.  Reject all those not explicitly handled so that we
can't pass invalid information to drivers.

Signed-off-by: Christoph Hellwig 
Reviewed-by: Jason Gunthorpe 
Reviewed-by: Sagi Grimberg 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/core: Destroy multcast_idr on module exit

2015-07-14T17:20:15+00:00

Destroy multcast_idr on module exit, reclaiming the allocated memory.

This was detected by the following semantic patch (written by Luis Rodriguez
)

@ defines_module_init @
declarer name module_init, module_exit;
declarer name DEFINE_IDR;
identifier init;
@@

module_init(init);

@ defines_module_exit @
identifier exit;
@@

module_exit(exit);

@ declares_idr depends on defines_module_init && defines_module_exit @
identifier idr;
@@

DEFINE_IDR(idr);

@ on_exit_calls_destroy depends on declares_idr && defines_module_exit @
identifier declares_idr.idr, defines_module_exit.exit;
@@

exit(void)
{
 ...
 idr_destroy(&idr);
 ...
}

@ missing_module_idr_destroy depends on declares_idr && defines_module_exit && !on_exit_calls_destroy @
identifier declares_idr.idr, defines_module_exit.exit;
@@

exit(void)
{
 ...
 +idr_destroy(&idr);
}



Signed-off-by: Johannes Thumshirn 
Signed-off-by: Doug Ledford

IB/ucm: Fix bitmap wrap when devnum > IB_UCM_MAX_DEVICES

2015-07-14T17:20:12+00:00

ib_ucm_release_dev clears the wrong bit if devnum is greater
than IB_UCM_MAX_DEVICES.

Signed-off-by: Carol L Soto 
Signed-off-by: Doug Ledford

IB/ucma: Fix lockdep warning in ucma_lock_files

2015-07-14T17:20:12+00:00

The ucma_lock_files() locks the mut mutex on two files, e.g. for migrating
an ID. Use mutex_lock_nested() to prevent the warning below.

 =============================================
 [ INFO: possible recursive locking detected ]
 4.1.0-rc6-hmm+ #40 Tainted: G           O
 ---------------------------------------------
 pingpong_rpc_se/10260 is trying to acquire lock:
  (&file->mut){+.+.+.}, at: [] ucma_migrate_id+0xc5/0x248 [rdma_ucm]

 but task is already holding lock:
  (&file->mut){+.+.+.}, at: [] ucma_migrate_id+0xbb/0x248 [rdma_ucm]

 other info that might help us debug this:
  Possible unsafe locking scenario:

        CPU0
        ----
   lock(&file->mut);
   lock(&file->mut);

  *** DEADLOCK ***

  May be due to missing lock nesting notation

 1 lock held by pingpong_rpc_se/10260:
  #0:  (&file->mut){+.+.+.}, at: [] ucma_migrate_id+0xbb/0x248 [rdma_ucm]

 stack backtrace:
 CPU: 0 PID: 10260 Comm: pingpong_rpc_se Tainted: G           O    4.1.0-rc6-hmm+ #40
 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2007
  ffff8801f85b63d0 ffff880195677b58 ffffffff81668f49 0000000000000001
  ffffffff825cbbe0 ffff880195677c38 ffffffff810bb991 ffff880100000000
  ffff880100000000 ffff880100000001 ffff8801f85b7010 ffffffff8121bee9
 Call Trace:
  [] dump_stack+0x4f/0x6e
  [] __lock_acquire+0x741/0x1820
  [] ? dput+0x29/0x320
  [] lock_acquire+0xc8/0x240
  [] ? ucma_migrate_id+0xc5/0x248 [rdma_ucm]
  [] ? mutex_lock_nested+0x291/0x3e0
  [] mutex_lock_nested+0x65/0x3e0
  [] ? ucma_migrate_id+0xc5/0x248 [rdma_ucm]
  [] ? trace_hardirqs_on+0xd/0x10
  [] ? mutex_unlock+0xe/0x10
  [] ucma_migrate_id+0xc5/0x248 [rdma_ucm]
  [] ucma_write+0xa4/0xb0 [rdma_ucm]
  [] __vfs_write+0x34/0x100
  [] ? __audit_syscall_entry+0xac/0x110
  [] ? current_kernel_time+0xc5/0xe0
  [] ? security_file_permission+0x23/0x90
  [] ? rw_verify_area+0x5d/0xe0
  [] vfs_write+0xab/0x120
  [] SyS_write+0x59/0xd0
  [] ? __audit_syscall_entry+0xac/0x110
  [] system_call_fastpath+0x12/0x76

Signed-off-by: Haggai Eran 
Signed-off-by: Doug Ledford

RDMA/core: Fixes for port mapper client registration

2015-07-14T17:20:10+00:00

Fixes to allow clients to make remove mapping requests, after
they have provided the user space service with the mapping
information, they are using when the service is restarted.

1) Adding IWPM_REG_VALID, IWPM_REG_INCOMPL and IWPM_REG_UNDEF
   registration types for the port mapper clients and functions
   to set/check the registration type.
2) If the port mapper user space service is not available to register
   the client, then its registration stays IWPM_REG_UNDEF and the
   registration isn't checked until the service becomes available
   (no mappings are possible, if the user space service isn't running).
3) After the service is restarted, the user space port mapper pid is set
   to valid and the client registration is set to IWPM_REG_INCOMPL
   to allow the client to make remove mapping requests.

Signed-off-by: Tatyana Nikolova 
Reviewed-by: Steve Wise 
Tested-by: Steve Wise 
Signed-off-by: Doug Ledford

IB/cm: Do not queue work to a device that's going away

2015-07-14T17:20:09+00:00

Whenever ib_cm gets remove_one call, like when there is a hot-unplug
event, the driver should mark itself as going_down and confirm that no
new works are going to be queued for that device.
so, the order of the actions are:
1. mark the going_down bit.
2. flush the wq.
3. [make sure no new works for that device.]
4. unregister mad agent.

otherwise, works that are already queued can be scheduled after the mad
agent was freed.

Signed-off-by: Erez Shitrit 
Signed-off-by: Doug Ledford

IB/mad: Fix compare between big endian and cpu endian

2015-07-14T17:20:08+00:00

The define OPA_LID_PERMISSIVE is big endian and was compared to the
cpu endian variable opa_drslid.

Problem caught by 0-day build infrastructure.

Fixes: 8e4349d13f33 (IB/mad: Add final OPA MAD processing)
Signed-off-by: Ira Weiny 
Reviewed-by: Mike Marciniszyn 
Reviewed-by: John, Jubin 
Signed-off-by: Doug Ledford

IB: Add rdma_cap_ib_switch helper and use where appropriate

2015-07-14T17:20:08+00:00

Persuant to Liran's comments on node_type on linux-rdma
mailing list:

In an effort to reform the RDMA core and ULPs to minimize use of
node_type in struct ib_device, an additional bit is added to
struct ib_device for is_switch (IB switch). This is needed
to be initialized by any IB switch device driver. This is a
NEW requirement on such device drivers which are all
"out of tree".

In addition, an ib_switch helper was added to ib_verbs.h
based on the is_switch device bit rather than node_type
(although those should be consistent).

The RDMA core (MAD, SMI, agent, sa_query, multicast, sysfs)
as well as (IPoIB and SRP) ULPs are updated where
appropriate to use this new helper. In some cases,
the helper is now used under the covers of using
rdma_[start end]_port rather than the open coding
previously used.

Reviewed-by: Sean Hefty 
Reviewed-By: Jason Gunthorpe 
Reviewed-by: Ira Weiny 
Tested-by: Ira Weiny 
Signed-off-by: Hal Rosenstock 
Signed-off-by: Doug Ledford