linux-toradex.git/drivers/infiniband, branch v3.14.24

IB/core: When marshaling uverbs path, clear unused fields

2014-10-05T21:52:22+00:00

commit a59c5850f09b4c2d6ad2fc47e5e1be8d654529d6 upstream.

When marsheling a user path to the kernel struct ib_sa_path, need
to zero smac, dmac and set the vlan id to the "no vlan" value.

Fixes: dd5f03beb4f7 ("IB/core: Ethernet L2 attributes in verbs/cm structures")
Reported-by: Aleksey Senin 
Signed-off-by: Matan Barak 
Signed-off-by: Or Gerlitz 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

IB/mlx4: Don't duplicate the default RoCE GID

2014-10-05T21:52:22+00:00

commit f5c4834d9328c4ed9fe5dcbec6128d6da16db69a upstream.

When reading the IPv6 addresses from the net-device, make sure to
avoid adding a duplicate entry to the GID table because of equality
between the default GID we generate and the default IPv6 link-local
address of the device.

Fixes: acc4fccf4eff ("IB/mlx4: Make sure GID index 0 is always occupied")
Signed-off-by: Moni Shoua 
Signed-off-by: Or Gerlitz 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

IB/mlx4: Avoid null pointer dereference in mlx4_ib_scan_netdevs()

2014-10-05T21:52:22+00:00

commit e381835cf1b8e3b2857277dbc3b77d8c5350f70a upstream.

When Ethernet netdev is not present for a port (e.g. when the link
layer type of the port is InfiniBand) it's possible to dereference a
null pointer when we do netdevice scanning.

To fix that, we move a section of code that needs to run only when
netdev is present to a proper if () statement.

Fixes: ad4885d279b6 ("IB/mlx4: Build the port IBoE GID table properly under bonding")
Reported-by: Dan Carpenter 
Signed-off-by: Moni Shoua 
Signed-off-by: Or Gerlitz 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

IB/qib: Correct reference counting in debugfs qp_stats

2014-10-05T21:52:22+00:00

commit 85cbb7c728bf39c45a9789b88c9471c0d7a58b0e upstream.

This particular reference count is not needed with the rcu protection,
and the current code leaks a reference count, causing a hang in
qib_qp_destroy().

Reviewed-by: Dennis Dalessandro 
Signed-off-by: Mike Marciniszyn 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

Target/iser: Don't put isert_conn inside disconnected handler

2014-10-05T21:52:18+00:00

commit 0fc4ea701fcf5bc51ace4e288af5be741465f776 upstream.

disconnected_handler is invoked on several CM events (such
as DISCONNECTED, DEVICE_REMOVAL, TIMEWAIT_EXIT...). Since
multiple  events can occur while before isert_free_conn is
invoked, we might put all isert_conn references and free
the connection too early.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

Target/iser: Get isert_conn reference once got to connected_handler

2014-10-05T21:52:18+00:00

commit c2f88b17a1d97ca4ecd96cc22333a7a4f1407d39 upstream.

In case the connection didn't reach connected state, disconnected
handler will never be invoked thus the second kref_put on
isert_conn will be missing.

Signed-off-by: Sagi Grimberg 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Greg Kroah-Hartman

IB/srp: Fix deadlock between host removal and multipathd

2014-09-17T16:19:28+00:00

commit bcc05910359183b431da92713e98eed478edf83a upstream.

If scsi_remove_host() is invoked after a SCSI device has been blocked,
if the fast_io_fail_tmo or dev_loss_tmo work gets scheduled on the
workqueue executing srp_remove_work() and if an I/O request is
scheduled after the SCSI device had been blocked by e.g. multipathd
then the following deadlock can occur:

    kworker/6:1     D ffff880831f3c460     0   195      2 0x00000000
    Call Trace:
     [] schedule+0x29/0x70
     [] schedule_timeout+0x10f/0x2a0
     [] msleep+0x2f/0x40
     [] __blk_drain_queue+0x4e/0x180
     [] blk_cleanup_queue+0x225/0x230
     [] __scsi_remove_device+0x62/0xe0 [scsi_mod]
     [] scsi_forget_host+0x6f/0x80 [scsi_mod]
     [] scsi_remove_host+0x7a/0x130 [scsi_mod]
     [] srp_remove_work+0x95/0x180 [ib_srp]
     [] process_one_work+0x1ea/0x6c0
     [] worker_thread+0x11b/0x3a0
     [] kthread+0xed/0x110
     [] ret_from_fork+0x7c/0xb0
    multipathd      D ffff880096acc460     0  5340      1 0x00000000
    Call Trace:
     [] schedule+0x29/0x70
     [] schedule_timeout+0x10f/0x2a0
     [] io_schedule_timeout+0x9b/0xf0
     [] wait_for_completion_io_timeout+0xdc/0x110
     [] blk_execute_rq+0x9b/0x100
     [] sg_io+0x1a5/0x450
     [] scsi_cmd_ioctl+0x2a1/0x430
     [] scsi_cmd_blk_ioctl+0x42/0x50
     [] sd_ioctl+0xbe/0x140 [sd_mod]
     [] blkdev_ioctl+0x234/0x840
     [] block_ioctl+0x41/0x50
     [] do_vfs_ioctl+0x300/0x520
     [] SyS_ioctl+0x41/0x80
     [] tracesys+0xd0/0xd5

Fix this by scheduling removal work on another workqueue than the
transport layer timers.

Signed-off-by: Bart Van Assche 
Reviewed-by: Sagi Grimberg 
Reviewed-by: David Dillow 
Cc: Sebastian Parschauer 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

RDMA/iwcm: Use a default listen backlog if needed

2014-09-17T16:19:24+00:00

commit 2f0304d21867476394cd51a54e97f7273d112261 upstream.

If the user creates a listening cm_id with backlog of 0 the IWCM ends
up not allowing any connection requests at all.  The correct behavior
is for the IWCM to pick a default value if the user backlog parameter
is zero.

Lustre from version 1.8.8 onward uses a backlog of 0, which breaks
iwarp support without this fix.

Signed-off-by: Steve Wise 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

IB/umad: Fix use-after-free on close

2014-07-07T01:57:27+00:00

commit 60e1751cb52cc6d1ae04b6bd3c2b96e770b5823f upstream.

Avoid that closing /dev/infiniband/umad or /dev/infiniband/issm
triggers a use-after-free.  __fput() invokes f_op->release() before it
invokes cdev_put().  Make sure that the ib_umad_device structure is
freed by the cdev_put() call instead of f_op->release().  This avoids
that changing the port mode from IB into Ethernet and back to IB
followed by restarting opensmd triggers the following kernel oops:

    general protection fault: 0000 [#1] PREEMPT SMP
    RIP: 0010:[]  [] module_put+0x2c/0x170
    Call Trace:
     [] cdev_put+0x20/0x30
     [] __fput+0x1ae/0x1f0
     [] ____fput+0xe/0x10
     [] task_work_run+0xac/0xe0
     [] do_notify_resume+0x9f/0xc0
     [] int_signal+0x12/0x17

Reference: https://bugzilla.kernel.org/show_bug.cgi?id=75051
Signed-off-by: Bart Van Assche 
Reviewed-by: Yann Droneaud 
Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman

IB/umad: Fix error handling

2014-07-07T01:57:27+00:00

commit 8ec0a0e6b58218bdc1db91dd70ebfcd6ad8dd6cd upstream.

Avoid leaking a kref count in ib_umad_open() if port->ib_dev == NULL
or if nonseekable_open() fails.

Avoid leaking a kref count, that sm_sem is kept down and also that the
IB_PORT_SM capability mask is not cleared in ib_umad_sm_open() if
nonseekable_open() fails.

Since container_of() never returns NULL, remove the code that tests
whether container_of() returns NULL.

Moving the kref_get() call from the start of ib_umad_*open() to the
end is safe since it is the responsibility of the caller of these
functions to ensure that the cdev pointer remains valid until at least
when these functions return.

Signed-off-by: Bart Van Assche 

[ydroneaud@opteya.com: rework a bit to reduce the amount of code changed]

Signed-off-by: Yann Droneaud 

[ nonseekable_open() can't actually fail, but....  - Roland ]

Signed-off-by: Roland Dreier 
Signed-off-by: Greg Kroah-Hartman