Skip to content

Commit ad03714

Browse files
gregkhgregkh
committed
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Jason writes: "Second RDMA rc pull request - Fix a long standing race bug when destroying comp_event file descriptors - srp, hfi1, bnxt_re: Various driver crashes from missing validation and other cases - Fixes for regressions in patches merged this window in the gid cache, devx, ucma and uapi." * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/core: Set right entry state before releasing reference IB/mlx5: Destroy the DEVX object upon error flow IB/uverbs: Free uapi on destroy RDMA/bnxt_re: Fix system crash during RDMA resource initialization IB/hfi1: Fix destroy_qp hang after a link down IB/hfi1: Fix context recovery when PBC has an UnsupportedVL IB/hfi1: Invalid user input can result in crash IB/hfi1: Fix SL array bounds check RDMA/uverbs: Fix validity check for modify QP IB/srp: Avoid that sg_reset -d ${srp_device} triggers an infinite loop ucma: fix a use-after-free in ucma_resolve_ip() RDMA/uverbs: Atomically flush and mark closed the comp event queue cxgb4: fix abort_req_rss6 struct
2 parents c127e59 + 5c5702e commit ad03714

File tree

14 files changed

+184
-130
lines changed

14 files changed

+184
-130
lines changed

‎drivers/infiniband/core/cache.c

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,39 @@ static int add_roce_gid(struct ib_gid_table_entry *entry)
337337
return 0;
338338
}
339339

340+
/**
341+
* del_gid - Delete GID table entry
342+
*
343+
* @ib_dev: IB device whose GID entry to be deleted
344+
* @port: Port number of the IB device
345+
* @table: GID table of the IB device for a port
346+
* @ix: GID entry index to delete
347+
*
348+
*/
349+
static void del_gid(struct ib_device *ib_dev, u8 port,
350+
struct ib_gid_table *table, int ix)
351+
{
352+
struct ib_gid_table_entry *entry;
353+
354+
lockdep_assert_held(&table->lock);
355+
356+
pr_debug("%s device=%s port=%d index=%d gid %pI6\n", __func__,
357+
ib_dev->name, port, ix,
358+
table->data_vec[ix]->attr.gid.raw);
359+
360+
write_lock_irq(&table->rwlock);
361+
entry = table->data_vec[ix];
362+
entry->state = GID_TABLE_ENTRY_PENDING_DEL;
363+
/*
364+
* For non RoCE protocol, GID entry slot is ready to use.
365+
*/
366+
if (!rdma_protocol_roce(ib_dev, port))
367+
table->data_vec[ix] = NULL;
368+
write_unlock_irq(&table->rwlock);
369+
370+
put_gid_entry_locked(entry);
371+
}
372+
340373
/**
341374
* add_modify_gid - Add or modify GID table entry
342375
*
@@ -358,7 +391,7 @@ static int add_modify_gid(struct ib_gid_table *table,
358391
* this index.
359392
*/
360393
if (is_gid_entry_valid(table->data_vec[attr->index]))
361-
put_gid_entry(table->data_vec[attr->index]);
394+
del_gid(attr->device, attr->port_num, table, attr->index);
362395

363396
/*
364397
* Some HCA's report multiple GID entries with only one valid GID, and
@@ -386,39 +419,6 @@ static int add_modify_gid(struct ib_gid_table *table,
386419
return ret;
387420
}
388421

389-
/**
390-
* del_gid - Delete GID table entry
391-
*
392-
* @ib_dev: IB device whose GID entry to be deleted
393-
* @port: Port number of the IB device
394-
* @table: GID table of the IB device for a port
395-
* @ix: GID entry index to delete
396-
*
397-
*/
398-
static void del_gid(struct ib_device *ib_dev, u8 port,
399-
struct ib_gid_table *table, int ix)
400-
{
401-
struct ib_gid_table_entry *entry;
402-
403-
lockdep_assert_held(&table->lock);
404-
405-
pr_debug("%s device=%s port=%d index=%d gid %pI6\n", __func__,
406-
ib_dev->name, port, ix,
407-
table->data_vec[ix]->attr.gid.raw);
408-
409-
write_lock_irq(&table->rwlock);
410-
entry = table->data_vec[ix];
411-
entry->state = GID_TABLE_ENTRY_PENDING_DEL;
412-
/*
413-
* For non RoCE protocol, GID entry slot is ready to use.
414-
*/
415-
if (!rdma_protocol_roce(ib_dev, port))
416-
table->data_vec[ix] = NULL;
417-
write_unlock_irq(&table->rwlock);
418-
419-
put_gid_entry_locked(entry);
420-
}
421-
422422
/* rwlock should be read locked, or lock should be held */
423423
static int find_gid(struct ib_gid_table *table, const union ib_gid *gid,
424424
const struct ib_gid_attr *val, bool default_gid,

‎drivers/infiniband/core/ucma.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1759,6 +1759,8 @@ static int ucma_close(struct inode *inode, struct file *filp)
17591759
mutex_lock(&mut);
17601760
if (!ctx->closing) {
17611761
mutex_unlock(&mut);
1762+
ucma_put_ctx(ctx);
1763+
wait_for_completion(&ctx->comp);
17621764
/* rdma_destroy_id ensures that no event handlers are
17631765
* inflight for that id before releasing it.
17641766
*/

‎drivers/infiniband/core/uverbs_cmd.c

Lines changed: 45 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2027,33 +2027,55 @@ static int modify_qp(struct ib_uverbs_file *file,
20272027

20282028
if ((cmd->base.attr_mask & IB_QP_CUR_STATE &&
20292029
cmd->base.cur_qp_state > IB_QPS_ERR) ||
2030-
cmd->base.qp_state > IB_QPS_ERR) {
2030+
(cmd->base.attr_mask & IB_QP_STATE &&
2031+
cmd->base.qp_state > IB_QPS_ERR)) {
20312032
ret = -EINVAL;
20322033
goto release_qp;
20332034
}
20342035

2035-
attr->qp_state = cmd->base.qp_state;
2036-
attr->cur_qp_state = cmd->base.cur_qp_state;
2037-
attr->path_mtu = cmd->base.path_mtu;
2038-
attr->path_mig_state = cmd->base.path_mig_state;
2039-
attr->qkey = cmd->base.qkey;
2040-
attr->rq_psn = cmd->base.rq_psn;
2041-
attr->sq_psn = cmd->base.sq_psn;
2042-
attr->dest_qp_num = cmd->base.dest_qp_num;
2043-
attr->qp_access_flags = cmd->base.qp_access_flags;
2044-
attr->pkey_index = cmd->base.pkey_index;
2045-
attr->alt_pkey_index = cmd->base.alt_pkey_index;
2046-
attr->en_sqd_async_notify = cmd->base.en_sqd_async_notify;
2047-
attr->max_rd_atomic = cmd->base.max_rd_atomic;
2048-
attr->max_dest_rd_atomic = cmd->base.max_dest_rd_atomic;
2049-
attr->min_rnr_timer = cmd->base.min_rnr_timer;
2050-
attr->port_num = cmd->base.port_num;
2051-
attr->timeout = cmd->base.timeout;
2052-
attr->retry_cnt = cmd->base.retry_cnt;
2053-
attr->rnr_retry = cmd->base.rnr_retry;
2054-
attr->alt_port_num = cmd->base.alt_port_num;
2055-
attr->alt_timeout = cmd->base.alt_timeout;
2056-
attr->rate_limit = cmd->rate_limit;
2036+
if (cmd->base.attr_mask & IB_QP_STATE)
2037+
attr->qp_state = cmd->base.qp_state;
2038+
if (cmd->base.attr_mask & IB_QP_CUR_STATE)
2039+
attr->cur_qp_state = cmd->base.cur_qp_state;
2040+
if (cmd->base.attr_mask & IB_QP_PATH_MTU)
2041+
attr->path_mtu = cmd->base.path_mtu;
2042+
if (cmd->base.attr_mask & IB_QP_PATH_MIG_STATE)
2043+
attr->path_mig_state = cmd->base.path_mig_state;
2044+
if (cmd->base.attr_mask & IB_QP_QKEY)
2045+
attr->qkey = cmd->base.qkey;
2046+
if (cmd->base.attr_mask & IB_QP_RQ_PSN)
2047+
attr->rq_psn = cmd->base.rq_psn;
2048+
if (cmd->base.attr_mask & IB_QP_SQ_PSN)
2049+
attr->sq_psn = cmd->base.sq_psn;
2050+
if (cmd->base.attr_mask & IB_QP_DEST_QPN)
2051+
attr->dest_qp_num = cmd->base.dest_qp_num;
2052+
if (cmd->base.attr_mask & IB_QP_ACCESS_FLAGS)
2053+
attr->qp_access_flags = cmd->base.qp_access_flags;
2054+
if (cmd->base.attr_mask & IB_QP_PKEY_INDEX)
2055+
attr->pkey_index = cmd->base.pkey_index;
2056+
if (cmd->base.attr_mask & IB_QP_EN_SQD_ASYNC_NOTIFY)
2057+
attr->en_sqd_async_notify = cmd->base.en_sqd_async_notify;
2058+
if (cmd->base.attr_mask & IB_QP_MAX_QP_RD_ATOMIC)
2059+
attr->max_rd_atomic = cmd->base.max_rd_atomic;
2060+
if (cmd->base.attr_mask & IB_QP_MAX_DEST_RD_ATOMIC)
2061+
attr->max_dest_rd_atomic = cmd->base.max_dest_rd_atomic;
2062+
if (cmd->base.attr_mask & IB_QP_MIN_RNR_TIMER)
2063+
attr->min_rnr_timer = cmd->base.min_rnr_timer;
2064+
if (cmd->base.attr_mask & IB_QP_PORT)
2065+
attr->port_num = cmd->base.port_num;
2066+
if (cmd->base.attr_mask & IB_QP_TIMEOUT)
2067+
attr->timeout = cmd->base.timeout;
2068+
if (cmd->base.attr_mask & IB_QP_RETRY_CNT)
2069+
attr->retry_cnt = cmd->base.retry_cnt;
2070+
if (cmd->base.attr_mask & IB_QP_RNR_RETRY)
2071+
attr->rnr_retry = cmd->base.rnr_retry;
2072+
if (cmd->base.attr_mask & IB_QP_ALT_PATH) {
2073+
attr->alt_port_num = cmd->base.alt_port_num;
2074+
attr->alt_timeout = cmd->base.alt_timeout;
2075+
attr->alt_pkey_index = cmd->base.alt_pkey_index;
2076+
}
2077+
if (cmd->base.attr_mask & IB_QP_RATE_LIMIT)
2078+
attr->rate_limit = cmd->rate_limit;
20572079

20582080
if (cmd->base.attr_mask & IB_QP_AV)
20592081
copy_ah_attr_from_uverbs(qp->device, &attr->ah_attr,

‎drivers/infiniband/core/uverbs_main.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -440,6 +440,7 @@ static int ib_uverbs_comp_event_close(struct inode *inode, struct file *filp)
440440
list_del(&entry->obj_list);
441441
kfree(entry);
442442
}
443+
file->ev_queue.is_closed = 1;
443444
spin_unlock_irq(&file->ev_queue.lock);
444445

445446
uverbs_close_fd(filp);

‎drivers/infiniband/core/uverbs_uapi.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -248,6 +248,7 @@ void uverbs_destroy_api(struct uverbs_api *uapi)
248248
kfree(rcu_dereference_protected(*slot, true));
249249
radix_tree_iter_delete(&uapi->radix, &iter, slot);
250250
}
251+
kfree(uapi);
251252
}
252253

253254
struct uverbs_api *uverbs_alloc_api(

0 commit comments

Comments
 (0)