Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Pull rdma fixes from Jason Gunthorpe:
"The usual collection of small driver bug fixes:
- Fix error unwind bugs in hfi1, irdma rtrs
- Old bug with IPoIB children interfaces possibly using the wrong
number of queues
- Really old bug in usnic calling iommu_map in an atomic context
- Recent regression from the DMABUF locking rework
- Missing user data validation in MANA"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
RDMA/rtrs: Don't call kobject_del for srv_path->kobj
RDMA/mana_ib: Prevent array underflow in mana_ib_create_qp_raw()
IB/hfi1: Assign npages earlier
RDMA/umem: Use dma-buf locked API to solve deadlock
RDMA/usnic: use iommu_map_atomic() under spin_lock()
RDMA/irdma: Fix potential NULL-ptr-dereference
IB/IPoIB: Fix legacy IPoIB due to wrong number of queues
IB/hfi1: Restore allocated resources on failed copyout
+28
-20
+4
-4
drivers/infiniband/core/umem_dmabuf.c
+4
-4
drivers/infiniband/core/umem_dmabuf.c
···
26
26
if (umem_dmabuf->sgt)
27
27
goto wait_fence;
28
28
29
-
sgt = dma_buf_map_attachment_unlocked(umem_dmabuf->attach,
30
-
DMA_BIDIRECTIONAL);
29
+
sgt = dma_buf_map_attachment(umem_dmabuf->attach,
30
+
DMA_BIDIRECTIONAL);
31
31
if (IS_ERR(sgt))
32
32
return PTR_ERR(sgt);
33
33
···
103
103
umem_dmabuf->last_sg_trim = 0;
104
104
}
105
105
106
-
dma_buf_unmap_attachment_unlocked(umem_dmabuf->attach, umem_dmabuf->sgt,
107
-
DMA_BIDIRECTIONAL);
106
+
dma_buf_unmap_attachment(umem_dmabuf->attach, umem_dmabuf->sgt,
107
+
DMA_BIDIRECTIONAL);
108
108
109
109
umem_dmabuf->sgt = NULL;
110
110
}
+5
-2
drivers/infiniband/hw/hfi1/file_ops.c
+5
-2
drivers/infiniband/hw/hfi1/file_ops.c
···
1318
1318
addr = arg + offsetof(struct hfi1_tid_info, tidcnt);
1319
1319
if (copy_to_user((void __user *)addr, &tinfo.tidcnt,
1320
1320
sizeof(tinfo.tidcnt)))
1321
-
return -EFAULT;
1321
+
ret = -EFAULT;
1322
1322
1323
1323
addr = arg + offsetof(struct hfi1_tid_info, length);
1324
-
if (copy_to_user((void __user *)addr, &tinfo.length,
1324
+
if (!ret && copy_to_user((void __user *)addr, &tinfo.length,
1325
1325
sizeof(tinfo.length)))
1326
1326
ret = -EFAULT;
1327
+
1328
+
if (ret)
1329
+
hfi1_user_exp_rcv_invalid(fd, &tinfo);
1327
1330
}
1328
1331
1329
1332
return ret;
+2
-7
drivers/infiniband/hw/hfi1/user_exp_rcv.c
+2
-7
drivers/infiniband/hw/hfi1/user_exp_rcv.c
···
160
160
static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
161
161
{
162
162
int pinned;
163
-
unsigned int npages;
163
+
unsigned int npages = tidbuf->npages;
164
164
unsigned long vaddr = tidbuf->vaddr;
165
165
struct page **pages = NULL;
166
166
struct hfi1_devdata *dd = fd->uctxt->dd;
167
-
168
-
/* Get the number of pages the user buffer spans */
169
-
npages = num_user_pages(vaddr, tidbuf->length);
170
-
if (!npages)
171
-
return -EINVAL;
172
167
173
168
if (npages > fd->uctxt->expected_count) {
174
169
dd_dev_err(dd, "Expected buffer too big\n");
···
191
196
return pinned;
192
197
}
193
198
tidbuf->pages = pages;
194
-
tidbuf->npages = npages;
195
199
fd->tid_n_pinned += pinned;
196
200
return pinned;
197
201
}
···
268
274
mutex_init(&tidbuf->cover_mutex);
269
275
tidbuf->vaddr = tinfo->vaddr;
270
276
tidbuf->length = tinfo->length;
277
+
tidbuf->npages = num_user_pages(tidbuf->vaddr, tidbuf->length);
271
278
tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets),
272
279
GFP_KERNEL);
273
280
if (!tidbuf->psets) {
+3
drivers/infiniband/hw/irdma/cm.c
+3
drivers/infiniband/hw/irdma/cm.c
+1
-1
drivers/infiniband/hw/mana/qp.c
+1
-1
drivers/infiniband/hw/mana/qp.c
+4
-4
drivers/infiniband/hw/usnic/usnic_uiom.c
+4
-4
drivers/infiniband/hw/usnic/usnic_uiom.c
···
276
276
size = pa_end - pa_start + PAGE_SIZE;
277
277
usnic_dbg("va 0x%lx pa %pa size 0x%zx flags 0x%x",
278
278
va_start, &pa_start, size, flags);
279
-
err = iommu_map(pd->domain, va_start, pa_start,
280
-
size, flags);
279
+
err = iommu_map_atomic(pd->domain, va_start,
280
+
pa_start, size, flags);
281
281
if (err) {
282
282
usnic_err("Failed to map va 0x%lx pa %pa size 0x%zx with err %d\n",
283
283
va_start, &pa_start, size, err);
···
293
293
size = pa - pa_start + PAGE_SIZE;
294
294
usnic_dbg("va 0x%lx pa %pa size 0x%zx flags 0x%x\n",
295
295
va_start, &pa_start, size, flags);
296
-
err = iommu_map(pd->domain, va_start, pa_start,
297
-
size, flags);
296
+
err = iommu_map_atomic(pd->domain, va_start,
297
+
pa_start, size, flags);
298
298
if (err) {
299
299
usnic_err("Failed to map va 0x%lx pa %pa size 0x%zx with err %d\n",
300
300
va_start, &pa_start, size, err);
+8
drivers/infiniband/ulp/ipoib/ipoib_main.c
+8
drivers/infiniband/ulp/ipoib/ipoib_main.c
···
2200
2200
rn->attach_mcast = ipoib_mcast_attach;
2201
2201
rn->detach_mcast = ipoib_mcast_detach;
2202
2202
rn->hca = hca;
2203
+
2204
+
rc = netif_set_real_num_tx_queues(dev, 1);
2205
+
if (rc)
2206
+
goto out;
2207
+
2208
+
rc = netif_set_real_num_rx_queues(dev, 1);
2209
+
if (rc)
2210
+
goto out;
2203
2211
}
2204
2212
2205
2213
priv->rn_ops = dev->netdev_ops;
+1
-2
drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
+1
-2
drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c
···
312
312
313
313
if (srv_path->kobj.state_in_sysfs) {
314
314
sysfs_remove_group(&srv_path->kobj, &rtrs_srv_path_attr_group);
315
-
kobject_del(&srv_path->kobj);
316
315
kobject_put(&srv_path->kobj);
316
+
rtrs_srv_destroy_once_sysfs_root_folders(srv_path);
317
317
}
318
318
319
-
rtrs_srv_destroy_once_sysfs_root_folders(srv_path);
320
319
}