tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:
"Still not much going on, the usual set of oops and driver fixes this
time:

- Fix two uapi breakage regressions in mlx5 drivers

- Various oops fixes in hfi1, mlx4, umem, uverbs, and ipoib

- A protocol bug fix for hfi1 preventing it from implementing the
verbs API properly, and a compatability fix for EXEC STACK user
programs

- Fix missed refcounting in the 'advise_mr' patches merged this
cycle.

- Fix wrong use of the uABI in the hns SRQ patches merged this cycle"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
IB/uverbs: Fix OOPs in uverbs_user_mmap_disassociate
IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start
IB/uverbs: Fix ioctl query port to consider device disassociation
RDMA/mlx5: Fix flow creation on representors
IB/uverbs: Fix OOPs upon device disassociation
RDMA/umem: Add missing initialization of owning_mm
RDMA/hns: Update the kernel header file of hns
IB/mlx5: Fix how advise_mr() launches async work
RDMA/device: Expose ib_device_try_get(()
IB/hfi1: Add limit test for RC/UC send via loopback
IB/hfi1: Remove overly conservative VM_EXEC flag check
IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
IB/mlx4: Fix using wrong function to destroy sqp AHs under SRIOV
RDMA/mlx5: Fix check for supported user flags when creating a QP

Linus Torvalds 5eeb6335 9ace868a

+97 -42
-1
drivers/infiniband/core/core_priv.h
··· 267 267 #endif 268 268 269 269 struct ib_device *ib_device_get_by_index(u32 ifindex); 270 - void ib_device_put(struct ib_device *device); 271 270 /* RDMA device netlink */ 272 271 void nldev_init(void); 273 272 void nldev_exit(void);
+10 -3
drivers/infiniband/core/device.c
··· 156 156 down_read(&lists_rwsem); 157 157 device = __ib_device_get_by_index(index); 158 158 if (device) { 159 - /* Do not return a device if unregistration has started. */ 160 - if (!refcount_inc_not_zero(&device->refcount)) 159 + if (!ib_device_try_get(device)) 161 160 device = NULL; 162 161 } 163 162 up_read(&lists_rwsem); 164 163 return device; 165 164 } 166 165 166 + /** 167 + * ib_device_put - Release IB device reference 168 + * @device: device whose reference to be released 169 + * 170 + * ib_device_put() releases reference to the IB device to allow it to be 171 + * unregistered and eventually free. 172 + */ 167 173 void ib_device_put(struct ib_device *device) 168 174 { 169 175 if (refcount_dec_and_test(&device->refcount)) 170 176 complete(&device->unreg_completion); 171 177 } 178 + EXPORT_SYMBOL(ib_device_put); 172 179 173 180 static struct ib_device *__ib_device_get_by_name(const char *name) 174 181 { ··· 310 303 rwlock_init(&device->client_data_lock); 311 304 INIT_LIST_HEAD(&device->client_data_list); 312 305 INIT_LIST_HEAD(&device->port_list); 313 - refcount_set(&device->refcount, 1); 314 306 init_completion(&device->unreg_completion); 315 307 316 308 return device; ··· 626 620 goto cg_cleanup; 627 621 } 628 622 623 + refcount_set(&device->refcount, 1); 629 624 device->reg_state = IB_DEV_REGISTERED; 630 625 631 626 list_for_each_entry(client, &client_list, list)
+3
drivers/infiniband/core/umem_odp.c
··· 352 352 umem->writable = 1; 353 353 umem->is_odp = 1; 354 354 odp_data->per_mm = per_mm; 355 + umem->owning_mm = per_mm->mm; 356 + mmgrab(umem->owning_mm); 355 357 356 358 mutex_init(&odp_data->umem_mutex); 357 359 init_completion(&odp_data->notifier_completion); ··· 386 384 out_page_list: 387 385 vfree(odp_data->page_list); 388 386 out_odp_data: 387 + mmdrop(umem->owning_mm); 389 388 kfree(odp_data); 390 389 return ERR_PTR(ret); 391 390 }
+16 -9
drivers/infiniband/core/uverbs_main.c
··· 204 204 if (atomic_dec_and_test(&file->device->refcount)) 205 205 ib_uverbs_comp_dev(file->device); 206 206 207 + if (file->async_file) 208 + kref_put(&file->async_file->ref, 209 + ib_uverbs_release_async_event_file); 207 210 put_device(&file->device->dev); 208 211 kfree(file); 209 212 } ··· 967 964 968 965 /* Get an arbitrary mm pointer that hasn't been cleaned yet */ 969 966 mutex_lock(&ufile->umap_lock); 970 - if (!list_empty(&ufile->umaps)) { 971 - mm = list_first_entry(&ufile->umaps, 972 - struct rdma_umap_priv, list) 973 - ->vma->vm_mm; 974 - mmget(mm); 967 + while (!list_empty(&ufile->umaps)) { 968 + int ret; 969 + 970 + priv = list_first_entry(&ufile->umaps, 971 + struct rdma_umap_priv, list); 972 + mm = priv->vma->vm_mm; 973 + ret = mmget_not_zero(mm); 974 + if (!ret) { 975 + list_del_init(&priv->list); 976 + mm = NULL; 977 + continue; 978 + } 979 + break; 975 980 } 976 981 mutex_unlock(&ufile->umap_lock); 977 982 if (!mm) ··· 1106 1095 mutex_lock(&file->device->lists_mutex); 1107 1096 list_del_init(&file->list); 1108 1097 mutex_unlock(&file->device->lists_mutex); 1109 - 1110 - if (file->async_file) 1111 - kref_put(&file->async_file->ref, 1112 - ib_uverbs_release_async_event_file); 1113 1098 1114 1099 kref_put(&file->ref, ib_uverbs_release_file); 1115 1100
+7 -1
drivers/infiniband/core/uverbs_std_types_device.c
··· 168 168 static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_PORT)( 169 169 struct uverbs_attr_bundle *attrs) 170 170 { 171 - struct ib_device *ib_dev = attrs->ufile->device->ib_dev; 171 + struct ib_device *ib_dev; 172 172 struct ib_port_attr attr = {}; 173 173 struct ib_uverbs_query_port_resp_ex resp = {}; 174 + struct ib_ucontext *ucontext; 174 175 int ret; 175 176 u8 port_num; 177 + 178 + ucontext = ib_uverbs_get_ucontext(attrs); 179 + if (IS_ERR(ucontext)) 180 + return PTR_ERR(ucontext); 181 + ib_dev = ucontext->device; 176 182 177 183 /* FIXME: Extend the UAPI_DEF_OBJ_NEEDS_FN stuff.. */ 178 184 if (!ib_dev->ops.query_port)
+1 -1
drivers/infiniband/hw/hfi1/file_ops.c
··· 488 488 vmf = 1; 489 489 break; 490 490 case STATUS: 491 - if (flags & (unsigned long)(VM_WRITE | VM_EXEC)) { 491 + if (flags & VM_WRITE) { 492 492 ret = -EPERM; 493 493 goto done; 494 494 }
-1
drivers/infiniband/hw/hfi1/ud.c
··· 987 987 opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { 988 988 wc.ex.imm_data = packet->ohdr->u.ud.imm_data; 989 989 wc.wc_flags = IB_WC_WITH_IMM; 990 - tlen -= sizeof(u32); 991 990 } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { 992 991 wc.ex.imm_data = 0; 993 992 wc.wc_flags = 0;
+8 -2
drivers/infiniband/hw/hns/hns_roce_srq.c
··· 210 210 struct ib_udata *udata) 211 211 { 212 212 struct hns_roce_dev *hr_dev = to_hr_dev(pd->device); 213 + struct hns_roce_ib_create_srq_resp resp = {}; 213 214 struct hns_roce_srq *srq; 214 215 int srq_desc_size; 215 216 int srq_buf_size; ··· 379 378 380 379 srq->event = hns_roce_ib_srq_event; 381 380 srq->ibsrq.ext.xrc.srq_num = srq->srqn; 381 + resp.srqn = srq->srqn; 382 382 383 383 if (udata) { 384 - if (ib_copy_to_udata(udata, &srq->srqn, sizeof(__u32))) { 384 + if (ib_copy_to_udata(udata, &resp, 385 + min(udata->outlen, sizeof(resp)))) { 385 386 ret = -EFAULT; 386 - goto err_wrid; 387 + goto err_srqc_alloc; 387 388 } 388 389 } 389 390 390 391 return &srq->ibsrq; 392 + 393 + err_srqc_alloc: 394 + hns_roce_srq_free(hr_dev, srq); 391 395 392 396 err_wrid: 393 397 kvfree(srq->wrid);
+3 -3
drivers/infiniband/hw/mlx4/mad.c
··· 1411 1411 1412 1412 sqp_mad = (struct mlx4_mad_snd_buf *) (sqp->tx_ring[wire_tx_ix].buf.addr); 1413 1413 if (sqp->tx_ring[wire_tx_ix].ah) 1414 - rdma_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0); 1414 + mlx4_ib_destroy_ah(sqp->tx_ring[wire_tx_ix].ah, 0); 1415 1415 sqp->tx_ring[wire_tx_ix].ah = ah; 1416 1416 ib_dma_sync_single_for_cpu(&dev->ib_dev, 1417 1417 sqp->tx_ring[wire_tx_ix].buf.map, ··· 1902 1902 if (wc.status == IB_WC_SUCCESS) { 1903 1903 switch (wc.opcode) { 1904 1904 case IB_WC_SEND: 1905 - rdma_destroy_ah(sqp->tx_ring[wc.wr_id & 1905 + mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id & 1906 1906 (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0); 1907 1907 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah 1908 1908 = NULL; ··· 1931 1931 " status = %d, wrid = 0x%llx\n", 1932 1932 ctx->slave, wc.status, wc.wr_id); 1933 1933 if (!MLX4_TUN_IS_RECV(wc.wr_id)) { 1934 - rdma_destroy_ah(sqp->tx_ring[wc.wr_id & 1934 + mlx4_ib_destroy_ah(sqp->tx_ring[wc.wr_id & 1935 1935 (MLX4_NUM_TUNNEL_BUFS - 1)].ah, 0); 1936 1936 sqp->tx_ring[wc.wr_id & (MLX4_NUM_TUNNEL_BUFS - 1)].ah 1937 1937 = NULL;
+1 -2
drivers/infiniband/hw/mlx5/flow.c
··· 630 630 UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)), 631 631 UAPI_DEF_CHAIN_OBJ_TREE( 632 632 UVERBS_OBJECT_FLOW, 633 - &mlx5_ib_fs, 634 - UAPI_DEF_IS_OBJ_SUPPORTED(flow_is_supported)), 633 + &mlx5_ib_fs), 635 634 UAPI_DEF_CHAIN_OBJ_TREE(UVERBS_OBJECT_FLOW_ACTION, 636 635 &mlx5_ib_flow_actions), 637 636 {},
+5 -5
drivers/infiniband/hw/mlx5/odp.c
··· 1595 1595 struct prefetch_mr_work *w = 1596 1596 container_of(work, struct prefetch_mr_work, work); 1597 1597 1598 - if (w->dev->ib_dev.reg_state == IB_DEV_REGISTERED) 1598 + if (ib_device_try_get(&w->dev->ib_dev)) { 1599 1599 mlx5_ib_prefetch_sg_list(w->dev, w->pf_flags, w->sg_list, 1600 1600 w->num_sge); 1601 - 1601 + ib_device_put(&w->dev->ib_dev); 1602 + } 1603 + put_device(&w->dev->ib_dev.dev); 1602 1604 kfree(w); 1603 1605 } 1604 1606 ··· 1619 1617 return mlx5_ib_prefetch_sg_list(dev, pf_flags, sg_list, 1620 1618 num_sge); 1621 1619 1622 - if (dev->ib_dev.reg_state != IB_DEV_REGISTERED) 1623 - return -ENODEV; 1624 - 1625 1620 work = kvzalloc(struct_size(work, sg_list, num_sge), GFP_KERNEL); 1626 1621 if (!work) 1627 1622 return -ENOMEM; 1628 1623 1629 1624 memcpy(work->sg_list, sg_list, num_sge * sizeof(struct ib_sge)); 1630 1625 1626 + get_device(&dev->ib_dev.dev); 1631 1627 work->dev = dev; 1632 1628 work->pf_flags = pf_flags; 1633 1629 work->num_sge = num_sge;
+9 -7
drivers/infiniband/hw/mlx5/qp.c
··· 1912 1912 } 1913 1913 1914 1914 if (!check_flags_mask(ucmd.flags, 1915 + MLX5_QP_FLAG_ALLOW_SCATTER_CQE | 1916 + MLX5_QP_FLAG_BFREG_INDEX | 1917 + MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE | 1918 + MLX5_QP_FLAG_SCATTER_CQE | 1915 1919 MLX5_QP_FLAG_SIGNATURE | 1916 - MLX5_QP_FLAG_SCATTER_CQE | 1917 - MLX5_QP_FLAG_TUNNEL_OFFLOADS | 1918 - MLX5_QP_FLAG_BFREG_INDEX | 1919 - MLX5_QP_FLAG_TYPE_DCT | 1920 - MLX5_QP_FLAG_TYPE_DCI | 1921 - MLX5_QP_FLAG_ALLOW_SCATTER_CQE | 1922 - MLX5_QP_FLAG_PACKET_BASED_CREDIT_MODE)) 1920 + MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_MC | 1921 + MLX5_QP_FLAG_TIR_ALLOW_SELF_LB_UC | 1922 + MLX5_QP_FLAG_TUNNEL_OFFLOADS | 1923 + MLX5_QP_FLAG_TYPE_DCI | 1924 + MLX5_QP_FLAG_TYPE_DCT)) 1923 1925 return -EINVAL; 1924 1926 1925 1927 err = get_qp_user_index(to_mucontext(pd->uobject->context),
-1
drivers/infiniband/hw/qib/qib_ud.c
··· 512 512 opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { 513 513 wc.ex.imm_data = ohdr->u.ud.imm_data; 514 514 wc.wc_flags = IB_WC_WITH_IMM; 515 - tlen -= sizeof(u32); 516 515 } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { 517 516 wc.ex.imm_data = 0; 518 517 wc.wc_flags = 0;
+6 -1
drivers/infiniband/sw/rdmavt/qp.c
··· 2910 2910 goto op_err; 2911 2911 if (!ret) 2912 2912 goto rnr_nak; 2913 + if (wqe->length > qp->r_len) 2914 + goto inv_err; 2913 2915 break; 2914 2916 2915 2917 case IB_WR_RDMA_WRITE_WITH_IMM: ··· 3080 3078 goto err; 3081 3079 3082 3080 inv_err: 3083 - send_status = IB_WC_REM_INV_REQ_ERR; 3081 + send_status = 3082 + sqp->ibqp.qp_type == IB_QPT_RC ? 3083 + IB_WC_REM_INV_REQ_ERR : 3084 + IB_WC_SUCCESS; 3084 3085 wc.status = IB_WC_LOC_QP_OP_ERR; 3085 3086 goto err; 3086 3087
-1
drivers/infiniband/ulp/ipoib/ipoib.h
··· 248 248 struct list_head list; 249 249 struct net_device *dev; 250 250 struct ipoib_neigh *neigh; 251 - struct ipoib_path *path; 252 251 struct ipoib_tx_buf *tx_ring; 253 252 unsigned int tx_head; 254 253 unsigned int tx_tail;
+1 -2
drivers/infiniband/ulp/ipoib/ipoib_cm.c
··· 1312 1312 1313 1313 neigh->cm = tx; 1314 1314 tx->neigh = neigh; 1315 - tx->path = path; 1316 1315 tx->dev = dev; 1317 1316 list_add(&tx->list, &priv->cm.start_list); 1318 1317 set_bit(IPOIB_FLAG_INITIALIZED, &tx->flags); ··· 1370 1371 neigh->daddr + QPN_AND_OPTIONS_OFFSET); 1371 1372 goto free_neigh; 1372 1373 } 1373 - memcpy(&pathrec, &p->path->pathrec, sizeof(pathrec)); 1374 + memcpy(&pathrec, &path->pathrec, sizeof(pathrec)); 1374 1375 1375 1376 spin_unlock_irqrestore(&priv->lock, flags); 1376 1377 netif_tx_unlock_bh(dev);
+22 -2
include/rdma/ib_verbs.h
··· 2579 2579 2580 2580 const struct uapi_definition *driver_def; 2581 2581 enum rdma_driver_id driver_id; 2582 + 2582 2583 /* 2583 - * Provides synchronization between device unregistration and netlink 2584 - * commands on a device. To be used only by core. 2584 + * Positive refcount indicates that the device is currently 2585 + * registered and cannot be unregistered. 2585 2586 */ 2586 2587 refcount_t refcount; 2587 2588 struct completion unreg_completion; ··· 3927 3926 int ib_check_mr_status(struct ib_mr *mr, u32 check_mask, 3928 3927 struct ib_mr_status *mr_status); 3929 3928 3929 + /** 3930 + * ib_device_try_get: Hold a registration lock 3931 + * device: The device to lock 3932 + * 3933 + * A device under an active registration lock cannot become unregistered. It 3934 + * is only possible to obtain a registration lock on a device that is fully 3935 + * registered, otherwise this function returns false. 3936 + * 3937 + * The registration lock is only necessary for actions which require the 3938 + * device to still be registered. Uses that only require the device pointer to 3939 + * be valid should use get_device(&ibdev->dev) to hold the memory. 3940 + * 3941 + */ 3942 + static inline bool ib_device_try_get(struct ib_device *dev) 3943 + { 3944 + return refcount_inc_not_zero(&dev->refcount); 3945 + } 3946 + 3947 + void ib_device_put(struct ib_device *device); 3930 3948 struct net_device *ib_get_net_dev_by_params(struct ib_device *dev, u8 port, 3931 3949 u16 pkey, const union ib_gid *gid, 3932 3950 const struct sockaddr *addr);
+5
include/uapi/rdma/hns-abi.h
··· 52 52 __aligned_u64 que_addr; 53 53 }; 54 54 55 + struct hns_roce_ib_create_srq_resp { 56 + __u32 srqn; 57 + __u32 reserved; 58 + }; 59 + 55 60 struct hns_roce_ib_create_qp { 56 61 __aligned_u64 buf_addr; 57 62 __aligned_u64 db_addr;