lkml.org 
[lkml]   [2018]   [Dec]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 194/328] iw_cxgb4: only allow 1 flush on user qps
    3.16.62-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Steve Wise <swise@opengridcomputing.com>

    commit 308aa2b8f7b7db3332a7d41099fd37851fb793b2 upstream.

    Once the qp has been flushed, it cannot be flushed again. The user qp
    flush logic wasn't enforcing it however. The bug can cause
    touch-after-free crashes like:

    Unable to handle kernel paging request for data at address 0x000001ec
    Faulting instruction address: 0xc008000016069100
    Oops: Kernel access of bad area, sig: 11 [#1]
    ...
    NIP [c008000016069100] flush_qp+0x80/0x480 [iw_cxgb4]
    LR [c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
    Call Trace:
    [c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
    [c00800001606e868] c4iw_ib_modify_qp+0x118/0x200 [iw_cxgb4]
    [c0080000119eae80] ib_security_modify_qp+0xd0/0x3d0 [ib_core]
    [c0080000119c4e24] ib_modify_qp+0xc4/0x2c0 [ib_core]
    [c008000011df0284] iwcm_modify_qp_err+0x44/0x70 [iw_cm]
    [c008000011df0fec] destroy_cm_id+0xcc/0x370 [iw_cm]
    [c008000011ed4358] rdma_destroy_id+0x3c8/0x520 [rdma_cm]
    [c0080000134b0540] ucma_close+0x90/0x1b0 [rdma_ucm]
    [c000000000444da4] __fput+0xe4/0x2f0

    So fix flush_qp() to only flush the wq once.

    Signed-off-by: Steve Wise <swise@opengridcomputing.com>
    Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
    [bwh: Backported to 3.16: adjust context]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/infiniband/hw/cxgb4/qp.c | 6 ++++++
    1 file changed, 6 insertions(+)

    --- a/drivers/infiniband/hw/cxgb4/qp.c
    +++ b/drivers/infiniband/hw/cxgb4/qp.c
    @@ -1133,6 +1133,12 @@ static void flush_qp(struct c4iw_qp *qhp
    schp = to_c4iw_cq(qhp->ibqp.send_cq);

    if (qhp->ibqp.uobject) {
    +
    + /* for user qps, qhp->wq.flushed is protected by qhp->mutex */
    + if (qhp->wq.flushed)
    + return;
    +
    + qhp->wq.flushed = 1;
    t4_set_wq_in_error(&qhp->wq);
    t4_set_cq_in_error(&rchp->cq);
    spin_lock_irqsave(&rchp->comp_handler_lock, flag);
    \
     
     \ /
      Last update: 2018-12-09 22:57    [W:4.100 / U:0.236 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site