linux-stable.git/drivers/infiniband/ulp, branch v4.1.44

iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done

2017-09-10T20:36:00+00:00

[ Upstream commit fce50a2fa4e9c6e103915c351b6d4a98661341d6 ]

This patch fixes a NULL pointer dereference in isert_login_recv_done()
of isert_conn->cm_id due to isert_cma_handler() -> isert_connect_error()
resetting isert_conn->cm_id = NULL during a failed login attempt.

As per Sagi, we will always see the completion of all recv wrs posted
on the qp (given that we assigned a ->done handler), this is a FLUSH
error completion, we just don't get to verify that because we deref
NULL before.

The issue here, was the assumption that dereferencing the connection
cm_id is always safe, which is not true since:

    commit 4a579da2586bd3b79b025947ea24ede2bbfede62
    Author: Sagi Grimberg 
    Date:   Sun Mar 29 15:52:04 2015 +0300

         iser-target: Fix possible deadlock in RDMA_CM connection error

As I see it, we have a direct reference to the isert_device from
isert_conn which is the one-liner fix that we actually need like
we do in isert_rdma_read_done() and isert_rdma_write_done().

Reported-by: Andrea Righi 
Tested-by: Andrea Righi 
Reviewed-by: Sagi Grimberg 
Cc:  # 3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

IB/IPoIB: ibX: failed to create mcg debug file

2017-05-17T19:08:21+00:00

[ Upstream commit 771a52584096c45e4565e8aabb596eece9d73d61 ]

When udev renames the netdev devices, ipoib debugfs entries does not
get renamed. As a result, if subsequent probe of ipoib device reuse the
name then creating a debugfs entry for the new device would fail.

Also, moved ipoib_create_debug_files and ipoib_delete_debug_files as part
of ipoib event handling in order to avoid any race condition between these.

Fixes: 1732b0ef3b3a ([IPoIB] add path record information in debugfs)
Cc: stable@vger.kernel.org # 2.6.15+
Signed-off-by: Vijay Kumar 
Signed-off-by: Shamir Rabinovitch 
Reviewed-by: Mark Bloch 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

IB/srp: Avoid that duplicate responses trigger a kernel bug

2017-05-17T19:06:59+00:00

[ Upstream commit 6cb72bc1b40bb2c1750ee7a5ebade93bed49a5fb ]

After srp_process_rsp() returns there is a short time during which
the scsi_host_find_tag() call will return a pointer to the SCSI
command that is being completed. If during that time a duplicate
response is received, avoid that the following call stack appears:

BUG: unable to handle kernel NULL pointer dereference at           (null)
IP: srp_recv_done+0x450/0x6b0 [ib_srp]
Oops: 0000 [#1] SMP
CPU: 10 PID: 0 Comm: swapper/10 Not tainted 4.10.0-rc7-dbg+ #1
Call Trace:
 
 __ib_process_cq+0x4b/0xd0 [ib_core]
 ib_poll_handler+0x1d/0x70 [ib_core]
 irq_poll_softirq+0xba/0x120
 __do_softirq+0xba/0x4c0
 irq_exit+0xbe/0xd0
 smp_apic_timer_interrupt+0x38/0x50
 apic_timer_interrupt+0x90/0xa0
 
RIP: srp_recv_done+0x450/0x6b0 [ib_srp] RSP: ffff88046f483e20

Signed-off-by: Bart Van Assche 
Cc: Israel Rukshin 
Cc: Max Gurtovoy 
Cc: Laurence Oberman 
Cc: Steve Feeley 
Cc: 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

IB/ipoib: Fix deadlock between rmmod and set_mode

2017-05-16T03:18:59+00:00

[ Upstream commit 0a0007f28304cb9fc87809c86abb80ec71317f20 ]

When calling set_mode from sys/fs, the call flow locks the sys/fs lock
first and then tries to lock rtnl_lock (when calling ipoib_set_mod).
On the other hand, the rmmod call flow takes the rtnl_lock first
(when calling unregister_netdev) and then tries to take the sys/fs
lock. Deadlock a->b, b->a.

The problem starts when ipoib_set_mod frees it's rtnl_lck and tries
to get it after that.

    set_mod:
    [] ? check_preempt_curr+0x6d/0x90
    [] __mutex_lock_slowpath+0x13e/0x180
    [] ? __rtnl_unlock+0x15/0x20
    [] mutex_lock+0x2b/0x50
    [] rtnl_lock+0x15/0x20
    [] ipoib_set_mode+0x97/0x160 [ib_ipoib]
    [] set_mode+0x3b/0x80 [ib_ipoib]
    [] dev_attr_store+0x20/0x30
    [] sysfs_write_file+0xe5/0x170
    [] vfs_write+0xb8/0x1a0
    [] sys_write+0x51/0x90
    [] system_call_fastpath+0x16/0x1b

    rmmod:
    [] ? put_dec+0x10c/0x110
    [] ? number+0x2ee/0x320
    [] schedule_timeout+0x215/0x2e0
    [] ? vsnprintf+0x484/0x5f0
    [] ? string+0x40/0x100
    [] wait_for_common+0x123/0x180
    [] ? default_wake_function+0x0/0x20
    [] ? ifind_fast+0x5e/0xb0
    [] wait_for_completion+0x1d/0x20
    [] sysfs_addrm_finish+0x228/0x270
    [] sysfs_remove_dir+0xa3/0xf0
    [] kobject_del+0x16/0x40
    [] device_del+0x184/0x1e0
    [] netdev_unregister_kobject+0xab/0xc0
    [] rollback_registered+0xae/0x130
    [] unregister_netdevice+0x22/0x70
    [] unregister_netdev+0x1e/0x30
    [] ipoib_remove_one+0xe0/0x120 [ib_ipoib]
    [] ib_unregister_device+0x4f/0x100 [ib_core]
    [] mlx4_ib_remove+0x41/0x180 [mlx4_ib]
    [] mlx4_remove_device+0x71/0x90 [mlx4_core]

Fixes: 862096a8bbf8 ("IB/ipoib: Add more rtnl_link_ops callbacks")
Cc:  # v3.6+
Cc: Or Gerlitz 
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

IPoIB: Avoid reading an uninitialized member variable

2017-01-13T01:56:57+00:00

[ Upstream commit 11b642b84e8c43e8597de031678d15c08dd057bc ]

This patch avoids that Coverity reports the following:

    Using uninitialized value port_attr.state when calling printk

Fixes: commit 94232d9ce817 ("IPoIB: Start multicast join process only on active ports")
Signed-off-by: Bart Van Assche 
Cc: Erez Shitrit 
Cc: 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

iser-target: Separate flows for np listeners and connections cma events

2016-04-18T12:50:54+00:00

[ Upstream commit f81bf458208ef6d12b2fc08091204e3859dcdba4 ]

No need to restrict this check to specific events.

Signed-off-by: Jenny Derzhavetz 
Signed-off-by: Sagi Grimberg 
Cc: stable@vger.kernel.org # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iser-target: Add new state ISER_CONN_BOUND to isert_conn

2016-04-18T12:50:53+00:00

[ Upstream commit aea92980601f7ddfcb3c54caa53a43726314fe46 ]

We need an indication that isert_conn->iscsi_conn binding has
happened so we'll know not to invoke a connection reinstatement
on an unbound connection which will lead to a bogus isert_conn->conn
dereferece.

Signed-off-by: Jenny Derzhavetz 
Signed-off-by: Sagi Grimberg 
Cc: stable@vger.kernel.org # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

iser-target: Fix identification of login rx descriptor type

2016-04-18T12:50:53+00:00

[ Upstream commit b89a7c25462b164db280abc3b05d4d9d888d40e9 ]

Once connection request is accepted, one rx descriptor
is posted to receive login request. This descriptor has rx type,
but is outside the main pool of rx descriptors, and thus
was mistreated as tx type.

Signed-off-by: Jenny Derzhavetz 
Signed-off-by: Sagi Grimberg 
Cc: stable@vger.kernel.org # v3.10+
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin

IB/srpt: Simplify srpt_handle_tsk_mgmt()

2016-04-18T12:50:43+00:00

[ Upstream commit 51093254bf879bc9ce96590400a87897c7498463 ]

Let the target core check task existence instead of the SRP target
driver. Additionally, let the target core check the validity of the
task management request instead of the ib_srpt driver.

This patch fixes the following kernel crash:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000001
IP: [] srpt_handle_new_iu+0x6d7/0x790 [ib_srpt]
Oops: 0002 [#1] SMP
Call Trace:
 [] srpt_process_completion+0xde/0x570 [ib_srpt]
 [] srpt_compl_thread+0x13f/0x160 [ib_srpt]
 [] kthread+0xcf/0xe0
 [] ret_from_fork+0x7c/0xb0

Signed-off-by: Bart Van Assche 
Fixes: 3e4f574857ee ("ib_srpt: Convert TMR path to target_submit_tmr")
Tested-by: Alex Estrin 
Reviewed-by: Christoph Hellwig 
Cc: Nicholas Bellinger 
Cc: Sagi Grimberg 
Cc: stable 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

target: Remove first argument of target_{get,put}_sess_cmd()

2016-02-28T05:09:36+00:00

[ Upstream commit afc16604c06414223478df3e42301ab630b9960a ]

The first argument of these two functions is always identical
to se_cmd->se_sess. Hence remove the first argument.

Signed-off-by: Bart Van Assche 
Reviewed-by: Sagi Grimberg 
Reviewed-by: Christoph Hellwig 
Cc: Andy Grover 
Cc: 
Cc: Felipe Balbi 
Cc: Michael S. Tsirkin 
Signed-off-by: Nicholas Bellinger 
Signed-off-by: Sasha Levin