linux-stable.git/drivers/infiniband, branch v4.13.2

IB/hfi1: update to new mmu_notifier semantic

2017-08-31T23:12:59+00:00

Calls to mmu_notifier_invalidate_page() were replaced by calls to
mmu_notifier_invalidate_range() and are now bracketed by calls to
mmu_notifier_invalidate_range_start()/end()

Remove now useless invalidate_page callback.

Signed-off-by: Jérôme Glisse 
Cc: linux-rdma@vger.kernel.org
Cc: Dean Luick 
Cc: Ira Weiny 
Cc: Doug Ledford 
Cc: Kirill A. Shutemov 
Cc: Andrew Morton 
Cc: Andrea Arcangeli 
Signed-off-by: Linus Torvalds

IB/umem: update to new mmu_notifier semantic

2017-08-31T23:12:59+00:00

Calls to mmu_notifier_invalidate_page() were replaced by calls to
mmu_notifier_invalidate_range() and are now bracketed by calls to
mmu_notifier_invalidate_range_start()/end()

Remove now useless invalidate_page callback.

Signed-off-by: Jérôme Glisse 
Tested-by: Leon Romanovsky 
Cc: linux-rdma@vger.kernel.org
Cc: Artemy Kovalyov 
Cc: Doug Ledford 
Cc: Kirill A. Shutemov 
Cc: Andrew Morton 
Cc: Andrea Arcangeli 
Signed-off-by: Linus Torvalds

IB/mlx5: Always return success for RoCE modify port

2017-08-24T19:33:33+00:00

CM layer calls ib_modify_port() regardless of the link layer.

For the Ethernet ports, qkey violation and Port capabilities
are meaningless. Therefore, always return success for ib_modify_port
calls on the Ethernet ports.

Cc: Selvin Xavier 
Signed-off-by: Majd Dibbiny 
Reviewed-by: Moni Shoua 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

IB/mlx5: Fix Raw Packet QP event handler assignment

2017-08-24T19:33:33+00:00

In case we have SQ and RQ for Raw Packet QP, the SQ's event handler
wasn't assigned.

Fixing this by assigning event handler for each WQ after creation.

[ 1877.145243] Call Trace:
[ 1877.148644] 
[ 1877.150580] [] ? mlx5_rsc_event+0x105/0x210 [mlx5_core]
[ 1877.159581] [] ? mlx5_cq_event+0x57/0xd0 [mlx5_core]
[ 1877.167137] [] mlx5_eq_int+0x53e/0x6c0 [mlx5_core]
[ 1877.174526] [] ? sched_clock+0x9/0x10
[ 1877.180753] [] handle_irq_event_percpu+0x3e/0x1e0
[ 1877.188014] [] handle_irq_event+0x3d/0x60
[ 1877.194567] [] handle_edge_irq+0x77/0x130
[ 1877.201129] [] handle_irq+0xbf/0x150
[ 1877.207244] [] ? atomic_notifier_call_chain+0x1a/0x20
[ 1877.214829] [] do_IRQ+0x4f/0xf0
[ 1877.220498] [] common_interrupt+0x6d/0x6d
[ 1877.227025] 
[ 1877.228967] [] ? cpuidle_enter_state+0x52/0xc0
[ 1877.236990] [] cpuidle_idle_call+0xc5/0x200
[ 1877.243676] [] arch_cpu_idle+0xe/0x30
[ 1877.249831] [] cpu_startup_entry+0xf5/0x290
[ 1877.256513] [] start_secondary+0x265/0x27b
[ 1877.263111] Code: Bad RIP value.
[ 1877.267296] RIP [< (null)>] (null)
[ 1877.273264] RSP 
[ 1877.277531] CR2: 0000000000000000

Fixes: 19098df2da78 ("IB/mlx5: Refactor mlx5_ib_qp to accommodate other QP types")
Signed-off-by: Majd Dibbiny 
Reviewed-by: Yishai Hadas 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

IB/core: Avoid accessing non-allocated memory when inferring port type

2017-08-24T19:33:33+00:00

Commit 44c58487d51a ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types")
introduced the concept of type in ah_attr:
 * During ib_register_device, each port is checked for its type which
   is stored in ib_device's port_immutable array.
 * During uverbs' modify_qp, the type is inferred using the port number
   in ib_uverbs_qp_dest struct (address vector) by accessing the
   relevant port_immutable array and the type is passed on to
   providers.

IB spec (version 1.3) enforces a valid port value only in Reset to
Init. During Init to RTR, the address vector must be valid but port
number is not mentioned as a field in the address vector, so its
value is not validated, which leads to accesses to a non-allocated
memory when inferring the port type.

Save the real port number in ib_qp during modify to Init (when the
comp_mask indicates that the port number is valid) and use this value
to infer the port type.

Avoid copying the address vector fields if the matching bit is not set
in the attr_mask. Address vector can't be modified before the port, so
no valid flow is affected.

Fixes: 44c58487d51a ('IB/core: Define 'ib' and 'roce' rdma_ah_attr types')
Signed-off-by: Noa Osherovich 
Reviewed-by: Yishai Hadas 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

RDMA/uverbs: Initialize cq_context appropriately

2017-08-22T17:55:47+00:00

Initializing cq_context with ev_queue in create_cq(), leads to NULL pointer
dereference in ib_uverbs_comp_handler(), if application doesnot use completion
channel. This patch fixes the cq_context initialization.

Fixes: 1e7710f3f65 ("IB/core: Change completion channel to use the reworked")
Cc: stable@vger.kernel.org # 4.12
Signed-off-by: Potnuri Bharat Teja 
Reviewed-by: Matan Barak 
Signed-off-by: Doug Ledford 
(cherry picked from commit 699a2d5b1b880b4e4e1c7d55fa25659322cf5b51)

IB/uverbs: Fix NULL pointer dereference during device removal

2017-08-16T16:53:15+00:00

As part of ib_uverbs_remove_one which might be triggered upon
reset flow, we trigger IB_EVENT_DEVICE_FATAL event to userspace
application.
If device was removed after uverbs fd was opened but before
ib_uverbs_get_context was called, the event file will be accessed
before it was allocated, result in NULL pointer dereference:

[ 72.325873] BUG: unable to handle kernel NULL pointer dereference at (null)
...
[ 72.325984] IP: _raw_spin_lock_irqsave+0x22/0x40
[ 72.327123] Call Trace:
[ 72.327168] ib_uverbs_async_handler.isra.8+0x2e/0x160 [ib_uverbs]
[ 72.327216] ? synchronize_srcu_expedited+0x27/0x30
[ 72.327269] ib_uverbs_remove_one+0x120/0x2c0 [ib_uverbs]
[ 72.327330] ib_unregister_device+0xd0/0x180 [ib_core]
[ 72.327373] mlx5_ib_remove+0x74/0x140 [mlx5_ib]
[ 72.327422] mlx5_remove_device+0xfb/0x110 [mlx5_core]
[ 72.327466] mlx5_unregister_interface+0x3c/0xa0 [mlx5_core]
[ 72.327509] mlx5_ib_cleanup+0x10/0x962 [mlx5_ib]
[ 72.327546] SyS_delete_module+0x155/0x230
[ 72.328472] ? exit_to_usermode_loop+0x70/0xa6
[ 72.329370] do_syscall_64+0x54/0xc0
[ 72.330262] entry_SYSCALL64_slow_path+0x25/0x25

Fix it by checking that user context was allocated before
trigger the event.

Fixes: 036b10635739 ('IB/uverbs: Enable device removal when there are active user space applications')
Signed-off-by: Maor Gottlieb 
Reviewed-by: Matan Barak 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

IB/core: Protect sysfs entry on ib_unregister_device

2017-08-16T15:47:55+00:00

ib_unregister_device is not protecting removal of sysfs entries.
A call to ib_register_device in that window can result in
duplicate sysfs entry warning. Move mutex_unlock to after
ib_device_unregister_sysfs to protect against sysfs entry creation.

This issue is exposed during driver load/unload stress test.

WARNING: CPU: 5 PID: 4445 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x5f/0x70
sysfs: cannot create duplicate filename '/class/infiniband/i40iw0'
Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./Q87M-D2H
BIOS F7 01/17/2014
Workqueue: i40e i40e_service_task [i40e]
Call Trace:
dump_stack+0x67/0x98
__warn+0xcc/0xf0
warn_slowpath_fmt+0x4a/0x50
? kernfs_path_from_node+0x4b/0x60
sysfs_warn_dup+0x5f/0x70
sysfs_do_create_link_sd.isra.2+0xb7/0xc0
sysfs_create_link+0x20/0x40
device_add+0x28c/0x600
ib_device_register_sysfs+0x58/0x170 [ib_core]
ib_register_device+0x325/0x570 [ib_core]
? i40iw_register_rdma_device+0x1f4/0x400 [i40iw]
? kmem_cache_alloc_trace+0x143/0x330
? __raw_spin_lock_init+0x2d/0x50
i40iw_register_rdma_device+0x2dc/0x400 [i40iw]
i40iw_open+0x10a6/0x1950 [i40iw]
? i40iw_open+0xeab/0x1950 [i40iw]
? i40iw_make_cm_node+0x9c0/0x9c0 [i40iw]
i40e_client_subtask+0xa4/0x110 [i40e]
i40e_service_task+0xc2d/0x1320 [i40e]
process_one_work+0x203/0x710
? process_one_work+0x16f/0x710
worker_thread+0x126/0x4a0
? trace_hardirqs_on+0xd/0x10
kthread+0x112/0x150
? process_one_work+0x710/0x710
? kthread_create_on_node+0x40/0x40
ret_from_fork+0x2e/0x40
---[ end trace fd11b69e21ea7653 ]---
Couldn't register device i40iw0 with driver model

Signed-off-by: Shiraz Saleem 
Signed-off-by: Sindhu Devale 
Signed-off-by: Doug Ledford

iw_cxgb4: fix misuse of integer variable

2017-08-16T15:43:21+00:00

Fixes: ee30f7d507c0 ("iw_cxgb4: Max fastreg depth depends on DSGL support")
Signed-off-by: Steve Wise 
Signed-off-by: Doug Ledford

IB/hns: fix memory leak on ah on error return path

2017-08-16T15:30:33+00:00

When dmac is NULL, ah is not being freed on the error return path. Fix
this by kfree'ing it.

Detected by CoverityScan, CID#1452636 ("Resource Leak")

Fixes: d8966fcd4c25 ("IB/core: Use rdma_ah_attr accessor functions")
Signed-off-by: Colin Ian King 
Signed-off-by: Doug Ledford