linux-stable.git/drivers/staging/rdma, branch v4.6

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma

2016-04-30T00:07:54+00:00

Pull rdma fixes from Doug Ledford:
 "Final set of -rc fixes for 4.6.

  I've collected up a number of patches that are all pretty small with
  the exception of only a couple.  The hfi1 driver has a number of
  important patches, and it is what really drives the line count of this
  pull request up.  These are all small and I've got this kernel built
  and running in the test lab (I have most of the hardware, I think nes
  is the only thing in this patch set that I can't say I've personally
  tested and have up and running).

  Summary:

   - A number of collected fixes for oopses, memory corruptions,
     deadlocks, etc.  All of these fixes are small (many only 5-10
     lines), obvious, and tested.

   - Fix for the security issue related to the use of write for
     bi-directional communications"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
  RDMA/nes: don't leak skb if carrier down
  IB/security: Restrict use of the write() interface
  IB/hfi1: Use kernel default llseek for ui device
  IB/hfi1: Don't attempt to free resources if initialization failed
  IB/hfi1: Fix missing lock/unlock in verbs drain callback
  IB/rdmavt: Fix send scheduling
  IB/hfi1: Prevent unpinning of wrong pages
  IB/hfi1: Fix deadlock caused by locking with wrong scope
  IB/hfi1: Prevent NULL pointer deferences in caching code
  MAINTAINERS: Update iser/isert maintainer contact info
  IB/mlx5: Expose correct max_sge_rd limit
  RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips
  iw_cxgb4: handle draining an idle qp
  iw_cxgb3: initialize ibdev.iwcm->ifname for port mapping
  iw_cxgb4: initialize ibdev.iwcm->ifname for port mapping
  IB/core: Don't drain non-existent rq queue-pair
  IB/core: Fix oops in ib_cache_gid_set_default_gid

IB/security: Restrict use of the write() interface

2016-04-28T16:03:16+00:00

The drivers/infiniband stack uses write() as a replacement for
bi-directional ioctl().  This is not safe. There are ways to
trigger write calls that result in the return structure that
is normally written to user space being shunted off to user
specified kernel memory instead.

For the immediate repair, detect and deny suspicious accesses to
the write API.

For long term, update the user space libraries and the kernel API
to something that doesn't present the same security vulnerabilities
(likely a structured ioctl() interface).

The impacted uAPI interfaces are generally only available if
hardware from drivers/infiniband is installed in the system.

Reported-by: Jann Horn 
Signed-off-by: Linus Torvalds 
Signed-off-by: Jason Gunthorpe 
[ Expanded check to all known write() entry points ]
Cc: stable@vger.kernel.org
Signed-off-by: Doug Ledford

IB/hfi1: Use kernel default llseek for ui device

2016-04-28T16:00:39+00:00

The ui device llseek had a mistake with SEEK_END and did
not fully follow seek semantics.  Correct all this by
using a kernel supplied function for fixed size devices.

Cc: Al Viro 
Reviewed-by: Dennis Dalessandro 
Signed-off-by: Dean Luick 
Signed-off-by: Doug Ledford

IB/hfi1: Don't attempt to free resources if initialization failed

2016-04-28T16:00:39+00:00

Attempting to free resources which have not been allocated and
initialized properly led to the following kernel backtrace:

    BUG: unable to handle kernel NULL pointer dereference at           (null)
    IP: [] unlock_exp_tids.isra.8+0x2e/0x120 [hfi1]
    PGD 852a43067 PUD 85d4a6067 PMD 0
    Oops: 0000 [#1] SMP
    CPU: 0 PID: 2831 Comm: osu_bw Tainted: G          IO 3.12.18-wfr+ #1
    task: ffff88085b15b540 ti: ffff8808588fe000 task.ti: ffff8808588fe000
    RIP: 0010:[]  [] unlock_exp_tids.isra.8+0x2e/0x120 [hfi1]
    RSP: 0018:ffff8808588ffde0  EFLAGS: 00010282
    RAX: 0000000000000000 RBX: ffff880858a31800 RCX: 0000000000000000
    RDX: ffff88085d971bc0 RSI: ffff880858a318f8 RDI: ffff880858a318c0
    RBP: ffff8808588ffe20 R08: 0000000000000000 R09: 0000000000000000
    R10: ffff88087ffd6f40 R11: 0000000001100348 R12: ffff880852900000
    R13: ffff880858a318c0 R14: 0000000000000000 R15: ffff88085d971be8
    FS:  00007f4674e83740(0000) GS:ffff88087f400000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000000000 CR3: 000000085c377000 CR4: 00000000001407f0
    Stack:
     ffffffffa0941a71 ffff880858a318f8 ffff88085d971bc0 ffff880858a31800
     ffff880852900000 ffff880858a31800 00000000003ffff7 ffff88085d971bc0
     ffff8808588ffe60 ffffffffa09663fc ffff8808588ffe60 ffff880858a31800
    Call Trace:
     [] ? find_mmu_handler+0x51/0x70 [hfi1]
     [] hfi1_user_exp_rcv_free+0x6c/0x120 [hfi1]
     [] hfi1_file_close+0x1a9/0x340 [hfi1]
     [] __fput+0xe9/0x270
     [] ____fput+0xe/0x10
     [] task_work_run+0xa7/0xe0
     [] do_notify_resume+0x59/0x80
     [] int_signal+0x12/0x17

This commit re-arranges the context initialization code in a way that
would allow for context event flags to be used to determine whether
the context has been successfully initialized.

In turn, this can be used to skip the resource de-allocation if they
were never allocated in the first place.

Fixes: 3abb33ac6521 ("staging/hfi1: Add TID cache receive init and free funcs")
Reviewed-by: Dennis Dalessandro 
Signed-off-by: Mitko Haralanov 
Reviewed-by: Leon Romanovsky

IB/hfi1: Fix missing lock/unlock in verbs drain callback

2016-04-28T16:00:39+00:00

The iowait_sdma_drained() callback lacked locking to
protect the qp s_flags field.

This causes the s_flags to be out of sync
on multiple CPUs, potentially corrupting the s_flags.

Fixes: a545f5308b6c ("staging/rdma/hfi: fix CQ completion order issue")
Reviewed-by: Sebastian Sanchez 
Signed-off-by: Mike Marciniszyn 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

IB/hfi1: Prevent unpinning of wrong pages

2016-04-28T16:00:38+00:00

The routine used by the SDMA cache to handle already
cached nodes can extend an already existing node.

In its error handling code, the routine will unpin pages
when not all pages of the buffer extension were pinned.

There was a bug in that part of the routine, which would
mistakenly unpin pages from the original set rather than
the newly pinned pages.

This commit fixes that bug by offsetting the page array
to the proper place pointing at the beginning of the newly
pinned pages.

Reviewed-by: Dean Luick 
Signed-off-by: Mitko Haralanov 
Signed-off-by: Doug Ledford

IB/hfi1: Fix deadlock caused by locking with wrong scope

2016-04-28T16:00:38+00:00

The locking around the interval RB tree is designed to prevent
access to the tree while it's being modified. The locking in its
current form is too overzealous, which is causing a deadlock in
certain cases with the following backtrace:

    Kernel panic - not syncing: Watchdog detected hard LOCKUP on cpu 0
    CPU: 0 PID: 5836 Comm: IMB-MPI1 Tainted: G           O 3.12.18-wfr+ #1
     0000000000000000 ffff88087f206c50 ffffffff814f1caa ffffffff817b53f0
     ffff88087f206cc8 ffffffff814ecd56 0000000000000010 ffff88087f206cd8
     ffff88087f206c78 0000000000000000 0000000000000000 0000000000001662
    Call Trace:
       [] dump_stack+0x45/0x56
     [] panic+0xc2/0x1cb
     [] ? restart_watchdog_hrtimer+0x50/0x50
     [] watchdog_overflow_callback+0xc2/0xd0
     [] __perf_event_overflow+0x8e/0x2b0
     [] perf_event_overflow+0x14/0x20
     [] intel_pmu_handle_irq+0x1b6/0x390
     [] perf_event_nmi_handler+0x2b/0x50
     [] nmi_handle.isra.3+0x88/0x180
     [] do_nmi+0x169/0x310
     [] end_repeat_nmi+0x1e/0x2e
     [] ? unmap_single+0x30/0x30
     [] ? _raw_spin_lock_irqsave+0x2d/0x40
     [] ? _raw_spin_lock_irqsave+0x2d/0x40
     [] ? _raw_spin_lock_irqsave+0x2d/0x40
     <>    [] hfi1_mmu_rb_search+0x38/0x70 [hfi1]
     [] user_sdma_free_request+0xcb/0x120 [hfi1]
     [] user_sdma_txreq_cb+0x263/0x350 [hfi1]
     [] ? sdma_txclean+0x27/0x1c0 [hfi1]
     [] ? user_sdma_send_pkts+0x1710/0x1710 [hfi1]
     [] sdma_make_progress+0x166/0x480 [hfi1]
     [] ? ttwu_do_wakeup+0x19/0xd0
     [] sdma_engine_interrupt+0x8e/0x100 [hfi1]
     [] sdma_interrupt+0x5d/0xa0 [hfi1]
     [] handle_irq_event_percpu+0x47/0x1d0
     [] handle_irq_event+0x37/0x60
     [] handle_edge_irq+0x6f/0x120
     [] handle_irq+0xbf/0x150
     [] ? irq_enter+0x17/0x80
     [] do_IRQ+0x4d/0xc0
     [] common_interrupt+0x6a/0x6a
       [] ? finish_task_switch+0x54/0xe0
     [] __schedule+0x3b6/0x7e0
     [] __cond_resched+0x26/0x30
     [] _cond_resched+0x3a/0x50
     [] down_write+0x12/0x30
     [] hfi1_release_user_pages+0x69/0x90 [hfi1]
     [] sdma_rb_remove+0x9a/0xc0 [hfi1]
     [] __mmu_rb_remove.isra.5+0x5d/0x70 [hfi1]
     [] hfi1_mmu_rb_remove+0x56/0x70 [hfi1]
     [] hfi1_user_sdma_process_request+0x74b/0x1160 [hfi1]
     [] hfi1_aio_write+0xc3/0x100 [hfi1]
     [] do_sync_readv_writev+0x4c/0x80
     [] do_readv_writev+0xbb/0x230
     [] ? fsnotify+0x241/0x320
     [] ? finish_task_switch+0x54/0xe0
     [] vfs_writev+0x35/0x60
     [] SyS_writev+0x49/0xc0
     [] ? __audit_syscall_exit+0x1f6/0x2a0
     [] system_call_fastpath+0x16/0x1b

As evident from the backtrace above, the process was being put to sleep
while holding the lock.

Limiting the scope of the lock only to the RB tree operation fixes the
above error allowing for proper locking and the process being put to
sleep when needed.

Reviewed-by: Dennis Dalessandro 
Reviewed-by: Dean Luick 
Signed-off-by: Mitko Haralanov 
Signed-off-by: Doug Ledford

IB/hfi1: Prevent NULL pointer deferences in caching code

2016-04-28T16:00:38+00:00

There is a potential kernel crash when the MMU notifier calls the
invalidation routines in the hfi1 pinned page caching code for sdma.

The invalidation routine could call the remove callback
for the node, which in turn ends up dereferencing the
current task_struct to get a pointer to the mm_struct.
However, the mm_struct pointer could be NULL resulting in
the following backtrace:

    BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8
    IP: [] sdma_rb_remove+0xaa/0x100 [hfi1]
    15
    task: ffff88085e66e080 ti: ffff88085c244000 task.ti: ffff88085c244000
    RIP: 0010:[]  [] sdma_rb_remove+0xaa/0x100 [hfi1]
    RSP: 0000:ffff88085c245878  EFLAGS: 00010002
    RAX: 0000000000000000 RBX: ffff88105b9bbd40 RCX: ffffea003931a830
    RDX: 0000000000000004 RSI: ffff88105754a9c0 RDI: ffff88105754a9c0
    RBP: ffff88085c245890 R08: ffff88105b9bbd70 R09: 00000000fffffffb
    R10: ffff88105b9bbd58 R11: 0000000000000013 R12: ffff88105754a9c0
    R13: 0000000000000001 R14: 0000000000000001 R15: ffff88105b9bbd40
    FS:  0000000000000000(0000) GS:ffff88107ef40000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00000000000000a8 CR3: 0000000001a0b000 CR4: 00000000001407e0
    Stack:
     ffff88105b9bbd40 ffff88080ec481a8 ffff88080ec481b8 ffff88085c2458c0
     ffffffffa03fa00e ffff88080ec48190 ffff88080ed9cd00 0000000001024000
     0000000000000000 ffff88085c245920 ffffffffa03fa0e7 0000000000000282
    Call Trace:
     [] __mmu_rb_remove.isra.5+0x5e/0x70 [hfi1]
     [] mmu_notifier_mem_invalidate+0xc7/0xf0 [hfi1]
     [] mmu_notifier_page+0x13/0x20 [hfi1]
     [] __mmu_notifier_invalidate_page+0x50/0x70
     [] try_to_unmap_one+0x20b/0x470
     [] try_to_unmap_anon+0xa7/0x120
     [] try_to_unmap+0x4d/0x60
     [] shrink_page_list+0x2eb/0x9d0
     [] shrink_inactive_list+0x243/0x490
     [] shrink_lruvec+0x4c1/0x640
     [] shrink_zone+0x31/0x100
     [] kswapd_shrink_zone.constprop.62+0xef/0x1c0
     [] kswapd+0x403/0x7e0
     [] ? shrink_all_memory+0xf0/0xf0
     [] kthread+0xc0/0xd0
     [] ? insert_kthread_work+0x40/0x40
     [] ret_from_fork+0x7c/0xb0
     [] ? insert_kthread_work+0x40/0x40

To correct this, the mm_struct passed to us by the MMU notifier is
used (which is what should have been done to begin with). This avoids
the broken derefences and ensures that the correct mm_struct is used.

Reviewed-by: Dennis Dalessandro 
Reviewed-by: Dean Luick 
Signed-off-by: Mitko Haralanov 
Signed-off-by: Doug Ledford

staging/rdma/hfi1: select CRC32

2016-04-04T20:47:15+00:00

The function parse_platform_config in firmware.c calls crc32_le.
Building without CRC32 selected causes a link error:

drivers/built-in.o: In function `parse_platform_config':
(.text+0x92ffa): undefined reference to `crc32_le'

Signed-off-by: Markus Böhme 
Signed-off-by: Greg Kroah-Hartman

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma

2016-03-22T22:48:44+00:00

Pull more rdma updates from Doug Ledford:
"Round two of 4.6 merge window patches.

This is a monster pull request. I held off on the hfi1 driver updates
(the hfi1 driver is intimately tied to the qib driver and the new
rdmavt software library that was created to help both of them) in my
first pull request. The hfi1/qib/rdmavt update is probably 90% of
this pull request. The hfi1 driver is being left in staging so that
it can be fixed up in regards to the API that Al and yourself didn't
like. Intel has agreed to do the work, but in the meantime, this
clears out 300+ patches in the backlog queue and brings my tree and
their tree closer to sync.

This also includes about 10 patches to the core and a few to mlx5 to
create an infrastructure for configuring SRIOV ports on IB devices.
That series includes one patch to the net core that we sent to netdev@
and Dave Miller with each of the three revisions to the series. We
didn't get any response to the patch, so we took that as implicit
approval.

Finally, this series includes Intel's new iWARP driver for their x722
cards. It's not nearly the beast as the hfi1 driver. It also has a
linux-next merge issue, but that has been resolved and it now passes
just fine.

Summary:

- A few minor core fixups needed for the next patch series

- The IB SRIOV series. This has bounced around for several versions.
Of note is the fact that the first patch in this series effects the
net core. It was directed to netdev and DaveM for each iteration
of the series (three versions total). Dave did not object, but did
not respond either. I've taken this as permission to move forward
with the series.

- The new Intel X722 iWARP driver

- A huge set of updates to the Intel hfi1 driver. Of particular
interest here is that we have left the driver in staging since it
still has an API that people object to. Intel is working on a fix,
but getting these patches in now helps keep me sane as the upstream
and Intel's trees were over 300 patches apart"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: (362 commits)
IB/ipoib: Allow mcast packets from other VFs
IB/mlx5: Implement callbacks for manipulating VFs
net/mlx5_core: Implement modify HCA vport command
net/mlx5_core: Add VF param when querying vport counter
IB/ipoib: Add ndo operations for configuring VFs
IB/core: Add interfaces to control VF attributes
IB/core: Support accessing SA in virtualized environment
IB/core: Add subnet prefix to port info
IB/mlx5: Fix decision on using MAD_IFC
net/core: Add support for configuring VF GUIDs
IB/{core, ulp} Support above 32 possible device capability flags
IB/core: Replace setting the zero values in ib_uverbs_ex_query_device
net/mlx5_core: Introduce offload arithmetic hardware capabilities
net/mlx5_core: Refactor device capability function
net/mlx5_core: Fix caching ATOMIC endian mode capability
ib_srpt: fix a WARN_ON() message
i40iw: Replace the obsolete crypto hash interface with shash
IB/hfi1: Add SDMA cache eviction algorithm
IB/hfi1: Switch to using the pin query function
IB/hfi1: Specify mm when releasing pages
...