linux.git/drivers/infiniband, branch v3.6-rc4

Merge branches 'cma', 'ipoib', 'misc', 'mlx4', 'ocrdma', 'qib' and 'srp' into for-next

2012-08-16T16:38:39+00:00

IB/mlx4: Check iboe netdev pointer before dereferencing it

2012-08-16T16:38:19+00:00

Unlike other parts of the mlx4_ib code, the function build_mlx_header()
doesn't check if the iboe netdev of the given port is valid before
dereferencing it, which can cause a crash if the ethernet interface
has already been taken down.

Fix this by checking for a valid netdev pointer before using it to get
the port MAC address.

Signed-off-by: Kleber Sacilotto de Souza 
Signed-off-by: Roland Dreier

IB/srp: Fix a race condition

2012-08-15T19:00:48+00:00

Avoid a crash caused by the scmnd->scsi_done(scmnd) call in
srp_process_rsp() being invoked with scsi_done == NULL.  This can
happen if a reply is received during or after a command abort.

Reported-by: Joseph Glanville 
Reference: http://marc.info/?l=linux-rdma&m=134314367801595
Cc: 
Acked-by: David Dillow 
Signed-off-by: Bart Van Assche 
Signed-off-by: Roland Dreier

IB/qib: Fix error return code in qib_init_7322_variables()

2012-08-15T18:58:21+00:00

Convert a 0 error return code to a negative one, as returned elsewhere
in the function.

A simplified version of the semantic match that finds this problem is
as follows: (http://coccinelle.lip6.fr/)

// 
@@
identifier ret;
expression e,e1,e2,e3,e4,x;
@@

(
if (\(ret != 0\|ret < 0\) || ...) { ... return ...; }
|
ret = 0
)
... when != ret = e1
*x = \(kmalloc\|kzalloc\|kcalloc\|devm_kzalloc\|ioremap\|ioremap_nocache\|devm_ioremap\|devm_ioremap_nocache\)(...);
... when != x = e2
    when != ret = e3
*if (x == NULL || ...)
{
  ... when != ret = e4
*  return ret;
}
// 

Signed-off-by: Julia Lawall 
Acked-by: Mike Marciniszyn 
Signed-off-by: Roland Dreier

IB: Fix typos in infiniband drivers

2012-08-15T18:56:19+00:00

Correct spelling typos in comments in drivers/infiniband.

Signed-off-by: Masanari Iida 
Signed-off-by: Roland Dreier

IB/ipoib: Fix RCU pointer dereference of wrong object

2012-08-14T22:21:44+00:00

Commit b63b70d87741 ("IPoIB: Use a private hash table for path lookup
in xmit path") introduced a bug where in ipoib_neigh_free() (which is
called from a few errors flows in the driver), rcu_dereference() is
invoked with the wrong pointer object, which results in a crash.

Signed-off-by: Shlomo Pongratz 
Signed-off-by: Or Gerlitz 
Signed-off-by: Roland Dreier

IB/ipoib: Add missing locking when CM object is deleted

2012-08-14T22:21:44+00:00

Commit b63b70d87741 ("IPoIB: Use a private hash table for path lookup
in xmit path") introduced a bug where in ipoib_cm_destroy_tx() a CM
object is moved between lists without any supported locking.  Under a
stress test, this eventually leads to list corruption and a crash.

Previously when this routine was called, callers were taking the
device priv lock.  Currently this function is called from the RCU
callback associated with neighbour deletion.  Fix the race by taking
the same lock we used to before.

Signed-off-by: Shlomo Pongratz 
Signed-off-by: Or Gerlitz 
Signed-off-by: Roland Dreier

RDMA/ucma.c: Fix for events with wrong context on iWARP

2012-08-13T20:08:35+00:00

It is possible for asynchronous RDMA_CM_EVENT_ESTABLISHED events to be
generated with ctx->uid == 0, because ucma_set_event_context() copies
ctx->uid to the event structure outside of ctx->file->mut.  This leads
to a crash in the userspace library, since it gets a bogus event.

Fix this by taking the mutex a bit earlier in ucma_event_handler.

Signed-off-by: Tatyana Nikolova 
Signed-off-by: Sean Hefty 
Signed-off-by: Roland Dreier

RDMA/ocrdma: Don't call vlan_dev_real_dev() for non-VLAN netdevs

2012-08-10T23:52:13+00:00

If CONFIG_VLAN_8021Q is not set, then vlan_dev_real_dev() just goes BUG(),
so we shouldn't call it unless we're actually dealing with a VLAN netdev.

Reported-by: Fengguang Wu 
Signed-off-by: Roland Dreier

IB/mlx4: Fix possible deadlock on sm_lock spinlock

2012-08-10T20:02:24+00:00

The sm_lock spinlock is taken in the process context by
mlx4_ib_modify_device, and in the interrupt context by update_sm_ah,
so we need to take that spinlock with irqsave, and release it with
irqrestore.

Lockdeps reports this as follows:

    [ INFO: inconsistent lock state ]
    3.5.0+ #20 Not tainted
    inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
    swapper/0/0 [HC1[1]:SC0[0]:HE0:SE1] takes:
    (&(&ibdev->sm_lock)->rlock){?.+...}, at: [] update_sm_ah+0xad/0x100 [mlx4_ib]
    {HARDIRQ-ON-W} state was registered at:
      [] mark_irqflags+0x120/0x190
      [] __lock_acquire+0x307/0x4c0
      [] lock_acquire+0xb1/0x150
      [] _raw_spin_lock+0x41/0x50
      [] mlx4_ib_modify_device+0x63/0x240 [mlx4_ib]
      [] ib_modify_device+0x1c/0x20 [ib_core]
      [] set_node_desc+0x83/0xc0 [ib_core]
      [] dev_attr_store+0x20/0x30
      [] sysfs_write_file+0xe6/0x170
      [] vfs_write+0xc8/0x190
      [] sys_write+0x51/0x90
      [] system_call_fastpath+0x16/0x1b

    ...
    *** DEADLOCK ***

    1 lock held by swapper/0/0:

    stack backtrace:
    Pid: 0, comm: swapper/0 Not tainted 3.5.0+ #20
    Call Trace:
      [] print_usage_bug+0x18a/0x190
    [] ? print_irq_inversion_bug+0x210/0x210
    [] mark_lock_irq+0xf2/0x280
    [] mark_lock+0x150/0x240
    [] mark_irqflags+0x16f/0x190
    [] __lock_acquire+0x307/0x4c0
    [] ? update_sm_ah+0xad/0x100 [mlx4_ib]
    [] lock_acquire+0xb1/0x150
    [] ? update_sm_ah+0xad/0x100 [mlx4_ib]
    [] _raw_spin_lock+0x41/0x50
    [] ? update_sm_ah+0xad/0x100 [mlx4_ib]
    [] ? ib_create_ah+0x1a/0x40 [ib_core]
    [] update_sm_ah+0xad/0x100 [mlx4_ib]
    [] ? is_module_address+0x23/0x30
    [] handle_port_mgmt_change_event+0xeb/0x150 [mlx4_ib]
    [] mlx4_ib_event+0x117/0x160 [mlx4_ib]
    [] ? _raw_spin_lock_irqsave+0x61/0x70
    [] mlx4_dispatch_event+0x6c/0x90 [mlx4_core]
    [] mlx4_eq_int+0x500/0x950 [mlx4_core]

Reported by: Or Gerlitz 
Tested-by: Bart Van Assche 
Signed-off-by: Jack Morgenstein 
Signed-off-by: Roland Dreier