[PATCH rdma-next 0/4] RDMA/irdma: Prevent premature deregistration of user ring MRs

[Jacob Moroni <jmoroni@google.com>]

When a QP/CQ/SRQ is created, a two step process is used where the
buffer is allocated in userspace and explicitly registered with the
normal reg_mr mechanism prior to creating the actual QP/CQ/SRQ object.

Even though these special MRs are internal to the verbs provider,
nothing actually prevents a custom/malicious user application from
manually invoking dereg_mr on these regions. If this occurs, the PBL
is freed and umem is released while the HW may still be accessing it.

Since the core layer is unaware of the relationship between these MRs
and their associated QP/CQ/SRQ objects, refcounting must be performed
in the irdma driver to block any deregistration attempts if the region
is still associated with an active ring object.

Jacob Moroni (4):
  RDMA/irdma: Deduplicate the irdma_del_memlist logic
  RDMA/irdma: Add a refcount to track user ring MR associations
  RDMA/irdma: Add irdma_cq fields to track pbl allocations
  RDMA/irdma: Add refcounting to user ring MRs

 drivers/infiniband/hw/irdma/utils.c |   6 ++
 drivers/infiniband/hw/irdma/verbs.c | 116 ++++++++++++++++++++--------
 drivers/infiniband/hw/irdma/verbs.h |   3 +
 3 files changed, 93 insertions(+), 32 deletions(-)

-- 
2.55.0.rc0.738.g0c8ab3ebcc-goog