RE: [PATCH] core/verb.c: fix kernel panic: always initialize struct ib_qp *qp->usecnt

Hefty, Sean
2012-01-20T18:43:54Z

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="utf-8", Size: 3559 bytes --]

> However, what is is with user space setting type to IB_QPT_XRC_TGT? I
> guess this could be solved by letting the kernel zero the memory
> returned by ->ops.create_qp(pd, qp_init_attr).
> Btw, I didn't figure out yet, how this translates at all in kernel
> space? Is this op directly going to the device driver?

ops.create_qp basically ends up going into the kernel into ib_uverbs_create_qp().

> But even if we are properly going to initialize the qp, what is with
> user space mischievously trying to crash the system by manipulating
> struct ib_qp *qp?

There's cleanup in uverbs that ignores the return value from ib_destroy_qp(), basically because it shouldn't fail in those circumstances. After calling ib_destroy_qp, uverbs will free some internal structures that some of the callback handlers expect to access. This leads to the crashes that you're seeing.

I think the problem is that your first patch is incomplete. ib_uverbs_create_qp() will create a QP by either calling ib_create_qp() or by calling the device directly (device->create_qp). qp->usecnt needs to be initialized in both cases. Can you try this modification to your original patch?

From: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>

From: Sean Hefty <sean.hefty@intel.com>

rdma/core: Fix kernel panic by always initializing qp->usecnt

We have just been investigating kernel panics related to
cq->ibcq.event_handler() completion calls.

Reason is that ib_destroy_qp() fails with -EBUSY. Further investigation
revealed qp->usecnt is not initialized. This counter was introduced
in linux-3.2 by commit 0e0ec7e0638ef48e0c661873dfcc8caccab984c6
and is only initialized for IB_QPT_XRC_TGT, but also checked in ib_destroy_qp()
for any qp type.

Signed-off-by: Bernd Schubert <bernd.schubert@itwm.fraunhofer.de>
Signed-off-by: Sven Breuner <sven.breuner@itwm.fraunhofer.de>
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
---
drivers/infiniband/core/uverbs_cmd.c | 1 +
drivers/infiniband/core/verbs.c | 2 +-
2 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index e26193f..e47dbf1 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1472,6 +1472,7 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file,
qp->event_handler = attr.event_handler;
qp->qp_context = attr.qp_context;
qp->qp_type = attr.qp_type;
+ atomic_set(&qp->usecnt, 0);
atomic_inc(&pd->usecnt);
atomic_inc(&attr.send_cq->usecnt);
if (attr.recv_cq)
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 602b1bd..575b780 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -421,6 +421,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
qp->uobject = NULL;
qp->qp_type = qp_init_attr->qp_type;

+ atomic_set(&qp->usecnt, 0);
if (qp_init_attr->qp_type == IB_QPT_XRC_TGT) {
qp->event_handler = __ib_shared_qp_event_handler;
qp->qp_context = qp;
@@ -430,7 +431,6 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd,
qp->xrcd = qp_init_attr->xrcd;
atomic_inc(&qp_init_attr->xrcd->usecnt);
INIT_LIST_HEAD(&qp->open_list);
- atomic_set(&qp->usecnt, 0);

real_qp = qp;
qp = __ib_open_qp(real_qp, qp_init_attr->event_handler,

N‹§²æìr¸›yúèšØb²X¬¶Ç§vØ^–)Þº{.nÇ+‰·¥Š{±­ÙšŠ{ayº\x1dÊ‡Ú™ë,j\a­¢f£¢·hš‹»öì\x17/oSc¾™Ú³9˜uÀ¦æå‰È&jw¨®\x03(­éšŽŠÝ¢j"ú\x1a¶^[m§ÿïêäz¹Þ–Šàþf£¢·hšˆ§~ˆmš