Re: [PATCH] IB/hfi1: Eliminate races in the SDMA send error path

[Greg KH <greg@kroah.com>]

On Tue, Oct 30, 2018 at 12:17:32PM -0400, Michael J. Ruhl wrote:
> From: Michael J. Ruhl <michael.j.ruhl@intel.com>
> 
> commit a0e0cb82804a6a21d9067022c2dfdf80d11da429 upstream
> 
> pq_update() can only be called in two places: from the completion
> function when the complete (npkts) sequence of packets has been
> submitted and processed, or from setup function if a subset of the
> packets were submitted (i.e. the error path).
> 
> Currently both paths can call pq_update() if an error occurrs.  This
> race will cause the n_req value to go negative, hanging file_close(),
> or cause a crash by freeing the txlist more than once.
> 
> Several variables are used to determine SDMA send state.  Most of
> these are unnecessary, and have code inspectible races between the
> setup function and the completion function, in both the send path and
> the error path.
> 
> The request 'status' value can be set by the setup or by the
> completion function.  This is code inspectibly racy.  Since the status
> is not needed in the completion code or by the caller it has been
> removed.
> 
> The request 'done' value races between usage by the setup and the
> completion function.  The completion function does not need this.
> When the number of processed packets matches npkts, it is done.
> 
> The 'has_error' value races between usage of the setup and the
> completion function.  This can cause incorrect error handling and leave
> the n_req in an incorrect value (i.e. negative).
> 
> Simplify the code by removing all of the unneeded state checks and
> variables.
> 
> Clean up iovs node when it is freed.
> 
> Eliminate race conditions in the error path:
> 
> If all packets are submitted, the completion handler will set the
> completion status correctly (ok or aborted).
> 
> If all packets are not submitted, the caller must wait until the
> submitted packets have completed, and then set the completion status.
> 
> These two change eliminate the race condition in the error path.
> 
> Cc: <stable@vger.kernel.org> # 4.18.x+

Now applied, thanks.

greg k-h