From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Mike Marciniszyn <mike.marciniszyn@intel.com>,
Dennis Dalessandro <dennis.dalessandro@intel.com>,
Kaike Wan <kaike.wan@intel.com>,
Jason Gunthorpe <jgg@mellanox.com>
Subject: [PATCH 5.3 27/48] IB/hfi1: Ensure r_tid_ack is valid before building TID RDMA ACK packet
Date: Tue, 19 Nov 2019 06:19:47 +0100 [thread overview]
Message-ID: <20191119051009.167843775@linuxfoundation.org> (raw)
In-Reply-To: <20191119050946.745015350@linuxfoundation.org>
From: Kaike Wan <kaike.wan@intel.com>
commit c1abd865bd125015783286b353abb8da51644f59 upstream.
The index r_tid_ack is used to indicate the next TID RDMA WRITE request to
acknowledge in the ring s_ack_queue[] on the responder side and should be
set to a valid index other than its initial value before r_tid_tail is
advanced to the next TID RDMA WRITE request and particularly before a TID
RDMA ACK is built. Otherwise, a NULL pointer dereference may result:
BUG: unable to handle kernel paging request at ffff9a32d27abff8
IP: [<ffffffffc0d87ea6>] hfi1_make_tid_rdma_pkt+0x476/0xcb0 [hfi1]
PGD 2749032067 PUD 0
Oops: 0000 1 SMP
Modules linked in: osp(OE) ofd(OE) lfsck(OE) ost(OE) mgc(OE) osd_zfs(OE) lquota(OE) lustre(OE) lmv(OE) mdc(OE) lov(OE) fid(OE) fld(OE) ko2iblnd(OE) ptlrpc(OE) obdclass(OE) lnet(OE) libcfs(OE) ib_ipoib(OE) hfi1(OE) rdmavt(OE) nfsv3 nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache ib_isert iscsi_target_mod target_core_mod ib_ucm dm_mirror dm_region_hash dm_log mlx5_ib dm_mod zfs(POE) rpcrdma sunrpc rdma_ucm ib_uverbs opa_vnic ib_iser zunicode(POE) ib_umad zavl(POE) icp(POE) sb_edac intel_powerclamp coretemp rdma_cm intel_rapl iosf_mbi iw_cm libiscsi scsi_transport_iscsi kvm ib_cm iTCO_wdt mxm_wmi iTCO_vendor_support irqbypass crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd zcommon(POE) znvpair(POE) pcspkr spl(OE) mei_me
sg mei ioatdma lpc_ich joydev i2c_i801 shpchp ipmi_si ipmi_devintf ipmi_msghandler wmi acpi_power_meter ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic mgag200 mlx5_core drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ixgbe ahci ttm mlxfw ib_core libahci devlink mdio crct10dif_pclmul crct10dif_common drm ptp libata megaraid_sas crc32c_intel i2c_algo_bit pps_core i2c_core dca [last unloaded: rdmavt]
CPU: 15 PID: 68691 Comm: kworker/15:2H Kdump: loaded Tainted: P W OE ------------ 3.10.0-862.2.3.el7_lustre.x86_64 #1
Hardware name: Intel Corporation S2600WTT/S2600WTT, BIOS SE5C610.86B.01.01.0016.033120161139 03/31/2016
Workqueue: hfi0_0 _hfi1_do_tid_send [hfi1]
task: ffff9a01f47faf70 ti: ffff9a11776a8000 task.ti: ffff9a11776a8000
RIP: 0010:[<ffffffffc0d87ea6>] [<ffffffffc0d87ea6>] hfi1_make_tid_rdma_pkt+0x476/0xcb0 [hfi1]
RSP: 0018:ffff9a11776abd08 EFLAGS: 00010002
RAX: ffff9a32d27abfc0 RBX: ffff99f2d27aa000 RCX: 00000000ffffffff
RDX: 0000000000000000 RSI: 0000000000000220 RDI: ffff99f2ffc05300
RBP: ffff9a11776abd88 R08: 000000000001c310 R09: ffffffffc0d87ad4
R10: 0000000000000000 R11: 0000000000000000 R12: ffff9a117a423c00
R13: ffff9a117a423c00 R14: ffff9a03500c0000 R15: ffff9a117a423cb8
FS: 0000000000000000(0000) GS:ffff9a117e9c0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff9a32d27abff8 CR3: 0000002748a0e000 CR4: 00000000001607e0
Call Trace:
[<ffffffffc0d88874>] _hfi1_do_tid_send+0x194/0x320 [hfi1]
[<ffffffffaf0b2dff>] process_one_work+0x17f/0x440
[<ffffffffaf0b3ac6>] worker_thread+0x126/0x3c0
[<ffffffffaf0b39a0>] ? manage_workers.isra.24+0x2a0/0x2a0
[<ffffffffaf0bae31>] kthread+0xd1/0xe0
[<ffffffffaf0bad60>] ? insert_kthread_work+0x40/0x40
[<ffffffffaf71f5f7>] ret_from_fork_nospec_begin+0x21/0x21
[<ffffffffaf0bad60>] ? insert_kthread_work+0x40/0x40
hfi1 0000:05:00.0: hfi1_0: reserved_op: opcode 0xf2, slot 2, rsv_used 1, rsv_ops 1
Code: 00 00 41 8b 8d d8 02 00 00 89 c8 48 89 45 b0 48 c1 65 b0 06 48 8b 83 a0 01 00 00 48 01 45 b0 48 8b 45 b0 41 80 bd 10 03 00 00 00 <48> 8b 50 38 4c 8d 7a 50 74 45 8b b2 d0 00 00 00 85 f6 0f 85 72
RIP [<ffffffffc0d87ea6>] hfi1_make_tid_rdma_pkt+0x476/0xcb0 [hfi1]
RSP <ffff9a11776abd08>
CR2: ffff9a32d27abff8
This problem can happen if a RESYNC request is received before r_tid_ack
is modified.
This patch fixes the issue by making sure that r_tid_ack is set to a valid
value before a TID RDMA ACK is built. Functions are defined to simplify
the code.
Fixes: 07b923701e38 ("IB/hfi1: Add functions to receive TID RDMA WRITE request")
Fixes: 7cf0ad679de4 ("IB/hfi1: Add a function to receive TID RDMA RESYNC packet")
Link: https://lore.kernel.org/r/20191025195830.106825.44022.stgit@awfm-01.aw.intel.com
Cc: <stable@vger.kernel.org>
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Kaike Wan <kaike.wan@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/hfi1/tid_rdma.c | 44 ++++++++++++++++++++--------------
1 file changed, 27 insertions(+), 17 deletions(-)
--- a/drivers/infiniband/hw/hfi1/tid_rdma.c
+++ b/drivers/infiniband/hw/hfi1/tid_rdma.c
@@ -136,6 +136,26 @@ static void update_r_next_psn_fecn(struc
struct tid_rdma_flow *flow,
bool fecn);
+static void validate_r_tid_ack(struct hfi1_qp_priv *priv)
+{
+ if (priv->r_tid_ack == HFI1_QP_WQE_INVALID)
+ priv->r_tid_ack = priv->r_tid_tail;
+}
+
+static void tid_rdma_schedule_ack(struct rvt_qp *qp)
+{
+ struct hfi1_qp_priv *priv = qp->priv;
+
+ priv->s_flags |= RVT_S_ACK_PENDING;
+ hfi1_schedule_tid_send(qp);
+}
+
+static void tid_rdma_trigger_ack(struct rvt_qp *qp)
+{
+ validate_r_tid_ack(qp->priv);
+ tid_rdma_schedule_ack(qp);
+}
+
static u64 tid_rdma_opfn_encode(struct tid_rdma_params *p)
{
return
@@ -2997,10 +3017,7 @@ nak_psn:
qpriv->s_nak_state = IB_NAK_PSN_ERROR;
/* We are NAK'ing the next expected PSN */
qpriv->s_nak_psn = mask_psn(flow->flow_state.r_next_psn);
- qpriv->s_flags |= RVT_S_ACK_PENDING;
- if (qpriv->r_tid_ack == HFI1_QP_WQE_INVALID)
- qpriv->r_tid_ack = qpriv->r_tid_tail;
- hfi1_schedule_tid_send(qp);
+ tid_rdma_trigger_ack(qp);
}
goto unlock;
}
@@ -3518,7 +3535,7 @@ static void hfi1_tid_write_alloc_resourc
/*
* If overtaking req->acked_tail, send an RNR NAK. Because the
* QP is not queued in this case, and the issue can only be
- * caused due a delay in scheduling the second leg which we
+ * caused by a delay in scheduling the second leg which we
* cannot estimate, we use a rather arbitrary RNR timeout of
* (MAX_FLOWS / 2) segments
*/
@@ -3526,8 +3543,7 @@ static void hfi1_tid_write_alloc_resourc
MAX_FLOWS)) {
ret = -EAGAIN;
to_seg = MAX_FLOWS >> 1;
- qpriv->s_flags |= RVT_S_ACK_PENDING;
- hfi1_schedule_tid_send(qp);
+ tid_rdma_trigger_ack(qp);
break;
}
@@ -4327,8 +4343,7 @@ void hfi1_rc_rcv_tid_rdma_write_data(str
trace_hfi1_tid_req_rcv_write_data(qp, 0, e->opcode, e->psn, e->lpsn,
req);
trace_hfi1_tid_write_rsp_rcv_data(qp);
- if (priv->r_tid_ack == HFI1_QP_WQE_INVALID)
- priv->r_tid_ack = priv->r_tid_tail;
+ validate_r_tid_ack(priv);
if (opcode == TID_OP(WRITE_DATA_LAST)) {
release_rdma_sge_mr(e);
@@ -4367,8 +4382,7 @@ void hfi1_rc_rcv_tid_rdma_write_data(str
}
done:
- priv->s_flags |= RVT_S_ACK_PENDING;
- hfi1_schedule_tid_send(qp);
+ tid_rdma_schedule_ack(qp);
exit:
priv->r_next_psn_kdeth = flow->flow_state.r_next_psn;
if (fecn)
@@ -4380,10 +4394,7 @@ send_nak:
if (!priv->s_nak_state) {
priv->s_nak_state = IB_NAK_PSN_ERROR;
priv->s_nak_psn = flow->flow_state.r_next_psn;
- priv->s_flags |= RVT_S_ACK_PENDING;
- if (priv->r_tid_ack == HFI1_QP_WQE_INVALID)
- priv->r_tid_ack = priv->r_tid_tail;
- hfi1_schedule_tid_send(qp);
+ tid_rdma_trigger_ack(qp);
}
goto done;
}
@@ -4931,8 +4942,7 @@ void hfi1_rc_rcv_tid_rdma_resync(struct
qpriv->resync = true;
/* RESYNC request always gets a TID RDMA ACK. */
qpriv->s_nak_state = 0;
- qpriv->s_flags |= RVT_S_ACK_PENDING;
- hfi1_schedule_tid_send(qp);
+ tid_rdma_trigger_ack(qp);
bail:
if (fecn)
qp->s_flags |= RVT_S_ECN;
next prev parent reply other threads:[~2019-11-19 6:12 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-19 5:19 [PATCH 5.3 00/48] 5.3.12-stable review Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 01/48] scsi: core: Handle drivers which set sg_tablesize to zero Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 02/48] ax88172a: fix information leak on short answers Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 03/48] devlink: disallow reload operation during device cleanup Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 04/48] ipmr: Fix skb headroom in ipmr_get_route() Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 05/48] mlxsw: core: Enable devlink reload only on probe Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 06/48] net: gemini: add missed free_netdev Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 07/48] net/smc: fix fastopen for non-blocking connect() Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 08/48] net: usb: qmi_wwan: add support for Foxconn T77W968 LTE modules Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 09/48] slip: Fix memory leak in slip_open error path Greg Kroah-Hartman
2019-11-19 7:43 ` Oliver Hartkopp
2019-11-19 7:55 ` Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 10/48] tcp: remove redundant new line from tcp_event_sk_skb Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 11/48] dpaa2-eth: free already allocated channels on probe defer Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 12/48] devlink: Add method for time-stamp on reporters dump Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 13/48] net/smc: fix refcount non-blocking connect() -part 2 Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 14/48] ALSA: usb-audio: Fix missing error check at mixer resolution test Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 15/48] ALSA: usb-audio: not submit urb for stopped endpoint Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 16/48] ALSA: usb-audio: Fix incorrect NULL check in create_yamaha_midi_quirk() Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 17/48] ALSA: usb-audio: Fix incorrect size check for processing/extension units Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 18/48] Btrfs: fix log context list corruption after rename exchange operation Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 19/48] cgroup: freezer: call cgroup_enter_frozen() with preemption disabled in ptrace_stop() Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 20/48] Input: ff-memless - kill timer in destroy() Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 21/48] Input: synaptics-rmi4 - fix video buffer size Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 22/48] Input: synaptics-rmi4 - disable the relative position IRQ in the F12 driver Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 23/48] Input: synaptics-rmi4 - do not consume more data than we have (F11, F12) Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 24/48] Input: synaptics-rmi4 - clear IRQ enables for F54 Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 25/48] Input: synaptics-rmi4 - destroy F54 poller workqueue when removing Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 26/48] KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved Greg Kroah-Hartman
2019-11-19 5:19 ` Greg Kroah-Hartman [this message]
2019-11-19 5:19 ` [PATCH 5.3 28/48] IB/hfi1: Calculate flow weight based on QP MTU for TID RDMA Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 29/48] IB/hfi1: TID RDMA WRITE should not return IB_WC_RNR_RETRY_EXC_ERR Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 30/48] IB/hfi1: Ensure full Gen3 speed in a Gen4 system Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 31/48] IB/hfi1: Use a common pad buffer for 9B and 16B packets Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 32/48] i2c: acpi: Force bus speed to 400KHz if a Silead touchscreen is present Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 33/48] x86/quirks: Disable HPET on Intel Coffe Lake platforms Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 34/48] ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 35/48] ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 36/48] io_uring: ensure registered buffer import returns the IO length Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 37/48] drm/i915: update rawclk also on resume Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 38/48] Revert "drm/i915/ehl: Update MOCS table for EHL" Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 39/48] ntp/y2038: Remove incorrect time_t truncation Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 40/48] net: ethernet: dwmac-sun8i: Use the correct function in exit path Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 41/48] iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 42/48] mm: mempolicy: fix the wrong return value and potential pages leak of mbind Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 43/48] mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 44/48] mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup() Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 45/48] mm: slub: really fix slab walking for init_on_free Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 46/48] mm/memory_hotplug: fix try_offline_node() Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 47/48] mm/page_io.c: do not free shared swap slots Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 48/48] mmc: sdhci-of-at91: fix quirk2 overwrite Greg Kroah-Hartman
2019-11-19 10:16 ` [PATCH 5.3 00/48] 5.3.12-stable review Jon Hunter
2019-11-19 12:32 ` Greg Kroah-Hartman
2019-11-19 11:42 ` kernelci.org bot
2019-11-19 12:35 ` Holger Hoffstätte
2019-11-19 12:45 ` Greg Kroah-Hartman
2019-11-19 13:05 ` Holger Hoffstätte
2019-11-19 13:17 ` Naresh Kamboju
2019-11-19 18:45 ` Dan Rue
2019-11-20 6:00 ` Greg Kroah-Hartman
2019-11-19 20:34 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191119051009.167843775@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dennis.dalessandro@intel.com \
--cc=jgg@mellanox.com \
--cc=kaike.wan@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mike.marciniszyn@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).