From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1D7A9C18E5A for ; Tue, 10 Mar 2020 13:15:21 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E67A02469D for ; Tue, 10 Mar 2020 13:15:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1583846121; bh=11lTqkhPdykb/T5b6KrUOa+oT9IU1Yv8PZKOza1sqoc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Z2jH++Zvy8yLVf2UYOayrpxyEWzkqQs6jxT+SJzbvKa7CJdPrm2jcdzHZ1LNx7Hd7 nDR4/K57utYUC//RWtUY/qkx7hkhlv9Vj/1OLmduJyxvtovX6rQtrDjDBQxO4SLZEc WXOdkW7vMnX8q6h8ODWzr0dNlO9YC7EqCtFcu52w= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732020AbgCJNPT (ORCPT ); Tue, 10 Mar 2020 09:15:19 -0400 Received: from mail.kernel.org ([198.145.29.99]:39890 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732019AbgCJNPR (ORCPT ); Tue, 10 Mar 2020 09:15:17 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A2194208E4; Tue, 10 Mar 2020 13:15:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1583846117; bh=11lTqkhPdykb/T5b6KrUOa+oT9IU1Yv8PZKOza1sqoc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vpxf/lb7Q5PG1SylzQBuWfkQbvgRoEWeSmw8ejne2TQjNH+uCWWYUj2ks23FzvXKZ fhI6pz/9vbO0zAhTsso7hfAdhQlAoNM4+GNrtjuZ30NY4nVCemlwX7h+gqpD5DCI1y Ieus3o7ULJAXIA0SLS0Civx+Vymcd96Il0kwzCMo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mike Marciniszyn , Dennis Dalessandro , Jason Gunthorpe Subject: [PATCH 4.19 75/86] IB/hfi1, qib: Ensure RCU is locked when accessing list Date: Tue, 10 Mar 2020 13:45:39 +0100 Message-Id: <20200310124534.815634089@linuxfoundation.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200310124530.808338541@linuxfoundation.org> References: <20200310124530.808338541@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dennis Dalessandro commit 817a68a6584aa08e323c64283fec5ded7be84759 upstream. The packet handling function, specifically the iteration of the qp list for mad packet processing misses locking RCU before running through the list. Not only is this incorrect, but the list_for_each_entry_rcu() call can not be called with a conditional check for lock dependency. Remedy this by invoking the rcu lock and unlock around the critical section. This brings MAD packet processing in line with what is done for non-MAD packets. Fixes: 7724105686e7 ("IB/hfi1: add driver files") Link: https://lore.kernel.org/r/20200225195445.140896.41873.stgit@awfm-01.aw.intel.com Reviewed-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/hw/hfi1/verbs.c | 4 +++- drivers/infiniband/hw/qib/qib_verbs.c | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) --- a/drivers/infiniband/hw/hfi1/verbs.c +++ b/drivers/infiniband/hw/hfi1/verbs.c @@ -595,10 +595,11 @@ static inline void hfi1_handle_packet(st opa_get_lid(packet->dlid, 9B)); if (!mcast) goto drop; + rcu_read_lock(); list_for_each_entry_rcu(p, &mcast->qp_list, list) { packet->qp = p->qp; if (hfi1_do_pkey_check(packet)) - goto drop; + goto unlock_drop; spin_lock_irqsave(&packet->qp->r_lock, flags); packet_handler = qp_ok(packet); if (likely(packet_handler)) @@ -607,6 +608,7 @@ static inline void hfi1_handle_packet(st ibp->rvp.n_pkt_drops++; spin_unlock_irqrestore(&packet->qp->r_lock, flags); } + rcu_read_unlock(); /* * Notify rvt_multicast_detach() if it is waiting for us * to finish. --- a/drivers/infiniband/hw/qib/qib_verbs.c +++ b/drivers/infiniband/hw/qib/qib_verbs.c @@ -360,8 +360,10 @@ void qib_ib_rcv(struct qib_ctxtdata *rcd if (mcast == NULL) goto drop; this_cpu_inc(ibp->pmastats->n_multicast_rcv); + rcu_read_lock(); list_for_each_entry_rcu(p, &mcast->qp_list, list) qib_qp_rcv(rcd, hdr, 1, data, tlen, p->qp); + rcu_read_unlock(); /* * Notify rvt_multicast_detach() if it is waiting for us * to finish.