1. 20 3月, 2018 7 次提交
  2. 17 3月, 2018 1 次提交
    • L
      RDMA/restrack: Don't rely on uninitialized variable in restrack_add flow · 7d9a935e
      Leon Romanovsky 提交于
      The restrack code relies on the fact that object structures are zeroed at
      the allocation stage, the mlx4 CQ wasn't allocated with kzalloc and it
      caused to the following crash.
      
      [  137.392209] general protection fault: 0000 [#1] SMP KASAN PTI
      [  137.392972] CPU: 0 PID: 622 Comm: ibv_rc_pingpong Tainted: G        W        4.16.0-rc1-00099-g00313983 #11
      [  137.395079] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014
      [  137.396866] RIP: 0010:rdma_restrack_del+0xc8/0xf0
      [  137.397762] RSP: 0018:ffff8801b54e7968 EFLAGS: 00010206
      [  137.399008] RAX: 0000000000000000 RBX: ffff8801d8bcbae8 RCX: ffffffffb82314df
      [  137.400055] RDX: dffffc0000000000 RSI: dffffc0000000000 RDI: 70696b533d454741
      [  137.401103] RBP: ffff8801d90c07a0 R08: ffff8801d8bcbb00 R09: 0000000000000000
      [  137.402470] R10: 0000000000000001 R11: ffffed0036a9cf52 R12: ffff8801d90c0ad0
      [  137.403318] R13: ffff8801d853fb20 R14: ffff8801d8bcbb28 R15: 0000000000000014
      [  137.404736] FS:  00007fb415d43740(0000) GS:ffff8801e5c00000(0000) knlGS:0000000000000000
      [  137.406074] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [  137.407101] CR2: 00007fb41557df20 CR3: 00000001b580c001 CR4: 00000000003606b0
      [  137.408308] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      [  137.409352] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      [  137.410385] Call Trace:
      [  137.411058]  ib_destroy_cq+0x23/0x60
      [  137.411460]  uverbs_free_cq+0x37/0xa0
      [  137.412040]  remove_commit_idr_uobject+0x38/0xf0
      [  137.413042]  _rdma_remove_commit_uobject+0x5c/0x160
      [  137.413782]  ? lookup_get_idr_uobject+0x39/0x50
      [  137.414737]  rdma_remove_commit_uobject+0x3b/0x70
      [  137.415742]  ib_uverbs_destroy_cq+0x114/0x1d0
      [  137.416260]  ? ib_uverbs_req_notify_cq+0x160/0x160
      [  137.417073]  ? kernel_text_address+0x5c/0x90
      [  137.417805]  ? __kernel_text_address+0xe/0x30
      [  137.418766]  ? unwind_get_return_address+0x2f/0x50
      [  137.419558]  ib_uverbs_write+0x453/0x6a0
      [  137.420220]  ? show_ibdev+0x90/0x90
      [  137.420653]  ? __kasan_slab_free+0x136/0x180
      [  137.421155]  ? kmem_cache_free+0x78/0x1e0
      [  137.422192]  ? remove_vma+0x83/0x90
      [  137.422614]  ? do_munmap+0x447/0x6c0
      [  137.423045]  ? vm_munmap+0xb0/0x100
      [  137.423481]  ? SyS_munmap+0x1d/0x30
      [  137.424120]  ? do_syscall_64+0xeb/0x250
      [  137.424984]  ? entry_SYSCALL_64_after_hwframe+0x21/0x86
      [  137.425611]  ? lru_add_drain_all+0x270/0x270
      [  137.426116]  ? lru_add_drain_cpu+0xa3/0x170
      [  137.426616]  ? lru_add_drain+0x11/0x20
      [  137.427058]  ? free_pages_and_swap_cache+0xa6/0x120
      [  137.427672]  ? tlb_flush_mmu_free+0x78/0x90
      [  137.428168]  ? arch_tlb_finish_mmu+0x6d/0xb0
      [  137.428680]  __vfs_write+0xc4/0x350
      [  137.430917]  ? kernel_read+0xa0/0xa0
      [  137.432758]  ? remove_vma+0x90/0x90
      [  137.434781]  ? __kasan_slab_free+0x14b/0x180
      [  137.437486]  ? remove_vma+0x83/0x90
      [  137.439836]  ? kmem_cache_free+0x78/0x1e0
      [  137.442195]  ? percpu_counter_add_batch+0x1d/0x90
      [  137.444389]  vfs_write+0xf7/0x280
      [  137.446030]  SyS_write+0xa1/0x120
      [  137.447867]  ? SyS_read+0x120/0x120
      [  137.449670]  ? mm_fault_error+0x180/0x180
      [  137.451539]  ? _cond_resched+0x16/0x50
      [  137.453697]  ? SyS_read+0x120/0x120
      [  137.455883]  do_syscall_64+0xeb/0x250
      [  137.457686]  entry_SYSCALL_64_after_hwframe+0x21/0x86
      [  137.459595] RIP: 0033:0x7fb415637b94
      [  137.461315] RSP: 002b:00007ffdebea7d88 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      [  137.463879] RAX: ffffffffffffffda RBX: 00005565022d1bd0 RCX: 00007fb415637b94
      [  137.466519] RDX: 0000000000000018 RSI: 00007ffdebea7da0 RDI: 0000000000000003
      [  137.469543] RBP: 00007ffdebea7d98 R08: 0000000000000000 R09: 00005565022d40c0
      [  137.472479] R10: 00000000000009cf R11: 0000000000000246 R12: 00005565022d2520
      [  137.475125] R13: 00000000000003e8 R14: 0000000000000000 R15: 00007ffdebea7fd0
      [  137.477760] Code: f7 e8 dd 0d 0b ff 48 c7 43 40 00 00 00 00 48 89 df e8 0d 0b 0b ff 48 8d 7b 28 c6 03 00 e8 41 0d 0b ff 48 8b 7b 28 48 85 ff 74 06 <f0> ff 4f 48 74 10 5b 48 89 ef 5d 41 5c 41 5d 41 5e e9 32 b0 ee
      [  137.483375] RIP: rdma_restrack_del+0xc8/0xf0 RSP: ffff8801b54e7968
      [  137.486436] ---[ end trace 81835a1ea6722eed ]---
      [  137.488566] Kernel panic - not syncing: Fatal exception
      [  137.491162] Kernel Offset: 0x36000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
      
      Fixes: 00313983 ("RDMA/nldev: provide detailed CM_ID information")
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Reviewed-by: NSteve Wise <swise@opengridcomputing.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      7d9a935e
  3. 16 3月, 2018 24 次提交
  4. 15 3月, 2018 8 次提交
    • L
      RDMA/mlx5: Simplify clean and destroy MR calls · eeea6953
      Leon Romanovsky 提交于
      The failure to destroy the MRs is printed on mlx5_core layer
      as error and it makes warning prints useless.
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      eeea6953
    • L
      RDMA/mlx5: Guard ODP specific assignments with specific CONFIG · c985bd0e
      Leon Romanovsky 提交于
      "live" is needed for ODP only and is better to be guarded
      by appropriate CONFIG.
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      c985bd0e
    • L
      RDMA/mlx5: Unify error flows in rereg MR failure paths · 4638a3b2
      Leon Romanovsky 提交于
      According to the IBTA spec 1.3, the driver failure in
      MR reregister shall release old and new MRs.
      
       C11-20: If the CI returns any other error, the CI shall
       invalidate both "old" and "new" registrations, and release
       any associated resources.
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      4638a3b2
    • L
      RDMA/mlx5: Return proper value for not-supported command · ea30f013
      Leon Romanovsky 提交于
      Return -EOPNOTSUPP value to the user for unsupported reg_user_mr.
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      ea30f013
    • L
      RDMA/mlx5: Protect from NULL pointer derefence · 4289861d
      Leon Romanovsky 提交于
      The mlx5_ib_alloc_implicit_mr() can fail to acquire pages
      and the returned mr pointer won't be valid. Ensure that it
      is not error prior to access.
      
      Cc: <stable@vger.kernel.org> # 4.10
      Fixes: 81713d37 ("IB/mlx5: Add implicit MR support")
      Reported-by: NNoa Osherovich <noaos@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      4289861d
    • D
      Merge branch 'k.o/wip/dl-for-rc' into k.o/wip/dl-for-next · 2d873449
      Doug Ledford 提交于
      Due to bug fixes found by the syzkaller bot and taken into the for-rc
      branch after development for the 4.17 merge window had already started
      being taken into the for-next branch, there were fairly non-trivial
      merge issues that would need to be resolved between the for-rc branch
      and the for-next branch.  This merge resolves those conflicts and
      provides a unified base upon which ongoing development for 4.17 can
      be based.
      
      Conflicts:
      	drivers/infiniband/hw/mlx5/main.c - Commit 42cea83f
      	(IB/mlx5: Fix cleanup order on unload) added to for-rc and
      	commit b5ca15ad (IB/mlx5: Add proper representors support)
      	add as part of the devel cycle both needed to modify the
      	init/de-init functions used by mlx5.  To support the new
      	representors, the new functions added by the cleanup patch
      	needed to be made non-static, and the init/de-init list
      	added by the representors patch needed to be modified to
      	match the init/de-init list changes made by the cleanup
      	patch.
      Updates:
      	drivers/infiniband/hw/mlx5/mlx5_ib.h - Update function
      	prototypes added by representors patch to reflect new function
      	names as changed by cleanup patch
      	drivers/infiniband/hw/mlx5/ib_rep.c - Update init/de-init
      	stage list to match new order from cleanup patch
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      2d873449
    • A
      infiniband: bnxt_re: use BIT_ULL() for 64-bit bit masks · bd8602ca
      Arnd Bergmann 提交于
      On 32-bit targets, we otherwise get a warning about an impossible constant
      integer expression:
      
      In file included from include/linux/kernel.h:11,
                       from include/linux/interrupt.h:6,
                       from drivers/infiniband/hw/bnxt_re/ib_verbs.c:39:
      drivers/infiniband/hw/bnxt_re/ib_verbs.c: In function 'bnxt_re_query_device':
      include/linux/bitops.h:7:24: error: left shift count >= width of type [-Werror=shift-count-overflow]
       #define BIT(nr)   (1UL << (nr))
                              ^~
      drivers/infiniband/hw/bnxt_re/bnxt_re.h:61:34: note: in expansion of macro 'BIT'
       #define BNXT_RE_MAX_MR_SIZE_HIGH BIT(39)
                                        ^~~
      drivers/infiniband/hw/bnxt_re/bnxt_re.h:62:30: note: in expansion of macro 'BNXT_RE_MAX_MR_SIZE_HIGH'
       #define BNXT_RE_MAX_MR_SIZE  BNXT_RE_MAX_MR_SIZE_HIGH
                                    ^~~~~~~~~~~~~~~~~~~~~~~~
      drivers/infiniband/hw/bnxt_re/ib_verbs.c:149:25: note: in expansion of macro 'BNXT_RE_MAX_MR_SIZE'
        ib_attr->max_mr_size = BNXT_RE_MAX_MR_SIZE;
                               ^~~~~~~~~~~~~~~~~~~
      
      Fixes: 872f3578 ("RDMA/bnxt_re: Add support for MRs with Huge pages")
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      bd8602ca
    • A
      infiniband: qplib_fp: fix pointer cast · 5388a508
      Arnd Bergmann 提交于
      Building for a 32-bit target results in a couple of warnings from casting
      between a 32-bit pointer and a 64-bit integer:
      
      drivers/infiniband/hw/bnxt_re/qplib_fp.c: In function 'bnxt_qplib_service_nq':
      drivers/infiniband/hw/bnxt_re/qplib_fp.c:333:23: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
          bnxt_qplib_arm_srq((struct bnxt_qplib_srq *)q_handle,
                             ^
      drivers/infiniband/hw/bnxt_re/qplib_fp.c:336:12: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
                  (struct bnxt_qplib_srq *)q_handle,
                  ^
      In file included from include/linux/byteorder/little_endian.h:5,
                       from arch/arm/include/uapi/asm/byteorder.h:22,
                       from include/asm-generic/bitops/le.h:6,
                       from arch/arm/include/asm/bitops.h:342,
                       from include/linux/bitops.h:38,
                       from include/linux/kernel.h:11,
                       from include/linux/interrupt.h:6,
                       from drivers/infiniband/hw/bnxt_re/qplib_fp.c:39:
      drivers/infiniband/hw/bnxt_re/qplib_fp.c: In function 'bnxt_qplib_create_srq':
      include/uapi/linux/byteorder/little_endian.h:31:43: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]
       #define __cpu_to_le64(x) ((__force __le64)(__u64)(x))
                                                 ^
      include/linux/byteorder/generic.h:86:21: note: in expansion of macro '__cpu_to_le64'
       #define cpu_to_le64 __cpu_to_le64
                           ^~~~~~~~~~~~~
      drivers/infiniband/hw/bnxt_re/qplib_fp.c:569:19: note: in expansion of macro 'cpu_to_le64'
        req.srq_handle = cpu_to_le64(srq);
      
      Using a uintptr_t as an intermediate works on all architectures.
      
      Fixes: 37cb11ac ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters")
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      5388a508