1. 04 4月, 2018 3 次提交
  2. 20 3月, 2018 1 次提交
  3. 16 3月, 2018 2 次提交
  4. 07 3月, 2018 1 次提交
    • B
      RDMA/rxe: Fix an out-of-bounds read · a6544a62
      Bart Van Assche 提交于
      This patch avoids that KASAN reports the following when the SRP initiator
      calls srp_post_send():
      
      ==================================================================
      BUG: KASAN: stack-out-of-bounds in rxe_post_send+0x5c4/0x980 [rdma_rxe]
      Read of size 8 at addr ffff880066606e30 by task 02-mq/1074
      
      CPU: 2 PID: 1074 Comm: 02-mq Not tainted 4.16.0-rc3-dbg+ #1
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
      Call Trace:
      dump_stack+0x85/0xc7
      print_address_description+0x65/0x270
      kasan_report+0x231/0x350
      rxe_post_send+0x5c4/0x980 [rdma_rxe]
      srp_post_send.isra.16+0x149/0x190 [ib_srp]
      srp_queuecommand+0x94d/0x1670 [ib_srp]
      scsi_dispatch_cmd+0x1c2/0x550 [scsi_mod]
      scsi_queue_rq+0x843/0xa70 [scsi_mod]
      blk_mq_dispatch_rq_list+0x143/0xac0
      blk_mq_do_dispatch_ctx+0x1c5/0x260
      blk_mq_sched_dispatch_requests+0x2bf/0x2f0
      __blk_mq_run_hw_queue+0xdb/0x160
      __blk_mq_delay_run_hw_queue+0xba/0x100
      blk_mq_run_hw_queue+0xf2/0x190
      blk_mq_sched_insert_request+0x163/0x2f0
      blk_execute_rq+0xb0/0x130
      scsi_execute+0x14e/0x260 [scsi_mod]
      scsi_probe_and_add_lun+0x366/0x13d0 [scsi_mod]
      __scsi_scan_target+0x18a/0x810 [scsi_mod]
      scsi_scan_target+0x11e/0x130 [scsi_mod]
      srp_create_target+0x1522/0x19e0 [ib_srp]
      kernfs_fop_write+0x180/0x210
      __vfs_write+0xb1/0x2e0
      vfs_write+0xf6/0x250
      SyS_write+0x99/0x110
      do_syscall_64+0xee/0x2b0
      entry_SYSCALL_64_after_hwframe+0x42/0xb7
      
      The buggy address belongs to the page:
      page:ffffea0001998180 count:0 mapcount:0 mapping:0000000000000000 index:0x0
      flags: 0x4000000000000000()
      raw: 4000000000000000 0000000000000000 0000000000000000 00000000ffffffff
      raw: dead000000000100 dead000000000200 0000000000000000 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
      ffff880066606d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1
      ffff880066606d80: f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 f2 f2 f2 f2 f2
      >ffff880066606e00: f2 00 00 00 00 00 f2 f2 f2 f3 f3 f3 f3 00 00 00
                                          ^
      ffff880066606e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      ffff880066606f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      ==================================================================
      
      Fixes: 8700e3e7 ("Soft RoCE driver")
      Signed-off-by: NBart Van Assche <bart.vanassche@wdc.com>
      Cc: Moni Shoua <monis@mellanox.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      a6544a62
  5. 01 2月, 2018 5 次提交
  6. 11 1月, 2018 1 次提交
    • B
      RDMA/rxe: Fix a race condition related to the QP error state · 6f301e06
      Bart Van Assche 提交于
      The following sequence:
      * Change queue pair state into IB_QPS_ERR.
      * Post a work request on the queue pair.
      
      Triggers the following race condition in the rdma_rxe driver:
      * rxe_qp_error() triggers an asynchronous call of rxe_completer(), the function
        that examines the QP send queue.
      * rxe_post_send() posts a work request on the QP send queue.
      
      If rxe_completer() runs prior to rxe_post_send(), it will drain the send
      queue and the driver will assume no further action is necessary.
      However, once we post the send to the send queue, because the queue is
      in error, no send completion will ever happen and the send will get
      stuck.  In order to process the send, we need to make sure that
      rxe_completer() gets run after a send is posted to a queue pair in an
      error state.  This patch ensures that happens.
      Signed-off-by: NBart Van Assche <bart.vanassche@wdc.com>
      Cc: Moni Shoua <monis@mellanox.com>
      Cc: <stable@vger.kernel.org> # v4.8
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      6f301e06
  7. 11 11月, 2017 1 次提交
  8. 15 10月, 2017 1 次提交
  9. 29 8月, 2017 1 次提交
    • A
      IB/rxe: Disable completion upcalls when a CQ is destroyed · bfc3ae05
      Andrew Boyer 提交于
      This prevents the stack from accessing userspace objects while they
      are being torn down.
      
      One possible sequence of events:
       - Userspace program exits
       - ib_uverbs_cleanup_ucontext() runs, calling ib_destroy_qp(),
         ib_destroy_cq(), etc. and releasing/freeing the UCQ
         - The QP still has tasklets running, so it isn't destroyed yet
         - The CQ is referenced by the QP, so the CQ isn't destroyed yet
         - The UCQ is kfree()'d anyway
       - A send work request completes
       - rxe_send_complete() calls cq->ibcq.comp_handler()
       - ib_uverbs_comp_handler() runs and crashes; the event queue is checked
         for is_closed, but it has no way to check the ib_ucq_object before
         accessing it
      
      The reference counting on the CQ doesn't protect against this since the CQ
      hasn't been destroyed yet.
      There's no available interface to deregister the UCQ from the CQ, and it
      didn't appear that attempting to add reference counting to the UCQ was
      going to be a good way to go since this solution is much simpler.
      
      Fixes: 8700e3e7 ("Soft RoCE driver")
      Signed-off-by: NAndrew Boyer <andrew.boyer@dell.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      bfc3ae05
  10. 24 7月, 2017 3 次提交
  11. 20 7月, 2017 1 次提交
  12. 18 7月, 2017 1 次提交
    • Y
      IB/rxe: Set dma_mask and coherent_dma_mask · 56012e1c
      yonatanc 提交于
      The RXE coupled with dummy device causes to the kernel panic attached
      below.  The panic happens when ib_register_device tries to set dma_mask
      by accessing a NULLed parent device.
      
      The RXE does not actually use DMA, so we can set the dma_mask
      to architecture value.
      
      [16240.199689] RIP: 0010:ib_register_device+0x468/0x5a0 [ib_core]
      [16240.205289] RSP: 0018:ffffc9000220fc10 EFLAGS: 00010246
      [16240.209909] RAX: 0000000000000024 RBX: ffff880220d1a2a8 RCX: 0000000000000000
      [16240.212244] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009
      [16240.214385] RBP: ffffc9000220fcb0 R08: 0000000000000000 R09: 000000000000023f
      [16240.254465] R10: 0000000000000007 R11: 0000000000000000 R12: 0000000000000000
      [16240.259467] R13: 0000000000000000 R14: 0000000000000000 R15: ffff880220d1a2a8
      [16240.263314] FS:  00007fd8ecca0740(0000) GS:ffff8802364c0000(0000) knlGS:0000000000000000
      [16240.267292] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [16240.273503] CR2: 0000000000000218 CR3: 00000002253ba000 CR4: 00000000000006e0
      [16240.277066] Call Trace:
      [16240.281836]  ? __kmalloc+0x26f/0x280
      [16240.286596]  rxe_register_device+0x297/0x300 [rdma_rxe]
      [16240.291377]  rxe_add+0x535/0x5b0 [rdma_rxe]
      [16240.297586]  rxe_net_add+0x3e/0xc0 [rdma_rxe]
      [16240.302375]  rxe_param_set_add+0x65/0x144 [rdma_rxe]
      [16240.307769]  param_attr_store+0x68/0xd0
      [16240.311640]  module_attr_store+0x1d/0x30
      [16240.316421]  sysfs_kf_write+0x3a/0x50
      [16240.317802]  kernfs_fop_write+0xff/0x180
      [16240.322989]  __vfs_write+0x37/0x140
      [16240.328164]  ? handle_mm_fault+0xce/0x240
      [16240.333340]  vfs_write+0xb2/0x1b0
      [16240.335013]  SyS_write+0x55/0xc0
      [16240.340632]  entry_SYSCALL_64_fastpath+0x1a/0xa9
      
      Fixes: 8700e3e7 ("Soft RoCE driver")
      Signed-off-by: NYonatan Cohen <yonatanc@mellanox.com>
      Reviewed-by: NMoni Shoua <monis@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leon@kernel.org>
      Reviewed-by: NJohannes Thumshirn <jthumshirn@suse.de>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      56012e1c
  13. 15 6月, 2017 1 次提交
  14. 05 5月, 2017 1 次提交
  15. 02 5月, 2017 4 次提交
  16. 29 4月, 2017 1 次提交
  17. 26 4月, 2017 1 次提交
  18. 21 4月, 2017 2 次提交
    • Y
      IB/rxe: Offload CRC calculation when possible · cee2688e
      yonatanc 提交于
      Use CPU ability to perform CRC calculations, by
      replacing direct calls to crc32_le() with crypto_shash_updata().
      
      The overall performance gain measured with ib_send_bw tool is 10% and it
      was tested on "Intel CPU ES-2660 v2 @ 2.20Ghz" CPU.
      
      ib_send_bw -d rxe0  -x 1 -n 9000 -e  -s $((1024 * 1024 )) -l 100
      
      ---------------------------------------------------------------------------------------------
      |             | bytes   | iterations | BW peak[MB/sec] | BW average[MB/sec] | MsgRate[Mpps] |
      ---------------------------------------------------------------------------------------------
      | crc32_le    | 1048576 | 9000       | inf             | 497.60             | 0.000498      |
      | CRC offload | 1048576 | 9000       | inf             | 546.70             | 0.000547      |
      ---------------------------------------------------------------------------------------------
      
      Fixes: 8700e3e7 ("Soft RoCE driver")
      Signed-off-by: NYonatan Cohen <yonatanc@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leon@kernel.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      cee2688e
    • Y
      IB/rxe: Add port protocol stats · 0b1e5b99
      Yonatan Cohen 提交于
      Expose new counters using the get_hw_stats callback.
      We expose the following counters:
      
      +---------------------+----------------------------------------+
      |      Name           |           Description                  |
      |---------------------+----------------------------------------|
      |sent_pkts            | number of sent pkts                    |
      |---------------------+----------------------------------------|
      |rcvd_pkts            | number of received packets             |
      |---------------------+----------------------------------------|
      |out_of_sequence      | number of errors due to packet         |
      |                     | transport sequence number              |
      |---------------------+----------------------------------------|
      |duplicate_request    | number of received duplicated packets. |
      |                     | A request that previously executed is  |
      |                     | named duplicated.                      |
      |---------------------+----------------------------------------|
      |rcvd_rnr_err         | number of received RNR by completer    |
      |---------------------+----------------------------------------|
      |send_rnr_err         | number of sent RNR by responder        |
      |---------------------+----------------------------------------|
      |rcvd_seq_err         | number of out of sequence packets      |
      |                     | received                               |
      |---------------------+----------------------------------------|
      |ack_deffered         | number of deferred handling of ack     |
      |                     | packets.                               |
      |---------------------+----------------------------------------|
      |retry_exceeded_err   | number of times retry exceeded         |
      |---------------------+----------------------------------------|
      |completer_retry_err  | number of times completer decided to   |
      |                     | retry                                  |
      |---------------------+----------------------------------------|
      |send_err             | number of failed send packet           |
      +---------------------+----------------------------------------+
      Signed-off-by: NYonatan Cohen <yonatanc@mellanox.com>
      Reviewed-by: NMoni Shoua <monis@mellanox.com>
      Reviewed-by: NAndrew Boyer <andrew.boyer@dell.com>
      Signed-off-by: NLeon Romanovsky <leon@kernel.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      0b1e5b99
  19. 15 2月, 2017 1 次提交
  20. 25 1月, 2017 2 次提交
  21. 11 1月, 2017 1 次提交
  22. 14 12月, 2016 1 次提交
  23. 13 12月, 2016 2 次提交
    • A
      IB/rxe: Fix ref leak in rxe_create_qp() · 5b9ea16c
      Andrew Boyer 提交于
      The udata->inlen error path needs to clean up the ref
      added by rxe_alloc().
      Signed-off-by: NAndrew Boyer <andrew.boyer@dell.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      5b9ea16c
    • A
      IB/rxe: Add support for IB_CQ_REPORT_MISSED_EVENTS · accacb8f
      Andrew Boyer 提交于
      Peek at the CQ after arming it so that we can return a hint.
      This avoids missed completions due to a race between posting
      CQEs and arming the CQ.
      
      For example, CM teardown waits on MAD requests to complete with
      ib_cq_poll_work(). Without this fix, the last completion might be
      left on the CQ, hanging the kthread doing the teardown.
      
      The console backtraces look like this:
      
      [ 4199.911284] Call Trace:
      [ 4199.911401]  [<ffffffff9657fe95>] schedule+0x35/0x80
      [ 4199.911556]  [<ffffffff965830df>] schedule_timeout+0x22f/0x2c0
      [ 4199.911727]  [<ffffffff9657f7a8>] ? __schedule+0x368/0xa20
      [ 4199.911891]  [<ffffffff96580903>] wait_for_completion+0xb3/0x130
      [ 4199.912067]  [<ffffffff960a17e0>] ? wake_up_q+0x70/0x70
      [ 4199.912243]  [<ffffffffc074a06d>] cm_destroy_id+0x13d/0x450 [ib_cm]
      [ 4199.912422]  [<ffffffff961615d5>] ? printk+0x57/0x73
      [ 4199.912578]  [<ffffffffc074a390>] ib_destroy_cm_id+0x10/0x20 [ib_cm]
      [ 4199.912759]  [<ffffffffc076098c>] rdma_destroy_id+0xac/0x340 [rdma_cm]
      [ 4199.912941]  [<ffffffffc076f2cc>] 0xffffffffc076f2cc
      Signed-off-by: NAndrew Boyer <andrew.boyer@dell.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      accacb8f
  24. 07 10月, 2016 2 次提交