1. 23 8月, 2016 2 次提交
    • I
      IB/hfi1: Fix mm_struct use after free · e0cf75de
      Ira Weiny 提交于
      Testing with CONFIG_SLUB_DEBUG_ON=y resulted in the kernel panic below.
      
      This is the result of the mm_struct sometimes being free'd prior to
      hfi1_file_close being called.
      
      This was due to the combination of 2 reasons:
      
      1) hfi1_file_close is deferred in process exit and it therefore may not
         be called synchronously with process exit.
      2) exit_mm is called prior to exit_files in do_exit.  Normally this is ok
         however, our kernel bypass code requires us to have access to the
         mm_struct for house keeping both at "normal" close time as well as at
         process exit.
      
      Therefore, the fix is to simply keep a reference to the mm_struct until
      we are done with it.
      
      [ 3006.340150] general protection fault: 0000 [#1] SMP
      [ 3006.346469] Modules linked in: hfi1 rdmavt rpcrdma ib_isert iscsi_target_mod
      ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod
       ib_srp scsi_transport_srp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm
       ib_cm iw_cm dm_mirror dm_region_hash dm_log dm_mod snd_hda_code
       c_realtek iTCO_wdt snd_hda_codec_generic iTCO_vendor_support sb_edac edac_core
       x86_pkg_temp_thermal intel_powerclamp coretemp kvm irqbypass c
       rct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel lrw snd_hda_intel
       gf128mul snd_hda_codec glue_helper snd_hda_core ablk_helper sn
       d_hwdep cryptd snd_seq snd_seq_device snd_pcm snd_timer snd soundcore pcspkr
       shpchp mei_me sg lpc_ich mei i2c_i801 mfd_core ioatdma ipmi_devi
       ntf wmi ipmi_si ipmi_msghandler acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd
       grace sunrpc ip_tables ext4 jbd2 mbcache mlx4_en ib_core sr_mod s
       d_mod cdrom crc32c_intel mgag200 drm_kms_helper syscopyarea sysfillrect igb
       sysimgblt fb_sys_fops ptp mlx4_core ttm isci pps_core ahci drm li
       bsas libahci dca firewire_ohci i2c_algo_bit scsi_transport_sas firewire_core
       crc_itu_t i2c_core libata [last unloaded: mlx4_ib]
       [ 3006.461759] CPU: 16 PID: 11624 Comm: mpi_stress Not tainted 4.7.0-rc5+ #1
       [ 3006.469915] Hardware name: Intel Corporation W2600CR ........../W2600CR, BIOS SE5C600.86B.01.08.0003.022620131521 02/26/2013
       [ 3006.483027] task: ffff8804102f0040 ti: ffff8804102f8000 task.ti: ffff8804102f8000
       [ 3006.491971] RIP: 0010:[<ffffffff810f0383>]  [<ffffffff810f0383>] __lock_acquire+0xb3/0x19e0
       [ 3006.501905] RSP: 0018:ffff8804102fb908  EFLAGS: 00010002
       [ 3006.508447] RAX: 6b6b6b6b6b6b6b6b RBX: 0000000000000001 RCX: 0000000000000000
       [ 3006.517012] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff880410b56a40
       [ 3006.525569] RBP: ffff8804102fb9b0 R08: 0000000000000001 R09: 0000000000000000
       [ 3006.534119] R10: ffff8804102f0040 R11: 0000000000000000 R12: 0000000000000000
       [ 3006.542664] R13: ffff880410b56a40 R14: 0000000000000000 R15: 0000000000000000
       [ 3006.551203] FS:  00007ff478c08700(0000) GS:ffff88042e200000(0000) knlGS:0000000000000000
       [ 3006.560814] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       [ 3006.567806] CR2: 00007f667f5109e0 CR3: 0000000001c06000 CR4: 00000000000406e0
       [ 3006.576352] Stack:
       [ 3006.579157]  ffffffff8124b819 ffffffffffffffff 0000000000000000 ffff8804102fb940
       [ 3006.588072]  0000000000000002 0000000000000000 ffff8804102f0040 0000000000000007
       [ 3006.596971]  0000000000000006 ffff8803cad6f000 0000000000000000 ffff8804102f0040
       [ 3006.605878] Call Trace:
       [ 3006.609220]  [<ffffffff8124b819>] ? uncharge_batch+0x109/0x250
       [ 3006.616382]  [<ffffffff810f2313>] lock_acquire+0xd3/0x220
       [ 3006.623056]  [<ffffffffa0a30bfc>] ? hfi1_release_user_pages+0x7c/0xa0 [hfi1]
       [ 3006.631593]  [<ffffffff81775579>] down_write+0x49/0x80
       [ 3006.638022]  [<ffffffffa0a30bfc>] ? hfi1_release_user_pages+0x7c/0xa0 [hfi1]
       [ 3006.646569]  [<ffffffffa0a30bfc>] hfi1_release_user_pages+0x7c/0xa0 [hfi1]
       [ 3006.654898]  [<ffffffffa0a2efb6>] cacheless_tid_rb_remove+0x106/0x330 [hfi1]
       [ 3006.663417]  [<ffffffff810efd36>] ? mark_held_locks+0x66/0x90
       [ 3006.670498]  [<ffffffff817771f6>] ? _raw_spin_unlock_irqrestore+0x36/0x60
       [ 3006.678741]  [<ffffffffa0a2f1ee>] tid_rb_remove+0xe/0x10 [hfi1]
       [ 3006.686010]  [<ffffffffa0a0c5d5>] hfi1_mmu_rb_unregister+0xc5/0x100 [hfi1]
       [ 3006.694387]  [<ffffffffa0a2fcb9>] hfi1_user_exp_rcv_free+0x39/0x120 [hfi1]
       [ 3006.702732]  [<ffffffffa09fc6ea>] hfi1_file_close+0x17a/0x330 [hfi1]
       [ 3006.710489]  [<ffffffff81263e9a>] __fput+0xfa/0x230
       [ 3006.716595]  [<ffffffff8126400e>] ____fput+0xe/0x10
       [ 3006.722696]  [<ffffffff810b95c6>] task_work_run+0x86/0xc0
       [ 3006.729379]  [<ffffffff81099933>] do_exit+0x323/0xc40
       [ 3006.735672]  [<ffffffff8109a2dc>] do_group_exit+0x4c/0xc0
       [ 3006.742371]  [<ffffffff810a7f55>] get_signal+0x345/0x940
       [ 3006.748958]  [<ffffffff810340c7>] do_signal+0x37/0x700
       [ 3006.755328]  [<ffffffff8127872a>] ? poll_select_set_timeout+0x5a/0x90
       [ 3006.763146]  [<ffffffff811609cb>] ? __audit_syscall_exit+0x1db/0x260
       [ 3006.770853]  [<ffffffff8110f3e3>] ? rcu_read_lock_sched_held+0x93/0xa0
       [ 3006.778765]  [<ffffffff812347a4>] ? kfree+0x1e4/0x2a0
       [ 3006.784986]  [<ffffffff8108e75a>] ? exit_to_usermode_loop+0x33/0xac
       [ 3006.792551]  [<ffffffff8108e785>] exit_to_usermode_loop+0x5e/0xac
       [ 3006.799907]  [<ffffffff81003dca>] do_syscall_64+0x12a/0x190
       [ 3006.806664]  [<ffffffff81777a7f>] entry_SYSCALL64_slow_path+0x25/0x25
       [ 3006.814396] Code: 24 08 44 89 44 24 10 89 4c 24 18 e8 a8 d8 ff ff 48 85 c0
       8b 4c 24 18 44 8b 44 24 10 44 8b 4c 24 08 4c 8b 14 24 0f 84 30
       08 00 00 <f0> ff 80 98 01 00 00 8b 3d 48 ad be 01 45 8b a2 90 0b 00 00 85
       [ 3006.837158] RIP  [<ffffffff810f0383>] __lock_acquire+0xb3/0x19e0
       [ 3006.844401]  RSP <ffff8804102fb908>
       [ 3006.851170] ---[ end trace b7b9f21cf06c27df ]---
       [ 3006.927420] Kernel panic - not syncing: Fatal exception
       [ 3006.933954] Kernel Offset: disabled
       [ 3006.940961] ---[ end Kernel panic - not syncing: Fatal exception
       [ 3006.948249] ------------[ cut here ]------------
      
      Fixes: 3faa3d9a ("IB/hfi1: Make use of mm consistent")
      Reviewed-by: NDean Luick <dean.luick@intel.com>
      Signed-off-by: NIra Weiny <ira.weiny@intel.com>
      Signed-off-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      e0cf75de
    • C
      IB/hfi1: Add missing error code assignment before test · 57bb562a
      Christophe Jaillet 提交于
      It is likely that checking the result of 'setup_ctxt' is expected here.
      Signed-off-by: NChristophe JAILLET <christophe.jaillet@wanadoo.fr>
      Acked-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      57bb562a
  2. 04 8月, 2016 1 次提交
  3. 03 8月, 2016 7 次提交
  4. 18 6月, 2016 1 次提交
  5. 26 5月, 2016 10 次提交
  6. 29 4月, 2016 3 次提交
    • J
      IB/security: Restrict use of the write() interface · e6bd18f5
      Jason Gunthorpe 提交于
      The drivers/infiniband stack uses write() as a replacement for
      bi-directional ioctl().  This is not safe. There are ways to
      trigger write calls that result in the return structure that
      is normally written to user space being shunted off to user
      specified kernel memory instead.
      
      For the immediate repair, detect and deny suspicious accesses to
      the write API.
      
      For long term, update the user space libraries and the kernel API
      to something that doesn't present the same security vulnerabilities
      (likely a structured ioctl() interface).
      
      The impacted uAPI interfaces are generally only available if
      hardware from drivers/infiniband is installed in the system.
      Reported-by: NJann Horn <jann@thejh.net>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: NJason Gunthorpe <jgunthorpe@obsidianresearch.com>
      [ Expanded check to all known write() entry points ]
      Cc: stable@vger.kernel.org
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      e6bd18f5
    • D
      IB/hfi1: Use kernel default llseek for ui device · 7723d8c2
      Dean Luick 提交于
      The ui device llseek had a mistake with SEEK_END and did
      not fully follow seek semantics.  Correct all this by
      using a kernel supplied function for fixed size devices.
      
      Cc: Al Viro <viro@ZenIV.linux.org.uk>
      Reviewed-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NDean Luick <dean.luick@intel.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      7723d8c2
    • M
      IB/hfi1: Don't attempt to free resources if initialization failed · 94158442
      Mitko Haralanov 提交于
      Attempting to free resources which have not been allocated and
      initialized properly led to the following kernel backtrace:
      
          BUG: unable to handle kernel NULL pointer dereference at           (null)
          IP: [<ffffffffa09658fe>] unlock_exp_tids.isra.8+0x2e/0x120 [hfi1]
          PGD 852a43067 PUD 85d4a6067 PMD 0
          Oops: 0000 [#1] SMP
          CPU: 0 PID: 2831 Comm: osu_bw Tainted: G          IO 3.12.18-wfr+ #1
          task: ffff88085b15b540 ti: ffff8808588fe000 task.ti: ffff8808588fe000
          RIP: 0010:[<ffffffffa09658fe>]  [<ffffffffa09658fe>] unlock_exp_tids.isra.8+0x2e/0x120 [hfi1]
          RSP: 0018:ffff8808588ffde0  EFLAGS: 00010282
          RAX: 0000000000000000 RBX: ffff880858a31800 RCX: 0000000000000000
          RDX: ffff88085d971bc0 RSI: ffff880858a318f8 RDI: ffff880858a318c0
          RBP: ffff8808588ffe20 R08: 0000000000000000 R09: 0000000000000000
          R10: ffff88087ffd6f40 R11: 0000000001100348 R12: ffff880852900000
          R13: ffff880858a318c0 R14: 0000000000000000 R15: ffff88085d971be8
          FS:  00007f4674e83740(0000) GS:ffff88087f400000(0000) knlGS:0000000000000000
          CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
          CR2: 0000000000000000 CR3: 000000085c377000 CR4: 00000000001407f0
          Stack:
           ffffffffa0941a71 ffff880858a318f8 ffff88085d971bc0 ffff880858a31800
           ffff880852900000 ffff880858a31800 00000000003ffff7 ffff88085d971bc0
           ffff8808588ffe60 ffffffffa09663fc ffff8808588ffe60 ffff880858a31800
          Call Trace:
           [<ffffffffa0941a71>] ? find_mmu_handler+0x51/0x70 [hfi1]
           [<ffffffffa09663fc>] hfi1_user_exp_rcv_free+0x6c/0x120 [hfi1]
           [<ffffffffa0932809>] hfi1_file_close+0x1a9/0x340 [hfi1]
           [<ffffffff8116c189>] __fput+0xe9/0x270
           [<ffffffff8116c35e>] ____fput+0xe/0x10
           [<ffffffff81065707>] task_work_run+0xa7/0xe0
           [<ffffffff81002969>] do_notify_resume+0x59/0x80
           [<ffffffff814ffc1a>] int_signal+0x12/0x17
      
      This commit re-arranges the context initialization code in a way that
      would allow for context event flags to be used to determine whether
      the context has been successfully initialized.
      
      In turn, this can be used to skip the resource de-allocation if they
      were never allocated in the first place.
      
      Fixes: 3abb33ac ("staging/hfi1: Add TID cache receive init and free funcs")
      Reviewed-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NMitko Haralanov <mitko.haralanov@intel.com>
      Reviewed-by: Leon Romanovsky <leonro@mellanox.com.
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      94158442
  7. 22 3月, 2016 1 次提交
  8. 12 3月, 2016 1 次提交
  9. 11 3月, 2016 11 次提交
  10. 01 3月, 2016 3 次提交