From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Mike Marciniszyn <mike.marciniszyn@intel.com>,
Dennis Dalessandro <dennis.dalessandro@intel.com>,
Kaike Wan <kaike.wan@intel.com>,
Jason Gunthorpe <jgg@mellanox.com>
Subject: [PATCH 5.3 27/48] IB/hfi1: Ensure r_tid_ack is valid before building TID RDMA ACK packet
Date: Tue, 19 Nov 2019 06:19:47 +0100 [thread overview]
Message-ID: <20191119051009.167843775@linuxfoundation.org> (raw)
In-Reply-To: <20191119050946.745015350@linuxfoundation.org>
From: Kaike Wan <kaike.wan@intel.com>
commit c1abd865bd125015783286b353abb8da51644f59 upstream.
The index r_tid_ack is used to indicate the next TID RDMA WRITE request to
acknowledge in the ring s_ack_queue[] on the responder side and should be
set to a valid index other than its initial value before r_tid_tail is
advanced to the next TID RDMA WRITE request and particularly before a TID
RDMA ACK is built. Otherwise, a NULL pointer dereference may result:
BUG: unable to handle kernel paging request at ffff9a32d27abff8
IP: [<ffffffffc0d87ea6>] hfi1_make_tid_rdma_pkt+0x476/0xcb0 [hfi1]
PGD 2749032067 PUD 0
Oops: 0000 1 SMP
Modules linked in: osp(OE) ofd(OE) lfsck(OE) ost(OE) mgc(OE) osd_zfs(OE) lquota(OE) lustre(OE) lmv(OE) mdc(OE) lov(OE) fid(OE) fld(OE) ko2iblnd(OE) ptlrpc(OE) obdclass(OE) lnet(OE) libcfs(OE) ib_ipoib(OE) hfi1(OE) rdmavt(OE) nfsv3 nfs_acl rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache ib_isert iscsi_target_mod target_core_mod ib_ucm dm_mirror dm_region_hash dm_log mlx5_ib dm_mod zfs(POE) rpcrdma sunrpc rdma_ucm ib_uverbs opa_vnic ib_iser zunicode(POE) ib_umad zavl(POE) icp(POE) sb_edac intel_powerclamp coretemp rdma_cm intel_rapl iosf_mbi iw_cm libiscsi scsi_transport_iscsi kvm ib_cm iTCO_wdt mxm_wmi iTCO_vendor_support irqbypass crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd zcommon(POE) znvpair(POE) pcspkr spl(OE) mei_me
sg mei ioatdma lpc_ich joydev i2c_i801 shpchp ipmi_si ipmi_devintf ipmi_msghandler wmi acpi_power_meter ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic mgag200 mlx5_core drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ixgbe ahci ttm mlxfw ib_core libahci devlink mdio crct10dif_pclmul crct10dif_common drm ptp libata megaraid_sas crc32c_intel i2c_algo_bit pps_core i2c_core dca [last unloaded: rdmavt]
CPU: 15 PID: 68691 Comm: kworker/15:2H Kdump: loaded Tainted: P W OE ------------ 3.10.0-862.2.3.el7_lustre.x86_64 #1
Hardware name: Intel Corporation S2600WTT/S2600WTT, BIOS SE5C610.86B.01.01.0016.033120161139 03/31/2016
Workqueue: hfi0_0 _hfi1_do_tid_send [hfi1]
task: ffff9a01f47faf70 ti: ffff9a11776a8000 task.ti: ffff9a11776a8000
RIP: 0010:[<ffffffffc0d87ea6>] [<ffffffffc0d87ea6>] hfi1_make_tid_rdma_pkt+0x476/0xcb0 [hfi1]
RSP: 0018:ffff9a11776abd08 EFLAGS: 00010002
RAX: ffff9a32d27abfc0 RBX: ffff99f2d27aa000 RCX: 00000000ffffffff
RDX: 0000000000000000 RSI: 0000000000000220 RDI: ffff99f2ffc05300
RBP: ffff9a11776abd88 R08: 000000000001c310 R09: ffffffffc0d87ad4
R10: 0000000000000000 R11: 0000000000000000 R12: ffff9a117a423c00
R13: ffff9a117a423c00 R14: ffff9a03500c0000 R15: ffff9a117a423cb8
FS: 0000000000000000(0000) GS:ffff9a117e9c0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff9a32d27abff8 CR3: 0000002748a0e000 CR4: 00000000001607e0
Call Trace:
[<ffffffffc0d88874>] _hfi1_do_tid_send+0x194/0x320 [hfi1]
[<ffffffffaf0b2dff>] process_one_work+0x17f/0x440
[<ffffffffaf0b3ac6>] worker_thread+0x126/0x3c0
[<ffffffffaf0b39a0>] ? manage_workers.isra.24+0x2a0/0x2a0
[<ffffffffaf0bae31>] kthread+0xd1/0xe0
[<ffffffffaf0bad60>] ? insert_kthread_work+0x40/0x40
[<ffffffffaf71f5f7>] ret_from_fork_nospec_begin+0x21/0x21
[<ffffffffaf0bad60>] ? insert_kthread_work+0x40/0x40
hfi1 0000:05:00.0: hfi1_0: reserved_op: opcode 0xf2, slot 2, rsv_used 1, rsv_ops 1
Code: 00 00 41 8b 8d d8 02 00 00 89 c8 48 89 45 b0 48 c1 65 b0 06 48 8b 83 a0 01 00 00 48 01 45 b0 48 8b 45 b0 41 80 bd 10 03 00 00 00 <48> 8b 50 38 4c 8d 7a 50 74 45 8b b2 d0 00 00 00 85 f6 0f 85 72
RIP [<ffffffffc0d87ea6>] hfi1_make_tid_rdma_pkt+0x476/0xcb0 [hfi1]
RSP <ffff9a11776abd08>
CR2: ffff9a32d27abff8
This problem can happen if a RESYNC request is received before r_tid_ack
is modified.
This patch fixes the issue by making sure that r_tid_ack is set to a valid
value before a TID RDMA ACK is built. Functions are defined to simplify
the code.
Fixes: 07b923701e38 ("IB/hfi1: Add functions to receive TID RDMA WRITE request")
Fixes: 7cf0ad679de4 ("IB/hfi1: Add a function to receive TID RDMA RESYNC packet")
Link: https://lore.kernel.org/r/20191025195830.106825.44022.stgit@awfm-01.aw.intel.com
Cc: <stable@vger.kernel.org>
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Kaike Wan <kaike.wan@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/hfi1/tid_rdma.c | 44 ++++++++++++++++++++--------------
1 file changed, 27 insertions(+), 17 deletions(-)
--- a/drivers/infiniband/hw/hfi1/tid_rdma.c
+++ b/drivers/infiniband/hw/hfi1/tid_rdma.c
@@ -136,6 +136,26 @@ static void update_r_next_psn_fecn(struc
struct tid_rdma_flow *flow,
bool fecn);
+static void validate_r_tid_ack(struct hfi1_qp_priv *priv)
+{
+ if (priv->r_tid_ack == HFI1_QP_WQE_INVALID)
+ priv->r_tid_ack = priv->r_tid_tail;
+}
+
+static void tid_rdma_schedule_ack(struct rvt_qp *qp)
+{
+ struct hfi1_qp_priv *priv = qp->priv;
+
+ priv->s_flags |= RVT_S_ACK_PENDING;
+ hfi1_schedule_tid_send(qp);
+}
+
+static void tid_rdma_trigger_ack(struct rvt_qp *qp)
+{
+ validate_r_tid_ack(qp->priv);
+ tid_rdma_schedule_ack(qp);
+}
+
static u64 tid_rdma_opfn_encode(struct tid_rdma_params *p)
{
return
@@ -2997,10 +3017,7 @@ nak_psn:
qpriv->s_nak_state = IB_NAK_PSN_ERROR;
/* We are NAK'ing the next expected PSN */
qpriv->s_nak_psn = mask_psn(flow->flow_state.r_next_psn);
- qpriv->s_flags |= RVT_S_ACK_PENDING;
- if (qpriv->r_tid_ack == HFI1_QP_WQE_INVALID)
- qpriv->r_tid_ack = qpriv->r_tid_tail;
- hfi1_schedule_tid_send(qp);
+ tid_rdma_trigger_ack(qp);
}
goto unlock;
}
@@ -3518,7 +3535,7 @@ static void hfi1_tid_write_alloc_resourc
/*
* If overtaking req->acked_tail, send an RNR NAK. Because the
* QP is not queued in this case, and the issue can only be
- * caused due a delay in scheduling the second leg which we
+ * caused by a delay in scheduling the second leg which we
* cannot estimate, we use a rather arbitrary RNR timeout of
* (MAX_FLOWS / 2) segments
*/
@@ -3526,8 +3543,7 @@ static void hfi1_tid_write_alloc_resourc
MAX_FLOWS)) {
ret = -EAGAIN;
to_seg = MAX_FLOWS >> 1;
- qpriv->s_flags |= RVT_S_ACK_PENDING;
- hfi1_schedule_tid_send(qp);
+ tid_rdma_trigger_ack(qp);
break;
}
@@ -4327,8 +4343,7 @@ void hfi1_rc_rcv_tid_rdma_write_data(str
trace_hfi1_tid_req_rcv_write_data(qp, 0, e->opcode, e->psn, e->lpsn,
req);
trace_hfi1_tid_write_rsp_rcv_data(qp);
- if (priv->r_tid_ack == HFI1_QP_WQE_INVALID)
- priv->r_tid_ack = priv->r_tid_tail;
+ validate_r_tid_ack(priv);
if (opcode == TID_OP(WRITE_DATA_LAST)) {
release_rdma_sge_mr(e);
@@ -4367,8 +4382,7 @@ void hfi1_rc_rcv_tid_rdma_write_data(str
}
done:
- priv->s_flags |= RVT_S_ACK_PENDING;
- hfi1_schedule_tid_send(qp);
+ tid_rdma_schedule_ack(qp);
exit:
priv->r_next_psn_kdeth = flow->flow_state.r_next_psn;
if (fecn)
@@ -4380,10 +4394,7 @@ send_nak:
if (!priv->s_nak_state) {
priv->s_nak_state = IB_NAK_PSN_ERROR;
priv->s_nak_psn = flow->flow_state.r_next_psn;
- priv->s_flags |= RVT_S_ACK_PENDING;
- if (priv->r_tid_ack == HFI1_QP_WQE_INVALID)
- priv->r_tid_ack = priv->r_tid_tail;
- hfi1_schedule_tid_send(qp);
+ tid_rdma_trigger_ack(qp);
}
goto done;
}
@@ -4931,8 +4942,7 @@ void hfi1_rc_rcv_tid_rdma_resync(struct
qpriv->resync = true;
/* RESYNC request always gets a TID RDMA ACK. */
qpriv->s_nak_state = 0;
- qpriv->s_flags |= RVT_S_ACK_PENDING;
- hfi1_schedule_tid_send(qp);
+ tid_rdma_trigger_ack(qp);
bail:
if (fecn)
qp->s_flags |= RVT_S_ECN;
next prev parent reply other threads:[~2019-11-19 6:12 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-19 5:19 [PATCH 5.3 00/48] 5.3.12-stable review Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 01/48] scsi: core: Handle drivers which set sg_tablesize to zero Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 02/48] ax88172a: fix information leak on short answers Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 03/48] devlink: disallow reload operation during device cleanup Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 04/48] ipmr: Fix skb headroom in ipmr_get_route() Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 05/48] mlxsw: core: Enable devlink reload only on probe Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 06/48] net: gemini: add missed free_netdev Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 07/48] net/smc: fix fastopen for non-blocking connect() Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 08/48] net: usb: qmi_wwan: add support for Foxconn T77W968 LTE modules Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 09/48] slip: Fix memory leak in slip_open error path Greg Kroah-Hartman
2019-11-19 7:43 ` Oliver Hartkopp
2019-11-19 7:55 ` Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 10/48] tcp: remove redundant new line from tcp_event_sk_skb Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 11/48] dpaa2-eth: free already allocated channels on probe defer Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 12/48] devlink: Add method for time-stamp on reporters dump Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 13/48] net/smc: fix refcount non-blocking connect() -part 2 Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 14/48] ALSA: usb-audio: Fix missing error check at mixer resolution test Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 15/48] ALSA: usb-audio: not submit urb for stopped endpoint Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 16/48] ALSA: usb-audio: Fix incorrect NULL check in create_yamaha_midi_quirk() Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 17/48] ALSA: usb-audio: Fix incorrect size check for processing/extension units Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 18/48] Btrfs: fix log context list corruption after rename exchange operation Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 19/48] cgroup: freezer: call cgroup_enter_frozen() with preemption disabled in ptrace_stop() Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 20/48] Input: ff-memless - kill timer in destroy() Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 21/48] Input: synaptics-rmi4 - fix video buffer size Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 22/48] Input: synaptics-rmi4 - disable the relative position IRQ in the F12 driver Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 23/48] Input: synaptics-rmi4 - do not consume more data than we have (F11, F12) Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 24/48] Input: synaptics-rmi4 - clear IRQ enables for F54 Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 25/48] Input: synaptics-rmi4 - destroy F54 poller workqueue when removing Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 26/48] KVM: MMU: Do not treat ZONE_DEVICE pages as being reserved Greg Kroah-Hartman
2019-11-19 5:19 ` Greg Kroah-Hartman [this message]
2019-11-19 5:19 ` [PATCH 5.3 28/48] IB/hfi1: Calculate flow weight based on QP MTU for TID RDMA Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 29/48] IB/hfi1: TID RDMA WRITE should not return IB_WC_RNR_RETRY_EXC_ERR Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 30/48] IB/hfi1: Ensure full Gen3 speed in a Gen4 system Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 31/48] IB/hfi1: Use a common pad buffer for 9B and 16B packets Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 32/48] i2c: acpi: Force bus speed to 400KHz if a Silead touchscreen is present Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 33/48] x86/quirks: Disable HPET on Intel Coffe Lake platforms Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 34/48] ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 35/48] ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 36/48] io_uring: ensure registered buffer import returns the IO length Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 37/48] drm/i915: update rawclk also on resume Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 38/48] Revert "drm/i915/ehl: Update MOCS table for EHL" Greg Kroah-Hartman
2019-11-19 5:19 ` [PATCH 5.3 39/48] ntp/y2038: Remove incorrect time_t truncation Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 40/48] net: ethernet: dwmac-sun8i: Use the correct function in exit path Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 41/48] iommu/vt-d: Fix QI_DEV_IOTLB_PFSID and QI_DEV_EIOTLB_PFSID macros Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 42/48] mm: mempolicy: fix the wrong return value and potential pages leak of mbind Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 43/48] mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 44/48] mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup() Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 45/48] mm: slub: really fix slab walking for init_on_free Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 46/48] mm/memory_hotplug: fix try_offline_node() Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 47/48] mm/page_io.c: do not free shared swap slots Greg Kroah-Hartman
2019-11-19 5:20 ` [PATCH 5.3 48/48] mmc: sdhci-of-at91: fix quirk2 overwrite Greg Kroah-Hartman
2019-11-19 10:16 ` [PATCH 5.3 00/48] 5.3.12-stable review Jon Hunter
2019-11-19 10:16 ` Jon Hunter
2019-11-19 12:32 ` Greg Kroah-Hartman
2019-11-19 11:42 ` kernelci.org bot
2019-11-19 12:35 ` Holger Hoffstätte
2019-11-19 12:45 ` Greg Kroah-Hartman
2019-11-19 13:05 ` Holger Hoffstätte
2019-11-19 13:17 ` Naresh Kamboju
2019-11-19 18:45 ` Dan Rue
2019-11-20 6:00 ` Greg Kroah-Hartman
2019-11-19 20:34 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191119051009.167843775@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dennis.dalessandro@intel.com \
--cc=jgg@mellanox.com \
--cc=kaike.wan@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mike.marciniszyn@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.