[iw_cxgb4 linux-4.14.y] iw_cxgb4: only allow 1 flush on user qps

[iw_cxgb4 linux-4.14.y] iw_cxgb4: only allow 1 flush on user qps

[Steve Wise]

commit 308aa2b8f7b7db3332a7d41099fd37851fb793b2 upstream

Once the qp has been flushed, it cannot be flushed again.  The user qp
flush logic wasn't enforcing it however.  The bug can cause
touch-after-free crashes like:

Unable to handle kernel paging request for data at address 0x000001ec
Faulting instruction address: 0xc008000016069100
Oops: Kernel access of bad area, sig: 11 [#1]
...
NIP [c008000016069100] flush_qp+0x80/0x480 [iw_cxgb4]
LR [c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
Call Trace:
[c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
[c00800001606e868] c4iw_ib_modify_qp+0x118/0x200 [iw_cxgb4]
[c0080000119eae80] ib_security_modify_qp+0xd0/0x3d0 [ib_core]
[c0080000119c4e24] ib_modify_qp+0xc4/0x2c0 [ib_core]
[c008000011df0284] iwcm_modify_qp_err+0x44/0x70 [iw_cm]
[c008000011df0fec] destroy_cm_id+0xcc/0x370 [iw_cm]
[c008000011ed4358] rdma_destroy_id+0x3c8/0x520 [rdma_cm]
[c0080000134b0540] ucma_close+0x90/0x1b0 [rdma_ucm]
[c000000000444da4] __fput+0xe4/0x2f0

So fix flush_qp() to only flush the wq once.

Cc: stable@vger.kernel.org
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
---
 drivers/infiniband/hw/cxgb4/qp.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index a8a8f65a1e51..24952af51a54 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -1395,6 +1395,12 @@ static void flush_qp(struct c4iw_qp *qhp)
 	schp = to_c4iw_cq(qhp->ibqp.send_cq);
 
 	if (qhp->ibqp.uobject) {
+
+		/* for user qps, qhp->wq.flushed is protected by qhp->mutex */
+		if (qhp->wq.flushed)
+			return;
+
+		qhp->wq.flushed = 1;
 		t4_set_wq_in_error(&qhp->wq);
 		t4_set_cq_in_error(&rchp->cq);
 		spin_lock_irqsave(&rchp->comp_handler_lock, flag);
-- 
1.8.3.1

Re: [iw_cxgb4 linux-4.14.y] iw_cxgb4: only allow 1 flush on user qps

[Greg KH]

On Mon, Sep 24, 2018 at 10:38:52AM -0700, Steve Wise wrote:
> commit 308aa2b8f7b7db3332a7d41099fd37851fb793b2 upstream
> 
> Once the qp has been flushed, it cannot be flushed again.  The user qp
> flush logic wasn't enforcing it however.  The bug can cause
> touch-after-free crashes like:

I've applied the 4.14 and 4.18 patch.

What about 4.9.y?

thanks,

greg k-h

Re: [iw_cxgb4 linux-4.14.y] iw_cxgb4: only allow 1 flush on user qps

[Steve Wise]

On 9/26/2018 3:20 PM, Greg KH wrote:
> On Mon, Sep 24, 2018 at 10:38:52AM -0700, Steve Wise wrote:
>> commit 308aa2b8f7b7db3332a7d41099fd37851fb793b2 upstream
>>
>> Once the qp has been flushed, it cannot be flushed again.  The user qp
>> flush logic wasn't enforcing it however.  The bug can cause
>> touch-after-free crashes like:
> 
> I've applied the 4.14 and 4.18 patch.
> 
> What about 4.9.y?

huh.  Guess I missed that. :(  I'll send it out soon. Sorry!

Steve.