* [PATCH] RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued()
@ 2020-06-26 17:49 Jason Gunthorpe
2020-06-28 8:02 ` Leon Romanovsky
2020-07-02 17:29 ` Jason Gunthorpe
0 siblings, 2 replies; 3+ messages in thread
From: Jason Gunthorpe @ 2020-06-26 17:49 UTC (permalink / raw)
To: linux-rdma; +Cc: Hillf Danton, syzbot+4088ed905e4ae2b0e13b
ib_unregister_device_queued() can only be used by drivers using the new
dealloc_device callback flow, and it has a safety WARN_ON to ensure
drivers are using it properly.
However, if unregister and register are raced there is a special
destruction path that maintains the uniform error h andling semantic of
'caller does ib_dealloc_device() on failure'. This requires disabling the
dealloc_device callback which triggers the WARN_ON.
Instead of using NULL to disable the callback use a special function
pointer so the WARN_ON does not trigger.
Reported-by: syzbot+4088ed905e4ae2b0e13b@syzkaller.appspotmail.com
Suggested-by: Hillf Danton <hdanton@sina.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
---
drivers/infiniband/core/device.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
As outlined by Hillf, seems like it is OK.
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 1335ed1f1e4a25..40cf07129f662b 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1339,6 +1339,10 @@ static int enable_device_and_get(struct ib_device *device)
return ret;
}
+static void prevent_dealloc_device(struct ib_device *ib_dev)
+{
+}
+
/**
* ib_register_device - Register an IB device with IB core
* @device: Device to register
@@ -1409,11 +1413,11 @@ int ib_register_device(struct ib_device *device, const char *name)
* possibility for a parallel unregistration along with this
* error flow. Since we have a refcount here we know any
* parallel flow is stopped in disable_device and will see the
- * NULL pointers, causing the responsibility to
+ * special dealloc_driver pointer, causing the responsibility to
* ib_dealloc_device() to revert back to this thread.
*/
dealloc_fn = device->ops.dealloc_driver;
- device->ops.dealloc_driver = NULL;
+ device->ops.dealloc_driver = prevent_dealloc_device;
ib_device_put(device);
__ib_unregister_device(device);
device->ops.dealloc_driver = dealloc_fn;
@@ -1462,7 +1466,8 @@ static void __ib_unregister_device(struct ib_device *ib_dev)
* Drivers using the new flow may not call ib_dealloc_device except
* in error unwind prior to registration success.
*/
- if (ib_dev->ops.dealloc_driver) {
+ if (ib_dev->ops.dealloc_driver &&
+ ib_dev->ops.dealloc_driver != prevent_dealloc_device) {
WARN_ON(kref_read(&ib_dev->dev.kobj.kref) <= 1);
ib_dealloc_device(ib_dev);
}
--
2.27.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued()
2020-06-26 17:49 [PATCH] RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued() Jason Gunthorpe
@ 2020-06-28 8:02 ` Leon Romanovsky
2020-07-02 17:29 ` Jason Gunthorpe
1 sibling, 0 replies; 3+ messages in thread
From: Leon Romanovsky @ 2020-06-28 8:02 UTC (permalink / raw)
To: Jason Gunthorpe; +Cc: linux-rdma, Hillf Danton, syzbot+4088ed905e4ae2b0e13b
On Fri, Jun 26, 2020 at 02:49:10PM -0300, Jason Gunthorpe wrote:
> ib_unregister_device_queued() can only be used by drivers using the new
> dealloc_device callback flow, and it has a safety WARN_ON to ensure
> drivers are using it properly.
>
> However, if unregister and register are raced there is a special
> destruction path that maintains the uniform error h andling semantic of
"h andling" -> "handling"
> 'caller does ib_dealloc_device() on failure'. This requires disabling the
> dealloc_device callback which triggers the WARN_ON.
>
> Instead of using NULL to disable the callback use a special function
> pointer so the WARN_ON does not trigger.
>
> Reported-by: syzbot+4088ed905e4ae2b0e13b@syzkaller.appspotmail.com
> Suggested-by: Hillf Danton <hdanton@sina.com>
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> ---
> drivers/infiniband/core/device.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
Thanks,
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued()
2020-06-26 17:49 [PATCH] RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued() Jason Gunthorpe
2020-06-28 8:02 ` Leon Romanovsky
@ 2020-07-02 17:29 ` Jason Gunthorpe
1 sibling, 0 replies; 3+ messages in thread
From: Jason Gunthorpe @ 2020-07-02 17:29 UTC (permalink / raw)
To: linux-rdma; +Cc: Hillf Danton, syzbot+4088ed905e4ae2b0e13b
On Fri, Jun 26, 2020 at 02:49:10PM -0300, Jason Gunthorpe wrote:
> ib_unregister_device_queued() can only be used by drivers using the new
> dealloc_device callback flow, and it has a safety WARN_ON to ensure
> drivers are using it properly.
>
> However, if unregister and register are raced there is a special
> destruction path that maintains the uniform error h andling semantic of
> 'caller does ib_dealloc_device() on failure'. This requires disabling the
> dealloc_device callback which triggers the WARN_ON.
>
> Instead of using NULL to disable the callback use a special function
> pointer so the WARN_ON does not trigger.
>
> Reported-by: syzbot+4088ed905e4ae2b0e13b@syzkaller.appspotmail.com
> Suggested-by: Hillf Danton <hdanton@sina.com>
> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
> Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
> ---
> drivers/infiniband/core/device.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> As outlined by Hillf, seems like it is OK.
Applied to for-next
Jason
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-07-02 17:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-26 17:49 [PATCH] RDMA/core: Fix bogus WARN_ON during ib_unregister_device_queued() Jason Gunthorpe
2020-06-28 8:02 ` Leon Romanovsky
2020-07-02 17:29 ` Jason Gunthorpe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).