linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 5.2 01/59] RDMA/hns: Fix sg offset non-zero issue
@ 2019-08-06 21:32 Sasha Levin
  2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 02/59] IB/mlx5: Replace kfree with kvfree Sasha Levin
                   ` (57 more replies)
  0 siblings, 58 replies; 67+ messages in thread
From: Sasha Levin @ 2019-08-06 21:32 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Xi Wang, Jason Gunthorpe, Sasha Levin, linux-rdma

From: Xi Wang <wangxi11@huawei.com>

[ Upstream commit 60c3becfd1a138fdcfe48f2a5ef41ef0078d481e ]

When run perftest in many times, the system will report a BUG as follows:

   BUG: Bad rss-counter state mm:(____ptrval____) idx:0 val:-1
   BUG: Bad rss-counter state mm:(____ptrval____) idx:1 val:1

We tested with different kernel version and found it started from the the
following commit:

commit d10bcf947a3e ("RDMA/umem: Combine contiguous PAGE_SIZE regions in
SGEs")

In this commit, the sg->offset is always 0 when sg_set_page() is called in
ib_umem_get() and the drivers are not allowed to change the sgl, otherwise
it will get bad page descriptor when unfolding SGEs in __ib_umem_release()
as sg_page_count() will get wrong result while sgl->offset is not 0.

However, there is a weird sgl usage in the current hns driver, the driver
modified sg->offset after calling ib_umem_get(), which caused we iterate
past the wrong number of pages in for_each_sg_page iterator.

This patch fixes it by correcting the non-standard sgl usage found in the
hns_roce_db_map_user() function.

Fixes: d10bcf947a3e ("RDMA/umem: Combine contiguous PAGE_SIZE regions in SGEs")
Fixes: 0425e3e6e0c7 ("RDMA/hns: Support flush cqe for hip08 in kernel space")
Link: https://lore.kernel.org/r/1562808737-45723-1-git-send-email-oulijun@huawei.com
Signed-off-by: Xi Wang <wangxi11@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/hns/hns_roce_db.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/infiniband/hw/hns/hns_roce_db.c b/drivers/infiniband/hw/hns/hns_roce_db.c
index 0c6c1fe87705c..d60453e98db7c 100644
--- a/drivers/infiniband/hw/hns/hns_roce_db.c
+++ b/drivers/infiniband/hw/hns/hns_roce_db.c
@@ -12,13 +12,15 @@ int hns_roce_db_map_user(struct hns_roce_ucontext *context,
 			 struct ib_udata *udata, unsigned long virt,
 			 struct hns_roce_db *db)
 {
+	unsigned long page_addr = virt & PAGE_MASK;
 	struct hns_roce_user_db_page *page;
+	unsigned int offset;
 	int ret = 0;
 
 	mutex_lock(&context->page_mutex);
 
 	list_for_each_entry(page, &context->page_list, list)
-		if (page->user_virt == (virt & PAGE_MASK))
+		if (page->user_virt == page_addr)
 			goto found;
 
 	page = kmalloc(sizeof(*page), GFP_KERNEL);
@@ -28,8 +30,8 @@ int hns_roce_db_map_user(struct hns_roce_ucontext *context,
 	}
 
 	refcount_set(&page->refcount, 1);
-	page->user_virt = (virt & PAGE_MASK);
-	page->umem = ib_umem_get(udata, virt & PAGE_MASK, PAGE_SIZE, 0, 0);
+	page->user_virt = page_addr;
+	page->umem = ib_umem_get(udata, page_addr, PAGE_SIZE, 0, 0);
 	if (IS_ERR(page->umem)) {
 		ret = PTR_ERR(page->umem);
 		kfree(page);
@@ -39,10 +41,9 @@ int hns_roce_db_map_user(struct hns_roce_ucontext *context,
 	list_add(&page->list, &context->page_list);
 
 found:
-	db->dma = sg_dma_address(page->umem->sg_head.sgl) +
-		  (virt & ~PAGE_MASK);
-	page->umem->sg_head.sgl->offset = virt & ~PAGE_MASK;
-	db->virt_addr = sg_virt(page->umem->sg_head.sgl);
+	offset = virt - page_addr;
+	db->dma = sg_dma_address(page->umem->sg_head.sgl) + offset;
+	db->virt_addr = sg_virt(page->umem->sg_head.sgl) + offset;
 	db->u.user_page = page;
 	refcount_inc(&page->refcount);
 
-- 
2.20.1


^ permalink raw reply related	[flat|nested] 67+ messages in thread

end of thread, other threads:[~2019-08-18  1:48 UTC | newest]

Thread overview: 67+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-06 21:32 [PATCH AUTOSEL 5.2 01/59] RDMA/hns: Fix sg offset non-zero issue Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 02/59] IB/mlx5: Replace kfree with kvfree Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 03/59] clk: at91: generated: Truncate divisor to GENERATED_MAX_DIV + 1 Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 04/59] clk: sprd: Select REGMAP_MMIO to avoid compile errors Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 05/59] clk: renesas: cpg-mssr: Fix reset control race condition Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 06/59] dma-mapping: check pfn validity in dma_common_{mmap,get_sgtable} Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 07/59] xtensa: fix build for cores with coprocessors Sasha Levin
2019-08-06 21:55   ` Max Filippov
2019-08-18  1:45     ` Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 08/59] platform/x86: pcengines-apuv2: Fix softdep statement Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 09/59] platform/x86: intel_pmc_core: Add ICL-NNPI support to PMC Core Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 10/59] mm/hmm: always return EBUSY for invalid ranges in hmm_range_{fault,snapshot} Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 11/59] xen/pciback: remove set but not used variable 'old_state' Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 12/59] irqchip/gic-v3-its: Free unused vpt_page when alloc vpe table fail Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 13/59] irqchip/irq-imx-gpcv2: Forward irq type to parent Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 14/59] f2fs: fix to read source block before invalidating it Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 15/59] tools perf beauty: Fix usbdevfs_ioctl table generator to handle _IOC() Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 16/59] perf header: Fix divide by zero error if f_header.attr_size==0 Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 17/59] perf header: Fix use of unitialized value warning Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 18/59] RDMA/qedr: Fix the hca_type and hca_rev returned in device attributes Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 19/59] ALSA: pcm: fix lost wakeup event scenarios in snd_pcm_drain Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 20/59] libata: zpodd: Fix small read overflow in zpodd_get_mech_type() Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 21/59] powerpc/nvdimm: Pick nearby online node if the device node is not online Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 22/59] drm/bridge: lvds-encoder: Fix build error while CONFIG_DRM_KMS_HELPER=m Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 23/59] drm/bridge: tc358764: Fix build error Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 24/59] Btrfs: fix deadlock between fiemap and transaction commits Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 25/59] scsi: hpsa: correct scsi command status issue after reset Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 26/59] scsi: qla2xxx: Fix possible fcport null-pointer dereferences Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 27/59] exit: make setting exit_state consistent Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 28/59] tracing: Fix header include guards in trace event headers Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 29/59] drm/amdkfd: Fix byte align on VegaM Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 30/59] drm/amd/powerplay: fix null pointer dereference around dpm state relates Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 31/59] drm/amdgpu: fix error handling in amdgpu_cs_process_fence_dep Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 32/59] drm/amdgpu: fix a potential information leaking bug Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 33/59] ata: libahci: do not complain in case of deferred probe Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 34/59] kbuild: modpost: handle KBUILD_EXTRA_SYMBOLS only for external modules Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 35/59] kbuild: Check for unknown options with cc-option usage in Kconfig and clang Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 36/59] arm64/efi: fix variable 'si' set but not used Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 37/59] drm/vgem: fix cache synchronization on arm/arm64 Sasha Levin
2019-08-06 22:45   ` Rob Clark
2019-08-18  1:45     ` Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 38/59] riscv: Fix perf record without libelf support Sasha Levin
2019-08-06 21:32 ` [PATCH AUTOSEL 5.2 39/59] i2c: iproc: Fix i2c master read more than 63 bytes Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 40/59] arm64: Lower priority mask for GIC_PRIO_IRQON Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 41/59] arm64: unwind: Prohibit probing on return_address() Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 42/59] arm64/mm: fix variable 'pud' set but not used Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 43/59] arm64/mm: fix variable 'tag' " Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 44/59] IB/core: Add mitigation for Spectre V1 Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 45/59] IB/mlx5: Fix MR registration flow to use UMR properly Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 46/59] RDMA/restrack: Track driver QP types in resource tracker Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 47/59] IB/mad: Fix use-after-free in ib mad completion handling Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 48/59] RDMA/mlx5: Release locks during notifier unregister Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 49/59] drm: msm: Fix add_gpu_components Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 50/59] RDMA/hns: Fix error return code in hns_roce_v1_rsv_lp_qp() Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 51/59] drm/exynos: fix missing decrement of retry counter Sasha Levin
2019-08-07  8:49   ` David Laight
2019-08-18  1:47     ` Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 52/59] arm64: kprobes: Recover pstate.D in single-step exception handler Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 53/59] arm64: Make debug exception handlers visible from RCU Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 54/59] Revert "kmemleak: allow to coexist with fault injection" Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 55/59] ocfs2: remove set but not used variable 'last_hash' Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 56/59] page flags: prioritize kasan bits over last-cpuid Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 57/59] coredump: split pipe command whitespace before expanding template Sasha Levin
2019-08-07  1:41   ` Paul Wise
2019-08-18  1:48     ` Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 58/59] asm-generic: fix -Wtype-limits compiler warnings Sasha Levin
2019-08-06 21:33 ` [PATCH AUTOSEL 5.2 59/59] tpm: tpm_ibm_vtpm: Fix unallocated banks Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).