kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/infiniband/hw
History
Michael J. Ruhl 6763372b81 IB/hfi1: Eliminate races in the SDMA send error path 
commit a0e0cb8280 upstream.

pq_update() can only be called in two places: from the completion
function when the complete (npkts) sequence of packets has been
submitted and processed, or from setup function if a subset of the
packets were submitted (i.e. the error path).

Currently both paths can call pq_update() if an error occurrs.  This
race will cause the n_req value to go negative, hanging file_close(),
or cause a crash by freeing the txlist more than once.

Several variables are used to determine SDMA send state.  Most of
these are unnecessary, and have code inspectible races between the
setup function and the completion function, in both the send path and
the error path.

The request 'status' value can be set by the setup or by the
completion function.  This is code inspectibly racy.  Since the status
is not needed in the completion code or by the caller it has been
removed.

The request 'done' value races between usage by the setup and the
completion function.  The completion function does not need this.
When the number of processed packets matches npkts, it is done.

The 'has_error' value races between usage of the setup and the
completion function.  This can cause incorrect error handling and leave
the n_req in an incorrect value (i.e. negative).

Simplify the code by removing all of the unneeded state checks and
variables.

Clean up iovs node when it is freed.

Eliminate race conditions in the error path:

If all packets are submitted, the completion handler will set the
completion status correctly (ok or aborted).

If all packets are not submitted, the caller must wait until the
submitted packets have completed, and then set the completion status.

These two change eliminate the race condition in the error path.

Reviewed-by: Mitko Haralanov <mitko.haralanov@intel.com>
Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2018-12-01 09:37:30 +01:00
..
bnxt_re RDMA/bnxt_re: Fix recursive lock warning in debug kernel 2018-11-13 11:08:33 -08:00
cxgb3 RDMA/providers: Remove pointless functions 2018-07-30 20:31:54 -06:00
cxgb4 iw_cxgb4: only allow 1 flush on user qps 2018-09-04 15:07:56 -06:00
hfi1 IB/hfi1: Eliminate races in the SDMA send error path 2018-12-01 09:37:30 +01:00
hns Merge branch 'linus/master' into rdma.git for-next 2018-08-16 14:21:29 -06:00
i40iw RDMA/providers: Remove pointless functions 2018-07-30 20:31:54 -06:00
mlx4 RDMA/mlx4: Ensure that maximal send/receive SGE less than supported by HW 2018-09-06 13:16:12 -06:00
mlx5 IB/mlx5: Fix MR cache initialization 2018-11-13 11:08:43 -08:00
mthca RDMA/providers: Fix return value from create_srq callbacks 2018-07-30 20:29:45 -06:00
nes RDMA/providers: Remove pointless functions 2018-07-30 20:31:54 -06:00
ocrdma RDMA/providers: Remove pointless functions 2018-07-30 20:31:54 -06:00
qedr Linux 4.18 2018-08-16 13:12:00 -06:00
qib RDMA: Constify the argument of the work request conversion functions 2018-07-30 20:00:20 -06:00
usnic RDMA, core and ULPs: Declare ib_post_send() and ib_post_recv() arguments const 2018-07-30 20:09:34 -06:00
vmw_pvrdma RDMA/providers: Remove pointless functions 2018-07-30 20:31:54 -06:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00