1. 22 Aug, 2017 8 commits
  2. 18 Aug, 2017 26 commits
  3. 17 Aug, 2017 1 commit
  4. 16 Aug, 2017 5 commits
    • Maor Gottlieb's avatar
      IB/uverbs: Fix NULL pointer dereference during device removal · 870201f9
      Maor Gottlieb authored
      As part of ib_uverbs_remove_one which might be triggered upon
      reset flow, we trigger IB_EVENT_DEVICE_FATAL event to userspace
      application.
      If device was removed after uverbs fd was opened but before
      ib_uverbs_get_context was called, the event file will be accessed
      before it was allocated, result in NULL pointer dereference:
      
      [ 72.325873] BUG: unable to handle kernel NULL pointer dereference at (null)
      ...
      [ 72.325984] IP: _raw_spin_lock_irqsave+0x22/0x40
      [ 72.327123] Call Trace:
      [ 72.327168] ib_uverbs_async_handler.isra.8+0x2e/0x160 [ib_uverbs]
      [ 72.327216] ? synchronize_srcu_expedited+0x27/0x30
      [ 72.327269] ib_uverbs_remove_one+0x120/0x2c0 [ib_uverbs]
      [ 72.327330] ib_unregister_device+0xd0/0x180 [ib_core]
      [ 72.327373] mlx5_ib_remove+0x74/0x140 [mlx5_ib]
      [ 72.327422] mlx5_remove_device+0xfb/0x110 [mlx5_core]
      [ 72.327466] mlx5_unregister_interface+0x3c/0xa0 [mlx5_core]
      [ 72.327509] mlx5_ib_cleanup+0x10/0x962 [mlx5_ib]
      [ 72.327546] SyS_delete_module+0x155/0x230
      [ 72.328472] ? exit_to_usermode_loop+0x70/0xa6
      [ 72.329370] do_syscall_64+0x54/0xc0
      [ 72.330262] entry_SYSCALL64_slow_path+0x25/0x25
      
      Fix it by checking that user context was allocated before
      trigger the event.
      
      Fixes: 036b1063 ('IB/uverbs: Enable device removal when there are active user space applications')
      Signed-off-by: default avatarMaor Gottlieb <maorg@mellanox.com>
      Reviewed-by: default avatarMatan Barak <matanb@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      870201f9
    • Shiraz Saleem's avatar
      IB/core: Protect sysfs entry on ib_unregister_device · 06f8174a
      Shiraz Saleem authored
      ib_unregister_device is not protecting removal of sysfs entries.
      A call to ib_register_device in that window can result in
      duplicate sysfs entry warning. Move mutex_unlock to after
      ib_device_unregister_sysfs to protect against sysfs entry creation.
      
      This issue is exposed during driver load/unload stress test.
      
      WARNING: CPU: 5 PID: 4445 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x5f/0x70
      sysfs: cannot create duplicate filename '/class/infiniband/i40iw0'
      Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./Q87M-D2H
      BIOS F7 01/17/2014
      Workqueue: i40e i40e_service_task [i40e]
      Call Trace:
      dump_stack+0x67/0x98
      __warn+0xcc/0xf0
      warn_slowpath_fmt+0x4a/0x50
      ? kernfs_path_from_node+0x4b/0x60
      sysfs_warn_dup+0x5f/0x70
      sysfs_do_create_link_sd.isra.2+0xb7/0xc0
      sysfs_create_link+0x20/0x40
      device_add+0x28c/0x600
      ib_device_register_sysfs+0x58/0x170 [ib_core]
      ib_register_device+0x325/0x570 [ib_core]
      ? i40iw_register_rdma_device+0x1f4/0x400 [i40iw]
      ? kmem_cache_alloc_trace+0x143/0x330
      ? __raw_spin_lock_init+0x2d/0x50
      i40iw_register_rdma_device+0x2dc/0x400 [i40iw]
      i40iw_open+0x10a6/0x1950 [i40iw]
      ? i40iw_open+0xeab/0x1950 [i40iw]
      ? i40iw_make_cm_node+0x9c0/0x9c0 [i40iw]
      i40e_client_subtask+0xa4/0x110 [i40e]
      i40e_service_task+0xc2d/0x1320 [i40e]
      process_one_work+0x203/0x710
      ? process_one_work+0x16f/0x710
      worker_thread+0x126/0x4a0
      ? trace_hardirqs_on+0xd/0x10
      kthread+0x112/0x150
      ? process_one_work+0x710/0x710
      ? kthread_create_on_node+0x40/0x40
      ret_from_fork+0x2e/0x40
      ---[ end trace fd11b69e21ea7653 ]---
      Couldn't register device i40iw0 with driver model
      Signed-off-by: default avatarShiraz Saleem <shiraz.saleem@intel.com>
      Signed-off-by: default avatarSindhu Devale <sindhu.devale@intel.com>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      06f8174a
    • Steve Wise's avatar
      iw_cxgb4: fix misuse of integer variable · d4ba61d2
      Steve Wise authored
      Fixes: ee30f7d5 ("iw_cxgb4: Max fastreg depth depends on DSGL support")
      Signed-off-by: default avatarSteve Wise <swise@opengridcomputing.com>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      d4ba61d2
    • Colin Ian King's avatar
      IB/hns: fix memory leak on ah on error return path · 5b59a396
      Colin Ian King authored
      When dmac is NULL, ah is not being freed on the error return path. Fix
      this by kfree'ing it.
      
      Detected by CoverityScan, CID#1452636 ("Resource Leak")
      
      Fixes: d8966fcd ("IB/core: Use rdma_ah_attr accessor functions")
      Signed-off-by: default avatarColin Ian King <colin.king@canonical.com>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      5b59a396
    • Christopher N Bednarz's avatar
      i40iw: Fix potential fcn_id_array out of bounds · aa939c12
      Christopher N Bednarz authored
      Avoid out of bounds error by utilizing I40IW_MAX_STATS_COUNT
      instead of I40IW_INVALID_FCN_ID.
      Signed-off-by: default avatarChristopher N Bednarz <christoper.n.bednarz@intel.com>
      Signed-off-by: default avatarHenry Orosco <henry.orosco@intel.com>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      aa939c12