Skip to contentSkip to conversation

Patch "IB/mlx5: Serialize access to the VMA list" has been added to the 4.14-stable tree

PATCH [email protected] 1 participant 1 message Dec 30, 2017

Subsystems (3)
Stable branch InfiniBand Mellanox MLX5 IB driver
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

IB/mlx5: Serialize access to the VMA list

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ib-mlx5-serialize-access-to-the-vma-list.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From ad9a3668a434faca1339789ed2f043d679199309 Mon Sep 17 00:00:00 2001

From: Majd Dibbiny <[email protected]>
Date: Sun, 24 Dec 2017 13:54:56 +0200
Subject: IB/mlx5: Serialize access to the VMA list

From: Majd Dibbiny <[email protected]>

commit ad9a3668a434faca1339789ed2f043d679199309 upstream.

User-space applications can do mmap and munmap directly at any time.

Since the VMA list is not protected with a mutex, concurrent accesses to the VMA list from the mmap and munmap can cause data corruption. Add a mutex around the list.

Fixes 7c2344c3bbf9 ("IB/mlx5: Implements disassociate_ucontext API")
Reviewed-by Yishai Hadas <[email protected]>
Signed-off-by Majd Dibbiny <[email protected]>
Signed-off-by Leon Romanovsky <[email protected]>
Signed-off-by Jason Gunthorpe <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/infiniband/hw/mlx5/main.c    |    8 ++++++++
 drivers/infiniband/hw/mlx5/mlx5_ib.h |    4 ++++
 2 files changed, 12 insertions(+)
drivers/infiniband/hw/mlx5/main.c +8 -0
@@ -1415,6 +1415,7 @@ static struct ib_ucontext *mlx5_ib_alloc
 	}
 
 	INIT_LIST_HEAD(&context->vma_private_list);
+	mutex_init(&context->vma_private_list_mutex);
 	INIT_LIST_HEAD(&context->db_page_list);
 	mutex_init(&context->db_page_mutex);
 

@@ -1576,7 +1577,9 @@ static void  mlx5_ib_vma_close(struct vm
 	 * mlx5_ib_disassociate_ucontext().
 	 */
 	mlx5_ib_vma_priv_data->vma = NULL;
+	mutex_lock(mlx5_ib_vma_priv_data->vma_private_list_mutex);
 	list_del(&mlx5_ib_vma_priv_data->list);
+	mutex_unlock(mlx5_ib_vma_priv_data->vma_private_list_mutex);
 	kfree(mlx5_ib_vma_priv_data);
 }
 

@@ -1596,10 +1599,13 @@ static int mlx5_ib_set_vma_data(struct v
 		return -ENOMEM;
 
 	vma_prv->vma = vma;
+	vma_prv->vma_private_list_mutex = &ctx->vma_private_list_mutex;
 	vma->vm_private_data = vma_prv;
 	vma->vm_ops =  &mlx5_ib_vm_ops;
 
+	mutex_lock(&ctx->vma_private_list_mutex);
 	list_add(&vma_prv->list, vma_head);
+	mutex_unlock(&ctx->vma_private_list_mutex);
 
 	return 0;
 }

@@ -1642,6 +1648,7 @@ static void mlx5_ib_disassociate_ucontex
 	 * mlx5_ib_vma_close.
 	 */
 	down_write(&owning_mm->mmap_sem);
+	mutex_lock(&context->vma_private_list_mutex);
 	list_for_each_entry_safe(vma_private, n, &context->vma_private_list,
 				 list) {
 		vma = vma_private->vma;

@@ -1656,6 +1663,7 @@ static void mlx5_ib_disassociate_ucontex
 		list_del(&vma_private->list);
 		kfree(vma_private);
 	}
+	mutex_unlock(&context->vma_private_list_mutex);
 	up_write(&owning_mm->mmap_sem);
 	mmput(owning_mm);
 	put_task_struct(owning_process);
drivers/infiniband/hw/mlx5/mlx5_ib.h +4 -0
@@ -115,6 +115,8 @@ enum {
 struct mlx5_ib_vma_private_data {
 	struct list_head list;
 	struct vm_area_struct *vma;
+	/* protect vma_private_list add/del */
+	struct mutex *vma_private_list_mutex;
 };
 
 struct mlx5_ib_ucontext {

@@ -129,6 +131,8 @@ struct mlx5_ib_ucontext {
 	/* Transport Domain number */
 	u32			tdn;
 	struct list_head	vma_private_list;
+	/* protect vma_private_list add/del */
+	struct mutex		vma_private_list_mutex;
 
 	unsigned long		upd_xlt_page;
 	/* protect ODP/KSM */

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/ib-mlx5-serialize-access-to-the-vma-list.patch