Skip to contentSkip to conversation

FAILED: patch "[PATCH] IB/hfi1, qib: Ensure RCU is locked when accessing list" failed to apply to 4.9-stable tree

PATCH [email protected] 1 participant 1 message Mar 10, 2020

Subsystems (3)
Stable branch InfiniBand HFI1 driver
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 817a68a6584aa08e323c64283fec5ded7be84759 Mon Sep 17 00:00:00 2001
From: Dennis Dalessandro <[email protected]>
Date: Tue, 25 Feb 2020 14:54:45 -0500
Subject: [PATCH] IB/hfi1, qib: Ensure RCU is locked when accessing list

The packet handling function, specifically the iteration of the qp list for mad packet processing misses locking RCU before running through the list. Not only is this incorrect, but the list_for_each_entry_rcu() call can not be called with a conditional check for lock dependency. Remedy this by invoking the rcu lock and unlock around the critical section.

This brings MAD packet processing in line with what is done for non-MAD packets.

Fixes 7724105686e7 ("IB/hfi1: add driver files")
Link https://lore.kernel.org/r/[email protected] open here
Reviewed-by Mike Marciniszyn <[email protected]>
Signed-off-by Dennis Dalessandro <[email protected]>
Signed-off-by Jason Gunthorpe <[email protected]>
drivers/infiniband/hw/hfi1/verbs.c +3 -1
index 089e201d7550..2f6323ad9c59 100644
@@ -515,10 +515,11 @@ static inline void hfi1_handle_packet(struct hfi1_packet *packet,
 				       opa_get_lid(packet->dlid, 9B));
 		if (!mcast)
 			goto drop;
+		rcu_read_lock();
 		list_for_each_entry_rcu(p, &mcast->qp_list, list) {
 			packet->qp = p->qp;
 			if (hfi1_do_pkey_check(packet))
-				goto drop;
+				goto unlock_drop;
 			spin_lock_irqsave(&packet->qp->r_lock, flags);
 			packet_handler = qp_ok(packet);
 			if (likely(packet_handler))

@@ -527,6 +528,7 @@ static inline void hfi1_handle_packet(struct hfi1_packet *packet,
 				ibp->rvp.n_pkt_drops++;
 			spin_unlock_irqrestore(&packet->qp->r_lock, flags);
 		}
+		rcu_read_unlock();
 		/*
 		 * Notify rvt_multicast_detach() if it is waiting for us
 		 * to finish.
drivers/infiniband/hw/qib/qib_verbs.c +2 -0
index 33778d451b82..5ef93f8f17a1 100644
@@ -329,8 +329,10 @@ void qib_ib_rcv(struct qib_ctxtdata *rcd, void *rhdr, void *data, u32 tlen)
 		if (mcast == NULL)
 			goto drop;
 		this_cpu_inc(ibp->pmastats->n_multicast_rcv);
+		rcu_read_lock();
 		list_for_each_entry_rcu(p, &mcast->qp_list, list)
 			qib_qp_rcv(rcd, hdr, 1, data, tlen, p->qp);
+		rcu_read_unlock();
 		/*
 		 * Notify rvt_multicast_detach() if it is waiting for us
 		 * to finish.