From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"Mike Marciniszyn" <mike.marciniszyn@intel.com>,
"Doug Ledford" <dledford@redhat.com>,
"Dennis Dalessandro" <dennis.dalessandro@intel.com>,
"Jason Gunthorpe" <jgunthorpe@obsidianresearch.com>
Subject: [PATCH 3.2 65/87] IB/qib: fix mcast detach when qp not attached
Date: Mon, 08 Feb 2016 23:53:51 +0000 [thread overview]
Message-ID: <lsq.1454975631.396488960@decadent.org.uk> (raw)
In-Reply-To: <lsq.1454975630.125133756@decadent.org.uk>
3.2.77-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marciniszyn <mike.marciniszyn@intel.com>
commit 09dc9cd6528f5b52bcbd3292a6312e762c85260f upstream.
The code produces the following trace:
[1750924.419007] general protection fault: 0000 [#3] SMP
[1750924.420364] Modules linked in: nfnetlink autofs4 rpcsec_gss_krb5 nfsv4
dcdbas rfcomm bnep bluetooth nfsd auth_rpcgss nfs_acl dm_multipath nfs lockd
scsi_dh sunrpc fscache radeon ttm drm_kms_helper drm serio_raw parport_pc
ppdev i2c_algo_bit lpc_ich ipmi_si ib_mthca ib_qib dca lp parport ib_ipoib
mac_hid ib_cm i3000_edac ib_sa ib_uverbs edac_core ib_umad ib_mad ib_core
ib_addr tg3 ptp dm_mirror dm_region_hash dm_log psmouse pps_core
[1750924.420364] CPU: 1 PID: 8401 Comm: python Tainted: G D
3.13.0-39-generic #66-Ubuntu
[1750924.420364] Hardware name: Dell Computer Corporation PowerEdge
860/0XM089, BIOS A04 07/24/2007
[1750924.420364] task: ffff8800366a9800 ti: ffff88007af1c000 task.ti:
ffff88007af1c000
[1750924.420364] RIP: 0010:[<ffffffffa0131d51>] [<ffffffffa0131d51>]
qib_mcast_qp_free+0x11/0x50 [ib_qib]
[1750924.420364] RSP: 0018:ffff88007af1dd70 EFLAGS: 00010246
[1750924.420364] RAX: 0000000000000001 RBX: ffff88007b822688 RCX:
000000000000000f
[1750924.420364] RDX: ffff88007b822688 RSI: ffff8800366c15a0 RDI:
6764697200000000
[1750924.420364] RBP: ffff88007af1dd78 R08: 0000000000000001 R09:
0000000000000000
[1750924.420364] R10: 0000000000000011 R11: 0000000000000246 R12:
ffff88007baa1d98
[1750924.420364] R13: ffff88003ecab000 R14: ffff88007b822660 R15:
0000000000000000
[1750924.420364] FS: 00007ffff7fd8740(0000) GS:ffff88007fc80000(0000)
knlGS:0000000000000000
[1750924.420364] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[1750924.420364] CR2: 00007ffff597c750 CR3: 000000006860b000 CR4:
00000000000007e0
[1750924.420364] Stack:
[1750924.420364] ffff88007b822688 ffff88007af1ddf0 ffffffffa0132429
000000007af1de20
[1750924.420364] ffff88007baa1dc8 ffff88007baa0000 ffff88007af1de70
ffffffffa00cb313
[1750924.420364] 00007fffffffde88 0000000000000000 0000000000000008
ffff88003ecab000
[1750924.420364] Call Trace:
[1750924.420364] [<ffffffffa0132429>] qib_multicast_detach+0x1e9/0x350
[ib_qib]
[1750924.568035] [<ffffffffa00cb313>] ? ib_uverbs_modify_qp+0x323/0x3d0
[ib_uverbs]
[1750924.568035] [<ffffffffa0092d61>] ib_detach_mcast+0x31/0x50 [ib_core]
[1750924.568035] [<ffffffffa00cc213>] ib_uverbs_detach_mcast+0x93/0x170
[ib_uverbs]
[1750924.568035] [<ffffffffa00c61f6>] ib_uverbs_write+0xc6/0x2c0 [ib_uverbs]
[1750924.568035] [<ffffffff81312e68>] ? apparmor_file_permission+0x18/0x20
[1750924.568035] [<ffffffff812d4cd3>] ? security_file_permission+0x23/0xa0
[1750924.568035] [<ffffffff811bd214>] vfs_write+0xb4/0x1f0
[1750924.568035] [<ffffffff811bdc49>] SyS_write+0x49/0xa0
[1750924.568035] [<ffffffff8172f7ed>] system_call_fastpath+0x1a/0x1f
[1750924.568035] Code: 66 2e 0f 1f 84 00 00 00 00 00 31 c0 5d c3 66 2e 0f 1f
84 00 00 00 00 00 66 90 0f 1f 44 00 00 55 48 89 e5 53 48 89 fb 48 8b 7f 10
<f0> ff 8f 40 01 00 00 74 0e 48 89 df e8 8e f8 06 e1 5b 5d c3 0f
[1750924.568035] RIP [<ffffffffa0131d51>] qib_mcast_qp_free+0x11/0x50
[ib_qib]
[1750924.568035] RSP <ffff88007af1dd70>
[1750924.650439] ---[ end trace 73d5d4b3f8ad4851 ]
The fix is to note the qib_mcast_qp that was found. If none is found, then
return EINVAL indicating the error.
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Reported-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/infiniband/hw/qib/qib_verbs_mcast.c | 35 +++++++++++++----------------
1 file changed, 15 insertions(+), 20 deletions(-)
--- a/drivers/infiniband/hw/qib/qib_verbs_mcast.c
+++ b/drivers/infiniband/hw/qib/qib_verbs_mcast.c
@@ -286,15 +286,13 @@ int qib_multicast_detach(struct ib_qp *i
struct qib_ibdev *dev = to_idev(ibqp->device);
struct qib_ibport *ibp = to_iport(ibqp->device, qp->port_num);
struct qib_mcast *mcast = NULL;
- struct qib_mcast_qp *p, *tmp;
+ struct qib_mcast_qp *p, *tmp, *delp = NULL;
struct rb_node *n;
int last = 0;
int ret;
- if (ibqp->qp_num <= 1 || qp->state == IB_QPS_RESET) {
- ret = -EINVAL;
- goto bail;
- }
+ if (ibqp->qp_num <= 1 || qp->state == IB_QPS_RESET)
+ return -EINVAL;
spin_lock_irq(&ibp->lock);
@@ -303,8 +301,7 @@ int qib_multicast_detach(struct ib_qp *i
while (1) {
if (n == NULL) {
spin_unlock_irq(&ibp->lock);
- ret = -EINVAL;
- goto bail;
+ return -EINVAL;
}
mcast = rb_entry(n, struct qib_mcast, rb_node);
@@ -328,6 +325,7 @@ int qib_multicast_detach(struct ib_qp *i
*/
list_del_rcu(&p->list);
mcast->n_attached--;
+ delp = p;
/* If this was the last attached QP, remove the GID too. */
if (list_empty(&mcast->qp_list)) {
@@ -338,15 +336,16 @@ int qib_multicast_detach(struct ib_qp *i
}
spin_unlock_irq(&ibp->lock);
+ /* QP not attached */
+ if (!delp)
+ return -EINVAL;
+ /*
+ * Wait for any list walkers to finish before freeing the
+ * list element.
+ */
+ wait_event(mcast->wait, atomic_read(&mcast->refcount) <= 1);
+ qib_mcast_qp_free(delp);
- if (p) {
- /*
- * Wait for any list walkers to finish before freeing the
- * list element.
- */
- wait_event(mcast->wait, atomic_read(&mcast->refcount) <= 1);
- qib_mcast_qp_free(p);
- }
if (last) {
atomic_dec(&mcast->refcount);
wait_event(mcast->wait, !atomic_read(&mcast->refcount));
@@ -355,11 +354,7 @@ int qib_multicast_detach(struct ib_qp *i
dev->n_mcast_grps_allocated--;
spin_unlock_irq(&dev->n_mcast_grps_lock);
}
-
- ret = 0;
-
-bail:
- return ret;
+ return 0;
}
int qib_mcast_tree_empty(struct qib_ibport *ibp)
next prev parent reply other threads:[~2016-02-09 0:03 UTC|newest]
Thread overview: 91+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-08 23:53 [PATCH 3.2 00/87] 3.2.77-rc1 review Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 72/87] crypto: hash - Add crypto_ahash_has_setkey Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 01/87] [media] gspca: ov534/topro: prevent a division by 0 Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 48/87] ALSA: timer: Fix race among timer ioctls Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 78/87] crypto: algif_skcipher - Remove custom release parent function Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 60/87] crypto: af_alg - Fix socket double-free when accept fails Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 18/87] futex: Drop refcount if requeue_pi() acquired the rtmutex Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 40/87] x86/mm: Add barriers and document switch_mm()-vs-flush synchronization Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 47/87] ALSA: timer: Fix double unlink of active_list Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 77/87] crypto: algif_hash - Remove custom release parent function Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 24/87] x86/LDT: Print the real LDT base address Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 38/87] uml: flush stdout before forking Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 11/87] rtlwifi: fix memory leak for USB device Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 29/87] NFS: Fix attribute cache revalidation Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 10/87] xhci: refuse loading if nousb is used Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 06/87] KVM: x86: correctly print #AC in traces Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 80/87] crypto: algif_hash - Fix race condition in hash_check_key Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 42/87] x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[] Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 15/87] powerpc: Make value-returning atomics fully ordered Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 68/87] crypto: algif_skcipher - Require setkey before accept(2) Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 28/87] rtlwifi: rtl8192cu: Add missing parameter setup Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 75/87] crypto: algif_skcipher - Add key check exception for cipher_null Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 81/87] crypto: algif_skcipher - Fix race condition in skcipher_check_key Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 67/87] ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 58/87] memcg: only free spare array when readers are done Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 63/87] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 21/87] udf: limit the maximum number of indirect extents in a row Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 05/87] KVM: x86: expose MSR_TSC_AUX to userspace Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 45/87] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 25/87] rtlwifi: rtl8192de: Fix incorrect module parameter descriptions Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 09/87] drm/radeon: call hpd_irq_event on resume Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 50/87] cifs: Ratelimit kernel log messages Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 13/87] wlcore/wl12xx: spi: fix oops on firmware load Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 52/87] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 32/87] udf: Prevent buffer overrun with multi-byte characters Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 34/87] power: test_power: correctly handle empty writes Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 86/87] [media] usbvision fix overflow of interfaces array Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 16/87] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 17/87] asix: silence log message from oversize packet Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 26/87] rtlwifi: rtl8192se: Fix module parameter initialization Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 56/87] ocfs2/dlm: ignore cleaning the migration mle that is inuse Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 74/87] crypto: skcipher - Add crypto_skcipher_has_setkey Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 64/87] ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0 Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 76/87] crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 55/87] scripts/bloat-o-meter: fix python3 syntax error Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 22/87] USB: cp210x: add ID for ELV Marble Sound Board 1 Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 70/87] crypto: af_alg - Add nokey compatibility path Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 35/87] locks: fix unlock when fcntl_setlk races with a close Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 41/87] x86/boot: Double BOOT_HEAP_SIZE to 64KB Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 39/87] ipv6: tcp: add rcu locking in tcp_v6_send_synack() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 73/87] crypto: algif_hash - Require setkey before accept(2) Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 19/87] ALSA: fm801: propagate TUNER_ONLY bit when autodetected Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 23/87] posix-clock: Fix return code on the poll method's error path Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 36/87] dm snapshot: fix hung bios when copy error occurs Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 85/87] [media] usbvision: fix leak of usb_dev on failure paths in usbvision_probe() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 62/87] ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 59/87] printk: help pr_debug and pr_devel to optimize out arguments Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 49/87] sparc64: fix incorrect sign extension in sys_sparc64_personality Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 44/87] ALSA: seq: Fix race at timer setup and close Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 20/87] drm/radeon: clean up fujitsu quirks Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 54/87] dma-debug: switch check from _text to _stext Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 71/87] crypto: algif_skcipher - Add nokey compatibility path Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 03/87] [media] rc: allow rc modules to be loaded if rc-main is not a module Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 12/87] wlcore: SPI - fix spi transfer_list Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 27/87] rtlwifi: rtl8192ce: Fix handling of module parameters Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 07/87] ath9k_htc: check for underflow in ath9k_htc_rx_msg() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 46/87] x86/mm: Improve switch_mm() barrier comments Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 30/87] Input: i8042 - add Fujitsu Lifebook U745 to the nomux list Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 53/87] m32r: fix m32104ut_defconfig build fail Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 33/87] udf: Check output buffer length when converting name to CS0 Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 08/87] mtd: nand: fix ONFI parameter page layout Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 83/87] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 69/87] crypto: af_alg - Disallow bind/setkey/... after accept(2) Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 43/87] ALSA: seq: Fix missing NULL check at remove_events ioctl Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 57/87] ALSA: timer: Harden slave timer list handling Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 79/87] crypto: af_alg - Forbid bind(2) when nokey child sockets are present Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 31/87] x86/xen: don't reset vcpu_info on a cancelled suspend Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 37/87] uml: fix hostfs mknod() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 87/87] [media] usbvision: fix crash on detecting device with invalid configuration Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 04/87] SCSI: initio: remove duplicate module device table Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 02/87] [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 84/87] [media] usbvision-video: fix memory leak of alt_max_pkt_size Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 51/87] cifs: fix race between call_async() and reconnect() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 66/87] IB/mlx4: Initialize hop_limit when creating address handle Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 14/87] EDAC: Robustify workqueues destruction Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 61/87] ALSA: hrtimer: Fix stall by hrtimer_cancel() Ben Hutchings
2016-02-08 23:53 ` [PATCH 3.2 82/87] crypto: algif_skcipher - Load TX SG list after waiting Ben Hutchings
2016-02-08 23:53 ` Ben Hutchings [this message]
2016-02-09 0:21 ` [PATCH 3.2 00/87] 3.2.77-rc1 review Ben Hutchings
2016-02-09 3:58 ` Guenter Roeck
2016-02-10 1:00 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1454975631.396488960@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=dennis.dalessandro@intel.com \
--cc=dledford@redhat.com \
--cc=jgunthorpe@obsidianresearch.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mike.marciniszyn@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®