Commit 61a09258 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma 

Pull rdma fixes from Jason Gunthorpe:
 "Nothing particularly exciting, some small ODP regressions from the mmu
  notifier rework, another bunch of syzkaller fixes, and a bug fix for a
  botched syzkaller fix in the first rc pull request.

   - Fix busted syzkaller fix in 'get_new_pps' - this turned out to
     crash on certain HW configurations

   - Bug fixes for various missed things in error unwinds

   - Add a missing rcu_read_lock annotation in hfi/qib

   - Fix two ODP related regressions from the recent mmu notifier
     changes

   - Several more syzkaller bugs in siw, RDMA netlink, verbs and iwcm

   - Revert an old patch in CMA as it is now shown to not be allocating
     port numbers properly"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/iwcm: Fix iwcm work deallocation
  RDMA/siw: Fix failure handling during device creation
  RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing
  RDMA/odp: Ensure the mm is still alive before creating an implicit child
  RDMA/core: Fix protection fault in ib_mr_pool_destroy
  IB/mlx5: Fix implicit ODP race
  IB/hfi1, qib: Ensure RCU is locked when accessing list
  RDMA/core: Fix pkey and port assignment in get_new_pps
  RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
  RDMA/rw: Fix error flow during RDMA context initialization
  RDMA/core: Fix use of logical OR in get_new_pps
  Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow"
parents c2003765 810dbc69

drivers/infiniband/core/cm.c

+1 −0
Original line number Diff line number Diff line
@@ -1191,6 +1191,7 @@ struct ib_cm_id *ib_cm_insert_listen(struct ib_device *device, 
			/* Sharing an ib_cm_id with different handlers is not

			 * supported */

			spin_unlock_irqrestore(&cm.lock, flags);

			ib_destroy_cm_id(cm_id);

			return ERR_PTR(-EINVAL);

		}

		refcount_inc(&cm_id_priv->refcount);

drivers/infiniband/core/cma.c

+11 −4
Original line number Diff line number Diff line
@@ -3212,19 +3212,26 @@ int rdma_resolve_addr(struct rdma_cm_id *id, struct sockaddr *src_addr, 
	int ret;



	id_priv = container_of(id, struct rdma_id_private, id);

	memcpy(cma_dst_addr(id_priv), dst_addr, rdma_addr_size(dst_addr));

	if (id_priv->state == RDMA_CM_IDLE) {

		ret = cma_bind_addr(id, src_addr, dst_addr);

		if (ret)

		if (ret) {

			memset(cma_dst_addr(id_priv), 0,

			       rdma_addr_size(dst_addr));

			return ret;

		}

	}



	if (cma_family(id_priv) != dst_addr->sa_family)

	if (cma_family(id_priv) != dst_addr->sa_family) {

		memset(cma_dst_addr(id_priv), 0, rdma_addr_size(dst_addr));

		return -EINVAL;

	}



	if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_ADDR_QUERY))

	if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_ADDR_QUERY)) {

		memset(cma_dst_addr(id_priv), 0, rdma_addr_size(dst_addr));

		return -EINVAL;

	}



	memcpy(cma_dst_addr(id_priv), dst_addr, rdma_addr_size(dst_addr));

	if (cma_any_addr(dst_addr)) {

		ret = cma_resolve_loopback(id_priv);

	} else {

drivers/infiniband/core/core_priv.h

+14 −0
Original line number Diff line number Diff line
@@ -338,6 +338,20 @@ static inline struct ib_qp *_ib_create_qp(struct ib_device *dev, 
	qp->pd = pd;

	qp->uobject = uobj;

	qp->real_qp = qp;



	qp->qp_type = attr->qp_type;

	qp->rwq_ind_tbl = attr->rwq_ind_tbl;

	qp->send_cq = attr->send_cq;

	qp->recv_cq = attr->recv_cq;

	qp->srq = attr->srq;

	qp->rwq_ind_tbl = attr->rwq_ind_tbl;

	qp->event_handler = attr->event_handler;



	atomic_set(&qp->usecnt, 0);

	spin_lock_init(&qp->mr_lock);

	INIT_LIST_HEAD(&qp->rdma_mrs);

	INIT_LIST_HEAD(&qp->sig_mrs);



	/*

	 * We don't track XRC QPs for now, because they don't have PD

	 * and more importantly they are created internaly by driver,

drivers/infiniband/core/iwcm.c

+3 −1
Original line number Diff line number Diff line
@@ -159,9 +159,11 @@ static void dealloc_work_entries(struct iwcm_id_private *cm_id_priv) 
{

	struct list_head *e, *tmp;



	list_for_each_safe(e, tmp, &cm_id_priv->work_free_list)

	list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) {

		list_del(e);

		kfree(list_entry(e, struct iwcm_work, free_list));

	}

}



static int alloc_work_entries(struct iwcm_id_private *cm_id_priv, int count)

{

drivers/infiniband/core/nldev.c

+2 −0
Original line number Diff line number Diff line
@@ -1757,6 +1757,8 @@ static int nldev_stat_set_doit(struct sk_buff *skb, struct nlmsghdr *nlh, 
		if (ret)

			goto err_msg;

	} else {

		if (!tb[RDMA_NLDEV_ATTR_RES_LQPN])

			goto err_msg;

		qpn = nla_get_u32(tb[RDMA_NLDEV_ATTR_RES_LQPN]);

		if (tb[RDMA_NLDEV_ATTR_STAT_COUNTER_ID]) {

			cntn = nla_get_u32(tb[RDMA_NLDEV_ATTR_STAT_COUNTER_ID]);

CRA Git | Maintained and supported by SUSTech CRA and CCSE