Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8a8c600d authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma 

Pull rdma fixes from Jason Gunthorpe:
 "The usual collection of driver bug fixes, and a few regressions from
  the merge window. Nothing particularly worrisome.

   - Various missed memory frees and error unwind bugs

   - Fix regressions in a few iwarp drivers from 5.4 patches

   - A few regressions added in past kernels

   - Squash a number of races in mlx5 ODP code"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/mlx5: Add missing synchronize_srcu() for MW cases
  RDMA/mlx5: Put live in the correct place for ODP MRs
  RDMA/mlx5: Order num_pending_prefetch properly with synchronize_srcu
  RDMA/odp: Lift umem_mutex out of ib_umem_odp_unmap_dma_pages()
  RDMA/mlx5: Fix a race with mlx5_ib_update_xlt on an implicit MR
  RDMA/mlx5: Do not allow rereg of a ODP MR
  IB/core: Fix wrong iterating on ports
  RDMA/nldev: Reshuffle the code to avoid need to rebind QP in error path
  RDMA/cxgb4: Do not dma memory off of the stack
  RDMA/cm: Fix memory leak in cm_add/remove_one
  RDMA/core: Fix an error handling path in 'res_get_common_doit()'
  RDMA/i40iw: Associate ibdev to netdev before IB device registration
  RDMA/iwcm: Fix a lock inversion issue
  RDMA/iw_cxgb4: fix SRQ access from dump_qp()
  RDMA/hfi1: Prevent memory leak in sdma_init
  RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port
  RDMA/siw: Fix serialization issue in write_space()
  RDMA/vmw_pvrdma: Free SRQ only once
parents e60329c9 04177915

drivers/infiniband/core/cm.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -4399,6 +4399,7 @@ static void cm_add_one(struct ib_device *ib_device) 
error1:

error1:

	port_modify.set_port_cap_mask = 0;

	port_modify.set_port_cap_mask = 0;

	port_modify.clr_port_cap_mask = IB_PORT_CM_SUP;

	port_modify.clr_port_cap_mask = IB_PORT_CM_SUP;

	kfree(port);

	while (--i) {

	while (--i) {

		if (!rdma_cap_ib_cm(ib_device, i))

		if (!rdma_cap_ib_cm(ib_device, i))

			continue;

			continue;
@@ -4407,6 +4408,7 @@ static void cm_add_one(struct ib_device *ib_device) 
		ib_modify_port(ib_device, port->port_num, 0, &port_modify);

		ib_modify_port(ib_device, port->port_num, 0, &port_modify);

		ib_unregister_mad_agent(port->mad_agent);

		ib_unregister_mad_agent(port->mad_agent);

		cm_remove_port_fs(port);

		cm_remove_port_fs(port);

		kfree(port);

	}

	}

free:

free:

	kfree(cm_dev);

	kfree(cm_dev);
@@ -4460,6 +4462,7 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data) 
		spin_unlock_irq(&cm.state_lock);

		spin_unlock_irq(&cm.state_lock);

		ib_unregister_mad_agent(cur_mad_agent);

		ib_unregister_mad_agent(cur_mad_agent);

		cm_remove_port_fs(port);

		cm_remove_port_fs(port);

		kfree(port);

	}

	}





	kfree(cm_dev);

	kfree(cm_dev);

drivers/infiniband/core/cma.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -2396,9 +2396,10 @@ static int iw_conn_req_handler(struct iw_cm_id *cm_id, 
		conn_id->cm_id.iw = NULL;

		conn_id->cm_id.iw = NULL;

		cma_exch(conn_id, RDMA_CM_DESTROYING);

		cma_exch(conn_id, RDMA_CM_DESTROYING);

		mutex_unlock(&conn_id->handler_mutex);

		mutex_unlock(&conn_id->handler_mutex);

		mutex_unlock(&listen_id->handler_mutex);

		cma_deref_id(conn_id);

		cma_deref_id(conn_id);

		rdma_destroy_id(&conn_id->id);

		rdma_destroy_id(&conn_id->id);

		goto out;

		return ret;

	}

	}





	mutex_unlock(&conn_id->handler_mutex);

	mutex_unlock(&conn_id->handler_mutex);

drivers/infiniband/core/device.c

+5 −4
Original line number Original line Diff line number Diff line
@@ -1987,8 +1987,6 @@ static int iw_query_port(struct ib_device *device, 
	if (!netdev)

	if (!netdev)

		return -ENODEV;

		return -ENODEV;





	dev_put(netdev);



	port_attr->max_mtu = IB_MTU_4096;

	port_attr->max_mtu = IB_MTU_4096;

	port_attr->active_mtu = ib_mtu_int_to_enum(netdev->mtu);

	port_attr->active_mtu = ib_mtu_int_to_enum(netdev->mtu);
@@ -1996,19 +1994,22 @@ static int iw_query_port(struct ib_device *device, 
		port_attr->state = IB_PORT_DOWN;

		port_attr->state = IB_PORT_DOWN;

		port_attr->phys_state = IB_PORT_PHYS_STATE_DISABLED;

		port_attr->phys_state = IB_PORT_PHYS_STATE_DISABLED;

	} else {

	} else {

		inetdev = in_dev_get(netdev);

		rcu_read_lock();

		inetdev = __in_dev_get_rcu(netdev);





		if (inetdev && inetdev->ifa_list) {

		if (inetdev && inetdev->ifa_list) {

			port_attr->state = IB_PORT_ACTIVE;

			port_attr->state = IB_PORT_ACTIVE;

			port_attr->phys_state = IB_PORT_PHYS_STATE_LINK_UP;

			port_attr->phys_state = IB_PORT_PHYS_STATE_LINK_UP;

			in_dev_put(inetdev);

		} else {

		} else {

			port_attr->state = IB_PORT_INIT;

			port_attr->state = IB_PORT_INIT;

			port_attr->phys_state =

			port_attr->phys_state =

				IB_PORT_PHYS_STATE_PORT_CONFIGURATION_TRAINING;

				IB_PORT_PHYS_STATE_PORT_CONFIGURATION_TRAINING;

		}

		}



		rcu_read_unlock();

	}

	}





	dev_put(netdev);

	err = device->ops.query_port(device, port_num, port_attr);

	err = device->ops.query_port(device, port_num, port_attr);

	if (err)

	if (err)

		return err;

		return err;

drivers/infiniband/core/nldev.c

+5 −7
Original line number Original line Diff line number Diff line
@@ -1230,7 +1230,7 @@ static int res_get_common_doit(struct sk_buff *skb, struct nlmsghdr *nlh, 
	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);

	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);

	if (!msg) {

	if (!msg) {

		ret = -ENOMEM;

		ret = -ENOMEM;

		goto err;

		goto err_get;

	}

	}





	nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq,

	nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq,
@@ -1787,10 +1787,6 @@ static int nldev_stat_del_doit(struct sk_buff *skb, struct nlmsghdr *nlh, 




	cntn = nla_get_u32(tb[RDMA_NLDEV_ATTR_STAT_COUNTER_ID]);

	cntn = nla_get_u32(tb[RDMA_NLDEV_ATTR_STAT_COUNTER_ID]);

	qpn = nla_get_u32(tb[RDMA_NLDEV_ATTR_RES_LQPN]);

	qpn = nla_get_u32(tb[RDMA_NLDEV_ATTR_RES_LQPN]);

	ret = rdma_counter_unbind_qpn(device, port, qpn, cntn);

	if (ret)

		goto err_unbind;



	if (fill_nldev_handle(msg, device) ||

	if (fill_nldev_handle(msg, device) ||

	    nla_put_u32(msg, RDMA_NLDEV_ATTR_PORT_INDEX, port) ||

	    nla_put_u32(msg, RDMA_NLDEV_ATTR_PORT_INDEX, port) ||

	    nla_put_u32(msg, RDMA_NLDEV_ATTR_STAT_COUNTER_ID, cntn) ||

	    nla_put_u32(msg, RDMA_NLDEV_ATTR_STAT_COUNTER_ID, cntn) ||
@@ -1799,13 +1795,15 @@ static int nldev_stat_del_doit(struct sk_buff *skb, struct nlmsghdr *nlh, 
		goto err_fill;

		goto err_fill;

	}

	}





	ret = rdma_counter_unbind_qpn(device, port, qpn, cntn);

	if (ret)

		goto err_fill;



	nlmsg_end(msg, nlh);

	nlmsg_end(msg, nlh);

	ib_device_put(device);

	ib_device_put(device);

	return rdma_nl_unicast(sock_net(skb->sk), msg, NETLINK_CB(skb).portid);

	return rdma_nl_unicast(sock_net(skb->sk), msg, NETLINK_CB(skb).portid);





err_fill:

err_fill:

	rdma_counter_bind_qpn(device, port, qpn, cntn);

err_unbind:

	nlmsg_free(msg);

	nlmsg_free(msg);

err:

err:

	ib_device_put(device);

	ib_device_put(device);

drivers/infiniband/core/security.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -426,7 +426,7 @@ int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev) 
	int ret;

	int ret;





	rdma_for_each_port (dev, i) {

	rdma_for_each_port (dev, i) {

		is_ib = rdma_protocol_ib(dev, i++);

		is_ib = rdma_protocol_ib(dev, i);

		if (is_ib)

		if (is_ib)

			break;

			break;

	}

	}