Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3faa3d9a authored by Ira Weiny's avatar Ira Weiny Committed by Doug Ledford
Browse files

IB/hfi1: Make use of mm consistent 



The hfi1 driver registers a mmu_notifier callback when /dev/hfi1_* is
opened, and unregisters it when the device is closed.  The driver
incorrectly assumes that the close will always happen from the same
context as the open.  In particular, closes due to SIGKILL or OOM killer
activity may happen from a different context.  In these cases, the wrong
mm is passed to mmu_notifier_unregister(), which causes improper reference
counting for the victim mm, and eventual memory corruption.

Preserve the mm for all open file descriptors and use this mm rather than
current->mm for memory operations for the lifetime of that fd.  Note: this
patch leaves 1 use of current->mm in place.  This use is removed in a
follow on patch because other functional changes were required prior to
that use being removed.

If registration fails, there is no reason to keep the handler object
around.  Free the handler object rather than add it to the list to
prevent any mmu_notifier operations, including unregister, when
registration fails.

Suggested-by: default avatarJim Foraker <foraker1@llnl.gov>
Reviewed-by: default avatarDean Luick <dean.luick@intel.com>
Signed-off-by: default avatarIra Weiny <ira.weiny@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 7b3256e3

drivers/infiniband/hw/hfi1/file_ops.c

+4 −2
Original line number Diff line number Diff line
@@ -180,8 +180,10 @@ static int hfi1_file_open(struct inode *inode, struct file *fp) 


	fd = kzalloc(sizeof(*fd), GFP_KERNEL);



	if (fd) /* no cpu affinity by default */

		fd->rec_cpu_num = -1;

	if (fd) {

		fd->rec_cpu_num = -1; /* no cpu affinity by default */

		fd->mm = current->mm;

	}



	fp->private_data = fd;

drivers/infiniband/hw/hfi1/hfi.h

+5 −3
Original line number Diff line number Diff line
@@ -1205,6 +1205,7 @@ struct hfi1_filedata { 
	u32 invalid_tid_idx;

	/* protect invalid_tids array and invalid_tid_idx */

	spinlock_t invalid_lock;

	struct mm_struct *mm;

};



extern struct list_head hfi1_dev_list;
@@ -1700,9 +1701,10 @@ void shutdown_led_override(struct hfi1_pportdata *ppd); 
 */

#define DEFAULT_RCVHDR_ENTSIZE 32



bool hfi1_can_pin_pages(struct hfi1_devdata *dd, u32 nlocked, u32 npages);

int hfi1_acquire_user_pages(unsigned long vaddr, size_t npages, bool writable,

			    struct page **pages);

bool hfi1_can_pin_pages(struct hfi1_devdata *dd, struct mm_struct *mm,

			u32 nlocked, u32 npages);

int hfi1_acquire_user_pages(struct mm_struct *mm, unsigned long vaddr,

			    size_t npages, bool writable, struct page **pages);

void hfi1_release_user_pages(struct mm_struct *mm, struct page **p,

			     size_t npages, bool dirty);

drivers/infiniband/hw/hfi1/mmu_rb.c

+14 −4
Original line number Diff line number Diff line
@@ -58,6 +58,7 @@ struct mmu_rb_handler { 
	struct rb_root *root;

	spinlock_t lock;        /* protect the RB tree */

	struct mmu_rb_ops *ops;

	struct mm_struct *mm;

};



static LIST_HEAD(mmu_rb_handlers);
@@ -95,9 +96,11 @@ static unsigned long mmu_node_last(struct mmu_rb_node *node) 
	return PAGE_ALIGN(node->addr + node->len) - 1;

}



int hfi1_mmu_rb_register(struct rb_root *root, struct mmu_rb_ops *ops)

int hfi1_mmu_rb_register(struct mm_struct *mm, struct rb_root *root,

			 struct mmu_rb_ops *ops)

{

	struct mmu_rb_handler *handlr;

	int ret;



	handlr = kmalloc(sizeof(*handlr), GFP_KERNEL);

	if (!handlr)
@@ -108,11 +111,19 @@ int hfi1_mmu_rb_register(struct rb_root *root, struct mmu_rb_ops *ops) 
	INIT_HLIST_NODE(&handlr->mn.hlist);

	spin_lock_init(&handlr->lock);

	handlr->mn.ops = &mn_opts;

	handlr->mm = mm;



	ret = mmu_notifier_register(&handlr->mn, handlr->mm);

	if (ret) {

		kfree(handlr);

		return ret;

	}



	spin_lock(&mmu_rb_lock);

	list_add_tail_rcu(&handlr->list, &mmu_rb_handlers);

	spin_unlock(&mmu_rb_lock);



	return mmu_notifier_register(&handlr->mn, current->mm);

	return ret;

}



void hfi1_mmu_rb_unregister(struct rb_root *root)
@@ -126,8 +137,7 @@ void hfi1_mmu_rb_unregister(struct rb_root *root) 
		return;



	/* Unregister first so we don't get any more notifications. */

	if (current->mm)

		mmu_notifier_unregister(&handler->mn, current->mm);

	mmu_notifier_unregister(&handler->mn, handler->mm);



	spin_lock(&mmu_rb_lock);

	list_del_rcu(&handler->list);

drivers/infiniband/hw/hfi1/mmu_rb.h

+2 −1
Original line number Diff line number Diff line
@@ -65,7 +65,8 @@ struct mmu_rb_ops { 
	int (*invalidate)(struct rb_root *root, struct mmu_rb_node *node);

};



int hfi1_mmu_rb_register(struct rb_root *root, struct mmu_rb_ops *ops);

int hfi1_mmu_rb_register(struct mm_struct *mm, struct rb_root *root,

			 struct mmu_rb_ops *ops);

void hfi1_mmu_rb_unregister(struct rb_root *);

int hfi1_mmu_rb_insert(struct rb_root *, struct mmu_rb_node *);

void hfi1_mmu_rb_remove(struct rb_root *, struct mmu_rb_node *);

drivers/infiniband/hw/hfi1/user_exp_rcv.c

+8 −7
Original line number Diff line number Diff line
@@ -211,7 +211,8 @@ int hfi1_user_exp_rcv_init(struct file *fp) 
		 * fails, continue but turn off the TID caching for

		 * all user contexts.

		 */

		ret = hfi1_mmu_rb_register(&fd->tid_rb_root, &tid_rb_ops);

		ret = hfi1_mmu_rb_register(fd->mm, &fd->tid_rb_root,

					   &tid_rb_ops);

		if (ret) {

			dd_dev_info(dd,

				    "Failed MMU notifier registration %d\n",
@@ -399,12 +400,12 @@ int hfi1_user_exp_rcv_setup(struct file *fp, struct hfi1_tid_info *tinfo) 
	 * pages, accept the amount pinned so far and program only that.

	 * User space knows how to deal with partially programmed buffers.

	 */

	if (!hfi1_can_pin_pages(dd, fd->tid_n_pinned, npages)) {

	if (!hfi1_can_pin_pages(dd, fd->mm, fd->tid_n_pinned, npages)) {

		ret = -ENOMEM;

		goto bail;

	}



	pinned = hfi1_acquire_user_pages(vaddr, npages, true, pages);

	pinned = hfi1_acquire_user_pages(fd->mm, vaddr, npages, true, pages);

	if (pinned <= 0) {

		ret = pinned;

		goto bail;
@@ -559,7 +560,7 @@ int hfi1_user_exp_rcv_setup(struct file *fp, struct hfi1_tid_info *tinfo) 
	 * for example), unpin all unmapped pages so we can pin them nex time.

	 */

	if (mapped_pages != pinned) {

		hfi1_release_user_pages(current->mm, &pages[mapped_pages],

		hfi1_release_user_pages(fd->mm, &pages[mapped_pages],

					pinned - mapped_pages,

					false);

		fd->tid_n_pinned -= pinned - mapped_pages;
@@ -905,7 +906,7 @@ static int unprogram_rcvarray(struct file *fp, u32 tidinfo, 
	if (!node || node->rcventry != (uctxt->expected_base + rcventry))

		return -EBADF;

	if (HFI1_CAP_IS_USET(TID_UNMAP))

		tid_rb_remove(&fd->tid_rb_root, &node->mmu, NULL);

		tid_rb_remove(&fd->tid_rb_root, &node->mmu, fd->mm);

	else

		hfi1_mmu_rb_remove(&fd->tid_rb_root, &node->mmu);
@@ -933,7 +934,7 @@ static void clear_tid_node(struct hfi1_filedata *fd, struct tid_rb_node *node) 


	pci_unmap_single(dd->pcidev, node->dma_addr, node->mmu.len,

			 PCI_DMA_FROMDEVICE);

	hfi1_release_user_pages(current->mm, node->pages, node->npages, true);

	hfi1_release_user_pages(fd->mm, node->pages, node->npages, true);

	fd->tid_n_pinned -= node->npages;



	node->grp->used--;
@@ -970,7 +971,7 @@ static void unlock_exp_tids(struct hfi1_ctxtdata *uctxt, 
					continue;

				if (HFI1_CAP_IS_USET(TID_UNMAP))

					tid_rb_remove(&fd->tid_rb_root,

						      &node->mmu, NULL);

						      &node->mmu, fd->mm);

				else

					hfi1_mmu_rb_remove(&fd->tid_rb_root,

							   &node->mmu);