Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 28a0ea77 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma 

Pull rdma fixes from Jason Gunthorpe:
 "This fixes one major regression with NFS and mlx4 due to the max_sg
  rework in this merge window, tidies a few minor error_path
  regressions, and various small fixes.

  The HFI1 driver is broken this cycle due to a regression caused by a
  PCI change, it is looking like Bjorn will merge a fix for this. Also,
  the lingering ipoib issue I mentioned earlier still remains unfixed.

  Summary:

   - Fix possible FD type confusion crash

   - Fix a user trigger-able crash in cxgb4

   - Fix bad handling of IOMMU resources causing user controlled leaking
     in bnxt

   - Add missing locking in ipoib to fix a rare 'stuck tx' situation

   - Add missing locking in cma

   - Add two missing missing uverbs cleanups on failure paths,
     regressions from this merge window

   - Fix a regression from this merge window that caused RDMA NFS to not
     work with the mlx4 driver due to the max_sg changes"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/mlx4: Ensure that maximal send/receive SGE less than supported by HW
  RDMA/cma: Protect cma dev list with lock
  RDMA/uverbs: Fix error cleanup path of ib_uverbs_add_one()
  bnxt_re: Fix couple of memory leaks that could lead to IOMMU call traces
  IB/ipoib: Avoid a race condition between start_xmit and cm_rep_handler
  iw_cxgb4: only allow 1 flush on user qps
  IB/core: Release object lock if destroy failed
  RDMA/ucma: check fd type in ucma_migrate_id()
parents 11da3a7f 8f28b178

drivers/infiniband/core/cma.c

+7 −5
Original line number Diff line number Diff line
@@ -724,6 +724,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) 
	dgid = (union ib_gid *) &addr->sib_addr;

	pkey = ntohs(addr->sib_pkey);



	mutex_lock(&lock);

	list_for_each_entry(cur_dev, &dev_list, list) {

		for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) {

			if (!rdma_cap_af_ib(cur_dev->device, p))
@@ -750,18 +751,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) 
					cma_dev = cur_dev;

					sgid = gid;

					id_priv->id.port_num = p;

					goto found;

				}

			}

		}

	}



	if (!cma_dev)

	mutex_unlock(&lock);

	return -ENODEV;



found:

	cma_attach_to_dev(id_priv, cma_dev);

	mutex_unlock(&lock);

	addr = (struct sockaddr_ib *)cma_src_addr(id_priv);

	memcpy(&addr->sib_addr, &sgid, sizeof sgid);

	memcpy(&addr->sib_addr, &sgid, sizeof(sgid));

	cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr);

	return 0;

}

drivers/infiniband/core/rdma_core.c

+2 −0
Original line number Diff line number Diff line
@@ -882,6 +882,8 @@ static int __uverbs_cleanup_ufile(struct ib_uverbs_file *ufile, 
		WARN_ON(uverbs_try_lock_object(obj, UVERBS_LOOKUP_WRITE));

		if (!uverbs_destroy_uobject(obj, reason))

			ret = 0;

		else

			atomic_set(&obj->usecnt, 0);

	}

	return ret;

}

drivers/infiniband/core/ucma.c

+6 −0
Original line number Diff line number Diff line
@@ -124,6 +124,8 @@ static DEFINE_MUTEX(mut); 
static DEFINE_IDR(ctx_idr);

static DEFINE_IDR(multicast_idr);



static const struct file_operations ucma_fops;



static inline struct ucma_context *_ucma_find_context(int id,

						      struct ucma_file *file)

{
@@ -1581,6 +1583,10 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, 
	f = fdget(cmd.fd);

	if (!f.file)

		return -ENOENT;

	if (f.file->f_op != &ucma_fops) {

		ret = -EINVAL;

		goto file_put;

	}



	/* Validate current fd and prevent destruction of id. */

	ctx = ucma_get_ctx(f.file->private_data, cmd.id);

drivers/infiniband/core/uverbs_main.c

+2 −3
Original line number Diff line number Diff line
@@ -1050,7 +1050,7 @@ static void ib_uverbs_add_one(struct ib_device *device) 
	uverbs_dev->num_comp_vectors = device->num_comp_vectors;



	if (ib_uverbs_create_uapi(device, uverbs_dev))

		goto err;

		goto err_uapi;



	cdev_init(&uverbs_dev->cdev, NULL);

	uverbs_dev->cdev.owner = THIS_MODULE;
@@ -1077,11 +1077,10 @@ static void ib_uverbs_add_one(struct ib_device *device) 


err_class:

	device_destroy(uverbs_class, uverbs_dev->cdev.dev);



err_cdev:

	cdev_del(&uverbs_dev->cdev);

err_uapi:

	clear_bit(devnum, dev_map);



err:

	if (atomic_dec_and_test(&uverbs_dev->refcount))

		ib_uverbs_comp_dev(uverbs_dev);

drivers/infiniband/hw/bnxt_re/ib_verbs.c

+2 −0
Original line number Diff line number Diff line
@@ -833,6 +833,8 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp) 
				"Failed to destroy Shadow QP");

			return rc;

		}

		bnxt_qplib_free_qp_res(&rdev->qplib_res,

				       &rdev->qp1_sqp->qplib_qp);

		mutex_lock(&rdev->qp_lock);

		list_del(&rdev->qp1_sqp->list);

		atomic_dec(&rdev->qp_count);