mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-22 02:20:40 +00:00
b85f751d71
[ Upstream commit349d43127d] A crash occurs when smc_cdc_tx_handler() tries to access smc_sock but smc_release() has already freed it. [ 4570.695099] BUG: unable to handle page fault for address: 000000002eae9e88 [ 4570.696048] #PF: supervisor write access in kernel mode [ 4570.696728] #PF: error_code(0x0002) - not-present page [ 4570.697401] PGD 0 P4D 0 [ 4570.697716] Oops: 0002 [#1] PREEMPT SMP NOPTI [ 4570.698228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc4+ #111 [ 4570.699013] Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 8c24b4c 04/0 [ 4570.699933] RIP: 0010:_raw_spin_lock+0x1a/0x30 <...> [ 4570.711446] Call Trace: [ 4570.711746] <IRQ> [ 4570.711992] smc_cdc_tx_handler+0x41/0xc0 [ 4570.712470] smc_wr_tx_tasklet_fn+0x213/0x560 [ 4570.712981] ? smc_cdc_tx_dismisser+0x10/0x10 [ 4570.713489] tasklet_action_common.isra.17+0x66/0x140 [ 4570.714083] __do_softirq+0x123/0x2f4 [ 4570.714521] irq_exit_rcu+0xc4/0xf0 [ 4570.714934] common_interrupt+0xba/0xe0 Though smc_cdc_tx_handler() checked the existence of smc connection, smc_release() may have already dismissed and released the smc socket before smc_cdc_tx_handler() further visits it. smc_cdc_tx_handler() |smc_release() if (!conn) | | |smc_cdc_tx_dismiss_slots() | smc_cdc_tx_dismisser() | |sock_put(&smc->sk) <- last sock_put, | smc_sock freed bh_lock_sock(&smc->sk) (panic) | To make sure we won't receive any CDC messages after we free the smc_sock, add a refcount on the smc_connection for inflight CDC message(posted to the QP but haven't received related CQE), and don't release the smc_connection until all the inflight CDC messages haven been done, for both success or failed ones. Using refcount on CDC messages brings another problem: when the link is going to be destroyed, smcr_link_clear() will reset the QP, which then remove all the pending CQEs related to the QP in the CQ. To make sure all the CQEs will always come back so the refcount on the smc_connection can always reach 0, smc_ib_modify_qp_reset() was replaced by smc_ib_modify_qp_error(). And remove the timeout in smc_wr_tx_wait_no_pending_sends() since we need to wait for all pending WQEs done, or we may encounter use-after- free when handling CQEs. For IB device removal routine, we need to wait for all the QPs on that device been destroyed before we can destroy CQs on the device, or the refcount on smc_connection won't reach 0 and smc_sock cannot be released. Fixes:5f08318f61("smc: connection data control (CDC)") Reported-by: Wen Gu <guwen@linux.alibaba.com> Signed-off-by: Dust Li <dust.li@linux.alibaba.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
97 lines
3.7 KiB
C
97 lines
3.7 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Shared Memory Communications over RDMA (SMC-R) and RoCE
|
|
*
|
|
* Definitions for IB environment
|
|
*
|
|
* Copyright IBM Corp. 2016
|
|
*
|
|
* Author(s): Ursula Braun <Ursula Braun@linux.vnet.ibm.com>
|
|
*/
|
|
|
|
#ifndef _SMC_IB_H
|
|
#define _SMC_IB_H
|
|
|
|
#include <linux/interrupt.h>
|
|
#include <linux/if_ether.h>
|
|
#include <linux/mutex.h>
|
|
#include <linux/wait.h>
|
|
#include <rdma/ib_verbs.h>
|
|
#include <net/smc.h>
|
|
|
|
#define SMC_MAX_PORTS 2 /* Max # of ports */
|
|
#define SMC_GID_SIZE sizeof(union ib_gid)
|
|
|
|
#define SMC_IB_MAX_SEND_SGE 2
|
|
|
|
struct smc_ib_devices { /* list of smc ib devices definition */
|
|
struct list_head list;
|
|
struct mutex mutex; /* protects list of smc ib devices */
|
|
};
|
|
|
|
extern struct smc_ib_devices smc_ib_devices; /* list of smc ib devices */
|
|
extern struct smc_lgr_list smc_lgr_list; /* list of linkgroups */
|
|
|
|
struct smc_ib_device { /* ib-device infos for smc */
|
|
struct list_head list;
|
|
struct ib_device *ibdev;
|
|
struct ib_port_attr pattr[SMC_MAX_PORTS]; /* ib dev. port attrs */
|
|
struct ib_event_handler event_handler; /* global ib_event handler */
|
|
struct ib_cq *roce_cq_send; /* send completion queue */
|
|
struct ib_cq *roce_cq_recv; /* recv completion queue */
|
|
struct tasklet_struct send_tasklet; /* called by send cq handler */
|
|
struct tasklet_struct recv_tasklet; /* called by recv cq handler */
|
|
char mac[SMC_MAX_PORTS][ETH_ALEN];
|
|
/* mac address per port*/
|
|
u8 pnetid[SMC_MAX_PORTS][SMC_MAX_PNETID_LEN];
|
|
/* pnetid per port */
|
|
bool pnetid_by_user[SMC_MAX_PORTS];
|
|
/* pnetid defined by user? */
|
|
u8 initialized : 1; /* ib dev CQ, evthdl done */
|
|
struct work_struct port_event_work;
|
|
unsigned long port_event_mask;
|
|
DECLARE_BITMAP(ports_going_away, SMC_MAX_PORTS);
|
|
atomic_t lnk_cnt; /* number of links on ibdev */
|
|
wait_queue_head_t lnks_deleted; /* wait 4 removal of all links*/
|
|
struct mutex mutex; /* protect dev setup+cleanup */
|
|
atomic_t lnk_cnt_by_port[SMC_MAX_PORTS];
|
|
/* number of links per port */
|
|
int ndev_ifidx[SMC_MAX_PORTS]; /* ndev if indexes */
|
|
};
|
|
|
|
struct smc_buf_desc;
|
|
struct smc_link;
|
|
|
|
void smc_ib_ndev_change(struct net_device *ndev, unsigned long event);
|
|
int smc_ib_register_client(void) __init;
|
|
void smc_ib_unregister_client(void);
|
|
bool smc_ib_port_active(struct smc_ib_device *smcibdev, u8 ibport);
|
|
int smc_ib_buf_map_sg(struct smc_link *lnk,
|
|
struct smc_buf_desc *buf_slot,
|
|
enum dma_data_direction data_direction);
|
|
void smc_ib_buf_unmap_sg(struct smc_link *lnk,
|
|
struct smc_buf_desc *buf_slot,
|
|
enum dma_data_direction data_direction);
|
|
void smc_ib_dealloc_protection_domain(struct smc_link *lnk);
|
|
int smc_ib_create_protection_domain(struct smc_link *lnk);
|
|
void smc_ib_destroy_queue_pair(struct smc_link *lnk);
|
|
int smc_ib_create_queue_pair(struct smc_link *lnk);
|
|
int smc_ib_ready_link(struct smc_link *lnk);
|
|
int smc_ib_modify_qp_rts(struct smc_link *lnk);
|
|
int smc_ib_modify_qp_reset(struct smc_link *lnk);
|
|
int smc_ib_modify_qp_error(struct smc_link *lnk);
|
|
long smc_ib_setup_per_ibdev(struct smc_ib_device *smcibdev);
|
|
int smc_ib_get_memory_region(struct ib_pd *pd, int access_flags,
|
|
struct smc_buf_desc *buf_slot, u8 link_idx);
|
|
void smc_ib_put_memory_region(struct ib_mr *mr);
|
|
void smc_ib_sync_sg_for_cpu(struct smc_link *lnk,
|
|
struct smc_buf_desc *buf_slot,
|
|
enum dma_data_direction data_direction);
|
|
void smc_ib_sync_sg_for_device(struct smc_link *lnk,
|
|
struct smc_buf_desc *buf_slot,
|
|
enum dma_data_direction data_direction);
|
|
int smc_ib_determine_gid(struct smc_ib_device *smcibdev, u8 ibport,
|
|
unsigned short vlan_id, u8 gid[], u8 *sgid_index);
|
|
bool smc_ib_is_valid_local_systemid(void);
|
|
int smcr_nl_get_device(struct sk_buff *skb, struct netlink_callback *cb);
|
|
#endif
|