diff mbox series

[rdma-next] RDMA/uverbs: Store PR pointer before it is overwritten

Message ID 20190221160742.3036-1-leon@kernel.org (mailing list archive)
State Mainlined
Commit 25fd08eb2be0fcebd5ab7bb8e1d4fe228c6739d0
Delegated to: Jason Gunthorpe
Headers show
Series [rdma-next] RDMA/uverbs: Store PR pointer before it is overwritten | expand

Commit Message

Leon Romanovsky Feb. 21, 2019, 4:07 p.m. UTC 
From: Leon Romanovsky <leonro@mellanox.com>

The IB_MR_REREG_PD command rewrites mr->pd after successful rereg_user_mr(),
such change causes to lost usecnt information and produce the following warning,

[58060.273960] WARNING: CPU: 1 PID: 1771 at
drivers/infiniband/core/verbs.c:336 ib_dealloc_pd+0x4e/0x60 [ib_core]
[58060.283241] CPU: 1 PID: 1771 Comm: rereg_mr Tainted: G        W  OE 5.0.0-rc7-for-upstream-perf-2019-02-20_14-03-40-34 #1
[58060.284467] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
[58060.285691] RIP: 0010:ib_dealloc_pd+0x4e/0x60 [ib_core]
[58060.286890] Code: 00 00 00 00 8b 43 18 85 c0 75 1f 48 8d 7b 28 e8 88
d7 01 00 48 8b 43 08 48 89 df ff 90 f8 00 00 00 48 89 df 5b e9 b2 97 c4
e0 <0f> 0b eb dd 0f 0b eb ca 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00
[58060.289293] RSP: 0018:ffffc90003923dc0 EFLAGS: 00010286
[58060.290490] RAX: 00000000ffffffff RBX: ffff88821f7f0400 RCX: ffff888236a40c00
[58060.291668] RDX: ffff88821f7f0400 RSI: 0000000000000001 RDI: 0000000000000000
[58060.292838] RBP: 0000000000000001 R08: ffff88835f665d80 R09: ffff8882209c90d8
[58060.294007] R10: ffff88835ec003e0 R11: 0000000000000000 R12: ffff888221680ba0
[58060.295132] R13: ffff888221680b00 R14: 00000000ffffffea R15: ffff88821f53c318
[58060.296220] FS:  00007f70db11e740(0000) GS:ffff88835f640000(0000) knlGS:0000000000000000
[58060.297321] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[58060.298435] CR2: 0000000001dfd030 CR3: 000000029d9d8000 CR4: 00000000000006e0
[58060.299544] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[58060.300638] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[58060.301718] Call Trace:
[58060.302813]  uverbs_free_pd+0x2d/0x30 [ib_uverbs]
[58060.303909]  destroy_hw_idr_uobject+0x16/0x40 [ib_uverbs]
[58060.305000]  uverbs_destroy_uobject+0x28/0x170 [ib_uverbs]
[58060.306099]  __uverbs_cleanup_ufile+0x6b/0x90 [ib_uverbs]
[58060.307144]  uverbs_destroy_ufile_hw+0x8b/0x110 [ib_uverbs]
[58060.308168]  ib_uverbs_close+0x1f/0x80 [ib_uverbs]
[58060.309191]  __fput+0xb1/0x220
[58060.310216]  task_work_run+0x7f/0xa0
[58060.311227]  exit_to_usermode_loop+0x6b/0xb2
[58060.312237]  do_syscall_64+0xc5/0x100
[58060.313249]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[58060.314275] RIP: 0033:0x7f70dad00664
[58060.315293] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f
80 00 00 00 00 8b 05 6a cd 20 00 48 63 ff 85 c0 75 13 b8 03 00 00 00 0f
05 <48> 3d 00 f0 ff ff 77 44 f3 c3 66 90 48 83 ec 18 48 89 7c 24 08 e8
[58060.317403] RSP: 002b:00007fff1c3ac308 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[58060.318470] RAX: 0000000000000000 RBX: 00007f70db0ec010 RCX: 00007f70dad00664
[58060.319471] RDX: 0000000000000021 RSI: 0000000000000002 RDI: 0000000000000003
[58060.320438] RBP: 00007f70db11d338 R08: 0000000001dd52f0 R09: 00007f70db11e740
[58060.321400] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000001000
[58060.322370] R13: 00007f70db0ec150 R14: 0000000000001000 R15: 00007f70db0ec010
[58060.323332] ---[ end trace 76888cd25e6e2305 ]---

Fixes: e278173fd19e ("RDMA/core: Cosmetic change - move member initialization to correct block")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
---
 drivers/infiniband/core/uverbs_cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Majd Dibbiny Feb. 21, 2019, 6:45 p.m. UTC | #1 
> On Feb 21, 2019, at 6:07 PM, Leon Romanovsky <leon@kernel.org> wrote:
> 
> From: Leon Romanovsky <leonro@mellanox.com>
> 
> The IB_MR_REREG_PD command rewrites mr->pd after successful rereg_user_mr(),
> such change causes to lost usecnt information and produce the following warning,
> 
> [58060.273960] WARNING: CPU: 1 PID: 1771 at
> drivers/infiniband/core/verbs.c:336 ib_dealloc_pd+0x4e/0x60 [ib_core]
> [58060.283241] CPU: 1 PID: 1771 Comm: rereg_mr Tainted: G        W  OE 5.0.0-rc7-for-upstream-perf-2019-02-20_14-03-40-34 #1
> [58060.284467] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
> [58060.285691] RIP: 0010:ib_dealloc_pd+0x4e/0x60 [ib_core]
> [58060.286890] Code: 00 00 00 00 8b 43 18 85 c0 75 1f 48 8d 7b 28 e8 88
> d7 01 00 48 8b 43 08 48 89 df ff 90 f8 00 00 00 48 89 df 5b e9 b2 97 c4
> e0 <0f> 0b eb dd 0f 0b eb ca 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00
> [58060.289293] RSP: 0018:ffffc90003923dc0 EFLAGS: 00010286
> [58060.290490] RAX: 00000000ffffffff RBX: ffff88821f7f0400 RCX: ffff888236a40c00
> [58060.291668] RDX: ffff88821f7f0400 RSI: 0000000000000001 RDI: 0000000000000000
> [58060.292838] RBP: 0000000000000001 R08: ffff88835f665d80 R09: ffff8882209c90d8
> [58060.294007] R10: ffff88835ec003e0 R11: 0000000000000000 R12: ffff888221680ba0
> [58060.295132] R13: ffff888221680b00 R14: 00000000ffffffea R15: ffff88821f53c318
> [58060.296220] FS:  00007f70db11e740(0000) GS:ffff88835f640000(0000) knlGS:0000000000000000
> [58060.297321] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [58060.298435] CR2: 0000000001dfd030 CR3: 000000029d9d8000 CR4: 00000000000006e0
> [58060.299544] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [58060.300638] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [58060.301718] Call Trace:
> [58060.302813]  uverbs_free_pd+0x2d/0x30 [ib_uverbs]
> [58060.303909]  destroy_hw_idr_uobject+0x16/0x40 [ib_uverbs]
> [58060.305000]  uverbs_destroy_uobject+0x28/0x170 [ib_uverbs]
> [58060.306099]  __uverbs_cleanup_ufile+0x6b/0x90 [ib_uverbs]
> [58060.307144]  uverbs_destroy_ufile_hw+0x8b/0x110 [ib_uverbs]
> [58060.308168]  ib_uverbs_close+0x1f/0x80 [ib_uverbs]
> [58060.309191]  __fput+0xb1/0x220
> [58060.310216]  task_work_run+0x7f/0xa0
> [58060.311227]  exit_to_usermode_loop+0x6b/0xb2
> [58060.312237]  do_syscall_64+0xc5/0x100
> [58060.313249]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [58060.314275] RIP: 0033:0x7f70dad00664
> [58060.315293] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f
> 80 00 00 00 00 8b 05 6a cd 20 00 48 63 ff 85 c0 75 13 b8 03 00 00 00 0f
> 05 <48> 3d 00 f0 ff ff 77 44 f3 c3 66 90 48 83 ec 18 48 89 7c 24 08 e8
> [58060.317403] RSP: 002b:00007fff1c3ac308 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
> [58060.318470] RAX: 0000000000000000 RBX: 00007f70db0ec010 RCX: 00007f70dad00664
> [58060.319471] RDX: 0000000000000021 RSI: 0000000000000002 RDI: 0000000000000003
> [58060.320438] RBP: 00007f70db11d338 R08: 0000000001dd52f0 R09: 00007f70db11e740
> [58060.321400] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000001000
> [58060.322370] R13: 00007f70db0ec150 R14: 0000000000001000 R15: 00007f70db0ec010
> [58060.323332] ---[ end trace 76888cd25e6e2305 ]---
> 
> Fixes: e278173fd19e ("RDMA/core: Cosmetic change - move member initialization to correct block")
> Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Majd Dibbiny <majd@mellanox.com> 
> ---
> drivers/infiniband/core/uverbs_cmd.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
> index c57fd3a870ca..062a86c04123 100644
> --- a/drivers/infiniband/core/uverbs_cmd.c
> +++ b/drivers/infiniband/core/uverbs_cmd.c
> @@ -824,6 +824,7 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs)
>        }
>    }
> 
> +    old_pd = mr->pd;
>    ret = mr->device->ops.rereg_user_mr(mr, cmd.flags, cmd.start,
>                        cmd.length, cmd.hca_va,
>                        cmd.access_flags, pd,
> @@ -832,7 +833,6 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs)
>        goto put_uobj_pd;
> 
>    if (cmd.flags & IB_MR_REREG_PD) {
> -        old_pd = mr->pd;
>        atomic_inc(&pd->usecnt);
>        mr->pd = pd;
>        atomic_dec(&old_pd->usecnt);
> -- 
> 2.19.1
>
Jason Gunthorpe Feb. 21, 2019, 9:12 p.m. UTC | #2 
On Thu, Feb 21, 2019 at 06:07:42PM +0200, Leon Romanovsky wrote:
> From: Leon Romanovsky <leonro@mellanox.com>
> 
> The IB_MR_REREG_PD command rewrites mr->pd after successful rereg_user_mr(),
> such change causes to lost usecnt information and produce the following warning,
> 
> [58060.273960] WARNING: CPU: 1 PID: 1771 at
> drivers/infiniband/core/verbs.c:336 ib_dealloc_pd+0x4e/0x60 [ib_core]
> [58060.283241] CPU: 1 PID: 1771 Comm: rereg_mr Tainted: G        W  OE 5.0.0-rc7-for-upstream-perf-2019-02-20_14-03-40-34 #1
> [58060.284467] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
> [58060.285691] RIP: 0010:ib_dealloc_pd+0x4e/0x60 [ib_core]
> [58060.286890] Code: 00 00 00 00 8b 43 18 85 c0 75 1f 48 8d 7b 28 e8 88
> d7 01 00 48 8b 43 08 48 89 df ff 90 f8 00 00 00 48 89 df 5b e9 b2 97 c4
> e0 <0f> 0b eb dd 0f 0b eb ca 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00
> [58060.289293] RSP: 0018:ffffc90003923dc0 EFLAGS: 00010286
> [58060.290490] RAX: 00000000ffffffff RBX: ffff88821f7f0400 RCX: ffff888236a40c00
> [58060.291668] RDX: ffff88821f7f0400 RSI: 0000000000000001 RDI: 0000000000000000
> [58060.292838] RBP: 0000000000000001 R08: ffff88835f665d80 R09: ffff8882209c90d8
> [58060.294007] R10: ffff88835ec003e0 R11: 0000000000000000 R12: ffff888221680ba0
> [58060.295132] R13: ffff888221680b00 R14: 00000000ffffffea R15: ffff88821f53c318
> [58060.296220] FS:  00007f70db11e740(0000) GS:ffff88835f640000(0000) knlGS:0000000000000000
> [58060.297321] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [58060.298435] CR2: 0000000001dfd030 CR3: 000000029d9d8000 CR4: 00000000000006e0
> [58060.299544] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [58060.300638] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [58060.301718] Call Trace:
> [58060.302813]  uverbs_free_pd+0x2d/0x30 [ib_uverbs]
> [58060.303909]  destroy_hw_idr_uobject+0x16/0x40 [ib_uverbs]
> [58060.305000]  uverbs_destroy_uobject+0x28/0x170 [ib_uverbs]
> [58060.306099]  __uverbs_cleanup_ufile+0x6b/0x90 [ib_uverbs]
> [58060.307144]  uverbs_destroy_ufile_hw+0x8b/0x110 [ib_uverbs]
> [58060.308168]  ib_uverbs_close+0x1f/0x80 [ib_uverbs]
> [58060.309191]  __fput+0xb1/0x220
> [58060.310216]  task_work_run+0x7f/0xa0
> [58060.311227]  exit_to_usermode_loop+0x6b/0xb2
> [58060.312237]  do_syscall_64+0xc5/0x100
> [58060.313249]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [58060.314275] RIP: 0033:0x7f70dad00664
> [58060.315293] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f
> 80 00 00 00 00 8b 05 6a cd 20 00 48 63 ff 85 c0 75 13 b8 03 00 00 00 0f
> 05 <48> 3d 00 f0 ff ff 77 44 f3 c3 66 90 48 83 ec 18 48 89 7c 24 08 e8
> [58060.317403] RSP: 002b:00007fff1c3ac308 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
> [58060.318470] RAX: 0000000000000000 RBX: 00007f70db0ec010 RCX: 00007f70dad00664
> [58060.319471] RDX: 0000000000000021 RSI: 0000000000000002 RDI: 0000000000000003
> [58060.320438] RBP: 00007f70db11d338 R08: 0000000001dd52f0 R09: 00007f70db11e740
> [58060.321400] R10: 0000000000000009 R11: 0000000000000246 R12: 0000000000001000
> [58060.322370] R13: 00007f70db0ec150 R14: 0000000000001000 R15: 00007f70db0ec010
> [58060.323332] ---[ end trace 76888cd25e6e2305 ]---
> 
> Fixes: e278173fd19e ("RDMA/core: Cosmetic change - move member initialization to correct block")
> Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
> Reviewed-by: Majd Dibbiny <majd@mellanox.com> 
> ---
>  drivers/infiniband/core/uverbs_cmd.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Applied to for-next

Thanks,
Jason
diff mbox series

Patch

diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index c57fd3a870ca..062a86c04123 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -824,6 +824,7 @@  static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs)
 		}
 	}
 
+	old_pd = mr->pd;
 	ret = mr->device->ops.rereg_user_mr(mr, cmd.flags, cmd.start,
 					    cmd.length, cmd.hca_va,
 					    cmd.access_flags, pd,
@@ -832,7 +833,6 @@  static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs)
 		goto put_uobj_pd;
 
 	if (cmd.flags & IB_MR_REREG_PD) {
-		old_pd = mr->pd;
 		atomic_inc(&pd->usecnt);
 		mr->pd = pd;
 		atomic_dec(&old_pd->usecnt);