From patchwork Tue May 28 11:20:54 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Line Holen X-Patchwork-Id: 2624071 X-Patchwork-Delegate: hal@mellanox.com Return-Path: X-Original-To: patchwork-linux-rdma@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 1780D4020A for ; Tue, 28 May 2013 11:21:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932457Ab3E1LVL (ORCPT ); Tue, 28 May 2013 07:21:11 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:24418 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932248Ab3E1LVA convert rfc822-to-8bit (ORCPT ); Tue, 28 May 2013 07:21:00 -0400 Received: from ucsinet21.oracle.com (ucsinet21.oracle.com [156.151.31.93]) by aserp1040.oracle.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.1) with ESMTP id r4SBKtte029482 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Tue, 28 May 2013 11:20:56 GMT Received: from userz7021.oracle.com (userz7021.oracle.com [156.151.31.85]) by ucsinet21.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id r4SBKtiA010982 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL); Tue, 28 May 2013 11:20:55 GMT Received: from abhmt107.oracle.com (abhmt107.oracle.com [141.146.116.59]) by userz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id r4SBKsTd010963; Tue, 28 May 2013 11:20:55 GMT MIME-Version: 1.0 Message-ID: <051b06cb-edf4-4b84-9030-1a1108d5fe25@default> Date: Tue, 28 May 2013 04:20:54 -0700 (PDT) From: Line Holen To: Cc: Subject: [PATCH] Segfault in osm_mgrp_delete_port() X-Mailer: Zimbra on Oracle Beehive Content-Disposition: inline X-Source-IP: ucsinet21.oracle.com [156.151.31.93] Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org Segfaults can occur in osm_mgrp_delete_port() if the last full member of a MCG is removed while other non-full members still exist. Signed-off-by: Line Holen --- -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/include/opensm/osm_multicast.h b/include/opensm/osm_multicast.h index 11d789b..e192a72 100644 --- a/include/opensm/osm_multicast.h +++ b/include/opensm/osm_multicast.h @@ -2,6 +2,7 @@ * Copyright (c) 2004-2009 Voltaire, Inc. All rights reserved. * Copyright (c) 2002-2012 Mellanox Technologies LTD. All rights reserved. * Copyright (c) 1996-2003 Intel Corporation. All rights reserved. + * Copyright (c) 2013 Oracle and/or its affiliates. All rights reserved. * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -447,7 +448,7 @@ void osm_mgrp_delete_port(IN osm_subn_t * subn, IN osm_log_t * log, * SEE ALSO *********/ -void osm_mgrp_remove_port(osm_subn_t * subn, osm_log_t * log, osm_mgrp_t * mgrp, +boolean_t osm_mgrp_remove_port(osm_subn_t * subn, osm_log_t * log, osm_mgrp_t * mgrp, osm_mcm_alias_guid_t * mcm_alias_guid, ib_member_rec_t * mcmr); void osm_mgrp_cleanup(osm_subn_t * subn, osm_mgrp_t * mpgr); diff --git a/opensm/osm_multicast.c b/opensm/osm_multicast.c index c43d58d..eb93c55 100644 --- a/opensm/osm_multicast.c +++ b/opensm/osm_multicast.c @@ -2,6 +2,7 @@ * Copyright (c) 2004-2009 Voltaire, Inc. All rights reserved. * Copyright (c) 2002-2012 Mellanox Technologies LTD. All rights reserved. * Copyright (c) 1996-2003 Intel Corporation. All rights reserved. + * Copyright (c) 2013 Oracle and/or its affiliates. All rights reserved. * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -338,12 +339,13 @@ osm_mcm_port_t *osm_mgrp_add_port(IN osm_subn_t * subn, osm_log_t * log, return mcm_port; } -void osm_mgrp_remove_port(osm_subn_t * subn, osm_log_t * log, osm_mgrp_t * mgrp, +boolean_t osm_mgrp_remove_port(osm_subn_t * subn, osm_log_t * log, osm_mgrp_t * mgrp, osm_mcm_alias_guid_t * mcm_alias_guid, ib_member_rec_t *mcmr) { uint8_t join_state = mcmr->scope_state & 0xf; uint8_t port_join_state, new_join_state; + boolean_t mgrp_deleted = FALSE; /* * according to the same o15-0.1.14 we get the stored @@ -406,9 +408,12 @@ void osm_mgrp_remove_port(osm_subn_t * subn, osm_log_t * log, osm_mgrp_t * mgrp, --mgrp->full_members == 0) { mgrp_send_notice(subn, log, mgrp, 67); osm_mgrp_cleanup(subn, mgrp); + mgrp_deleted = TRUE; } subn->p_osm->sa.dirty = TRUE; + + return (mgrp_deleted); } void osm_mgrp_delete_port(osm_subn_t * subn, osm_log_t * log, osm_mgrp_t * mgrp, @@ -416,14 +421,16 @@ void osm_mgrp_delete_port(osm_subn_t * subn, osm_log_t * log, osm_mgrp_t * mgrp, { osm_mcm_alias_guid_t *mcm_alias_guid, *next_mcm_alias_guid; ib_member_rec_t mcmrec; + boolean_t mgrp_deleted = FALSE; next_mcm_alias_guid = (osm_mcm_alias_guid_t *) cl_qmap_head(&mgrp->mcm_alias_port_tbl); - while (next_mcm_alias_guid != (osm_mcm_alias_guid_t *) cl_qmap_end(&mgrp->mcm_alias_port_tbl)) { + while (next_mcm_alias_guid != (osm_mcm_alias_guid_t *) cl_qmap_end(&mgrp->mcm_alias_port_tbl) && + !mgrp_deleted) { mcm_alias_guid = next_mcm_alias_guid; next_mcm_alias_guid = (osm_mcm_alias_guid_t *) cl_qmap_next(&next_mcm_alias_guid->map_item); if (mcm_alias_guid->p_base_mcm_port->port == port) { mcmrec.scope_state = 0xf; - osm_mgrp_remove_port(subn, log, mgrp, mcm_alias_guid, + mgrp_deleted = osm_mgrp_remove_port(subn, log, mgrp, mcm_alias_guid, &mcmrec); } } diff --git a/opensm/osm_sa_mcmember_record.c b/opensm/osm_sa_mcmember_record.c index 242fcde..4d4070f 100644 --- a/opensm/osm_sa_mcmember_record.c +++ b/opensm/osm_sa_mcmember_record.c @@ -3,6 +3,7 @@ * Copyright (c) 2002-2011 Mellanox Technologies LTD. All rights reserved. * Copyright (c) 1996-2003 Intel Corporation. All rights reserved. * Copyright (c) 2008 Xsigo Systems Inc. All rights reserved. + * Copyright (c) 2013 Oracle and/or its affiliates. All rights reserved. * * This software is available to you under a choice of one of two * licenses. You may choose to be licensed under the terms of the GNU @@ -979,7 +980,7 @@ static void mcmr_rcv_leave_mgrp(IN osm_sa_t * sa, IN osm_madw_t * p_madw) } /* remove port and/or update join state */ - osm_mgrp_remove_port(sa->p_subn, sa->p_log, p_mgrp, p_mcm_alias_guid, + (void) osm_mgrp_remove_port(sa->p_subn, sa->p_log, p_mgrp, p_mcm_alias_guid, &mcmember_rec); CL_PLOCK_RELEASE(sa->p_lock);