[rdma-next,1/4] IB/mlx4: Take write semaphore when changing the vma struct

Commit Message

Leon Romanovsky March 29, 2017, 3:03 a.m. UTC

From: Maor Gottlieb <[e-mail]>

When the driver disassociate user context, it changes the vma to
anonymous by setting the vm_ops to null and zap the vma ptes.

In order to avoid race in the kernel, we need to take write lock
before we change the vma entries.

Fixes: ae184ddeca5db ('IB/mlx4_ib: Disassociate support')
Signed-off-by: Maor Gottlieb <[e-mail]>
Signed-off-by: Leon Romanovsky <[e-mail]>
---
 drivers/infiniband/hw/mlx4/main.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Doug Ledford April 24, 2017, 4:12 p.m. UTC | #1

On Wed, 2017-03-29 at 06:03 +0300, Leon Romanovsky wrote:
> From: Maor Gottlieb <[e-mail]>
> 
> When the driver disassociate user context, it changes the vma to
> anonymous by setting the vm_ops to null and zap the vma ptes.
> 
> In order to avoid race in the kernel, we need to take write lock
> before we change the vma entries.
> 
> Fixes: ae184ddeca5db ('IB/mlx4_ib: Disassociate support')
> Signed-off-by: Maor Gottlieb <[e-mail]>
> Signed-off-by: Leon Romanovsky <[e-mail]>

Thanks, series applied.

Patch

diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index fba94df28cf1..a2c9629f63d0 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1173,7 +1173,7 @@  static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext)
 	/* need to protect from a race on closing the vma as part of
 	 * mlx4_ib_vma_close().
 	 */
-	down_read(&owning_mm->mmap_sem);
+	down_write(&owning_mm->mmap_sem);
 	for (i = 0; i < HW_BAR_COUNT; i++) {
 		vma = context->hw_bar_info[i].vma;
 		if (!vma)
@@ -1191,7 +1191,7 @@  static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext)
 		context->hw_bar_info[i].vma->vm_ops = NULL;
 	}
 
-	up_read(&owning_mm->mmap_sem);
+	up_write(&owning_mm->mmap_sem);
 	mmput(owning_mm);
 	put_task_struct(owning_process);
 }