From patchwork Tue Jan 23 20:54:59 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Davidlohr Bueso X-Patchwork-Id: 10181063 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 42C8D602B7 for ; Tue, 23 Jan 2018 21:02:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 345E8287EA for ; Tue, 23 Jan 2018 21:02:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 28CEA287EF; Tue, 23 Jan 2018 21:02:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 923FA287EA for ; Tue, 23 Jan 2018 21:02:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752646AbeAWVCl (ORCPT ); Tue, 23 Jan 2018 16:02:41 -0500 Received: from smtp2.provo.novell.com ([137.65.250.81]:46767 "EHLO smtp2.provo.novell.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752638AbeAWVCk (ORCPT ); Tue, 23 Jan 2018 16:02:40 -0500 Received: from localhost.localdomain (prv-ext-foundry1int.gns.novell.com [137.65.251.240]) by smtp2.provo.novell.com with ESMTP (TLS encrypted); Tue, 23 Jan 2018 14:02:36 -0700 From: Davidlohr Bueso To: dledford@redhat.com, roland@purestorage.com, linux-rdma@vger.kernel.org Cc: linux-kernel@vger.kernel.org, dave@stgolabs.net, Davidlohr Bueso Subject: [PATCH] IB/mthca: Fix how mthca_map_user_db() calls gup Date: Tue, 23 Jan 2018 12:54:59 -0800 Message-Id: <20180123205459.432-1-dave@stgolabs.net> X-Mailer: git-send-email 2.13.6 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP mthca_map_user_db() has two problems regarding the call to get_user_pages(): (i) It is not done under mmap_sem. (ii) It is done under the db_table mutex, which protects all database related operations. Should any of these be called under mmap_sem, we get an ABBA deadlock. In addition, gup can be performance intensive, which could contend other mapping/ unmapping ops. To fix this, we can drop the mutex while doing a gup_fast(), once done, recheck to see the page was mapped while we didn't hold the mutex, and exit out with the corresponding housekeeping. Suggested-by: Al Viro Signed-off-by: Davidlohr Bueso --- - Compile tested only. - Should I be wrong about no callers already holding mmap_sem, I still think calling gup without the mutex makes sense for improved paralellism. Now, if callers can hold the mmap_sem, it's wrong to do copy_from_user right before calling mthca_map_user_db. drivers/infiniband/hw/mthca/mthca_memfree.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c index c6fe89d79248..046871878a02 100644 --- a/drivers/infiniband/hw/mthca/mthca_memfree.c +++ b/drivers/infiniband/hw/mthca/mthca_memfree.c @@ -472,9 +472,27 @@ int mthca_map_user_db(struct mthca_dev *dev, struct mthca_uar *uar, goto out; } - ret = get_user_pages(uaddr & PAGE_MASK, 1, FOLL_WRITE, pages, NULL); + mutex_unlock(&db_tab->mutex); + + ret = get_user_pages_fast(uaddr & PAGE_MASK, 1, FOLL_WRITE, pages); if (ret < 0) + return ret; + + mutex_lock(&db_tab->mutex); + + if (db_tab->page[i].refcount >= MTHCA_DB_REC_PER_PAGE || + (db_tab->page[i].uvirt && db_tab->page[i].uvirt != uaddr)) { + put_page(pages[0]); + ret = -EINVAL; goto out; + } + + /* page was already mapped by another task while we were doing gup */ + if (db_tab->page[i].refcount) { + put_page(pages[0]); + ++db_tab->page[i].refcount; + goto out; + } sg_set_page(&db_tab->page[i].mem, pages[0], MTHCA_ICM_PAGE_SIZE, uaddr & ~PAGE_MASK);