From patchwork Mon May 22 15:56:53 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shiraz Saleem X-Patchwork-Id: 13250790 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8D86C77B73 for ; Mon, 22 May 2023 15:58:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234589AbjEVP6z (ORCPT ); Mon, 22 May 2023 11:58:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49642 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234193AbjEVP6x (ORCPT ); Mon, 22 May 2023 11:58:53 -0400 Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CB880103 for ; Mon, 22 May 2023 08:58:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1684771131; x=1716307131; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=M0zOjbbJ+hXokX9UQAFQUh5T61+DO+laSJRdN1QSupg=; b=eojvBxe0i9mmJoADJJcpiKl5V4/NWEm2lOOJGjbcww8FPvJU2F2YPr+k k9gx++xGwNWrTEaBqYFrldwu/toOkD2TxnMo0pEid24aPeJnx+L7J45IK 44fIpZ1ytOiJMhyW3voFnG8ju7IV/muVggUEv99xGYarMP8zDiA3Ufuuu wb6pQ3gD0JpVYduLi2OitTLa85SIov2uinAM9yqyYvDw+yKXaZyHIU/Ml uwdTu6pAGdW+RKgyY0D+rYUyVXG7HJo+45gWmpbqzyAUmM9nh8bP+8Wld fXMdaNbeDkKFpPf/HV9PfOuJLzHhJtd7nYNfvQ6bsRhdIeCkdBn5kuwer Q==; X-IronPort-AV: E=McAfee;i="6600,9927,10718"; a="337546900" X-IronPort-AV: E=Sophos;i="6.00,184,1681196400"; d="scan'208";a="337546900" Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 22 May 2023 08:58:50 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10718"; a="734312901" X-IronPort-AV: E=Sophos;i="6.00,184,1681196400"; d="scan'208";a="734312901" Received: from ssaleem-mobl1.amr.corp.intel.com ([10.92.172.160]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 22 May 2023 08:58:49 -0700 From: Shiraz Saleem To: jgg@nvidia.com, leon@kernel.org Cc: linux-rdma@vger.kernel.org, Mustafa Ismail , Shiraz Saleem Subject: [PATCH for-rc 1/2] RDMA/irdma: Prevent QP use after free Date: Mon, 22 May 2023 10:56:53 -0500 Message-Id: <20230522155654.1309-3-shiraz.saleem@intel.com> X-Mailer: git-send-email 2.39.0 In-Reply-To: <20230522155654.1309-1-shiraz.saleem@intel.com> References: <20230522155654.1309-1-shiraz.saleem@intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org From: Mustafa Ismail There is a window where the poll cq may use a QP that has been freed. This can happen if a CQE is polled before irdma_clean_cqes() can clear the CQE's related to the QP and the destroy QP races to free the QP memory. then the QP structures are used in irdma_poll_cq. Fix this by moving the clearing of CQE's before the reference is removed and the QP is destroyed. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem --- drivers/infiniband/hw/irdma/verbs.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c index 52084651..6a1c266 100644 --- a/drivers/infiniband/hw/irdma/verbs.c +++ b/drivers/infiniband/hw/irdma/verbs.c @@ -522,11 +522,6 @@ static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) if (!iwqp->user_mode) cancel_delayed_work_sync(&iwqp->dwork_flush); - irdma_qp_rem_ref(&iwqp->ibqp); - wait_for_completion(&iwqp->free_qp); - irdma_free_lsmm_rsrc(iwqp); - irdma_cqp_qp_destroy_cmd(&iwdev->rf->sc_dev, &iwqp->sc_qp); - if (!iwqp->user_mode) { if (iwqp->iwscq) { irdma_clean_cqes(iwqp, iwqp->iwscq); @@ -534,6 +529,12 @@ static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) irdma_clean_cqes(iwqp, iwqp->iwrcq); } } + + irdma_qp_rem_ref(&iwqp->ibqp); + wait_for_completion(&iwqp->free_qp); + irdma_free_lsmm_rsrc(iwqp); + irdma_cqp_qp_destroy_cmd(&iwdev->rf->sc_dev, &iwqp->sc_qp); + irdma_remove_push_mmap_entries(iwqp); irdma_free_qp_rsrc(iwqp); From patchwork Mon May 22 15:56:54 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shiraz Saleem X-Patchwork-Id: 13250789 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35839C7EE2E for ; Mon, 22 May 2023 15:58:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234193AbjEVP6z (ORCPT ); Mon, 22 May 2023 11:58:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49648 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233883AbjEVP6x (ORCPT ); Mon, 22 May 2023 11:58:53 -0400 Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 54D1A109 for ; Mon, 22 May 2023 08:58:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1684771132; x=1716307132; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Y0VzENVr0Jr9edv6GJw8fEJl0ApeNVsziHXVjlIIJB4=; b=dac8EOWgqMbj/Jx5EYwlO9CqwlIdZKmnDF75E+uL0PqmDDLZleDwT+X8 yeUExnCWZgBEoQCD3a9T9It05Gwk6J1EY6OPGhQ9rdAFomRWHizUtA8Fg 8dBsn+tWmZIPuIqebhWnIcEdfo+w3G8c/BZ4WfsB8jg49o7M1rU/UC07k TNwTNNA5/G4YcCPdrmJDzjZ1NBKFgA9tNO/C/pUCaGGF+OXAX8Ja54rJc 4RtqZ9JFxMNCvYJGjFcs+S44iE5mnd+52I3Tq0B/hCh02q71iQ687lqy3 rPAn0t1DGE0bqJiSLfx3ozqIpIeNezRUxoyjxoISJKjmncxIdv9+A/vP7 g==; X-IronPort-AV: E=McAfee;i="6600,9927,10718"; a="337546909" X-IronPort-AV: E=Sophos;i="6.00,184,1681196400"; d="scan'208";a="337546909" Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 22 May 2023 08:58:50 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10718"; a="734312905" X-IronPort-AV: E=Sophos;i="6.00,184,1681196400"; d="scan'208";a="734312905" Received: from ssaleem-mobl1.amr.corp.intel.com ([10.92.172.160]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 22 May 2023 08:58:49 -0700 From: Shiraz Saleem To: jgg@nvidia.com, leon@kernel.org Cc: linux-rdma@vger.kernel.org, Mustafa Ismail , Shiraz Saleem Subject: [PATCH for-rc 2/2] RDMA/irdma: Fix Local Invalidate fencing Date: Mon, 22 May 2023 10:56:54 -0500 Message-Id: <20230522155654.1309-4-shiraz.saleem@intel.com> X-Mailer: git-send-email 2.39.0 In-Reply-To: <20230522155654.1309-1-shiraz.saleem@intel.com> References: <20230522155654.1309-1-shiraz.saleem@intel.com> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org From: Mustafa Ismail If the local invalidate fence is indicated in the WR, only the read fence is currently being set in WQE. Fix this to set both the read and local fence in the WQE. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem --- drivers/infiniband/hw/irdma/verbs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c index 6a1c266..996e1c9 100644 --- a/drivers/infiniband/hw/irdma/verbs.c +++ b/drivers/infiniband/hw/irdma/verbs.c @@ -3316,6 +3316,7 @@ static int irdma_post_send(struct ib_qp *ibqp, break; case IB_WR_LOCAL_INV: info.op_type = IRDMA_OP_TYPE_INV_STAG; + info.local_fence = info.read_fence; info.op.inv_local_stag.target_stag = ib_wr->ex.invalidate_rkey; err = irdma_uk_stag_local_invalidate(ukqp, &info, true); break;