redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity
alistair23-linux/drivers/infiniband/core
History
Yishai Hadas 7b21b69ab2 IB/uverbs: Fix OOPs in uverbs_user_mmap_disassociate 
The vma->vm_mm can become impossible to get before rdma_umap_close() is
called, in this case we must not try to get an mm that is already
undergoing process exit. In this case there is no need to wait for
anything as the VMA will be destroyed by another thread soon and is
already effectively 'unreachable' by userspace.

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
 PGD 800000012bc50067 P4D 800000012bc50067 PUD 129db5067 PMD 0
 Oops: 0000 [#1] SMP PTI
 CPU: 1 PID: 2050 Comm: bash Tainted: G        W  OE 4.20.0-rc6+ #3
 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
 RIP: 0010:__rb_erase_color+0xb9/0x280
 Code: 84 17 01 00 00 48 3b 68 10 0f 84 15 01 00 00 48 89
               58 08 48 89 de 48 89 ef 4c 89 e3 e8 90 84 22 00 e9 60 ff ff ff 48 8b 5d
               10 <f6> 03 01 0f 84 9c 00 00 00 48 8b 43 10 48 85 c0 74 09 f6 00 01 0f
 RSP: 0018:ffffbecfc090bab8 EFLAGS: 00010246
 RAX: ffff97616346cf30 RBX: 0000000000000000 RCX: 0000000000000101
 RDX: 0000000000000000 RSI: ffff97623b6ca828 RDI: ffff97621ef10828
 RBP: ffff97621ef10828 R08: ffff97621ef10828 R09: 0000000000000000
 R10: 0000000000000000 R11: 0000000000000000 R12: ffff97623b6ca838
 R13: ffffffffbb3fef50 R14: ffff97623b6ca828 R15: 0000000000000000
 FS:  00007f7a5c31d740(0000) GS:ffff97623bb00000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000000 CR3: 000000011255a000 CR4: 00000000000006e0
 Call Trace:
  unlink_file_vma+0x3b/0x50
  free_pgtables+0xa1/0x110
  exit_mmap+0xca/0x1a0
  ? mlx5_ib_dealloc_pd+0x28/0x30 [mlx5_ib]
  mmput+0x54/0x140
  uverbs_user_mmap_disassociate+0xcc/0x160 [ib_uverbs]
  uverbs_destroy_ufile_hw+0xf7/0x120 [ib_uverbs]
  ib_uverbs_remove_one+0xea/0x240 [ib_uverbs]
  ib_unregister_device+0xfb/0x200 [ib_core]
  mlx5_ib_remove+0x51/0xe0 [mlx5_ib]
  mlx5_remove_device+0xc1/0xd0 [mlx5_core]
  mlx5_unregister_device+0x3d/0xb0 [mlx5_core]
  remove_one+0x2a/0x90 [mlx5_core]
  pci_device_remove+0x3b/0xc0
  device_release_driver_internal+0x16d/0x240
  unbind_store+0xb2/0x100
  kernfs_fop_write+0x102/0x180
  __vfs_write+0x36/0x1a0
  ? __alloc_fd+0xa9/0x170
  ? set_close_on_exec+0x49/0x70
  vfs_write+0xad/0x1a0
  ksys_write+0x52/0xc0
  do_syscall_64+0x5b/0x180
  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Cc: <stable@vger.kernel.org> # 4.19
Fixes: 5f9794dc94 ("RDMA/ucontext: Add a core API for mmaping driver IO memory")
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
 		2019-01-29 13:57:22 -07:00
..
Makefile RDMA/uverbs: Implement an ioctl that can call write and write_ex handlers 2018-12-18 14:12:48 -05:00
addr.c RDMA/core: Annotate timeout as unsigned long 2018-10-16 13:34:01 -04:00
agent.c RDMA: Mark if destroy address handle is in a sleepable context 2018-12-19 16:28:03 -07:00
agent.h IB/mad: Add final OPA MAD processing 2015-06-12 14:49:18 -04:00
cache.c RDMA/core: Delete RoCE GID in hw when corresponding IP is deleted 2018-12-18 14:16:44 -07:00
cgroup.c IB/core: added support to use rdma cgroup controller 2017-01-10 11:14:27 -05:00
cm.c RDMA: Mark if destroy address handle is in a sleepable context 2018-12-19 16:28:03 -07:00
cm_msgs.h IB/cm: Remove unused and erroneous msg sequence encoding 2018-07-09 11:39:28 -06:00
cma.c RDMA/cma: Add cm_id restrack resource based on kernel or user cm_id type 2019-01-08 17:12:33 -07:00
cma_configfs.c RDMA/cma: Move cma module specific functions to cma_priv.h 2018-11-22 11:57:33 -07:00
cma_priv.h RDMA/cma: Move cma module specific functions to cma_priv.h 2018-11-22 11:57:33 -07:00
core_priv.h RDMA/device: Expose ib_device_try_get(() 2019-01-21 14:33:08 -07:00
cq.c RDMA/restrack: Resource-tracker should not use uobject pointers 2018-12-18 15:38:26 -07:00
device.c RDMA/device: Expose ib_device_try_get(() 2019-01-21 14:33:08 -07:00
fmr_pool.c RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
iwcm.c RDMA/iwcm: Don't copy past the end of dev_name() string 2018-12-20 20:45:56 -07:00
iwcm.h iw_cm: free cm_id resources on the last deref 2016-08-02 13:15:18 -04:00
iwpm_msg.c RDMA/iwpm: Properly mark end of NL messages 2017-09-29 11:32:42 -04:00
iwpm_util.c treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
iwpm_util.h iwpm: crash fix for large connections test 2016-03-16 13:48:32 -04:00
mad.c RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
mad_priv.h RDMA/core: Annotate timeout as unsigned long 2018-10-16 13:34:01 -04:00
mad_rmpp.c RDMA: Mark if destroy address handle is in a sleepable context 2018-12-19 16:28:03 -07:00
mad_rmpp.h
…
mr_pool.c IB/core: add a simple MR pool 2016-05-13 13:37:18 -04:00
multicast.c IB: Make ib_init_ah_from_mcmember set sgid_attr 2018-06-25 14:19:56 -06:00
netlink.c RDMA/netlink: Simplify netlink listener existence check 2018-10-03 16:06:07 -06:00
nldev.c RDMA/nldev: Don't expose unsafe global rkey to regular user 2019-01-07 13:35:57 -07:00
opa_smi.h RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
packer.c IB/core: trivial prink cleanup. 2016-03-03 10:20:25 -05:00
rdma_core.c RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
rdma_core.h RDMA/uverbs: Mark ioctl responses with UVERBS_ATTR_F_VALID_OUTPUT 2019-01-14 14:02:22 -07:00
restrack.c RDMA/restrack: Resource-tracker should not use uobject pointers 2018-12-18 15:38:26 -07:00
roce_gid_mgmt.c IB/core: Fix oops in netdev_next_upper_dev_rcu() 2018-12-12 12:14:49 -05:00
rw.c IB/core: Ensure we map P2P memory correctly in rdma_rw_ctx_[init|destroy]() 2018-10-17 12:18:20 -05:00
sa.h RDMA/core: Annotate timeout as unsigned long 2018-10-16 13:34:01 -04:00
sa_query.c RDMA: Mark if destroy address handle is in a sleepable context 2018-12-19 16:28:03 -07:00
security.c RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
smi.c IB: Add rdma_cap_ib_switch helper and use where appropriate 2015-07-14 13:20:08 -04:00
smi.h RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
sysfs.c RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
ucm.c RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
ucma.c RDMA/ucma: Fix Spectre v1 vulnerability 2018-10-16 12:47:40 -04:00
ud_header.c IB/core: trivial prink cleanup. 2016-03-03 10:20:25 -05:00
umem.c RDMA/core: Acquire and release mmap_sem on page range 2018-09-27 12:40:20 -06:00
umem_odp.c RDMA/umem: Add missing initialization of owning_mm 2019-01-25 09:55:48 -07:00
user_mad.c IB/umad: Start using dev_groups of class 2018-12-21 11:39:41 -07:00
uverbs.h IB/core: Move query port to ioctl 2018-12-20 15:18:24 -07:00
uverbs_cmd.c RDMA/uverbs: Mark ioctl responses with UVERBS_ATTR_F_VALID_OUTPUT 2019-01-14 14:02:22 -07:00
uverbs_ioctl.c RDMA/uverbs: Mark ioctl responses with UVERBS_ATTR_F_VALID_OUTPUT 2019-01-14 14:02:22 -07:00
uverbs_main.c IB/uverbs: Fix OOPs in uverbs_user_mmap_disassociate 2019-01-29 13:57:22 -07:00
uverbs_marshall.c IB/cm: Replace members of sa_path_rec with 'struct sgid_attr *' 2018-06-25 14:19:57 -06:00
uverbs_std_types.c RDMA: Mark if destroy address handle is in a sleepable context 2018-12-19 16:28:03 -07:00
uverbs_std_types_counters.c RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
uverbs_std_types_cq.c RDMA/restrack: Resource-tracker should not use uobject pointers 2018-12-18 15:38:26 -07:00
uverbs_std_types_device.c IB/uverbs: Fix ioctl query port to consider device disassociation 2019-01-25 11:58:06 -07:00
uverbs_std_types_dm.c RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
uverbs_std_types_flow_action.c RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
uverbs_std_types_mr.c IB/uverbs: Signedness bug in UVERBS_HANDLER() 2018-12-22 16:07:13 -07:00
uverbs_uapi.c RDMA/uverbs: Implement an ioctl that can call write and write_ex handlers 2018-12-18 14:12:48 -05:00
verbs.c RDMA: Mark if destroy address handle is in a sleepable context 2018-12-19 16:28:03 -07:00