diff options
| author | Leon Romanovsky <leonro@mellanox.com> | 2019-02-21 18:07:42 +0200 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2019-02-21 14:09:23 -0700 |
| commit | 25fd08eb2be0fcebd5ab7bb8e1d4fe228c6739d0 (patch) | |
| tree | 510c3fd208a3bb3c6ae04d31d57ae6c4eb3e5b90 /drivers | |
| parent | 7264235ee74f51d26fbdf97bf98c6102a460484f (diff) | |
| download | linux-25fd08eb2be0fcebd5ab7bb8e1d4fe228c6739d0.tar.gz linux-25fd08eb2be0fcebd5ab7bb8e1d4fe228c6739d0.tar.bz2 linux-25fd08eb2be0fcebd5ab7bb8e1d4fe228c6739d0.zip | |
RDMA/uverbs: Store PR pointer before it is overwritten
The IB_MR_REREG_PD command rewrites mr->pd after successful
rereg_user_mr(), such change causes to lost usecnt information and
produces the following warning:
WARNING: CPU: 1 PID: 1771 at drivers/infiniband/core/verbs.c:336 ib_dealloc_pd+0x4e/0x60 [ib_core]
CPU: 1 PID: 1771 Comm: rereg_mr Tainted: G W OE 5.0.0-rc7-for-upstream-perf-2019-02-20_14-03-40-34 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
RIP: 0010:ib_dealloc_pd+0x4e/0x60 [ib_core]
RSP: 0018:ffffc90003923dc0 EFLAGS: 00010286
RAX: 00000000ffffffff RBX: ffff88821f7f0400 RCX: ffff888236a40c00
RDX: ffff88821f7f0400 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffff88835f665d80 R09: ffff8882209c90d8
R10: ffff88835ec003e0 R11: 0000000000000000 R12: ffff888221680ba0
R13: ffff888221680b00 R14: 00000000ffffffea R15: ffff88821f53c318
FS: 00007f70db11e740(0000) GS:ffff88835f640000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001dfd030 CR3: 000000029d9d8000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
uverbs_free_pd+0x2d/0x30 [ib_uverbs]
destroy_hw_idr_uobject+0x16/0x40 [ib_uverbs]
uverbs_destroy_uobject+0x28/0x170 [ib_uverbs]
__uverbs_cleanup_ufile+0x6b/0x90 [ib_uverbs]
uverbs_destroy_ufile_hw+0x8b/0x110 [ib_uverbs]
ib_uverbs_close+0x1f/0x80 [ib_uverbs]
__fput+0xb1/0x220
task_work_run+0x7f/0xa0
exit_to_usermode_loop+0x6b/0xb2
do_syscall_64+0xc5/0x100
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f70dad00664
Fixes: e278173fd19e ("RDMA/core: Cosmetic change - move member initialization to correct block")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Majd Dibbiny <majd@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/infiniband/core/uverbs_cmd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c index 6fcfaca82332..e44ac718f1cd 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -819,6 +819,7 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) } } + old_pd = mr->pd; ret = mr->device->ops.rereg_user_mr(mr, cmd.flags, cmd.start, cmd.length, cmd.hca_va, cmd.access_flags, pd, @@ -827,7 +828,6 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) goto put_uobj_pd; if (cmd.flags & IB_MR_REREG_PD) { - old_pd = mr->pd; atomic_inc(&pd->usecnt); mr->pd = pd; atomic_dec(&old_pd->usecnt); |