iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/infiniband/core
History
Jason Gunthorpe 7c11910783 RDMA/ucma: Put a lock around every call to the rdma_cm layer 
The rdma_cm must be used single threaded.

This appears to be a bug in the design, as it does have lots of locking
that seems like it should allow concurrency. However, when it is all said
and done every single place that uses the cma_exch() scheme is broken, and
all the unlocked reads from the ucma of the cm_id data are wrong too.

syzkaller has been finding endless bugs related to this.

Fixing this in any elegant way is some enormous amount of work. Take a
very big hammer and put a mutex around everything to do with the
ucma_context at the top of every syscall.

Fixes: 75216638572f ("RDMA/cma: Export rdma cm interface to userspace")
Link: https://lore.kernel.org/r/20200218210432.GA31966@ziepe.ca
Reported-by: syzbot+adb15cf8c2798e4e0db4@syzkaller.appspotmail.com
Reported-by: syzbot+e5579222b6a3edd96522@syzkaller.appspotmail.com
Reported-by: syzbot+4b628fcc748474003457@syzkaller.appspotmail.com
Reported-by: syzbot+29ee8f76017ce6cf03da@syzkaller.appspotmail.com
Reported-by: syzbot+6956235342b7317ec564@syzkaller.appspotmail.com
Reported-by: syzbot+b358909d8d01556b790b@syzkaller.appspotmail.com
Reported-by: syzbot+6b46b135602a3f3ac99e@syzkaller.appspotmail.com
Reported-by: syzbot+8458d13b13562abf6b77@syzkaller.appspotmail.com
Reported-by: syzbot+bd034f3fdc0402e942ed@syzkaller.appspotmail.com
Reported-by: syzbot+c92378b32760a4eef756@syzkaller.appspotmail.com
Reported-by: syzbot+68b44a1597636e0b342c@syzkaller.appspotmail.com
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
2020-02-27 16:40:40 -04:00
..
addr.c
RDMA/netlink: Do not always generate an ACK for some netlink operations
2020-01-03 16:02:32 -04:00
agent.c
RDMA: Mark if destroy address handle is in a sleepable context
2018-12-19 16:28:03 -07:00
agent.h
…
cache.c
RDMA: Replace zero-length array with flexible-array member
2020-02-20 13:33:51 -04:00
cgroup.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288
2019-06-05 17:36:37 +02:00
cm_msgs.h
RDMA/cm: Remove CM message structs
2020-01-25 15:11:37 -04:00
cm.c
RDMA: Replace zero-length array with flexible-array member
2020-02-20 13:33:51 -04:00
cma_configfs.c
RDMA/cma: Rename cma_device ref/deref helpers to to get/put
2020-02-11 13:55:13 -04:00
cma_priv.h
RDMA/cma: Use refcount API to reflect refcount
2020-02-11 14:00:40 -04:00
cma_trace.c
RDMA/cma: Add trace points in RDMA Connection Manager
2020-01-07 16:10:53 -04:00
cma_trace.h
RDMA/cma: Add trace points in RDMA Connection Manager
2020-01-07 16:10:53 -04:00
cma.c
RDMA/cma: Use refcount API to reflect refcount
2020-02-11 14:00:40 -04:00
core_priv.h
RDMA/core: Do not erase the type of ib_qp.uobject
2020-01-13 16:20:15 -04:00
counters.c
RDMA/counter: Prevent auto-binding a QP which are not tracked with res
2019-12-12 15:38:15 -05:00
cq.c
RDMA/core: Trace points for diagnosing completion queue issues
2020-01-07 16:10:53 -04:00
device.c
RDMA/core: Remove err in iw_query_port
2020-01-10 11:19:04 -04:00
fmr_pool.c
RDMA: Delete DEBUG code
2019-08-20 13:27:53 -04:00
ib_core_uverbs.c
RDMA/core: Ensure that rdma_user_mmap_entry_remove() is a fence
2020-01-25 14:48:33 -04:00
iwcm.c
RDMA/iwcm: move iw_rem_ref() calls out of spinlock
2019-10-18 14:40:01 -04:00
iwcm.h
…
iwpm_msg.c
RDMA/iwpm: Delete unnecessary checks before the macro call "dev_kfree_skb"
2019-08-27 13:09:23 -03:00
iwpm_util.c
RDMA/iwpm: Delete unnecessary checks before the macro call "dev_kfree_skb"
2019-08-27 13:09:23 -03:00
iwpm_util.h
infiniband: fix core/ipwm_util.h kernel-doc warnings
2019-10-22 14:45:31 -03:00
mad_priv.h
RDMA: Replace zero-length array with flexible-array member
2020-02-20 13:33:51 -04:00
mad_rmpp.c
RDMA: Mark if destroy address handle is in a sleepable context
2018-12-19 16:28:03 -07:00
mad_rmpp.h
…
mad.c
RDMA: Change MAD processing function to remove extra casting and parameter
2019-11-12 20:20:15 -04:00
Makefile
RDMA/core: Make ib_uverbs_async_event_file into a uobject
2020-01-13 16:20:16 -04:00
mr_pool.c
Linux 5.2-rc6
2019-06-28 21:18:23 -03:00
multicast.c
RDMA: Replace zero-length array with flexible-array member
2020-02-20 13:33:51 -04:00
netlink.c
IB/core: Avoid deadlock during netlink message handling
2019-10-24 20:49:37 -03:00
nldev.c
RDMA/core: Do not erase the type of ib_cq.uobject
2020-01-13 16:20:15 -04:00
opa_smi.h
RDMA: Start use ib_device_ops
2018-12-12 07:40:16 -07:00
packer.c
…
rdma_core.c
RDMA/core: Remove ucontext_lock from the uverbs_destry_ufile_hw() path
2020-01-16 15:55:45 -04:00
rdma_core.h
RDMA/core: Make ib_uverbs_async_event_file into a uobject
2020-01-13 16:20:16 -04:00
restrack.c
RDMA/restrack: Remove PID namespace support
2019-10-23 15:58:31 -03:00
restrack.h
RDMA/restrack: Remove PID namespace support
2019-10-23 15:58:31 -03:00
roce_gid_mgmt.c
drivers: use in_dev_for_each_ifa_rtnl/rcu
2019-06-02 18:06:26 -07:00
rw.c
RDMA/rw: Support threshold for registration vs scattering to local pages
2019-10-22 14:26:52 -03:00
sa_query.c
RDMA: Replace zero-length array with flexible-array member
2020-02-20 13:33:51 -04:00
sa.h
RDMA/core: Annotate timeout as unsigned long
2018-10-16 13:34:01 -04:00
security.c
IB/core: Fix wrong iterating on ports
2019-10-04 15:50:27 -03:00
smi.c
…
smi.h
RDMA: Start use ib_device_ops
2018-12-12 07:40:16 -07:00
sysfs.c
RDMA: Change MAD processing function to remove extra casting and parameter
2019-11-12 20:20:15 -04:00
trace.c
RDMA/core: Trace points for diagnosing completion queue issues
2020-01-07 16:10:53 -04:00
ucma.c
RDMA/ucma: Put a lock around every call to the rdma_cm layer
2020-02-27 16:40:40 -04:00
ud_header.c
…
umem_odp.c
RDMA subsystem updates for 5.6
2020-01-31 14:40:36 -08:00
umem.c
RDMA/core: Add weak ordering dma attr to dma mapping
2020-02-13 13:38:02 -04:00
user_mad.c
Merge branch 'odp_fixes' into rdma.git for-next
2019-08-21 14:10:36 -03:00
uverbs_cmd.c
RDMA/uverbs: Add ioctl command to get a device context
2020-01-16 15:55:45 -04:00
uverbs_ioctl.c
RDMA/core: Do not allow alloc_commit to fail
2020-01-13 16:20:15 -04:00
uverbs_main.c
RDMA/uverbs: Add ioctl command to get a device context
2020-01-16 15:55:45 -04:00
uverbs_marshall.c
IB/cm: Replace members of sa_path_rec with 'struct sgid_attr *'
2018-06-25 14:19:57 -06:00
uverbs_std_types_async_fd.c
RDMA/uverbs: Add ioctl command to get a device context
2020-01-16 15:55:45 -04:00
uverbs_std_types_counters.c
IB: When attrs.udata/ufile is available use that instead of uobject
2019-04-08 13:05:25 -03:00
uverbs_std_types_cq.c
RDMA/core: Use READ_ONCE for ib_ufile.async_file
2020-01-13 16:20:16 -04:00
uverbs_std_types_device.c
RDMA/core: Add the core support field to METHOD_GET_CONTEXT
2020-01-16 15:55:46 -04:00
uverbs_std_types_dm.c
IB: When attrs.udata/ufile is available use that instead of uobject
2019-04-08 13:05:25 -03:00
uverbs_std_types_flow_action.c
IB: When attrs.udata/ufile is available use that instead of uobject
2019-04-08 13:05:25 -03:00
uverbs_std_types_mr.c
Linux 5.2-rc6
2019-06-28 21:18:23 -03:00
uverbs_std_types.c
RDMA/core: Use READ_ONCE for ib_ufile.async_file
2020-01-13 16:20:16 -04:00
uverbs_uapi.c
RDMA/core: Make ib_uverbs_async_event_file into a uobject
2020-01-13 16:20:16 -04:00
uverbs.h
RDMA/core: Make the entire API tree static
2020-01-30 16:28:52 -04:00
verbs.c
RDMA/core: Get rid of ib_create_qp_user
2020-02-18 20:27:37 -04:00