From patchwork Tue Mar 17 16:05:10 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dennis Dalessandro X-Patchwork-Id: 11443281 X-Patchwork-Delegate: jgg@ziepe.ca Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 34C191392 for ; Tue, 17 Mar 2020 16:05:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1396C20735 for ; Tue, 17 Mar 2020 16:05:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726294AbgCQQFS (ORCPT ); Tue, 17 Mar 2020 12:05:18 -0400 Received: from mga18.intel.com ([134.134.136.126]:15217 "EHLO mga18.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726019AbgCQQFS (ORCPT ); Tue, 17 Mar 2020 12:05:18 -0400 IronPort-SDR: R2jMwj7eTrI9KCyNqReh8ReV8QgmVl6puKCJZgwiqdL26s07T0vN0i2oBiLQj+sKhrHUyMXsYE /2Qkh0QmYsCA== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Mar 2020 09:05:17 -0700 IronPort-SDR: mEeMfjFwevhEvS39umjAVuInoZqKiHd6qKoG20yWO2sSS75c0tib+i7UzP4rREda60oSwJt/Ws y96p7Q2a5Qvg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,564,1574150400"; d="scan'208";a="236371219" Received: from sedona.ch.intel.com ([10.2.136.157]) by fmsmga007.fm.intel.com with ESMTP; 17 Mar 2020 09:05:14 -0700 Received: from awfm-01.aw.intel.com (awfm-01.aw.intel.com [10.228.212.213]) by sedona.ch.intel.com (8.14.3/8.14.3/Standard MailSET/Hub) with ESMTP id 02HG5DMF038616; Tue, 17 Mar 2020 09:05:13 -0700 Received: from awfm-01.aw.intel.com (localhost [127.0.0.1]) by awfm-01.aw.intel.com (8.14.7/8.14.7) with ESMTP id 02HG5Av7085936; Tue, 17 Mar 2020 12:05:10 -0400 Subject: [PATCH for-rc] IB/hfi1: Insure pq is not left on waitlist From: Dennis Dalessandro To: jgg@ziepe.ca, dledford@redhat.com Cc: linux-rdma@vger.kernel.org, Mike Marciniszyn , Kaike Wan Date: Tue, 17 Mar 2020 12:05:10 -0400 Message-ID: <20200317160510.85914.22202.stgit@awfm-01.aw.intel.com> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org From: Mike Marciniszyn The following warning can occur when a pq is left on the dmawait list and the pq is then freed: [3218804.385525] WARNING: CPU: 47 PID: 3546 at lib/list_debug.c:29 __list_add+0x65/0xc0 [3218804.385527] list_add corruption. next->prev should be prev (ffff939228da1880), but was ffff939cabb52230. (next=ffff939cabb52230). [3218804.385528] Modules linked in: mmfs26(OE) mmfslinux(OE) tracedev(OE) 8021q garp mrp ib_isert iscsi_target_mod target_core_mod crc_t10dif crct10dif_generic opa_vnic rpcrdma ib_iser libiscsi scsi_transport_iscsi ib_ipoib(OE) bridge stp llc iTCO_wdt iTCO_vendor_support intel_powerclamp coretemp intel_rapl iosf_mbi kvm_intel kvm irqbypass crct10dif_pclmul crct10dif_common crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd ast ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm pcspkr joydev drm_panel_orientation_quirks i2c_i801 mei_me lpc_ich mei wmi ipmi_si ipmi_devintf ipmi_msghandler nfit libnvdimm acpi_power_meter acpi_pad hfi1(OE) rdmavt(OE) rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_core binfmt_misc numatools(OE) xpmem(OE) ip_tables [3218804.385576] nfsv3 nfs_acl nfs lockd grace sunrpc fscache igb ahci libahci i2c_algo_bit dca libata ptp pps_core crc32c_intel [last unloaded: i2c_algo_bit] [3218804.385589] CPU: 47 PID: 3546 Comm: wrf.exe Kdump: loaded Tainted: G W OE ------------ 3.10.0-957.41.1.el7.x86_64 #1 [3218804.385590] Hardware name: HPE.COM HPE SGI 8600-XA730i Gen10/X11DPT-SB-SG007, BIOS SBED1229 01/22/2019 [3218804.385592] Call Trace: [3218804.385602] [] dump_stack+0x19/0x1b [3218804.385607] [] __warn+0xd8/0x100 [3218804.385609] [] warn_slowpath_fmt+0x5f/0x80 [3218804.385616] [] ? ___slab_alloc+0x24e/0x4f0 [3218804.385618] [] __list_add+0x65/0xc0 [3218804.385642] [] defer_packet_queue+0x145/0x1a0 [hfi1] [3218804.385658] [] sdma_check_progress+0x67/0xa0 [hfi1] [3218804.385673] [] sdma_send_txlist+0x432/0x550 [hfi1] [3218804.385676] [] ? kmem_cache_alloc+0x179/0x1f0 [3218804.385691] [] ? user_sdma_send_pkts+0xc3/0x1990 [hfi1] [3218804.385704] [] user_sdma_send_pkts+0x158a/0x1990 [hfi1] [3218804.385707] [] ? try_to_del_timer_sync+0x5e/0x90 [3218804.385710] [] ? __check_object_size+0x1ca/0x250 [3218804.385723] [] hfi1_user_sdma_process_request+0xd66/0x1280 [hfi1] [3218804.385737] [] hfi1_aio_write+0xca/0x120 [hfi1] [3218804.385739] [] do_sync_readv_writev+0x7b/0xd0 [3218804.385742] [] do_readv_writev+0xce/0x260 [3218804.385746] [] ? pick_next_task_fair+0x5f/0x1b0 [3218804.385748] [] ? sched_clock_cpu+0x85/0xc0 [3218804.385751] [] ? __schedule+0x13a/0x860 [3218804.385752] [] vfs_writev+0x35/0x60 [3218804.385754] [] SyS_writev+0x7f/0x110 [3218804.385757] [] system_call_fastpath+0x22/0x27 The issue happens when wait_event_interruptible_timeout() returns a value <= 0. In that case, the pq is left on the list. The code continues sending packets and potentially can complete the current request with the pq still on the dmawait list provided no descriptor shortage is seen. If the pq is torn down in that state, the sdma interrupt handler could find the now freed pq on the list with list corruption or memory corruption resulting. Fix by adding a flush routine to insure that the pq is never on a list after processing a request. Fixes: a0d406934a46 ("staging/rdma/hfi1: Add page lock limit check for SDMA requests") Reviewed-by: Kaike Wan Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro --- drivers/infiniband/hw/hfi1/user_sdma.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c index c2f0d9b..13e4203 100644 --- a/drivers/infiniband/hw/hfi1/user_sdma.c +++ b/drivers/infiniband/hw/hfi1/user_sdma.c @@ -141,6 +141,7 @@ static int defer_packet_queue( */ xchg(&pq->state, SDMA_PKT_Q_DEFERRED); if (list_empty(&pq->busy.list)) { + pq->busy.lock = &sde->waitlock; iowait_get_priority(&pq->busy); iowait_queue(pkts_sent, &pq->busy, &sde->dmawait); } @@ -155,6 +156,7 @@ static void activate_packet_queue(struct iowait *wait, int reason) { struct hfi1_user_sdma_pkt_q *pq = container_of(wait, struct hfi1_user_sdma_pkt_q, busy); + pq->busy.lock = NULL; xchg(&pq->state, SDMA_PKT_Q_ACTIVE); wake_up(&wait->wait_dma); }; @@ -256,6 +258,21 @@ int hfi1_user_sdma_alloc_queues(struct hfi1_ctxtdata *uctxt, return ret; } +static void flush_pq_iowait(struct hfi1_user_sdma_pkt_q *pq) +{ + unsigned long flags; + seqlock_t *lock = pq->busy.lock; + + if (!lock) + return; + write_seqlock_irqsave(lock, flags); + if (!list_empty(&pq->busy.list)) { + list_del_init(&pq->busy.list); + pq->busy.lock = NULL; + } + write_sequnlock_irqrestore(lock, flags); +} + int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd, struct hfi1_ctxtdata *uctxt) { @@ -281,6 +298,7 @@ int hfi1_user_sdma_free_queues(struct hfi1_filedata *fd, kfree(pq->reqs); kfree(pq->req_in_use); kmem_cache_destroy(pq->txreq_cache); + flush_pq_iowait(pq); kfree(pq); } else { spin_unlock(&fd->pq_rcu_lock); @@ -587,11 +605,12 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd, if (ret < 0) { if (ret != -EBUSY) goto free_req; - wait_event_interruptible_timeout( + if (wait_event_interruptible_timeout( pq->busy.wait_dma, - (pq->state == SDMA_PKT_Q_ACTIVE), + pq->state == SDMA_PKT_Q_ACTIVE, msecs_to_jiffies( - SDMA_IOWAIT_TIMEOUT)); + SDMA_IOWAIT_TIMEOUT)) <= 0) + flush_pq_iowait(pq); } } *count += idx;