| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 28 Oct 2020 11:19:14 +0200
From: Maor Gottlieb <maorg@...dia.com>
To: Jason Gunthorpe <jgg@...dia.com>, <linux-rdma@...r.kernel.org>
CC: Guoqing Jiang <guoqing.jiang@...ud.ionos.com>,
Christoph Hellwig <hch@....de>,
Jack Wang <jinpu.wang@...ud.ionos.com>,
Leon Romanovsky <leonro@...dia.com>,
Chao Leng <lengchao@...wei.com>,
Santosh Shilimkar <santosh.shilimkar@...cle.com>,
Keith Busch <kbusch@...nel.org>,
<linux-nvme@...ts.infradead.org>,
Max Gurtovoy <mgurtovoy@...dia.com>, <netdev@...r.kernel.org>,
<rds-devel@....oracle.com>, Sagi Grimberg <sagi@...mberg.me>
Subject: Re: [PATCH rdma v2] RDMA: Add rdma_connect_locked()
On 10/27/2020 2:20 PM, Jason Gunthorpe wrote:
> There are two flows for handling RDMA_CM_EVENT_ROUTE_RESOLVED, either the
> handler triggers a completion and another thread does rdma_connect() or
> the handler directly calls rdma_connect().
>
> In all cases rdma_connect() needs to hold the handler_mutex, but when
> handler's are invoked this is already held by the core code. This causes
> ULPs using the 2nd method to deadlock.
>
> Provide a rdma_connect_locked() and have all ULPs call it from their
> handlers.
>
> Link: https://lore.kernel.org/r/0-v1-75e124dbad74+b05-rdma_connect_locking_jgg@nvidia.com
> Reported-and-tested-by: Guoqing Jiang <guoqing.jiang@...ud.ionos.com>
> Fixes: 2a7cec538169 ("RDMA/cma: Fix locking for the RDMA_CM_CONNECT state")
> Acked-by: Santosh Shilimkar <santosh.shilimkar@...cle.com>
> Acked-by: Jack Wang <jinpu.wang@...ud.ionos.com>
> Reviewed-by: Christoph Hellwig <hch@....de>
> Signed-off-by: Jason Gunthorpe <jgg@...dia.com>
> ---
> drivers/infiniband/core/cma.c | 40 +++++++++++++++++++++---
> drivers/infiniband/ulp/iser/iser_verbs.c | 2 +-
> drivers/infiniband/ulp/rtrs/rtrs-clt.c | 4 +--
> drivers/nvme/host/rdma.c | 4 +--
> include/rdma/rdma_cm.h | 14 ++-------
> net/rds/ib_cm.c | 5 +--
> 6 files changed, 46 insertions(+), 23 deletions(-)
>
> v2:
> - Remove extra code from nvme (Chao)
> - Fix long lines (CH)
>
> I've applied this version to rdma-rc - expecting to get these ULPs unbroken for rc2
> release
>
> Thanks,
> Jason
>
> diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
> index 7c2ab1f2fbea37..193c8902b9db26 100644
> --- a/drivers/infiniband/core/cma.c
> +++ b/drivers/infiniband/core/cma.c
> @@ -405,10 +405,10 @@ static int cma_comp_exch(struct rdma_id_private *id_priv,
> /*
> * The FSM uses a funny double locking where state is protected by both
> * the handler_mutex and the spinlock. State is not allowed to change
> - * away from a handler_mutex protected value without also holding
> + * to/from a handler_mutex protected value without also holding
> * handler_mutex.
> */
> - if (comp == RDMA_CM_CONNECT)
> + if (comp == RDMA_CM_CONNECT || exch == RDMA_CM_CONNECT)
> lockdep_assert_held(&id_priv->handler_mutex);
>
> spin_lock_irqsave(&id_priv->lock, flags);
> @@ -4038,13 +4038,21 @@ static int cma_connect_iw(struct rdma_id_private *id_priv,
> return ret;
> }
>
> -int rdma_connect(struct rdma_cm_id *id, struct rdma_conn_param *conn_param)
> +/**
> + * rdma_connect_locked - Initiate an active connection request.
> + * @id: Connection identifier to connect.
> + * @conn_param: Connection information used for connected QPs.
> + *
> + * Same as rdma_connect() but can only be called from the
> + * RDMA_CM_EVENT_ROUTE_RESOLVED handler callback.
> + */
> +int rdma_connect_locked(struct rdma_cm_id *id,
> + struct rdma_conn_param *conn_param)
> {
> struct rdma_id_private *id_priv =
> container_of(id, struct rdma_id_private, id);
> int ret;
>
> - mutex_lock(&id_priv->handler_mutex);
You need to delete the mutex_unlock in success path too.
> if (!cma_comp_exch(id_priv, RDMA_CM_ROUTE_RESOLVED, RDMA_CM_CONNECT)) {
> ret = -EINVAL;
> goto err_unlock;
> @@ -4071,6 +4079,30 @@ int rdma_connect(struct rdma_cm_id *id, struct rdma_conn_param *conn_param)
> err_state:
> cma_comp_exch(id_priv, RDMA_CM_CONNECT, RDMA_CM_ROUTE_RESOLVED);
> err_unlock:
> + return ret;
> +}
> +EXPORT_SYMBOL(rdma_connect_locked);
> +
> +/**
> + * rdma_connect - Initiate an active connection request.
> + * @id: Connection identifier to connect.
> + * @conn_param: Connection information used for connected QPs.
> + *
> + * Users must have resolved a route for the rdma_cm_id to connect with by having
> + * called rdma_resolve_route before calling this routine.
> + *
> + * This call will either connect to a remote QP or obtain remote QP information
> + * for unconnected rdma_cm_id's. The actual operation is based on the
> + * rdma_cm_id's port space.
> + */
> +int rdma_connect(struct rdma_cm_id *id, struct rdma_conn_param *conn_param)
> +{
> + struct rdma_id_private *id_priv =
> + container_of(id, struct rdma_id_private, id);
> + int ret;
> +
> + mutex_lock(&id_priv->handler_mutex);
> + ret = rdma_connect_locked(id, conn_param);
> mutex_unlock(&id_priv->handler_mutex);
> return ret;
> }
> diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
> index 2f3ebc0a75d924..2bd18b00689341 100644
> --- a/drivers/infiniband/ulp/iser/iser_verbs.c
> +++ b/drivers/infiniband/ulp/iser/iser_verbs.c
> @@ -620,7 +620,7 @@ static void iser_route_handler(struct rdma_cm_id *cma_id)
> conn_param.private_data = (void *)&req_hdr;
> conn_param.private_data_len = sizeof(struct iser_cm_hdr);
>
> - ret = rdma_connect(cma_id, &conn_param);
> + ret = rdma_connect_locked(cma_id, &conn_param);
> if (ret) {
> iser_err("failure connecting: %d\n", ret);
> goto failure;
> diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
> index 776e89231c52f7..f298adc02acba2 100644
> --- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c
> +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c
> @@ -1674,9 +1674,9 @@ static int rtrs_rdma_route_resolved(struct rtrs_clt_con *con)
> uuid_copy(&msg.sess_uuid, &sess->s.uuid);
> uuid_copy(&msg.paths_uuid, &clt->paths_uuid);
>
> - err = rdma_connect(con->c.cm_id, ¶m);
> + err = rdma_connect_locked(con->c.cm_id, ¶m);
> if (err)
> - rtrs_err(clt, "rdma_connect(): %d\n", err);
> + rtrs_err(clt, "rdma_connect_locked(): %d\n", err);
>
> return err;
> }
> diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
> index aad829a2b50d0f..8bbc48cc45dc1d 100644
> --- a/drivers/nvme/host/rdma.c
> +++ b/drivers/nvme/host/rdma.c
> @@ -1890,10 +1890,10 @@ static int nvme_rdma_route_resolved(struct nvme_rdma_queue *queue)
> priv.hsqsize = cpu_to_le16(queue->ctrl->ctrl.sqsize);
> }
>
> - ret = rdma_connect(queue->cm_id, ¶m);
> + ret = rdma_connect_locked(queue->cm_id, ¶m);
> if (ret) {
> dev_err(ctrl->ctrl.device,
> - "rdma_connect failed (%d).\n", ret);
> + "rdma_connect_locked failed (%d).\n", ret);
> goto out_destroy_queue_ib;
> }
>
> diff --git a/include/rdma/rdma_cm.h b/include/rdma/rdma_cm.h
> index c672ae1da26bb5..32a67af18415d6 100644
> --- a/include/rdma/rdma_cm.h
> +++ b/include/rdma/rdma_cm.h
> @@ -227,19 +227,9 @@ void rdma_destroy_qp(struct rdma_cm_id *id);
> int rdma_init_qp_attr(struct rdma_cm_id *id, struct ib_qp_attr *qp_attr,
> int *qp_attr_mask);
>
> -/**
> - * rdma_connect - Initiate an active connection request.
> - * @id: Connection identifier to connect.
> - * @conn_param: Connection information used for connected QPs.
> - *
> - * Users must have resolved a route for the rdma_cm_id to connect with
> - * by having called rdma_resolve_route before calling this routine.
> - *
> - * This call will either connect to a remote QP or obtain remote QP
> - * information for unconnected rdma_cm_id's. The actual operation is
> - * based on the rdma_cm_id's port space.
> - */
> int rdma_connect(struct rdma_cm_id *id, struct rdma_conn_param *conn_param);
> +int rdma_connect_locked(struct rdma_cm_id *id,
> + struct rdma_conn_param *conn_param);
>
> int rdma_connect_ece(struct rdma_cm_id *id, struct rdma_conn_param *conn_param,
> struct rdma_ucm_ece *ece);
> diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
> index 06603dd1c8aa38..b36b60668b1da9 100644
> --- a/net/rds/ib_cm.c
> +++ b/net/rds/ib_cm.c
> @@ -956,9 +956,10 @@ int rds_ib_cm_initiate_connect(struct rdma_cm_id *cm_id, bool isv6)
> rds_ib_cm_fill_conn_param(conn, &conn_param, &dp,
> conn->c_proposed_version,
> UINT_MAX, UINT_MAX, isv6);
> - ret = rdma_connect(cm_id, &conn_param);
> + ret = rdma_connect_locked(cm_id, &conn_param);
> if (ret)
> - rds_ib_conn_error(conn, "rdma_connect failed (%d)\n", ret);
> + rds_ib_conn_error(conn, "rdma_connect_locked failed (%d)\n",
> + ret);
>
> out:
> /* Beware - returning non-zero tells the rdma_cm to destroy
Powered by blists - more mailing lists