> However, what is is with user space setting type to IB_QPT_XRC_TGT? I > guess this could be solved by letting the kernel zero the memory > returned by ->ops.create_qp(pd, qp_init_attr). > Btw, I didn't figure out yet, how this translates at all in kernel > space? Is this op directly going to the device driver?
ops.create_qp basically ends up going into the kernel into ib_uverbs_create_qp(). > But even if we are properly going to initialize the qp, what is with > user space mischievously trying to crash the system by manipulating > struct ib_qp *qp? There's cleanup in uverbs that ignores the return value from ib_destroy_qp(), basically because it shouldn't fail in those circumstances. After calling ib_destroy_qp, uverbs will free some internal structures that some of the callback handlers expect to access. This leads to the crashes that you're seeing. I think the problem is that your first patch is incomplete. ib_uverbs_create_qp() will create a QP by either calling ib_create_qp() or by calling the device directly (device->create_qp). qp->usecnt needs to be initialized in both cases. Can you try this modification to your original patch? From: Bernd Schubert <[email protected]> From: Sean Hefty <[email protected]> rdma/core: Fix kernel panic by always initializing qp->usecnt We have just been investigating kernel panics related to cq->ibcq.event_handler() completion calls. Reason is that ib_destroy_qp() fails with -EBUSY. Further investigation revealed qp->usecnt is not initialized. This counter was introduced in linux-3.2 by commit 0e0ec7e0638ef48e0c661873dfcc8caccab984c6 and is only initialized for IB_QPT_XRC_TGT, but also checked in ib_destroy_qp() for any qp type. Signed-off-by: Bernd Schubert <[email protected]> Signed-off-by: Sven Breuner <[email protected]> Signed-off-by: Sean Hefty <[email protected]> --- drivers/infiniband/core/uverbs_cmd.c | 1 + drivers/infiniband/core/verbs.c | 2 +- 2 files changed, 2 insertions(+), 1 deletions(-) diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c index e26193f..e47dbf1 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -1472,6 +1472,7 @@ ssize_t ib_uverbs_create_qp(struct ib_uverbs_file *file, qp->event_handler = attr.event_handler; qp->qp_context = attr.qp_context; qp->qp_type = attr.qp_type; + atomic_set(&qp->usecnt, 0); atomic_inc(&pd->usecnt); atomic_inc(&attr.send_cq->usecnt); if (attr.recv_cq) diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c index 602b1bd..575b780 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -421,6 +421,7 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd, qp->uobject = NULL; qp->qp_type = qp_init_attr->qp_type; + atomic_set(&qp->usecnt, 0); if (qp_init_attr->qp_type == IB_QPT_XRC_TGT) { qp->event_handler = __ib_shared_qp_event_handler; qp->qp_context = qp; @@ -430,7 +431,6 @@ struct ib_qp *ib_create_qp(struct ib_pd *pd, qp->xrcd = qp_init_attr->xrcd; atomic_inc(&qp_init_attr->xrcd->usecnt); INIT_LIST_HEAD(&qp->open_list); - atomic_set(&qp->usecnt, 0); real_qp = qp; qp = __ib_open_qp(real_qp, qp_init_attr->event_handler, N�����r��y����b�X��ǧv�^�){.n�+����{��ٚ�{ay� ʇڙ�,j��f���h���z� �w��� ���j:+v���w�j�m��������zZ+�����ݢj"��!�i
