Commit 20c7840a authored by Michael J. Ruhl's avatar Michael J. Ruhl Committed by Doug Ledford

IB/core: If the MGID/MLID pair is not on the list return an error

A list of MGID/MLID pairs is built when doing a multicast attach.  When
the multicast detach is called, the list is searched, and regardless of
the search outcome, the driver detach is called.

If an MGID/MLID pair is not on the list, driver detach should not be
called, and an error should be returned.  Calling the driver without
removing an MGID/MLID pair from the list can leave the core and driver
out of sync.

Fixes: f4e40156 ("IB/uverbs: track multicast group membership for userspace QPs")
Cc: stable@vger.kernel.org
Reviewed-by: default avatarIra Weiny <ira.weiny@intel.com>
Reviewed-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 2443c6cc
...@@ -2658,6 +2658,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file, ...@@ -2658,6 +2658,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
struct ib_qp *qp; struct ib_qp *qp;
struct ib_uverbs_mcast_entry *mcast; struct ib_uverbs_mcast_entry *mcast;
int ret = -EINVAL; int ret = -EINVAL;
bool found = false;
if (copy_from_user(&cmd, buf, sizeof cmd)) if (copy_from_user(&cmd, buf, sizeof cmd))
return -EFAULT; return -EFAULT;
...@@ -2669,18 +2670,22 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file, ...@@ -2669,18 +2670,22 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
obj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject); obj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject);
mutex_lock(&obj->mcast_lock); mutex_lock(&obj->mcast_lock);
ret = ib_detach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
if (ret)
goto out_put;
list_for_each_entry(mcast, &obj->mcast_list, list) list_for_each_entry(mcast, &obj->mcast_list, list)
if (cmd.mlid == mcast->lid && if (cmd.mlid == mcast->lid &&
!memcmp(cmd.gid, mcast->gid.raw, sizeof mcast->gid.raw)) { !memcmp(cmd.gid, mcast->gid.raw, sizeof mcast->gid.raw)) {
list_del(&mcast->list); list_del(&mcast->list);
kfree(mcast); kfree(mcast);
found = true;
break; break;
} }
if (!found) {
ret = -EINVAL;
goto out_put;
}
ret = ib_detach_mcast(qp, (union ib_gid *)cmd.gid, cmd.mlid);
out_put: out_put:
mutex_unlock(&obj->mcast_lock); mutex_unlock(&obj->mcast_lock);
uobj_put_obj_read(qp); uobj_put_obj_read(qp);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment