From patchwork Fri May 26 11:49:00 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wen Gu X-Patchwork-Id: 99461 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp407968vqr; Fri, 26 May 2023 04:51:22 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6wSUEQOlYQkITVN4/YCbEgInKkdWvQMQFa0ZAjQFWcgw8ND441hbk8oYqwhUR6vpH8TnHn X-Received: by 2002:a17:90a:e391:b0:253:3b3d:477f with SMTP id b17-20020a17090ae39100b002533b3d477fmr2194444pjz.13.1685101882337; Fri, 26 May 2023 04:51:22 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685101882; cv=none; d=google.com; s=arc-20160816; b=DTn+GRrnx5LDlkxb+L5w+v0CIl4QU4AzH948GQKxWGll4jjYEOU9gXRKdhY7iYRnyt OguBOzV+tRIDf75Z/wdsAmCKZDp6ZxXm/tsNriDOznmeTQxhTP6KfXMqa9aGYzQrJB5i S0GSFOie1Hv4na+fLUqAGKB0Kao4TxbIUi/htRVZANgL8+d0f0BvCKROZVvHf9f06RIU VibI2SzEqS8vJXi2RizKH1FvhXR/h0sQm1fzO+T2rRcgStE64lwqg63Oa5QjD/9XmKAj xJVd/Omlin+9+0BcoN35FuaklrKlFRMwGazYgnqmR4BfgnKFGhbfdUXLCciJ5fCeqGAs GgBQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:references:in-reply-to:message-id:date:subject :cc:to:from; bh=K1pV8fd/CWHNnW3wJZjlTmyewKV5MjagQwYKOsqRr+Y=; b=rNdu0/j4pljPKVw+JbMEfPITIKlgn3gCbpp6ACBx9jfpXCsk+ykzGV39pKW+9kp0qt aoNSk15UX1xMl3xOuv8ML0Qm0IgSEy3TXGi4p2JoMN/zMp/Q3u3HEKa07nfbIJCN11aE D05gd2AKznqhPlErdIvYVlkCmG4vyyS0i/J7EmF28jDCaZ3A+R+pXAt4rATp4hxwm5Li rwmYZZxcvUTi6NhxYOacx0FJSxm+dZ/q/7fVgU8O6gOW4n0LQvv5Wls7mXRwETSn1obg QaqjkoaPu28vAwyHCDL3v5h4TK/yH57D0sTpWqmew9MkfD8fTBaS+UxUmPuhOBkaSZru JDAg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id bg10-20020a17090b0d8a00b002470264eb50si3783566pjb.169.2023.05.26.04.51.10; Fri, 26 May 2023 04:51:22 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243348AbjEZLtX (ORCPT + 99 others); Fri, 26 May 2023 07:49:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40400 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243374AbjEZLtL (ORCPT ); Fri, 26 May 2023 07:49:11 -0400 Received: from out30-112.freemail.mail.aliyun.com (out30-112.freemail.mail.aliyun.com [115.124.30.112]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 91AA919A; Fri, 26 May 2023 04:49:08 -0700 (PDT) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R791e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046051;MF=guwen@linux.alibaba.com;NM=1;PH=DS;RN=10;SR=0;TI=SMTPD_---0VjWOl8M_1685101744; Received: from h68b04305.sqa.eu95.tbsite.net(mailfrom:guwen@linux.alibaba.com fp:SMTPD_---0VjWOl8M_1685101744) by smtp.aliyun-inc.com; Fri, 26 May 2023 19:49:04 +0800 From: Wen Gu To: kgraul@linux.ibm.com, wenjia@linux.ibm.com, jaka@linux.ibm.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: linux-s390@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net 1/2] net/smc: Scan from current RMB list when no position specified Date: Fri, 26 May 2023 19:49:00 +0800 Message-Id: <1685101741-74826-2-git-send-email-guwen@linux.alibaba.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1685101741-74826-1-git-send-email-guwen@linux.alibaba.com> References: <1685101741-74826-1-git-send-email-guwen@linux.alibaba.com> X-Spam-Status: No, score=-9.9 required=5.0 tests=BAYES_00, ENV_AND_HDR_SPF_MATCH,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE, UNPARSEABLE_RELAY,USER_IN_DEF_SPF_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1766957391110015231?= X-GMAIL-MSGID: =?utf-8?q?1766957391110015231?= When finding the first RMB of link group, it should start from the current RMB list whose index is 0. So fix it. Fixes: b4ba4652b3f8 ("net/smc: extend LLC layer for SMC-Rv2") Signed-off-by: Wen Gu --- net/smc/smc_llc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c index a0840b8..8423e8e 100644 --- a/net/smc/smc_llc.c +++ b/net/smc/smc_llc.c @@ -578,7 +578,10 @@ static struct smc_buf_desc *smc_llc_get_next_rmb(struct smc_link_group *lgr, { struct smc_buf_desc *buf_next; - if (!buf_pos || list_is_last(&buf_pos->list, &lgr->rmbs[*buf_lst])) { + if (!buf_pos) + return _smc_llc_get_next_rmb(lgr, buf_lst); + + if (list_is_last(&buf_pos->list, &lgr->rmbs[*buf_lst])) { (*buf_lst)++; return _smc_llc_get_next_rmb(lgr, buf_lst); } From patchwork Fri May 26 11:49:01 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wen Gu X-Patchwork-Id: 99462 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp408048vqr; Fri, 26 May 2023 04:51:33 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7yibqB2bTEObvMzCx8Isk1MHbLRnk2VcvGh+AQISGk8uZCrFLCNUgvfzf7BviusM5Q+6KY X-Received: by 2002:a05:6a20:1451:b0:10d:8f40:6469 with SMTP id a17-20020a056a20145100b0010d8f406469mr2120554pzi.48.1685101893412; Fri, 26 May 2023 04:51:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685101893; cv=none; d=google.com; s=arc-20160816; b=h27b19mdBN562DUNdM/fGC6FznwkrwECIvUkR4fv+M2z41C0UlQfXrZPjQwTZc4OBx 0qZVweEg5jO7JH5ZjjrnoM3XTk6cUPjRP+R6v4hPbd8vbFs0FFBrhYX1SGi0gvi5qBlC JuDxqbmaKlxg9celK3Qs1WNvuUJgo69DMRIppUddxlo0X9sueKbq0uQa2eBiJhaBfL1D Igx9RW+sc43MkS9HuNcS8h4GWgBUXuCFpiJj5ItE4H08WnbwBTPoRue/5CnGtqMj/Jq0 z5SeQgBlU5yUvIeKyjWscHHHLUiQWT8aTnJZreNOn87N0KzpZxEiA8Iod/loz0k554Kt DQkw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:references:in-reply-to:message-id:date:subject :cc:to:from; bh=AV435po+qLLBG10m219iwAOvOu6hRMa5DuUx6R064ao=; b=FpTlrrYo5NHqYRy1XHb7guAivG2JuDd3lhoMzZU1OA4bhNx/V6Q0DccJvN9mGhidRC qX4qGxDfrbuRR3SbFabc90BPyCXMsQaN6d5E/Goe7be3CLpUfQcrJTBEF9QJZL04Cfew R8Y6K/yVPUvjzLhaxBoxjTMcMC3wDVKZfebKUFSaJeWpdrUQ5KCZhbr82GmEbIj7bwW5 Mq/pCvORML8cm2mL9FE3/+ikuDvIL1Sr/3ig5G6Z3e5dtYDGYrtvwD23PTTsOhaMft19 jPvKxAdJvc2nEUusbpRpMoe8Vsorjau6y6t8Ud1bSpq901xl5A1lptBfxzVM+jR+phCU La5Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t191-20020a6381c8000000b0053f25333ab7si3490801pgd.759.2023.05.26.04.51.21; Fri, 26 May 2023 04:51:33 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=alibaba.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243396AbjEZLtZ (ORCPT + 99 others); Fri, 26 May 2023 07:49:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40324 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243387AbjEZLtS (ORCPT ); Fri, 26 May 2023 07:49:18 -0400 Received: from out30-130.freemail.mail.aliyun.com (out30-130.freemail.mail.aliyun.com [115.124.30.130]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0C6CC1B4; Fri, 26 May 2023 04:49:10 -0700 (PDT) X-Alimail-AntiSpam: AC=PASS;BC=-1|-1;BR=01201311R161e4;CH=green;DM=||false|;DS=||;FP=0|-1|-1|-1|0|-1|-1|-1;HT=ay29a033018046051;MF=guwen@linux.alibaba.com;NM=1;PH=DS;RN=10;SR=0;TI=SMTPD_---0VjWOl8u_1685101745; Received: from h68b04305.sqa.eu95.tbsite.net(mailfrom:guwen@linux.alibaba.com fp:SMTPD_---0VjWOl8u_1685101745) by smtp.aliyun-inc.com; Fri, 26 May 2023 19:49:05 +0800 From: Wen Gu To: kgraul@linux.ibm.com, wenjia@linux.ibm.com, jaka@linux.ibm.com, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com Cc: linux-s390@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH net 2/2] net/smc: Don't use RMBs not mapped to new link in SMCRv2 ADD LINK Date: Fri, 26 May 2023 19:49:01 +0800 Message-Id: <1685101741-74826-3-git-send-email-guwen@linux.alibaba.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1685101741-74826-1-git-send-email-guwen@linux.alibaba.com> References: <1685101741-74826-1-git-send-email-guwen@linux.alibaba.com> X-Spam-Status: No, score=-9.9 required=5.0 tests=BAYES_00, ENV_AND_HDR_SPF_MATCH,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE,UNPARSEABLE_RELAY,USER_IN_DEF_SPF_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1766957403073621342?= X-GMAIL-MSGID: =?utf-8?q?1766957403073621342?= We encountered a crash when using SMCRv2. It is caused by a logical error in smc_llc_fill_ext_v2(). BUG: kernel NULL pointer dereference, address: 0000000000000014 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 453 Comm: kworker/7:4 Kdump: loaded Tainted: G W E 6.4.0-rc3+ #44 Workqueue: events smc_llc_add_link_work [smc] RIP: 0010:smc_llc_fill_ext_v2+0x117/0x280 [smc] RSP: 0018:ffffacb5c064bd88 EFLAGS: 00010282 RAX: ffff9a6bc1c3c02c RBX: ffff9a6be3558000 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000002 RDI: 000000000000000a RBP: ffffacb5c064bdb8 R08: 0000000000000040 R09: 000000000000000c R10: ffff9a6bc0910300 R11: 0000000000000002 R12: 0000000000000000 R13: 0000000000000002 R14: ffff9a6bc1c3c02c R15: ffff9a6be3558250 FS: 0000000000000000(0000) GS:ffff9a6eefdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000014 CR3: 000000010b078003 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: smc_llc_send_add_link+0x1ae/0x2f0 [smc] smc_llc_srv_add_link+0x2c9/0x5a0 [smc] ? cc_mkenc+0x40/0x60 smc_llc_add_link_work+0xb8/0x140 [smc] process_one_work+0x1e5/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 When an alernate RNIC is available in system, SMC will try to add a new link based on the RNIC for resilience. All the RMBs in use will be mapped to the new link. Then the RMBs' MRs corresponding to the new link will be filled into SMCRv2 LLC ADD LINK messages. However, smc_llc_fill_ext_v2() mistakenly accesses to unused RMBs which haven't been mapped to the new link and have no valid MRs, thus causing a crash. So this patch fixes the logic. Fixes: b4ba4652b3f8 ("net/smc: extend LLC layer for SMC-Rv2") Signed-off-by: Wen Gu --- net/smc/smc_llc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c index 8423e8e..7a8d916 100644 --- a/net/smc/smc_llc.c +++ b/net/smc/smc_llc.c @@ -617,6 +617,8 @@ static int smc_llc_fill_ext_v2(struct smc_llc_msg_add_link_v2_ext *ext, goto out; buf_pos = smc_llc_get_first_rmb(lgr, &buf_lst); for (i = 0; i < ext->num_rkeys; i++) { + while (buf_pos && !(buf_pos)->used) + buf_pos = smc_llc_get_next_rmb(lgr, &buf_lst, buf_pos); if (!buf_pos) break; rmb = buf_pos; @@ -626,8 +628,6 @@ static int smc_llc_fill_ext_v2(struct smc_llc_msg_add_link_v2_ext *ext, cpu_to_be64((uintptr_t)rmb->cpu_addr) : cpu_to_be64((u64)sg_dma_address(rmb->sgt[lnk_idx].sgl)); buf_pos = smc_llc_get_next_rmb(lgr, &buf_lst, buf_pos); - while (buf_pos && !(buf_pos)->used) - buf_pos = smc_llc_get_next_rmb(lgr, &buf_lst, buf_pos); } len += i * sizeof(ext->rt[0]); out: