Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751877AbdFEMWP (ORCPT ); Mon, 5 Jun 2017 08:22:15 -0400 Received: from m12-15.163.com ([220.181.12.15]:50424 "EHLO m12-15.163.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751747AbdFEMWN (ORCPT ); Mon, 5 Jun 2017 08:22:13 -0400 From: Jia-Ju Bai To: monis@mellanox.com, sean.hefty@intel.com, dledford@redhat.com, hal.rosenstock@gmail.com, yuval.shaia@oracle.com Cc: linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, Jia-Ju Bai Subject: [PATCH V5] rxe: Fix a sleep-in-atomic bug in post_one_send Date: Mon, 5 Jun 2017 20:23:40 +0800 Message-Id: <1496665420-8100-1-git-send-email-baijiaju1990@163.com> X-Mailer: git-send-email 1.7.9.5 X-CM-TRANSID: D8CowACHjVG4TDVZZ8D1JQ--.36490S2 X-Coremail-Antispam: 1Uf129KBjvJXoW7ZFy8Zw4UtF17Aw1UWF4xtFb_yoW8Xw1Dpw 4rGwnFkr4fJFW293WqyF4Y9rWfZ39rX3y5KF9rW3s3ZF1UWryjvrn3K3WjgFykGF97WF1I qF4UtrZ8Ga15CFJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07Ukb1nUUUUU= X-Originating-IP: [166.111.70.19] X-CM-SenderInfo: xedlyx5dmximizq6il2tof0z/1tbiHgPtelSIVanragAAsr Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1573 Lines: 53 The driver may sleep under a spin lock, and the function call path is: post_one_send (acquire the lock by spin_lock_irqsave) init_send_wqe copy_from_user --> may sleep There is no flow that makes "qp->is_user" true, and copy_from_user may cause bug when a non-user pointer is used. So the lines of copy_from_user and check of "qp->is_user" are removed. Signed-off-by: Jia-Ju Bai --- V5: * Remove useless check of "qp->is_user". Thank Leon for pointing it out. V4: * Remove the line of copy_from_user. Thank Moni for good advice. V3: * It corrects the mistakes of remaining legacy code in V2. Thank Ram for pointing it out. V2: * The parameter "flags" is added to restore and save the irq status. Thank Leon for good advice. --- drivers/infiniband/sw/rxe/rxe_verbs.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c index 83d709e..073e667 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.c +++ b/drivers/infiniband/sw/rxe/rxe_verbs.c @@ -740,13 +740,8 @@ static int init_send_wqe(struct rxe_qp *qp, struct ib_send_wr *ibwr, sge = ibwr->sg_list; for (i = 0; i < num_sge; i++, sge++) { - if (qp->is_user && copy_from_user(p, (__user void *) - (uintptr_t)sge->addr, sge->length)) - return -EFAULT; - - else if (!qp->is_user) - memcpy(p, (void *)(uintptr_t)sge->addr, - sge->length); + memcpy(p, (void *)(uintptr_t)sge->addr, + sge->length); p += sge->length; } -- 1.7.9.5