RDMA/ucma: Fix the locking of ctx->file

ctx->file is changed under the file->mut lock by ucma_migrate_id(), which
is impossible to lock correctly. Instead change ctx->file under the
handler_lock and ctx_table lock and revise all places touching ctx->file
to use this locking when reading ctx->file.

Link: https://lore.kernel.org/r/20200818120526.702120-9-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index 1828594..f7ec712 100644 (file)
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -547,6 +547,7 @@ static void ucma_cleanup_mc_events(struct ucma_multicast *mc)
 {
        struct ucma_event *uevent, *tmp;
 
+       rdma_lock_handler(mc->ctx->cm_id);
        mutex_lock(&mc->ctx->file->mut);
        list_for_each_entry_safe(uevent, tmp, &mc->ctx->file->event_list, list) {
                if (uevent->mc != mc)
@@ -556,6 +557,7 @@ static void ucma_cleanup_mc_events(struct ucma_multicast *mc)
                kfree(uevent);
        }
        mutex_unlock(&mc->ctx->file->mut);
+       rdma_unlock_handler(mc->ctx->cm_id);
 }
 
 /*
@@ -1600,7 +1602,7 @@ static ssize_t ucma_leave_multicast(struct ucma_file *file,
        mc = xa_load(&multicast_table, cmd.id);
        if (!mc)
                mc = ERR_PTR(-ENOENT);
-       else if (mc->ctx->file != file)
+       else if (READ_ONCE(mc->ctx->file) != file)
                mc = ERR_PTR(-EINVAL);
        else if (!refcount_inc_not_zero(&mc->ctx->ref))
                mc = ERR_PTR(-ENXIO);
@@ -1692,6 +1694,7 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file,
                goto file_put;
        }
 
+       rdma_lock_handler(ctx->cm_id);
        cur_file = ctx->file;
        if (cur_file == new_file) {
                resp.events_reported = ctx->events_reported;
@@ -1718,6 +1721,7 @@ response:
                         &resp, sizeof(resp)))
                ret = -EFAULT;
 
+       rdma_unlock_handler(ctx->cm_id);
        ucma_put_ctx(ctx);
 file_put:
        fdput(f);