IB/hfi1: Fix an Oops on pci device force remove

This patch fixes an Oops on device unbind, when the device is used
by a PSM user process. PSM processes access device resources which
are freed on device removal. Similar protection exists in uverbs
in ib_core for Verbs clients, but PSM doesn't use ib_uverbs hence
a separate protection is required for PSM clients.

Cc: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Dean Luick <dean.luick@intel.com>
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>

1 files changed, 16 insertions, 3 deletions

diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 677efa0e8cd6..bd786b7bd30b 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -172,6 +172,9 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
                                                struct hfi1_devdata,
                                                user_cdev);
 
+        if (!atomic_inc_not_zero(&dd->user_refcount))
+                return -ENXIO;
+
         /* Just take a ref now. Not all opens result in a context assign */
         kobject_get(&dd->kobj);
 
@@ -183,11 +186,17 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
                 fd->rec_cpu_num = -1; /* no cpu affinity by default */
                 fd->mm = current->mm;
                 atomic_inc(&fd->mm->mm_count);
-        }
+                fp->private_data = fd;
+        } else {
+                fp->private_data = NULL;
+
+                if (atomic_dec_and_test(&dd->user_refcount))
+                        complete(&dd->user_comp);
 
-        fp->private_data = fd;
+                return -ENOMEM;
+        }
 
-        return fd ? 0 : -ENOMEM;
+        return 0;
 }
 
 static long hfi1_file_ioctl(struct file *fp, unsigned int cmd,
@@ -798,6 +807,10 @@ static int hfi1_file_close(struct inode *inode, struct file *fp)
 done:
         mmdrop(fdata->mm);
         kobject_put(&dd->kobj);
+
+        if (atomic_dec_and_test(&dd->user_refcount))
+                complete(&dd->user_comp);
+
         kfree(fdata);
         return 0;
 }