10 files changed, 102 insertions, 33 deletions

diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 63a7cc00bae0..84f077b2b90a 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -494,7 +494,10 @@ static void _cma_attach_to_dev(struct rdma_id_private *id_priv,
         id_priv->id.route.addr.dev_addr.transport =
                 rdma_node_get_transport(cma_dev->device->node_type);
         list_add_tail(&id_priv->list, &cma_dev->id_list);
-        rdma_restrack_kadd(&id_priv->res);
+        if (id_priv->res.kern_name)
+                rdma_restrack_kadd(&id_priv->res);
+        else
+                rdma_restrack_uadd(&id_priv->res);
 }
 
 static void cma_attach_to_dev(struct rdma_id_private *id_priv,
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 3cd830d52967..616734313f0c 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -267,7 +267,6 @@ static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map,
 #endif
 
 struct ib_device *ib_device_get_by_index(u32 ifindex);
-void ib_device_put(struct ib_device *device);
 /* RDMA device netlink */
 void nldev_init(void);
 void nldev_exit(void);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 8872453e26c0..238ec42778ef 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -156,19 +156,26 @@ struct ib_device *ib_device_get_by_index(u32 index)
         down_read(&lists_rwsem);
         device = __ib_device_get_by_index(index);
         if (device) {
-                /* Do not return a device if unregistration has started. */
-                if (!refcount_inc_not_zero(&device->refcount))
+                if (!ib_device_try_get(device))
                         device = NULL;
         }
         up_read(&lists_rwsem);
         return device;
 }
 
+/**
+ * ib_device_put - Release IB device reference
+ * @device: device whose reference to be released
+ *
+ * ib_device_put() releases reference to the IB device to allow it to be
+ * unregistered and eventually free.
+ */
 void ib_device_put(struct ib_device *device)
 {
         if (refcount_dec_and_test(&device->refcount))
                 complete(&device->unreg_completion);
 }
+EXPORT_SYMBOL(ib_device_put);
 
 static struct ib_device *__ib_device_get_by_name(const char *name)
 {
@@ -303,7 +310,6 @@ struct ib_device *ib_alloc_device(size_t size)
         rwlock_init(&device->client_data_lock);
         INIT_LIST_HEAD(&device->client_data_list);
         INIT_LIST_HEAD(&device->port_list);
-        refcount_set(&device->refcount, 1);
         init_completion(&device->unreg_completion);
 
         return device;
@@ -620,6 +626,7 @@ int ib_register_device(struct ib_device *device, const char *name,
                 goto cg_cleanup;
         }
 
+        refcount_set(&device->refcount, 1);
         device->reg_state = IB_DEV_REGISTERED;
 
         list_for_each_entry(client, &client_list, list)
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index e600fc23ae62..3c97a8b6bf1e 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -584,10 +584,6 @@ static int fill_res_pd_entry(struct sk_buff *msg, struct netlink_callback *cb,
         if (nla_put_u64_64bit(msg, RDMA_NLDEV_ATTR_RES_USECNT,
                               atomic_read(&pd->usecnt), RDMA_NLDEV_ATTR_PAD))
                 goto err;
-        if ((pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY) &&
-            nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_UNSAFE_GLOBAL_RKEY,
-                        pd->unsafe_global_rkey))
-                goto err;
 
         if (fill_res_name_pid(msg, res))
                 goto err;
diff --git a/drivers/infiniband/core/rdma_core.h b/drivers/infiniband/core/rdma_core.h
index be6b8e1257d0..69f8db66925e 100644
--- a/drivers/infiniband/core/rdma_core.h
+++ b/drivers/infiniband/core/rdma_core.h
@@ -106,6 +106,8 @@ int uverbs_finalize_object(struct ib_uobject *uobj,
                            enum uverbs_obj_access access,
                            bool commit);
 
+int uverbs_output_written(const struct uverbs_attr_bundle *bundle, size_t idx);
+
 void setup_ufile_idr_uobject(struct ib_uverbs_file *ufile);
 void release_ufile_idr_uobject(struct ib_uverbs_file *ufile);
 
diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/umem_odp.c
index a4ec43093cb3..acb882f279cb 100644
--- a/drivers/infiniband/core/umem_odp.c
+++ b/drivers/infiniband/core/umem_odp.c
@@ -352,6 +352,8 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
         umem->writable   = 1;
         umem->is_odp = 1;
         odp_data->per_mm = per_mm;
+        umem->owning_mm  = per_mm->mm;
+        mmgrab(umem->owning_mm);
 
         mutex_init(&odp_data->umem_mutex);
         init_completion(&odp_data->notifier_completion);
@@ -384,6 +386,7 @@ struct ib_umem_odp *ib_alloc_odp_umem(struct ib_ucontext_per_mm *per_mm,
 out_page_list:
         vfree(odp_data->page_list);
 out_odp_data:
+        mmdrop(umem->owning_mm);
         kfree(odp_data);
         return ERR_PTR(ret);
 }
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 6b12cc5f97b2..3317300ab036 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -60,6 +60,10 @@ static int uverbs_response(struct uverbs_attr_bundle *attrs, const void *resp,
 {
         int ret;
 
+        if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CORE_OUT))
+                return uverbs_copy_to_struct_or_zero(
+                        attrs, UVERBS_ATTR_CORE_OUT, resp, resp_len);
+
         if (copy_to_user(attrs->ucore.outbuf, resp,
                          min(attrs->ucore.outlen, resp_len)))
                 return -EFAULT;
@@ -1181,6 +1185,9 @@ static int ib_uverbs_poll_cq(struct uverbs_attr_bundle *attrs)
                 goto out_put;
         }
 
+        if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CORE_OUT))
+                ret = uverbs_output_written(attrs, UVERBS_ATTR_CORE_OUT);
+
         ret = 0;
 
 out_put:
@@ -2012,8 +2019,10 @@ static int ib_uverbs_post_send(struct uverbs_attr_bundle *attrs)
                 return -ENOMEM;
 
         qp = uobj_get_obj_read(qp, UVERBS_OBJECT_QP, cmd.qp_handle, attrs);
-        if (!qp)
+        if (!qp) {
+                ret = -EINVAL;
                 goto out;
+        }
 
         is_ud = qp->qp_type == IB_QPT_UD;
         sg_ind = 0;
diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
index 8c81ff698052..0ca04d224015 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -144,6 +144,21 @@ static bool uverbs_is_attr_cleared(const struct ib_uverbs_attr *uattr,
                            0, uattr->len - len);
 }
 
+static int uverbs_set_output(const struct uverbs_attr_bundle *bundle,
+                             const struct uverbs_attr *attr)
+{
+        struct bundle_priv *pbundle =
+                container_of(bundle, struct bundle_priv, bundle);
+        u16 flags;
+
+        flags = pbundle->uattrs[attr->ptr_attr.uattr_idx].flags |
+                UVERBS_ATTR_F_VALID_OUTPUT;
+        if (put_user(flags,
+                     &pbundle->user_attrs[attr->ptr_attr.uattr_idx].flags))
+                return -EFAULT;
+        return 0;
+}
+
 static int uverbs_process_idrs_array(struct bundle_priv *pbundle,
                                      const struct uverbs_api_attr *attr_uapi,
                                      struct uverbs_objs_arr_attr *attr,
@@ -456,6 +471,19 @@ static int ib_uverbs_run_method(struct bundle_priv *pbundle,
         }
 
         /*
+         * Until the drivers are revised to use the bundle directly we have to
+         * assume that the driver wrote to its UHW_OUT and flag userspace
+         * appropriately.
+         */
+        if (!ret && pbundle->method_elm->has_udata) {
+                const struct uverbs_attr *attr =
+                        uverbs_attr_get(&pbundle->bundle, UVERBS_ATTR_UHW_OUT);
+
+                if (!IS_ERR(attr))
+                        ret = uverbs_set_output(&pbundle->bundle, attr);
+        }
+
+        /*
          * EPROTONOSUPPORT is ONLY to be returned if the ioctl framework can
          * not invoke the method because the request is not supported.  No
          * other cases should return this code.
@@ -706,10 +734,7 @@ void uverbs_fill_udata(struct uverbs_attr_bundle *bundle,
 int uverbs_copy_to(const struct uverbs_attr_bundle *bundle, size_t idx,
                    const void *from, size_t size)
 {
-        struct bundle_priv *pbundle =
-                container_of(bundle, struct bundle_priv, bundle);
         const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
-        u16 flags;
         size_t min_size;
 
         if (IS_ERR(attr))
@@ -719,16 +744,25 @@ int uverbs_copy_to(const struct uverbs_attr_bundle *bundle, size_t idx,
         if (copy_to_user(u64_to_user_ptr(attr->ptr_attr.data), from, min_size))
                 return -EFAULT;
 
-        flags = pbundle->uattrs[attr->ptr_attr.uattr_idx].flags |
-                UVERBS_ATTR_F_VALID_OUTPUT;
-        if (put_user(flags,
-                     &pbundle->user_attrs[attr->ptr_attr.uattr_idx].flags))
-                return -EFAULT;
-
-        return 0;
+        return uverbs_set_output(bundle, attr);
 }
 EXPORT_SYMBOL(uverbs_copy_to);
 
+
+/*
+ * This is only used if the caller has directly used copy_to_use to write the
+ * data.  It signals to user space that the buffer is filled in.
+ */
+int uverbs_output_written(const struct uverbs_attr_bundle *bundle, size_t idx)
+{
+        const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
+
+        if (IS_ERR(attr))
+                return PTR_ERR(attr);
+
+        return uverbs_set_output(bundle, attr);
+}
+
 int _uverbs_get_const(s64 *to, const struct uverbs_attr_bundle *attrs_bundle,
                       size_t idx, s64 lower_bound, u64 upper_bound,
                       s64  *def_val)
@@ -757,8 +791,10 @@ int uverbs_copy_to_struct_or_zero(const struct uverbs_attr_bundle *bundle,
 {
         const struct uverbs_attr *attr = uverbs_attr_get(bundle, idx);
 
-        if (clear_user(u64_to_user_ptr(attr->ptr_attr.data),
-                       attr->ptr_attr.len))
-                return -EFAULT;
+        if (size < attr->ptr_attr.len) {
+                if (clear_user(u64_to_user_ptr(attr->ptr_attr.data) + size,
+                               attr->ptr_attr.len - size))
+                        return -EFAULT;
+        }
         return uverbs_copy_to(bundle, idx, from, size);
 }
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index fb0007aa0c27..5f366838b7ff 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -204,6 +204,9 @@ void ib_uverbs_release_file(struct kref *ref)
         if (atomic_dec_and_test(&file->device->refcount))
                 ib_uverbs_comp_dev(file->device);
 
+        if (file->async_file)
+                kref_put(&file->async_file->ref,
+                         ib_uverbs_release_async_event_file);
         put_device(&file->device->dev);
         kfree(file);
 }
@@ -690,6 +693,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
 
         buf += sizeof(hdr);
 
+        memset(bundle.attr_present, 0, sizeof(bundle.attr_present));
         bundle.ufile = file;
         if (!method_elm->is_ex) {
                 size_t in_len = hdr.in_words * 4 - sizeof(hdr);
@@ -963,11 +967,19 @@ void uverbs_user_mmap_disassociate(struct ib_uverbs_file *ufile)
 
                 /* Get an arbitrary mm pointer that hasn't been cleaned yet */
                 mutex_lock(&ufile->umap_lock);
-                if (!list_empty(&ufile->umaps)) {
-                        mm = list_first_entry(&ufile->umaps,
-                                              struct rdma_umap_priv, list)
-                                     ->vma->vm_mm;
-                        mmget(mm);
+                while (!list_empty(&ufile->umaps)) {
+                        int ret;
+
+                        priv = list_first_entry(&ufile->umaps,
+                                                struct rdma_umap_priv, list);
+                        mm = priv->vma->vm_mm;
+                        ret = mmget_not_zero(mm);
+                        if (!ret) {
+                                list_del_init(&priv->list);
+                                mm = NULL;
+                                continue;
+                        }
+                        break;
                 }
                 mutex_unlock(&ufile->umap_lock);
                 if (!mm)
@@ -1095,10 +1107,6 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
         list_del_init(&file->list);
         mutex_unlock(&file->device->lists_mutex);
 
-        if (file->async_file)
-                kref_put(&file->async_file->ref,
-                         ib_uverbs_release_async_event_file);
-
         kref_put(&file->ref, ib_uverbs_release_file);
 
         return 0;
diff --git a/drivers/infiniband/core/uverbs_std_types_device.c b/drivers/infiniband/core/uverbs_std_types_device.c
index 5030ec480370..2a3f2f01028d 100644
--- a/drivers/infiniband/core/uverbs_std_types_device.c
+++ b/drivers/infiniband/core/uverbs_std_types_device.c
@@ -168,12 +168,18 @@ void copy_port_attr_to_resp(struct ib_port_attr *attr,
 static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_PORT)(
         struct uverbs_attr_bundle *attrs)
 {
-        struct ib_device *ib_dev = attrs->ufile->device->ib_dev;
+        struct ib_device *ib_dev;
         struct ib_port_attr attr = {};
         struct ib_uverbs_query_port_resp_ex resp = {};
+        struct ib_ucontext *ucontext;
         int ret;
         u8 port_num;
 
+        ucontext = ib_uverbs_get_ucontext(attrs);
+        if (IS_ERR(ucontext))
+                return PTR_ERR(ucontext);
+        ib_dev = ucontext->device;
+
         /* FIXME: Extend the UAPI_DEF_OBJ_NEEDS_FN stuff.. */
         if (!ib_dev->ops.query_port)
                 return -EOPNOTSUPP;