IB/mthca: Don't cancel commands on a signal

We have run into the following problem: if a task receives a signal
while in the process of e.g. destroying a resource (which could be
because the relevant file was closed) mthca could bail out from trying
to take a command interface semaphore without performing the
appropriate command to tell hardware that the resource is being
destroyed.

As a result we see messages like
 ib_mthca 0000:04:00.0: HW2SW_CQ failed (-4)

In this case, hardware could access the resource after the memory has
been freed, possibly causing memory corruption.

A simple solution is to replace down_interruptible() by down() in
command interface activation.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
[ It's also not safe to bail out on multicast table operations, since
  they may be invoked on the cleanup path too.  So use down() for
  mcg_table.sem too. ]
Signed-off-by: Roland Dreier <rolandd@cisco.com>

1 files changed, 4 insertions, 10 deletions

diff --git a/drivers/infiniband/hw/mthca/mthca_mcg.c b/drivers/infiniband/hw/mthca/mthca_mcg.c
index 77bc6c746f43..55ff5e5bcfef 100644
--- a/drivers/infiniband/hw/mthca/mthca_mcg.c
+++ b/drivers/infiniband/hw/mthca/mthca_mcg.c
@@ -154,10 +154,7 @@ int mthca_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
                 return PTR_ERR(mailbox);
         mgm = mailbox->buf;
 
-        if (down_interruptible(&dev->mcg_table.sem)) {
-                err = -EINTR;
-                goto err_sem;
-        }
+        down(&dev->mcg_table.sem);
 
         err = find_mgm(dev, gid->raw, mailbox, &hash, &prev, &index);
         if (err)
@@ -242,7 +239,7 @@ int mthca_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
                 mthca_free(&dev->mcg_table.alloc, index);
         }
         up(&dev->mcg_table.sem);
- err_sem:
+
         mthca_free_mailbox(dev, mailbox);
         return err;
 }
@@ -263,10 +260,7 @@ int mthca_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
                 return PTR_ERR(mailbox);
         mgm = mailbox->buf;
 
-        if (down_interruptible(&dev->mcg_table.sem)) {
-                err = -EINTR;
-                goto err_sem;
-        }
+        down(&dev->mcg_table.sem);
 
         err = find_mgm(dev, gid->raw, mailbox, &hash, &prev, &index);
         if (err)
@@ -372,7 +366,7 @@ int mthca_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
 
  out:
         up(&dev->mcg_table.sem);
- err_sem:
+
         mthca_free_mailbox(dev, mailbox);
         return err;
 }