i40iw: Remove setting of VMA private data and use rdma_user_mmap_io
vm_ops is now initialized in ib_uverbs_mmap() with the recent rdma mmap
API changes. Earlier it was done in rdma_umap_priv_init() which would not
be called unless a driver called rdma_user_mmap_io() in its mmap.
i40iw does not use the rdma_user_mmap_io API but sets the vma's
vm_private_data to a driver object. This now conflicts with the vm_op
rdma_umap_close as priv pointer points to the i40iw driver object instead
of the private data setup by core when rdma_user_mmap_io is called. This
leads to a crash in rdma_umap_close with a mmap put being called when it
should not have.
Remove the redundant setting of the vma private_data in i40iw as it is not
used. Also move i40iw over to use the rdma_user_mmap_io API. This gives
the extra protection of having the mappings zapped when the context is
detsroyed.
BUG: unable to handle page fault for address:
0000000100000001
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0 P4D 0
Oops: 0002 [#1] SMP PTI
CPU: 6 PID: 9528 Comm: rping Kdump: loaded Not tainted 5.5.0-rc4+ #117
Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./Q87M-D2H, BIOS F7 01/17/2014
RIP: 0010:rdma_user_mmap_entry_put+0xa/0x30 [ib_core]
RSP: 0018:
ffffb340c04c7c38 EFLAGS:
00010202
RAX:
00000000ffffffff RBX:
ffff9308e7be2a00 RCX:
000000000000cec0
RDX:
0000000000000000 RSI:
0000000000000006 RDI:
0000000100000001
RBP:
ffff9308dc7641f0 R08:
0000000000000001 R09:
0000000000000000
R10:
0000000000000001 R11:
ffffffff8d4414d8 R12:
ffff93075182c780
R13:
0000000000000001 R14:
ffff93075182d2a8 R15:
ffff9308e2ddc840
FS:
0000000000000000(0000) GS:
ffff9308fdc00000(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
0000000100000001 CR3:
00000002e0412004 CR4:
00000000001606e0
Call Trace:
rdma_umap_close+0x40/0x90 [ib_uverbs]
remove_vma+0x43/0x80
exit_mmap+0xfd/0x1b0
mmput+0x6e/0x130
do_exit+0x290/0xcc0
? get_signal+0x152/0xc40
do_group_exit+0x46/0xc0
get_signal+0x1bd/0xc40
? prepare_to_wait_event+0x97/0x190
do_signal+0x36/0x630
? remove_wait_queue+0x60/0x60
? __audit_syscall_exit+0x1d9/0x290
? rcu_read_lock_sched_held+0x52/0x90
? kfree+0x21c/0x2e0
exit_to_usermode_loop+0x4f/0xc3
do_syscall_64+0x1ed/0x270
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fae715a81fd
Code: Bad RIP value.
RSP: 002b:
00007fae6e163cb0 EFLAGS:
00000293 ORIG_RAX:
0000000000000001
RAX:
fffffffffffffe00 RBX:
00007fae6e163d30 RCX:
00007fae715a81fd
RDX:
0000000000000010 RSI:
00007fae6e163cf0 RDI:
0000000000000003
RBP:
00000000013413a0 R08:
00007fae68000000 R09:
0000000000000017
R10:
0000000000000001 R11:
0000000000000293 R12:
00007fae680008c0
R13:
00007fae6e163cf0 R14:
00007fae717c9804 R15:
00007fae6e163ed0
CR2:
0000000100000001
---[ end trace
b33d58d3a06782cb ]---
RIP: 0010:rdma_user_mmap_entry_put+0xa/0x30 [ib_core]
Fixes:
b86deba977a9 ("RDMA/core: Move core content from ib_uverbs to ib_core")
Link: https://lore.kernel.org/r/20200107162223.1745-1-shiraz.saleem@intel.com
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>