From: Linus Torvalds Date: Sun, 28 Apr 2019 17:00:45 +0000 (-0700) Subject: Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma X-Git-Tag: v5.4-rc1~1173 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=14f974d7f0f1f93d8c35f496ae774ba0f1b3389a;p=platform%2Fkernel%2Flinux-rpi.git Merge tag 'for-linus' of git://git./linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: "One core bug fix and a few driver ones - FRWR memory registration for hfi1/qib didn't work with with some iovas causing a NFSoRDMA failure regression due to a fix in the NFS side - A command flow error in mlx5 allowed user space to send a corrupt command (and also smash the kernel stack we've since learned) - Fix a regression and some bugs with device hot unplug that was discovered while reviewing Andrea's patches - hns has a failure if the user asks for certain QP configurations" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/hns: Bugfix for mapping user db RDMA/ucontext: Fix regression with disassociate RDMA/mlx5: Use rdma_user_map_io for mapping BAR pages RDMA/mlx5: Do not allow the user to write to the clock page IB/mlx5: Fix scatter to CQE in DCT QP creation IB/rdmavt: Fix frwr memory registration --- 14f974d7f0f1f93d8c35f496ae774ba0f1b3389a diff --cc drivers/infiniband/core/uverbs_main.c index f2e7ffe6fc54,db20b6e0f253..7843e89235c3 --- a/drivers/infiniband/core/uverbs_main.c +++ b/drivers/infiniband/core/uverbs_main.c @@@ -992,9 -1039,7 +1039,9 @@@ void uverbs_user_mmap_disassociate(stru * at a time to get the lock ordering right. Typically there * will only be one mm, so no big deal. */ - down_write(&mm->mmap_sem); + down_read(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto skip_mm; mutex_lock(&ufile->umap_lock); list_for_each_entry_safe (priv, next_priv, &ufile->umaps, list) { @@@ -1006,11 -1051,9 +1053,10 @@@ zap_vma_ptes(vma, vma->vm_start, vma->vm_end - vma->vm_start); - vma->vm_flags &= ~(VM_SHARED | VM_MAYSHARE); } mutex_unlock(&ufile->umap_lock); + skip_mm: - up_write(&mm->mmap_sem); + up_read(&mm->mmap_sem); mmput(mm); } }