On Tue, Jan 22, 2019 at 09:16:10AM +0200, Leon Romanovsky wrote:
> From: Artemy Kovalyov <artemyko@xxxxxxxxxxxx>
>
> When allocating a umem leaf for implicit ODP MR during page fault the
> field owning_mm was not set.
>
> Initialize and take a reference on this field to avoid kernel panic when
> trying to access this field.
>
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000058
> PGD 800000022dfed067 P4D 800000022dfed067 PUD 22dfcf067 PMD 0
> Oops: 0000 [#1] SMP PTI
> CPU: 0 PID: 634 Comm: kworker/u33:0 Not tainted 4.20.0-rc6+ #89
> Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
> Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]
> RIP: 0010:ib_umem_odp_map_dma_pages+0xf3/0x710 [ib_core]
> Code: 45 c0 48 21 f3 48 89 75 b0 31 f6 4a 8d 04 33 48 89 45 a8 49 8b 44 24 60 48 8b 78 10 e8 66 16 a8 c5 49 8b 54 24 08 48 89 45 98 <8b> 42 58 85 c0 0f 84 8e 05 00 00 8d 48 01 48 8d 72 58 f0 0f b1 4a
> RSP: 0000:ffffb610813a7c20 EFLAGS: 00010202
> RAX: ffff95ace6e8ac80 RBX: 0000000000000000 RCX: 000000000000000c
> RDX: 0000000000000000 RSI: 0000000000000850 RDI: ffff95aceaadae80
> RBP: ffffb610813a7ce0 R08: 0000000000000000 R09: 0000000000080c77
> R10: ffff95acfffdbd00 R11: 0000000000000000 R12: ffff95aceaa20a00
> R13: 0000000000001000 R14: 0000000000001000 R15: 000000000000000c
> FS: 0000000000000000(0000) GS:ffff95acf7800000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000058 CR3: 000000022c834001 CR4: 00000000001606f0
> Call Trace:
> pagefault_single_data_segment+0x1df/0xc60 [mlx5_ib]
> mlx5_ib_eqe_pf_action+0x7bc/0xa70 [mlx5_ib]
> ? __switch_to+0xe1/0x470
> process_one_work+0x174/0x390
> worker_thread+0x4f/0x3e0
> kthread+0x102/0x140
> ? drain_workqueue+0x130/0x130
> ? kthread_stop+0x110/0x110
> ret_from_fork+0x1f/0x30
>
> Fixes: f27a0d50a4bc ("RDMA/umem: Use umem->owning_mm inside ODP")
> Signed-off-by: Artemy Kovalyov <artemyko@xxxxxxxxxxxx>
> Signed-off-by: Moni Shoua <monis@xxxxxxxxxxxx>
> Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxxxx>
> ---
> drivers/infiniband/core/umem_odp.c | 3 +++
> 1 file changed, 3 insertions(+)
Applied to for-rc
Thanks,
Jason
