[PATCH 3.16 090/134] IB/core: If the MGID/MLID pair is not on the list return an error

[Ben Hutchings]

3.16.47-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: "Michael J. Ruhl" <michael.j.r...@intel.com>

commit 20c7840a77ddcb2ed2fbd66e8197db2868495751 upstream.

A list of MGID/MLID pairs is built when doing a multicast attach.  When
the multicast detach is called, the list is searched, and regardless of
the search outcome, the driver detach is called.

If an MGID/MLID pair is not on the list, driver detach should not be
called, and an error should be returned.  Calling the driver without
removing an MGID/MLID pair from the list can leave the core and driver
out of sync.

Fixes: f4e401562c11 ("IB/uverbs: track multicast group membership for userspace 
QPs")
Reviewed-by: Ira Weiny <ira.we...@intel.com>
Reviewed-by: Leon Romanovsky <leo...@mellanox.com>
Signed-off-by: Michael J. Ruhl <michael.j.r...@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessan...@intel.com>
Signed-off-by: Doug Ledford <dledf...@redhat.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
---
 drivers/infiniband/core/uverbs_cmd.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2577,6 +2577,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib
        struct ib_qp                 *qp;
        struct ib_uverbs_mcast_entry *mcast;
        int                           ret = -EINVAL;
+       bool                          found = false;
 
        if (copy_from_user(&cmd, buf, sizeof cmd))
                return -EFAULT;
@@ -2585,10 +2586,6 @@ ssize_t ib_uverbs_detach_mcast(struct ib
        if (!qp)
                return -EINVAL;
 
-       ret = ib_detach_mcast(qp, (union ib_gid *) cmd.gid, cmd.mlid);
-       if (ret)
-               goto out_put;
-
        obj = container_of(qp->uobject, struct ib_uqp_object, uevent.uobject);
 
        list_for_each_entry(mcast, &obj->mcast_list, list)
@@ -2596,9 +2593,17 @@ ssize_t ib_uverbs_detach_mcast(struct ib
                    !memcmp(cmd.gid, mcast->gid.raw, sizeof mcast->gid.raw)) {
                        list_del(&mcast->list);
                        kfree(mcast);
+                       found = true;
                        break;
                }
 
+       if (!found) {
+               ret = -EINVAL;
+               goto out_put;
+       }
+
+       ret = ib_detach_mcast(qp, (union ib_gid *)cmd.gid, cmd.mlid);
+
 out_put:
        put_qp_write(qp);