From: Jason Gunthorpe <jgg@ziepe.ca>
Date: Thu, 26 Jul 2018 15:57:56 -0600
Subject: IB/uverbs: Remove rdma_explicit_destroy() from the ioctl methods
Patch-mainline: v4.19-rc1
Git-commit: aa72c9a5f986444f5e245767402ed1f3066fca2c
References: bsc#1103992 FATE#326009

The core code will destroy the HW object on behalf of the method, if the
method provides an implementation it must simply copy data from the stub
uobj into the response. Destroy methods cannot touch the HW object.

Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
 drivers/infiniband/core/rdma_core.c           |    5 ----
 drivers/infiniband/core/uverbs_ioctl.c        |   28 +++++++++++++++++++++++---
 drivers/infiniband/core/uverbs_std_types_cq.c |   21 +++++--------------
 3 files changed, 32 insertions(+), 22 deletions(-)

--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -924,10 +924,7 @@ int uverbs_finalize_object(struct ib_uob
 		rdma_lookup_put_uobject(uobj, true);
 		break;
 	case UVERBS_ACCESS_DESTROY:
-		if (commit)
-			ret = rdma_remove_commit_uobject(uobj);
-		else
-			rdma_lookup_put_uobject(uobj, true);
+		rdma_lookup_put_uobject(uobj, true);
 		break;
 	case UVERBS_ACCESS_NEW:
 		if (commit)
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -51,6 +51,7 @@ static int uverbs_process_attr(struct ib
 			       u16 attr_id,
 			       const struct uverbs_attr_spec_hash *attr_spec_bucket,
 			       struct uverbs_attr_bundle_hash *attr_bundle_h,
+			       struct uverbs_obj_attr **destroy_attr,
 			       struct ib_uverbs_attr __user *uattr_ptr)
 {
 	const struct uverbs_attr_spec *spec;
@@ -148,6 +149,12 @@ static int uverbs_process_attr(struct ib
 		if (!object)
 			return -EINVAL;
 
+		/* specs are allowed to have only one destroy attribute */
+		WARN_ON(spec->u.obj.access == UVERBS_ACCESS_DESTROY &&
+			*destroy_attr);
+		if (spec->u.obj.access == UVERBS_ACCESS_DESTROY)
+			*destroy_attr = o_attr;
+
 		/*
 		 * The type of uattr->data is u64 for UVERBS_ATTR_TYPE_IDR and
 		 * s64 for UVERBS_ATTR_TYPE_FD. We can cast the u64 to s64
@@ -235,6 +242,7 @@ static int uverbs_uattrs_process(struct
 				 size_t num_uattrs,
 				 const struct uverbs_method_spec *method,
 				 struct uverbs_attr_bundle *attr_bundle,
+				 struct uverbs_obj_attr **destroy_attr,
 				 struct ib_uverbs_attr __user *uattr_ptr)
 {
 	size_t i;
@@ -268,7 +276,8 @@ static int uverbs_uattrs_process(struct
 		attr_spec_bucket = method->attr_buckets[ret];
 		ret = uverbs_process_attr(ufile, uattr, attr_id,
 					  attr_spec_bucket,
-					  &attr_bundle->hash[ret], uattr_ptr++);
+					  &attr_bundle->hash[ret], destroy_attr,
+					  uattr_ptr++);
 		if (ret) {
 			uverbs_finalize_attrs(attr_bundle,
 					      method->attr_buckets,
@@ -322,9 +331,11 @@ static int uverbs_handle_method(struct i
 	int ret;
 	int finalize_ret;
 	int num_given_buckets;
+	struct uverbs_obj_attr *destroy_attr = NULL;
 
-	num_given_buckets = uverbs_uattrs_process(
-		ufile, uattrs, num_uattrs, method_spec, attr_bundle, uattr_ptr);
+	num_given_buckets =
+		uverbs_uattrs_process(ufile, uattrs, num_uattrs, method_spec,
+				      attr_bundle, &destroy_attr, uattr_ptr);
 	if (num_given_buckets <= 0)
 		return -EINVAL;
 
@@ -333,7 +344,18 @@ static int uverbs_handle_method(struct i
 	if (ret)
 		goto cleanup;
 
+	/*
+	 * We destroy the HW object before invoking the handler, handlers do
+	 * not get to manipulate the HW objects.
+	 */
+	if (destroy_attr) {
+		ret = rdma_explicit_destroy(destroy_attr->uobject);
+		if (ret)
+			goto cleanup;
+	}
+
 	ret = method_spec->handler(ibdev, ufile, attr_bundle);
+
 cleanup:
 	finalize_ret = uverbs_finalize_attrs(attr_bundle,
 					     method_spec->attr_buckets,
--- a/drivers/infiniband/core/uverbs_std_types_cq.c
+++ b/drivers/infiniband/core/uverbs_std_types_cq.c
@@ -179,21 +179,12 @@ static int UVERBS_HANDLER(UVERBS_METHOD_
 {
 	struct ib_uobject *uobj =
 		uverbs_attr_get_uobject(attrs, UVERBS_ATTR_DESTROY_CQ_HANDLE);
-	struct ib_uverbs_destroy_cq_resp resp;
-	struct ib_ucq_object *obj;
-	int ret;
-
-	if (IS_ERR(uobj))
-		return PTR_ERR(uobj);
-
-	obj = container_of(uobj, struct ib_ucq_object, uobject);
-
-	ret = rdma_explicit_destroy(uobj);
-	if (ret)
-		return ret;
-
-	resp.comp_events_reported  = obj->comp_events_reported;
-	resp.async_events_reported = obj->async_events_reported;
+	struct ib_ucq_object *obj =
+		container_of(uobj, struct ib_ucq_object, uobject);
+	struct ib_uverbs_destroy_cq_resp resp = {
+		.comp_events_reported = obj->comp_events_reported,
+		.async_events_reported = obj->async_events_reported
+	};
 
 	return uverbs_copy_to(attrs, UVERBS_ATTR_DESTROY_CQ_RESP, &resp,
 			      sizeof(resp));