From: Jason Gunthorpe <jgg@mellanox.com>
Date: Fri, 28 Sep 2018 16:28:02 -0600
Subject: RDMA/uverbs: Fix RCU annotation for radix slot deference
Patch-mainline: v4.20-rc1
Git-commit: e73798f20ecb35f7d6c672d48d6b9da57c8cbf64
References: bsc#1103992 FATE#326009

The uapi radix tree is a write-once data structure protected by kref.
Once we get to the ioctl() fop it is not possible for anything else
to be writing to it, so the access should use rcu_dereference_protected.

Reported-by: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
 drivers/infiniband/core/uverbs_ioctl.c |    9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -386,8 +386,7 @@ static int uverbs_set_attr(struct bundle
 			return -EPROTONOSUPPORT;
 		return 0;
 	}
-	attr = srcu_dereference(
-		*slot, &pbundle->bundle.ufile->device->disassociate_srcu);
+	attr = rcu_dereference_protected(*slot, true);
 
 	/* Reject duplicate attributes from user-space */
 	if (test_bit(attr_bkey, pbundle->bundle.attr_present))
@@ -498,9 +497,7 @@ static int bundle_destroy(struct bundle_
 		if (WARN_ON(!slot))
 			continue;
 
-		attr_uapi = srcu_dereference(
-			*slot,
-			&pbundle->bundle.ufile->device->disassociate_srcu);
+		attr_uapi = rcu_dereference_protected(*slot, true);
 
 		if (attr_uapi->spec.type == UVERBS_ATTR_TYPE_IDRS_ARRAY) {
 			current_ret = uverbs_free_idrs_array(
@@ -542,7 +539,7 @@ static int ib_uverbs_cmd_verbs(struct ib
 			uapi_key_ioctl_method(hdr->method_id));
 	if (unlikely(!slot))
 		return -EPROTONOSUPPORT;
-	method_elm = srcu_dereference(*slot, &ufile->device->disassociate_srcu);
+	method_elm = rcu_dereference_protected(*slot, true);
 
 	if (!method_elm->use_stack) {
 		pbundle = kmalloc(method_elm->bundle_size, GFP_KERNEL);