Skip to content

Commit 6ce4d44

Browse files
torvaldstorvalds
committed
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Pull rdma fixes from Jason Gunthorpe: - Fix several syzkaller found bugs: - Poor parsing of the RDMA_NL_LS_OP_IP_RESOLVE netlink - GID entry refcount leaking when CM destruction races with multicast establishment - Missing refcount put in ib_del_sub_device_and_put() - Fixup recently introduced uABI padding for 32 bit consistency - Avoid user triggered math overflow in MANA and AFA - Reading invalid netdev data during an event - kdoc fixes - Fix never-working gid copying in ib_get_gids_from_rdma_hdr - Typo in bnxt when validating the BAR - bnxt mis-parsed IB_SEND_IP_CSUM so it didn't work always - bnxt out of bounds access in bnxt related to the counters on new devices - Allocate the bnxt PDE table with the right sizing - Use dma_free_coherent() correctly in bnxt - Allow rxe to be unloadable when CONFIG_PROVE_LOCKING by adjusting the tracking of the global sockets it uses - Missing unlocking on error path in rxe - Compute the right number of pages in a MR in rtrs * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/bnxt_re: fix dma_free_coherent() pointer RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation IB/rxe: Fix missing umem_odp->umem_mutex unlock on error path RDMA/bnxt_re: Fix to use correct page size for PDE table RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send RDMA/core: always drop device refcount in ib_del_sub_device_and_put() RDMA/rxe: let rxe_reclassify_recv_socket() call sk_owner_put() RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() RDMA/efa: Remove possible negative shift RTRS/rtrs: clean up rtrs headers kernel-doc RDMA/irdma: avoid invalid read in irdma_net_event RDMA/mana_ib: check cqe length for kernel CQs RDMA/irdma: Fix irdma_alloc_ucontext_resp padding RDMA/ucma: Fix rdma_ucm_query_ib_service_resp struct padding RDMA/cm: Fix leaking the multicast GID table reference RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
2 parents 3d35fa1 + fcd431a commit 6ce4d44

18 files changed

Lines changed: 107 additions & 68 deletions

File tree

‎drivers/infiniband/core/addr.c‎

Lines changed: 10 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -80,37 +80,25 @@ static const struct nla_policy ib_nl_addr_policy[LS_NLA_TYPE_MAX] = {
8080
.min = sizeof(struct rdma_nla_ls_gid)},
8181
};
8282

83-
static inline bool ib_nl_is_good_ip_resp(const struct nlmsghdr *nlh)
83+
static void ib_nl_process_ip_rsep(const struct nlmsghdr *nlh)
8484
{
8585
struct nlattr *tb[LS_NLA_TYPE_MAX] = {};
86+
union ib_gid gid;
87+
struct addr_req *req;
88+
int found = 0;
8689
int ret;
8790

8891
if (nlh->nlmsg_flags & RDMA_NL_LS_F_ERR)
89-
return false;
92+
return;
9093

9194
ret = nla_parse_deprecated(tb, LS_NLA_TYPE_MAX - 1, nlmsg_data(nlh),
9295
nlmsg_len(nlh), ib_nl_addr_policy, NULL);
9396
if (ret)
94-
return false;
95-
96-
return true;
97-
}
98-
99-
static void ib_nl_process_good_ip_rsep(const struct nlmsghdr *nlh)
100-
{
101-
const struct nlattr *head, *curr;
102-
union ib_gid gid;
103-
struct addr_req *req;
104-
int len, rem;
105-
int found = 0;
106-
107-
head = (const struct nlattr *)nlmsg_data(nlh);
108-
len = nlmsg_len(nlh);
97+
return;
10998

110-
nla_for_each_attr(curr, head, len, rem) {
111-
if (curr->nla_type == LS_NLA_TYPE_DGID)
112-
memcpy(&gid, nla_data(curr), nla_len(curr));
113-
}
99+
if (!tb[LS_NLA_TYPE_DGID])
100+
return;
101+
memcpy(&gid, nla_data(tb[LS_NLA_TYPE_DGID]), sizeof(gid));
114102

115103
spin_lock_bh(&lock);
116104
list_for_each_entry(req, &req_list, list) {
@@ -137,8 +125,7 @@ int ib_nl_handle_ip_res_resp(struct sk_buff *skb,
137125
!(NETLINK_CB(skb).sk))
138126
return -EPERM;
139127

140-
if (ib_nl_is_good_ip_resp(nlh))
141-
ib_nl_process_good_ip_rsep(nlh);
128+
ib_nl_process_ip_rsep(nlh);
142129

143130
return 0;
144131
}

‎drivers/infiniband/core/cma.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2009,6 +2009,7 @@ static void destroy_mc(struct rdma_id_private *id_priv,
20092009
ib_sa_free_multicast(mc->sa_mc);
20102010

20112011
if (rdma_protocol_roce(id_priv->id.device, id_priv->id.port_num)) {
2012+
struct rdma_cm_event *event = &mc->iboe_join.event;
20122013
struct rdma_dev_addr *dev_addr =
20132014
&id_priv->id.route.addr.dev_addr;
20142015
struct net_device *ndev = NULL;
@@ -2031,6 +2032,8 @@ static void destroy_mc(struct rdma_id_private *id_priv,
20312032
dev_put(ndev);
20322033

20332034
cancel_work_sync(&mc->iboe_join.work);
2035+
if (event->event == RDMA_CM_EVENT_MULTICAST_JOIN)
2036+
rdma_destroy_ah_attr(&event->param.ud.ah_attr);
20342037
}
20352038
kfree(mc);
20362039
}

‎drivers/infiniband/core/device.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2881,8 +2881,10 @@ int ib_del_sub_device_and_put(struct ib_device *sub)
28812881
{
28822882
struct ib_device *parent = sub->parent;
28832883

2884-
if (!parent)
2884+
if (!parent) {
2885+
ib_device_put(sub);
28852886
return -EOPNOTSUPP;
2887+
}
28862888

28872889
mutex_lock(&parent->subdev_lock);
28882890
list_del(&sub->subdev_list);

‎drivers/infiniband/core/verbs.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -738,7 +738,7 @@ int ib_get_gids_from_rdma_hdr(const union rdma_network_hdr *hdr,
738738
(struct in6_addr *)dgid);
739739
return 0;
740740
} else if (net_type == RDMA_NETWORK_IPV6 ||
741-
net_type == RDMA_NETWORK_IB || RDMA_NETWORK_ROCE_V1) {
741+
net_type == RDMA_NETWORK_IB || net_type == RDMA_NETWORK_ROCE_V1) {
742742
*dgid = hdr->ibgrh.dgid;
743743
*sgid = hdr->ibgrh.sgid;
744744
return 0;

‎drivers/infiniband/hw/bnxt_re/hw_counters.h‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,9 @@ enum bnxt_re_hw_stats {
8989
BNXT_RE_RES_SRQ_LOAD_ERR,
9090
BNXT_RE_RES_TX_PCI_ERR,
9191
BNXT_RE_RES_RX_PCI_ERR,
92+
BNXT_RE_REQ_CQE_ERROR,
93+
BNXT_RE_RESP_CQE_ERROR,
94+
BNXT_RE_RESP_REMOTE_ACCESS_ERRS,
9295
BNXT_RE_OUT_OF_SEQ_ERR,
9396
BNXT_RE_TX_ATOMIC_REQ,
9497
BNXT_RE_TX_READ_REQ,
@@ -110,9 +113,6 @@ enum bnxt_re_hw_stats {
110113
BNXT_RE_TX_CNP,
111114
BNXT_RE_RX_CNP,
112115
BNXT_RE_RX_ECN,
113-
BNXT_RE_REQ_CQE_ERROR,
114-
BNXT_RE_RESP_CQE_ERROR,
115-
BNXT_RE_RESP_REMOTE_ACCESS_ERRS,
116116
BNXT_RE_NUM_EXT_COUNTERS
117117
};
118118

‎drivers/infiniband/hw/bnxt_re/ib_verbs.c‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2919,14 +2919,9 @@ int bnxt_re_post_send(struct ib_qp *ib_qp, const struct ib_send_wr *wr,
29192919
wqe.rawqp1.lflags |=
29202920
SQ_SEND_RAWETH_QP1_LFLAGS_ROCE_CRC;
29212921
}
2922-
switch (wr->send_flags) {
2923-
case IB_SEND_IP_CSUM:
2922+
if (wr->send_flags & IB_SEND_IP_CSUM)
29242923
wqe.rawqp1.lflags |=
29252924
SQ_SEND_RAWETH_QP1_LFLAGS_IP_CHKSUM;
2926-
break;
2927-
default:
2928-
break;
2929-
}
29302925
fallthrough;
29312926
case IB_WR_SEND_WITH_INV:
29322927
rc = bnxt_re_build_send_wqe(qp, wr, &wqe);

‎drivers/infiniband/hw/bnxt_re/qplib_rcfw.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1112,7 +1112,7 @@ static int bnxt_qplib_map_creq_db(struct bnxt_qplib_rcfw *rcfw, u32 reg_offt)
11121112
creq_db->dbinfo.flags = 0;
11131113
creq_db->reg.bar_id = RCFW_COMM_CONS_PCI_BAR_REGION;
11141114
creq_db->reg.bar_base = pci_resource_start(pdev, creq_db->reg.bar_id);
1115-
if (!creq_db->reg.bar_id)
1115+
if (!creq_db->reg.bar_base)
11161116
dev_err(&pdev->dev,
11171117
"QPLIB: CREQ BAR region %d resc start is 0!",
11181118
creq_db->reg.bar_id);

‎drivers/infiniband/hw/bnxt_re/qplib_res.c‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -64,9 +64,7 @@ static void __free_pbl(struct bnxt_qplib_res *res, struct bnxt_qplib_pbl *pbl,
6464
for (i = 0; i < pbl->pg_count; i++) {
6565
if (pbl->pg_arr[i])
6666
dma_free_coherent(&pdev->dev, pbl->pg_size,
67-
(void *)((unsigned long)
68-
pbl->pg_arr[i] &
69-
PAGE_MASK),
67+
pbl->pg_arr[i],
7068
pbl->pg_map_arr[i]);
7169
else
7270
dev_warn(&pdev->dev,
@@ -237,15 +235,15 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq,
237235
if (npbl % BIT(MAX_PDL_LVL_SHIFT))
238236
npde++;
239237
/* Alloc PDE pages */
240-
sginfo.pgsize = npde * pg_size;
238+
sginfo.pgsize = npde * ROCE_PG_SIZE_4K;
241239
sginfo.npages = 1;
242240
rc = __alloc_pbl(res, &hwq->pbl[PBL_LVL_0], &sginfo);
243241
if (rc)
244242
goto fail;
245243

246244
/* Alloc PBL pages */
247245
sginfo.npages = npbl;
248-
sginfo.pgsize = PAGE_SIZE;
246+
sginfo.pgsize = ROCE_PG_SIZE_4K;
249247
rc = __alloc_pbl(res, &hwq->pbl[PBL_LVL_1], &sginfo);
250248
if (rc)
251249
goto fail;

‎drivers/infiniband/hw/efa/efa_verbs.c‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1320,13 +1320,9 @@ static int umem_to_page_list(struct efa_dev *dev,
13201320
u32 hp_cnt,
13211321
u8 hp_shift)
13221322
{
1323-
u32 pages_in_hp = BIT(hp_shift - PAGE_SHIFT);
13241323
struct ib_block_iter biter;
13251324
unsigned int hp_idx = 0;
13261325

1327-
ibdev_dbg(&dev->ibdev, "hp_cnt[%u], pages_in_hp[%u]\n",
1328-
hp_cnt, pages_in_hp);
1329-
13301326
rdma_umem_for_each_dma_block(umem, &biter, BIT(hp_shift))
13311327
page_list[hp_idx++] = rdma_block_iter_dma_address(&biter);
13321328

‎drivers/infiniband/hw/irdma/utils.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ int irdma_net_event(struct notifier_block *notifier, unsigned long event,
251251
void *ptr)
252252
{
253253
struct neighbour *neigh = ptr;
254-
struct net_device *real_dev, *netdev = (struct net_device *)neigh->dev;
254+
struct net_device *real_dev, *netdev;
255255
struct irdma_device *iwdev;
256256
struct ib_device *ibdev;
257257
__be32 *p;
@@ -260,6 +260,7 @@ int irdma_net_event(struct notifier_block *notifier, unsigned long event,
260260

261261
switch (event) {
262262
case NETEVENT_NEIGH_UPDATE:
263+
netdev = neigh->dev;
263264
real_dev = rdma_vlan_dev_real_dev(netdev);
264265
if (!real_dev)
265266
real_dev = netdev;

0 commit comments

Comments
 (0)