tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:
"This includes a fix for a significant security miss in checking the
RDMA_NLDEV_CMD_SYS_SET operation.

Summary:

- UAF in SRP

- Error unwind failure in siw connection management

- Missing error checks

- NULL/ERR_PTR confusion in erdma

- Possible string truncation in CMA configfs and mlx4

- Data ordering issue in bnxt_re

- Missing stats decrement on object destroy in bnxt_re

- Mlx5 bugs in this merge window:
* Incorrect access_flag in the new mkey cache
* Missing unlock on error in flow steering
* lockdep possible deadlock on new mkey cache destruction (Plus a
fix for this too)

- Don't leak kernel stack memory to userspace in the CM

- Missing permission validation for RDMA_NLDEV_CMD_SYS_SET"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
RDMA/core: Require admin capabilities to set system parameters
RDMA/mlx5: Remove not-used cache disable flag
RDMA/cma: Initialize ib_sa_multicast structure to 0 when join
RDMA/mlx5: Fix mkey cache possible deadlock on cleanup
RDMA/mlx5: Fix NULL string error
RDMA/mlx5: Fix mutex unlocking on error flow for steering anchor creation
RDMA/mlx5: Fix assigning access flags to cache mkeys
IB/mlx4: Fix the size of a buffer in add_port_entries()
RDMA/bnxt_re: Decrement resource stats correctly
RDMA/bnxt_re: Fix the handling of control path response data
RDMA/cma: Fix truncation compilation warning in make_cma_ports
RDMA/erdma: Fix NULL pointer access in regmr_cmd
RDMA/erdma: Fix error code in erdma_create_scatter_mtt()
RDMA/uverbs: Fix typo of sizeof argument
RDMA/cxgb4: Check skb value for failure to allocate
RDMA/siw: Fix connection failure handling
RDMA/srp: Do not call scsi_done() from srp_abort()

Linus Torvalds 8fea9f8f 82714078

+54 -30
+1 -1
drivers/infiniband/core/cma.c
··· 4968 4968 int err = 0; 4969 4969 struct sockaddr *addr = (struct sockaddr *)&mc->addr; 4970 4970 struct net_device *ndev = NULL; 4971 - struct ib_sa_multicast ib; 4971 + struct ib_sa_multicast ib = {}; 4972 4972 enum ib_gid_type gid_type; 4973 4973 bool send_only; 4974 4974
+1 -1
drivers/infiniband/core/cma_configfs.c
··· 217 217 return -ENOMEM; 218 218 219 219 for (i = 0; i < ports_num; i++) { 220 - char port_str[10]; 220 + char port_str[11]; 221 221 222 222 ports[i].port_num = i + 1; 223 223 snprintf(port_str, sizeof(port_str), "%u", i + 1);
+1
drivers/infiniband/core/nldev.c
··· 2529 2529 }, 2530 2530 [RDMA_NLDEV_CMD_SYS_SET] = { 2531 2531 .doit = nldev_set_sys_set_doit, 2532 + .flags = RDMA_NL_ADMIN_PERM, 2532 2533 }, 2533 2534 [RDMA_NLDEV_CMD_STAT_SET] = { 2534 2535 .doit = nldev_stat_set_doit,
+1 -1
drivers/infiniband/core/uverbs_main.c
··· 546 546 if (hdr->in_words * 4 != count) 547 547 return -EINVAL; 548 548 549 - if (count < method_elm->req_size + sizeof(hdr)) { 549 + if (count < method_elm->req_size + sizeof(*hdr)) { 550 550 /* 551 551 * rdma-core v18 and v19 have a bug where they send DESTROY_CQ 552 552 * with a 16 byte write instead of 24. Old kernels didn't
+4
drivers/infiniband/hw/bnxt_re/ib_verbs.c
··· 910 910 list_del(&qp->list); 911 911 mutex_unlock(&rdev->qp_lock); 912 912 atomic_dec(&rdev->stats.res.qp_count); 913 + if (qp->qplib_qp.type == CMDQ_CREATE_QP_TYPE_RC) 914 + atomic_dec(&rdev->stats.res.rc_qp_count); 915 + else if (qp->qplib_qp.type == CMDQ_CREATE_QP_TYPE_UD) 916 + atomic_dec(&rdev->stats.res.ud_qp_count); 913 917 914 918 ib_umem_release(qp->rumem); 915 919 ib_umem_release(qp->sumem);
+9 -2
drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
··· 665 665 blocked = cookie & RCFW_CMD_IS_BLOCKING; 666 666 cookie &= RCFW_MAX_COOKIE_VALUE; 667 667 crsqe = &rcfw->crsqe_tbl[cookie]; 668 - crsqe->is_in_used = false; 669 668 670 669 if (WARN_ONCE(test_bit(FIRMWARE_STALL_DETECTED, 671 670 &rcfw->cmdq.flags), ··· 680 681 atomic_dec(&rcfw->timeout_send); 681 682 682 683 if (crsqe->is_waiter_alive) { 683 - if (crsqe->resp) 684 + if (crsqe->resp) { 684 685 memcpy(crsqe->resp, qp_event, sizeof(*qp_event)); 686 + /* Insert write memory barrier to ensure that 687 + * response data is copied before clearing the 688 + * flags 689 + */ 690 + smp_wmb(); 691 + } 685 692 if (!blocked) 686 693 wait_cmds++; 687 694 } ··· 698 693 crsqe->req_size = 0; 699 694 if (!is_waiter_alive) 700 695 crsqe->resp = NULL; 696 + 697 + crsqe->is_in_used = false; 701 698 702 699 hwq->cons += req_size; 703 700
+3
drivers/infiniband/hw/cxgb4/cm.c
··· 1965 1965 int win; 1966 1966 1967 1967 skb = get_skb(NULL, sizeof(*req), GFP_KERNEL); 1968 + if (!skb) 1969 + return -ENOMEM; 1970 + 1968 1971 req = __skb_put_zero(skb, sizeof(*req)); 1969 1972 req->op_compl = htonl(WR_OP_V(FW_OFLD_CONNECTION_WR)); 1970 1973 req->len16_pkd = htonl(FW_WR_LEN16_V(DIV_ROUND_UP(sizeof(*req), 16)));
+3 -4
drivers/infiniband/hw/erdma/erdma_verbs.c
··· 133 133 static int regmr_cmd(struct erdma_dev *dev, struct erdma_mr *mr) 134 134 { 135 135 struct erdma_pd *pd = to_epd(mr->ibmr.pd); 136 + u32 mtt_level = ERDMA_MR_MTT_0LEVEL; 136 137 struct erdma_cmdq_reg_mr_req req; 137 - u32 mtt_level; 138 138 139 139 erdma_cmdq_build_reqhdr(&req.hdr, CMDQ_SUBMOD_RDMA, CMDQ_OPCODE_REG_MR); 140 140 ··· 147 147 req.phy_addr[0] = sg_dma_address(mr->mem.mtt->sglist); 148 148 mtt_level = mr->mem.mtt->level; 149 149 } 150 - } else { 150 + } else if (mr->type != ERDMA_MR_TYPE_DMA) { 151 151 memcpy(req.phy_addr, mr->mem.mtt->buf, 152 152 MTT_SIZE(mr->mem.page_cnt)); 153 - mtt_level = ERDMA_MR_MTT_0LEVEL; 154 153 } 155 154 156 155 req.cfg0 = FIELD_PREP(ERDMA_CMD_MR_VALID_MASK, mr->valid) | ··· 654 655 655 656 mtt = kzalloc(sizeof(*mtt), GFP_KERNEL); 656 657 if (!mtt) 657 - return NULL; 658 + return ERR_PTR(-ENOMEM); 658 659 659 660 mtt->size = ALIGN(size, PAGE_SIZE); 660 661 mtt->buf = vzalloc(mtt->size);
+1 -1
drivers/infiniband/hw/mlx4/sysfs.c
··· 223 223 static int add_port_entries(struct mlx4_ib_dev *device, int port_num) 224 224 { 225 225 int i; 226 - char buff[11]; 226 + char buff[12]; 227 227 struct mlx4_ib_iov_port *port = NULL; 228 228 int ret = 0 ; 229 229 struct ib_port_attr attr;
+1 -1
drivers/infiniband/hw/mlx5/fs.c
··· 2470 2470 mlx5_steering_anchor_destroy_res(ft_prio); 2471 2471 put_flow_table: 2472 2472 put_flow_table(dev, ft_prio, true); 2473 - mutex_unlock(&dev->flow_db->lock); 2474 2473 free_obj: 2474 + mutex_unlock(&dev->flow_db->lock); 2475 2475 kfree(obj); 2476 2476 2477 2477 return err;
+1 -1
drivers/infiniband/hw/mlx5/main.c
··· 2084 2084 case MLX5_IB_MMAP_DEVICE_MEM: 2085 2085 return "Device Memory"; 2086 2086 default: 2087 - return NULL; 2087 + return "Unknown"; 2088 2088 } 2089 2089 } 2090 2090
+11 -3
drivers/infiniband/hw/mlx5/mr.c
··· 301 301 302 302 static void set_cache_mkc(struct mlx5_cache_ent *ent, void *mkc) 303 303 { 304 - set_mkc_access_pd_addr_fields(mkc, 0, 0, ent->dev->umrc.pd); 304 + set_mkc_access_pd_addr_fields(mkc, ent->rb_key.access_flags, 0, 305 + ent->dev->umrc.pd); 305 306 MLX5_SET(mkc, mkc, free, 1); 306 307 MLX5_SET(mkc, mkc, umr_en, 1); 307 308 MLX5_SET(mkc, mkc, access_mode_1_0, ent->rb_key.access_mode & 0x3); ··· 1025 1024 if (!dev->cache.wq) 1026 1025 return; 1027 1026 1028 - cancel_delayed_work_sync(&dev->cache.remove_ent_dwork); 1029 1027 mutex_lock(&dev->cache.rb_lock); 1030 1028 for (node = rb_first(root); node; node = rb_next(node)) { 1031 1029 ent = rb_entry(node, struct mlx5_cache_ent, node); 1032 1030 xa_lock_irq(&ent->mkeys); 1033 1031 ent->disabled = true; 1034 1032 xa_unlock_irq(&ent->mkeys); 1035 - cancel_delayed_work_sync(&ent->dwork); 1036 1033 } 1034 + mutex_unlock(&dev->cache.rb_lock); 1035 + 1036 + /* 1037 + * After all entries are disabled and will not reschedule on WQ, 1038 + * flush it and all async commands. 1039 + */ 1040 + flush_workqueue(dev->cache.wq); 1037 1041 1038 1042 mlx5_mkey_cache_debugfs_cleanup(dev); 1039 1043 mlx5_cmd_cleanup_async_ctx(&dev->async_ctx); 1040 1044 1045 + /* At this point all entries are disabled and have no concurrent work. */ 1046 + mutex_lock(&dev->cache.rb_lock); 1041 1047 node = rb_first(root); 1042 1048 while (node) { 1043 1049 ent = rb_entry(node, struct mlx5_cache_ent, node);
+12 -4
drivers/infiniband/sw/siw/siw_cm.c
··· 976 976 siw_cep_put(cep); 977 977 new_cep->listen_cep = NULL; 978 978 if (rv) { 979 + siw_cancel_mpatimer(new_cep); 979 980 siw_cep_set_free(new_cep); 980 981 goto error; 981 982 } ··· 1101 1100 /* 1102 1101 * Socket close before MPA request received. 1103 1102 */ 1104 - siw_dbg_cep(cep, "no mpareq: drop listener\n"); 1105 - siw_cep_put(cep->listen_cep); 1106 - cep->listen_cep = NULL; 1103 + if (cep->listen_cep) { 1104 + siw_dbg_cep(cep, 1105 + "no mpareq: drop listener\n"); 1106 + siw_cep_put(cep->listen_cep); 1107 + cep->listen_cep = NULL; 1108 + } 1107 1109 } 1108 1110 } 1109 1111 release_cep = 1; ··· 1231 1227 if (!cep) 1232 1228 goto out; 1233 1229 1234 - siw_dbg_cep(cep, "state: %d\n", cep->state); 1230 + siw_dbg_cep(cep, "cep state: %d, socket state %d\n", 1231 + cep->state, sk->sk_state); 1232 + 1233 + if (sk->sk_state != TCP_ESTABLISHED) 1234 + goto out; 1235 1235 1236 1236 switch (cep->state) { 1237 1237 case SIW_EPSTATE_RDMA_MODE:
+5 -11
drivers/infiniband/ulp/srp/ib_srp.c
··· 2784 2784 u32 tag; 2785 2785 u16 ch_idx; 2786 2786 struct srp_rdma_ch *ch; 2787 - int ret; 2788 2787 2789 2788 shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n"); 2790 2789 ··· 2797 2798 shost_printk(KERN_ERR, target->scsi_host, 2798 2799 "Sending SRP abort for tag %#x\n", tag); 2799 2800 if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun, 2800 - SRP_TSK_ABORT_TASK, NULL) == 0) 2801 - ret = SUCCESS; 2802 - else if (target->rport->state == SRP_RPORT_LOST) 2803 - ret = FAST_IO_FAIL; 2804 - else 2805 - ret = FAILED; 2806 - if (ret == SUCCESS) { 2801 + SRP_TSK_ABORT_TASK, NULL) == 0) { 2807 2802 srp_free_req(ch, req, scmnd, 0); 2808 - scmnd->result = DID_ABORT << 16; 2809 - scsi_done(scmnd); 2803 + return SUCCESS; 2810 2804 } 2805 + if (target->rport->state == SRP_RPORT_LOST) 2806 + return FAST_IO_FAIL; 2811 2807 2812 - return ret; 2808 + return FAILED; 2813 2809 } 2814 2810 2815 2811 static int srp_reset_device(struct scsi_cmnd *scmnd)