Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:
"Two more merge window regressions, a corruption bug in hfi1 and a few
other small fixes.

- Missing user input validation regression in ucma

- Disallowing a previously allowed user combination regression in
mlx5

- ODP prefetch memory leaking triggerable by userspace

- Memory corruption in hf1 due to faulty ring buffer logic

- Missed mutex initialization crash in mlx5

- Two small defects with RDMA DIM"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
RDMA/core: Free DIM memory in error unwind
RDMA/core: Stop DIM before destroying CQ
RDMA/mlx5: Initialize QP mutex for the debug kernels
IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE
RDMA/mlx5: Allow providing extra scatter CQE QP flag
RDMA/mlx5: Fix prefetch memory leak if get_prefetchable_mr fails
RDMA/cm: Add min length checks to user structure copies

+57 -51
+11 -3
drivers/infiniband/core/cq.c
··· 72 72 INIT_WORK(&dim->work, ib_cq_rdma_dim_work); 73 73 } 74 74 75 + static void rdma_dim_destroy(struct ib_cq *cq) 76 + { 77 + if (!cq->dim) 78 + return; 79 + 80 + cancel_work_sync(&cq->dim->work); 81 + kfree(cq->dim); 82 + } 83 + 75 84 static int __poll_cq(struct ib_cq *cq, int num_entries, struct ib_wc *wc) 76 85 { 77 86 int rc; ··· 275 266 return cq; 276 267 277 268 out_destroy_cq: 269 + rdma_dim_destroy(cq); 278 270 rdma_restrack_del(&cq->res); 279 271 cq->device->ops.destroy_cq(cq, udata); 280 272 out_free_wc: ··· 341 331 WARN_ON_ONCE(1); 342 332 } 343 333 334 + rdma_dim_destroy(cq); 344 335 trace_cq_free(cq); 345 336 rdma_restrack_del(&cq->res); 346 337 cq->device->ops.destroy_cq(cq, udata); 347 - if (cq->dim) 348 - cancel_work_sync(&cq->dim->work); 349 - kfree(cq->dim); 350 338 kfree(cq->wc); 351 339 kfree(cq); 352 340 }
+4
drivers/infiniband/core/ucma.c
··· 1084 1084 size_t in_size; 1085 1085 int ret; 1086 1086 1087 + if (in_len < offsetofend(typeof(cmd), reserved)) 1088 + return -EINVAL; 1087 1089 in_size = min_t(size_t, in_len, sizeof(cmd)); 1088 1090 if (copy_from_user(&cmd, inbuf, in_size)) 1089 1091 return -EFAULT; ··· 1143 1141 size_t in_size; 1144 1142 int ret; 1145 1143 1144 + if (in_len < offsetofend(typeof(cmd), reserved)) 1145 + return -EINVAL; 1146 1146 in_size = min_t(size_t, in_len, sizeof(cmd)); 1147 1147 if (copy_from_user(&cmd, inbuf, in_size)) 1148 1148 return -EFAULT;
+2 -3
drivers/infiniband/hw/mlx5/odp.c
··· 1797 1797 work->frags[i].mr = 1798 1798 get_prefetchable_mr(pd, advice, sg_list[i].lkey); 1799 1799 if (!work->frags[i].mr) { 1800 - work->num_sge = i - 1; 1801 - if (i) 1802 - destroy_prefetch_work(work); 1800 + work->num_sge = i; 1803 1801 return false; 1804 1802 } 1805 1803 ··· 1863 1865 srcu_key = srcu_read_lock(&dev->odp_srcu); 1864 1866 if (!init_prefetch_work(pd, advice, pf_flags, work, sg_list, num_sge)) { 1865 1867 srcu_read_unlock(&dev->odp_srcu, srcu_key); 1868 + destroy_prefetch_work(work); 1866 1869 return -EINVAL; 1867 1870 } 1868 1871 queue_work(system_unbound_wq, &work->work);
+16 -13
drivers/infiniband/hw/mlx5/qp.c
··· 1766 1766 } 1767 1767 1768 1768 static void configure_requester_scat_cqe(struct mlx5_ib_dev *dev, 1769 + struct mlx5_ib_qp *qp, 1769 1770 struct ib_qp_init_attr *init_attr, 1770 - struct mlx5_ib_create_qp *ucmd, 1771 1771 void *qpc) 1772 1772 { 1773 1773 int scqe_sz; 1774 1774 bool allow_scat_cqe = false; 1775 1775 1776 - if (ucmd) 1777 - allow_scat_cqe = ucmd->flags & MLX5_QP_FLAG_ALLOW_SCATTER_CQE; 1776 + allow_scat_cqe = qp->flags_en & MLX5_QP_FLAG_ALLOW_SCATTER_CQE; 1778 1777 1779 1778 if (!allow_scat_cqe && init_attr->sq_sig_type != IB_SIGNAL_ALL_WR) 1780 1779 return; ··· 1851 1852 void *qpc; 1852 1853 u32 *in; 1853 1854 int err; 1854 - 1855 - mutex_init(&qp->mutex); 1856 1855 1857 1856 if (attr->sq_sig_type == IB_SIGNAL_ALL_WR) 1858 1857 qp->sq_signal_bits = MLX5_WQE_CTRL_CQ_UPDATE; ··· 1935 1938 u32 *in; 1936 1939 int err; 1937 1940 1938 - mutex_init(&qp->mutex); 1939 1941 spin_lock_init(&qp->sq.lock); 1940 1942 spin_lock_init(&qp->rq.lock); 1941 1943 ··· 2008 2012 } 2009 2013 if ((qp->flags_en & MLX5_QP_FLAG_SCATTER_CQE) && 2010 2014 (qp->type == MLX5_IB_QPT_DCI || qp->type == IB_QPT_RC)) 2011 - configure_requester_scat_cqe(dev, init_attr, ucmd, qpc); 2015 + configure_requester_scat_cqe(dev, qp, init_attr, qpc); 2012 2016 2013 2017 if (qp->rq.wqe_cnt) { 2014 2018 MLX5_SET(qpc, qpc, log_rq_stride, qp->rq.wqe_shift - 4); ··· 2125 2129 u32 *in; 2126 2130 int err; 2127 2131 2128 - mutex_init(&qp->mutex); 2129 2132 spin_lock_init(&qp->sq.lock); 2130 2133 spin_lock_init(&qp->rq.lock); 2131 2134 ··· 2538 2543 return; 2539 2544 } 2540 2545 2541 - if (flag == MLX5_QP_FLAG_SCATTER_CQE) { 2546 + switch (flag) { 2547 + case MLX5_QP_FLAG_SCATTER_CQE: 2548 + case MLX5_QP_FLAG_ALLOW_SCATTER_CQE: 2542 2549 /* 2543 - * We don't return error if this flag was provided, 2544 - * and mlx5 doesn't have right capability. 2545 - */ 2546 - *flags &= ~MLX5_QP_FLAG_SCATTER_CQE; 2550 + * We don't return error if these flags were provided, 2551 + * and mlx5 doesn't have right capability. 2552 + */ 2553 + *flags &= ~(MLX5_QP_FLAG_SCATTER_CQE | 2554 + MLX5_QP_FLAG_ALLOW_SCATTER_CQE); 2547 2555 return; 2556 + default: 2557 + break; 2548 2558 } 2549 2559 mlx5_ib_dbg(dev, "Vendor create QP flag 0x%X is not supported\n", flag); 2550 2560 } ··· 2588 2588 2589 2589 process_vendor_flag(dev, &flags, MLX5_QP_FLAG_SIGNATURE, true, qp); 2590 2590 process_vendor_flag(dev, &flags, MLX5_QP_FLAG_SCATTER_CQE, 2591 + MLX5_CAP_GEN(mdev, sctr_data_cqe), qp); 2592 + process_vendor_flag(dev, &flags, MLX5_QP_FLAG_ALLOW_SCATTER_CQE, 2591 2593 MLX5_CAP_GEN(mdev, sctr_data_cqe), qp); 2592 2594 2593 2595 if (qp->type == IB_QPT_RAW_PACKET) { ··· 2965 2963 goto free_ucmd; 2966 2964 } 2967 2965 2966 + mutex_init(&qp->mutex); 2968 2967 qp->type = type; 2969 2968 if (udata) { 2970 2969 err = process_vendor_flags(dev, qp, params.ucmd, attr);
+4 -29
drivers/infiniband/sw/rdmavt/qp.c
··· 901 901 qp->s_tail_ack_queue = 0; 902 902 qp->s_acked_ack_queue = 0; 903 903 qp->s_num_rd_atomic = 0; 904 - if (qp->r_rq.kwq) 905 - qp->r_rq.kwq->count = qp->r_rq.size; 906 904 qp->r_sge.num_sge = 0; 907 905 atomic_set(&qp->s_reserved_used, 0); 908 906 } ··· 2365 2367 } 2366 2368 2367 2369 /** 2368 - * get_count - count numbers of request work queue entries 2369 - * in circular buffer 2370 - * @rq: data structure for request queue entry 2371 - * @tail: tail indices of the circular buffer 2372 - * @head: head indices of the circular buffer 2373 - * 2374 - * Return - total number of entries in the circular buffer 2375 - */ 2376 - static u32 get_count(struct rvt_rq *rq, u32 tail, u32 head) 2377 - { 2378 - u32 count; 2379 - 2380 - count = head; 2381 - 2382 - if (count >= rq->size) 2383 - count = 0; 2384 - if (count < tail) 2385 - count += rq->size - tail; 2386 - else 2387 - count -= tail; 2388 - 2389 - return count; 2390 - } 2391 - 2392 - /** 2393 2370 * get_rvt_head - get head indices of the circular buffer 2394 2371 * @rq: data structure for request queue entry 2395 2372 * @ip: the QP ··· 2438 2465 2439 2466 if (kwq->count < RVT_RWQ_COUNT_THRESHOLD) { 2440 2467 head = get_rvt_head(rq, ip); 2441 - kwq->count = get_count(rq, tail, head); 2468 + kwq->count = rvt_get_rq_count(rq, head, tail); 2442 2469 } 2443 2470 if (unlikely(kwq->count == 0)) { 2444 2471 ret = 0; ··· 2473 2500 * the number of remaining WQEs. 2474 2501 */ 2475 2502 if (kwq->count < srq->limit) { 2476 - kwq->count = get_count(rq, tail, get_rvt_head(rq, ip)); 2503 + kwq->count = 2504 + rvt_get_rq_count(rq, 2505 + get_rvt_head(rq, ip), tail); 2477 2506 if (kwq->count < srq->limit) { 2478 2507 struct ib_event ev; 2479 2508
+1 -3
drivers/infiniband/sw/rdmavt/rc.c
··· 127 127 * not atomic, which is OK, since the fuzziness is 128 128 * resolved as further ACKs go out. 129 129 */ 130 - credits = head - tail; 131 - if ((int)credits < 0) 132 - credits += qp->r_rq.size; 130 + credits = rvt_get_rq_count(&qp->r_rq, head, tail); 133 131 } 134 132 /* 135 133 * Binary search the credit table to find the code to
+19
include/rdma/rdmavt_qp.h
··· 305 305 spinlock_t lock ____cacheline_aligned_in_smp; 306 306 }; 307 307 308 + /** 309 + * rvt_get_rq_count - count numbers of request work queue entries 310 + * in circular buffer 311 + * @rq: data structure for request queue entry 312 + * @head: head indices of the circular buffer 313 + * @tail: tail indices of the circular buffer 314 + * 315 + * Return - total number of entries in the Receive Queue 316 + */ 317 + 318 + static inline u32 rvt_get_rq_count(struct rvt_rq *rq, u32 head, u32 tail) 319 + { 320 + u32 count = head - tail; 321 + 322 + if ((s32)count < 0) 323 + count += rq->size; 324 + return count; 325 + } 326 + 308 327 /* 309 328 * This structure holds the information that the send tasklet needs 310 329 * to send a RDMA read response or atomic operation.