Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:

- Older "does not even boot" regression in qib from July

- Bug fixes for error unwind in rtrs

- Avoid a deadlock syzkaller found in srp

- Fix another UAF syzkaller found in cma

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
RDMA/cma: Do not change route.addr.src_addr outside state checks
RDMA/ib_srp: Fix a deadlock
RDMA/rtrs-clt: Move free_permit from free_clt to rtrs_clt_close
RDMA/rtrs-clt: Fix possible double free in error case
IB/qib: Fix duplicate sysfs directory name

+49 -36
+23 -15
drivers/infiniband/core/cma.c
··· 3370 3370 static int cma_bind_addr(struct rdma_cm_id *id, struct sockaddr *src_addr, 3371 3371 const struct sockaddr *dst_addr) 3372 3372 { 3373 - if (!src_addr || !src_addr->sa_family) { 3374 - src_addr = (struct sockaddr *) &id->route.addr.src_addr; 3375 - src_addr->sa_family = dst_addr->sa_family; 3376 - if (IS_ENABLED(CONFIG_IPV6) && 3377 - dst_addr->sa_family == AF_INET6) { 3378 - struct sockaddr_in6 *src_addr6 = (struct sockaddr_in6 *) src_addr; 3379 - struct sockaddr_in6 *dst_addr6 = (struct sockaddr_in6 *) dst_addr; 3380 - src_addr6->sin6_scope_id = dst_addr6->sin6_scope_id; 3381 - if (ipv6_addr_type(&dst_addr6->sin6_addr) & IPV6_ADDR_LINKLOCAL) 3382 - id->route.addr.dev_addr.bound_dev_if = dst_addr6->sin6_scope_id; 3383 - } else if (dst_addr->sa_family == AF_IB) { 3384 - ((struct sockaddr_ib *) src_addr)->sib_pkey = 3385 - ((struct sockaddr_ib *) dst_addr)->sib_pkey; 3386 - } 3373 + struct sockaddr_storage zero_sock = {}; 3374 + 3375 + if (src_addr && src_addr->sa_family) 3376 + return rdma_bind_addr(id, src_addr); 3377 + 3378 + /* 3379 + * When the src_addr is not specified, automatically supply an any addr 3380 + */ 3381 + zero_sock.ss_family = dst_addr->sa_family; 3382 + if (IS_ENABLED(CONFIG_IPV6) && dst_addr->sa_family == AF_INET6) { 3383 + struct sockaddr_in6 *src_addr6 = 3384 + (struct sockaddr_in6 *)&zero_sock; 3385 + struct sockaddr_in6 *dst_addr6 = 3386 + (struct sockaddr_in6 *)dst_addr; 3387 + 3388 + src_addr6->sin6_scope_id = dst_addr6->sin6_scope_id; 3389 + if (ipv6_addr_type(&dst_addr6->sin6_addr) & IPV6_ADDR_LINKLOCAL) 3390 + id->route.addr.dev_addr.bound_dev_if = 3391 + dst_addr6->sin6_scope_id; 3392 + } else if (dst_addr->sa_family == AF_IB) { 3393 + ((struct sockaddr_ib *)&zero_sock)->sib_pkey = 3394 + ((struct sockaddr_ib *)dst_addr)->sib_pkey; 3387 3395 } 3388 - return rdma_bind_addr(id, src_addr); 3396 + return rdma_bind_addr(id, (struct sockaddr *)&zero_sock); 3389 3397 } 3390 3398 3391 3399 /*
+1 -1
drivers/infiniband/hw/qib/qib_sysfs.c
··· 541 541 }; 542 542 543 543 static const struct attribute_group port_diagc_group = { 544 - .name = "linkcontrol", 544 + .name = "diag_counters", 545 545 .attrs = port_diagc_attributes, 546 546 }; 547 547
+21 -18
drivers/infiniband/ulp/rtrs/rtrs-clt.c
··· 2682 2682 struct rtrs_clt_sess *clt = container_of(dev, struct rtrs_clt_sess, 2683 2683 dev); 2684 2684 2685 + mutex_destroy(&clt->paths_ev_mutex); 2686 + mutex_destroy(&clt->paths_mutex); 2685 2687 kfree(clt); 2686 2688 } 2687 2689 ··· 2713 2711 return ERR_PTR(-ENOMEM); 2714 2712 } 2715 2713 2714 + clt->dev.class = rtrs_clt_dev_class; 2715 + clt->dev.release = rtrs_clt_dev_release; 2716 2716 uuid_gen(&clt->paths_uuid); 2717 2717 INIT_LIST_HEAD_RCU(&clt->paths_list); 2718 2718 clt->paths_num = paths_num; ··· 2731 2727 init_waitqueue_head(&clt->permits_wait); 2732 2728 mutex_init(&clt->paths_ev_mutex); 2733 2729 mutex_init(&clt->paths_mutex); 2730 + device_initialize(&clt->dev); 2734 2731 2735 - clt->dev.class = rtrs_clt_dev_class; 2736 - clt->dev.release = rtrs_clt_dev_release; 2737 2732 err = dev_set_name(&clt->dev, "%s", sessname); 2738 2733 if (err) 2739 - goto err; 2734 + goto err_put; 2735 + 2740 2736 /* 2741 2737 * Suppress user space notification until 2742 2738 * sysfs files are created 2743 2739 */ 2744 2740 dev_set_uevent_suppress(&clt->dev, true); 2745 - err = device_register(&clt->dev); 2746 - if (err) { 2747 - put_device(&clt->dev); 2748 - goto err; 2749 - } 2741 + err = device_add(&clt->dev); 2742 + if (err) 2743 + goto err_put; 2750 2744 2751 2745 clt->kobj_paths = kobject_create_and_add("paths", &clt->dev.kobj); 2752 2746 if (!clt->kobj_paths) { 2753 2747 err = -ENOMEM; 2754 - goto err_dev; 2748 + goto err_del; 2755 2749 } 2756 2750 err = rtrs_clt_create_sysfs_root_files(clt); 2757 2751 if (err) { 2758 2752 kobject_del(clt->kobj_paths); 2759 2753 kobject_put(clt->kobj_paths); 2760 - goto err_dev; 2754 + goto err_del; 2761 2755 } 2762 2756 dev_set_uevent_suppress(&clt->dev, false); 2763 2757 kobject_uevent(&clt->dev.kobj, KOBJ_ADD); 2764 2758 2765 2759 return clt; 2766 - err_dev: 2767 - device_unregister(&clt->dev); 2768 - err: 2760 + err_del: 2761 + device_del(&clt->dev); 2762 + err_put: 2769 2763 free_percpu(clt->pcpu_path); 2770 - kfree(clt); 2764 + put_device(&clt->dev); 2771 2765 return ERR_PTR(err); 2772 2766 } 2773 2767 2774 2768 static void free_clt(struct rtrs_clt_sess *clt) 2775 2769 { 2776 - free_permits(clt); 2777 2770 free_percpu(clt->pcpu_path); 2778 - mutex_destroy(&clt->paths_ev_mutex); 2779 - mutex_destroy(&clt->paths_mutex); 2780 - /* release callback will free clt in last put */ 2771 + 2772 + /* 2773 + * release callback will free clt and destroy mutexes in last put 2774 + */ 2781 2775 device_unregister(&clt->dev); 2782 2776 } 2783 2777 ··· 2892 2890 rtrs_clt_destroy_path_files(clt_path, NULL); 2893 2891 kobject_put(&clt_path->kobj); 2894 2892 } 2893 + free_permits(clt); 2895 2894 free_clt(clt); 2896 2895 } 2897 2896 EXPORT_SYMBOL(rtrs_clt_close);
+4 -2
drivers/infiniband/ulp/srp/ib_srp.c
··· 4047 4047 spin_unlock(&host->target_lock); 4048 4048 4049 4049 /* 4050 - * Wait for tl_err and target port removal tasks. 4050 + * srp_queue_remove_work() queues a call to 4051 + * srp_remove_target(). The latter function cancels 4052 + * target->tl_err_work so waiting for the remove works to 4053 + * finish is sufficient. 4051 4054 */ 4052 - flush_workqueue(system_long_wq); 4053 4055 flush_workqueue(srp_remove_wq); 4054 4056 4055 4057 kfree(host);