Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma fixes from Jason Gunthorpe:
"A few minor bug fixes for user visible defects, and one regression:

- Various bugs from static checkers and syzkaller

- Add missing error checking in mlx4

- Prevent RTNL lock recursion in i40iw

- Fix segfault in cxgb4 in peer abort cases

- Fix a regression added in 5.7 where the IB_EVENT_DEVICE_FATAL could
be lost, and wasn't delivered to all the FDs"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
RDMA/uverbs: Move IB_EVENT_DEVICE_FATAL to destroy_uobj
RDMA/uverbs: Do not discard the IB_EVENT_DEVICE_FATAL event
RDMA/iw_cxgb4: Fix incorrect function parameters
RDMA/core: Fix double put of resource
IB/core: Fix potential NULL pointer dereference in pkey cache
IB/hfi1: Fix another case where pq is left on waitlist
IB/i40iw: Remove bogus call to netdev_master_upper_dev_get()
IB/mlx4: Test return value of calls to ib_get_cached_pkey
RDMA/rxe: Always return ERR_PTR from rxe_create_mmap_info()
i40iw: Fix error handling in i40iw_manage_arp_cache()

+68 -39
+5 -2
drivers/infiniband/core/cache.c
··· 1553 1553 if (err) 1554 1554 return err; 1555 1555 1556 - rdma_for_each_port (device, p) 1557 - ib_cache_update(device, p, true); 1556 + rdma_for_each_port (device, p) { 1557 + err = ib_cache_update(device, p, true); 1558 + if (err) 1559 + return err; 1560 + } 1558 1561 1559 1562 return 0; 1560 1563 }
+1 -2
drivers/infiniband/core/nldev.c
··· 1292 1292 has_cap_net_admin = netlink_capable(skb, CAP_NET_ADMIN); 1293 1293 1294 1294 ret = fill_func(msg, has_cap_net_admin, res, port); 1295 - 1296 - rdma_restrack_put(res); 1297 1295 if (ret) 1298 1296 goto err_free; 1299 1297 1298 + rdma_restrack_put(res); 1300 1299 nlmsg_end(msg, nlh); 1301 1300 ib_device_put(device); 1302 1301 return rdma_nl_unicast(sock_net(skb->sk), msg, NETLINK_CB(skb).portid);
+2 -1
drivers/infiniband/core/rdma_core.c
··· 459 459 struct ib_uobject *uobj; 460 460 struct file *filp; 461 461 462 - if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release)) 462 + if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release && 463 + fd_type->fops->release != &uverbs_async_event_release)) 463 464 return ERR_PTR(-EINVAL); 464 465 465 466 new_fd = get_unused_fd_flags(O_CLOEXEC);
+4
drivers/infiniband/core/uverbs.h
··· 219 219 void ib_uverbs_init_async_event_file(struct ib_uverbs_async_event_file *ev_file); 220 220 void ib_uverbs_free_event_queue(struct ib_uverbs_event_queue *event_queue); 221 221 void ib_uverbs_flow_resources_free(struct ib_uflow_resources *uflow_res); 222 + int uverbs_async_event_release(struct inode *inode, struct file *filp); 222 223 223 224 int ib_alloc_ucontext(struct uverbs_attr_bundle *attrs); 224 225 int ib_init_ucontext(struct uverbs_attr_bundle *attrs); ··· 228 227 struct ib_ucq_object *uobj); 229 228 void ib_uverbs_release_uevent(struct ib_uevent_object *uobj); 230 229 void ib_uverbs_release_file(struct kref *ref); 230 + void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file, 231 + __u64 element, __u64 event, 232 + struct list_head *obj_list, u32 *counter); 231 233 232 234 void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context); 233 235 void ib_uverbs_cq_event_handler(struct ib_event *event, void *context_ptr);
+4 -8
drivers/infiniband/core/uverbs_main.c
··· 346 346 .owner = THIS_MODULE, 347 347 .read = ib_uverbs_async_event_read, 348 348 .poll = ib_uverbs_async_event_poll, 349 - .release = uverbs_uobject_fd_release, 349 + .release = uverbs_async_event_release, 350 350 .fasync = ib_uverbs_async_event_fasync, 351 351 .llseek = no_llseek, 352 352 }; ··· 386 386 kill_fasync(&ev_queue->async_queue, SIGIO, POLL_IN); 387 387 } 388 388 389 - static void 390 - ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file, 391 - __u64 element, __u64 event, struct list_head *obj_list, 392 - u32 *counter) 389 + void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file, 390 + __u64 element, __u64 event, 391 + struct list_head *obj_list, u32 *counter) 393 392 { 394 393 struct ib_uverbs_event *entry; 395 394 unsigned long flags; ··· 1185 1186 * mmput). 1186 1187 */ 1187 1188 mutex_unlock(&uverbs_dev->lists_mutex); 1188 - 1189 - ib_uverbs_async_handler(READ_ONCE(file->async_file), 0, 1190 - IB_EVENT_DEVICE_FATAL, NULL, NULL); 1191 1189 1192 1190 uverbs_destroy_ufile_hw(file, RDMA_REMOVE_DRIVER_REMOVE); 1193 1191 kref_put(&file->ref, ib_uverbs_release_file);
+29 -1
drivers/infiniband/core/uverbs_std_types_async_fd.c
··· 26 26 container_of(uobj, struct ib_uverbs_async_event_file, uobj); 27 27 28 28 ib_unregister_event_handler(&event_file->event_handler); 29 - ib_uverbs_free_event_queue(&event_file->ev_queue); 29 + 30 + if (why == RDMA_REMOVE_DRIVER_REMOVE) 31 + ib_uverbs_async_handler(event_file, 0, IB_EVENT_DEVICE_FATAL, 32 + NULL, NULL); 30 33 return 0; 34 + } 35 + 36 + int uverbs_async_event_release(struct inode *inode, struct file *filp) 37 + { 38 + struct ib_uverbs_async_event_file *event_file; 39 + struct ib_uobject *uobj = filp->private_data; 40 + int ret; 41 + 42 + if (!uobj) 43 + return uverbs_uobject_fd_release(inode, filp); 44 + 45 + event_file = 46 + container_of(uobj, struct ib_uverbs_async_event_file, uobj); 47 + 48 + /* 49 + * The async event FD has to deliver IB_EVENT_DEVICE_FATAL even after 50 + * disassociation, so cleaning the event list must only happen after 51 + * release. The user knows it has reached the end of the event stream 52 + * when it sees IB_EVENT_DEVICE_FATAL. 53 + */ 54 + uverbs_uobject_get(uobj); 55 + ret = uverbs_uobject_fd_release(inode, filp); 56 + ib_uverbs_free_event_queue(&event_file->ev_queue); 57 + uverbs_uobject_put(uobj); 58 + return ret; 31 59 } 32 60 33 61 DECLARE_UVERBS_NAMED_METHOD(
+3 -4
drivers/infiniband/hw/cxgb4/cm.c
··· 2891 2891 srqidx = ABORT_RSS_SRQIDX_G( 2892 2892 be32_to_cpu(req->srqidx_status)); 2893 2893 if (srqidx) { 2894 - complete_cached_srq_buffers(ep, 2895 - req->srqidx_status); 2894 + complete_cached_srq_buffers(ep, srqidx); 2896 2895 } else { 2897 2896 /* Hold ep ref until finish_peer_abort() */ 2898 2897 c4iw_get_ep(&ep->com); ··· 3877 3878 return 0; 3878 3879 } 3879 3880 3880 - ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_W, 3881 - TCB_RQ_START_S); 3881 + ep->srqe_idx = t4_tcb_get_field32(tcb, TCB_RQ_START_W, TCB_RQ_START_M, 3882 + TCB_RQ_START_S); 3882 3883 cleanup: 3883 3884 pr_debug("ep %p tid %u %016x\n", ep, ep->hwtid, ep->srqe_idx); 3884 3885
-4
drivers/infiniband/hw/hfi1/user_sdma.c
··· 589 589 590 590 set_comp_state(pq, cq, info.comp_idx, QUEUED, 0); 591 591 pq->state = SDMA_PKT_Q_ACTIVE; 592 - /* Send the first N packets in the request to buy us some time */ 593 - ret = user_sdma_send_pkts(req, pcount); 594 - if (unlikely(ret < 0 && ret != -EBUSY)) 595 - goto free_req; 596 592 597 593 /* 598 594 * This is a somewhat blocking send implementation.
-8
drivers/infiniband/hw/i40iw/i40iw_cm.c
··· 1987 1987 struct rtable *rt; 1988 1988 struct neighbour *neigh; 1989 1989 int rc = arpindex; 1990 - struct net_device *netdev = iwdev->netdev; 1991 1990 __be32 dst_ipaddr = htonl(dst_ip); 1992 1991 __be32 src_ipaddr = htonl(src_ip); 1993 1992 ··· 1995 1996 i40iw_pr_err("ip_route_output\n"); 1996 1997 return rc; 1997 1998 } 1998 - 1999 - if (netif_is_bond_slave(netdev)) 2000 - netdev = netdev_master_upper_dev_get(netdev); 2001 1999 2002 2000 neigh = dst_neigh_lookup(&rt->dst, &dst_ipaddr); 2003 2001 ··· 2061 2065 { 2062 2066 struct neighbour *neigh; 2063 2067 int rc = arpindex; 2064 - struct net_device *netdev = iwdev->netdev; 2065 2068 struct dst_entry *dst; 2066 2069 struct sockaddr_in6 dst_addr; 2067 2070 struct sockaddr_in6 src_addr; ··· 2080 2085 } 2081 2086 return rc; 2082 2087 } 2083 - 2084 - if (netif_is_bond_slave(netdev)) 2085 - netdev = netdev_master_upper_dev_get(netdev); 2086 2088 2087 2089 neigh = dst_neigh_lookup(dst, dst_addr.sin6_addr.in6_u.u6_addr32); 2088 2090
+1 -1
drivers/infiniband/hw/i40iw/i40iw_hw.c
··· 534 534 int arp_index; 535 535 536 536 arp_index = i40iw_arp_table(iwdev, ip_addr, ipv4, mac_addr, action); 537 - if (arp_index == -1) 537 + if (arp_index < 0) 538 538 return; 539 539 cqp_request = i40iw_get_cqp_request(&iwdev->cqp, false); 540 540 if (!cqp_request)
+11 -3
drivers/infiniband/hw/mlx4/qp.c
··· 2891 2891 int send_size; 2892 2892 int header_size; 2893 2893 int spc; 2894 + int err; 2894 2895 int i; 2895 2896 2896 2897 if (wr->wr.opcode != IB_WR_SEND) ··· 2926 2925 2927 2926 sqp->ud_header.lrh.virtual_lane = 0; 2928 2927 sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED); 2929 - ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey); 2928 + err = ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey); 2929 + if (err) 2930 + return err; 2930 2931 sqp->ud_header.bth.pkey = cpu_to_be16(pkey); 2931 2932 if (sqp->qp.mlx4_ib_qp_type == MLX4_IB_QPT_TUN_SMI_OWNER) 2932 2933 sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn); ··· 3215 3212 } 3216 3213 sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED); 3217 3214 if (!sqp->qp.ibqp.qp_num) 3218 - ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, &pkey); 3215 + err = ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, 3216 + &pkey); 3219 3217 else 3220 - ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, &pkey); 3218 + err = ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, 3219 + &pkey); 3220 + if (err) 3221 + return err; 3222 + 3221 3223 sqp->ud_header.bth.pkey = cpu_to_be16(pkey); 3222 3224 sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn); 3223 3225 sqp->ud_header.bth.psn = cpu_to_be32((sqp->send_psn++) & ((1 << 24) - 1));
+1 -1
drivers/infiniband/sw/rxe/rxe_mmap.c
··· 151 151 152 152 ip = kmalloc(sizeof(*ip), GFP_KERNEL); 153 153 if (!ip) 154 - return NULL; 154 + return ERR_PTR(-ENOMEM); 155 155 156 156 size = PAGE_ALIGN(size); 157 157
+7 -4
drivers/infiniband/sw/rxe/rxe_queue.c
··· 45 45 46 46 if (outbuf) { 47 47 ip = rxe_create_mmap_info(rxe, buf_size, udata, buf); 48 - if (!ip) 48 + if (IS_ERR(ip)) { 49 + err = PTR_ERR(ip); 49 50 goto err1; 51 + } 50 52 51 - err = copy_to_user(outbuf, &ip->info, sizeof(ip->info)); 52 - if (err) 53 + if (copy_to_user(outbuf, &ip->info, sizeof(ip->info))) { 54 + err = -EFAULT; 53 55 goto err2; 56 + } 54 57 55 58 spin_lock_bh(&rxe->pending_lock); 56 59 list_add(&ip->pending_mmaps, &rxe->pending_mmaps); ··· 67 64 err2: 68 65 kfree(ip); 69 66 err1: 70 - return -EINVAL; 67 + return err; 71 68 } 72 69 73 70 inline void rxe_queue_reset(struct rxe_queue *q)