Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Pull rdma fixes from Jason Gunthorpe:
"Last pull for 5.16, the reversion has been known for a while now but
didn't get a proper fix in time. Looks like we will have several
info-leak bugs to take care of going foward.
- Revert the patch fixing the DM related crash causing a widespread
regression for kernel ULPs. A proper fix just didn't appear this
cycle due to the holidays
- Missing NULL check on alloc in uverbs
- Double free in rxe error paths
- Fix a new kernel-infoleak report when forming ah_attr's without
GRH's in ucma"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
RDMA/core: Don't infoleak GRH fields
RDMA/uverbs: Check for null return of kmalloc_array
Revert "RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow"
RDMA/rxe: Prevent double freeing rxe_map_set()
+28
-25
+1
-1
drivers/infiniband/core/uverbs_marshall.c
+1
-1
drivers/infiniband/core/uverbs_marshall.c
···
66
66
struct rdma_ah_attr *src = ah_attr;
67
67
struct rdma_ah_attr conv_ah;
68
68
69
-
memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
69
+
memset(&dst->grh, 0, sizeof(dst->grh));
70
70
71
71
if ((ah_attr->type == RDMA_AH_ATTR_TYPE_OPA) &&
72
72
(rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) &&
+3
drivers/infiniband/core/uverbs_uapi.c
+3
drivers/infiniband/core/uverbs_uapi.c
···
447
447
uapi->num_write_ex = max_write_ex + 1;
448
448
data = kmalloc_array(uapi->num_write + uapi->num_write_ex,
449
449
sizeof(*uapi->write_methods), GFP_KERNEL);
450
+
if (!data)
451
+
return -ENOMEM;
452
+
450
453
for (i = 0; i != uapi->num_write + uapi->num_write_ex; i++)
451
454
data[i] = &uapi->notsupp_method;
452
455
uapi->write_methods = data;
+3
-3
drivers/infiniband/hw/mlx5/mlx5_ib.h
+3
-3
drivers/infiniband/hw/mlx5/mlx5_ib.h
···
664
664
665
665
/* User MR data */
666
666
struct mlx5_cache_ent *cache_ent;
667
+
struct ib_umem *umem;
667
668
668
669
/* This is zero'd when the MR is allocated */
669
670
union {
···
676
675
struct list_head list;
677
676
};
678
677
679
-
/* Used only by kernel MRs */
678
+
/* Used only by kernel MRs (umem == NULL) */
680
679
struct {
681
680
void *descs;
682
681
void *descs_alloc;
···
697
696
int data_length;
698
697
};
699
698
700
-
/* Used only by User MRs */
699
+
/* Used only by User MRs (umem != NULL) */
701
700
struct {
702
-
struct ib_umem *umem;
703
701
unsigned int page_shift;
704
702
/* Current access_flags */
705
703
int access_flags;
+14
-12
drivers/infiniband/hw/mlx5/mr.c
+14
-12
drivers/infiniband/hw/mlx5/mr.c
···
1904
1904
return ret;
1905
1905
}
1906
1906
1907
-
static void mlx5_free_priv_descs(struct mlx5_ib_mr *mr)
1907
+
static void
1908
+
mlx5_free_priv_descs(struct mlx5_ib_mr *mr)
1908
1909
{
1909
-
struct mlx5_ib_dev *dev = to_mdev(mr->ibmr.device);
1910
-
int size = mr->max_descs * mr->desc_size;
1910
+
if (!mr->umem && mr->descs) {
1911
+
struct ib_device *device = mr->ibmr.device;
1912
+
int size = mr->max_descs * mr->desc_size;
1913
+
struct mlx5_ib_dev *dev = to_mdev(device);
1911
1914
1912
-
if (!mr->descs)
1913
-
return;
1914
-
1915
-
dma_unmap_single(&dev->mdev->pdev->dev, mr->desc_map, size,
1916
-
DMA_TO_DEVICE);
1917
-
kfree(mr->descs_alloc);
1918
-
mr->descs = NULL;
1915
+
dma_unmap_single(&dev->mdev->pdev->dev, mr->desc_map, size,
1916
+
DMA_TO_DEVICE);
1917
+
kfree(mr->descs_alloc);
1918
+
mr->descs = NULL;
1919
+
}
1919
1920
}
1920
1921
1921
1922
int mlx5_ib_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
···
1992
1991
if (mr->cache_ent) {
1993
1992
mlx5_mr_cache_free(dev, mr);
1994
1993
} else {
1995
-
if (!udata)
1996
-
mlx5_free_priv_descs(mr);
1994
+
mlx5_free_priv_descs(mr);
1997
1995
kfree(mr);
1998
1996
}
1999
1997
return 0;
···
2079
2079
if (err)
2080
2080
goto err_free_in;
2081
2081
2082
+
mr->umem = NULL;
2082
2083
kfree(in);
2083
2084
2084
2085
return mr;
···
2206
2205
}
2207
2206
2208
2207
mr->ibmr.device = pd->device;
2208
+
mr->umem = NULL;
2209
2209
2210
2210
switch (mr_type) {
2211
2211
case IB_MR_TYPE_MEM_REG:
+7
-9
drivers/infiniband/sw/rxe/rxe_mr.c
+7
-9
drivers/infiniband/sw/rxe/rxe_mr.c
···
135
135
136
136
ret = rxe_mr_alloc_map_set(num_map, &mr->cur_map_set);
137
137
if (ret)
138
-
goto err_out;
138
+
return -ENOMEM;
139
139
140
140
if (both) {
141
141
ret = rxe_mr_alloc_map_set(num_map, &mr->next_map_set);
142
-
if (ret) {
143
-
rxe_mr_free_map_set(mr->num_map, mr->cur_map_set);
144
-
goto err_out;
145
-
}
142
+
if (ret)
143
+
goto err_free;
146
144
}
147
145
148
146
return 0;
149
147
150
-
err_out:
148
+
err_free:
149
+
rxe_mr_free_map_set(mr->num_map, mr->cur_map_set);
150
+
mr->cur_map_set = NULL;
151
151
return -ENOMEM;
152
152
}
153
153
···
214
214
pr_warn("%s: Unable to get virtual address\n",
215
215
__func__);
216
216
err = -ENOMEM;
217
-
goto err_cleanup_map;
217
+
goto err_release_umem;
218
218
}
219
219
220
220
buf->addr = (uintptr_t)vaddr;
···
237
237
238
238
return 0;
239
239
240
-
err_cleanup_map:
241
-
rxe_mr_free_map_set(mr->num_map, mr->cur_map_set);
242
240
err_release_umem:
243
241
ib_umem_release(umem);
244
242
err_out: