Commit 6ce4d44f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma 

Pull rdma fixes from Jason Gunthorpe:

 - Fix several syzkaller found bugs:
    - Poor parsing of the RDMA_NL_LS_OP_IP_RESOLVE netlink
    - GID entry refcount leaking when CM destruction races with
      multicast establishment
    - Missing refcount put in ib_del_sub_device_and_put()

 - Fixup recently introduced uABI padding for 32 bit consistency

 - Avoid user triggered math overflow in MANA and AFA

 - Reading invalid netdev data during an event

 - kdoc fixes

 - Fix never-working gid copying in ib_get_gids_from_rdma_hdr

 - Typo in bnxt when validating the BAR

 - bnxt mis-parsed IB_SEND_IP_CSUM so it didn't work always

 - bnxt out of bounds access in bnxt related to the counters on new
   devices

 - Allocate the bnxt PDE table with the right sizing

 - Use dma_free_coherent() correctly in bnxt

 - Allow rxe to be unloadable when CONFIG_PROVE_LOCKING by adjusting the
   tracking of the global sockets it uses

 - Missing unlocking on error path in rxe

 - Compute the right number of pages in a MR in rtrs

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/bnxt_re: fix dma_free_coherent() pointer
  RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
  IB/rxe: Fix missing umem_odp->umem_mutex unlock on error path
  RDMA/bnxt_re: Fix to use correct page size for PDE table
  RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()
  RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
  RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
  RDMA/rxe: let rxe_reclassify_recv_socket() call sk_owner_put()
  RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
  RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
  RDMA/efa: Remove possible negative shift
  RTRS/rtrs: clean up rtrs headers kernel-doc
  RDMA/irdma: avoid invalid read in irdma_net_event
  RDMA/mana_ib: check cqe length for kernel CQs
  RDMA/irdma: Fix irdma_alloc_ucontext_resp padding
  RDMA/ucma: Fix rdma_ucm_query_ib_service_resp struct padding
  RDMA/cm: Fix leaking the multicast GID table reference
  RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
parents 3d35fa11 fcd431a9

drivers/infiniband/core/addr.c

+10 −23
Original line number Diff line number Diff line
@@ -80,37 +80,25 @@ static const struct nla_policy ib_nl_addr_policy[LS_NLA_TYPE_MAX] = { 
		.min = sizeof(struct rdma_nla_ls_gid)},

};



static inline bool ib_nl_is_good_ip_resp(const struct nlmsghdr *nlh)

static void ib_nl_process_ip_rsep(const struct nlmsghdr *nlh)

{

	struct nlattr *tb[LS_NLA_TYPE_MAX] = {};

	union ib_gid gid;

	struct addr_req *req;

	int found = 0;

	int ret;



	if (nlh->nlmsg_flags & RDMA_NL_LS_F_ERR)

		return false;

		return;



	ret = nla_parse_deprecated(tb, LS_NLA_TYPE_MAX - 1, nlmsg_data(nlh),

				   nlmsg_len(nlh), ib_nl_addr_policy, NULL);

	if (ret)

		return false;



	return true;

}



static void ib_nl_process_good_ip_rsep(const struct nlmsghdr *nlh)

{

	const struct nlattr *head, *curr;

	union ib_gid gid;

	struct addr_req *req;

	int len, rem;

	int found = 0;



	head = (const struct nlattr *)nlmsg_data(nlh);

	len = nlmsg_len(nlh);

		return;



	nla_for_each_attr(curr, head, len, rem) {

		if (curr->nla_type == LS_NLA_TYPE_DGID)

			memcpy(&gid, nla_data(curr), nla_len(curr));

	}

	if (!tb[LS_NLA_TYPE_DGID])

		return;

	memcpy(&gid, nla_data(tb[LS_NLA_TYPE_DGID]), sizeof(gid));



	spin_lock_bh(&lock);

	list_for_each_entry(req, &req_list, list) {
@@ -137,8 +125,7 @@ int ib_nl_handle_ip_res_resp(struct sk_buff *skb, 
	    !(NETLINK_CB(skb).sk))

		return -EPERM;



	if (ib_nl_is_good_ip_resp(nlh))

		ib_nl_process_good_ip_rsep(nlh);

	ib_nl_process_ip_rsep(nlh);



	return 0;

}

drivers/infiniband/core/cma.c

+3 −0
Original line number Diff line number Diff line
@@ -2009,6 +2009,7 @@ static void destroy_mc(struct rdma_id_private *id_priv, 
		ib_sa_free_multicast(mc->sa_mc);



	if (rdma_protocol_roce(id_priv->id.device, id_priv->id.port_num)) {

		struct rdma_cm_event *event = &mc->iboe_join.event;

		struct rdma_dev_addr *dev_addr =

			&id_priv->id.route.addr.dev_addr;

		struct net_device *ndev = NULL;
@@ -2031,6 +2032,8 @@ static void destroy_mc(struct rdma_id_private *id_priv, 
		dev_put(ndev);



		cancel_work_sync(&mc->iboe_join.work);

		if (event->event == RDMA_CM_EVENT_MULTICAST_JOIN)

			rdma_destroy_ah_attr(&event->param.ud.ah_attr);

	}

	kfree(mc);

}

drivers/infiniband/core/device.c

+3 −1
Original line number Diff line number Diff line
@@ -2881,8 +2881,10 @@ int ib_del_sub_device_and_put(struct ib_device *sub) 
{

	struct ib_device *parent = sub->parent;



	if (!parent)

	if (!parent) {

		ib_device_put(sub);

		return -EOPNOTSUPP;

	}



	mutex_lock(&parent->subdev_lock);

	list_del(&sub->subdev_list);

drivers/infiniband/core/verbs.c

+1 −1
Original line number Diff line number Diff line
@@ -738,7 +738,7 @@ int ib_get_gids_from_rdma_hdr(const union rdma_network_hdr *hdr, 
				       (struct in6_addr *)dgid);

		return 0;

	} else if (net_type == RDMA_NETWORK_IPV6 ||

		   net_type == RDMA_NETWORK_IB || RDMA_NETWORK_ROCE_V1) {

		   net_type == RDMA_NETWORK_IB || net_type == RDMA_NETWORK_ROCE_V1) {

		*dgid = hdr->ibgrh.dgid;

		*sgid = hdr->ibgrh.sgid;

		return 0;

drivers/infiniband/hw/bnxt_re/hw_counters.h

+3 −3
Original line number Diff line number Diff line
@@ -89,6 +89,9 @@ enum bnxt_re_hw_stats { 
	BNXT_RE_RES_SRQ_LOAD_ERR,

	BNXT_RE_RES_TX_PCI_ERR,

	BNXT_RE_RES_RX_PCI_ERR,

	BNXT_RE_REQ_CQE_ERROR,

	BNXT_RE_RESP_CQE_ERROR,

	BNXT_RE_RESP_REMOTE_ACCESS_ERRS,

	BNXT_RE_OUT_OF_SEQ_ERR,

	BNXT_RE_TX_ATOMIC_REQ,

	BNXT_RE_TX_READ_REQ,
@@ -110,9 +113,6 @@ enum bnxt_re_hw_stats { 
	BNXT_RE_TX_CNP,

	BNXT_RE_RX_CNP,

	BNXT_RE_RX_ECN,

	BNXT_RE_REQ_CQE_ERROR,

	BNXT_RE_RESP_CQE_ERROR,

	BNXT_RE_RESP_REMOTE_ACCESS_ERRS,

	BNXT_RE_NUM_EXT_COUNTERS

};