kernel/linux.git/drivers/infiniband/hw/ionic/ionic_controlpath.c, branch v6.19.11

RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init()

2026-04-02T11:25:41+00:00

commit a08aaf3968aec5d05cd32c801b8cc0c61da69c41 upstream. ionic_build_hdr() populated the Ethernet source MAC (hdr->eth.smac_h) by passing the header’s storage directly to rdma_read_gid_l2_fields(). However, ib_ud_header_init() is called after that and re-initializes the UD header, which wipes the previously written smac_h. As a result, packets are emitted with an zero source MAC address on the wire. Correct the source MAC by reading the GID-derived smac into a temporary buffer and copy it after ib_ud_header_init() completes. Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Cc: stable@vger.kernel.org # 6.18 Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20260227061809.2979990-1-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky Signed-off-by: Greg Kroah-Hartman

RDMA/ionic: Fix kernel stack leak in ionic_create_cq()

2026-03-12T11:09:35+00:00

commit faa72102b178c7ae6c6afea23879e7c84fc59b4e upstream. struct ionic_cq_resp resp { __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below) __u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask) __u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK }; rsvd[7]: 7 bytes of stack memory leaked unconditionally. cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but udma_count could be 1, meaning cqid[1] might never be written via ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4 bytes) is also leaked. So potentially 11 bytes leaked. Cc: stable@vger.kernel.org Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Signed-off-by: Jason Gunthorpe Link: https://patch.msgid.link/4-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com Acked-by: Abhijit Gangurde Signed-off-by: Leon Romanovsky Signed-off-by: Greg Kroah-Hartman

RDMA/ionic: Use ether_addr_copy instead of memcpy

2025-09-21T11:30:37+00:00

eth header from ib_ud_header structure packs the mac into 4B high and 2B low parts. But when 4B high is used in memcpy, it sees it as overflow. However, this is safe due to the 4B high and 2B low arrangement in the structure. To avoid the memcpy warning, use ether_addr_copy to copy the mac address. In function ‘fortify_memcpy_chk’, inlined from ‘ionic_set_ah_attr.isra’ at drivers/infiniband/hw/ionic/ionic_controlpath.c:609:3: ./include/linux/fortify-string.h:580:25: error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning] 580 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors make[6]: *** [scripts/Makefile.build:287: drivers/infiniband/hw/ionic/ionic_controlpath.o] Error 1 make[5]: *** [scripts/Makefile.build:556: drivers/infiniband/hw/ionic] Error 2 make[5]: *** Waiting for unfinished jobs.... make[4]: *** [scripts/Makefile.build:556: drivers/infiniband/hw] Error 2 make[3]: *** [scripts/Makefile.build:556: drivers/infiniband] Error 2 make[2]: *** [scripts/Makefile.build:556: drivers] Error 2 make[1]: *** [/tmp/tmp53nb1nwr/Makefile:2011: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Reported-by: Leon Romanovsky Closes: https://lore.kernel.org/lkml/20250918180750.GA135135@unreal/ Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250919121301.1113759-2-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Register device ops for control path

2025-09-11T06:18:36+00:00

Implement device supported verb APIs for control path. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-11-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Create device queues to support admin operations

2025-09-11T06:18:36+00:00

Setup RDMA admin queues using device command exposed over auxiliary device and manage these queues using ida. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-10-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky