kernel/linux.git/drivers/infiniband/hw/ionic, branch v6.19.11

RDMA/ionic: Preserve and set Ethernet source MAC after ib_ud_header_init()

2026-04-02T11:25:41+00:00

commit a08aaf3968aec5d05cd32c801b8cc0c61da69c41 upstream. ionic_build_hdr() populated the Ethernet source MAC (hdr->eth.smac_h) by passing the header’s storage directly to rdma_read_gid_l2_fields(). However, ib_ud_header_init() is called after that and re-initializes the UD header, which wipes the previously written smac_h. As a result, packets are emitted with an zero source MAC address on the wire. Correct the source MAC by reading the GID-derived smac into a temporary buffer and copy it after ib_ud_header_init() completes. Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Cc: stable@vger.kernel.org # 6.18 Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20260227061809.2979990-1-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky Signed-off-by: Greg Kroah-Hartman

RDMA/ionic: Fix kernel stack leak in ionic_create_cq()

2026-03-12T11:09:35+00:00

commit faa72102b178c7ae6c6afea23879e7c84fc59b4e upstream. struct ionic_cq_resp resp { __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below) __u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask) __u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK }; rsvd[7]: 7 bytes of stack memory leaked unconditionally. cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but udma_count could be 1, meaning cqid[1] might never be written via ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4 bytes) is also leaked. So potentially 11 bytes leaked. Cc: stable@vger.kernel.org Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Signed-off-by: Jason Gunthorpe Link: https://patch.msgid.link/4-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com Acked-by: Abhijit Gangurde Signed-off-by: Leon Romanovsky Signed-off-by: Greg Kroah-Hartman

RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port

2026-03-04T12:20:56+00:00

[ Upstream commit fd80bd7105f88189f47d465ca8cb7d115570de30 ] The function ionic_query_port() calls ib_device_get_netdev() without checking the return value which could lead to NULL pointer dereference, Fix it by checking the return value and return -ENODEV if the 'ndev' is NULL. Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality") Signed-off-by: Kamal Heib Link: https://patch.msgid.link/20260220222125.16973-2-kheib@redhat.com Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin

RDMA/ionic: Fix memory leak of admin q_wr

2025-09-26T16:12:56+00:00

The admin queue work request buffer, aq->q_wr, is allocated via kcalloc in __ionic_create_rdma_adminq. However, it was not being freed in the corresponding teardown function __ionic_destroy_rdma_adminq. This results in a memory leak. Fix this leak by adding the missing kfree(aq->q_wr) in the destruction path. Fixes: f3bdbd42702c ("RDMA/ionic: Create device queues to support admin operations") Link: https://patch.msgid.link/r/20250924142123.18344-1-abhijit.gangurde@amd.com Signed-off-by: Abhijit Gangurde Signed-off-by: Jason Gunthorpe

RDMA: Use %pe format specifier for error pointers

2025-09-21T11:34:49+00:00

Convert error logging throughout the RDMA subsystem to use the %pe format specifier instead of PTR_ERR() with integer format specifiers. Link: https://patch.msgid.link/e81ec02df1e474be20417fb62e779776e3f47a50.1758217936.git.leon@kernel.org Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky

RDMA/ionic: Use ether_addr_copy instead of memcpy

2025-09-21T11:30:37+00:00

eth header from ib_ud_header structure packs the mac into 4B high and 2B low parts. But when 4B high is used in memcpy, it sees it as overflow. However, this is safe due to the 4B high and 2B low arrangement in the structure. To avoid the memcpy warning, use ether_addr_copy to copy the mac address. In function ‘fortify_memcpy_chk’, inlined from ‘ionic_set_ah_attr.isra’ at drivers/infiniband/hw/ionic/ionic_controlpath.c:609:3: ./include/linux/fortify-string.h:580:25: error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning] 580 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors make[6]: *** [scripts/Makefile.build:287: drivers/infiniband/hw/ionic/ionic_controlpath.o] Error 1 make[5]: *** [scripts/Makefile.build:556: drivers/infiniband/hw/ionic] Error 2 make[5]: *** Waiting for unfinished jobs.... make[4]: *** [scripts/Makefile.build:556: drivers/infiniband/hw] Error 2 make[3]: *** [scripts/Makefile.build:556: drivers/infiniband] Error 2 make[2]: *** [scripts/Makefile.build:556: drivers] Error 2 make[1]: *** [/tmp/tmp53nb1nwr/Makefile:2011: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Reported-by: Leon Romanovsky Closes: https://lore.kernel.org/lkml/20250918180750.GA135135@unreal/ Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250919121301.1113759-2-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Fix build failure on SPARC due to xchg() operand size

2025-09-21T11:30:37+00:00

xchg() is used to safely handle the event queue arming. However SPARC xchg operates only 4B of variable. Change variable type from bool to int. Unverified Error/Warning (likely false positive, kindly check if interested): ERROR: modpost: "__xchg_called_with_bad_pointer" [drivers/infiniband/hw/ionic/ionic_rdma.ko] undefined! Error/Warning ids grouped by kconfigs: recent_errors `-- sparc-allmodconfig `-- ERROR:__xchg_called_with_bad_pointer-drivers-infiniband-hw-ionic-ionic_rdma.ko-undefined Fixes: f3bdbd42702c ("RDMA/ionic: Create device queues to support admin operations") Reported-by: Leon Romanovsky Closes: https://lore.kernel.org/lkml/20250918180750.GA135135@unreal/ Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250919121301.1113759-1-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Add Makefile/Kconfig to kernel build environment

2025-09-11T06:18:36+00:00

Add ionic to the kernel build environment. Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-15-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Implement device stats ops

2025-09-11T06:18:36+00:00

Implement device stats operations for hw stats and qp stats. Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-14-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Register device ops for miscellaneous functionality

2025-09-11T06:18:36+00:00

Implement idbdev ops for device and port information. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-13-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky