Linux kernel stable tree (mirror) https://git.radix-linux.su/kernel/linux.git/atom?h=v5.16 2022-01-04T14:29:34+00:00 2022-01-04T14:29:34+00:00 Li Zhijian lizhijian@cn.fujitsu.com 2021-12-28T01:44:06+00:00 urn:sha1:8ff5f5d9d8cfce6a1e368a6daa7123be133a6c35 The same rxe_map_set could be freed twice: rxe_reg_user_mr() -> rxe_mr_init_user() -> rxe_mr_free_map_set() # 1st -> rxe_drop_ref() ... -> rxe_mr_cleanup() -> rxe_mr_free_map_set() # 2nd Follow normal convection and put resource cleanup either in the error unwind of the allocator, or the overall free function. Leave the object unchanged with a NULL cur_map_set on failure and remove the unncessary free in rxe_mr_init_user(). Link: https://lore.kernel.org/r/20211228014406.1033444-1-lizhijian@cn.fujitsu.com Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com> Acked-by: Zhu Yanjun <zyjzyj2000@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> 2021-11-25T17:15:59+00:00 Pavel Skripkin paskripkin@gmail.com 2021-11-21T20:22:39+00:00 urn:sha1:84b01721e8042cdd1e8ffeb648844a09cd4213e0 On error handling path in rxe_qp_from_init() qp->sq.queue is freed and then rxe_create_qp() will drop last reference to this object. qp clean up function will try to free this queue one time and it causes UAF bug. Fix it by zeroing queue pointer after freeing queue in rxe_qp_from_init(). Fixes: 514aee660df4 ("RDMA: Globally allocate and release QP memory") Link: https://lore.kernel.org/r/20211121202239.3129-1-paskripkin@gmail.com Reported-by: syzbot+aab53008a5adf26abe91@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Reviewed-by: Zhu Yanjun <zyjzyj2000@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> 2021-11-01T17:49:20+00:00 Jason Gunthorpe jgg@nvidia.com 2021-11-01T17:49:20+00:00 urn:sha1:a2a2a69d144d66e0c36697da062b3949e3c2c870 Pull in the accepted for-rc patches as the next merge needs a newer base. Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> 2021-10-28T11:58:27+00:00 Joe Perches joe@perches.com 2021-10-24T17:13:14+00:00 urn:sha1:000b8490ecacb3ad5145314ca235c0a17d0187bf Make struct rxe_type_info static const and local to the only uses. Moves a bit of data to text. $ size drivers/infiniband/sw/rxe/rxe_pool.o* (defconfig w/ infiniband swe) text data bss dec hex filename 4456 12 0 4468 1174 drivers/infiniband/sw/rxe/rxe_pool.o.new 3817 652 0 4469 1175 drivers/infiniband/sw/rxe/rxe_pool.o.old Link: https://lore.kernel.org/r/166b715d71f98336e8ecab72b0dbdd266eee9193.camel@perches.com Signed-off-by: Joe Perches <joe@perches.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> 2021-10-28T11:58:27+00:00 Christophe JAILLET christophe.jaillet@wanadoo.fr 2021-10-24T16:43:56+00:00 urn:sha1:e30bb300a401a65b985c6af1f799080c80e1b950 'index.table' is a bitmap. So use 'bitmap_zalloc()' to simplify code, improve the semantic and avoid some open-coded arithmetic in allocator arguments. Using 'bitmap_zalloc()' also allows the removal of a now useless 'bitmap_zero()'. Also change the corresponding 'kfree()' into 'bitmap_free()' to keep consistency. Link: https://lore.kernel.org/r/4a3e11d45865678d570333d1962820eb13168848.1635093628.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> 2021-10-28T11:58:27+00:00 Christophe JAILLET christophe.jaillet@wanadoo.fr 2021-10-24T16:43:30+00:00 urn:sha1:69d1ed59999c1e9c823f78befd3fb8a22bdbff48 'table_size' is never read, it can be removed. In fact, the only place that uses something that could be 'table_size' is 'alloc_index()'. In this function, it is re-computed from 'min_index' and 'max_index'. Link: https://lore.kernel.org/r/2c42065049bb2b99bededdc423a9babf4a98adee.1635093628.git.christophe.jaillet@wanadoo.fr Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> 2021-10-13T16:59:47+00:00 Dan Carpenter dan.carpenter@oracle.com 2021-10-13T08:06:45+00:00 urn:sha1:663991f32857b3b63c94c97de9dbb0ec8600144f Return negative -ENOMEM instead of positive ENOMEM. Returning a postive value will cause an Oops because it becomes an ERR_PTR() in the create_qp() function. Fixes: 514aee660df4 ("RDMA: Globally allocate and release QP memory") Link: https://lore.kernel.org/r/20211013080645.GD6010@kili Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> 2021-10-12T16:25:27+00:00 Bob Pearson rpearsonhpe@gmail.com 2021-10-07T20:40:52+00:00 urn:sha1:3b87e0824272414cec79763afef6720c7c908c44 Modify ib_post_send for kernel UD sends to put the AH index into the WQE instead of the address vector. Link: https://lore.kernel.org/r/20211007204051.10086-7-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> 2021-10-12T16:25:26+00:00 Bob Pearson rpearsonhpe@gmail.com 2021-10-07T20:40:51+00:00 urn:sha1:e2fe06c9080694f2c28894f14ef8ebfd923ac94d Add code to rxe_get_av in rxe_av.c to use the AH index in UD send WQEs to lookup the kernel AH. For old user providers continue to use the AV passed in WQEs. Move setting pkt->rxe to before the call to rxe_get_av() to get access to the AH pool. Link: https://lore.kernel.org/r/20211007204051.10086-6-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> 2021-10-12T16:25:26+00:00 Bob Pearson rpearsonhpe@gmail.com 2021-10-07T20:40:50+00:00 urn:sha1:4da698eabf0f7c1c1806670d3fd3895512fdf43b The pd field in struct rxe_ah is redundant with the pd field in the rdma-core's ib_ah. Eliminate the pd field in rxe_ah and add an inline to extract the pd from the ibah field. Link: https://lore.kernel.org/r/20211007204051.10086-5-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>