kernel/linux.git/include/rdma/uverbs_ioctl.h, branch linux-7.1.y

RDMA/core: Do not read wild stack memory in uverbs_get_handler_fn()

2026-05-19T22:32:48+00:00

Sashiko points out the legacy write path in ib_uverbs_write() does allocate a struct uverbs_attr_bundle, but it doesn't wrap it in a bundle_priv so downcasting here isn't safe. Instead lift the method_elm out of the bundle_priv and use it for the debug function. The legacy write path will leave it set as NULL since the write method_elm uses a different type. Cc: stable@vger.kernel.org Fixes: 1de9287ece44 ("RDMA: Add ib_copy_validate_udata_in()") Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky

RDMA: Add ib_is_udata_in_empty()

2026-03-08T10:20:25+00:00

If the driver doesn't yet support any request driver data it should check that it is all zeroed. This is a common pattern, add a helper around _ib_copy_validate_udata_in() to do this. Link: https://patch.msgid.link/r/6-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe

RDMA: Add ib_respond_udata()

2026-03-08T10:20:25+00:00

Wrap the common copy_to_user() pattern used in drivers and enhance it to zero pad as well. Include debug logging on failures. Link: https://patch.msgid.link/r/5-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe

RDMA: Add ib_copy_validate_udata_in_cm()

2026-03-08T10:20:25+00:00

For structures with comp_mask also absorb the check of comp_mask valid bits into the helper. This is slightly tricky because ~ might not fully extend to 64 bits, the helper inserts an explicit type to ensure that ~ covers all bits. Link: https://patch.msgid.link/r/4-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe

RDMA: Add ib_copy_validate_udata_in()

2026-03-08T10:20:25+00:00

Add a new function to consolidate the required compatibility pattern for driver data of checking against a minimum size, and checking for unknown trailing bytes to be zero into a function. This new function uses the faster copy_struct_from_user() instead of trying to directly check for zero. Incorporate the common ibdev_dbg() logging directly into the error paths of the helper. Link: https://patch.msgid.link/r/3-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Tested-by: Sriharsha Basavapatna Acked-by: Sriharsha Basavapatna Signed-off-by: Jason Gunthorpe

RDMA/core: Add rdma_udata_to_dev()

2026-03-08T10:20:24+00:00

Get an ib_device out of a udata so it can be used for debug prints. Link: https://patch.msgid.link/r/2-v3-bd56dd443069+49-bnxt_re_uapi_jgg@nvidia.com Signed-off-by: Jason Gunthorpe

RDMA/uverbs: Avoid -Wflex-array-member-not-at-end warnings

2024-03-03T13:38:44+00:00

-Wflex-array-member-not-at-end is coming in GCC-14, and we are getting ready to enable it globally. There are currently a couple of objects (`alloc_head` and `bundle`) in `struct bundle_priv` that contain a couple of flexible structures: struct bundle_priv { /* Must be first */ struct bundle_alloc_head alloc_head; ... /* * Must be last. bundle ends in a flex array which overlaps * internal_buffer. */ struct uverbs_attr_bundle bundle; u64 internal_buffer[32]; }; So, in order to avoid ending up with a couple of flexible-array members in the middle of a struct, we use the `struct_group_tagged()` helper to separate the flexible array from the rest of the members in the flexible structures: struct uverbs_attr_bundle { struct_group_tagged(uverbs_attr_bundle_hdr, hdr, ... the rest of the members ); struct uverbs_attr attrs[]; }; With the change described above, we now declare objects of the type of the tagged struct without embedding flexible arrays in the middle of another struct: struct bundle_priv { /* Must be first */ struct bundle_alloc_head_hdr alloc_head; ... struct uverbs_attr_bundle_hdr bundle; u64 internal_buffer[32]; }; We also use `container_of()` whenever we need to retrieve a pointer to the flexible structures. Notice that the `bundle_size` computed in `uapi_compute_bundle_size()` remains the same. So, with these changes, fix the following warnings: drivers/infiniband/core/uverbs_ioctl.c:45:34: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] 45 | struct bundle_alloc_head alloc_head; | ^~~~~~~~~~ drivers/infiniband/core/uverbs_ioctl.c:67:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] 67 | struct uverbs_attr_bundle bundle; | ^~~~~~ Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/ZeIgeZ5Sb0IZTOyt@neat Reviewed-by: Kees Cook Signed-off-by: Leon Romanovsky

rdma: fix INFINIBAND_USER_ACCESS dependency

2023-07-03T23:55:04+00:00

After a change to the bnxt_re driver, it fails to link when CONFIG_INFINIBAND_USER_ACCESS is disabled: aarch64-linux-ld: drivers/infiniband/hw/bnxt_re/ib_verbs.o: in function `bnxt_re_handler_BNXT_RE_METHOD_ALLOC_PAGE': ib_verbs.c:(.text+0xd64): undefined reference to `ib_uverbs_get_ucontext_file' aarch64-linux-ld: drivers/infiniband/hw/bnxt_re/ib_verbs.o:(.rodata+0x168): undefined reference to `uverbs_idr_class' aarch64-linux-ld: drivers/infiniband/hw/bnxt_re/ib_verbs.o:(.rodata+0x1a8): undefined reference to `uverbs_destroy_def_handler' The problem is that the 'bnxt_re_uapi_defs' structure is built unconditionally and references a couple of functions that are never really called in this configuration but instead require other functions that are left out. Adding an #ifdef around the new code, or a Kconfig dependency would address this problem, but adding the compile-time check inside of the UAPI_DEF_CHAIN_OBJ_TREE_NAMED() macro seems best because that also addresses the problem in other drivers that may run into the same dependency. Fixes: 360da60d6c6ed ("RDMA/bnxt_re: Enable low latency push") Signed-off-by: Arnd Bergmann Acked-by: Leon Romanovsky Signed-off-by: Linus Torvalds

RDMA/core: Add UVERBS_ATTR_RAW_FD

2022-09-27T13:15:24+00:00

This uses the same passing protocol as UVERBS_ATTR_FD (eg len = 0 data_s64 = fd), except that the FD is not required to be a uverbs object and the core code does not covert the FD to an object handle automatically. Access to the int fd is provided by uverbs_get_raw_fd(). Link: https://lore.kernel.org/r/2-v1-bd147097458e+ede-umem_dmabuf_jgg@nvidia.com Signed-off-by: Jason Gunthorpe

RDMA/uverbs: Fix -Wunused-function warning

2021-04-01T18:28:49+00:00

make W=1 warns this: In file included from drivers/infiniband/sw/rdmavt/mmap.c:51:0: ./include/rdma/uverbs_ioctl.h:937:1: warning: ‘_uverbs_get_const_unsigned’ defined but not used [-Wunused-function] _uverbs_get_const_unsigned(u64 *to, ^~~~~~~~~~~~~~~~~~~~~~~~~~ ./include/rdma/uverbs_ioctl.h:930:1: warning: ‘_uverbs_get_const_signed’ defined but not used [-Wunused-function] _uverbs_get_const_signed(s64 *to, const struct uverbs_attr_bundle *attrs_bundle, ^~~~~~~~~~~~~~~~~~~~~~~~ Make these functions inline to fix this warnings. Fixes: 2904bb37b35d ("IB/core: Split uverbs_get_const/default to consider target type") Link: https://lore.kernel.org/r/20210401021028.25720-1-yuehaibing@huawei.com Signed-off-by: YueHaibing Signed-off-by: Jason Gunthorpe