1. 05 10月, 2019 1 次提交
    • I
      IB/hfi1: Define variables as unsigned long to fix KASAN warning · ad6819cd
      Ira Weiny 提交于
      commit f8659d68e2bee5b86a1beaf7be42d942e1fc81f4 upstream.
      
      Define the working variables to be unsigned long to be compatible with
      for_each_set_bit and change types as needed.
      
      While we are at it remove unused variables from a couple of functions.
      
      This was found because of the following KASAN warning:
       ==================================================================
         BUG: KASAN: stack-out-of-bounds in find_first_bit+0x19/0x70
         Read of size 8 at addr ffff888362d778d0 by task kworker/u308:2/1889
      
         CPU: 21 PID: 1889 Comm: kworker/u308:2 Tainted: G W         5.3.0-rc2-mm1+ #2
         Hardware name: Intel Corporation W2600CR/W2600CR, BIOS SE5C600.86B.02.04.0003.102320141138 10/23/2014
         Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core]
         Call Trace:
          dump_stack+0x9a/0xf0
          ? find_first_bit+0x19/0x70
          print_address_description+0x6c/0x332
          ? find_first_bit+0x19/0x70
          ? find_first_bit+0x19/0x70
          __kasan_report.cold.6+0x1a/0x3b
          ? find_first_bit+0x19/0x70
          kasan_report+0xe/0x12
          find_first_bit+0x19/0x70
          pma_get_opa_portstatus+0x5cc/0xa80 [hfi1]
          ? ret_from_fork+0x3a/0x50
          ? pma_get_opa_port_ectrs+0x200/0x200 [hfi1]
          ? stack_trace_consume_entry+0x80/0x80
          hfi1_process_mad+0x39b/0x26c0 [hfi1]
          ? __lock_acquire+0x65e/0x21b0
          ? clear_linkup_counters+0xb0/0xb0 [hfi1]
          ? check_chain_key+0x1d7/0x2e0
          ? lock_downgrade+0x3a0/0x3a0
          ? match_held_lock+0x2e/0x250
          ib_mad_recv_done+0x698/0x15e0 [ib_core]
          ? clear_linkup_counters+0xb0/0xb0 [hfi1]
          ? ib_mad_send_done+0xc80/0xc80 [ib_core]
          ? mark_held_locks+0x79/0xa0
          ? _raw_spin_unlock_irqrestore+0x44/0x60
          ? rvt_poll_cq+0x1e1/0x340 [rdmavt]
          __ib_process_cq+0x97/0x100 [ib_core]
          ib_cq_poll_work+0x31/0xb0 [ib_core]
          process_one_work+0x4ee/0xa00
          ? pwq_dec_nr_in_flight+0x110/0x110
          ? do_raw_spin_lock+0x113/0x1d0
          worker_thread+0x57/0x5a0
          ? process_one_work+0xa00/0xa00
          kthread+0x1bb/0x1e0
          ? kthread_create_on_node+0xc0/0xc0
          ret_from_fork+0x3a/0x50
      
         The buggy address belongs to the page:
         page:ffffea000d8b5dc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
         flags: 0x17ffffc0000000()
         raw: 0017ffffc0000000 0000000000000000 ffffea000d8b5dc8 0000000000000000
         raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
         page dumped because: kasan: bad access detected
      
         addr ffff888362d778d0 is located in stack of task kworker/u308:2/1889 at offset 32 in frame:
          pma_get_opa_portstatus+0x0/0xa80 [hfi1]
      
         this frame has 1 object:
          [32, 36) 'vl_select_mask'
      
         Memory state around the buggy address:
          ffff888362d77780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
          ffff888362d77800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
         >ffff888362d77880: 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 00 00
                                                          ^
          ffff888362d77900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
          ffff888362d77980: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2
      
       ==================================================================
      
      Cc: <stable@vger.kernel.org>
      Fixes: 77241056 ("IB/hfi1: add driver files")
      Link: https://lore.kernel.org/r/20190911113053.126040.47327.stgit@awfm-01.aw.intel.comReviewed-by: NMike Marciniszyn <mike.marciniszyn@intel.com>
      Signed-off-by: NIra Weiny <ira.weiny@intel.com>
      Signed-off-by: NKaike Wan <kaike.wan@intel.com>
      Signed-off-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      ad6819cd
  2. 24 5月, 2018 1 次提交
  3. 10 5月, 2018 1 次提交
  4. 02 2月, 2018 1 次提交
  5. 23 12月, 2017 1 次提交
  6. 14 11月, 2017 3 次提交
  7. 31 10月, 2017 1 次提交
    • S
      IB/hfi1: Validate PKEY for incoming GSI MAD packets · 406310c6
      Sebastian Sanchez 提交于
      These are the use-cases where the pkey needs to be tested to see
      if a packet needs to be dropped.
      
      a) Check if pkey is not FULL_MGMT_P_KEY or LIM_MGMT_P_KEY,
         drop the packet as it's not part of the management partition.
         Self-originated packets are an exception.
      
      b) If pkey index points to FULL_MGMT_P_KEY and LIM_MGMT_P_KEY is
         in the table, the packet is coming from a management node,
         and the receiving node is also a management node, so it is safe
         for the packet to go through.
      
      c) If pkey index points to FULL_MGMT_P_KEY and LIM_MGMT_P_KEY is
         NOT in the table, drop the packet as LIM_MGMT_P_KEY should
         always be in the pkey table. It could be a misconfiguration.
      
      d) If pkey index points to LIM_MGMT_P_KEY and FULL_MGMT_P_KEY is
         NOT in the table, it is safe for the packet to go through
         since a non-management node is talking to another non-managment
         node.
      
      e) If pkey index points to LIM_MGMT_P_KEY and FULL_MGMT_P_KEY is in
         the table, drop the packet because a non-management node is
         talking to a management node, and it could be an attack.
      
      For the implementation, these rules can be simplied to only checking
      for (a) and (e). There's no need to check for rule (b) as
      the packet doesn't need to be dropped. Rule (c) is not possible in
      the driver as LIM_MGMT_P_KEY is always in the pkey table.
      Reviewed-by: NMichael J. Ruhl <michael.j.ruhl@intel.com>
      Signed-off-by: NSebastian Sanchez <sebastian.sanchez@intel.com>
      Signed-off-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      406310c6
  8. 18 10月, 2017 1 次提交
    • K
      IB/hfi1: Convert timers to use timer_setup() · 8064135e
      Kees Cook 提交于
      In preparation for unconditionally passing the struct timer_list pointer to
      all timer callbacks, switch to using the new timer_setup() and from_timer()
      to pass the timer pointer explicitly. Switches test of .data field to
      .function, since .data will be going away.
      
      Cc: Mike Marciniszyn <mike.marciniszyn@intel.com>
      Cc: Dennis Dalessandro <dennis.dalessandro@intel.com>
      Cc: Doug Ledford <dledford@redhat.com>
      Cc: Sean Hefty <sean.hefty@intel.com>
      Cc: Hal Rosenstock <hal.rosenstock@gmail.com>
      Cc: linux-rdma@vger.kernel.org
      Signed-off-by: NKees Cook <keescook@chromium.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      8064135e
  9. 15 10月, 2017 2 次提交
  10. 05 10月, 2017 1 次提交
    • D
      IB/hfi1: Do not warn on lid conversions for OPA · 4988be58
      Don Hiatt 提交于
      On OPA devices opa_local_smp_check will receive 32Bit LIDs when the LID
      is Extended. In such cases, it is okay to lose the upper 16 bits of the
      LID as this information is obtained elsewhere. Do not issue a warning
      when calling ib_lid_cpu16() in this case by masking out the upper 16Bits.
      
      [75920.148985] ------------[ cut here ]------------
      [75920.154651] WARNING: CPU: 0 PID: 1718 at ./include/rdma/ib_verbs.h:3788 hfi1_process_mad+0x1c1f/0x1c80 [hfi1]
      [75920.166192] Modules linked in: ib_ipoib hfi1(E) rdmavt(E) rdma_ucm(E) ib_ucm(E) rdma_cm(E) ib_cm(E) iw_cm(E) ib_umad(E) ib_uverbs(E) ib_core(E) libiscsi scsi_transport_iscsi dm_mirror dm_region_hash dm_log dm_mod dax x86_pkg_temp_thermal intel_powerclamp coretemp kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel mei_me ipmi_si iTCO_wdt iTCO_vendor_support crypto_simd ipmi_devintf pcspkr mei sg i2c_i801 glue_helper lpc_ich shpchp ioatdma mfd_core wmi ipmi_msghandler cryptd acpi_power_meter acpi_pad nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm igb ptp ahci libahci pps_core crc32c_intel libata dca i2c_algo_bit i2c_core [last unloaded: ib_core]
      [75920.246331] CPU: 0 PID: 1718 Comm: kworker/0:1H Tainted: G        W I E   4.13.0-rc7+ #1
      [75920.255907] Hardware name: Intel Corporation S2600WT2/S2600WT2, BIOS SE5C610.86B.01.01.0008.021120151325 02/11/2015
      [75920.268158] Workqueue: ib-comp-wq ib_cq_poll_work [ib_core]
      [75920.274934] task: ffff88084a718000 task.stack: ffffc9000a424000
      [75920.282123] RIP: 0010:hfi1_process_mad+0x1c1f/0x1c80 [hfi1]
      [75920.288881] RSP: 0018:ffffc9000a427c38 EFLAGS: 00010206
      [75920.295265] RAX: 0000000000010001 RBX: ffff8808361420e8 RCX: ffff880837811d80
      [75920.303784] RDX: 0000000000000002 RSI: 0000000000007fff RDI: ffff880837811d80
      [75920.312302] RBP: ffffc9000a427d38 R08: 0000000000000000 R09: ffff8808361420e8
      [75920.320819] R10: ffff88083841f0e8 R11: ffffc9000a427da8 R12: 0000000000000001
      [75920.329335] R13: ffff880837810000 R14: 0000000000000000 R15: ffff88084f1a4800
      [75920.337849] FS:  0000000000000000(0000) GS:ffff88085f400000(0000) knlGS:0000000000000000
      [75920.347450] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [75920.354405] CR2: 00007f9e4b3d9000 CR3: 0000000001c09000 CR4: 00000000001406f0
      [75920.362947] Call Trace:
      [75920.366257]  ? ib_mad_recv_done+0x258/0x9b0 [ib_core]
      [75920.372457]  ? ib_mad_recv_done+0x258/0x9b0 [ib_core]
      [75920.378652]  ? __kmalloc+0x1df/0x210
      [75920.383229]  ib_mad_recv_done+0x305/0x9b0 [ib_core]
      [75920.389270]  __ib_process_cq+0x5d/0xb0 [ib_core]
      [75920.395032]  ib_cq_poll_work+0x20/0x60 [ib_core]
      [75920.400777]  process_one_work+0x149/0x360
      [75920.405836]  worker_thread+0x4d/0x3c0
      [75920.410505]  kthread+0x109/0x140
      [75920.414681]  ? rescuer_thread+0x380/0x380
      [75920.419731]  ? kthread_park+0x60/0x60
      [75920.424406]  ret_from_fork+0x25/0x30
      [75920.428972] Code: 4c 89 9d 58 ff ff ff 49 89 45 00 66 b8 00 02 49 89 45 08 e8 44 27 89 e0 4c 8b 9d 58 ff ff ff e9 d8 f6 ff ff 0f ff e9 55 e7 ff ff <0f> ff e9 3b e5 ff ff 0f ff 0f 1f 84 00 00 00 00 00 e9 4b e9 ff
      [75921.451269] ---[ end trace cf26df27c9597265 ]---
      
      Fixes: 62ede777 ("Add OPA extended LID support")
      Reviewed-by: NMike Marciniszyn <mike.marciniszyn@intel.com>
      Signed-off-by: NDon Hiatt <don.hiatt@intel.com>
      Signed-off-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Reviewed-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      4988be58
  11. 29 8月, 2017 1 次提交
  12. 23 8月, 2017 7 次提交
  13. 19 8月, 2017 1 次提交
  14. 09 8月, 2017 1 次提交
  15. 01 8月, 2017 1 次提交
  16. 28 6月, 2017 4 次提交
  17. 02 5月, 2017 1 次提交
  18. 29 4月, 2017 4 次提交
  19. 21 4月, 2017 1 次提交
  20. 25 1月, 2017 1 次提交
  21. 15 12月, 2016 1 次提交
  22. 16 11月, 2016 1 次提交
  23. 02 10月, 2016 2 次提交
  24. 03 9月, 2016 1 次提交