1. 05 8月, 2019 1 次提交
  2. 05 2月, 2019 5 次提交
  3. 23 12月, 2018 1 次提交
  4. 20 12月, 2018 7 次提交
    • G
      RDMA: Mark if destroy address handle is in a sleepable context · 2553ba21
      Gal Pressman 提交于
      Introduce a 'flags' field to destroy address handle callback and add a
      flag that marks whether the callback is executed in an atomic context or
      not.
      
      This will allow drivers to wait for completion instead of polling for it
      when it is allowed.
      Signed-off-by: NGal Pressman <galpress@amazon.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      2553ba21
    • B
      RDMA/srpt: Add support for immediate data · 5dabcd04
      Bart Van Assche 提交于
      Modify allocation of the non-SRQ receive queues such that immediate
      data is aligned on a 512 byte boundary. That alignment is necessary
      to pass the immediate data without copying to the block layer. When
      receiving an SRP_CMD with immediate data, postpone the ib_post_recv()
      call until target_execute_cmd() has finished. See also
      srpt_release_cmd().
      
      Cc: Sergey Gorenko <sergeygo@mellanox.com>
      Cc: Max Gurtovoy <maxg@mellanox.com>
      Cc: Laurence Oberman <loberman@redhat.com>
      Signed-off-by: NBart Van Assche <bvanassche@acm.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      5dabcd04
    • B
      RDMA/srpt: Rework the srpt_alloc_srq() error path · 82305f82
      Bart Van Assche 提交于
      This patch does not change any functionality but makes the next patch
      easier to read.
      
      Cc: Sergey Gorenko <sergeygo@mellanox.com>
      Cc: Max Gurtovoy <maxg@mellanox.com>
      Cc: Laurence Oberman <loberman@redhat.com>
      Signed-off-by: NBart Van Assche <bvanassche@acm.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      82305f82
    • B
      RDMA/srpt: Remove driver version and release date · 6feb64ff
      Bart Van Assche 提交于
      Neither a driver version number nor a release data is useful in
      an upstream driver. Remove the word "InfiniBand" from the driver
      description because recently RoCE support has been added to this
      driver.
      
      Cc: Sergey Gorenko <sergeygo@mellanox.com>
      Cc: Max Gurtovoy <maxg@mellanox.com>
      Cc: Laurence Oberman <loberman@redhat.com>
      Signed-off-by: NBart Van Assche <bvanassche@acm.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      6feb64ff
    • B
      RDMA/srpt: Join split strings · 75d79b80
      Bart Van Assche 提交于
      Make sure that long strings occur on a single line as required by the
      coding standard.
      
      Cc: Sergey Gorenko <sergeygo@mellanox.com>
      Cc: Max Gurtovoy <maxg@mellanox.com>
      Cc: Laurence Oberman <loberman@redhat.com>
      Signed-off-by: NBart Van Assche <bvanassche@acm.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      75d79b80
    • B
      RDMA/srpt: Improve coding style conformance · ffd59806
      Bart Van Assche 提交于
      Use tabs instead of spaces for indentation. Make sure that multi-line
      expressions have the operator at the end of a line instead of the start.
      Avoid a complaint about a missing space in a ternary expression by
      changing '(boolean) ? 1: 0' into 'boolean'.
      
      Cc: Sergey Gorenko <sergeygo@mellanox.com>
      Cc: Max Gurtovoy <maxg@mellanox.com>
      Cc: Laurence Oberman <loberman@redhat.com>
      Signed-off-by: NBart Van Assche <bvanassche@acm.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      ffd59806
    • B
      RDMA/srpt: Fix a use-after-free in the channel release code · ed041919
      Bart Van Assche 提交于
      This patch avoids that KASAN sporadically reports the following:
      
      BUG: KASAN: use-after-free in rxe_run_task+0x1e/0x60 [rdma_rxe]
      Read of size 1 at addr ffff88801c50d8f4 by task check/24830
      
      CPU: 4 PID: 24830 Comm: check Not tainted 4.20.0-rc6-dbg+ #3
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
      Call Trace:
       dump_stack+0x86/0xca
       print_address_description+0x71/0x239
       kasan_report.cold.5+0x242/0x301
       __asan_load1+0x47/0x50
       rxe_run_task+0x1e/0x60 [rdma_rxe]
       rxe_post_send+0x4bd/0x8d0 [rdma_rxe]
       srpt_zerolength_write+0xe1/0x160 [ib_srpt]
       srpt_close_ch+0x8b/0xe0 [ib_srpt]
       srpt_set_enabled+0xe7/0x150 [ib_srpt]
       srpt_tpg_enable_store+0xc0/0x100 [ib_srpt]
       configfs_write_file+0x157/0x1d0
       __vfs_write+0xd7/0x3d0
       vfs_write+0x102/0x290
       ksys_write+0xab/0x130
       __x64_sys_write+0x43/0x50
       do_syscall_64+0x71/0x210
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Allocated by task 13856:
       save_stack+0x43/0xd0
       kasan_kmalloc+0xc7/0xe0
       kasan_slab_alloc+0x11/0x20
       kmem_cache_alloc+0x105/0x320
       rxe_alloc+0xff/0x1f0 [rdma_rxe]
       rxe_create_qp+0x9f/0x160 [rdma_rxe]
       ib_create_qp+0xf5/0x690 [ib_core]
       rdma_create_qp+0x6a/0x140 [rdma_cm]
       srpt_cm_req_recv.cold.59+0x1588/0x237b [ib_srpt]
       srpt_rdma_cm_req_recv.isra.35+0x1d5/0x220 [ib_srpt]
       srpt_rdma_cm_handler+0x6f/0x100 [ib_srpt]
       cma_listen_handler+0x59/0x60 [rdma_cm]
       cma_ib_req_handler+0xd5b/0x2570 [rdma_cm]
       cm_process_work+0x2e/0x110 [ib_cm]
       cm_work_handler+0x2aae/0x502b [ib_cm]
       process_one_work+0x481/0x9e0
       worker_thread+0x67/0x5b0
       kthread+0x1cf/0x1f0
       ret_from_fork+0x24/0x30
      
      Freed by task 3440:
       save_stack+0x43/0xd0
       __kasan_slab_free+0x139/0x190
       kasan_slab_free+0xe/0x10
       kmem_cache_free+0xbc/0x330
       rxe_elem_release+0x66/0xe0 [rdma_rxe]
       rxe_destroy_qp+0x3f/0x50 [rdma_rxe]
       ib_destroy_qp+0x140/0x360 [ib_core]
       srpt_release_channel_work+0xdc/0x310 [ib_srpt]
       process_one_work+0x481/0x9e0
       worker_thread+0x67/0x5b0
       kthread+0x1cf/0x1f0
       ret_from_fork+0x24/0x30
      
      Cc: Sergey Gorenko <sergeygo@mellanox.com>
      Cc: Max Gurtovoy <maxg@mellanox.com>
      Cc: Laurence Oberman <loberman@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NBart Van Assche <bvanassche@acm.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      ed041919
  5. 29 11月, 2018 2 次提交
  6. 22 11月, 2018 1 次提交
  7. 27 9月, 2018 1 次提交
  8. 06 9月, 2018 1 次提交
  9. 03 8月, 2018 2 次提交
  10. 31 7月, 2018 1 次提交
  11. 25 7月, 2018 1 次提交
  12. 14 7月, 2018 2 次提交
  13. 11 7月, 2018 1 次提交
  14. 04 7月, 2018 2 次提交
    • B
      ib_srpt: Fix a use-after-free in __srpt_close_all_ch() · 14d15c2b
      Bart Van Assche 提交于
      BUG: KASAN: use-after-free in srpt_set_enabled+0x1a9/0x1e0 [ib_srpt]
      Read of size 4 at addr ffff8801269d23f8 by task check/29726
      
      CPU: 4 PID: 29726 Comm: check Not tainted 4.18.0-rc2-dbg+ #4
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
      Call Trace:
       dump_stack+0xa4/0xf5
       print_address_description+0x6f/0x270
       kasan_report+0x241/0x360
       __asan_load4+0x78/0x80
       srpt_set_enabled+0x1a9/0x1e0 [ib_srpt]
       srpt_tpg_enable_store+0xb8/0x120 [ib_srpt]
       configfs_write_file+0x14e/0x1d0 [configfs]
       __vfs_write+0xd2/0x3b0
       vfs_write+0x101/0x270
       ksys_write+0xab/0x120
       __x64_sys_write+0x43/0x50
       do_syscall_64+0x77/0x230
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      RIP: 0033:0x7f235cfe6154
      
      Fixes: aaf45bd8 ("IB/srpt: Detect session shutdown reliably")
      Signed-off-by: NBart Van Assche <bart.vanassche@wdc.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      14d15c2b
    • B
      ib_srpt: Fix a use-after-free in srpt_close_ch() · 99525095
      Bart Van Assche 提交于
      Avoid that KASAN reports the following:
      
      BUG: KASAN: use-after-free in srpt_close_ch+0x4f/0x1b0 [ib_srpt]
      Read of size 4 at addr ffff880151180cb8 by task check/4681
      
      CPU: 15 PID: 4681 Comm: check Not tainted 4.18.0-rc2-dbg+ #4
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014
      Call Trace:
       dump_stack+0xa4/0xf5
       print_address_description+0x6f/0x270
       kasan_report+0x241/0x360
       __asan_load4+0x78/0x80
       srpt_close_ch+0x4f/0x1b0 [ib_srpt]
       srpt_set_enabled+0xf7/0x1e0 [ib_srpt]
       srpt_tpg_enable_store+0xb8/0x120 [ib_srpt]
       configfs_write_file+0x14e/0x1d0 [configfs]
       __vfs_write+0xd2/0x3b0
       vfs_write+0x101/0x270
       ksys_write+0xab/0x120
       __x64_sys_write+0x43/0x50
       do_syscall_64+0x77/0x230
       entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Fixes: aaf45bd8 ("IB/srpt: Detect session shutdown reliably")
      Signed-off-by: NBart Van Assche <bart.vanassche@wdc.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      99525095
  15. 03 7月, 2018 1 次提交
  16. 30 6月, 2018 1 次提交
  17. 19 6月, 2018 2 次提交
  18. 13 6月, 2018 1 次提交
    • K
      treewide: kmalloc() -> kmalloc_array() · 6da2ec56
      Kees Cook 提交于
      The kmalloc() function has a 2-factor argument form, kmalloc_array(). This
      patch replaces cases of:
      
              kmalloc(a * b, gfp)
      
      with:
              kmalloc_array(a * b, gfp)
      
      as well as handling cases of:
      
              kmalloc(a * b * c, gfp)
      
      with:
      
              kmalloc(array3_size(a, b, c), gfp)
      
      as it's slightly less ugly than:
      
              kmalloc_array(array_size(a, b), c, gfp)
      
      This does, however, attempt to ignore constant size factors like:
      
              kmalloc(4 * 1024, gfp)
      
      though any constants defined via macros get caught up in the conversion.
      
      Any factors with a sizeof() of "unsigned char", "char", and "u8" were
      dropped, since they're redundant.
      
      The tools/ directory was manually excluded, since it has its own
      implementation of kmalloc().
      
      The Coccinelle script used for this was:
      
      // Fix redundant parens around sizeof().
      @@
      type TYPE;
      expression THING, E;
      @@
      
      (
        kmalloc(
      -	(sizeof(TYPE)) * E
      +	sizeof(TYPE) * E
        , ...)
      |
        kmalloc(
      -	(sizeof(THING)) * E
      +	sizeof(THING) * E
        , ...)
      )
      
      // Drop single-byte sizes and redundant parens.
      @@
      expression COUNT;
      typedef u8;
      typedef __u8;
      @@
      
      (
        kmalloc(
      -	sizeof(u8) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(__u8) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(char) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(unsigned char) * (COUNT)
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(u8) * COUNT
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(__u8) * COUNT
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(char) * COUNT
      +	COUNT
        , ...)
      |
        kmalloc(
      -	sizeof(unsigned char) * COUNT
      +	COUNT
        , ...)
      )
      
      // 2-factor product with sizeof(type/expression) and identifier or constant.
      @@
      type TYPE;
      expression THING;
      identifier COUNT_ID;
      constant COUNT_CONST;
      @@
      
      (
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * (COUNT_ID)
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * COUNT_ID
      +	COUNT_ID, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * COUNT_CONST
      +	COUNT_CONST, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * (COUNT_ID)
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * COUNT_ID
      +	COUNT_ID, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * (COUNT_CONST)
      +	COUNT_CONST, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * COUNT_CONST
      +	COUNT_CONST, sizeof(THING)
        , ...)
      )
      
      // 2-factor product, only identifiers.
      @@
      identifier SIZE, COUNT;
      @@
      
      - kmalloc
      + kmalloc_array
        (
      -	SIZE * COUNT
      +	COUNT, SIZE
        , ...)
      
      // 3-factor product with 1 sizeof(type) or sizeof(expression), with
      // redundant parens removed.
      @@
      expression THING;
      identifier STRIDE, COUNT;
      type TYPE;
      @@
      
      (
        kmalloc(
      -	sizeof(TYPE) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(TYPE))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * (COUNT) * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * (COUNT) * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * COUNT * (STRIDE)
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      |
        kmalloc(
      -	sizeof(THING) * COUNT * STRIDE
      +	array3_size(COUNT, STRIDE, sizeof(THING))
        , ...)
      )
      
      // 3-factor product with 2 sizeof(variable), with redundant parens removed.
      @@
      expression THING1, THING2;
      identifier COUNT;
      type TYPE1, TYPE2;
      @@
      
      (
        kmalloc(
      -	sizeof(TYPE1) * sizeof(TYPE2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
        , ...)
      |
        kmalloc(
      -	sizeof(THING1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        kmalloc(
      -	sizeof(THING1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(THING1), sizeof(THING2))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * COUNT
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      |
        kmalloc(
      -	sizeof(TYPE1) * sizeof(THING2) * (COUNT)
      +	array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
        , ...)
      )
      
      // 3-factor product, only identifiers, with redundant parens removed.
      @@
      identifier STRIDE, SIZE, COUNT;
      @@
      
      (
        kmalloc(
      -	(COUNT) * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	(COUNT) * (STRIDE) * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	(COUNT) * STRIDE * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	(COUNT) * (STRIDE) * (SIZE)
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      |
        kmalloc(
      -	COUNT * STRIDE * SIZE
      +	array3_size(COUNT, STRIDE, SIZE)
        , ...)
      )
      
      // Any remaining multi-factor products, first at least 3-factor products,
      // when they're not all constants...
      @@
      expression E1, E2, E3;
      constant C1, C2, C3;
      @@
      
      (
        kmalloc(C1 * C2 * C3, ...)
      |
        kmalloc(
      -	(E1) * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kmalloc(
      -	(E1) * (E2) * E3
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kmalloc(
      -	(E1) * (E2) * (E3)
      +	array3_size(E1, E2, E3)
        , ...)
      |
        kmalloc(
      -	E1 * E2 * E3
      +	array3_size(E1, E2, E3)
        , ...)
      )
      
      // And then all remaining 2 factors products when they're not all constants,
      // keeping sizeof() as the second factor argument.
      @@
      expression THING, E1, E2;
      type TYPE;
      constant C1, C2, C3;
      @@
      
      (
        kmalloc(sizeof(THING) * C2, ...)
      |
        kmalloc(sizeof(TYPE) * C2, ...)
      |
        kmalloc(C1 * C2 * C3, ...)
      |
        kmalloc(C1 * C2, ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * (E2)
      +	E2, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(TYPE) * E2
      +	E2, sizeof(TYPE)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * (E2)
      +	E2, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	sizeof(THING) * E2
      +	E2, sizeof(THING)
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	(E1) * E2
      +	E1, E2
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	(E1) * (E2)
      +	E1, E2
        , ...)
      |
      - kmalloc
      + kmalloc_array
        (
      -	E1 * E2
      +	E1, E2
        , ...)
      )
      Signed-off-by: NKees Cook <keescook@chromium.org>
      6da2ec56
  19. 15 3月, 2018 1 次提交
    • A
      drivers/infiniband/ulp/srpt/ib_srpt.c: fix build with gcc-4.4.4 · 06892cc1
      Andrew Morton 提交于
      gcc-4.4.4 has issues with initialization of anonymous unions:
      
      drivers/infiniband/ulp/srpt/ib_srpt.c: In function 'srpt_zerolength_write':
      drivers/infiniband/ulp/srpt/ib_srpt.c:854: error: unknown field 'wr_cqe' specified in initializer
      drivers/infiniband/ulp/srpt/ib_srpt.c:854: warning: initialization makes integer from pointer without a cast
      
      Work aound this.
      
      Fixes: 2a78cb4d ("IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write()")
      Cc: Bart Van Assche <bart.vanassche@wdc.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Jason Gunthorpe <jgg@mellanox.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      06892cc1
  20. 08 3月, 2018 1 次提交
    • B
      IB/srpt: Add RDMA/CM support · 63cf1a90
      Bart Van Assche 提交于
      Add a parameter for configuring the port on which the ib_srpt driver
      listens for incoming RDMA/CM connections, namely
      /sys/kernel/config/target/srpt/discovery_auth/rdma_cm_port. The default
      value for this parameter is 0 which means "do not listen for incoming
      RDMA/CM connections". Add RDMA/CM support to all code that handles
      connection state changes. Modify srpt_init_nodeacl() such that ACLs can
      be configured for IPv4 and IPv6 addresses.
      
      Note: incoming connection requests are only accepted for ports that
      have been enabled. See also the "if (!sport->enabled)" code in the
      connection request handler. See also the following configfs attribute:
      /sys/kernel/config/target/srpt/$port/$port/enable.
      Signed-off-by: NBart Van Assche <bart.vanassche@wdc.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      63cf1a90
  21. 07 3月, 2018 1 次提交
    • B
      IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write() · 2a78cb4d
      Bart Van Assche 提交于
      Avoid triggering an out-of-bounds stack access by changing the type
      of 'wr' from ib_send_wr into ib_rdma_wr.
      
      This patch fixes the following KASAN bug report:
      
      BUG: KASAN: stack-out-of-bounds in rxe_post_send+0x7a9/0x9a0 [rdma_rxe]
      Read of size 8 at addr ffff880068197a48 by task kworker/2:1/44
      
      Workqueue: ib_cm cm_work_handler [ib_cm]
      Call Trace:
       dump_stack+0x8e/0xcd
       print_address_description+0x6f/0x280
       kasan_report+0x25a/0x380
       __asan_load8+0x54/0x90
       rxe_post_send+0x7a9/0x9a0 [rdma_rxe]
       srpt_zerolength_write+0xf0/0x180 [ib_srpt]
       srpt_cm_rtu_recv+0x68/0x110 [ib_srpt]
       srpt_rdma_cm_handler+0xbb/0x15b [ib_srpt]
       cma_ib_handler+0x1aa/0x4a0 [rdma_cm]
       cm_process_work+0x30/0x100 [ib_cm]
       cm_work_handler+0xa86/0x351b [ib_cm]
       process_one_work+0x475/0x9f0
       worker_thread+0x69/0x690
       kthread+0x1ad/0x1d0
       ret_from_fork+0x3a/0x50
      
      Fixes: aaf45bd8 ("IB/srpt: Detect session shutdown reliably")
      Signed-off-by: NBart Van Assche <bart.vanassche@wdc.com>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: stable@vger.kernel.org
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      2a78cb4d
  22. 25 1月, 2018 1 次提交
    • L
      RDMA/srpt: Fix RCU debug build error · f97f43c9
      Leon Romanovsky 提交于
      Combination of CONFIG_DEBUG_OBJECTS_RCU_HEAD=y and
      CONFIG_INFINIBAND_SRPT=m produces the following build error.
      
      ERROR: "init_rcu_head" [drivers/infiniband/ulp/srpt/ib_srpt.ko] undefined!
      make[1]: *** [scripts/Makefile.modpost:92: __modpost] Error 1
      make: *** [Makefile:1216: modules] Error 2
      
      The reason to it that init_rcu_head() is not exported and not supposed
      to be used in modules. It is needed for dynamic initialization of
      statically allocated rcu_head structures.
      
      Fixes: 795bc112 ("IB/srpt: Make it safe to use RCU for srpt_device.rch_list")
      Fixes: a1125314 ("IB/srpt: Rework multi-channel support")
      Signed-off-by: NBart Van Assche <bart.vanassche@wdc.com>
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      f97f43c9
  23. 19 1月, 2018 3 次提交