1. 01 3月, 2018 1 次提交
  2. 29 1月, 2018 1 次提交
  3. 16 1月, 2018 1 次提交
    • L
      RDMA/mlx5: Fix out-of-bound access while querying AH · ae59c3f0
      Leon Romanovsky 提交于
      The rdma_ah_find_type() accesses the port array based on an index
      controlled by userspace. The existing bounds check is after the first use
      of the index, so userspace can generate an out of bounds access, as shown
      by the KASN report below.
      
      ==================================================================
      BUG: KASAN: slab-out-of-bounds in to_rdma_ah_attr+0xa8/0x3b0
      Read of size 4 at addr ffff880019ae2268 by task ibv_rc_pingpong/409
      
      CPU: 0 PID: 409 Comm: ibv_rc_pingpong Not tainted 4.15.0-rc2-00031-gb60a3faf5b83-dirty #3
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
      Call Trace:
       dump_stack+0xe9/0x18f
       print_address_description+0xa2/0x350
       kasan_report+0x3a5/0x400
       to_rdma_ah_attr+0xa8/0x3b0
       mlx5_ib_query_qp+0xd35/0x1330
       ib_query_qp+0x8a/0xb0
       ib_uverbs_query_qp+0x237/0x7f0
       ib_uverbs_write+0x617/0xd80
       __vfs_write+0xf7/0x500
       vfs_write+0x149/0x310
       SyS_write+0xca/0x190
       entry_SYSCALL_64_fastpath+0x18/0x85
      RIP: 0033:0x7fe9c7a275a0
      RSP: 002b:00007ffee5498738 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
      RAX: ffffffffffffffda RBX: 00007fe9c7ce4b00 RCX: 00007fe9c7a275a0
      RDX: 0000000000000018 RSI: 00007ffee5498800 RDI: 0000000000000003
      RBP: 000055d0c8d3f010 R08: 00007ffee5498800 R09: 0000000000000018
      R10: 00000000000000ba R11: 0000000000000246 R12: 0000000000008000
      R13: 0000000000004fb0 R14: 000055d0c8d3f050 R15: 00007ffee5498560
      
      Allocated by task 1:
       __kmalloc+0x3f9/0x430
       alloc_mad_private+0x25/0x50
       ib_mad_post_receive_mads+0x204/0xa60
       ib_mad_init_device+0xa59/0x1020
       ib_register_device+0x83a/0xbc0
       mlx5_ib_add+0x50e/0x5c0
       mlx5_add_device+0x142/0x410
       mlx5_register_interface+0x18f/0x210
       mlx5_ib_init+0x56/0x63
       do_one_initcall+0x15b/0x270
       kernel_init_freeable+0x2d8/0x3d0
       kernel_init+0x14/0x190
       ret_from_fork+0x24/0x30
      
      Freed by task 0:
      (stack is not available)
      
      The buggy address belongs to the object at ffff880019ae2000
       which belongs to the cache kmalloc-512 of size 512
      The buggy address is located 104 bytes to the right of
       512-byte region [ffff880019ae2000, ffff880019ae2200)
      The buggy address belongs to the page:
      page:000000005d674e18 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
      flags: 0x4000000000008100(slab|head)
      raw: 4000000000008100 0000000000000000 0000000000000000 00000001000c000c
      raw: dead000000000100 dead000000000200 ffff88001a402000 0000000000000000
      page dumped because: kasan: bad access detected
      
      Memory state around the buggy address:
       ffff880019ae2100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       ffff880019ae2180: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
      >ffff880019ae2200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                ^
       ffff880019ae2280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
       ffff880019ae2300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      ==================================================================
      Disabling lock debugging due to kernel taint
      
      Cc: <stable@vger.kernel.org>
      Fixes: 44c58487 ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types")
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      ae59c3f0
  4. 09 1月, 2018 5 次提交
  5. 29 12月, 2017 3 次提交
  6. 14 11月, 2017 1 次提交
  7. 11 11月, 2017 1 次提交
  8. 26 10月, 2017 3 次提交
  9. 15 10月, 2017 2 次提交
  10. 29 8月, 2017 1 次提交
  11. 25 8月, 2017 3 次提交
    • B
      IB/mlx5: Allow posting multi packet send WQEs if hardware supports · 795b609c
      Bodong Wang 提交于
      Set the field to allow posting multi packet send WQEs if hardware
      supports this feature. This doesn't mean the send WQEs will be for
      multi packet unless the send WQE was prepared according to multi
      packet send WQE format.
      
      User space shall use flag MLX5_IB_ALLOW_MPW to check if hardware
      supports MPW and allows MPW in SQ context.
      Signed-off-by: NBodong Wang <bodong@mellanox.com>
      Reviewed-by: NDaniel Jurgens <danielj@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leon@kernel.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      795b609c
    • N
      IB/mlx5: Expose software parsing for Raw Ethernet QP · 96dc3fc5
      Noa Osherovich 提交于
      Software parsing (SWP) is a feature that can be used to instruct the
      device to stop using its internal parser and to parse packets on the
      transmit path according to offsets set for each packets.
      
      Through this feature, the device allows the handling of checksum and
      LSO by the hardware according to the location of IP and TCP/UDP
      headers.
      
      Enable SW parsing on Raw Ethernet send queue by default if firmware
      supports it and report these capabilities to user space.
      Signed-off-by: NNoa Osherovich <noaos@mellanox.com>
      Reviewed-by: NMaor Gottlieb <maorg@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leon@kernel.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      96dc3fc5
    • M
      IB/mlx5: Fix Raw Packet QP event handler assignment · 1d31e9c0
      Majd Dibbiny 提交于
      In case we have SQ and RQ for Raw Packet QP, the SQ's event handler
      wasn't assigned.
      
      Fixing this by assigning event handler for each WQ after creation.
      
      [ 1877.145243] Call Trace:
      [ 1877.148644] <IRQ>
      [ 1877.150580] [<ffffffffa07987c5>] ? mlx5_rsc_event+0x105/0x210 [mlx5_core]
      [ 1877.159581] [<ffffffffa0795bd7>] ? mlx5_cq_event+0x57/0xd0 [mlx5_core]
      [ 1877.167137] [<ffffffffa079208e>] mlx5_eq_int+0x53e/0x6c0 [mlx5_core]
      [ 1877.174526] [<ffffffff8101a679>] ? sched_clock+0x9/0x10
      [ 1877.180753] [<ffffffff810f717e>] handle_irq_event_percpu+0x3e/0x1e0
      [ 1877.188014] [<ffffffff810f735d>] handle_irq_event+0x3d/0x60
      [ 1877.194567] [<ffffffff810f9fe7>] handle_edge_irq+0x77/0x130
      [ 1877.201129] [<ffffffff81014c3f>] handle_irq+0xbf/0x150
      [ 1877.207244] [<ffffffff815ed78a>] ? atomic_notifier_call_chain+0x1a/0x20
      [ 1877.214829] [<ffffffff815f434f>] do_IRQ+0x4f/0xf0
      [ 1877.220498] [<ffffffff815e94ad>] common_interrupt+0x6d/0x6d
      [ 1877.227025] <EOI>
      [ 1877.228967] [<ffffffff814834e2>] ? cpuidle_enter_state+0x52/0xc0
      [ 1877.236990] [<ffffffff81483615>] cpuidle_idle_call+0xc5/0x200
      [ 1877.243676] [<ffffffff8101bc7e>] arch_cpu_idle+0xe/0x30
      [ 1877.249831] [<ffffffff810b4725>] cpu_startup_entry+0xf5/0x290
      [ 1877.256513] [<ffffffff815cfee1>] start_secondary+0x265/0x27b
      [ 1877.263111] Code: Bad RIP value.
      [ 1877.267296] RIP [< (null)>] (null)
      [ 1877.273264] RSP <ffff88046fd63df8>
      [ 1877.277531] CR2: 0000000000000000
      
      Fixes: 19098df2 ("IB/mlx5: Refactor mlx5_ib_qp to accommodate other QP types")
      Signed-off-by: NMajd Dibbiny <majd@mellanox.com>
      Reviewed-by: NYishai Hadas <yishaih@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leon@kernel.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      1d31e9c0
  12. 23 8月, 2017 1 次提交
  13. 24 7月, 2017 3 次提交
  14. 02 6月, 2017 1 次提交
  15. 14 5月, 2017 1 次提交
  16. 02 5月, 2017 4 次提交
  17. 22 4月, 2017 1 次提交
    • P
      IB/mlx5: Support congestion related counters · e1f24a79
      Parav Pandit 提交于
      This patch adds support to query the congestion related hardware counters
      through new command and links them with other hw counters being available
      in hw_counters sysfs location.
      
      In order to reuse existing infrastructure it renames related q_counter
      data structures to more generic counters to reflect q_counters and
      congestion counters and maybe some other counters in the future.
      
      New hardware counters:
       * rp_cnp_handled - CNP packets handled by the reaction point
       * rp_cnp_ignored - CNP packets ignored by the reaction point
       * np_cnp_sent    - CNP packets sent by notification point to respond to
                           CE marked RoCE packets
       * np_ecn_marked_roce_packets - CE marked RoCE packets received by
                                      notification point
      
      It also avoids returning ENOSYS which is specific for invalid
      system call and produces the following checkpatch.pl warning.
      
      WARNING: ENOSYS means 'invalid syscall nr' and nothing else
      +		return -ENOSYS;
      Signed-off-by: NParav Pandit <parav@mellanox.com>
      Reviewed-by: NEli Cohen <eli@mellanox.com>
      Reviewed-by: NDaniel Jurgens <danielj@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leon@kernel.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      e1f24a79
  18. 17 4月, 2017 1 次提交
  19. 15 2月, 2017 6 次提交