1. 22 4月, 2021 5 次提交
  2. 19 4月, 2021 1 次提交
  3. 13 4月, 2021 7 次提交
  4. 08 4月, 2021 1 次提交
  5. 02 4月, 2021 1 次提交
  6. 26 3月, 2021 3 次提交
  7. 22 3月, 2021 1 次提交
  8. 12 3月, 2021 4 次提交
  9. 11 3月, 2021 1 次提交
  10. 04 3月, 2021 1 次提交
  11. 02 3月, 2021 1 次提交
    • S
      RDMA/cm: Fix IRQ restore in ib_send_cm_sidr_rep · 221384df
      Saeed Mahameed 提交于
      ib_send_cm_sidr_rep() {
      	spin_lock_irqsave()
              cm_send_sidr_rep_locked() {
                      ...
              	spin_lock_irq()
                      ....
                      spin_unlock_irq() <--- this will enable interrupts
              }
              spin_unlock_irqrestore()
      }
      
      spin_unlock_irqrestore() expects interrupts to be disabled but the
      internal spin_unlock_irq() will always enable hard interrupts.
      
      Fix this by replacing the internal spin_{lock,unlock}_irq() with
      irqsave/restore variants.
      
      It fixes the following kernel trace:
      
       raw_local_irq_restore() called with IRQs enabled
       WARNING: CPU: 2 PID: 20001 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x1d/0x20
      
       Call Trace:
        _raw_spin_unlock_irqrestore+0x4e/0x50
        ib_send_cm_sidr_rep+0x3a/0x50 [ib_cm]
        cma_send_sidr_rep+0xa1/0x160 [rdma_cm]
        rdma_accept+0x25e/0x350 [rdma_cm]
        ucma_accept+0x132/0x1cc [rdma_ucm]
        ucma_write+0xbf/0x140 [rdma_ucm]
        vfs_write+0xc1/0x340
        ksys_write+0xb3/0xe0
        do_syscall_64+0x2d/0x40
        entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Fixes: 87c4c774 ("RDMA/cm: Protect access to remote_sidr_table")
      Link: https://lore.kernel.org/r/20210301081844.445823-1-leon@kernel.orgSigned-off-by: NSaeed Mahameed <saeedm@nvidia.com>
      Reviewed-by: NJason Gunthorpe <jgg@nvidia.com>
      Signed-off-by: NLeon Romanovsky <leonro@nvidia.com>
      Signed-off-by: NJason Gunthorpe <jgg@nvidia.com>
      221384df
  12. 17 2月, 2021 3 次提交
    • A
      RDMA/ucma: Fix use-after-free bug in ucma_create_uevent · fe454dc3
      Avihai Horon 提交于
      ucma_process_join() allocates struct ucma_multicast mc and frees it if an
      error occurs during its run.  Specifically, if an error occurs in
      copy_to_user(), a use-after-free might happen in the following scenario:
      
      1. mc struct is allocated.
      2. rdma_join_multicast() is called and succeeds. During its run,
         cma_iboe_join_multicast() enqueues a work that will later use the
         aforementioned mc struct.
      3. copy_to_user() is called and fails.
      4. mc struct is deallocated.
      5. The work that was enqueued by cma_iboe_join_multicast() is run and
         calls ucma_create_uevent() which tries to access mc struct (which is
         freed by now).
      
      Fix this bug by cancelling the work enqueued by cma_iboe_join_multicast().
      Since cma_work_handler() frees struct cma_work, we don't use it in
      cma_iboe_join_multicast() so we can safely cancel the work later.
      
      The following syzkaller report revealed it:
      
         BUG: KASAN: use-after-free in ucma_create_uevent+0x2dd/0x;3f0 drivers/infiniband/core/ucma.c:272
         Read of size 8 at addr ffff88810b3ad110 by task kworker/u8:1/108
      
         CPU: 1 PID: 108 Comm: kworker/u8:1 Not tainted 5.10.0-rc6+ #257
         Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS   rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
         Workqueue: rdma_cm cma_work_handler
         Call Trace:
          __dump_stack lib/dump_stack.c:77 [inline]
          dump_stack+0xbe/0xf9 lib/dump_stack.c:118
          print_address_description.constprop.0+0x3e/0×60 mm/kasan/report.c:385
          __kasan_report mm/kasan/report.c:545 [inline]
          kasan_report.cold+0x1f/0×37 mm/kasan/report.c:562
          ucma_create_uevent+0x2dd/0×3f0 drivers/infiniband/core/ucma.c:272
          ucma_event_handler+0xb7/0×3c0 drivers/infiniband/core/ucma.c:349
          cma_cm_event_handler+0x5d/0×1c0 drivers/infiniband/core/cma.c:1977
          cma_work_handler+0xfa/0×190 drivers/infiniband/core/cma.c:2718
          process_one_work+0x54c/0×930 kernel/workqueue.c:2272
          worker_thread+0x82/0×830 kernel/workqueue.c:2418
          kthread+0x1ca/0×220 kernel/kthread.c:292
          ret_from_fork+0x1f/0×30 arch/x86/entry/entry_64.S:296
      
         Allocated by task 359:
           kasan_save_stack+0x1b/0×40 mm/kasan/common.c:48
           kasan_set_track mm/kasan/common.c:56 [inline]
           __kasan_kmalloc mm/kasan/common.c:461 [inline]
           __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:434
           kmalloc include/linux/slab.h:552 [inline]
           kzalloc include/linux/slab.h:664 [inline]
           ucma_process_join+0x16e/0×3f0 drivers/infiniband/core/ucma.c:1453
           ucma_join_multicast+0xda/0×140 drivers/infiniband/core/ucma.c:1538
           ucma_write+0x1f7/0×280 drivers/infiniband/core/ucma.c:1724
           vfs_write fs/read_write.c:603 [inline]
           vfs_write+0x191/0×4c0 fs/read_write.c:585
           ksys_write+0x1a1/0×1e0 fs/read_write.c:658
           do_syscall_64+0x2d/0×40 arch/x86/entry/common.c:46
           entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
         Freed by task 359:
           kasan_save_stack+0x1b/0×40 mm/kasan/common.c:48
           kasan_set_track+0x1c/0×30 mm/kasan/common.c:56
           kasan_set_free_info+0x1b/0×30 mm/kasan/generic.c:355
           __kasan_slab_free+0x112/0×160 mm/kasan/common.c:422
           slab_free_hook mm/slub.c:1544 [inline]
           slab_free_freelist_hook mm/slub.c:1577 [inline]
           slab_free mm/slub.c:3142 [inline]
           kfree+0xb3/0×3e0 mm/slub.c:4124
           ucma_process_join+0x22d/0×3f0 drivers/infiniband/core/ucma.c:1497
           ucma_join_multicast+0xda/0×140 drivers/infiniband/core/ucma.c:1538
           ucma_write+0x1f7/0×280 drivers/infiniband/core/ucma.c:1724
           vfs_write fs/read_write.c:603 [inline]
           vfs_write+0x191/0×4c0 fs/read_write.c:585
           ksys_write+0x1a1/0×1e0 fs/read_write.c:658
           do_syscall_64+0x2d/0×40 arch/x86/entry/common.c:46
           entry_SYSCALL_64_after_hwframe+0x44/0xa9
           The buggy address belongs to the object at ffff88810b3ad100
           which belongs to the cache kmalloc-192 of size 192
           The buggy address is located 16 bytes inside of
           192-byte region [ffff88810b3ad100, ffff88810b3ad1c0)
      
      Fixes: b5de0c60 ("RDMA/cma: Fix use after free race in roce multicast join")
      Link: https://lore.kernel.org/r/20210211090517.1278415-1-leon@kernel.orgReported-by: NAmit Matityahu <mitm@nvidia.com>
      Signed-off-by: NAvihai Horon <avihaih@nvidia.com>
      Signed-off-by: NLeon Romanovsky <leonro@nvidia.com>
      Signed-off-by: NJason Gunthorpe <jgg@nvidia.com>
      fe454dc3
    • L
      RDMA/core: Fix kernel doc warnings for ib_port_immutable_read() · 168e4cd9
      Leon Romanovsky 提交于
      drivers/infiniband/core/device.c:859: warning: Function parameter or member 'dev' not described in 'ib_port_immutable_read'
      drivers/infiniband/core/device.c:859: warning: Function parameter or member 'port' not described in 'ib_port_immutable_read'
      
      Fixes: 7416790e ("RDMA/core: Introduce and use API to read port immutable data")
      Link: https://lore.kernel.org/r/20210210151421.1108809-1-leon@kernel.orgReported-by: NStephen Rothwell <sfr@canb.auug.org.au>
      Signed-off-by: NLeon Romanovsky <leonro@nvidia.com>
      Signed-off-by: NJason Gunthorpe <jgg@nvidia.com>
      168e4cd9
    • C
      RDMA/ipoib: Remove racy Subnet Manager sendonly join checks · 633d6102
      Christoph Lameter 提交于
      When a system receives a REREG event from the SM, then the SM information
      in the kernel is marked as invalid and a request is sent to the SM to
      update the information. The SM information is invalid in that time period.
      
      However, receiving a REREG also occurs simultaneously in user space
      applications that are now trying to rejoin the multicast groups. Some of
      those may be sendonly multicast groups which are then failing.
      
      If the SM information is invalid then ib_sa_sendonly_fullmem_support()
      returns false. That is wrong because it just means that we do not know yet
      if the potentially new SM supports sendonly joins.
      
      Sendonly join was introduced in 2015 and all the Subnet managers have
      supported it ever since. So there is no point in checking if a subnet
      manager supports it.
      
      Should an old opensm get a request for a sendonly join then the request
      will fail. The code that is removed here accomodated that situation and
      fell back to a full join.
      
      Falling back to a full join is problematic in itself. The reason to use
      the sendonly join was to reduce the traffic on the Infiniband fabric
      otherwise one could have just stayed with the regular join.  So this patch
      may cause users of very old opensms to discover that lots of traffic
      needlessly crosses their IB fabrics.
      
      Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2101281845160.13303@www.lameter.comSigned-off-by: NChristoph Lameter <cl@linux.com>
      Signed-off-by: NJason Gunthorpe <jgg@nvidia.com>
      633d6102
  13. 06 2月, 2021 1 次提交
  14. 03 2月, 2021 2 次提交
  15. 29 1月, 2021 2 次提交
  16. 21 1月, 2021 4 次提交
  17. 20 1月, 2021 2 次提交
    • L
      RDMA/core/iwpm_msg: Add proper descriptions for 'skb' param · abfa4565
      Lee Jones 提交于
      Fixes the following W=1 kernel build warning(s):
      
       drivers/infiniband/core/iwpm_msg.c:402: warning: Function parameter or member 'skb' not described in 'iwpm_register_pid_cb'
       drivers/infiniband/core/iwpm_msg.c:475: warning: Function parameter or member 'skb' not described in 'iwpm_add_mapping_cb'
       drivers/infiniband/core/iwpm_msg.c:553: warning: Function parameter or member 'skb' not described in 'iwpm_add_and_query_mapping_cb'
       drivers/infiniband/core/iwpm_msg.c:636: warning: Function parameter or member 'skb' not described in 'iwpm_remote_info_cb'
       drivers/infiniband/core/iwpm_msg.c:716: warning: Function parameter or member 'skb' not described in 'iwpm_mapping_info_cb'
       drivers/infiniband/core/iwpm_msg.c:773: warning: Function parameter or member 'skb' not described in 'iwpm_ack_mapping_info_cb'
       drivers/infiniband/core/iwpm_msg.c:803: warning: Function parameter or member 'skb' not described in 'iwpm_mapping_error_cb'
       drivers/infiniband/core/iwpm_msg.c:851: warning: Function parameter or member 'skb' not described in 'iwpm_hello_cb'
      
      Link: https://lore.kernel.org/r/20210118223929.512175-21-lee.jones@linaro.org
      Cc: Doug Ledford <dledford@redhat.com>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Cc: linux-rdma@vger.kernel.org
      Signed-off-by: NLee Jones <lee.jones@linaro.org>
      Signed-off-by: NJason Gunthorpe <jgg@nvidia.com>
      abfa4565
    • L
      RDMA/core/iwpm_util: Fix some param description misspellings · db038e70
      Lee Jones 提交于
      Fixes the following W=1 kernel build warning(s):
      
       drivers/infiniband/core/iwpm_util.c:138: warning: Function parameter or member 'local_sockaddr' not described in 'iwpm_create_mapinfo'
       drivers/infiniband/core/iwpm_util.c:138: warning: Function parameter or member 'mapped_sockaddr' not described in 'iwpm_create_mapinfo'
       drivers/infiniband/core/iwpm_util.c:138: warning: Excess function parameter 'local_addr' description in 'iwpm_create_mapinfo'
       drivers/infiniband/core/iwpm_util.c:138: warning: Excess function parameter 'mapped_addr' description in 'iwpm_create_mapinfo'
       drivers/infiniband/core/iwpm_util.c:185: warning: Function parameter or member 'local_sockaddr' not described in 'iwpm_remove_mapinfo'
       drivers/infiniband/core/iwpm_util.c:185: warning: Excess function parameter 'local_addr' description in 'iwpm_remove_mapinfo'
      
      Link: https://lore.kernel.org/r/20210118223929.512175-20-lee.jones@linaro.org
      Cc: Doug Ledford <dledford@redhat.com>
      Cc: Jason Gunthorpe <jgg@ziepe.ca>
      Cc: linux-rdma@vger.kernel.org
      Signed-off-by: NLee Jones <lee.jones@linaro.org>
      Signed-off-by: NJason Gunthorpe <jgg@nvidia.com>
      db038e70