1. 24 6月, 2019 5 次提交
  2. 21 6月, 2019 1 次提交
  3. 22 5月, 2019 1 次提交
  4. 06 5月, 2019 2 次提交
  5. 11 4月, 2019 1 次提交
  6. 03 4月, 2019 1 次提交
  7. 02 4月, 2019 1 次提交
  8. 22 2月, 2019 1 次提交
    • M
      IB/mlx5: Protect against prefetch of invalid MR · a6bc3875
      Moni Shoua 提交于
      When deferring a prefetch request we need to protect against MR or PD
      being destroyed while the request is still enqueued.
      
      The first step is to validate that PD owns the lkey that describes the MR
      and that the MR that the lkey refers to is owned by that PD.
      
      The second step is to dequeue all requests when MR is destroyed.
      
      Since PD can't be destroyed while it owns MRs it is guaranteed that when a
      worker wakes up the request it refers to is still valid.
      
      Now, it is possible to refrain from taking a reference on the device since
      it is assured to be present as pd.
      
      While that, replace the dedicated ordered workqueue with the system
      unbound workqueue to reuse an existing resource and improve
      performance. This will also fix a bug of queueing to the wrong workqueue.
      
      Fixes: 813e90b1 ("IB/mlx5: Add advise_mr() support")
      Reported-by: NParav Pandit <parav@mellanox.com>
      Signed-off-by: NMoni Shoua <monis@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      a6bc3875
  9. 25 1月, 2019 1 次提交
  10. 24 1月, 2019 1 次提交
  11. 11 1月, 2019 1 次提交
  12. 09 1月, 2019 2 次提交
  13. 03 1月, 2019 1 次提交
  14. 21 12月, 2018 1 次提交
  15. 19 12月, 2018 2 次提交
  16. 16 10月, 2018 1 次提交
  17. 11 10月, 2018 1 次提交
    • V
      IB/mlx5: Unmap DMA addr from HCA before IOMMU · dd9a4034
      Valentine Fatiev 提交于
      The function that puts back the MR in cache also removes the DMA address
      from the HCA. Therefore we need to call this function before we remove
      the DMA mapping from MMU. Otherwise the HCA may access a memory that
      is no longer DMA mapped.
      
      Call trace:
      NMI: IOCK error (debug interrupt?) for reason 71 on CPU 0.
      CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.0-rc6+ #4
      Hardware name: HP ProLiant DL360p Gen8, BIOS P71 08/20/2012
      RIP: 0010:intel_idle+0x73/0x120
      Code: 80 5c 01 00 0f ae 38 0f ae f0 31 d2 65 48 8b 04 25 80 5c 01 00 48 89 d1 0f 60 02
      RSP: 0018:ffffffff9a403e38 EFLAGS: 00000046
      RAX: 0000000000000030 RBX: 0000000000000005 RCX: 0000000000000001
      RDX: 0000000000000000 RSI: ffffffff9a5790c0 RDI: 0000000000000000
      RBP: 0000000000000030 R08: 0000000000000000 R09: 0000000000007cf9
      R10: 000000000000030a R11: 0000000000000018 R12: 0000000000000000
      R13: ffffffff9a5792b8 R14: ffffffff9a5790c0 R15: 0000002b48471e4d
      FS:  0000000000000000(0000) GS:ffff9c6caf400000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f5737185000 CR3: 0000000590c0a002 CR4: 00000000000606f0
      Call Trace:
       cpuidle_enter_state+0x7e/0x2e0
       do_idle+0x1ed/0x290
       cpu_startup_entry+0x6f/0x80
       start_kernel+0x524/0x544
       ? set_init_arg+0x55/0x55
       secondary_startup_64+0xa4/0xb0
      DMAR: DRHD: handling fault status reg 2
      DMAR: [DMA Read] Request device [04:00.0] fault addr b34d2000 [fault reason 06] PTE Read access is not set
      DMAR: [DMA Read] Request device [01:00.2] fault addr bff8b000 [fault reason 06] PTE Read access is not set
      
      Fixes: f3f134f5 ("RDMA/mlx5: Fix crash while accessing garbage pointer and freed memory")
      Signed-off-by: NValentine Fatiev <valentinef@mellanox.com>
      Reviewed-by: NMoni Shoua <monis@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      dd9a4034
  18. 21 9月, 2018 2 次提交
  19. 31 7月, 2018 1 次提交
    • B
      RDMA, core and ULPs: Declare ib_post_send() and ib_post_recv() arguments const · d34ac5cd
      Bart Van Assche 提交于
      Since neither ib_post_send() nor ib_post_recv() modify the data structure
      their second argument points at, declare that argument const. This change
      makes it necessary to declare the 'bad_wr' argument const too and also to
      modify all ULPs that call ib_post_send(), ib_post_recv() or
      ib_post_srq_recv(). This patch does not change any functionality but makes
      it possible for the compiler to verify whether the
      ib_post_(send|recv|srq_recv) really do not modify the posted work request.
      
      To make this possible, only one cast had to be introduce that casts away
      constness, namely in rpcrdma_post_recvs(). The only way I can think of to
      avoid that cast is to introduce an additional loop in that function or to
      change the data type of bad_wr from struct ib_recv_wr ** into int
      (an index that refers to an element in the work request list). However,
      both approaches would require even more extensive changes than this
      patch.
      Signed-off-by: NBart Van Assche <bart.vanassche@wdc.com>
      Reviewed-by: NChuck Lever <chuck.lever@oracle.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      d34ac5cd
  20. 10 7月, 2018 1 次提交
    • J
      IB/mlx5: fix uaccess beyond "count" in debugfs read/write handlers · 60e6627f
      Jann Horn 提交于
      In general, accessing userspace memory beyond the length of the supplied
      buffer in VFS read/write handlers can lead to both kernel memory corruption
      (via kernel_read()/kernel_write(), which can e.g. be triggered via
      sys_splice()) and privilege escalation inside userspace.
      
      In this case, the affected files are in debugfs (and should therefore only
      be accessible to root), and the read handlers check that *pos is zero
      (meaning that at least sys_splice() can't trigger kernel memory
      corruption). Because of the root requirement, this is not a security fix,
      but rather a cleanup.
      
      For the read handlers, fix it by using simple_read_from_buffer() instead
      of custom logic. Add min() calls to the write handlers.
      
      Fixes: 4a2da0b8 ("IB/mlx5: Add debug control parameters for congestion control")
      Fixes: e126ba97 ("mlx5: Add driver for Mellanox Connect-IB adapters")
      Signed-off-by: NJann Horn <jannh@google.com>
      Reviewed-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      60e6627f
  21. 27 4月, 2018 1 次提交
  22. 06 4月, 2018 2 次提交
  23. 28 3月, 2018 1 次提交
  24. 22 3月, 2018 1 次提交
  25. 15 3月, 2018 7 次提交