1. 26 7月, 2019 1 次提交
  2. 28 4月, 2019 1 次提交
    • J
      netlink: make validation more configurable for future strictness · 8cb08174
      Johannes Berg 提交于
      We currently have two levels of strict validation:
      
       1) liberal (default)
           - undefined (type >= max) & NLA_UNSPEC attributes accepted
           - attribute length >= expected accepted
           - garbage at end of message accepted
       2) strict (opt-in)
           - NLA_UNSPEC attributes accepted
           - attribute length >= expected accepted
      
      Split out parsing strictness into four different options:
       * TRAILING     - check that there's no trailing data after parsing
                        attributes (in message or nested)
       * MAXTYPE      - reject attrs > max known type
       * UNSPEC       - reject attributes with NLA_UNSPEC policy entries
       * STRICT_ATTRS - strictly validate attribute size
      
      The default for future things should be *everything*.
      The current *_strict() is a combination of TRAILING and MAXTYPE,
      and is renamed to _deprecated_strict().
      The current regular parsing has none of this, and is renamed to
      *_parse_deprecated().
      
      Additionally it allows us to selectively set one of the new flags
      even on old policies. Notably, the UNSPEC flag could be useful in
      this case, since it can be arranged (by filling in the policy) to
      not be an incompatible userspace ABI change, but would then going
      forward prevent forgetting attribute entries. Similar can apply
      to the POLICY flag.
      
      We end up with the following renames:
       * nla_parse           -> nla_parse_deprecated
       * nla_parse_strict    -> nla_parse_deprecated_strict
       * nlmsg_parse         -> nlmsg_parse_deprecated
       * nlmsg_parse_strict  -> nlmsg_parse_deprecated_strict
       * nla_parse_nested    -> nla_parse_nested_deprecated
       * nla_validate_nested -> nla_validate_nested_deprecated
      
      Using spatch, of course:
          @@
          expression TB, MAX, HEAD, LEN, POL, EXT;
          @@
          -nla_parse(TB, MAX, HEAD, LEN, POL, EXT)
          +nla_parse_deprecated(TB, MAX, HEAD, LEN, POL, EXT)
      
          @@
          expression NLH, HDRLEN, TB, MAX, POL, EXT;
          @@
          -nlmsg_parse(NLH, HDRLEN, TB, MAX, POL, EXT)
          +nlmsg_parse_deprecated(NLH, HDRLEN, TB, MAX, POL, EXT)
      
          @@
          expression NLH, HDRLEN, TB, MAX, POL, EXT;
          @@
          -nlmsg_parse_strict(NLH, HDRLEN, TB, MAX, POL, EXT)
          +nlmsg_parse_deprecated_strict(NLH, HDRLEN, TB, MAX, POL, EXT)
      
          @@
          expression TB, MAX, NLA, POL, EXT;
          @@
          -nla_parse_nested(TB, MAX, NLA, POL, EXT)
          +nla_parse_nested_deprecated(TB, MAX, NLA, POL, EXT)
      
          @@
          expression START, MAX, POL, EXT;
          @@
          -nla_validate_nested(START, MAX, POL, EXT)
          +nla_validate_nested_deprecated(START, MAX, POL, EXT)
      
          @@
          expression NLH, HDRLEN, MAX, POL, EXT;
          @@
          -nlmsg_validate(NLH, HDRLEN, MAX, POL, EXT)
          +nlmsg_validate_deprecated(NLH, HDRLEN, MAX, POL, EXT)
      
      For this patch, don't actually add the strict, non-renamed versions
      yet so that it breaks compile if I get it wrong.
      
      Also, while at it, make nla_validate and nla_parse go down to a
      common __nla_validate_parse() function to avoid code duplication.
      
      Ultimately, this allows us to have very strict validation for every
      new caller of nla_parse()/nlmsg_parse() etc as re-introduced in the
      next patch, while existing things will continue to work as is.
      
      In effect then, this adds fully strict validation for any new command.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      8cb08174
  3. 26 3月, 2019 1 次提交
  4. 08 1月, 2019 1 次提交
    • G
      IB/core: Use struct_size() in kzalloc() · 5aad26a7
      Gustavo A. R. Silva 提交于
      One of the more common cases of allocation size calculations is finding the
      size of a structure that has a zero-sized array at the end, along with memory
      for some number of elements for that array. For example:
      
      struct foo {
          int stuff;
          void *entry[];
      };
      
      instance = kzalloc(sizeof(struct foo) + sizeof(void *) * count, GFP_KERNEL);
      
      Instead of leaving these open-coded and prone to type mistakes, we can now
      use the new struct_size() helper:
      
      instance = kzalloc(struct_size(instance, entry, count), GFP_KERNEL);
      
      This code was detected with the help of Coccinelle.
      Signed-off-by: NGustavo A. R. Silva <gustavo@embeddedor.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      5aad26a7
  5. 20 12月, 2018 2 次提交
  6. 17 10月, 2018 1 次提交
  7. 04 10月, 2018 1 次提交
  8. 27 9月, 2018 2 次提交
  9. 13 9月, 2018 1 次提交
    • P
      RDMA/core: Simplify roce_resolve_route_from_path() · 6aaecd38
      Parav Pandit 提交于
      Currently RoCE route resolve functionality is split between two
      functions. (a) roce_resolve_route_from_path() and its helper function
      rdma_resolve_ip_route().
      
      Due to this multiple sockaddr src structures are created in both functions
      with rdma_dev_addr is an interface between the two for checks.
      
      Since there is only one user of rdma_resolve_ip_route() as RoCE, combine
      the functionality of both functions to roce_resolve_route_from_path() and
      further reduce the scope of rdma_dev_addr to core/addr.c
      
      This also allow to extend addr_resolve() in subsequent patch to consider
      netdev properties of GID in safer way under rcu lock.
      
      Additionally src and dst addresses were always provided, so skip the src
      addr NULL pointer check as they are present on the stack now.
      Signed-off-by: NParav Pandit <parav@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      6aaecd38
  10. 11 7月, 2018 2 次提交
  11. 10 7月, 2018 1 次提交
  12. 26 6月, 2018 2 次提交
    • P
      IB/cm: Replace members of sa_path_rec with 'struct sgid_attr *' · 39839107
      Parav Pandit 提交于
      While processing a path record entry in CM messages the associated GID
      attribute is now also supplied.
      
      Currently for RoCE a netdevice's net namespace pointer and ifindex are
      stored in path record entry. Both of these fields of the netdev can change
      anytime while processing CM messages. Additionally storing net namespace
      without holding reference will lead to use-after-free crash. Therefore it
      is removed. Netdevice information for RoCE is instead provided via
      referenced gid attribute in ib_cm requests.
      
      Such a design leads to a situation where the kernel can crash when the net
      pointer becomes invalid. However today it is always initialized to
      init_net, which cannot become invalid. In order to support processing
      packets in any arbitrary namespace of the received packet, it is necessary
      to avoid such conditions.
      
      This patch removes the dependency on the net pointer and ifindex; instead
      it will rely on SGID attribute which contains a pointer to netdev.
      Signed-off-by: NParav Pandit <parav@mellanox.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      39839107
    • P
      IB: Make init_ah_attr_grh_fields set sgid_attr · aa74f487
      Parav Pandit 提交于
      Use the sgid and other information from the path record to figure out the
      sgid_attrs.
      
      Store the selected table entry in the sgid_attr for everything else to
      use.
      Signed-off-by: NParav Pandit <parav@mellanox.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      aa74f487
  13. 24 3月, 2018 1 次提交
    • P
      IB/cma: Resolve route only while receiving CM requests · 114cc9c4
      Parav Pandit 提交于
      Currently CM request for RoCE follows following flow.
      rdma_create_id()
      rdma_resolve_addr()
      rdma_resolve_route()
      For RC QPs:
      rdma_connect()
      ->cma_connect_ib()
        ->ib_send_cm_req()
          ->cm_init_av_by_path()
            ->ib_init_ah_attr_from_path()
      For UD QPs:
      rdma_connect()
      ->cma_resolve_ib_udp()
        ->ib_send_cm_sidr_req()
          ->cm_init_av_by_path()
            ->ib_init_ah_attr_from_path()
      
      In both the flows, route is already resolved before sending CM requests.
      Therefore, code is refactored to avoid resolving route second time in
      ib_cm layer.
      ib_init_ah_attr_from_path() is extended to resolve route when it is not
      yet resolved for RoCE link layer. This is achieved by caller setting
      route_resolved field in path record whenever it has route already
      resolved.
      Signed-off-by: NParav Pandit <parav@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      114cc9c4
  14. 16 3月, 2018 1 次提交
  15. 08 3月, 2018 1 次提交
  16. 23 12月, 2017 1 次提交
    • V
      IB/SA: Check dlid before SA agent queries for ClassPortInfo · af808ece
      Venkata Sandeep Dhanalakota 提交于
      SA queries SM for class port info when there is a LID_CHANGE event.
      
      When a base lid is configured before fm is started ie when smlid is
      not yet assigned, SA handles the LID_CHANGE event and tries query SM
      with lid 0. This will cause an hang.
      
      [ 1106.958820] INFO: task kworker/2:0:23 blocked for more than 120 seconds.
      [ 1106.965082] Tainted: G O 4.12.0+ #1
      [ 1106.969602] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables
       this message.
      [ 1106.977227] kworker/2:0 D 0 23 2 0x00000000
      [ 1106.977250] Workqueue: infiniband update_ib_cpi [ib_core]
      [ 1106.977261] Call Trace:
      [ 1106.977273] __schedule+0x28e/0x860
      [ 1106.977285] schedule+0x36/0x80
      [ 1106.977298] schedule_timeout+0x1a3/0x2e0
      [ 1106.977310] ? radix_tree_iter_tag_clear+0x1b/0x20
      [ 1106.977322] ? idr_alloc+0x64/0x90
      [ 1106.977334] wait_for_completion+0xe3/0x140
      [ 1106.977347] ? wake_up_q+0x80/0x80
      [ 1106.977369] update_ib_cpi+0x163/0x210 [ib_core]
      [ 1106.977381] process_one_work+0x147/0x370
      [ 1106.977394] worker_thread+0x4a/0x390
      [ 1106.977406] kthread+0x109/0x140
      [ 1106.977418] ? process_one_work+0x370/0x370
      [ 1106.977430] ? kthread_park+0x60/0x60
      [ 1106.977443] ret_from_fork+0x22/0x30
      
      Always ensure a proper smlid is assigned before querying SM for cpi.
      
      Fixes: ee1c60b1 ("IB/SA: Modify SA to implicitly cache Class Port info")
      Reviewed-by: NIra Weiny <ira.weiny@intel.com>
      Signed-off-by: NVenkata Sandeep Dhanalakota <venkata.s.dhanalakota@intel.com>
      Signed-off-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      af808ece
  17. 19 12月, 2017 1 次提交
  18. 25 8月, 2017 1 次提交
  19. 23 8月, 2017 1 次提交
  20. 10 8月, 2017 4 次提交
  21. 16 6月, 2017 1 次提交
    • J
      networking: make skb_put & friends return void pointers · 4df864c1
      Johannes Berg 提交于
      It seems like a historic accident that these return unsigned char *,
      and in many places that means casts are required, more often than not.
      
      Make these functions (skb_put, __skb_put and pskb_put) return void *
      and remove all the casts across the tree, adding a (u8 *) cast only
      where the unsigned char pointer was used directly, all done with the
      following spatch:
      
          @@
          expression SKB, LEN;
          typedef u8;
          identifier fn = { skb_put, __skb_put };
          @@
          - *(fn(SKB, LEN))
          + *(u8 *)fn(SKB, LEN)
      
          @@
          expression E, SKB, LEN;
          identifier fn = { skb_put, __skb_put };
          type T;
          @@
          - E = ((T *)(fn(SKB, LEN)))
          + E = fn(SKB, LEN)
      
      which actually doesn't cover pskb_put since there are only three
      users overall.
      
      A handful of stragglers were converted manually, notably a macro in
      drivers/isdn/i4l/isdn_bsdcomp.c and, oddly enough, one of the many
      instances in net/bluetooth/hci_sock.c. In the former file, I also
      had to fix one whitespace problem spatch introduced.
      Signed-off-by: NJohannes Berg <johannes.berg@intel.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      4df864c1
  22. 02 6月, 2017 1 次提交
    • M
      RDMA/SA: Fix kernel panic in CMA request handler flow · d3957b86
      Majd Dibbiny 提交于
      Commit 9fdca4da (IB/SA: Split struct sa_path_rec based on IB and
      ROCE specific fields) moved the service_id to be specific attribute
      for IB and OPA SA Path Record, and thus wasn't assigned for RoCE.
      
      This caused to the following kernel panic in the CMA request handler flow:
      
      [   27.074594] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
      [   27.074731] IP: __radix_tree_lookup+0x1d/0xe0
      ...
      [   27.075356] Workqueue: ib_cm cm_work_handler [ib_cm]
      [   27.075401] task: ffff88022e3b8000 task.stack: ffffc90001298000
      [   27.075449] RIP: 0010:__radix_tree_lookup+0x1d/0xe0
      ...
      [   27.075979] Call Trace:
      [   27.076015]  radix_tree_lookup+0xd/0x10
      [   27.076055]  cma_ps_find+0x59/0x70 [rdma_cm]
      [   27.076097]  cma_id_from_event+0xd2/0x470 [rdma_cm]
      [   27.076144]  ? ib_init_ah_from_path+0x39a/0x590 [ib_core]
      [   27.076193]  cma_req_handler+0x25/0x480 [rdma_cm]
      [   27.076237]  cm_process_work+0x25/0x120 [ib_cm]
      [   27.076280]  ? cm_get_bth_pkey.isra.62+0x3c/0xa0 [ib_cm]
      [   27.076350]  cm_req_handler+0xb03/0xd40 [ib_cm]
      [   27.076430]  ? sched_clock_cpu+0x11/0xb0
      [   27.076478]  cm_work_handler+0x194/0x1588 [ib_cm]
      [   27.076525]  process_one_work+0x160/0x410
      [   27.076565]  worker_thread+0x137/0x4a0
      [   27.076614]  kthread+0x112/0x150
      [   27.076684]  ? max_active_store+0x60/0x60
      [   27.077642]  ? kthread_park+0x90/0x90
      [   27.078530]  ret_from_fork+0x2c/0x40
      
      This patch moves it back to the common SA Path Record structure
      and removes the redundant setter and getter.
      
      Tested on Connect-IB and Connect-X4 in Infiniband and RoCE respectively.
      
      Fixes: 9fdca4da (IB/SA: Split struct sa_path_rec based on IB ands
      	ROCE specific fields)
      Signed-off-by: NMajd Dibbiny <majd@mellanox.com>
      Reviewed-by: NParav Pandit <parav@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leon@kernel.org>
      Signed-off-by: NDoug Ledford <dledford@redhat.com>
      d3957b86
  23. 02 5月, 2017 10 次提交
  24. 29 4月, 2017 1 次提交