Commit 54654e14 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma 

Pull rdma fixes from Jason Gunthorpe:
 "Not too much going on here, though there are about four fixes related
  to stuff merged during the last merge window.

  We also see the return of a syzkaller instance with access to RDMA
  devices, and a few bugs detected by that squished.

   - Fix three crashers and a memory memory leak for HFI1

   - Several bugs found by syzkaller

   - A bug fix for the recent QP counters feature on older mlx5 HW

   - Locking inversion in cxgb4

   - Unnecessary WARN_ON in siw

   - A umad crasher regression during unload, from a bug fix for
     something else

   - Bugs introduced in the merge window:
       - Missed list_del in uverbs file rework, core and mlx5 devx
       - Unexpected integer math truncation in the mlx5 VAR patches
       - Compilation bug fix for the VAR patches on 32 bit"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  IB/mlx5: Use div64_u64 for num_var_hw_entries calculation
  RDMA/core: Fix protection fault in get_pkey_idx_qp_list
  RDMA/rxe: Fix soft lockup problem due to using tasklets in softirq
  RDMA/mlx5: Prevent overflow in mmap offset calculations
  IB/umad: Fix kernel crash while unloading ib_umad
  RDMA/mlx5: Fix async events cleanup flows
  RDMA/core: Add missing list deletion on freeing event queue
  RDMA/siw: Remove unwanted WARN_ON in siw_cm_llp_data_ready()
  RDMA/iw_cxgb4: initiate CLOSE when entering TERM
  IB/mlx5: Return failure when rts2rts_qp_counters_set_id is not supported
  RDMA/core: Fix invalid memory access in spec_filter_size
  IB/rdmavt: Reset all QPs when the device is shut down
  IB/hfi1: Close window for pq and request coliding
  IB/hfi1: Acquire lock to release TID entries when user file is closed
  RDMA/hfi1: Fix memory leak in _dev_comp_vect_mappings_create
parents b719ae07 685eff51

drivers/infiniband/core/security.c

+9 −15
Original line number Diff line number Diff line
@@ -339,22 +339,16 @@ static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp, 
	if (!new_pps)

		return NULL;



	if (qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) {

		if (!qp_pps) {

			new_pps->main.port_num = qp_attr->port_num;

			new_pps->main.pkey_index = qp_attr->pkey_index;

		} else {

			new_pps->main.port_num = (qp_attr_mask & IB_QP_PORT) ?

						  qp_attr->port_num :

						  qp_pps->main.port_num;



			new_pps->main.pkey_index =

					(qp_attr_mask & IB_QP_PKEY_INDEX) ?

					 qp_attr->pkey_index :

					 qp_pps->main.pkey_index;

		}

	if (qp_attr_mask & IB_QP_PORT)

		new_pps->main.port_num =

			(qp_pps) ? qp_pps->main.port_num : qp_attr->port_num;

	if (qp_attr_mask & IB_QP_PKEY_INDEX)

		new_pps->main.pkey_index = (qp_pps) ? qp_pps->main.pkey_index :

						      qp_attr->pkey_index;

	if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT))

		new_pps->main.state = IB_PORT_PKEY_VALID;

	} else if (qp_pps) {



	if (!(qp_attr_mask & (IB_QP_PKEY_INDEX || IB_QP_PORT)) && qp_pps) {

		new_pps->main.port_num = qp_pps->main.port_num;

		new_pps->main.pkey_index = qp_pps->main.pkey_index;

		if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID)

drivers/infiniband/core/user_mad.c

+3 −2
Original line number Diff line number Diff line
@@ -1312,6 +1312,9 @@ static void ib_umad_kill_port(struct ib_umad_port *port) 
	struct ib_umad_file *file;

	int id;



	cdev_device_del(&port->sm_cdev, &port->sm_dev);

	cdev_device_del(&port->cdev, &port->dev);



	mutex_lock(&port->file_mutex);



	/* Mark ib_dev NULL and block ioctl or other file ops to progress
@@ -1331,8 +1334,6 @@ static void ib_umad_kill_port(struct ib_umad_port *port) 


	mutex_unlock(&port->file_mutex);



	cdev_device_del(&port->sm_cdev, &port->sm_dev);

	cdev_device_del(&port->cdev, &port->dev);

	ida_free(&umad_ida, port->dev_num);



	/* balances device_initialize() */

drivers/infiniband/core/uverbs_cmd.c

+7 −8
Original line number Diff line number Diff line
@@ -2745,12 +2745,6 @@ static int kern_spec_to_ib_spec_action(struct uverbs_attr_bundle *attrs, 
	return 0;

}



static size_t kern_spec_filter_sz(const struct ib_uverbs_flow_spec_hdr *spec)

{

	/* Returns user space filter size, includes padding */

	return (spec->size - sizeof(struct ib_uverbs_flow_spec_hdr)) / 2;

}



static ssize_t spec_filter_size(const void *kern_spec_filter, u16 kern_filter_size,

				u16 ib_real_filter_sz)

{
@@ -2894,11 +2888,16 @@ int ib_uverbs_kern_spec_to_ib_spec_filter(enum ib_flow_spec_type type, 
static int kern_spec_to_ib_spec_filter(struct ib_uverbs_flow_spec *kern_spec,

				       union ib_flow_spec *ib_spec)

{

	ssize_t kern_filter_sz;

	size_t kern_filter_sz;

	void *kern_spec_mask;

	void *kern_spec_val;



	kern_filter_sz = kern_spec_filter_sz(&kern_spec->hdr);

	if (check_sub_overflow((size_t)kern_spec->hdr.size,

			       sizeof(struct ib_uverbs_flow_spec_hdr),

			       &kern_filter_sz))

		return -EINVAL;



	kern_filter_sz /= 2;



	kern_spec_val = (void *)kern_spec +

		sizeof(struct ib_uverbs_flow_spec_hdr);

drivers/infiniband/core/uverbs_std_types.c

+1 −0
Original line number Diff line number Diff line
@@ -220,6 +220,7 @@ void ib_uverbs_free_event_queue(struct ib_uverbs_event_queue *event_queue) 
	list_for_each_entry_safe(entry, tmp, &event_queue->event_list, list) {

		if (entry->counter)

			list_del(&entry->obj_list);

		list_del(&entry->list);

		kfree(entry);

	}

	spin_unlock_irq(&event_queue->lock);

drivers/infiniband/hw/cxgb4/cm.c

+4 −0
Original line number Diff line number Diff line
@@ -3036,6 +3036,10 @@ static int terminate(struct c4iw_dev *dev, struct sk_buff *skb) 
				       C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);

		}



		/* As per draft-hilland-iwarp-verbs-v1.0, sec 6.2.3,

		 * when entering the TERM state the RNIC MUST initiate a CLOSE.

		 */

		c4iw_ep_disconnect(ep, 1, GFP_KERNEL);

		c4iw_put_ep(&ep->com);

	} else

		pr_warn("TERM received tid %u no ep/qp\n", tid);

CRA Git | Maintained and supported by SUSTech CRA and CCSE