linux-toradex.git/drivers/infiniband/core/security.c, branch v5.0

RDMA: Start use ib_device_ops

2018-12-12T14:40:16+00:00

Make all the required change to start use the ib_device_ops structure.

Signed-off-by: Kamal Heib 
Signed-off-by: Jason Gunthorpe

RDMA/core: Use dev_name instead of ibdev->name

2018-09-26T19:51:48+00:00

These return the same thing but dev_name is a more conventional use of the
kernel API.

Signed-off-by: Jason Gunthorpe 
Reviewed-by: Steve Wise 
Reviewed-by: Leon Romanovsky 
Reviewed-by: Dennis Dalessandro

IB/core: Use CONFIG_SECURITY_INFINIBAND to compile out security code

2018-05-01T15:16:36+00:00

Make security.c depends on CONFIG_SECURITY_INFINIBAND.

Reviewed-by: Daniel Jurgens 
Signed-off-by: Parav Pandit 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

Merge branch 'from-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git

2017-12-28T04:50:46+00:00

Patches for 4.16 that are dependent on patches sent to 4.15-rc.

These are small clean ups for the vmw_pvrdma and i40iw drivers.

* 'from-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git:
  RDMA/vmw_pvrdma: Remove usage of BIT() from UAPI header
  RDMA/vmw_pvrdma: Use refcount_t instead of atomic_t
  RDMA/vmw_pvrdma: Use more specific sizeof in kcalloc
  RDMA/vmw_pvrdma: Clarify QP and CQ is_kernel logic
  RDMA/vmw_pvrdma: Add UAR SRQ macros in ABI header file
  i40iw: Change accelerated flag to bool

IB/core: Verify that QP is security enabled in create and destroy

2017-12-27T22:24:41+00:00

The XRC target QP create flow sets up qp_sec only if there is an IB link with
LSM security enabled. However, several other related uAPI entry points blindly
follow the qp_sec NULL pointer, resulting in a possible oops.

Check for NULL before using qp_sec.

Cc:  # v4.12
Fixes: d291f1a65232 ("IB/core: Enforce PKey security on QPs")
Reviewed-by: Daniel Jurgens 
Signed-off-by: Moni Shoua 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Jason Gunthorpe

IB/core: Avoid exporting module internal function

2017-12-18T20:49:43+00:00

ib_security_modify_qp and ib_security_pkey_access are core internal
function. So avoid exporting them.
ib_security_pkey_access is used only when secuirty hooks are enabled so
avoid defining it otherwise.

Signed-off-by: Parav Pandit 
Reviewed-by: Daniel Jurgens 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Jason Gunthorpe

IB/core: Don't enforce PKey security on SMI MADs

2017-12-07T20:28:06+00:00

Per the infiniband spec an SMI MAD can have any PKey. Checking the pkey
on SMI MADs is not necessary, and it seems that some older adapters
using the mthca driver don't follow the convention of using the default
PKey, resulting in false denials, or errors querying the PKey cache.

SMI MAD security is still enforced, only agents allowed to manage the
subnet are able to receive or send SMI MADs.

Reported-by: Chris Blake 
Cc:  # v4.12
Fixes: 47a2b338fe63 ("IB/core: Enforce security on management datagrams")
Signed-off-by: Daniel Jurgens 
Reviewed-by: Parav Pandit 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

IB/core: Only enforce security for InfiniBand

2017-12-01T19:21:28+00:00

For now the only LSM security enforcement mechanism available is
specific to InfiniBand. Bypass enforcement for non-IB link types.

This fixes a regression where modify_qp fails for iWARP because
querying the PKEY returns -EINVAL.

Cc: Paul Moore 
Cc: Don Dutile 
Cc: stable@vger.kernel.org
Reported-by: Potnuri Bharat Teja 
Fixes: d291f1a65232("IB/core: Enforce PKey security on QPs")
Fixes: 47a2b338fe63("IB/core: Enforce security on management datagrams")
Signed-off-by: Daniel Jurgens 
Reviewed-by: Parav Pandit 
Tested-by: Potnuri Bharat Teja 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Jason Gunthorpe

IB/core: Only maintain real QPs in the security lists

2017-11-13T21:24:17+00:00

When modify QP is called on a shared QP update the security context for
the real QP. When security is subsequently enforced the shared QP
handles will be checked as well.

Without this change shared QP handles get added to the port/pkey lists,
which is a bug, because not all shared QP handles will be checked for
access. Also the shared QP security context wouldn't get removed from
the port/pkey lists causing access to free memory and list corruption
when they are destroyed.

Cc: stable@vger.kernel.org
Fixes: d291f1a65232 ("IB/core: Enforce PKey security on QPs")
Signed-off-by: Daniel Jurgens 
Reviewed-by: Parav Pandit 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

IB/core: Avoid unnecessary return value check

2017-11-13T19:42:04+00:00

Since there is nothing done with non zero return value, such check is
avoided.

Signed-off-by: Parav Pandit 
Reviewed-by: Daniel Jurgens 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford