linux-toradex.git/drivers/infiniband/core, branch v4.4.73

infiniband: call ipv6 route lookup via the stub interface

2017-05-25T12:30:07+00:00

commit eea40b8f624f25cbc02d55f2d93203f60cee9341 upstream.

The infiniband address handle can be triggered to resolve an ipv6
address in response to MAD packets, regardless of the ipv6
module being disabled via the kernel command line argument.

That will cause a call into the ipv6 routing code, which is not
initialized, and a conseguent oops.

This commit addresses the above issue replacing the direct lookup
call with an indirect one via the ipv6 stub, which is properly
initialized according to the ipv6 status (e.g. if ipv6 is
disabled, the routing lookup fails gracefully)

Signed-off-by: Paolo Abeni 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/core: Fix sysfs registration error flow

2017-05-20T12:27:00+00:00

commit b312be3d87e4c80872cbea869e569175c5eb0f9a upstream.

The kernel commit cited below restructured ib device management
so that the device kobject is initialized in ib_alloc_device.

As part of the restructuring, the kobject is now initialized in
procedure ib_alloc_device, and is later added to the device hierarchy
in the ib_register_device call stack, in procedure
ib_device_register_sysfs (which calls device_add).

However, in the ib_device_register_sysfs error flow, if an error
occurs following the call to device_add, the cleanup procedure
device_unregister is called. This call results in the device object
being deleted -- which results in various use-after-free crashes.

The correct cleanup call is device_del -- which undoes device_add
without deleting the device object.

The device object will then (correctly) be deleted in the
ib_register_device caller's error cleanup flow, when the caller invokes
ib_dealloc_device.

Fixes: 55aeed06544f6 ("IB/core: Make ib_alloc_device init the kobject")
Signed-off-by: Jack Morgenstein 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

rdma_cm: fail iwarp accepts w/o connection params

2017-03-12T05:37:29+00:00

commit f2625f7db4dd0bbd16a9c7d2950e7621f9aa57ad upstream.

cma_accept_iw() needs to return an error if conn_params is NULL.
Since this is coming from user space, we can crash.

Reported-by: Shaobo He 
Acked-by: Sean Hefty 
Signed-off-by: Steve Wise 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/umem: Release pid in error and ODP flow

2017-02-01T07:30:53+00:00

commit 828f6fa65ce7e80f77f5ab12942e44eb3d9d174e upstream.

1. Release pid before enter odp flow
2. Release pid when fail to allocate memory

Fixes: 87773dd56d54 ("IB: ib_umem_release() should decrement mm->pinned_vm from ib_umem_get")
Fixes: 8ada2c1c0c1d ("IB/core: Add support for on demand paging regions")
Signed-off-by: Kenneth Lee 
Reviewed-by: Haggai Eran 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

RDMA/cma: Fix unknown symbol when CONFIG_IPV6 is not enabled

2017-02-01T07:30:52+00:00

commit b4cfe3971f6eab542dd7ecc398bfa1aeec889934 upstream.

If IPV6 has not been enabled in the underlying kernel, we must avoid
calling IPV6 procedures in rdma_cm.ko.

This requires using "IS_ENABLED(CONFIG_IPV6)" in "if" statements
surrounding any code which calls external IPV6 procedures.

In the instance fixed here, procedure cma_bind_addr() called
ipv6_addr_type() -- which resulted in calling external procedure
__ipv6_addr_type().

Fixes: 6c26a77124ff ("RDMA/cma: fix IPv6 address resolution")
Cc: Spencer Baugh 
Signed-off-by: Jack Morgenstein 
Reviewed-by: Moni Shoua 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/multicast: Check ib_find_pkey() return value

2017-01-09T07:07:51+00:00

commit d3a2418ee36a59bc02e9d454723f3175dcf4bfd9 upstream.

This patch avoids that Coverity complains about not checking the
ib_find_pkey() return value.

Fixes: commit 547af76521b3 ("IB/multicast: Report errors on multicast groups if P_key changes")
Signed-off-by: Bart Van Assche 
Cc: Sean Hefty 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/mad: Fix an array index check

2017-01-09T07:07:50+00:00

commit 2fe2f378dd45847d2643638c07a7658822087836 upstream.

The array ib_mad_mgmt_class_table.method_table has MAX_MGMT_CLASS
(80) elements. Hence compare the array index with that value instead
of with IB_MGMT_MAX_METHODS (128). This patch avoids that Coverity
reports the following:

Overrunning array class->method_table of 80 8-byte elements at element index 127 (byte offset 1016) using index convert_mgmt_class(mad_hdr->mgmt_class) (which evaluates to 127).

Fixes: commit b7ab0b19a85f ("IB/mad: Verify mgmt class in received MADs")
Signed-off-by: Bart Van Assche 
Cc: Sean Hefty 
Reviewed-by: Hal Rosenstock 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/cm: Mark stale CM id's whenever the mad agent was unregistered

2016-11-26T08:54:54+00:00

commit 9db0ff53cb9b43ed75bacd42a89c1a0ab048b2b0 upstream.

When there is a CM id object that has port assigned to it, it means that
the cm-id asked for the specific port that it should go by it, but if
that port was removed (hot-unplug event) the cm-id was not updated.
In order to fix that the port keeps a list of all the cm-id's that are
planning to go by it, whenever the port is removed it marks all of them
as invalid.

This commit fixes a kernel panic which happens when running traffic between
guests and we force reboot a guest mid traffic, it triggers a kernel panic:

 Call Trace:
  [] ? panic+0xa7/0x16f
  [] ? oops_end+0xe4/0x100
  [] ? no_context+0xfb/0x260
  [] ? del_timer_sync+0x22/0x30
  [] ? __bad_area_nosemaphore+0x125/0x1e0
  [] ? process_timeout+0x0/0x10
  [] ? bad_area_nosemaphore+0x13/0x20
  [] ? __do_page_fault+0x31f/0x480
  [] ? default_wake_function+0x0/0x20
  [] ? free_msg+0x55/0x70 [mlx5_core]
  [] ? cmd_exec+0x124/0x840 [mlx5_core]
  [] ? find_busiest_group+0x244/0x9f0
  [] ? do_page_fault+0x3e/0xa0
  [] ? page_fault+0x25/0x30
  [] ? cm_alloc_msg+0x35/0xc0 [ib_cm]
  [] ? ib_send_cm_dreq+0xb1/0x1e0 [ib_cm]
  [] ? cm_destroy_id+0x176/0x320 [ib_cm]
  [] ? ib_destroy_cm_id+0x10/0x20 [ib_cm]
  [] ? ipoib_cm_free_rx_reap_list+0xa7/0x110 [ib_ipoib]
  [] ? ipoib_cm_rx_reap+0x0/0x20 [ib_ipoib]
  [] ? ipoib_cm_rx_reap+0x15/0x20 [ib_ipoib]
  [] ? worker_thread+0x170/0x2a0
  [] ? autoremove_wake_function+0x0/0x40
  [] ? worker_thread+0x0/0x2a0
  [] ? kthread+0x96/0xa0
  [] ? child_rip+0xa/0x20
  [] ? kthread+0x0/0xa0
  [] ? child_rip+0x0/0x20

Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation")
Signed-off-by: Mark Bloch 
Signed-off-by: Erez Shitrit 
Reviewed-by: Maor Gottlieb 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/uverbs: Fix leak of XRC target QPs

2016-11-26T08:54:54+00:00

commit 5b810a242c28e1d8d64d718cebe75b79d86a0b2d upstream.

The real QP is destroyed in case of the ref count reaches zero, but
for XRC target QPs this call was missed and caused to QP leaks.

Let's call to destroy for all flows.

Fixes: 0e0ec7e0638e ('RDMA/core: Export ib_open_qp() to share XRC...')
Signed-off-by: Tariq Toukan 
Signed-off-by: Noa Osherovich 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/core: Avoid unsigned int overflow in sg_alloc_table

2016-11-26T08:54:54+00:00

commit 3c7ba5760ab8eedec01159b267bb9bfcffe522ac upstream.

sg_alloc_table gets unsigned int as parameter while the driver
returns it as size_t. Check npages isn't greater than maximum
unsigned int.

Fixes: eeb8461e36c9 ("IB: Refactor umem to use linear SG table")
Signed-off-by: Mark Bloch 
Signed-off-by: Maor Gottlieb 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman