linux-toradex.git/drivers/infiniband/sw, branch v4.10

IB/rxe: Fix mem_check_range integer overflow

2017-02-08T17:28:30+00:00

Update the range check to avoid integer-overflow in edge case.
Resolves CVE 2016-8636.

Signed-off-by: Eyal Itkin 
Signed-off-by: Dan Carpenter 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

IB/rxe: Fix resid update

2017-02-08T17:28:30+00:00

Update the response's resid field when larger than MTU, instead of only
updating the local resid variable.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Eyal Itkin 
Signed-off-by: Dan Carpenter 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

IB/rxe: Prevent from completer to operate on non valid QP

2017-01-24T21:17:32+00:00

On UD QP completer tasklet is scheduled for each packet sent.

If it is followed by a destroy_qp(), the kernel panic will
happen as the completer tries to operate on a destroyed QP.

Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Yonatan Cohen 
Reviewed-by: Moni Shoua 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

IB/rxe: Fix rxe dev insertion to rxe_dev_list

2017-01-24T21:17:25+00:00

The first argument of list_add_tail is the new item and the second
is the head of the list. Fix the code to pass arguments in the
right order, otherwise not all the rxe devices will be removed
during teardown.

Fixes: 8700e3e7c4857 ('Soft RoCE driver')
Signed-off-by: Maor Gottlieb 
Reviewed-by: Moni Shoua 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma

2016-12-23T18:38:48+00:00

Pull rdma fixes from Doug Ledford:
 "First round of -rc fixes for 4.10 kernel:

   - a series of qedr fixes
   - a series of rxe fixes
   - one i40iw fix
   - one cma fix
   - one cxgb4 fix"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
  IB/rxe: Don't check for null ptr in send()
  IB/rxe: Drop future atomic/read packets rather than retrying
  IB/rxe: Use BTH_PSN_MASK when ACKing duplicate sends
  qedr: Always notify the verb consumer of flushed CQEs
  qedr: clear the vendor error field in the work completion
  qedr: post_send/recv according to QP state
  qedr: ignore inline flag in read verbs
  qedr: modify QP state to error when destroying it
  qedr: return correct value on modify qp
  qedr: return error if destroy CQ failed
  qedr: configure the number of CQEs on CQ creation
  i40iw: Set 128B as the only supported RQ WQE size
  IB/cma: Fix a race condition in iboe_addr_get_sgid()
  IB/rxe: Fix a memory leak in rxe_qp_cleanup()
  iw_cxgb4: set correct FetchBurstMax for QPs

IB/rxe: Don't check for null ptr in send()

2016-12-22T16:36:12+00:00

pkt->qp was already dereferenced earlier in the function.

Fixes Smatch complaint:
drivers/infiniband/sw/rxe/rxe_net.c:458 send()
	 warn: variable dereferenced before check 'pkt->qp' (see line 441)

Signed-off-by: Andrew Boyer 
Signed-off-by: Doug Ledford

IB/rxe: Drop future atomic/read packets rather than retrying

2016-12-22T16:36:12+00:00

If the completer is in the middle of a large read operation, one
lost packet can cause havoc. Going to COMPST_ERROR_RETRY will
cause the requester to resend the request. After that, any packet
from the first attempt still in the receive queue will be
interpreted as an error, restarting the error/retry sequence.
The transfer will quickly exhaust its retries.

This behavior is very noticeable when doing 512KB reads on a
QEMU system configured with 1500B MTU.

Also, a resent request here will prompt the responder on the
other side to immediately start resending, but the resent
packets will get stuck in the already-loaded receive queue and
will never be processed.

Rather than erroring out every time an unexpected future packet
arrives, just drop it. Eventually the retry timer will send a
duplicate request; the completer will be able to make progress since
the queue will start relatively empty.

Signed-off-by: Andrew Boyer 
Signed-off-by: Doug Ledford

IB/rxe: Use BTH_PSN_MASK when ACKing duplicate sends

2016-12-22T16:36:12+00:00

Signed-off-by: Andrew Boyer 
Signed-off-by: Doug Ledford

IB/rxe: Fix a memory leak in rxe_qp_cleanup()

2016-12-18T18:35:19+00:00

A socket is associated with every QP by the rxe driver but sock_release()
is never called. Add a call to sock_release() in rxe_qp_cleanup().

Fixes: commit 8700e3e7c48A5 ("Add Soft RoCE driver")
Signed-off-by: Bart Van Assche 
Cc: Moni Shoua 
Cc: Kamal Heib 
Cc: Amir Vadai 
Cc: Haggai Eran 
Cc: 
Reviewed-by: Moni Shoua 
Signed-off-by: Doug Ledford

rdma: fix buggy code that the compiler warns about

2016-12-15T20:18:42+00:00

Get rid of this warning:

  drivers/infiniband/sw/rdmavt/cq.c: In function ‘rvt_cq_exit’:
  drivers/infiniband/sw/rdmavt/cq.c:542:2: warning: ‘worker’ may be used uninitialized in this function [-Wmaybe-uninitialized]
    kthread_destroy_worker(worker);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

by fixing the function to actually work.

Fixes: 6efaf10f163d ("IB/rdmavt: Avoid queuing work into a destroyed cq kthread worker")
Cc: Petr Mladek 
Cc: Doug Ledford 
Signed-off-by: Linus Torvalds