linux-toradex.git/net/rds/rdma.c, branch v3.3.4

rds: Integer overflow in RDS cmsg handling

2010-11-17T20:20:52+00:00

In rds_cmsg_rdma_args(), the user-provided args->nr_local value is
restricted to less than UINT_MAX.  This seems to need a tighter upper
bound, since the calculation of total iov_size can overflow, resulting
in a small sock_kmalloc() allocation.  This would probably just result
in walking off the heap and crashing when calling rds_rdma_pages() with
a high count value.  If it somehow doesn't crash here, then memory
corruption could occur soon after.

Signed-off-by: Dan Rosenberg 
Signed-off-by: David S. Miller

RDS: Let rds_message_alloc_sgs() return NULL

2010-10-30T23:34:18+00:00

Even with the previous fix, we still are reading the iovecs once
to determine SGs needed, and then again later on. Preallocating
space for sg lists as part of rds_message seemed like a good idea
but it might be better to not do this. While working to redo that
code, this patch attempts to protect against userspace rewriting
the rds_iovec array between the first and second accesses.

The consequences of this would be either a too-small or too-large
sg list array. Too large is not an issue. This patch changes all
callers of message_alloc_sgs to handle running out of preallocated
sgs, and fail gracefully.

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

RDS: Copy rds_iovecs into kernel memory instead of rereading from userspace

2010-10-30T23:34:17+00:00

Change rds_rdma_pages to take a passed-in rds_iovec array instead
of doing copy_from_user itself.

Change rds_cmsg_rdma_args to copy rds_iovec array once only. This
eliminates the possibility of userspace changing it after our
sanity checks.

Implement stack-based storage for small numbers of iovecs, based
on net/socket.c, to save an alloc in the extremely common case.

Although this patch reduces iovec copies in cmsg_rdma_args to 1,
we still do another one in rds_rdma_extra_size. Getting rid of
that one will be trickier, so it'll be a separate patch.

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

RDS: Clean up error handling in rds_cmsg_rdma_args

2010-10-30T23:34:17+00:00

We don't need to set ret = 0 at the end -- it's initialized to 0.

Also, don't increment s_send_rdma stat if we're exiting with an
error.

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

RDS: Return -EINVAL if rds_rdma_pages returns an error

2010-10-30T23:34:16+00:00

rds_cmsg_rdma_args would still return success even if rds_rdma_pages
returned an error (or overflowed).

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

net: fix rds_iovec page count overflow

2010-10-30T23:34:16+00:00

As reported by Thomas Pollet, the rdma page counting can overflow.  We
get the rdma sizes in 64-bit unsigned entities, but then limit it to
UINT_MAX bytes and shift them down to pages (so with a possible "+1" for
an unaligned address).

So each individual page count fits comfortably in an 'unsigned int' (not
even close to overflowing into signed), but as they are added up, they
might end up resulting in a signed return value. Which would be wrong.

Catch the case of tot_pages turning negative, and return the appropriate
error code.

Reported-by: Thomas Pollet 
Signed-off-by: Linus Torvalds 
Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

rds: signedness bug

2010-09-19T18:59:43+00:00

In the original code if the copy_from_user() fails in rds_rdma_pages()
then the error handling fails and we get a stack trace from kmalloc().

Signed-off-by: Dan Carpenter 
Signed-off-by: David S. Miller

RDS: Implement masked atomic operations

2010-09-09T01:16:51+00:00

Add two CMSGs for masked versions of cswp and fadd. args
struct modified to use a union for different atomic op type's
arguments. Change IB to do masked atomic ops. Atomic op type
in rds_message similarly unionized.

Signed-off-by: Andy Grover

RDS: Add flag for silent ops. Do atomic op before RDMA

2010-09-09T01:12:06+00:00

Add a flag to the API so users can indicate they want
silent operations. This is needed because silent ops
cannot be used with USE_ONCE MRs, so we can't just
assume silent.

Also, change send_xmit to do atomic op before rdma op if
both are present, and centralize the hairy logic to determine if
we want to attempt silent, or not.

Signed-off-by: Andy Grover

RDS: Move some variables around for consistency

2010-09-09T01:12:05+00:00

Also, add a comment.

Signed-off-by: Andy Grover