linux-toradex.git/net/rds/rdma.c, branch v4.10-rc1

RDS: use rb_entry()

2016-12-20T19:22:49+00:00

To make the code clearer, use rb_entry() instead of container_of() to
deal with rbtree.

Signed-off-by: Geliang Tang 
Reviewed-by: Leon Romanovsky 
Acked-by: Santosh Shilimkar 
Signed-off-by: David S. Miller

RDS: Fix rds MR reference count in rds_rdma_unuse()

2015-08-25T23:28:10+00:00

rds_rdma_unuse() drops the mr reference count which it hasn't
taken. Correct way of removing mr is to remove mr from the tree
and then rdma_destroy_mr() it first, then rds_mr_put() to decrement
its reference count. Whichever thread holds last reference will free
the mr via rds_mr_put()

This bug was triggering weird null pointer crashes. One if the trace
for it is captured below.

BUG: unable to handle kernel NULL pointer dereference at
0000000000000104
IP: [] rds_ib_free_mr+0x31/0x130 [rds_rdma]
PGD 4366fa067 PUD 4366f9067 PMD 0
Oops: 0000 [#1] SMP

[...]

task: ffff88046da6a000 ti: ffff88046da6c000 task.ti: ffff88046da6c000
RIP: 0010:[]  []
rds_ib_free_mr+0x31/0x130 [rds_rdma]
RSP: 0018:ffff88046fa43bd8  EFLAGS: 00010286
RAX: 0000000071d38b80 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff880079e7ff40
RBP: ffff88046fa43bf8 R08: 0000000000000000 R09: 0000000000000000
R10: ffff88046fa43ca8 R11: ffff88046a802ed8 R12: ffff880079e7fa40
R13: 0000000000000000 R14: ffff880079e7ff40 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88046fa40000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000104 CR3: 00000004366fb000 CR4: 00000000000006e0
Stack:
 ffff880079e7fa40 ffff880671d38f08 ffff880079e7ff40 0000000000000296
 ffff88046fa43c28 ffffffffa087a38b ffff880079e7fa40 ffff880671d38f10
 0000000000000000 0000000000000292 ffff88046fa43c48 ffffffffa087a3b6
Call Trace:
 
 [] rds_destroy_mr+0x8b/0xa0 [rds]
 [] __rds_put_mr_final+0x16/0x30 [rds]
 [] rds_rdma_unuse+0xc2/0x120 [rds]
 [] rds_recv_incoming_exthdrs+0x83/0xa0 [rds]
 [] rds_recv_incoming+0x92/0x200 [rds]
 [] rds_ib_process_recv+0x259/0x320 [rds_rdma]
 [] rds_ib_recv_tasklet_fn+0x1a8/0x490 [rds_rdma]
 [] ? __remove_hrtimer+0x58/0x90
 [] tasklet_action+0xb1/0xc0
 [] __do_softirq+0xe2/0x290
 [] irq_exit+0xa6/0xb0
 [] do_IRQ+0x65/0xf0
 [] common_interrupt+0x6b/0x6b

Signed-off-by: Santosh Shilimkar 
Signed-off-by: Santosh Shilimkar 
Signed-off-by: David S. Miller

RDS: Fix assertion level from fatal to warning

2015-08-25T20:35:31+00:00

Fix the asserion level since its not fatal and can be hit
in normal execution paths. There is no need to take the
system down.

We keep the WARN_ON() to detect the condition if we get
here with bad pages.

Reviewed-by: Ajaykumar Hotchandani 
Signed-off-by: Santosh Shilimkar 
Signed-off-by: Santosh Shilimkar 
Signed-off-by: David S. Miller

RDS: restore return value in rds_cmsg_rdma_args()

2015-08-25T20:35:29+00:00

In rds_cmsg_rdma_args() 'ret' is used by rds_pin_pages() which returns
number of pinned pages on success. And the same value is returned to the
caller of rds_cmsg_rdma_args() on success which is not intended.

Commit f4a3fc03c1d7 ("RDS: Clean up error handling in rds_cmsg_rdma_args")
removed the 'ret = 0' line which broke RDS RDMA mode.

Fix it by restoring the return value on rds_pin_pages() success
keeping the clean-up in place.

Signed-off-by: Santosh Shilimkar 
Signed-off-by: Santosh Shilimkar 
Signed-off-by: David S. Miller

rds: avoid calling sock_kfree_s() on allocation failure

2014-10-14T21:00:19+00:00

It is okay to free a NULL pointer but not okay to mischarge the socket optmem
accounting. Compile test only.

Reported-by: rucsoftsec@gmail.com
Cc: Chien Yen 
Cc: Stephen Hemminger 
Signed-off-by: Cong Wang 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

rds: Integer overflow in RDS cmsg handling

2010-11-17T20:20:52+00:00

In rds_cmsg_rdma_args(), the user-provided args->nr_local value is
restricted to less than UINT_MAX.  This seems to need a tighter upper
bound, since the calculation of total iov_size can overflow, resulting
in a small sock_kmalloc() allocation.  This would probably just result
in walking off the heap and crashing when calling rds_rdma_pages() with
a high count value.  If it somehow doesn't crash here, then memory
corruption could occur soon after.

Signed-off-by: Dan Rosenberg 
Signed-off-by: David S. Miller

RDS: Let rds_message_alloc_sgs() return NULL

2010-10-30T23:34:18+00:00

Even with the previous fix, we still are reading the iovecs once
to determine SGs needed, and then again later on. Preallocating
space for sg lists as part of rds_message seemed like a good idea
but it might be better to not do this. While working to redo that
code, this patch attempts to protect against userspace rewriting
the rds_iovec array between the first and second accesses.

The consequences of this would be either a too-small or too-large
sg list array. Too large is not an issue. This patch changes all
callers of message_alloc_sgs to handle running out of preallocated
sgs, and fail gracefully.

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

RDS: Copy rds_iovecs into kernel memory instead of rereading from userspace

2010-10-30T23:34:17+00:00

Change rds_rdma_pages to take a passed-in rds_iovec array instead
of doing copy_from_user itself.

Change rds_cmsg_rdma_args to copy rds_iovec array once only. This
eliminates the possibility of userspace changing it after our
sanity checks.

Implement stack-based storage for small numbers of iovecs, based
on net/socket.c, to save an alloc in the extremely common case.

Although this patch reduces iovec copies in cmsg_rdma_args to 1,
we still do another one in rds_rdma_extra_size. Getting rid of
that one will be trickier, so it'll be a separate patch.

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

RDS: Clean up error handling in rds_cmsg_rdma_args

2010-10-30T23:34:17+00:00

We don't need to set ret = 0 at the end -- it's initialized to 0.

Also, don't increment s_send_rdma stat if we're exiting with an
error.

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

RDS: Return -EINVAL if rds_rdma_pages returns an error

2010-10-30T23:34:16+00:00

rds_cmsg_rdma_args would still return success even if rds_rdma_pages
returned an error (or overflowed).

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller