linux-toradex.git/net/rds/rdma.c, branch v4.8-rc2

RDS: Fix rds MR reference count in rds_rdma_unuse()

2015-08-25T23:28:10+00:00

rds_rdma_unuse() drops the mr reference count which it hasn't
taken. Correct way of removing mr is to remove mr from the tree
and then rdma_destroy_mr() it first, then rds_mr_put() to decrement
its reference count. Whichever thread holds last reference will free
the mr via rds_mr_put()

This bug was triggering weird null pointer crashes. One if the trace
for it is captured below.

BUG: unable to handle kernel NULL pointer dereference at
0000000000000104
IP: [] rds_ib_free_mr+0x31/0x130 [rds_rdma]
PGD 4366fa067 PUD 4366f9067 PMD 0
Oops: 0000 [#1] SMP

[...]

task: ffff88046da6a000 ti: ffff88046da6c000 task.ti: ffff88046da6c000
RIP: 0010:[]  []
rds_ib_free_mr+0x31/0x130 [rds_rdma]
RSP: 0018:ffff88046fa43bd8  EFLAGS: 00010286
RAX: 0000000071d38b80 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff880079e7ff40
RBP: ffff88046fa43bf8 R08: 0000000000000000 R09: 0000000000000000
R10: ffff88046fa43ca8 R11: ffff88046a802ed8 R12: ffff880079e7fa40
R13: 0000000000000000 R14: ffff880079e7ff40 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88046fa40000(0000)
knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000104 CR3: 00000004366fb000 CR4: 00000000000006e0
Stack:
 ffff880079e7fa40 ffff880671d38f08 ffff880079e7ff40 0000000000000296
 ffff88046fa43c28 ffffffffa087a38b ffff880079e7fa40 ffff880671d38f10
 0000000000000000 0000000000000292 ffff88046fa43c48 ffffffffa087a3b6
Call Trace:
 
 [] rds_destroy_mr+0x8b/0xa0 [rds]
 [] __rds_put_mr_final+0x16/0x30 [rds]
 [] rds_rdma_unuse+0xc2/0x120 [rds]
 [] rds_recv_incoming_exthdrs+0x83/0xa0 [rds]
 [] rds_recv_incoming+0x92/0x200 [rds]
 [] rds_ib_process_recv+0x259/0x320 [rds_rdma]
 [] rds_ib_recv_tasklet_fn+0x1a8/0x490 [rds_rdma]
 [] ? __remove_hrtimer+0x58/0x90
 [] tasklet_action+0xb1/0xc0
 [] __do_softirq+0xe2/0x290
 [] irq_exit+0xa6/0xb0
 [] do_IRQ+0x65/0xf0
 [] common_interrupt+0x6b/0x6b

Signed-off-by: Santosh Shilimkar 
Signed-off-by: Santosh Shilimkar 
Signed-off-by: David S. Miller

RDS: Fix assertion level from fatal to warning

2015-08-25T20:35:31+00:00

Fix the asserion level since its not fatal and can be hit
in normal execution paths. There is no need to take the
system down.

We keep the WARN_ON() to detect the condition if we get
here with bad pages.

Reviewed-by: Ajaykumar Hotchandani 
Signed-off-by: Santosh Shilimkar 
Signed-off-by: Santosh Shilimkar 
Signed-off-by: David S. Miller

RDS: restore return value in rds_cmsg_rdma_args()

2015-08-25T20:35:29+00:00

In rds_cmsg_rdma_args() 'ret' is used by rds_pin_pages() which returns
number of pinned pages on success. And the same value is returned to the
caller of rds_cmsg_rdma_args() on success which is not intended.

Commit f4a3fc03c1d7 ("RDS: Clean up error handling in rds_cmsg_rdma_args")
removed the 'ret = 0' line which broke RDS RDMA mode.

Fix it by restoring the return value on rds_pin_pages() success
keeping the clean-up in place.

Signed-off-by: Santosh Shilimkar 
Signed-off-by: Santosh Shilimkar 
Signed-off-by: David S. Miller

rds: avoid calling sock_kfree_s() on allocation failure

2014-10-14T21:00:19+00:00

It is okay to free a NULL pointer but not okay to mischarge the socket optmem
accounting. Compile test only.

Reported-by: rucsoftsec@gmail.com
Cc: Chien Yen 
Cc: Stephen Hemminger 
Signed-off-by: Cong Wang 
Signed-off-by: Cong Wang 
Signed-off-by: David S. Miller

rds: Integer overflow in RDS cmsg handling

2010-11-17T20:20:52+00:00

In rds_cmsg_rdma_args(), the user-provided args->nr_local value is
restricted to less than UINT_MAX.  This seems to need a tighter upper
bound, since the calculation of total iov_size can overflow, resulting
in a small sock_kmalloc() allocation.  This would probably just result
in walking off the heap and crashing when calling rds_rdma_pages() with
a high count value.  If it somehow doesn't crash here, then memory
corruption could occur soon after.

Signed-off-by: Dan Rosenberg 
Signed-off-by: David S. Miller

RDS: Let rds_message_alloc_sgs() return NULL

2010-10-30T23:34:18+00:00

Even with the previous fix, we still are reading the iovecs once
to determine SGs needed, and then again later on. Preallocating
space for sg lists as part of rds_message seemed like a good idea
but it might be better to not do this. While working to redo that
code, this patch attempts to protect against userspace rewriting
the rds_iovec array between the first and second accesses.

The consequences of this would be either a too-small or too-large
sg list array. Too large is not an issue. This patch changes all
callers of message_alloc_sgs to handle running out of preallocated
sgs, and fail gracefully.

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

RDS: Copy rds_iovecs into kernel memory instead of rereading from userspace

2010-10-30T23:34:17+00:00

Change rds_rdma_pages to take a passed-in rds_iovec array instead
of doing copy_from_user itself.

Change rds_cmsg_rdma_args to copy rds_iovec array once only. This
eliminates the possibility of userspace changing it after our
sanity checks.

Implement stack-based storage for small numbers of iovecs, based
on net/socket.c, to save an alloc in the extremely common case.

Although this patch reduces iovec copies in cmsg_rdma_args to 1,
we still do another one in rds_rdma_extra_size. Getting rid of
that one will be trickier, so it'll be a separate patch.

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

RDS: Clean up error handling in rds_cmsg_rdma_args

2010-10-30T23:34:17+00:00

We don't need to set ret = 0 at the end -- it's initialized to 0.

Also, don't increment s_send_rdma stat if we're exiting with an
error.

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

RDS: Return -EINVAL if rds_rdma_pages returns an error

2010-10-30T23:34:16+00:00

rds_cmsg_rdma_args would still return success even if rds_rdma_pages
returned an error (or overflowed).

Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller

net: fix rds_iovec page count overflow

2010-10-30T23:34:16+00:00

As reported by Thomas Pollet, the rdma page counting can overflow.  We
get the rdma sizes in 64-bit unsigned entities, but then limit it to
UINT_MAX bytes and shift them down to pages (so with a possible "+1" for
an unaligned address).

So each individual page count fits comfortably in an 'unsigned int' (not
even close to overflowing into signed), but as they are added up, they
might end up resulting in a signed return value. Which would be wrong.

Catch the case of tot_pages turning negative, and return the appropriate
error code.

Reported-by: Thomas Pollet 
Signed-off-by: Linus Torvalds 
Signed-off-by: Andy Grover 
Signed-off-by: David S. Miller