Commit 20d7e01c authored Mar 04, 2025 by Jason Gunthorpe Committed by Ye Bin Mar 04, 2025

RDMA/mlx5: Ensure created mkeys always have a populated rb_key

mainline inclusion
from mainline-v6.10-rc5
commit 2e4c02fdecf2f6f55cefe48cb82d93fa4f8e2204
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5V
CVE: CVE-2025-21732

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2e4c02fdecf2f6f55cefe48cb82d93fa4f8e2204



--------------------------------

cachable and mmkey.rb_key together are used by mlx5_revoke_mr() to put the
MR/mkey back into the cache. In all cases they should be set correctly.

alloc_cacheable_mr() was setting cachable but not filling rb_key,
resulting in cache_ent_find_and_store() bucketing them all into a 0 length
entry.

implicit_get_child_mr()/mlx5_ib_alloc_implicit_mr() failed to set cachable
or rb_key at all, so the cache was not working at all for implicit ODP.

Cc: stable@vger.kernel.org
Fixes: 8c1185fef68c ("RDMA/mlx5: Change check for cacheable mkeys")
Fixes: dd1b913f ("RDMA/mlx5: Cache all user cacheable mkeys on dereg MR flow")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/7778c02dfa0999a30d6746c79a23dd7140a9c729.1716900410.git.leon@kernel.org


Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Ye Bin <yebin10@huawei.com>

parent 8a60ed35

drivers/infiniband/hw/mlx5/mr.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -784,6 +784,8 @@ static struct mlx5_ib_mr _mlx5_mr_cache_alloc(struct mlx5_ib_dev dev,
		}
		mr->mmkey.cache_ent = ent;
		mr->mmkey.type = MLX5_MKEY_MR;
		mr->mmkey.rb_key = ent->rb_key;
		mr->mmkey.cacheable = true;
		init_waitqueue_head(&mr->mmkey.wait);
		return mr;
		}
		@@ -1203,7 +1205,6 @@ static struct mlx5_ib_mr alloc_cacheable_mr(struct ib_pd pd,
		mr->ibmr.pd = pd;
		mr->umem = umem;
		mr->page_shift = order_base_2(page_size);
		mr->mmkey.cacheable = true;
		set_mr_fields(dev, mr, umem->length, access_flags, iova);

		return mr;