Unverified Commit 30472c94 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14951 Mainline patch to olk-6.6 

Merge Pull Request from: @ci-robot 
 
PR sync from: Junxian Huang <huangjunxian6@hisilicon.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/V2GQQ5QFV5NWJR6APU4KYD2CD5BUNZY6/ 
From: Xinghai Cen <cenxinghai@h-partners.com>

Mainline patch to olk-6.6:

Chengchang Tang (1):
  RDMA/hns: Fix UAF for cq async event

Junxian Huang (1):
  RDMA/hns: Check atomic wr length

Xinghai Cen (3):
  Revert "RDMA/hns: Check atomic wr length"
  Revert "RDMA/hns: Fix a missing check of atomic wr length"
  Revert "RDMA/hns: Fix UAF for cq async event"


-- 
2.33.0
 
https://gitee.com/openeuler/kernel/issues/IBJ9LU 
 
Link:https://gitee.com/openeuler/kernel/pulls/14951

 

Reviewed-by: default avatarChengchang Tang <tangchengchang@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 1a4b1223 6fb7ba54

drivers/infiniband/hw/hns/hns_roce_cq.c

+0 −1
Original line number Diff line number Diff line
@@ -239,7 +239,6 @@ static void free_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) 
				    ret, hr_cq->cqn);

	}



	xa_erase(&cq_table->array, hr_cq->cqn);

	xa_erase_irq(&cq_table->array, hr_cq->cqn);



	/* Waiting interrupt process procedure carried out */

drivers/infiniband/hw/hns/hns_roce_hw_v2.c

+5 −14
Original line number Diff line number Diff line
@@ -167,22 +167,15 @@ static void set_frmr_seg(struct hns_roce_v2_rc_send_wqe *rc_sq_wqe, 
	hr_reg_clear(fseg, FRMR_BLK_MODE);

}



static int set_atomic_seg(struct hns_roce_dev *hr_dev,

			  const struct ib_send_wr *wr,

static void set_atomic_seg(const struct ib_send_wr *wr,

			   struct hns_roce_v2_rc_send_wqe *rc_sq_wqe,

			  unsigned int valid_num_sge, u32 msg_len)

			   unsigned int valid_num_sge)

{

	struct hns_roce_v2_wqe_data_seg *dseg =

		(void *)rc_sq_wqe + sizeof(struct hns_roce_v2_rc_send_wqe);

	struct hns_roce_wqe_atomic_seg *aseg =

		(void *)dseg + sizeof(struct hns_roce_v2_wqe_data_seg);



	if (msg_len != ATOMIC_WR_LEN) {

		ibdev_err(&hr_dev->ib_dev, "invalid atomic wr len, len = %u.\n",

			  msg_len);

		return -EINVAL;

	}



	set_data_seg_v2(dseg, wr->sg_list);



	if (wr->opcode == IB_WR_ATOMIC_CMP_AND_SWP) {
@@ -195,8 +188,6 @@ static int set_atomic_seg(struct hns_roce_dev *hr_dev, 
	}



	hr_reg_write(rc_sq_wqe, RC_SEND_WQE_SGE_NUM, valid_num_sge);



	return 0;

}



static int fill_ext_sge_inl_data(struct hns_roce_qp *qp,
@@ -686,14 +677,14 @@ static inline int set_rc_wqe(struct hns_roce_qp *qp, 
	    wr->opcode == IB_WR_ATOMIC_FETCH_AND_ADD) {

		if (msg_len != ATOMIC_WR_LEN)

			return -EINVAL;

		ret = set_atomic_seg(hr_dev, wr, rc_sq_wqe, valid_num_sge,

				     msg_len);

		set_atomic_seg(wr, rc_sq_wqe, valid_num_sge);

	} else if (wr->opcode != IB_WR_REG_MR) {

		ret = set_rwqe_data_seg(&qp->ibqp, wr, rc_sq_wqe,

					&curr_idx, valid_num_sge);

		if (ret)

			return ret;

	}



	if (qp->en_flags & HNS_ROCE_QP_CAP_DYNAMIC_CTX_ATTACH)

		fill_dca_fields(qp, rc_sq_wqe);