Commit 8fea9f8f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma 

Pull rdma fixes from Jason Gunthorpe:
 "This includes a fix for a significant security miss in checking the
  RDMA_NLDEV_CMD_SYS_SET operation.

  Summary:

   - UAF in SRP

   - Error unwind failure in siw connection management

   - Missing error checks

   - NULL/ERR_PTR confusion in erdma

   - Possible string truncation in CMA configfs and mlx4

   - Data ordering issue in bnxt_re

   - Missing stats decrement on object destroy in bnxt_re

   - Mlx5 bugs in this merge window:
      * Incorrect access_flag in the new mkey cache
      * Missing unlock on error in flow steering
      * lockdep possible deadlock on new mkey cache destruction (Plus a
        fix for this too)

   - Don't leak kernel stack memory to userspace in the CM

   - Missing permission validation for RDMA_NLDEV_CMD_SYS_SET"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/core: Require admin capabilities to set system parameters
  RDMA/mlx5: Remove not-used cache disable flag
  RDMA/cma: Initialize ib_sa_multicast structure to 0 when join
  RDMA/mlx5: Fix mkey cache possible deadlock on cleanup
  RDMA/mlx5: Fix NULL string error
  RDMA/mlx5: Fix mutex unlocking on error flow for steering anchor creation
  RDMA/mlx5: Fix assigning access flags to cache mkeys
  IB/mlx4: Fix the size of a buffer in add_port_entries()
  RDMA/bnxt_re: Decrement resource stats correctly
  RDMA/bnxt_re: Fix the handling of control path response data
  RDMA/cma: Fix truncation compilation warning in make_cma_ports
  RDMA/erdma: Fix NULL pointer access in regmr_cmd
  RDMA/erdma: Fix error code in erdma_create_scatter_mtt()
  RDMA/uverbs: Fix typo of sizeof argument
  RDMA/cxgb4: Check skb value for failure to allocate
  RDMA/siw: Fix connection failure handling
  RDMA/srp: Do not call scsi_done() from srp_abort()
parents 82714078 c38d23a5

drivers/infiniband/core/cma.c

+1 −1
Original line number Diff line number Diff line
@@ -4968,7 +4968,7 @@ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv, 
	int err = 0;

	struct sockaddr *addr = (struct sockaddr *)&mc->addr;

	struct net_device *ndev = NULL;

	struct ib_sa_multicast ib;

	struct ib_sa_multicast ib = {};

	enum ib_gid_type gid_type;

	bool send_only;

drivers/infiniband/core/cma_configfs.c

+1 −1
Original line number Diff line number Diff line
@@ -217,7 +217,7 @@ static int make_cma_ports(struct cma_dev_group *cma_dev_group, 
		return -ENOMEM;



	for (i = 0; i < ports_num; i++) {

		char port_str[10];

		char port_str[11];



		ports[i].port_num = i + 1;

		snprintf(port_str, sizeof(port_str), "%u", i + 1);

drivers/infiniband/core/nldev.c

+1 −0
Original line number Diff line number Diff line
@@ -2529,6 +2529,7 @@ static const struct rdma_nl_cbs nldev_cb_table[RDMA_NLDEV_NUM_OPS] = { 
	},

	[RDMA_NLDEV_CMD_SYS_SET] = {

		.doit = nldev_set_sys_set_doit,

		.flags = RDMA_NL_ADMIN_PERM,

	},

	[RDMA_NLDEV_CMD_STAT_SET] = {

		.doit = nldev_stat_set_doit,

drivers/infiniband/core/uverbs_main.c

+1 −1
Original line number Diff line number Diff line
@@ -546,7 +546,7 @@ static ssize_t verify_hdr(struct ib_uverbs_cmd_hdr *hdr, 
	if (hdr->in_words * 4 != count)

		return -EINVAL;



	if (count < method_elm->req_size + sizeof(hdr)) {

	if (count < method_elm->req_size + sizeof(*hdr)) {

		/*

		 * rdma-core v18 and v19 have a bug where they send DESTROY_CQ

		 * with a 16 byte write instead of 24. Old kernels didn't

drivers/infiniband/hw/bnxt_re/ib_verbs.c

+4 −0
Original line number Diff line number Diff line
@@ -910,6 +910,10 @@ int bnxt_re_destroy_qp(struct ib_qp *ib_qp, struct ib_udata *udata) 
	list_del(&qp->list);

	mutex_unlock(&rdev->qp_lock);

	atomic_dec(&rdev->stats.res.qp_count);

	if (qp->qplib_qp.type == CMDQ_CREATE_QP_TYPE_RC)

		atomic_dec(&rdev->stats.res.rc_qp_count);

	else if (qp->qplib_qp.type == CMDQ_CREATE_QP_TYPE_UD)

		atomic_dec(&rdev->stats.res.ud_qp_count);



	ib_umem_release(qp->rumem);

	ib_umem_release(qp->sumem);