Commit 92e07c26 authored Nov 29, 2024 by Bhargava Chenna Marreddy Committed by Wang Liang Nov 29, 2024

RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages

stable inclusion
from stable-v5.10.229
commit df6fed0a2a1a5e57f033bca40dc316b18e0d0ce6
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YUP
CVE: CVE-2024-50208

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=df6fed0a2a1a5e57f033bca40dc316b18e0d0ce6

--------------------------------

[ Upstream commit 7988bdbbb85ac85a847baf09879edcd0f70521dc ]

Avoid memory corruption while setting up Level-2 PBL pages for the non MR
resources when num_pages > 256K.

There will be a single PDE page address (contiguous pages in the case of >
PAGE_SIZE), but, current logic assumes multiple pages, leading to invalid
memory access after 256K PBL entries in the PDE.

Fixes: 0c4dcd60 ("RDMA/bnxt_re: Refactor hardware queue memory allocation")
Link: https://patch.msgid.link/r/1728373302-19530-10-git-send-email-selvin.xavier@broadcom.com


Signed-off-by: Bhargava Chenna Marreddy <bhargava.marreddy@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Wang Liang <wangliang74@huawei.com>

parent 1a47bbfa

drivers/infiniband/hw/bnxt_re/qplib_res.c

+3 −16

Original line number	Diff line number	Diff line
		@@ -256,22 +256,9 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq,
		dst_virt_ptr =
		(dma_addr_t **)hwq->pbl[PBL_LVL_0].pg_arr;
		src_phys_ptr = hwq->pbl[PBL_LVL_1].pg_map_arr;
		if (hwq_attr->type == HWQ_TYPE_MR) {
		/* For MR it is expected that we supply only 1 contigous
		* page i.e only 1 entry in the PDL that will contain
		* all the PBLs for the user supplied memory region
		*/
		for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count;
		i++)
		dst_virt_ptr[0][i] = src_phys_ptr[i] \|
		flag;
		} else {
		for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count;
		i++)
		dst_virt_ptr[PTR_PG(i)][PTR_IDX(i)] =
		src_phys_ptr[i] \|
		PTU_PDE_VALID;
		}
		for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count; i++)
		dst_virt_ptr[0][i] = src_phys_ptr[i] \| flag;

		/* Alloc or init PTEs */
		rc = __alloc_pbl(res, &hwq->pbl[PBL_LVL_2],
		hwq_attr->sginfo);