Commit 93fd8eb0 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma 

Pull rdma fixes from Jason Gunthorpe:
 "This is an unusually large bunch of bug fixes for the later rc cycle,
  rxe and mlx5 both dumped a lot of things at once. rxe continues to fix
  itself, and mlx5 is fixing a bunch of "queue counters" related bugs.

  There is one highly notable bug fix regarding the qkey. This small
  security check was missed in the original 2005 implementation and it
  allows some significant issues.

  Summary:

   - Two rtrs bug fixes for error unwind bugs

   - Several rxe bug fixes:
      * Incorrect Rx packet validation
      * Using memory without a refcount
      * Syzkaller found use before initialization
      * Regression fix for missing locking with the tasklet conversion
        from this merge window

   - Have bnxt report the correct link properties to userspace, this was
     a regression in v6.3

   - Several mlx5 bug fixes:
      * Kernel crash triggerable by userspace for the RAW ethernet
        profile
      * Defend against steering refcounting issues created by userspace
      * Incorrect change of QP port affinity parameters in some LAG
        configurations

   - Fix mlx5 Q counters:
      * Do not over allocate Q counters to allow userspace to use the
        full port capacity
      * Kernel crash triggered by eswitch due to mis-use of Q counters
      * Incorrect mlx5_device for Q counters in some LAG configurations

   - Properly implement the IBA spec restricting privileged qkeys to
     root

   - Always an error when reading from a disassociated device's event
     queue

   - isert bug fixes:
      * Avoid a deadlock with the CM handler and CM ID destruction
      * Correct list corruption due to incorrect locking
      * Fix a use after free around connection tear down"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/rxe: Fix rxe_cq_post
  IB/isert: Fix incorrect release of isert connection
  IB/isert: Fix possible list corruption in CMA handler
  IB/isert: Fix dead lock in ib_isert
  RDMA/mlx5: Fix affinity assignment
  IB/uverbs: Fix to consider event queue closing also upon non-blocking mode
  RDMA/uverbs: Restrict usage of privileged QKEYs
  RDMA/cma: Always set static rate to 0 for RoCE
  RDMA/mlx5: Fix Q-counters query in LAG mode
  RDMA/mlx5: Remove vport Q-counters dependency on normal Q-counters
  RDMA/mlx5: Fix Q-counters per vport allocation
  RDMA/mlx5: Create an indirect flow table for steering anchor
  RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions
  RDMA/rxe: Fix the use-before-initialization error of resp_pkts
  RDMA/bnxt_re: Fix reporting active_{speed,width} attributes
  RDMA/rxe: Fix ref count error in check_rkey()
  RDMA/rxe: Fix packet length checks
  RDMA/rtrs: Fix rxe_dealloc_pd warning
  RDMA/rtrs: Fix the last iu->buf leak in err path
parents b7feaa49 0c7e314a

drivers/infiniband/core/cma.c

+2 −2
Original line number Diff line number Diff line
@@ -3295,7 +3295,7 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv) 
	route->path_rec->traffic_class = tos;

	route->path_rec->mtu = iboe_get_mtu(ndev->mtu);

	route->path_rec->rate_selector = IB_SA_EQ;

	route->path_rec->rate = iboe_get_rate(ndev);

	route->path_rec->rate = IB_RATE_PORT_CURRENT;

	dev_put(ndev);

	route->path_rec->packet_life_time_selector = IB_SA_EQ;

	/* In case ACK timeout is set, use this value to calculate
@@ -4964,7 +4964,7 @@ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv, 
	if (!ndev)

		return -ENODEV;



	ib.rec.rate = iboe_get_rate(ndev);

	ib.rec.rate = IB_RATE_PORT_CURRENT;

	ib.rec.hop_limit = 1;

	ib.rec.mtu = iboe_get_mtu(ndev->mtu);

drivers/infiniband/core/uverbs_cmd.c

+6 −1
Original line number Diff line number Diff line
@@ -1850,8 +1850,13 @@ static int modify_qp(struct uverbs_attr_bundle *attrs, 
		attr->path_mtu = cmd->base.path_mtu;

	if (cmd->base.attr_mask & IB_QP_PATH_MIG_STATE)

		attr->path_mig_state = cmd->base.path_mig_state;

	if (cmd->base.attr_mask & IB_QP_QKEY)

	if (cmd->base.attr_mask & IB_QP_QKEY) {

		if (cmd->base.qkey & IB_QP_SET_QKEY && !capable(CAP_NET_RAW)) {

			ret = -EPERM;

			goto release_qp;

		}

		attr->qkey = cmd->base.qkey;

	}

	if (cmd->base.attr_mask & IB_QP_RQ_PSN)

		attr->rq_psn = cmd->base.rq_psn;

	if (cmd->base.attr_mask & IB_QP_SQ_PSN)

drivers/infiniband/core/uverbs_main.c

+5 −7
Original line number Diff line number Diff line
@@ -222,8 +222,12 @@ static ssize_t ib_uverbs_event_read(struct ib_uverbs_event_queue *ev_queue, 
	spin_lock_irq(&ev_queue->lock);



	while (list_empty(&ev_queue->event_list)) {

		if (ev_queue->is_closed) {

			spin_unlock_irq(&ev_queue->lock);

			return -EIO;

		}



		spin_unlock_irq(&ev_queue->lock);

		if (filp->f_flags & O_NONBLOCK)

			return -EAGAIN;
@@ -233,12 +237,6 @@ static ssize_t ib_uverbs_event_read(struct ib_uverbs_event_queue *ev_queue, 
			return -ERESTARTSYS;



		spin_lock_irq(&ev_queue->lock);



		/* If device was disassociated and no event exists set an error */

		if (list_empty(&ev_queue->event_list) && ev_queue->is_closed) {

			spin_unlock_irq(&ev_queue->lock);

			return -EIO;

		}

	}



	event = list_entry(ev_queue->event_list.next, struct ib_uverbs_event, list);

drivers/infiniband/hw/bnxt_re/bnxt_re.h

+0 −2
Original line number Diff line number Diff line
@@ -135,8 +135,6 @@ struct bnxt_re_dev { 


	struct delayed_work		worker;

	u8				cur_prio_map;

	u16				active_speed;

	u8				active_width;



	/* FP Notification Queue (CQ & SRQ) */

	struct tasklet_struct		nq_task;

drivers/infiniband/hw/bnxt_re/ib_verbs.c

+4 −3
Original line number Diff line number Diff line
@@ -199,6 +199,7 @@ int bnxt_re_query_port(struct ib_device *ibdev, u32 port_num, 
{

	struct bnxt_re_dev *rdev = to_bnxt_re_dev(ibdev, ibdev);

	struct bnxt_qplib_dev_attr *dev_attr = &rdev->dev_attr;

	int rc;



	memset(port_attr, 0, sizeof(*port_attr));
@@ -228,10 +229,10 @@ int bnxt_re_query_port(struct ib_device *ibdev, u32 port_num, 
	port_attr->sm_sl = 0;

	port_attr->subnet_timeout = 0;

	port_attr->init_type_reply = 0;

	port_attr->active_speed = rdev->active_speed;

	port_attr->active_width = rdev->active_width;

	rc = ib_get_eth_speed(&rdev->ibdev, port_num, &port_attr->active_speed,

			      &port_attr->active_width);



	return 0;

	return rc;

}



int bnxt_re_get_port_immutable(struct ib_device *ibdev, u32 port_num,