Commit 9a20704f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma 

Pull rdma fixes from Jason Gunthorpe:
 "A few small bugs:

   - Fix longstanding mlx5 bug where ODP would fail with certain MR
     alignments

   - cancel work to prevent a hfi1 UAF

   - MAINTAINERS update

   - UAF, missing mutex_init and an error unwind bug in bnxt_re"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/bnxt_re: Initialize dpi_tbl_lock mutex
  RDMA/bnxt_re: Fix error handling in probe failure path
  RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF
  MAINTAINERS: Remove maintainer of HiSilicon RoCE
  IB/hfi1: Fix possible panic during hotplug remove
  RDMA/umem: Set iova in ODP flow
parents 0725a704 64b63265

MAINTAINERS

+0 −1
Original line number Diff line number Diff line
@@ -9375,7 +9375,6 @@ F: drivers/crypto/hisilicon/sgl.c 
F:	include/linux/hisi_acc_qm.h









HISILICON ROCE DRIVER









M:	Haoyue Xu <xuhaoyue1@hisilicon.com>









M:	Junxian Huang <huangjunxian6@hisilicon.com>









L:	linux-rdma@vger.kernel.org









S:	Maintained
































drivers/infiniband/core/umem.c



+2
−1






























Original line number
Diff line number
Diff line







@@ -85,6 +85,8 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem,







	dma_addr_t mask;









	int i;



















	umem->iova = va = virt;



















	if (umem->is_odp) {









		unsigned int page_size = BIT(to_ib_umem_odp(umem)->page_shift);


















@@ -100,7 +102,6 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem,







	 */









	pgsz_bitmap &= GENMASK(BITS_PER_LONG - 1, PAGE_SHIFT);



















	umem->iova = va = virt;









	/* The best result is the smallest page size that results in the minimum









	 * number of required pages. Compute the largest page size that could









	 * work based on VA address bits that don't change.
































drivers/infiniband/hw/bnxt_re/main.c



+3
−1






























Original line number
Diff line number
Diff line







@@ -1253,6 +1253,8 @@ static int bnxt_re_dev_init(struct bnxt_re_dev *rdev, u8 wqe_mode)

















	rc = bnxt_re_setup_chip_ctx(rdev, wqe_mode);









	if (rc) {









		bnxt_unregister_dev(rdev->en_dev);









		clear_bit(BNXT_RE_FLAG_NETDEV_REGISTERED, &rdev->flags);









		ibdev_err(&rdev->ibdev, "Failed to get chip context\n");









		return -EINVAL;









	}








@@ -1526,8 +1528,8 @@ static void bnxt_re_remove(struct auxiliary_device *adev)







	}









	bnxt_re_setup_cc(rdev, false);









	ib_unregister_device(&rdev->ibdev);









	ib_dealloc_device(&rdev->ibdev);









	bnxt_re_dev_uninit(rdev);









	ib_dealloc_device(&rdev->ibdev);









skip_remove:









	mutex_unlock(&bnxt_re_mutex);









}
































drivers/infiniband/hw/bnxt_re/qplib_res.c



+1
−0






























Original line number
Diff line number
Diff line







@@ -819,6 +819,7 @@ static int bnxt_qplib_alloc_dpi_tbl(struct bnxt_qplib_res *res,







	}



















	memset((u8 *)dpit->tbl, 0xFF, bytes);









	mutex_init(&res->dpi_tbl_lock);









	dpit->priv_db = dpit->ucreg.bar_reg + dpit->ucreg.offset;



















	return 0;
































drivers/infiniband/hw/hfi1/chip.c



+1
−0






























Original line number
Diff line number
Diff line







@@ -12307,6 +12307,7 @@ static void free_cntrs(struct hfi1_devdata *dd)

















	if (dd->synth_stats_timer.function)









		del_timer_sync(&dd->synth_stats_timer);









	cancel_work_sync(&dd->update_cntr_work);









	ppd = (struct hfi1_pportdata *)(dd + 1);









	for (i = 0; i < dd->num_pports; i++, ppd++) {









		kfree(ppd->cntrs);