Unverified Commit df1d0f90 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15186 CVE-2024-57795 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/YMPT2NZIS5AJSNG7VJPAKOGKX7NWGDAG/ 
CVE-2024-57795

Liu Jian (1):
  RDMA: Export ib_device_get_netdev()

Zhu Yanjun (1):
  RDMA/rxe: Remove the direct link to net_device


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IBID2B
https://gitee.com/src-openeuler/kernel/issues/IBI67U 
 
Link:https://gitee.com/openeuler/kernel/pulls/15186

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: default avatarLi Nan <linan122@huawei.com>
Signed-off-by: default avatarLi Nan <linan122@huawei.com>
parents 8db8b928 53b401b9

drivers/infiniband/core/device.c

+4 −0
Original line number Diff line number Diff line
@@ -2163,6 +2163,9 @@ struct net_device *ib_device_get_netdev(struct ib_device *ib_dev, 
	if (!rdma_is_port_valid(ib_dev, port))

		return NULL;



	if (!ib_dev->port_data)

		return NULL;



	pdata = &ib_dev->port_data[port];



	/*
@@ -2191,6 +2194,7 @@ struct net_device *ib_device_get_netdev(struct ib_device *ib_dev, 


	return res;

}

EXPORT_SYMBOL(ib_device_get_netdev);



/**

 * ib_device_get_by_netdev - Find an IB device associated with a netdev

drivers/infiniband/sw/rxe/rxe.c

+19 −4
Original line number Diff line number Diff line
@@ -42,6 +42,8 @@ void rxe_dealloc(struct ib_device *ib_dev) 
/* initialize rxe device parameters */

static void rxe_init_device_param(struct rxe_dev *rxe)

{

	struct net_device *ndev;



	rxe->max_inline_data			= RXE_MAX_INLINE_DATA;



	rxe->attr.vendor_id			= RXE_VENDOR_ID;
@@ -71,8 +73,15 @@ static void rxe_init_device_param(struct rxe_dev *rxe) 
	rxe->attr.max_fast_reg_page_list_len	= RXE_MAX_FMR_PAGE_LIST_LEN;

	rxe->attr.max_pkeys			= RXE_MAX_PKEYS;

	rxe->attr.local_ca_ack_delay		= RXE_LOCAL_CA_ACK_DELAY;



	ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);

	if (!ndev)

		return;



	addrconf_addr_eui48((unsigned char *)&rxe->attr.sys_image_guid,

			rxe->ndev->dev_addr);

			ndev->dev_addr);



	dev_put(ndev);



	rxe->max_ucontext			= RXE_MAX_UCONTEXT;

}
@@ -109,10 +118,15 @@ static void rxe_init_port_param(struct rxe_port *port) 
static void rxe_init_ports(struct rxe_dev *rxe)

{

	struct rxe_port *port = &rxe->port;

	struct net_device *ndev;



	rxe_init_port_param(port);

	ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);

	if (!ndev)

		return;

	addrconf_addr_eui48((unsigned char *)&port->port_guid,

			    rxe->ndev->dev_addr);

			    ndev->dev_addr);

	dev_put(ndev);

	spin_lock_init(&port->port_lock);

}
@@ -236,7 +250,8 @@ void rxe_set_mtu(struct rxe_dev *rxe, unsigned int ndev_mtu) 
/* called by ifc layer to create new rxe device.

 * The caller should allocate memory for rxe by calling ib_alloc_device.

 */

int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name)

int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name,

			struct net_device *ndev)

{

	int err;
@@ -246,7 +261,7 @@ int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name) 


	rxe_set_mtu(rxe, mtu);



	return rxe_register_device(rxe, ibdev_name);

	return rxe_register_device(rxe, ibdev_name, ndev);

}



static int rxe_newlink(const char *ibdev_name, struct net_device *ndev)

drivers/infiniband/sw/rxe/rxe.h

+2 −1
Original line number Diff line number Diff line
@@ -65,7 +65,8 @@ static inline u32 rxe_crc32(struct rxe_dev *rxe, 


void rxe_set_mtu(struct rxe_dev *rxe, unsigned int dev_mtu);



int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name);

int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name,

			struct net_device *ndev);



void rxe_rcv(struct sk_buff *skb);

drivers/infiniband/sw/rxe/rxe_net.c

+34 −7
Original line number Diff line number Diff line
@@ -24,9 +24,15 @@ int rxe_mcast_add(struct rxe_dev *rxe, union ib_gid *mgid) 
{

	int err;

	unsigned char ll_addr[ETH_ALEN];

	struct net_device *ndev;



	ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);

	if (!ndev)

		return -ENODEV;



	ipv6_eth_mc_map((struct in6_addr *)mgid->raw, ll_addr);

	err = dev_mc_add(rxe->ndev, ll_addr);

	err = dev_mc_add(ndev, ll_addr);

	dev_put(ndev);



	return err;

}
@@ -35,9 +41,15 @@ int rxe_mcast_delete(struct rxe_dev *rxe, union ib_gid *mgid) 
{

	int err;

	unsigned char ll_addr[ETH_ALEN];

	struct net_device *ndev;



	ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);

	if (!ndev)

		return -ENODEV;



	ipv6_eth_mc_map((struct in6_addr *)mgid->raw, ll_addr);

	err = dev_mc_del(rxe->ndev, ll_addr);

	err = dev_mc_del(ndev, ll_addr);

	dev_put(ndev);



	return err;

}
@@ -481,7 +493,16 @@ struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av, 
 */

const char *rxe_parent_name(struct rxe_dev *rxe, unsigned int port_num)

{

	return rxe->ndev->name;

	struct net_device *ndev;

	char *ndev_name;



	ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);

	if (!ndev)

		return NULL;

	ndev_name = ndev->name;

	dev_put(ndev);



	return ndev_name;

}



int rxe_net_add(const char *ibdev_name, struct net_device *ndev)
@@ -493,9 +514,7 @@ int rxe_net_add(const char *ibdev_name, struct net_device *ndev) 
	if (!rxe)

		return -ENOMEM;



	rxe->ndev = ndev;



	err = rxe_add(rxe, ndev->mtu, ibdev_name);

	err = rxe_add(rxe, ndev->mtu, ibdev_name, ndev);

	if (err) {

		ib_dealloc_device(&rxe->ib_dev);

		return err;
@@ -543,10 +562,18 @@ void rxe_port_down(struct rxe_dev *rxe) 


void rxe_set_port_state(struct rxe_dev *rxe)

{

	if (netif_running(rxe->ndev) && netif_carrier_ok(rxe->ndev))

	struct net_device *ndev;



	ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);

	if (!ndev)

		return;



	if (netif_running(ndev) && netif_carrier_ok(ndev))

		rxe_port_up(rxe);

	else

		rxe_port_down(rxe);



	dev_put(ndev);

}



static int rxe_notify(struct notifier_block *not_blk,

drivers/infiniband/sw/rxe/rxe_verbs.c

+19 −5
Original line number Diff line number Diff line
@@ -29,11 +29,16 @@ static int rxe_query_port(struct ib_device *dev, 
			  u8 port_num, struct ib_port_attr *attr)

{

	struct rxe_dev *rxe = to_rdev(dev);

	struct net_device *ndev;

	struct rxe_port *port;

	int rc;



	port = &rxe->port;



	ndev = rxe_ib_device_get_netdev(dev);

	if (!ndev)

		return -ENODEV;



	/* *attr being zeroed by the caller, avoid zeroing it here */

	*attr = port->attr;
@@ -43,13 +48,14 @@ static int rxe_query_port(struct ib_device *dev, 


	if (attr->state == IB_PORT_ACTIVE)

		attr->phys_state = IB_PORT_PHYS_STATE_LINK_UP;

	else if (dev_get_flags(rxe->ndev) & IFF_UP)

	else if (dev_get_flags(ndev) & IFF_UP)

		attr->phys_state = IB_PORT_PHYS_STATE_POLLING;

	else

		attr->phys_state = IB_PORT_PHYS_STATE_DISABLED;



	mutex_unlock(&rxe->usdev_lock);



	dev_put(ndev);

	return rc;

}
@@ -1050,9 +1056,16 @@ static const struct attribute_group rxe_attr_group = { 
static int rxe_enable_driver(struct ib_device *ib_dev)

{

	struct rxe_dev *rxe = container_of(ib_dev, struct rxe_dev, ib_dev);

	struct net_device *ndev;



	ndev = rxe_ib_device_get_netdev(ib_dev);

	if (!ndev)

		return -ENODEV;



	rxe_set_port_state(rxe);

	dev_info(&rxe->ib_dev.dev, "added %s\n", netdev_name(rxe->ndev));

	dev_info(&rxe->ib_dev.dev, "added %s\n", netdev_name(ndev));



	dev_put(ndev);

	return 0;

}
@@ -1113,7 +1126,8 @@ static const struct ib_device_ops rxe_dev_ops = { 
	INIT_RDMA_OBJ_SIZE(ib_ucontext, rxe_ucontext, ibuc),

};



int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name)

int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name,

						struct net_device *ndev)

{

	int err;

	struct ib_device *dev = &rxe->ib_dev;
@@ -1126,7 +1140,7 @@ int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name) 
	dev->num_comp_vectors = num_possible_cpus();

	dev->local_dma_lkey = 0;

	addrconf_addr_eui48((unsigned char *)&dev->node_guid,

			    rxe->ndev->dev_addr);

			    ndev->dev_addr);



	dev->uverbs_cmd_mask = BIT_ULL(IB_USER_VERBS_CMD_GET_CONTEXT)

	    | BIT_ULL(IB_USER_VERBS_CMD_CREATE_COMP_CHANNEL)
@@ -1162,7 +1176,7 @@ int rxe_register_device(struct rxe_dev *rxe, const char *ibdev_name) 
	    ;



	ib_set_device_ops(dev, &rxe_dev_ops);

	err = ib_device_set_netdev(&rxe->ib_dev, rxe->ndev, 1);

	err = ib_device_set_netdev(&rxe->ib_dev, ndev, 1);

	if (err)

		return err;