Commit f01da525 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma 

Pull rdma fixes from Jason Gunthorpe:
 "A mixture of small bug fixes, most for longer standing problems:

   - NULL pointer crash in siw

   - Various error unwind bugs in siw, rxe, cm

   - User triggerable errors in uverbs

   - Minor bugs in mlx5 and rxe drivers"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/uverbs: Fix a NULL vs IS_ERR() bug
  RDMA/mlx5: Fix query DCT via DEVX
  RDMA/core: Don't access cm_id after its destruction
  RDMA/rxe: Return CQE error if invalid lkey was supplied
  RDMA/mlx5: Recover from fatal event in dual port mode
  RDMA/mlx5: Verify that DM operation is reasonable
  RDMA/rxe: Clear all QP fields if creation failed
  RDMA/core: Prevent divide-by-zero error triggered by the user
  RDMA/siw: Release xarray entry
  RDMA/siw: Properly check send and receive CQ pointers
parents 6aa37a53 463a3f66

drivers/infiniband/core/cma.c

+3 −2
Original line number Diff line number Diff line
@@ -473,6 +473,7 @@ static void cma_release_dev(struct rdma_id_private *id_priv) 
	list_del(&id_priv->list);

	cma_dev_put(id_priv->cma_dev);

	id_priv->cma_dev = NULL;

	id_priv->id.device = NULL;

	if (id_priv->id.route.addr.dev_addr.sgid_attr) {

		rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr);

		id_priv->id.route.addr.dev_addr.sgid_attr = NULL;
@@ -1860,6 +1861,7 @@ static void _destroy_id(struct rdma_id_private *id_priv, 
				iw_destroy_cm_id(id_priv->cm_id.iw);

		}

		cma_leave_mc_groups(id_priv);

		rdma_restrack_del(&id_priv->res);

		cma_release_dev(id_priv);

	}
@@ -1873,7 +1875,6 @@ static void _destroy_id(struct rdma_id_private *id_priv, 
	kfree(id_priv->id.route.path_rec);



	put_net(id_priv->id.route.addr.dev_addr.net);

	rdma_restrack_del(&id_priv->res);

	kfree(id_priv);

}
@@ -3774,7 +3775,7 @@ int rdma_listen(struct rdma_cm_id *id, int backlog) 
	}



	id_priv->backlog = backlog;

	if (id->device) {

	if (id_priv->cma_dev) {

		if (rdma_cap_ib_cm(id->device, 1)) {

			ret = cma_ib_listen(id_priv);

			if (ret)

drivers/infiniband/core/uverbs_std_types_device.c

+5 −2
Original line number Diff line number Diff line
@@ -117,8 +117,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_INFO_HANDLES)( 
		return ret;



	uapi_object = uapi_get_object(attrs->ufile->device->uapi, object_id);

	if (!uapi_object)

		return -EINVAL;

	if (IS_ERR(uapi_object))

		return PTR_ERR(uapi_object);



	handles = gather_objects_handle(attrs->ufile, uapi_object, attrs,

					out_len, &total);
@@ -331,6 +331,9 @@ static int UVERBS_HANDLER(UVERBS_METHOD_QUERY_GID_TABLE)( 
	if (ret)

		return ret;



	if (!user_entry_size)

		return -EINVAL;



	max_entries = uverbs_attr_ptr_get_array_size(

		attrs, UVERBS_ATTR_QUERY_GID_TABLE_RESP_ENTRIES,

		user_entry_size);

drivers/infiniband/hw/mlx5/devx.c

+2 −4
Original line number Diff line number Diff line
@@ -630,9 +630,8 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs, 
	case UVERBS_OBJECT_QP:

	{

		struct mlx5_ib_qp *qp = to_mqp(uobj->object);

		enum ib_qp_type	qp_type = qp->ibqp.qp_type;



		if (qp_type == IB_QPT_RAW_PACKET ||

		if (qp->type == IB_QPT_RAW_PACKET ||

		    (qp->flags & IB_QP_CREATE_SOURCE_QPN)) {

			struct mlx5_ib_raw_packet_qp *raw_packet_qp =

							 &qp->raw_packet_qp;
@@ -649,10 +648,9 @@ static bool devx_is_valid_obj_id(struct uverbs_attr_bundle *attrs, 
					       sq->tisn) == obj_id);

		}



		if (qp_type == MLX5_IB_QPT_DCT)

		if (qp->type == MLX5_IB_QPT_DCT)

			return get_enc_obj_id(MLX5_CMD_OP_CREATE_DCT,

					      qp->dct.mdct.mqp.qpn) == obj_id;



		return get_enc_obj_id(MLX5_CMD_OP_CREATE_QP,

				      qp->ibqp.qp_num) == obj_id;

	}

drivers/infiniband/hw/mlx5/dm.c

+3 −0
Original line number Diff line number Diff line
@@ -217,6 +217,9 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DM_MAP_OP_ADDR)( 
	if (err)

		return err;



	if (op >= BITS_PER_TYPE(u32))

		return -EOPNOTSUPP;



	if (!(MLX5_CAP_DEV_MEM(dev->mdev, memic_operations) & BIT(op)))

		return -EOPNOTSUPP;

drivers/infiniband/hw/mlx5/main.c

+1 −0
Original line number Diff line number Diff line
@@ -4419,6 +4419,7 @@ static int mlx5r_mp_probe(struct auxiliary_device *adev, 


		if (bound) {

			rdma_roce_rescan_device(&dev->ib_dev);

			mpi->ibdev->ib_active = true;

			break;

		}

	}