linux-stable.git/drivers/infiniband, branch linux-4.8.y

i40iw: Use correct src address in memcpy to rdma stats counters

2017-01-09T07:22:00+00:00

commit 91c42b72f8e8b45961ff05a05009b644e6316ca2 upstream.

hw_stats is a pointer to i40_iw_dev_stats struct in i40iw_get_hw_stats().
Use hw_stats and not &hw_stats in the memcpy to copy the i40iw device stats
data into rdma_hw_stats counters.

Fixes: b40f4757daa1 ("IB/core: Make device counter infrastructure dynamic")

Signed-off-by: Shiraz Saleem 
Signed-off-by: Faisal Latif 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/rxe: Fix a memory leak in rxe_qp_cleanup()

2017-01-09T07:21:58+00:00

commit e259934d4df7f99f2a5c2c4f074f6a55bd4b1722 upstream.

A socket is associated with every QP by the rxe driver but sock_release()
is never called. Add a call to sock_release() in rxe_qp_cleanup().

Fixes: commit 8700e3e7c48A5 ("Add Soft RoCE driver")
Signed-off-by: Bart Van Assche 
Cc: Moni Shoua 
Cc: Kamal Heib 
Cc: Amir Vadai 
Cc: Haggai Eran 
Reviewed-by: Moni Shoua 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/multicast: Check ib_find_pkey() return value

2017-01-09T07:21:58+00:00

commit d3a2418ee36a59bc02e9d454723f3175dcf4bfd9 upstream.

This patch avoids that Coverity complains about not checking the
ib_find_pkey() return value.

Fixes: commit 547af76521b3 ("IB/multicast: Report errors on multicast groups if P_key changes")
Signed-off-by: Bart Van Assche 
Cc: Sean Hefty 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IPoIB: Avoid reading an uninitialized member variable

2017-01-09T07:21:58+00:00

commit 11b642b84e8c43e8597de031678d15c08dd057bc upstream.

This patch avoids that Coverity reports the following:

    Using uninitialized value port_attr.state when calling printk

Fixes: commit 94232d9ce817 ("IPoIB: Start multicast join process only on active ports")
Signed-off-by: Bart Van Assche 
Cc: Erez Shitrit 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/mad: Fix an array index check

2017-01-09T07:21:58+00:00

commit 2fe2f378dd45847d2643638c07a7658822087836 upstream.

The array ib_mad_mgmt_class_table.method_table has MAX_MGMT_CLASS
(80) elements. Hence compare the array index with that value instead
of with IB_MGMT_MAX_METHODS (128). This patch avoids that Coverity
reports the following:

Overrunning array class->method_table of 80 8-byte elements at element index 127 (byte offset 1016) using index convert_mgmt_class(mad_hdr->mgmt_class) (which evaluates to 127).

Fixes: commit b7ab0b19a85f ("IB/mad: Verify mgmt class in received MADs")
Signed-off-by: Bart Van Assche 
Cc: Sean Hefty 
Reviewed-by: Hal Rosenstock 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/cm: Mark stale CM id's whenever the mad agent was unregistered

2016-11-26T08:56:58+00:00

commit 9db0ff53cb9b43ed75bacd42a89c1a0ab048b2b0 upstream.

When there is a CM id object that has port assigned to it, it means that
the cm-id asked for the specific port that it should go by it, but if
that port was removed (hot-unplug event) the cm-id was not updated.
In order to fix that the port keeps a list of all the cm-id's that are
planning to go by it, whenever the port is removed it marks all of them
as invalid.

This commit fixes a kernel panic which happens when running traffic between
guests and we force reboot a guest mid traffic, it triggers a kernel panic:

 Call Trace:
  [] ? panic+0xa7/0x16f
  [] ? oops_end+0xe4/0x100
  [] ? no_context+0xfb/0x260
  [] ? del_timer_sync+0x22/0x30
  [] ? __bad_area_nosemaphore+0x125/0x1e0
  [] ? process_timeout+0x0/0x10
  [] ? bad_area_nosemaphore+0x13/0x20
  [] ? __do_page_fault+0x31f/0x480
  [] ? default_wake_function+0x0/0x20
  [] ? free_msg+0x55/0x70 [mlx5_core]
  [] ? cmd_exec+0x124/0x840 [mlx5_core]
  [] ? find_busiest_group+0x244/0x9f0
  [] ? do_page_fault+0x3e/0xa0
  [] ? page_fault+0x25/0x30
  [] ? cm_alloc_msg+0x35/0xc0 [ib_cm]
  [] ? ib_send_cm_dreq+0xb1/0x1e0 [ib_cm]
  [] ? cm_destroy_id+0x176/0x320 [ib_cm]
  [] ? ib_destroy_cm_id+0x10/0x20 [ib_cm]
  [] ? ipoib_cm_free_rx_reap_list+0xa7/0x110 [ib_ipoib]
  [] ? ipoib_cm_rx_reap+0x0/0x20 [ib_ipoib]
  [] ? ipoib_cm_rx_reap+0x15/0x20 [ib_ipoib]
  [] ? worker_thread+0x170/0x2a0
  [] ? autoremove_wake_function+0x0/0x40
  [] ? worker_thread+0x0/0x2a0
  [] ? kthread+0x96/0xa0
  [] ? child_rip+0xa/0x20
  [] ? kthread+0x0/0xa0
  [] ? child_rip+0x0/0x20

Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation")
Signed-off-by: Mark Bloch 
Signed-off-by: Erez Shitrit 
Reviewed-by: Maor Gottlieb 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/uverbs: Fix leak of XRC target QPs

2016-11-26T08:56:58+00:00

commit 5b810a242c28e1d8d64d718cebe75b79d86a0b2d upstream.

The real QP is destroyed in case of the ref count reaches zero, but
for XRC target QPs this call was missed and caused to QP leaks.

Let's call to destroy for all flows.

Fixes: 0e0ec7e0638e ('RDMA/core: Export ib_open_qp() to share XRC...')
Signed-off-by: Tariq Toukan 
Signed-off-by: Noa Osherovich 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/hfi1: Remove incorrect IS_ERR check

2016-11-26T08:56:58+00:00

commit 2b16056f845207967a32497f41cf92b57849f934 upstream.

Remove IS_ERR check from caching code as the function being called does
not actually return error pointers.

Fixes: f19bd643dbde: "IB/hfi1: Prevent NULL pointer deferences in caching code"
Reported-by: Dan Carpenter 
Reviewed-by: Dean Luick 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/core: Avoid unsigned int overflow in sg_alloc_table

2016-11-26T08:56:58+00:00

commit 3c7ba5760ab8eedec01159b267bb9bfcffe522ac upstream.

sg_alloc_table gets unsigned int as parameter while the driver
returns it as size_t. Check npages isn't greater than maximum
unsigned int.

Fixes: eeb8461e36c9 ("IB: Refactor umem to use linear SG table")
Signed-off-by: Mark Bloch 
Signed-off-by: Maor Gottlieb 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/mlx5: Fix NULL pointer dereference on debug print

2016-11-26T08:56:58+00:00

commit a1ab8402d15d2305d2315d96ec3294bfdf16587e upstream.

For XRC QP CQs may not exist. Check before attempting dereference.

Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Eli Cohen 
Signed-off-by: Maor Gottlieb 
Reviewed-by: Yishai Hadas 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman