linux-stable.git/drivers/infiniband, branch v3.2.94

RDMA/uverbs: Check port number supplied by user verbs cmds

2017-10-12T14:27:14+00:00

commit 5ecce4c9b17bed4dc9cb58bfb10447307569b77b upstream.

The ib_uverbs_create_ah() ind ib_uverbs_modify_qp() calls receive
the port number from user input as part of its attributes and assumes
it is valid. Down on the stack, that parameter is used to access kernel
data structures.  If the value is invalid, the kernel accesses memory
it should not.  To prevent this, verify the port number before using it.

BUG: KASAN: use-after-free in ib_uverbs_create_ah+0x6d5/0x7b0
Read of size 4 at addr ffff880018d67ab8 by task syz-executor/313

BUG: KASAN: slab-out-of-bounds in modify_qp.isra.4+0x19d0/0x1ef0
Read of size 4 at addr ffff88006c40ec58 by task syz-executor/819

Fixes: 67cdb40ca444 ("[IB] uverbs: Implement more commands")
Fixes: 189aba99e70 ("IB/uverbs: Extend modify_qp and support packet pacing")
Cc: 
Cc: Yevgeny Kliteynik 
Cc: Tziporet Koren 
Cc: Alex Polak 
Signed-off-by: Boris Pismenny 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
[bwh: Backported to 3.2:
 - In modify_qp(), command structure is cmd not cmd->base
 - In modify_qp(), add release_qp label
 - In ib_uverbs_create_ah(), add definition of ib_dev
 - Adjust context]
Signed-off-by: Ben Hutchings

IB/core: Add inline function to validate port

2017-10-12T14:27:14+00:00

commit 24dc831b77eca9361cf835be59fa69ea0e471afc upstream.

Signed-off-by: Yuval Shaia 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
[bwh: Backported to 3.2:
 - Drop inapplicable changes
 - Adjust context]
Signed-off-by: Ben Hutchings

IB/core: Create common start/end port functions

2017-10-12T14:27:14+00:00

commit 0cf18d7723055709faf51b50f5a33253b480637f upstream.

Previously start_port and end_port were defined in 2 places, cache.c and
device.c and this prevented their use in other modules.

Make these common functions, change the name to reflect the rdma
name space, and update existing users.

Signed-off-by: Ira Weiny 
Signed-off-by: Doug Ledford 
[bwh: Backported to 3.2: drop one inapplicable change]
Signed-off-by: Ben Hutchings

IB/core: For multicast functions, verify that LIDs are multicast LIDs

2017-08-26T01:14:03+00:00

commit 8561eae60ff9417a50fa1fb2b83ae950dc5c1e21 upstream.

The Infiniband spec defines "A multicast address is defined by a
MGID and a MLID" (section 10.5).  Currently the MLID value is not
validated.

Add check to verify that the MLID value is in the correct address
range.

Fixes: 0c33aeedb2cf ("[IB] Add checks to multicast attach and detach")
Reviewed-by: Ira Weiny 
Reviewed-by: Dasaratharaman Chandramouli 
Signed-off-by: Michael J. Ruhl 
Signed-off-by: Dennis Dalessandro 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
[bwh: Backported to 3.2: use literal number instead of IB_MULTICAST_LID_BASE]
Signed-off-by: Ben Hutchings

IB/core: If the MGID/MLID pair is not on the list return an error

2017-08-26T01:14:03+00:00

commit 20c7840a77ddcb2ed2fbd66e8197db2868495751 upstream.

A list of MGID/MLID pairs is built when doing a multicast attach.  When
the multicast detach is called, the list is searched, and regardless of
the search outcome, the driver detach is called.

If an MGID/MLID pair is not on the list, driver detach should not be
called, and an error should be returned.  Calling the driver without
removing an MGID/MLID pair from the list can leave the core and driver
out of sync.

Fixes: f4e401562c11 ("IB/uverbs: track multicast group membership for userspace QPs")
Reviewed-by: Ira Weiny 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Michael J. Ruhl 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings

IB/qib: fix false-postive maybe-uninitialized warning

2017-07-18T17:38:37+00:00

commit f6aafac184a3e46e919769dd4faa8bf0dc436534 upstream.

aarch64-linux-gcc-7 complains about code it doesn't fully understand:

drivers/infiniband/hw/qib/qib_iba7322.c: In function 'qib_7322_txchk_change':
include/asm-generic/bitops/non-atomic.h:105:35: error: 'shadow' may be used uninitialized in this function [-Werror=maybe-uninitialized]

The code is right, and despite trying hard, I could not come up with a version
that I liked better than just adding a fake initialization here to shut up the
warning.

Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
Signed-off-by: Arnd Bergmann 
Acked-by: Ira Weiny 
Signed-off-by: Doug Ledford 
Signed-off-by: Ben Hutchings

rdma_cm: fail iwarp accepts w/o connection params

2017-06-05T20:13:50+00:00

commit f2625f7db4dd0bbd16a9c7d2950e7621f9aa57ad upstream.

cma_accept_iw() needs to return an error if conn_params is NULL.
Since this is coming from user space, we can crash.

Reported-by: Shaobo He 
Acked-by: Sean Hefty 
Signed-off-by: Steve Wise 
Signed-off-by: Doug Ledford 
Signed-off-by: Ben Hutchings

IB/ipoib: Change list_del to list_del_init in the tx object

2017-06-05T20:13:41+00:00

commit 27d41d29c7f093f6f77843624fbb080c1b4a8b9c upstream.

Since ipoib_cm_tx_start function and ipoib_cm_tx_reap function
belong to different work queues, they can run in parallel.
In this case if ipoib_cm_tx_reap calls list_del and release the
lock, ipoib_cm_tx_start may acquire it and call list_del_init
on the already deleted object.
Changing list_del to list_del_init in ipoib_cm_tx_reap fixes the problem.

Fixes: 839fcaba355a ("IPoIB: Connected mode experimental support")
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Reviewed-by: Alex Vesker 
Signed-off-by: Leon Romanovsky 
Reviewed-by: Yuval Shaia 
Signed-off-by: Doug Ledford 
Signed-off-by: Ben Hutchings

IB/ipoib: Set device connection mode only when needed

2017-06-05T20:13:41+00:00

commit 80b5b35aba62232521b31440f0a3cf6caa033849 upstream.

When changing the connection mode, the ipoib_set_mode function
did not check if the previous connection mode equals to the
new one. This commit adds the required check and return 0 if the new
mode equals to the previous one.

Fixes: 839fcaba355a ("IPoIB: Connected mode experimental support")
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Reviewed-by: Alex Vesker 
Reviewed-by: Yuval Shaia 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
[bwh: Backported to 3.2:
 - Adjust filename
 - Unlock RTNL lock before returning]
Signed-off-by: Ben Hutchings

IB/multicast: Check ib_find_pkey() return value

2017-03-16T02:18:32+00:00

commit d3a2418ee36a59bc02e9d454723f3175dcf4bfd9 upstream.

This patch avoids that Coverity complains about not checking the
ib_find_pkey() return value.

Fixes: commit 547af76521b3 ("IB/multicast: Report errors on multicast groups if P_key changes")
Signed-off-by: Bart Van Assche 
Cc: Sean Hefty 
Signed-off-by: Doug Ledford 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings