linux-stable.git/drivers/infiniband, branch v4.9.35

IB/mlx5: Fix kernel to user leak prevention logic

2017-06-24T05:11:15+00:00

commit de8d6e02efbdb259c67832ccf027d7ace9b91d5d upstream.

The logic was broken as it failed to update the response length for
architectures with PAGE_SIZE larger than 4kB. As a result further
extension of the ucontext response struct would fail.

Fixes: d69e3bcf7976 ('IB/mlx5: Mmap the HCA's core clock register to user-space')
Signed-off-by: Eli Cohen 
Reviewed-by: Matan Barak 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Saeed Mahameed 
Signed-off-by: Greg Kroah-Hartman

RDMA/qedr: Return max inline data in QP query result

2017-06-17T04:41:58+00:00

[ Upstream commit 59e8970b3798e4cbe575ed9cf4d53098760a2a86 ]

Return the maximum supported amount of inline data, not the qp's current
configured inline data size, when filling out the results of a query
qp call.

Signed-off-by: Ram Amrani 
Signed-off-by: Michal Kalderon 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

RDMA/qedr: Don't spam dmesg if QP is in error state

2017-06-17T04:41:58+00:00

[ Upstream commit c78c31496111f497b4a03f955c100091185da8b6 ]

It is normal to flush CQEs if the QP is in error state. Hence there's no
use in printing a message per CQE to dmesg.

Signed-off-by: Ram Amrani 
Signed-off-by: Michal Kalderon 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

RDMA/qedr: Don't reset QP when queues aren't flushed

2017-06-17T04:41:58+00:00

[ Upstream commit 933e6dcaa0f65eb2f624ad760274020874a1f35e ]

Fail QP state transition from error to reset if SQ/RQ are not empty
and still in the process of flushing out the queued work entries.

Signed-off-by: Ram Amrani 
Signed-off-by: Michal Kalderon 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

RDMA/qedr: Fix and simplify memory leak in PD alloc

2017-06-17T04:41:58+00:00

[ Upstream commit 9c1e0228ab35e52d30abf4b5629c28350833fbcb ]

Free the PD if no internal resources were available. Move userspace
code under the relevant 'if'.

Signed-off-by: Ram Amrani 
Signed-off-by: Ariel Elior 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

RDMA/qedr: Dispatch port active event from qedr_add

2017-06-17T04:41:58+00:00

[ Upstream commit f449c7a2d822c2d81b5bcb2c50eec80796766726 ]

Relying on qede to trigger qedr on startup is problematic. When probing
both if qedr loads slowly then qede can assume qedr is missing and not
trigger it. This patch adds a triggering from qedr and protects against
a race via an atomic bit.

Signed-off-by: Ram Amrani 
Signed-off-by: Ariel Elior 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin 
Signed-off-by: Greg Kroah-Hartman

RDMA/qib,hfi1: Fix MR reference count leak on write with immediate

2017-06-07T10:07:49+00:00

commit 1feb40067cf04ae48d65f728d62ca255c9449178 upstream.

The handling of IB_RDMA_WRITE_ONLY_WITH_IMMEDIATE will leak a memory
reference when a buffer cannot be allocated for returning the immediate
data.

The issue is that the rkey validation has already occurred and the RNR
nak fails to release the reference that was fruitlessly gotten.  The
the peer will send the identical single packet request when its RNR
timer pops.

The fix is to release the held reference prior to the rnr nak exit.
This is the only sequence the requires both rkey validation and the
buffer allocation on the same packet.

Tested-by: Tadeusz Struk 
Reviewed-by: Dennis Dalessandro 
Signed-off-by: Mike Marciniszyn 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/hfi1: Fix a subcontext memory leak

2017-05-25T13:44:38+00:00

commit 224d71f910102c966cdcd782c97e096d5e26e4da upstream.

The only context that frees user_exp_rcv data structures is the last
context closed (from a sub-context set).  This leaks the allocations
from the other sub-contexts.  Separate the common frees from the
specific frees and call them at the appropriate time.

Using KEDR to check for memory leaks we get:

Before test:

[leak_check] Possible leaks: 25

After test:

[leak_check] Possible leaks: 31  (6 leaked data structures)

After patch applied (before and after test have the same value)

[leak_check] Possible leaks: 25

Each leak is 192 + 13440 + 6720 = 20352 bytes per sub-context.

Reviewed-by: Mike Marciniszyn 
Signed-off-by: Michael J. Ruhl 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/hfi1: Return an error on memory allocation failure

2017-05-25T13:44:37+00:00

commit 94679061dcdddbafcf24e3bfb526e54dedcc2f2f upstream.

If the eager buffer allocation fails, it is necessary to return
an error code.

Reviewed-by: Mike Marciniszyn 
Signed-off-by: Michael J. Ruhl 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

infiniband: call ipv6 route lookup via the stub interface

2017-05-25T13:44:32+00:00

commit eea40b8f624f25cbc02d55f2d93203f60cee9341 upstream.

The infiniband address handle can be triggered to resolve an ipv6
address in response to MAD packets, regardless of the ipv6
module being disabled via the kernel command line argument.

That will cause a call into the ipv6 routing code, which is not
initialized, and a conseguent oops.

This commit addresses the above issue replacing the direct lookup
call with an indirect one via the ipv6 stub, which is properly
initialized according to the ipv6 status (e.g. if ipv6 is
disabled, the routing lookup fails gracefully)

Signed-off-by: Paolo Abeni 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman