linux-stable.git/drivers/vdpa, branch v6.2.2

vdpa: ifcvf: Do proper cleanup if IFCVF init fails

2023-01-27T11:18:41+00:00

ifcvf_mgmt_dev leaks memory if it is not freed before
returning. Call is made to correct return statement
so memory does not leak. ifcvf_init_hw does not take
care of this so it is needed to do it here.

Signed-off-by: Tanmay Bhushan <007047221b@gmail.com>
Message-Id: <772e9fe133f21fa78fb98a2ebe8969efbbd58e3c.camel@gmail.com>
Signed-off-by: Michael S. Tsirkin 
Acked-by: Jason Wang 
Acked-by: Zhu Lingshan

vdpa_sim_net: should not drop the multicast/broadcast packet

2022-12-28T10:28:11+00:00

In the receive_filter(), should not drop the packet with the
broadcast/multicast address. Add the check for this

Signed-off-by: Cindy Lu 
Message-Id: <20221214054306.24145-1-lulu@redhat.com>
Signed-off-by: Michael S. Tsirkin 
Acked-by: Jason Wang

vdpasim: fix memory leak when freeing IOTLBs

2022-12-28T10:28:11+00:00

After commit bda324fd037a ("vdpasim: control virtqueue support"),
vdpasim->iommu became an array of IOTLB, so we should clean the
mappings of each free one by one instead of just deleting the ranges
in the first IOTLB which may leak maps.

Fixes: bda324fd037a ("vdpasim: control virtqueue support")
Cc: Gautam Dawar 
Signed-off-by: Jason Wang 
Message-Id: <20221213090717.61529-1-jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin 
Reviewed-by: Gautam Dawar

vdpa: conditionally fill max max queue pair for stats

2022-12-28T10:28:11+00:00

For the device without multiqueue feature, we will read 0 as
max_virtqueue_pairs from the config. So if we fill
VDPA_ATTR_DEV_NET_CFG_MAX_VQP with the value we read from the config
we will confuse the user.

Fixing this by only filling the value when multiqueue is offered by
the device so userspace can assume 1 when the attr is not provided.

Fixes: 13b00b135665c("vdpa: Add support for querying vendor statistics")
Cc: Eli Cohen 
Signed-off-by: Jason Wang 
Message-Id: <20220907060110.4511-1-jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin 
Reviewed-by: Eli Cohen

vdpa/vp_vdpa: fix kfree a wrong pointer in vp_vdpa_remove

2022-12-28T10:28:11+00:00

In vp_vdpa_remove(), the code kfree(&vp_vdpa_mgtdev->mgtdev.id_table) uses
a reference of pointer as the argument of kfree, which is the wrong pointer
and then may hit crash like this:

Unable to handle kernel paging request at virtual address 00ffff003363e30c
Internal error: Oops: 96000004 [#1] SMP
Call trace:
 rb_next+0x20/0x5c
 ext4_readdir+0x494/0x5c4 [ext4]
 iterate_dir+0x168/0x1b4
 __se_sys_getdents64+0x68/0x170
 __arm64_sys_getdents64+0x24/0x30
 el0_svc_common.constprop.0+0x7c/0x1bc
 do_el0_svc+0x2c/0x94
 el0_svc+0x20/0x30
 el0_sync_handler+0xb0/0xb4
 el0_sync+0x160/0x180
Code: 54000220 f9400441 b4000161 aa0103e0 (f9400821)
SMP: stopping secondary CPUs
Starting crashdump kernel...

Fixes: ffbda8e9df10 ("vdpa/vp_vdpa : add vdpa tool support in vp_vdpa")
Signed-off-by: Rong Wang 
Signed-off-by: Nanyong Sun 
Message-Id: <20221207120813.2837529-1-sunnanyong@huawei.com>
Signed-off-by: Michael S. Tsirkin 
Reviewed-by: Cindy Lu 
Acked-by: Jason Wang

vduse: Validate vq_num in vduse_validate_config()

2022-12-28T10:28:11+00:00

Add a limit to 'config->vq_num' which is user controlled data which
comes from an vduse_ioctl to prevent large memory allocations.

Micheal says  - This limit is somewhat arbitrary.
However, currently virtio pci and ccw are limited to a 16 bit vq number.
While MMIO isn't it is also isn't used with lots of VQs due to
current lack of support for per-vq interrupts.
Thus, the 0xffff limit on number of VQs corresponding
to a 16-bit VQ number seems sufficient for now.

This is found using static analysis with smatch.

Suggested-by: Michael S. Tsirkin 
Signed-off-by: Harshit Mogalapalli 
Message-Id: <20221128155717.2579992-1-harshit.m.mogalapalli@oracle.com>
Signed-off-by: Michael S. Tsirkin 
Acked-by: Jason Wang

vdpa_sim: fix vringh initialization in vdpasim_queue_ready()

2022-12-28T10:28:10+00:00

When we initialize vringh, we should pass the features and the
number of elements in the virtqueue negotiated with the driver,
otherwise operations with vringh may fail.

This was discovered in a case where the driver sets a number of
elements in the virtqueue different from the value returned by
.get_vq_num_max().

In vdpasim_vq_reset() is safe to initialize the vringh with
default values, since the virtqueue will not be used until
vdpasim_queue_ready() is called again.

Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator")
Signed-off-by: Stefano Garzarella 
Message-Id: <20221110141335.62171-1-sgarzare@redhat.com>
Signed-off-by: Michael S. Tsirkin 
Acked-by: Jason Wang 
Acked-by: Eugenio Pérez

vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init()

2022-12-28T10:28:10+00:00

Inject fault while probing module, if device_register() fails in
vdpasim_net_init() or vdpasim_blk_init(), but the refcount of kobject is
not decreased to 0, the name allocated in dev_set_name() is leaked.
Fix this by calling put_device(), so that name can be freed in
callback function kobject_cleanup().

(vdpa_sim_net)
unreferenced object 0xffff88807eebc370 (size 16):
  comm "modprobe", pid 3848, jiffies 4362982860 (age 18.153s)
  hex dump (first 16 bytes):
    76 64 70 61 73 69 6d 5f 6e 65 74 00 6b 6b 6b a5  vdpasim_net.kkk.
  backtrace:
    [] __kmalloc_node_track_caller+0x4e/0x150
    [] kstrdup+0x33/0x60
    [] kobject_set_name_vargs+0x41/0x110
    [] dev_set_name+0xab/0xe0
    [] device_add+0xe3/0x1a80
    [] 0xffffffffa0270013
    [] do_one_initcall+0x87/0x2e0
    [] do_init_module+0x1ab/0x640
    [] load_module+0x5d00/0x77f0
    [] __do_sys_finit_module+0x110/0x1b0
    [] do_syscall_64+0x35/0x80
    [] entry_SYSCALL_64_after_hwframe+0x46/0xb0

(vdpa_sim_blk)
unreferenced object 0xffff8881070c1250 (size 16):
  comm "modprobe", pid 6844, jiffies 4364069319 (age 17.572s)
  hex dump (first 16 bytes):
    76 64 70 61 73 69 6d 5f 62 6c 6b 00 6b 6b 6b a5  vdpasim_blk.kkk.
  backtrace:
    [] __kmalloc_node_track_caller+0x4e/0x150
    [] kstrdup+0x33/0x60
    [] kobject_set_name_vargs+0x41/0x110
    [] dev_set_name+0xab/0xe0
    [] device_add+0xe3/0x1a80
    [] 0xffffffffa0220013
    [] do_one_initcall+0x87/0x2e0
    [] do_init_module+0x1ab/0x640
    [] load_module+0x5d00/0x77f0
    [] __do_sys_finit_module+0x110/0x1b0
    [] do_syscall_64+0x35/0x80
    [] entry_SYSCALL_64_after_hwframe+0x46/0xb0

Fixes: 899c4d187f6a ("vdpa_sim_blk: add support for vdpa management tool")
Fixes: a3c06ae158dd ("vdpa_sim_net: Add support for user supported devices")

Signed-off-by: ruanjinjie 
Reviewed-by: Stefano Garzarella 
Message-Id: <20221110082348.4105476-1-ruanjinjie@huawei.com>
Signed-off-by: Michael S. Tsirkin 
Acked-by: Jason Wang

RDMA/mlx5: remove variable i

2022-12-28T10:28:09+00:00

Variable i is just being incremented and it's never used
anywhere else. The variable and the increment are redundant so
remove it.

Signed-off-by: Colin Ian King 
Message-Id: <20221024133756.2158497-1-colin.i.king@gmail.com>
Signed-off-by: Michael S. Tsirkin

vdpa/mlx5: Avoid overwriting CVQ iotlb

2022-12-28T10:28:09+00:00

When qemu uses different address spaces for data and control virtqueues,
the current code would overwrite the control virtqueue iotlb through the
dup_iotlb call. Fix this by referring to the address space identifier
and the group to asid mapping to determine which mapping needs to be
updated. We also move the address space logic from mlx5 net to core
directory.

Reported-by: Eugenio Pérez 
Signed-off-by: Eli Cohen 
Message-Id: <20221114131759.57883-6-elic@nvidia.com>
Signed-off-by: Michael S. Tsirkin 
Acked-by: Jason Wang 
Acked-by: Eugenio Pérez