linux-stable.git/net/smc, branch linux-5.17.y

net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *"

2022-06-14T16:41:22+00:00

[ Upstream commit e225c9a5a74b12e9ef8516f30a3db2c7eb866ee1 ]

"struct smc_cdc_tx_pend **" can not directly convert
to "struct smc_wr_tx_pend_priv *".

Fixes: 2bced6aefa3d ("net/smc: put slot when connection is killed")
Signed-off-by: Guangguan Wang 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net/smc: set ini->smcrv2.ib_dev_v2 to NULL if SMC-Rv2 is unavailable

2022-06-14T16:41:20+00:00

[ Upstream commit b3b1a17538d3ef6a9667b2271216fd16d7678ab5 ]

In the process of checking whether RDMAv2 is available, the current
implementation first sets ini->smcrv2.ib_dev_v2, and then allocates
smc buf desc and register rmb, but the latter may fail. In this case,
the pointer should be reset.

Fixes: e49300a6bf62 ("net/smc: add listen processing for SMC-Rv2")
Signed-off-by: liuyacan 
Reviewed-by: Karsten Graul 
Link: https://lore.kernel.org/r/20220525085408.812273-1-liuyacan@corp.netease.com
Signed-off-by: Jakub Kicinski 
Signed-off-by: Sasha Levin

Revert "net/smc: fix listen processing for SMC-Rv2"

2022-06-09T08:25:59+00:00

[ Upstream commit 9029ac03f20a5999bc5627277c6cf008ab8e23ed ]

This reverts commit 8c3b8dc5cc9bf6d273ebe18b16e2d6882bcfb36d.

Some rollback issue will be fixed in other patches in the future.

Link: https://lore.kernel.org/all/20220523055056.2078994-1-liuyacan@corp.netease.com/

Fixes: 8c3b8dc5cc9b ("net/smc: fix listen processing for SMC-Rv2")
Signed-off-by: liuyacan 
Link: https://lore.kernel.org/r/20220524090230.2140302-1-liuyacan@corp.netease.com
Signed-off-by: Jakub Kicinski 
Signed-off-by: Sasha Levin

net/smc: fix listen processing for SMC-Rv2

2022-06-09T08:25:58+00:00

[ Upstream commit 8c3b8dc5cc9bf6d273ebe18b16e2d6882bcfb36d ]

In the process of checking whether RDMAv2 is available, the current
implementation first sets ini->smcrv2.ib_dev_v2, and then allocates
smc buf desc, but the latter may fail. Unfortunately, the caller
will only check the former. In this case, a NULL pointer reference
will occur in smc_clc_send_confirm_accept() when accessing
conn->rmb_desc.

This patch does two things:
1. Use the return code to determine whether V2 is available.
2. If the return code is NODEV, continue to check whether V1 is
available.

Fixes: e49300a6bf62 ("net/smc: add listen processing for SMC-Rv2")
Signed-off-by: liuyacan 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net/smc: postpone sk_refcnt increment in connect()

2022-06-09T08:25:58+00:00

[ Upstream commit 75c1edf23b95a9c66923d9269d8e86e4dbde151f ]

Same trigger condition as commit 86434744. When setsockopt runs
in parallel to a connect(), and switch the socket into fallback
mode. Then the sk_refcnt is incremented in smc_connect(), but
its state stay in SMC_INIT (NOT SMC_ACTIVE). This cause the
corresponding sk_refcnt decrement in __smc_release() will not be
performed.

Fixes: 86434744fedf ("net/smc: add fallback check to connect()")
Signed-off-by: liuyacan 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending

2022-05-18T08:28:16+00:00

[ Upstream commit f3c46e41b32b6266cf60b0985c61748f53bf1c61 ]

Non blocking sendmsg will return -EAGAIN when any signal pending
and no send space left, while non blocking recvmsg return -EINTR
when signal pending and no data received. This may makes confused.
As TCP returns -EAGAIN in the conditions described above. Align the
behavior of smc with TCP.

Fixes: 846e344eb722 ("net/smc: add receive timeout check")
Signed-off-by: Guangguan Wang 
Reviewed-by: Tony Lu 
Acked-by: Karsten Graul 
Link: https://lore.kernel.org/r/20220512030820.73848-1-guangguan.wang@linux.alibaba.com
Signed-off-by: Jakub Kicinski 
Signed-off-by: Sasha Levin

net/smc: sync err code when tcp connection was refused

2022-05-09T07:16:23+00:00

[ Upstream commit 4e2e65e2e56c6ceb4ea1719360080c0af083229e ]

In the current implementation, when TCP initiates a connection
to an unavailable [ip,port], ECONNREFUSED will be stored in the
TCP socket, but SMC will not. However, some apps (like curl) use
getsockopt(,,SO_ERROR,,) to get the error information, which makes
them miss the error message and behave strangely.

Fixes: 50717a37db03 ("net/smc: nonblocking connect rework")
Signed-off-by: liuyacan 
Reviewed-by: Tony Lu 
Acked-by: Karsten Graul 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net/smc: Fix sock leak when release after smc_shutdown()

2022-04-27T12:41:00+00:00

[ Upstream commit 1a74e99323746353bba11562a2f2d0aa8102f402 ]

Since commit e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown
and fallback"), for a fallback connection, __smc_release() does not call
sock_put() if its state is already SMC_CLOSED.

When calling smc_shutdown() after falling back, its state is set to
SMC_CLOSED but does not call sock_put(), so this patch calls it.

Reported-and-tested-by: syzbot+6e29a053eb165bd50de5@syzkaller.appspotmail.com
Fixes: e5d5aadcf3cd ("net/smc: fix sk_refcnt underflow on linkdown and fallback")
Signed-off-by: Tony Lu 
Acked-by: Karsten Graul 
Signed-off-by: David S. Miller 
Signed-off-by: Sasha Levin

net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()

2022-04-20T07:36:15+00:00

[ Upstream commit d22f4f977236f97e01255a80bca2ea93a8094fc8 ]

dev_name() was called with dev.parent as argument but without to
NULL-check it before.
Solve this by checking the pointer before the call to dev_name().

Fixes: af5f60c7e3d5 ("net/smc: allow PCI IDs as ib device names in the pnet table")
Reported-by: syzbot+03e3e228510223dabd34@syzkaller.appspotmail.com
Signed-off-by: Karsten Graul 
Signed-off-by: Jakub Kicinski 
Signed-off-by: Sasha Levin

net/smc: use memcpy instead of snprintf to avoid out of bounds read

2022-04-20T07:36:15+00:00

[ Upstream commit b1871fd48efc567650dbdc974e5a2342a03fe0d2 ]

Using snprintf() to convert not null-terminated strings to null
terminated strings may cause out of bounds read in the source string.
Therefore use memcpy() and terminate the target string with a null
afterwards.

Fixes: fa0866625543 ("net/smc: add support for user defined EIDs")
Fixes: 3c572145c24e ("net/smc: add generic netlink support for system EID")
Signed-off-by: Karsten Graul 
Signed-off-by: Jakub Kicinski 
Signed-off-by: Sasha Levin