lkml.org 
[lkml]   [2019]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 312/313] IB/hfi1: Add limit test for RC/UC send via loopback
    Date
    4.19-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Mike Marciniszyn <mike.marciniszyn@intel.com>

    commit 09ce351dff8e7636af0beb72cd4a86c3904a0500 upstream.

    Fix potential memory corruption and panic in loopback for IB_WR_SEND
    variants.

    The code blindly assumes the posted length will fit in the fetched rwqe,
    which is not a valid assumption.

    Fix by adding a limit test, and triggering the appropriate send completion
    and putting the QP in an error state. This mimics the handling for
    non-loopback QPs.

    Fixes: 15703461533a ("IB/{hfi1, qib, rdmavt}: Move ruc_loopback to rdmavt")
    Cc: <stable@vger.kernel.org> #v4.20+
    Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
    Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
    Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
    Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>

    ---
    drivers/infiniband/hw/hfi1/ruc.c | 7 ++++++-
    drivers/infiniband/hw/qib/qib_ruc.c | 7 ++++++-
    2 files changed, 12 insertions(+), 2 deletions(-)

    --- a/drivers/infiniband/hw/hfi1/ruc.c
    +++ b/drivers/infiniband/hw/hfi1/ruc.c
    @@ -278,6 +278,8 @@ send:
    goto op_err;
    if (!ret)
    goto rnr_nak;
    + if (wqe->length > qp->r_len)
    + goto inv_err;
    break;

    case IB_WR_RDMA_WRITE_WITH_IMM:
    @@ -445,7 +447,10 @@ op_err:
    goto err;

    inv_err:
    - send_status = IB_WC_REM_INV_REQ_ERR;
    + send_status =
    + sqp->ibqp.qp_type == IB_QPT_RC ?
    + IB_WC_REM_INV_REQ_ERR :
    + IB_WC_SUCCESS;
    wc.status = IB_WC_LOC_QP_OP_ERR;
    goto err;

    --- a/drivers/infiniband/hw/qib/qib_ruc.c
    +++ b/drivers/infiniband/hw/qib/qib_ruc.c
    @@ -274,6 +274,8 @@ again:
    goto op_err;
    if (!ret)
    goto rnr_nak;
    + if (wqe->length > qp->r_len)
    + goto inv_err;
    break;

    case IB_WR_RDMA_WRITE_WITH_IMM:
    @@ -434,7 +436,10 @@ op_err:
    goto err;

    inv_err:
    - send_status = IB_WC_REM_INV_REQ_ERR;
    + send_status =
    + sqp->ibqp.qp_type == IB_QPT_RC ?
    + IB_WC_REM_INV_REQ_ERR :
    + IB_WC_SUCCESS;
    wc.status = IB_WC_LOC_QP_OP_ERR;
    goto err;


    \
     
     \ /
      Last update: 2019-02-11 16:34    [W:4.032 / U:0.788 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site