linux.git/drivers/infiniband, branch v3.18.53

infiniband: mlx5: avoid a compile-time warning

2017-05-08T05:44:11+00:00

commit 7835bfb5261501590a508b3de3379e2231cb4853 upstream.

The return type of find_first_bit() is architecture specific,
on ARM it is 'unsigned int', while the asm-generic code used
on x86 and a lot of other architectures returns 'unsigned long'.

When building the mlx5 driver on ARM, we get a warning about
this:

infiniband/hw/mlx5/mem.c: In function 'mlx5_ib_cont_pages':
infiniband/hw/mlx5/mem.c:84:143: warning: comparison of distinct pointer types lacks a cast
     m = min(m, find_first_bit(&tmp, sizeof(tmp)));

This patch changes the driver to use min_t to make it behave
the same way on all architectures.

Signed-off-by: Arnd Bergmann 
Acked-by: Eli Cohen 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

IB/ehca: fix maybe-uninitialized warnings

2017-05-08T05:44:11+00:00

The driver causes two warnings about possibly uninitialized variables:

drivers/infiniband/hw/ehca/ehca_mrmw.c: In function 'ehca_set_pagebuf':
drivers/infiniband/hw/ehca/ehca_mrmw.c:1908:4: warning: 'prev_pgaddr' may be used uninitialized in this function [-Wmaybe-uninitialized]
drivers/infiniband/hw/ehca/ehca_mrmw.c:1924:14: note: 'prev_pgaddr' was declared here
drivers/infiniband/hw/ehca/ehca_mrmw.c: In function 'ehca_reg_mr':
drivers/infiniband/hw/ehca/ehca_mrmw.c:2430:5: warning: 'hret' may be used uninitialized in this function [-Wmaybe-uninitialized]

The first one is definitely a false positive, the second one may or may not
be one. In both cases, adding an intialization is the safe and easy
workaround.

The driver was removed in mainline in commit e581d111dad3
("staging/rdma: remove deprecated ehca driver"), in linux-4.6.
In 4.4, the file is located in drivers/staging/rdma/ehca/ehca_mrmw.c,
and the fix still applies.

Signed-off-by: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

IB/qib: rename BITS_PER_PAGE to RVT_BITS_PER_PAGE

2017-05-08T05:44:11+00:00

We get this build warning on arm64

drivers/infiniband/hw/qib/qib_qp.c:44:0: error: "BITS_PER_PAGE" redefined [-Werror]
 #define BITS_PER_PAGE           (PAGE_SIZE*BITS_PER_BYTE)

This is fixed upstream in commit 898fa52b4ac3 ("IB/qib: Remove qpn, qp tables and
related variables from qib"), which does a lot of other things as well.

Instead, I just backport the rename of the local BITS_PER_PAGE definition to
RVT_BITS_PER_PAGE.

The driver first showed up in linux-2.6.35, and the fixup should still apply
to that. The upstream fix went into v4.6, so we could apply this workaround
to both 3.18 and 4.4.

Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
Signed-off-by: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

IB/iser: Fix sparse warnings

2017-05-08T05:44:09+00:00

commit 49df2781b101a729e9f46eddc845a587fc5665a8 upstream.

Use uintptr_t to handle wr_id casting, which was found by Kbuild test
robot and smatch.  Also remove an internal definition of variable which
potentially shadows an external one (and make sparse happy).

Signed-off-by: Sagi Grimberg 
Signed-off-by: Or Gerlitz 
Signed-off-by: Roland Dreier 
Cc: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

IB/ipoib: Fix deadlock between rmmod and set_mode

2017-04-18T05:55:49+00:00

commit 0a0007f28304cb9fc87809c86abb80ec71317f20 upstream.

When calling set_mode from sys/fs, the call flow locks the sys/fs lock
first and then tries to lock rtnl_lock (when calling ipoib_set_mod).
On the other hand, the rmmod call flow takes the rtnl_lock first
(when calling unregister_netdev) and then tries to take the sys/fs
lock. Deadlock a->b, b->a.

The problem starts when ipoib_set_mod frees it's rtnl_lck and tries
to get it after that.

    set_mod:
    [] ? check_preempt_curr+0x6d/0x90
    [] __mutex_lock_slowpath+0x13e/0x180
    [] ? __rtnl_unlock+0x15/0x20
    [] mutex_lock+0x2b/0x50
    [] rtnl_lock+0x15/0x20
    [] ipoib_set_mode+0x97/0x160 [ib_ipoib]
    [] set_mode+0x3b/0x80 [ib_ipoib]
    [] dev_attr_store+0x20/0x30
    [] sysfs_write_file+0xe5/0x170
    [] vfs_write+0xb8/0x1a0
    [] sys_write+0x51/0x90
    [] system_call_fastpath+0x16/0x1b

    rmmod:
    [] ? put_dec+0x10c/0x110
    [] ? number+0x2ee/0x320
    [] schedule_timeout+0x215/0x2e0
    [] ? vsnprintf+0x484/0x5f0
    [] ? string+0x40/0x100
    [] wait_for_common+0x123/0x180
    [] ? default_wake_function+0x0/0x20
    [] ? ifind_fast+0x5e/0xb0
    [] wait_for_completion+0x1d/0x20
    [] sysfs_addrm_finish+0x228/0x270
    [] sysfs_remove_dir+0xa3/0xf0
    [] kobject_del+0x16/0x40
    [] device_del+0x184/0x1e0
    [] netdev_unregister_kobject+0xab/0xc0
    [] rollback_registered+0xae/0x130
    [] unregister_netdevice+0x22/0x70
    [] unregister_netdev+0x1e/0x30
    [] ipoib_remove_one+0xe0/0x120 [ib_ipoib]
    [] ib_unregister_device+0x4f/0x100 [ib_core]
    [] mlx4_ib_remove+0x41/0x180 [mlx4_ib]
    [] mlx4_remove_device+0x71/0x90 [mlx4_core]

Fixes: 862096a8bbf8 ("IB/ipoib: Add more rtnl_link_ops callbacks")
Cc: Or Gerlitz 
Signed-off-by: Feras Daoud 
Signed-off-by: Erez Shitrit 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IPoIB: Avoid reading an uninitialized member variable

2017-01-15T14:49:52+00:00

[ Upstream commit 11b642b84e8c43e8597de031678d15c08dd057bc ]

This patch avoids that Coverity reports the following:

    Using uninitialized value port_attr.state when calling printk

Fixes: commit 94232d9ce817 ("IPoIB: Start multicast join process only on active ports")
Signed-off-by: Bart Van Assche 
Cc: Erez Shitrit 
Cc: 
Reviewed-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs

2016-07-12T12:46:55+00:00

[ Upstream commit 8c5122e45a10a9262f872b53f151a592e870f905 ]

When this code was reworked for IBoE support the order of assignments
for the sl_tclass_flowlabel got flipped around resulting in
TClass & FlowLabel being permanently set to 0 in the packet headers.

This breaks IB routers that rely on these headers, but only affects
kernel users - libmlx4 does this properly for user space.

Cc: stable@vger.kernel.org
Fixes: fa417f7b520e ("IB/mlx4: Add support for IBoE")
Signed-off-by: Jason Gunthorpe 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

IB/security: Restrict use of the write() interface

2016-05-17T18:51:48+00:00

[ Upstream commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3 ]

The drivers/infiniband stack uses write() as a replacement for
bi-directional ioctl().  This is not safe. There are ways to
trigger write calls that result in the return structure that
is normally written to user space being shunted off to user
specified kernel memory instead.

For the immediate repair, detect and deny suspicious accesses to
the write API.

For long term, update the user space libraries and the kernel API
to something that doesn't present the same security vulnerabilities
(likely a structured ioctl() interface).

The impacted uAPI interfaces are generally only available if
hardware from drivers/infiniband is installed in the system.

Reported-by: Jann Horn 
Signed-off-by: Linus Torvalds 
Signed-off-by: Jason Gunthorpe 
[ Expanded check to all known write() entry points ]
Cc: stable@vger.kernel.org
Signed-off-by: Doug Ledford 

Signed-off-by: Sasha Levin

IB/srpt: Simplify srpt_handle_tsk_mgmt()

2016-04-18T12:49:20+00:00

[ Upstream commit 51093254bf879bc9ce96590400a87897c7498463 ]

Let the target core check task existence instead of the SRP target
driver. Additionally, let the target core check the validity of the
task management request instead of the ib_srpt driver.

This patch fixes the following kernel crash:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000001
IP: [] srpt_handle_new_iu+0x6d7/0x790 [ib_srpt]
Oops: 0002 [#1] SMP
Call Trace:
 [] srpt_process_completion+0xde/0x570 [ib_srpt]
 [] srpt_compl_thread+0x13f/0x160 [ib_srpt]
 [] kthread+0xcf/0xe0
 [] ret_from_fork+0x7c/0xb0

Signed-off-by: Bart Van Assche 
Fixes: 3e4f574857ee ("ib_srpt: Convert TMR path to target_submit_tmr")
Tested-by: Alex Estrin 
Reviewed-by: Christoph Hellwig 
Cc: Nicholas Bellinger 
Cc: Sagi Grimberg 
Cc: stable 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin

iw_cxgb3: Fix incorrectly returning error on success

2016-04-14T00:44:36+00:00

[ Upstream commit 67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 ]

The cxgb3_*_send() functions return NET_XMIT_ values, which are
positive integers values. So don't treat positive return values
as an error.

Signed-off-by: Steve Wise 
Signed-off-by: Hariprasad Shenai 
Signed-off-by: Doug Ledford 
Signed-off-by: Sasha Levin