Skip to contentSkip to conversation

Patch "RDMA/vmw_pvrdma: Fix usage of user response structures in ABI file" has been added to the 4.15-stable tree

PATCH [email protected] 1 participant 1 message Mar 22, 2018

Subsystems (3)
Stable branch InfiniBand VMware pvrdma driver
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

RDMA/vmw_pvrdma: Fix usage of user response structures in ABI file

to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
rdma-vmw_pvrdma-fix-usage-of-user-response-structures-in-abi-file.patch
and it can be found in the queue-4.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 1f5a6c47aabc4606f91ad2e6ef71a1ff1924101c Mon Sep 17 00:00:00 2001

From: Adit Ranadive <[email protected]>
Date: Thu, 15 Feb 2018 12:36:46 -0800
Subject: RDMA/vmw_pvrdma: Fix usage of user response structures in ABI file

From: Adit Ranadive <[email protected]>

commit 1f5a6c47aabc4606f91ad2e6ef71a1ff1924101c upstream.

This ensures that we return the right structures back to userspace. Otherwise, it looks like the reserved fields in the response structures in userspace might have uninitialized data in them.

Fixes 8b10ba783c9d ("RDMA/vmw_pvrdma: Add shared receive queue support")
Fixes 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
Suggested-by Jason Gunthorpe <[email protected]>
Reviewed-by Bryan Tan <[email protected]>
Reviewed-by Aditya Sarwade <[email protected]>
Reviewed-by Jorgen Hansen <[email protected]>
Signed-off-by Adit Ranadive <[email protected]>
Signed-off-by Jason Gunthorpe <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c    |    4 +++-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c   |    4 +++-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c |    4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)
drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c +3 -1
@@ -114,6 +114,7 @@ struct ib_cq *pvrdma_create_cq(struct ib
 	union pvrdma_cmd_resp rsp;
 	struct pvrdma_cmd_create_cq *cmd = &req.create_cq;
 	struct pvrdma_cmd_create_cq_resp *resp = &rsp.create_cq_resp;
+	struct pvrdma_create_cq_resp cq_resp = {0};
 	struct pvrdma_create_cq ucmd;
 
 	BUILD_BUG_ON(sizeof(struct pvrdma_cqe) != 64);

@@ -198,6 +199,7 @@ struct ib_cq *pvrdma_create_cq(struct ib
 
 	cq->ibcq.cqe = resp->cqe;
 	cq->cq_handle = resp->cq_handle;
+	cq_resp.cqn = resp->cq_handle;
 	spin_lock_irqsave(&dev->cq_tbl_lock, flags);
 	dev->cq_tbl[cq->cq_handle % dev->dsr->caps.max_cq] = cq;
 	spin_unlock_irqrestore(&dev->cq_tbl_lock, flags);

@@ -206,7 +208,7 @@ struct ib_cq *pvrdma_create_cq(struct ib
 		cq->uar = &(to_vucontext(context)->uar);
 
 		/* Copy udata back. */
-		if (ib_copy_to_udata(udata, &cq->cq_handle, sizeof(__u32))) {
+		if (ib_copy_to_udata(udata, &cq_resp, sizeof(cq_resp))) {
 			dev_warn(&dev->pdev->dev,
 				 "failed to copy back udata\n");
 			pvrdma_destroy_cq(&cq->ibcq);
drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c +3 -1
@@ -113,6 +113,7 @@ struct ib_srq *pvrdma_create_srq(struct
 	union pvrdma_cmd_resp rsp;
 	struct pvrdma_cmd_create_srq *cmd = &req.create_srq;
 	struct pvrdma_cmd_create_srq_resp *resp = &rsp.create_srq_resp;
+	struct pvrdma_create_srq_resp srq_resp = {0};
 	struct pvrdma_create_srq ucmd;
 	unsigned long flags;
 	int ret;

@@ -204,12 +205,13 @@ struct ib_srq *pvrdma_create_srq(struct
 	}
 
 	srq->srq_handle = resp->srqn;
+	srq_resp.srqn = resp->srqn;
 	spin_lock_irqsave(&dev->srq_tbl_lock, flags);
 	dev->srq_tbl[srq->srq_handle % dev->dsr->caps.max_srq] = srq;
 	spin_unlock_irqrestore(&dev->srq_tbl_lock, flags);
 
 	/* Copy udata back. */
-	if (ib_copy_to_udata(udata, &srq->srq_handle, sizeof(__u32))) {
+	if (ib_copy_to_udata(udata, &srq_resp, sizeof(srq_resp))) {
 		dev_warn(&dev->pdev->dev, "failed to copy back udata\n");
 		pvrdma_destroy_srq(&srq->ibsrq);
 		return ERR_PTR(-EINVAL);
drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +3 -1
@@ -447,6 +447,7 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_
 	union pvrdma_cmd_resp rsp;
 	struct pvrdma_cmd_create_pd *cmd = &req.create_pd;
 	struct pvrdma_cmd_create_pd_resp *resp = &rsp.create_pd_resp;
+	struct pvrdma_alloc_pd_resp pd_resp = {0};
 	int ret;
 	void *ptr;
 

@@ -475,9 +476,10 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_
 	pd->privileged = !context;
 	pd->pd_handle = resp->pd_handle;
 	pd->pdn = resp->pd_handle;
+	pd_resp.pdn = resp->pd_handle;
 
 	if (context) {
-		if (ib_copy_to_udata(udata, &pd->pdn, sizeof(__u32))) {
+		if (ib_copy_to_udata(udata, &pd_resp, sizeof(pd_resp))) {
 			dev_warn(&dev->pdev->dev,
 				 "failed to copy back protection domain\n");
 			pvrdma_dealloc_pd(&pd->ibpd);

Patches currently in stable-queue which might be from [email protected] are

queue-4.15/rdma-vmw_pvrdma-fix-usage-of-user-response-structures-in-abi-file.patch