Skip to contentSkip to conversation

RDMA/vmw_pvrdma: Fix usage of user response structures in ABI file

PATCH Applied Adit Ranadive 2 participants 2 messages Feb 15, 2018 1 message not in the archive

Subsystems (2)
InfiniBand VMware pvrdma driver
lore
Share & tools
lore

Adit Ranadive

author
#0 lore raw

PATCH 1/1 RDMA/vmw_pvrdma: Fix usage of user response structures in ABI file

Hi Doug, Jason,

Here is a patch for the vmw_pvrdma driver for the 4.16 RC.

Thanks,
Adit
---
This ensures that we return the right structures back to userspace. Otherwise, it looks like the reserved fields in the response structures in userspace might have uninitialized data in them.

Fixes 8b10ba783c9d ("RDMA/vmw_pvrdma: Add shared receive queue support")
Fixes 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
Suggested-by Jason Gunthorpe <jgg-VPRAkNaXOzVWk0Htik3J/[email protected]>
Reviewed-by Bryan Tan <[email protected]>
Reviewed-by Aditya Sarwade <[email protected]>
Reviewed-by Jorgen Hansen <[email protected]>
Signed-off-by Adit Ranadive <[email protected]>
---
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c    | 4 +++-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c   | 4 +++-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)
drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c +3 -1
index faa9478..f95b976 100644
@@ -114,6 +114,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev,
 	union pvrdma_cmd_resp rsp;
 	struct pvrdma_cmd_create_cq *cmd = &req.create_cq;
 	struct pvrdma_cmd_create_cq_resp *resp = &rsp.create_cq_resp;
+	struct pvrdma_create_cq_resp cq_resp = {0};
 	struct pvrdma_create_cq ucmd;
 
 	BUILD_BUG_ON(sizeof(struct pvrdma_cqe) != 64);

@@ -197,6 +198,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev,
 
 	cq->ibcq.cqe = resp->cqe;
 	cq->cq_handle = resp->cq_handle;
+	cq_resp.cqn = resp->cq_handle;
 	spin_lock_irqsave(&dev->cq_tbl_lock, flags);
 	dev->cq_tbl[cq->cq_handle % dev->dsr->caps.max_cq] = cq;
 	spin_unlock_irqrestore(&dev->cq_tbl_lock, flags);

@@ -205,7 +207,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev,
 		cq->uar = &(to_vucontext(context)->uar);
 
 		/* Copy udata back. */
-		if (ib_copy_to_udata(udata, &cq->cq_handle, sizeof(__u32))) {
+		if (ib_copy_to_udata(udata, &cq_resp, sizeof(cq_resp))) {
 			dev_warn(&dev->pdev->dev,
 				 "failed to copy back udata\n");
 			pvrdma_destroy_cq(&cq->ibcq);
drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c +3 -1
index 5acebb1..af23596 100644
@@ -113,6 +113,7 @@ struct ib_srq *pvrdma_create_srq(struct ib_pd *pd,
 	union pvrdma_cmd_resp rsp;
 	struct pvrdma_cmd_create_srq *cmd = &req.create_srq;
 	struct pvrdma_cmd_create_srq_resp *resp = &rsp.create_srq_resp;
+	struct pvrdma_create_srq_resp srq_resp = {0};
 	struct pvrdma_create_srq ucmd;
 	unsigned long flags;
 	int ret;

@@ -204,12 +205,13 @@ struct ib_srq *pvrdma_create_srq(struct ib_pd *pd,
 	}
 
 	srq->srq_handle = resp->srqn;
+	srq_resp.srqn = resp->srqn;
 	spin_lock_irqsave(&dev->srq_tbl_lock, flags);
 	dev->srq_tbl[srq->srq_handle % dev->dsr->caps.max_srq] = srq;
 	spin_unlock_irqrestore(&dev->srq_tbl_lock, flags);
 
 	/* Copy udata back. */
-	if (ib_copy_to_udata(udata, &srq->srq_handle, sizeof(__u32))) {
+	if (ib_copy_to_udata(udata, &srq_resp, sizeof(srq_resp))) {
 		dev_warn(&dev->pdev->dev, "failed to copy back udata\n");
 		pvrdma_destroy_srq(&srq->ibsrq);
 		return ERR_PTR(-EINVAL);
drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +3 -1
index 16b9661..a51463c 100644
@@ -447,6 +447,7 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev,
 	union pvrdma_cmd_resp rsp;
 	struct pvrdma_cmd_create_pd *cmd = &req.create_pd;
 	struct pvrdma_cmd_create_pd_resp *resp = &rsp.create_pd_resp;
+	struct pvrdma_alloc_pd_resp pd_resp = {0};
 	int ret;
 	void *ptr;
 

@@ -475,9 +476,10 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev,
 	pd->privileged = !context;
 	pd->pd_handle = resp->pd_handle;
 	pd->pdn = resp->pd_handle;
+	pd_resp.pdn = resp->pd_handle;
 
 	if (context) {
-		if (ib_copy_to_udata(udata, &pd->pdn, sizeof(__u32))) {
+		if (ib_copy_to_udata(udata, &pd_resp, sizeof(pd_resp))) {
 			dev_warn(&dev->pdev->dev,
 				 "failed to copy back protection domain\n");
 			pvrdma_dealloc_pd(&pd->ibpd);
Signature · 6 lines
2.7.4

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

A message that is not in the archive (sent off-list or not yet received): 1518727006-4073-1-git-send-email-aditr-pghWNbHTmq7QT0dZR+AlfA@public.gmane.org

Applied
#2 lore raw
Quoted 17 lines · Adit Ranadive

Hi Doug, Jason,

Here is a patch for the vmw_pvrdma driver for the 4.16 RC.

Thanks,
Adit
This ensures that we return the right structures back to userspace. Otherwise, it looks like the reserved fields in the response structures in userspace might have uninitialized data in them.

Fixes 8b10ba783c9d ("RDMA/vmw_pvrdma: Add shared receive queue support")
Fixes 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
Suggested-by Jason Gunthorpe <jgg-VPRAkNaXOzVWk0Htik3J/[email protected]>
Reviewed-by Bryan Tan <[email protected]>
Reviewed-by Aditya Sarwade <[email protected]>
Reviewed-by Jorgen Hansen <[email protected]>
Signed-off-by Adit Ranadive <[email protected]>
Quoted 4 lines
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c    | 4 +++-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c   | 4 +++-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 4 +++-
 3 files changed, 9 insertions(+), 3 deletions(-)

Applied to -rc, but next time please send patches in the cannonical format the commit message did not apply properly. See Documentation/process/submitting-patches.rst

Jason
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html