create_flow/destroy_flow fixes for v3.13

Hi Roland,

Please find the fourth revision of a patchset against create_flow/destroy_flow and associated extended command scheme.

These are fixes that *must* be applied before making the new uverbs widely available in v3.13:

- patches 1, 2 and 3 address a warning reported by sparse.
- patch 4 handle an uncommon type of extended command.
- patch 5, 6 and 7 ensure that commands will be extensible:
- one patch add a missing check of comp_mask;
- the other patches add checks on reserved fields.
- patch 8 fix an error path which was not setting the error code.
- patch 9 ensure the response buffer of an extended command is a valid memory region for userspace. Doing the check earlier, on the *full* response buffer, might be safer.
- patch 10 prevent out of bound access and underflow.

Please review, test and apply for v3.13.

Changes from patchset v3 [1]:

- add a patch to hold 'response' pointer to remove the redundant cast introduced by patch to remove implicit cast from INIT_UDATA()
- rework some commit messages to address review made by Roland.

Changes from patchset v2 [2]:

- add a patch to check the input length in extended uverbs, create_flow and destroy_flow.

Changes from patchset v1 [3]:

- add patch to verify early response buffer using access_ok(), just like vfs_read().

Regards.

[1] [PATCHv3 for-3.13 0/9] create_flow/destroy_flow fixes for v3.13

    http://marc.info/?i=cover.1386798254.git.ydroneaud-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org

[2] [PATCH v2 for v3.13 0/8] create_flow/destroy_flow fixes for v3.13

    http://marc.info/?i=cover.1385981934.git.ydroneaud-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org

[3] [PATCH for v3.13 0/7] create_flow/destroy_flow fixes for v3.13

    http://marc.info/?i=cover.1385501822.git.ydroneaud-RlY5vtjFyJ3QT0dZR+AlfA@public.gmane.org

Yann Droneaud (10):
IB/uverbs: move cast from u64 to void __user pointer to it's own
variable
IB/core: const'ify inbuf in struct ib_udata
IB/uverbs: remove implicit cast in INIT_UDATA()
IB/uverbs: set outbuf to NULL when no core response space is provided IB/uverbs: check reserved field in extended command header IB/uverbs: check comp_mask in destroy_flow
IB/uverbs: check reserved fields in create_flow
IB/uverbs: set error code when fail to consume all flow_spec items IB/uverbs: check access to userspace response buffer in extended
command
IB/uverbs: check input length in flow steering uverbs

 drivers/infiniband/core/uverbs.h      |  12 +--
 drivers/infiniband/core/uverbs_cmd.c  | 175 +++++++++++++++++++++++-----------
 drivers/infiniband/core/uverbs_main.c |  21 +++-
 include/rdma/ib_verbs.h               |   2 +-
 4 files changed, 144 insertions(+), 66 deletions(-)

1.8.4.2

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html