Patch "smc: switch to usage of IB_PD_UNSAFE_GLOBAL_RKEY" has been added to the 4.11-stable tree
This is a note to let you know that I've just added the patch titled
smc: switch to usage of IB_PD_UNSAFE_GLOBAL_RKEY
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
smc-switch-to-usage-of-ib_pd_unsafe_global_rkey.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From foo@baz Wed May 31 09:13:10 JST 2017
From: Ursula Braun <[email protected]>
Date: Mon, 15 May 2017 17:33:37 +0200
Subject: smc: switch to usage of IB_PD_UNSAFE_GLOBAL_RKEY
From: Ursula Braun <[email protected]>
[ Upstream commit 263eec9b2a82e8697d064709414914b5b10ac538 ]
Currently, SMC enables remote access to physical memory when a user has successfully configured and established an SMC-connection until ten minutes after the last SMC connection is closed. Because this is considered a security risk, drivers are supposed to use IB_PD_UNSAFE_GLOBAL_RKEY in such a case.
This patch changes the current SMC code to use IB_PD_UNSAFE_GLOBAL_RKEY. This improves user awareness, but does not remove the security risk itself.
--- net/smc/smc_clc.c | 4 ++-- net/smc/smc_core.c | 16 +++------------- net/smc/smc_core.h | 2 +- net/smc/smc_ib.c | 21 ++------------------- net/smc/smc_ib.h | 2 -- 5 files changed, 8 insertions(+), 37 deletions(-)
net/smc/smc_clc.c +2 -2
@@ -204,7 +204,7 @@ int smc_clc_send_confirm(struct smc_sockmemcpy (&cclc.lcl.mac, &link->smcibdev->mac[link->ibport -1 ],ETH_ALEN );hton24 (cclc.qpn, link->roce_qp->qp_num); cclc.rmb_rkey = -htonl (conn->rmb_desc->mr_rx[SMC_SINGLE_LINK ]->rkey); +htonl (conn->rmb_desc->rkey[SMC_SINGLE_LINK ]); cclc.conn_idx =1 ;/* for now: 1 RMB = 1 RMBE */ cclc.rmbe_alert_token =htonl (conn->alert_token_local); cclc.qp_mtu =min (link->path_mtu, link->peer_mtu);
@@ -256,7 +256,7 @@ int smc_clc_send_accept(struct smc_sockmemcpy (&aclc.lcl.mac, link->smcibdev->mac[link->ibport -1 ],ETH_ALEN );hton24 (aclc.qpn, link->roce_qp->qp_num); aclc.rmb_rkey = -htonl (conn->rmb_desc->mr_rx[SMC_SINGLE_LINK ]->rkey); +htonl (conn->rmb_desc->rkey[SMC_SINGLE_LINK ]); aclc.conn_idx =1 ;/* as long as 1 RMB = 1 RMBE */ aclc.rmbe_alert_token =htonl (conn->alert_token_local); aclc.qp_mtu = link->path_mtu;
net/smc/smc_core.c +3 -13
@@ -613,19 +613,8 @@ int smc_rmb_create(struct smc_sock *smc) rmb_desc =NULL ;continue ;/* if mapping failed, try smaller one */ } - rc =smc_ib_get_memory_region (lgr->lnk[SMC_SINGLE_LINK ].roce_pd, -IB_ACCESS_REMOTE_WRITE | -IB_ACCESS_LOCAL_WRITE , - &rmb_desc->mr_rx[SMC_SINGLE_LINK ]); -if (rc) { -smc_ib_buf_unmap (lgr->lnk[SMC_SINGLE_LINK ].smcibdev, - tmp_bufsize, rmb_desc, -DMA_FROM_DEVICE ); -kfree (rmb_desc->cpu_addr); -kfree (rmb_desc); - rmb_desc =NULL ; -continue ; - } + rmb_desc->rkey[SMC_SINGLE_LINK ] = + lgr->lnk[SMC_SINGLE_LINK ].roce_pd->unsafe_global_rkey; rmb_desc->used =1 ;write_lock_bh (&lgr->rmbs_lock); list_add(&rmb_desc->list,
@@ -668,6 +657,7 @@ int smc_rmb_rtoken_handling(struct smc_cfor (i =0 ; i <SMC_RMBS_PER_LGR_MAX ; i++) {if ((lgr->rtokens[i][SMC_SINGLE_LINK ].rkey == rkey) && + (lgr->rtokens[i][SMC_SINGLE_LINK ].dma_addr == dma_addr) &&test_bit (i, lgr->rtokens_used_mask)) { conn->rtoken_idx = i;return 0 ;
net/smc/smc_core.h +1 -1
@@ -93,7 +93,7 @@ struct smc_buf_desc {u64 dma_addr[SMC_LINKS_PER_LGR_MAX ];/* mapped address of buffer */ void *cpu_addr;/* virtual address of buffer */ -struct ib_mr *mr_rx[SMC_LINKS_PER_LGR_MAX ]; +u32 rkey[SMC_LINKS_PER_LGR_MAX ];/* for rmb only: * rkey provided to peer */
net/smc/smc_ib.c +2 -19
@@ -37,24 +37,6 @@ u8 local_systemid[SMC_SYSTEMID_LEN] = SM* identifier */ -int smc_ib_get_memory_region (struct ib_pd *pd,int access_flags, -struct ib_mr **mr) -{ -int rc; - -if (*mr) -return 0 ;/* already done */ - -/* obtain unique key - -* next invocation of get_dma_mr returns a different key! -*/ - *mr = pd->device->get_dma_mr (pd, access_flags); - rc =PTR_ERR_OR_ZERO (*mr); -if (IS_ERR (*mr)) - *mr =NULL ; -return rc; -} -static int smc_ib_modify_qp_init (struct smc_link *lnk) {struct ib_qp_attr qp_attr;
@@ -213,7 +195,8 @@ int smc_ib_create_protection_domain(stru {int rc; - lnk->roce_pd =ib_alloc_pd (lnk->smcibdev->ibdev,0 ); + lnk->roce_pd =ib_alloc_pd (lnk->smcibdev->ibdev, +IB_PD_UNSAFE_GLOBAL_RKEY ); rc =PTR_ERR_OR_ZERO (lnk->roce_pd);if (IS_ERR (lnk->roce_pd)) lnk->roce_pd =NULL ;
net/smc/smc_ib.h +0 -2
@@ -60,8 +60,6 @@ void smc_ib_dealloc_protection_domain(stint smc_ib_create_protection_domain (struct smc_link *lnk);void smc_ib_destroy_queue_pair (struct smc_link *lnk);int smc_ib_create_queue_pair (struct smc_link *lnk); -int smc_ib_get_memory_region (struct ib_pd *pd,int access_flags, -struct ib_mr **mr);int smc_ib_ready_link (struct smc_link *lnk);int smc_ib_modify_qp_rts (struct smc_link *lnk);int smc_ib_modify_qp_reset (struct smc_link *lnk);
Patches currently in stable-queue which might be from [email protected] are
queue-4.11/smc-switch-to-usage-of-ib_pd_unsafe_global_rkey.patch queue-4.11/s390-qeth-avoid-null-pointer-dereference-on-osn.patch queue-4.11/net-smc-add-warning-about-remote-memory-exposure.patch queue-4.11/s390-qeth-handle-sysfs-error-during-initialization.patch queue-4.11/s390-qeth-add-missing-hash-table-initializations.patch