github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 22:14:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

RDMA/ionic: Add robust udata compatibility checks to all uapi verbs

Browse Source 
Enable the robust udata contract by setting uverbs_robust_udata and
adding proper input validation and output handling to all verbs that
accept struct ib_udata.

For verbs with no driver request or response struct, add
ib_no_udata_io(). For create_ah, which already responds with
ionic_ah_resp, add the missing input validation via
ib_is_udata_in_empty().

Signed-off-by: Abhijit Gangurde <abhijit.gangurde@amd.com>
Link: https://patch.msgid.link/20260717092345.2533564-1-abhijit.gangurde@amd.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
This commit is contained in:
Abhijit Gangurde 2026-07-17 14:53:45 +05:30 committed by Leon Romanovsky
parent eb70d83a86
commit 28a06de731
2 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
drivers/infiniband/hw/ionic/ionic_controlpath.c
View File

@ -487,6 +487,11 @@ int ionic_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
{
struct ionic_ibdev *dev = to_ionic_ibdev(ibpd->device);
struct ionic_pd *pd = to_ionic_pd(ibpd);
int rc;
rc = ib_no_udata_io(udata);
if (rc)
return rc;
return ionic_get_pdid(dev, &pd->pdid);
}
@ -495,6 +500,11 @@ int ionic_dealloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
{
struct ionic_ibdev *dev = to_ionic_ibdev(ibpd->device);
struct ionic_pd *pd = to_ionic_pd(ibpd);
int rc;
rc = ib_no_udata_io(udata);
if (rc)
return rc;
ionic_put_pdid(dev, pd->pdid);
@ -741,6 +751,10 @@ int ionic_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *init_attr,
u32 flags = init_attr->flags;
int rc;
rc = ib_is_udata_in_empty(udata);
if (rc)
return rc;
rc = ionic_get_ahid(dev, &ah->ahid);
if (rc)
return rc;
@ -877,6 +891,10 @@ struct ib_mr *ionic_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 length,
unsigned long pg_sz;
int rc;
rc = ib_no_udata_io(udata);
if (rc)
return ERR_PTR(rc);
if (dmah)
return ERR_PTR(-EOPNOTSUPP);
@ -1008,6 +1026,10 @@ int ionic_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
struct ionic_mr *mr = to_ionic_mr(ibmr);
int rc;
rc = ib_no_udata_io(udata);
if (rc)
return rc;
if (!mr->ibmr.lkey)
goto out;
@ -1120,6 +1142,10 @@ int ionic_alloc_mw(struct ib_mw *ibmw, struct ib_udata *udata)
struct ionic_mr *mr = to_ionic_mw(ibmw);
int rc;
rc = ib_no_udata_io(udata);
if (rc)
return rc;
rc = ionic_get_mrid(dev, &mr->mrid);
if (rc)
return rc;
@ -1292,6 +1318,10 @@ int ionic_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
struct ionic_vcq *vcq = to_ionic_vcq(ibcq);
int udma_idx, rc_tmp, rc = 0;
rc = ib_no_udata_io(udata);
if (rc)
return rc;
for (udma_idx = dev->lif_cfg.udma_count; udma_idx; ) {
--udma_idx;
@ -2585,6 +2615,10 @@ int ionic_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int mask,
struct ionic_qp *qp = to_ionic_qp(ibqp);
int rc;
rc = ib_no_udata_io(udata);
if (rc)
return rc;
rc = ionic_check_modify_qp(qp, attr, mask);
if (rc)
return rc;
@ -2658,6 +2692,10 @@ int ionic_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
struct ionic_cq *cq;
int rc;
rc = ib_no_udata_io(udata);
if (rc)
return rc;
rc = ionic_destroy_qp_cmd(dev, qp->qpid);
if (rc)
return rc;

1
drivers/infiniband/hw/ionic/ionic_ibdev.c
View File

@ -216,6 +216,7 @@ static const struct ib_device_ops ionic_dev_ops = {
.owner = THIS_MODULE,
.driver_id = RDMA_DRIVER_IONIC,
.uverbs_abi_ver = IONIC_ABI_VERSION,
.uverbs_robust_udata = true,
.alloc_ucontext = ionic_alloc_ucontext,
.dealloc_ucontext = ionic_dealloc_ucontext,