github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

RDMA/irdma: Add checks for no udata

Browse Source 
Several methods do not accept udata input and do not provide
a udata response. Use the ib_no_udata_io helper to check that
the input buffers are empty and to zero fill any user response
buffers. For methods that do provide a response, enforce the
input buffer is empty using ib_is_udata_in_empty.

The irdma rdma-core provider as well as the legacy i40iw
provider were both checked to ensure they never passed any
udata to these ops.

Signed-off-by: Jacob Moroni <jmoroni@google.com>
Link: https://patch.msgid.link/20260713171257.3131493-2-jmoroni@google.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
This commit is contained in:
Jacob Moroni 2026-07-13 17:12:52 +00:00 committed by Leon Romanovsky
parent d32fe5bb41
commit 9b5261a233
1 changed files with 62 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
drivers/infiniband/hw/irdma/verbs.c
View File

@ -406,6 +406,10 @@ static int irdma_alloc_pd(struct ib_pd *pd, struct ib_udata *udata)
u32 pd_id = 0;
int err;
err = ib_is_udata_in_empty(udata);
if (err)
return err;
if (udata && udata->outlen < IRDMA_ALLOC_PD_MIN_RESP_LEN)
return -EINVAL;
@ -444,6 +448,11 @@ static int irdma_dealloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
{
struct irdma_pd *iwpd = to_iwpd(ibpd);
struct irdma_device *iwdev = to_iwdev(ibpd->device);
int ret;
ret = ib_no_udata_io(udata);
if (ret)
return ret;
irdma_free_rsrc(iwdev->rf, iwdev->rf->allocated_pds, iwpd->sc_pd.pd_id);
@ -536,11 +545,10 @@ static int irdma_setup_push_mmap_entries(struct irdma_ucontext *ucontext,
}
/**
* irdma_destroy_qp - destroy qp
* _irdma_destroy_qp - destroy qp
* @ibqp: qp's ib pointer also to get to device's qp address
* @udata: user data
*/
static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
static void _irdma_destroy_qp(struct ib_qp *ibqp)
{
struct irdma_qp *iwqp = to_iwqp(ibqp);
struct irdma_device *iwdev = iwqp->iwdev;
@ -572,6 +580,22 @@ static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
if (iwqp->sc_qp.qp_uk.qp_id == 1)
iwdev->rf->hwqp1_rsvd = false;
irdma_free_qp_rsrc(iwqp);
}
/**
* irdma_destroy_qp - destroy qp
* @ibqp: qp's ib pointer also to get to device's qp address
* @udata: user data
*/
static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
{
int ret;
ret = ib_no_udata_io(udata);
if (ret)
return ret;
_irdma_destroy_qp(ibqp);
return 0;
}
@ -1126,7 +1150,7 @@ static int irdma_create_qp(struct ib_qp *ibqp,
err_code = ib_respond_udata(udata, uresp);
if (err_code) {
irdma_destroy_qp(&iwqp->ibqp, udata);
_irdma_destroy_qp(&iwqp->ibqp);
return err_code;
}
}
@ -1980,6 +2004,11 @@ static int irdma_destroy_srq(struct ib_srq *ibsrq, struct ib_udata *udata)
struct irdma_device *iwdev = to_iwdev(ibsrq->device);
struct irdma_srq *iwsrq = to_iwsrq(ibsrq);
struct irdma_sc_srq *srq = &iwsrq->sc_srq;
int ret;
ret = ib_no_udata_io(udata);
if (ret)
return ret;
irdma_srq_wq_destroy(iwdev->rf, srq);
irdma_srq_free_rsrc(iwdev->rf, iwsrq);
@ -2000,6 +2029,11 @@ static int irdma_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata)
struct irdma_sc_ceq *ceq = dev->ceq[cq->ceq_id];
struct irdma_ceq *iwceq = container_of(ceq, struct irdma_ceq, sc_ceq);
unsigned long flags;
int ret;
ret = ib_no_udata_io(udata);
if (ret)
return ret;
spin_lock_irqsave(&iwcq->lock, flags);
if (!list_empty(&iwcq->cmpl_generated))
@ -2234,6 +2268,10 @@ static int irdma_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
struct cqp_cmds_info *cqp_info;
int status;
status = ib_no_udata_io(udata);
if (status)
return status;
if (attr_mask & IB_SRQ_MAX_WR)
return -EINVAL;
@ -3079,6 +3117,10 @@ static int irdma_alloc_mw(struct ib_mw *ibmw, struct ib_udata *udata)
int err_code;
u32 stag;
err_code = ib_no_udata_io(udata);
if (err_code)
return err_code;
stag = irdma_create_stag(iwdev);
if (!stag)
return -ENOMEM;
@ -3830,6 +3872,10 @@ static struct ib_mr *irdma_rereg_user_mr(struct ib_mr *ib_mr, int flags,
struct ib_umem_dmabuf *umem_dmabuf;
int ret;
ret = ib_no_udata_io(udata);
if (ret)
return ERR_PTR(ret);
if (len > iwdev->rf->sc_dev.hw_attrs.max_mr_size)
return ERR_PTR(-EINVAL);
@ -4022,6 +4068,10 @@ static int irdma_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata)
bool dmabuf_revocable = iwmr->region && iwmr->region->is_dmabuf;
int ret;
ret = ib_no_udata_io(udata);
if (ret)
return ret;
if (iwmr->type != IRDMA_MEMREG_TYPE_MEM) {
if (iwmr->region) {
struct irdma_ucontext *ucontext;
@ -5343,6 +5393,10 @@ static int irdma_create_user_ah(struct ib_ah *ibah,
struct irdma_ah *parent_ah;
int err;
err = ib_is_udata_in_empty(udata);
if (err)
return err;
if (udata->outlen < IRDMA_CREATE_AH_MIN_RESP_LEN)
return -EINVAL;
@ -5394,6 +5448,10 @@ static int irdma_create_ah(struct ib_ah *ibah, struct rdma_ah_init_attr *attr,
struct irdma_device *iwdev = to_iwdev(ibah->pd->device);
int err;
err = ib_no_udata_io(udata);
if (err)
return err;
err = irdma_setup_ah(ibah, attr);
if (err)
return err;