Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e093111d authored by Amrani, Ram's avatar Amrani, Ram Committed by Doug Ledford
Browse files

IB/core: Fix input len in multiple user verbs 



Most user verbs pass user data to the kernel with the inclusion of the
ib_uverbs_cmd_hdr structure. This is problematic because the vendor has
no ideas if the verb was called by a legacy verb or an extended verb.
Also, the incosistency between the verbs is confusing.

Fixes: 565197dd ("IB/core: Extend ib_uverbs_create_cq")
Signed-off-by: default avatarRam Amrani <Ram.Amrani@cavium.com>
Signed-off-by: default avatarAriel Elior <Ariel.Elior@cavium.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 18c90df9

drivers/infiniband/core/uverbs_cmd.c

+40 −30
Original line number Original line Diff line number Diff line
@@ -91,9 +91,10 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file, 
		goto err;

		goto err;

	}

	}





	INIT_UDATA(&udata, buf + sizeof cmd,

	INIT_UDATA(&udata, buf + sizeof(cmd),

		   (unsigned long) cmd.response + sizeof resp,

		   (unsigned long) cmd.response + sizeof(resp),

		   in_len - sizeof cmd, out_len - sizeof resp);

		   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),

		   out_len - sizeof(resp));





	ret = ib_rdmacg_try_charge(&cg_obj, ib_dev, RDMACG_RESOURCE_HCA_HANDLE);

	ret = ib_rdmacg_try_charge(&cg_obj, ib_dev, RDMACG_RESOURCE_HCA_HANDLE);

	if (ret)

	if (ret)
@@ -319,9 +320,10 @@ ssize_t ib_uverbs_alloc_pd(struct ib_uverbs_file *file, 
	if (copy_from_user(&cmd, buf, sizeof cmd))

	if (copy_from_user(&cmd, buf, sizeof cmd))

		return -EFAULT;

		return -EFAULT;





	INIT_UDATA(&udata, buf + sizeof cmd,

	INIT_UDATA(&udata, buf + sizeof(cmd),

		   (unsigned long) cmd.response + sizeof resp,

		   (unsigned long) cmd.response + sizeof(resp),

		   in_len - sizeof cmd, out_len - sizeof resp);

                   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),

                   out_len - sizeof(resp));





	uobj  = uobj_alloc(uobj_get_type(pd), file->ucontext);

	uobj  = uobj_alloc(uobj_get_type(pd), file->ucontext);

	if (IS_ERR(uobj))

	if (IS_ERR(uobj))
@@ -488,9 +490,10 @@ ssize_t ib_uverbs_open_xrcd(struct ib_uverbs_file *file, 
	if (copy_from_user(&cmd, buf, sizeof cmd))

	if (copy_from_user(&cmd, buf, sizeof cmd))

		return -EFAULT;

		return -EFAULT;





	INIT_UDATA(&udata, buf + sizeof cmd,

	INIT_UDATA(&udata, buf + sizeof(cmd),

		   (unsigned long) cmd.response + sizeof resp,

		   (unsigned long) cmd.response + sizeof(resp),

		   in_len - sizeof cmd, out_len - sizeof  resp);

                   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),

                   out_len - sizeof(resp));





	mutex_lock(&file->device->xrcd_tree_mutex);

	mutex_lock(&file->device->xrcd_tree_mutex);
@@ -652,9 +655,10 @@ ssize_t ib_uverbs_reg_mr(struct ib_uverbs_file *file, 
	if (copy_from_user(&cmd, buf, sizeof cmd))

	if (copy_from_user(&cmd, buf, sizeof cmd))

		return -EFAULT;

		return -EFAULT;





	INIT_UDATA(&udata, buf + sizeof cmd,

	INIT_UDATA(&udata, buf + sizeof(cmd),

		   (unsigned long) cmd.response + sizeof resp,

		   (unsigned long) cmd.response + sizeof(resp),

		   in_len - sizeof cmd, out_len - sizeof resp);

                   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),

                   out_len - sizeof(resp));





	if ((cmd.start & ~PAGE_MASK) != (cmd.hca_va & ~PAGE_MASK))

	if ((cmd.start & ~PAGE_MASK) != (cmd.hca_va & ~PAGE_MASK))

		return -EINVAL;

		return -EINVAL;
@@ -746,7 +750,8 @@ ssize_t ib_uverbs_rereg_mr(struct ib_uverbs_file *file, 




	INIT_UDATA(&udata, buf + sizeof(cmd),

	INIT_UDATA(&udata, buf + sizeof(cmd),

		   (unsigned long) cmd.response + sizeof(resp),

		   (unsigned long) cmd.response + sizeof(resp),

		   in_len - sizeof(cmd), out_len - sizeof(resp));

                   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),

                   out_len - sizeof(resp));





	if (cmd.flags & ~IB_MR_REREG_SUPPORTED || !cmd.flags)

	if (cmd.flags & ~IB_MR_REREG_SUPPORTED || !cmd.flags)

		return -EINVAL;

		return -EINVAL;
@@ -1086,7 +1091,8 @@ ssize_t ib_uverbs_create_cq(struct ib_uverbs_file *file, 




	INIT_UDATA(&uhw, buf + sizeof(cmd),

	INIT_UDATA(&uhw, buf + sizeof(cmd),

		   (unsigned long)cmd.response + sizeof(resp),

		   (unsigned long)cmd.response + sizeof(resp),

		   in_len - sizeof(cmd), out_len - sizeof(resp));

		   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),

		   out_len - sizeof(resp));





	memset(&cmd_ex, 0, sizeof(cmd_ex));

	memset(&cmd_ex, 0, sizeof(cmd_ex));

	cmd_ex.user_handle = cmd.user_handle;

	cmd_ex.user_handle = cmd.user_handle;
@@ -1167,9 +1173,10 @@ ssize_t ib_uverbs_resize_cq(struct ib_uverbs_file *file, 
	if (copy_from_user(&cmd, buf, sizeof cmd))

	if (copy_from_user(&cmd, buf, sizeof cmd))

		return -EFAULT;

		return -EFAULT;





	INIT_UDATA(&udata, buf + sizeof cmd,

	INIT_UDATA(&udata, buf + sizeof(cmd),

		   (unsigned long) cmd.response + sizeof resp,

		   (unsigned long) cmd.response + sizeof(resp),

		   in_len - sizeof cmd, out_len - sizeof resp);

		   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),

		   out_len - sizeof(resp));





	cq = uobj_get_obj_read(cq, cmd.cq_handle, file->ucontext);

	cq = uobj_get_obj_read(cq, cmd.cq_handle, file->ucontext);

	if (!cq)

	if (!cq)
@@ -1742,9 +1749,10 @@ ssize_t ib_uverbs_open_qp(struct ib_uverbs_file *file, 
	if (copy_from_user(&cmd, buf, sizeof cmd))

	if (copy_from_user(&cmd, buf, sizeof cmd))

		return -EFAULT;

		return -EFAULT;





	INIT_UDATA(&udata, buf + sizeof cmd,

	INIT_UDATA(&udata, buf + sizeof(cmd),

		   (unsigned long) cmd.response + sizeof resp,

		   (unsigned long) cmd.response + sizeof(resp),

		   in_len - sizeof cmd, out_len - sizeof resp);

		   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),

		   out_len - sizeof(resp));





	obj  = (struct ib_uqp_object *)uobj_alloc(uobj_get_type(qp),

	obj  = (struct ib_uqp_object *)uobj_alloc(uobj_get_type(qp),

						  file->ucontext);

						  file->ucontext);
@@ -2055,7 +2063,8 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file, 
		return -EOPNOTSUPP;

		return -EOPNOTSUPP;





	INIT_UDATA(&udata, buf + sizeof(cmd.base), NULL,

	INIT_UDATA(&udata, buf + sizeof(cmd.base), NULL,

		   in_len - sizeof(cmd.base), out_len);

		   in_len - sizeof(cmd.base) - sizeof(struct ib_uverbs_cmd_hdr),

		   out_len);





	ret = modify_qp(file, &cmd, &udata);

	ret = modify_qp(file, &cmd, &udata);

	if (ret)

	if (ret)
@@ -2561,7 +2570,8 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file, 




	INIT_UDATA(&udata, buf + sizeof(cmd),

	INIT_UDATA(&udata, buf + sizeof(cmd),

		   (unsigned long)cmd.response + sizeof(resp),

		   (unsigned long)cmd.response + sizeof(resp),

		   in_len - sizeof(cmd), out_len - sizeof(resp));

		   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),

		   out_len - sizeof(resp));





	uobj  = uobj_alloc(uobj_get_type(ah), file->ucontext);

	uobj  = uobj_alloc(uobj_get_type(ah), file->ucontext);

	if (IS_ERR(uobj))

	if (IS_ERR(uobj))
@@ -3625,10 +3635,10 @@ ssize_t ib_uverbs_create_srq(struct ib_uverbs_file *file, 
	xcmd.max_sge	 = cmd.max_sge;

	xcmd.max_sge	 = cmd.max_sge;

	xcmd.srq_limit	 = cmd.srq_limit;

	xcmd.srq_limit	 = cmd.srq_limit;





	INIT_UDATA(&udata, buf + sizeof cmd,

	INIT_UDATA(&udata, buf + sizeof(cmd),

		   (unsigned long) cmd.response + sizeof resp,

		   (unsigned long) cmd.response + sizeof(resp),

		   in_len - sizeof cmd - sizeof(struct ib_uverbs_cmd_hdr),

		   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),

		   out_len - sizeof resp);

		   out_len - sizeof(resp));





	ret = __uverbs_create_xsrq(file, ib_dev, &xcmd, &udata);

	ret = __uverbs_create_xsrq(file, ib_dev, &xcmd, &udata);

	if (ret)

	if (ret)
@@ -3652,10 +3662,10 @@ ssize_t ib_uverbs_create_xsrq(struct ib_uverbs_file *file, 
	if (copy_from_user(&cmd, buf, sizeof cmd))

	if (copy_from_user(&cmd, buf, sizeof cmd))

		return -EFAULT;

		return -EFAULT;





	INIT_UDATA(&udata, buf + sizeof cmd,

	INIT_UDATA(&udata, buf + sizeof(cmd),

		   (unsigned long) cmd.response + sizeof resp,

		   (unsigned long) cmd.response + sizeof(resp),

		   in_len - sizeof cmd - sizeof(struct ib_uverbs_cmd_hdr),

		   in_len - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr),

		   out_len - sizeof resp);

		   out_len - sizeof(resp));





	ret = __uverbs_create_xsrq(file, ib_dev, &cmd, &udata);

	ret = __uverbs_create_xsrq(file, ib_dev, &cmd, &udata);

	if (ret)

	if (ret)

drivers/infiniband/hw/mlx5/cq.c

+2 −4
Original line number Original line Diff line number Diff line
@@ -751,10 +751,8 @@ static int create_cq_user(struct mlx5_ib_dev *dev, struct ib_udata *udata, 
	void *cqc;

	void *cqc;

	int err;

	int err;





	ucmdlen =

	ucmdlen = udata->inlen < sizeof(ucmd) ?

		(udata->inlen - sizeof(struct ib_uverbs_cmd_hdr) <

		  (sizeof(ucmd) - sizeof(ucmd.reserved)) : sizeof(ucmd);

		 sizeof(ucmd)) ? (sizeof(ucmd) -

				  sizeof(ucmd.reserved)) : sizeof(ucmd);





	if (ib_copy_from_udata(&ucmd, udata, ucmdlen))

	if (ib_copy_from_udata(&ucmd, udata, ucmdlen))

		return -EFAULT;

		return -EFAULT;

drivers/infiniband/hw/mlx5/main.c

+3 −8
Original line number Original line Diff line number Diff line
@@ -1273,7 +1273,6 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev, 
	struct mlx5_bfreg_info *bfregi;

	struct mlx5_bfreg_info *bfregi;

	int ver;

	int ver;

	int err;

	int err;

	size_t reqlen;

	size_t min_req_v2 = offsetof(struct mlx5_ib_alloc_ucontext_req_v2,

	size_t min_req_v2 = offsetof(struct mlx5_ib_alloc_ucontext_req_v2,

				     max_cqe_version);

				     max_cqe_version);

	bool lib_uar_4k;

	bool lib_uar_4k;
@@ -1281,18 +1280,14 @@ static struct ib_ucontext *mlx5_ib_alloc_ucontext(struct ib_device *ibdev, 
	if (!dev->ib_active)

	if (!dev->ib_active)

		return ERR_PTR(-EAGAIN);

		return ERR_PTR(-EAGAIN);





	if (udata->inlen < sizeof(struct ib_uverbs_cmd_hdr))

	if (udata->inlen == sizeof(struct mlx5_ib_alloc_ucontext_req))

		return ERR_PTR(-EINVAL);



	reqlen = udata->inlen - sizeof(struct ib_uverbs_cmd_hdr);

	if (reqlen == sizeof(struct mlx5_ib_alloc_ucontext_req))

		ver = 0;

		ver = 0;

	else if (reqlen >= min_req_v2)

	else if (udata->inlen >= min_req_v2)

		ver = 2;

		ver = 2;

	else

	else

		return ERR_PTR(-EINVAL);

		return ERR_PTR(-EINVAL);





	err = ib_copy_from_udata(&req, udata, min(reqlen, sizeof(req)));

	err = ib_copy_from_udata(&req, udata, min(udata->inlen, sizeof(req)));

	if (err)

	if (err)

		return ERR_PTR(err);

		return ERR_PTR(err);

drivers/infiniband/hw/mthca/mthca_provider.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -914,7 +914,7 @@ static struct ib_mr *mthca_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, 
	int err = 0;

	int err = 0;

	int write_mtt_size;

	int write_mtt_size;





	if (udata->inlen - sizeof (struct ib_uverbs_cmd_hdr) < sizeof ucmd) {

	if (udata->inlen < sizeof ucmd) {

		if (!to_mucontext(pd->uobject->context)->reg_mr_warned) {

		if (!to_mucontext(pd->uobject->context)->reg_mr_warned) {

			mthca_warn(dev, "Process '%s' did not pass in MR attrs.\n",

			mthca_warn(dev, "Process '%s' did not pass in MR attrs.\n",

				   current->comm);

				   current->comm);