Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f5a6c47 authored by Adit Ranadive's avatar Adit Ranadive Committed by Jason Gunthorpe
Browse files

RDMA/vmw_pvrdma: Fix usage of user response structures in ABI file 



This ensures that we return the right structures back to userspace.
Otherwise, it looks like the reserved fields in the response structures
in userspace might have uninitialized data in them.

Fixes: 8b10ba78 ("RDMA/vmw_pvrdma: Add shared receive queue support")
Fixes: 29c8d9eb ("IB: Add vmw_pvrdma driver")
Suggested-by: default avatarJason Gunthorpe <jgg@mellanox.com>
Reviewed-by: default avatarBryan Tan <bryantan@vmware.com>
Reviewed-by: default avatarAditya Sarwade <asarwade@vmware.com>
Reviewed-by: default avatarJorgen Hansen <jhansen@vmware.com>
Signed-off-by: default avatarAdit Ranadive <aditr@vmware.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
parent 5d4c05c3

drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c

+3 −1
Original line number Diff line number Diff line
@@ -114,6 +114,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev, 
	union pvrdma_cmd_resp rsp;

	struct pvrdma_cmd_create_cq *cmd = &req.create_cq;

	struct pvrdma_cmd_create_cq_resp *resp = &rsp.create_cq_resp;

	struct pvrdma_create_cq_resp cq_resp = {0};

	struct pvrdma_create_cq ucmd;



	BUILD_BUG_ON(sizeof(struct pvrdma_cqe) != 64);
@@ -197,6 +198,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev, 


	cq->ibcq.cqe = resp->cqe;

	cq->cq_handle = resp->cq_handle;

	cq_resp.cqn = resp->cq_handle;

	spin_lock_irqsave(&dev->cq_tbl_lock, flags);

	dev->cq_tbl[cq->cq_handle % dev->dsr->caps.max_cq] = cq;

	spin_unlock_irqrestore(&dev->cq_tbl_lock, flags);
@@ -205,7 +207,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev, 
		cq->uar = &(to_vucontext(context)->uar);



		/* Copy udata back. */

		if (ib_copy_to_udata(udata, &cq->cq_handle, sizeof(__u32))) {

		if (ib_copy_to_udata(udata, &cq_resp, sizeof(cq_resp))) {

			dev_warn(&dev->pdev->dev,

				 "failed to copy back udata\n");

			pvrdma_destroy_cq(&cq->ibcq);

drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c

+3 −1
Original line number Diff line number Diff line
@@ -113,6 +113,7 @@ struct ib_srq *pvrdma_create_srq(struct ib_pd *pd, 
	union pvrdma_cmd_resp rsp;

	struct pvrdma_cmd_create_srq *cmd = &req.create_srq;

	struct pvrdma_cmd_create_srq_resp *resp = &rsp.create_srq_resp;

	struct pvrdma_create_srq_resp srq_resp = {0};

	struct pvrdma_create_srq ucmd;

	unsigned long flags;

	int ret;
@@ -204,12 +205,13 @@ struct ib_srq *pvrdma_create_srq(struct ib_pd *pd, 
	}



	srq->srq_handle = resp->srqn;

	srq_resp.srqn = resp->srqn;

	spin_lock_irqsave(&dev->srq_tbl_lock, flags);

	dev->srq_tbl[srq->srq_handle % dev->dsr->caps.max_srq] = srq;

	spin_unlock_irqrestore(&dev->srq_tbl_lock, flags);



	/* Copy udata back. */

	if (ib_copy_to_udata(udata, &srq->srq_handle, sizeof(__u32))) {

	if (ib_copy_to_udata(udata, &srq_resp, sizeof(srq_resp))) {

		dev_warn(&dev->pdev->dev, "failed to copy back udata\n");

		pvrdma_destroy_srq(&srq->ibsrq);

		return ERR_PTR(-EINVAL);

drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c

+3 −1
Original line number Diff line number Diff line
@@ -447,6 +447,7 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev, 
	union pvrdma_cmd_resp rsp;

	struct pvrdma_cmd_create_pd *cmd = &req.create_pd;

	struct pvrdma_cmd_create_pd_resp *resp = &rsp.create_pd_resp;

	struct pvrdma_alloc_pd_resp pd_resp = {0};

	int ret;

	void *ptr;
@@ -475,9 +476,10 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev, 
	pd->privileged = !context;

	pd->pd_handle = resp->pd_handle;

	pd->pdn = resp->pd_handle;

	pd_resp.pdn = resp->pd_handle;



	if (context) {

		if (ib_copy_to_udata(udata, &pd->pdn, sizeof(__u32))) {

		if (ib_copy_to_udata(udata, &pd_resp, sizeof(pd_resp))) {

			dev_warn(&dev->pdev->dev,

				 "failed to copy back protection domain\n");

			pvrdma_dealloc_pd(&pd->ibpd);