| From c3c6582f0be58899ad2fe8b52dab046ddc8a0fbb Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sun, 26 Apr 2020 10:59:21 +0300 |
| Subject: IB/mlx4: Test return value of calls to ib_get_cached_pkey |
| |
| From: Jack Morgenstein <jackm@dev.mellanox.co.il> |
| |
| [ Upstream commit 6693ca95bd4330a0ad7326967e1f9bcedd6b0800 ] |
| |
| In the mlx4_ib_post_send() flow, some functions call ib_get_cached_pkey() |
| without checking its return value. If ib_get_cached_pkey() returns an |
| error code, these functions should return failure. |
| |
| Fixes: 1ffeb2eb8be9 ("IB/mlx4: SR-IOV IB context objects and proxy/tunnel SQP support") |
| Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters") |
| Fixes: e622f2f4ad21 ("IB: split struct ib_send_wr") |
| Link: https://lore.kernel.org/r/20200426075921.130074-1-leon@kernel.org |
| Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> |
| Signed-off-by: Leon Romanovsky <leonro@mellanox.com> |
| Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/infiniband/hw/mlx4/qp.c | 14 +++++++++++--- |
| 1 file changed, 11 insertions(+), 3 deletions(-) |
| |
| diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c |
| index 26425dd2d960f..a2b1f6af5ba3f 100644 |
| --- a/drivers/infiniband/hw/mlx4/qp.c |
| +++ b/drivers/infiniband/hw/mlx4/qp.c |
| @@ -2891,6 +2891,7 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp, |
| int send_size; |
| int header_size; |
| int spc; |
| + int err; |
| int i; |
| |
| if (wr->wr.opcode != IB_WR_SEND) |
| @@ -2925,7 +2926,9 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp, |
| |
| sqp->ud_header.lrh.virtual_lane = 0; |
| sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED); |
| - ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey); |
| + err = ib_get_cached_pkey(ib_dev, sqp->qp.port, 0, &pkey); |
| + if (err) |
| + return err; |
| sqp->ud_header.bth.pkey = cpu_to_be16(pkey); |
| if (sqp->qp.mlx4_ib_qp_type == MLX4_IB_QPT_TUN_SMI_OWNER) |
| sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn); |
| @@ -3212,9 +3215,14 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, const struct ib_ud_wr *wr, |
| } |
| sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags & IB_SEND_SOLICITED); |
| if (!sqp->qp.ibqp.qp_num) |
| - ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, &pkey); |
| + err = ib_get_cached_pkey(ib_dev, sqp->qp.port, sqp->pkey_index, |
| + &pkey); |
| else |
| - ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, &pkey); |
| + err = ib_get_cached_pkey(ib_dev, sqp->qp.port, wr->pkey_index, |
| + &pkey); |
| + if (err) |
| + return err; |
| + |
| sqp->ud_header.bth.pkey = cpu_to_be16(pkey); |
| sqp->ud_header.bth.destination_qpn = cpu_to_be32(wr->remote_qpn); |
| sqp->ud_header.bth.psn = cpu_to_be32((sqp->send_psn++) & ((1 << 24) - 1)); |
| -- |
| 2.20.1 |
| |