linux-next: manual merge of the rdma tree with the origin tree

linux-next: manual merge of the rdma tree with the origin tree

[broonie]

Hi all,

Today's linux-next merge of the rdma tree got conflicts in:

  drivers/infiniband/hw/hns/hns_roce_hw_v2.c
  drivers/infiniband/hw/hns/hns_roce_main.c

between commit:

  45baad7dd98f4 ("RDMA/hns: Remove the num_qpc_timer variable")

from the origin tree and commits:

  29dc063596772 ("RDMA/hns: Remove redundant 'use_lowmem' argument from hns_roce_init_hem_table()")
  5436272c8cf4e ("RDMA/hns: Remove redundant 'num_mtt_segs' and 'max_extend_sg'")

from the rdma tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index c780646bd60ac,2d0192057d1af..0000000000000
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@@ -2272,7 -2270,7 +2270,6 @@@ static int hns_roce_query_pf_caps(struc
  	caps->max_sq_inline	     = le16_to_cpu(resp_a->max_sq_inline);
  	caps->max_rq_sg		     = le16_to_cpu(resp_a->max_rq_sg);
  	caps->max_rq_sg = roundup_pow_of_two(caps->max_rq_sg);
- 	caps->max_extend_sg	     = le32_to_cpu(resp_a->max_extend_sg);
 -	caps->num_qpc_timer	     = le16_to_cpu(resp_a->num_qpc_timer);
  	caps->max_srq_sges	     = le16_to_cpu(resp_a->max_srq_sges);
  	caps->max_srq_sges = roundup_pow_of_two(caps->max_srq_sges);
  	caps->num_aeq_vectors	     = resp_a->num_aeq_vectors;
diff --cc drivers/infiniband/hw/hns/hns_roce_main.c
index 4ccb217b2841d,53c53c20360d1..0000000000000
--- a/drivers/infiniband/hw/hns/hns_roce_main.c
+++ b/drivers/infiniband/hw/hns/hns_roce_main.c
@@@ -725,10 -734,10 +734,10 @@@ static int hns_roce_init_hem(struct hns
  		ret = hns_roce_init_hem_table(hr_dev, &hr_dev->qpc_timer_table,
  					      HEM_TYPE_QPC_TIMER,
  					      hr_dev->caps.qpc_timer_entry_sz,
- 					      hr_dev->caps.qpc_timer_bt_num, 1);
 -					      hr_dev->caps.num_qpc_timer);
++					      hr_dev->caps.qpc_timer_bt_num);
  		if (ret) {
  			dev_err(dev,
- 				"Failed to init QPC timer memory, aborting.\n");
+ 				"failed to init QPC timer memory, aborting.\n");
  			goto err_unmap_ctx;
  		}
  	}

linux-next: manual merge of the rdma tree with the origin tree

[Mark Brown]

Hi all,

Today's linux-next merge of the rdma tree got a conflict in:

  drivers/infiniband/hw/mana/cq.c

between commit:

  887bfe5986396 ("RDMA/mana_ib: check cqe length for kernel CQs")

from the origin tree and commit:

  f972bde7326e9 ("RDMA/mana_ib: Take CQ type from the device type")

from the rdma tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc drivers/infiniband/hw/mana/cq.c
index 7600412b0739f,2dce1b6771150..0000000000000
--- a/drivers/infiniband/hw/mana/cq.c
+++ b/drivers/infiniband/hw/mana/cq.c
@@@ -55,11 -54,6 +54,10 @@@ int mana_ib_create_cq(struct ib_cq *ibc
  							  ibucontext);
  		doorbell = mana_ucontext->doorbell;
  	} else {
- 		is_rnic_cq = true;
 +		if (attr->cqe > U32_MAX / COMP_ENTRY_SIZE / 2 + 1) {
 +			ibdev_dbg(ibdev, "CQE %d exceeding limit\n", attr->cqe);
 +			return -EINVAL;
 +		}
  		buf_size = MANA_PAGE_ALIGN(roundup_pow_of_two(attr->cqe * COMP_ENTRY_SIZE));
  		cq->cqe = buf_size / COMP_ENTRY_SIZE;
  		err = mana_ib_create_kernel_queue(mdev, buf_size, GDMA_CQ, &cq->queue);

linux-next: manual merge of the rdma tree with the origin tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 2316 bytes --]

Hi all,

Today's linux-next merge of the rdma tree got conflicts in:

  drivers/infiniband/hw/mana/qp.c
  drivers/infiniband/hw/mlx4/srq.c

between commits:

  c54c7e4cb679c ("RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()")
  6aaa978c6b621 ("RDMA/mana: Fix error unwind in mana_ib_create_qp_rss()")

from the origin tree and commits:

  271746ec81325 ("RDMA: Convert drivers using min to ib_respond_udata()")
  22d072b3bcc59 ("RDMA: Convert drivers using sizeof() to ib_respond_udata()")
  23a45206d20de ("RDMA: Use proper driver data response structs instead of open coding")

from the rdma tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --cc drivers/infiniband/hw/mana/qp.c
index 0fbcf449c134b,c50a1eafee58c..0000000000000
--- a/drivers/infiniband/hw/mana/qp.c
+++ b/drivers/infiniband/hw/mana/qp.c
@@@ -212,13 -210,9 +212,9 @@@ static int mana_ib_create_qp_rss(struc
  	if (ret)
  		goto fail;
  
- 	ret = ib_copy_to_udata(udata, &resp, sizeof(resp));
- 	if (ret) {
- 		ibdev_dbg(&mdev->ib_dev,
- 			  "Failed to copy to udata create rss-qp, %d\n",
- 			  ret);
+ 	ret = ib_respond_udata(udata, resp);
+ 	if (ret)
 -		goto fail;
 +		goto err_disable_vport_rx;
- 	}
  
  	kfree(mana_ind_table);
  
diff --cc drivers/infiniband/hw/mlx4/srq.c
index 767840736d583,0b4df4f48ca14..0000000000000
--- a/drivers/infiniband/hw/mlx4/srq.c
+++ b/drivers/infiniband/hw/mlx4/srq.c
@@@ -191,11 -191,15 +191,15 @@@ int mlx4_ib_create_srq(struct ib_srq *i
  	srq->msrq.event = mlx4_ib_srq_event;
  	srq->ibsrq.ext.xrc.srq_num = srq->msrq.srqn;
  
- 	if (udata)
- 		if (ib_copy_to_udata(udata, &srq->msrq.srqn, sizeof (__u32))) {
- 			err = -EFAULT;
+ 	if (udata) {
+ 		struct mlx4_ib_create_srq_resp uresp = {
+ 			.srqn = srq->msrq.srqn
+ 		};
+ 
+ 		err = ib_respond_udata(udata, uresp);
+ 		if (err)
 -			goto err_wrid;
 +			goto err_srq;
- 		}
+ 	}
  
  	init_attr->attr.max_wr = srq->msrq.max - 1;
  

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

linux-next: manual merge of the rdma tree with the origin tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 27202 bytes --]

Hi all,

Today's linux-next merge of the rdma tree got a conflict in:

  drivers/infiniband/hw/irdma/verbs.c

between commit:

  b9b0889071569 ("RDMA/irdma: Prevent user-triggered null deref on QP create")

from the origin tree and commit:

  d83bf998f719d ("RDMA/irdma: Prevent user-triggered null deref on QP create")

from the rdma tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

diff --combined drivers/infiniband/hw/irdma/verbs.c
index b7388b41ed958,16c80367270f5..0000000000000
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@@ -18,11 -18,10 +18,10 @@@ static int irdma_query_device(struct ib
  	struct irdma_hw_attrs *hw_attrs = &rf->sc_dev.hw_attrs;
  	int err;
  
- 	err = ib_is_udata_in_empty(udata);
+ 	err = ib_no_udata_io(udata);
  	if (err)
  		return err;
  
- 	memset(props, 0, sizeof(*props));
  	addrconf_addr_eui48((u8 *)&props->sys_image_guid,
  			    iwdev->netdev->dev_addr);
  	props->fw_ver = (u64)irdma_fw_major_ver(&rf->sc_dev) << 32 |
@@@ -76,7 -75,7 +75,7 @@@
  	if (hw_attrs->uk_attrs.hw_rev >= IRDMA_GEN_3)
  		props->device_cap_flags |= IB_DEVICE_MEM_WINDOW_TYPE_2B;
  
- 	return ib_respond_empty_udata(udata);
+ 	return 0;
  }
  
  /**
@@@ -407,6 -406,10 +406,10 @@@ static int irdma_alloc_pd(struct ib_pd 
  	u32 pd_id = 0;
  	int err;
  
+ 	err = ib_is_udata_in_empty(udata);
+ 	if (err)
+ 		return err;
+ 
  	if (udata && udata->outlen < IRDMA_ALLOC_PD_MIN_RESP_LEN)
  		return -EINVAL;
  
@@@ -445,6 -448,11 +448,11 @@@ static int irdma_dealloc_pd(struct ib_p
  {
  	struct irdma_pd *iwpd = to_iwpd(ibpd);
  	struct irdma_device *iwdev = to_iwdev(ibpd->device);
+ 	int ret;
+ 
+ 	ret = ib_no_udata_io(udata);
+ 	if (ret)
+ 		return ret;
  
  	irdma_free_rsrc(iwdev->rf, iwdev->rf->allocated_pds, iwpd->sc_pd.pd_id);
  
@@@ -464,6 -472,9 +472,9 @@@ static struct irdma_pbl *irdma_get_pbl(
  
  	list_for_each_entry (iwpbl, pbl_list, list) {
  		if (iwpbl->user_base == va) {
+ 			struct irdma_mr *iwmr = iwpbl->iwmr;
+ 
+ 			refcount_inc(&iwmr->user_ring_refs);
  			list_del(&iwpbl->list);
  			iwpbl->on_list = false;
  			return iwpbl;
@@@ -534,11 -545,10 +545,10 @@@ static int irdma_setup_push_mmap_entrie
  }
  
  /**
-  * irdma_destroy_qp - destroy qp
+  * _irdma_destroy_qp - destroy qp
   * @ibqp: qp's ib pointer also to get to device's qp address
-  * @udata: user data
   */
- static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
+ static void _irdma_destroy_qp(struct ib_qp *ibqp)
  {
  	struct irdma_qp *iwqp = to_iwqp(ibqp);
  	struct irdma_device *iwdev = iwqp->iwdev;
@@@ -570,6 -580,22 +580,22 @@@
  	if (iwqp->sc_qp.qp_uk.qp_id == 1)
  		iwdev->rf->hwqp1_rsvd = false;
  	irdma_free_qp_rsrc(iwqp);
+ }
+ 
+ /**
+  * irdma_destroy_qp - destroy qp
+  * @ibqp: qp's ib pointer also to get to device's qp address
+  * @udata: user data
+  */
+ static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
+ {
+ 	int ret;
+ 
+ 	ret = ib_no_udata_io(udata);
+ 	if (ret)
+ 		return ret;
+ 
+ 	_irdma_destroy_qp(ibqp);
  
  	return 0;
  }
@@@ -605,37 -631,29 +631,29 @@@ static void irdma_setup_virt_qp(struct 
  
  /**
   * irdma_setup_umode_qp - setup sq and rq size in user mode qp
-  * @udata: udata
+  * @ucontext: user context
+  * @req: user request pointer
   * @iwdev: iwarp device
   * @iwqp: qp ptr (user or kernel)
   * @info: initialize info to return
   * @init_attr: Initial QP create attributes
   */
- static int irdma_setup_umode_qp(struct ib_udata *udata,
+ static int irdma_setup_umode_qp(struct irdma_ucontext *ucontext,
+ 				struct irdma_create_qp_req *req,
  				struct irdma_device *iwdev,
  				struct irdma_qp *iwqp,
  				struct irdma_qp_init_info *info,
  				struct ib_qp_init_attr *init_attr)
  {
- 	struct irdma_ucontext *ucontext = rdma_udata_to_drv_context(udata,
- 				struct irdma_ucontext, ibucontext);
  	struct irdma_qp_uk_init_info *ukinfo = &info->qp_uk_init_info;
- 	struct irdma_create_qp_req req;
  	unsigned long flags;
  	int ret;
  
- 	ret = ib_copy_from_udata(&req, udata,
- 				 min(sizeof(req), udata->inlen));
- 	if (ret) {
- 		ibdev_dbg(&iwdev->ibdev, "VERBS: ib_copy_from_data fail\n");
- 		return ret;
- 	}
- 
- 	iwqp->ctx_info.qp_compl_ctx = req.user_compl_ctx;
+ 	iwqp->ctx_info.qp_compl_ctx = req->user_compl_ctx;
  	iwqp->user_mode = 1;
  
  	spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags);
- 	iwqp->iwpbl = irdma_get_pbl((unsigned long)req.user_wqe_bufs,
+ 	iwqp->iwpbl = irdma_get_pbl((unsigned long)req->user_wqe_bufs,
  				    &ucontext->qp_reg_mem_list);
  	spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags);
  
@@@ -962,6 -980,7 +980,7 @@@ static int irdma_create_qp(struct ib_q
  	struct irdma_uk_attrs *uk_attrs = &dev->hw_attrs.uk_attrs;
  	struct irdma_qp_init_info init_info = {};
  	struct irdma_qp_host_ctx_info *ctx_info;
+ 	struct irdma_create_qp_req ureq = {};
  	struct irdma_srq *iwsrq;
  	bool srq_valid = false;
  	u32 srq_id = 0;
@@@ -979,9 -998,14 +998,14 @@@
  	if (err_code)
  		return err_code;
  
- 	if (udata && (udata->inlen < IRDMA_CREATE_QP_MIN_REQ_LEN ||
- 		      udata->outlen < IRDMA_CREATE_QP_MIN_RESP_LEN))
- 		return -EINVAL;
+ 	if (udata) {
+ 		if (udata->outlen < IRDMA_CREATE_QP_MIN_RESP_LEN)
+ 			return -EINVAL;
+ 
+ 		err_code = ib_copy_validate_udata_in(udata, ureq, user_compl_ctx);
+ 		if (err_code)
+ 			return err_code;
+ 	}
  
  	init_info.vsi = &iwdev->vsi;
  	init_info.qp_uk_init_info.uk_attrs = uk_attrs;
@@@ -1040,9 -1064,14 +1064,14 @@@
  	init_waitqueue_head(&iwqp->mod_qp_waitq);
  
  	if (udata) {
+ 		struct irdma_ucontext *ucontext =
+ 			rdma_udata_to_drv_context(udata,
+ 						  struct irdma_ucontext,
+ 						  ibucontext);
+ 
  		init_info.qp_uk_init_info.abi_ver = iwpd->sc_pd.abi_ver;
- 		err_code = irdma_setup_umode_qp(udata, iwdev, iwqp, &init_info,
- 						init_attr);
+ 		err_code = irdma_setup_umode_qp(ucontext, &ureq, iwdev, iwqp,
+ 						&init_info, init_attr);
  	} else {
  		INIT_DELAYED_WORK(&iwqp->dwork_flush, irdma_flush_worker);
  		init_info.qp_uk_init_info.abi_ver = IRDMA_ABI_VER;
@@@ -1109,8 -1138,12 +1138,12 @@@
  	init_completion(&iwqp->free_qp);
  
  	if (udata) {
- 		/* GEN_1 legacy support with libi40iw does not have expanded uresp struct */
- 		if (udata->outlen < sizeof(uresp)) {
+ 		/* GEN_1 legacy support with libi40iw does not have expanded
+ 		 * uresp struct. Check for the exact legacy size (20 bytes) to
+ 		 * ensure that newer expanded uresp structs don't accidentally
+ 		 * trigger the legacy fallback.
+ 		 */
+ 		if (udata->outlen == IRDMA_CREATE_QP_MIN_RESP_LEN) {
  			uresp.lsmm = 1;
  			uresp.push_idx = IRDMA_INVALID_PUSH_PAGE_INDEX_GEN_1;
  		} else {
@@@ -1124,7 -1157,7 +1157,7 @@@
  
  		err_code = ib_respond_udata(udata, uresp);
  		if (err_code) {
- 			irdma_destroy_qp(&iwqp->ibqp, udata);
+ 			_irdma_destroy_qp(&iwqp->ibqp);
  			return err_code;
  		}
  	}
@@@ -1273,7 -1306,6 +1306,6 @@@ static int irdma_wait_for_suspend(struc
  int irdma_modify_qp_roce(struct ib_qp *ibqp, struct ib_qp_attr *attr,
  			 int attr_mask, struct ib_udata *udata)
  {
- #define IRDMA_MODIFY_QP_MIN_REQ_LEN offsetofend(struct irdma_modify_qp_req, rq_flush)
  #define IRDMA_MODIFY_QP_MIN_RESP_LEN offsetofend(struct irdma_modify_qp_resp, push_valid)
  	struct irdma_pd *iwpd = to_iwpd(ibqp->pd);
  	struct irdma_qp *iwqp = to_iwqp(ibqp);
@@@ -1289,15 -1321,26 +1321,26 @@@
  	u8 issue_modify_qp = 0;
  	int ret = 0;
  
+ 	/* Clear the response buffer (if any). It may be updated again later. */
+ 	ret = ib_respond_empty_udata(udata);
+ 	if (ret)
+ 		return ret;
+ 
  	ctx_info = &iwqp->ctx_info;
  	roce_info = &iwqp->roce_info;
  	udp_info = &iwqp->udp_info;
  
  	if (udata) {
  		/* udata inlen/outlen can be 0 when supporting legacy libi40iw */
- 		if ((udata->inlen && udata->inlen < IRDMA_MODIFY_QP_MIN_REQ_LEN) ||
- 		    (udata->outlen && udata->outlen < IRDMA_MODIFY_QP_MIN_RESP_LEN))
+ 		if (udata->outlen && udata->outlen < IRDMA_MODIFY_QP_MIN_RESP_LEN)
  			return -EINVAL;
+ 
+ 		/* For current irdma, validate against ABI def. */
+ 		if (udata->inlen) {
+ 			ret = ib_copy_validate_udata_in(udata, ureq, rsvd);
+ 			if (ret)
+ 				return ret;
+ 		}
  	}
  
  	if (attr_mask & ~IB_QP_ATTR_STANDARD_BITS)
@@@ -1540,10 -1583,6 +1583,6 @@@
  				iwqp->ibqp_state = attr->qp_state;
  				spin_unlock_irqrestore(&iwqp->lock, flags);
  				if (udata && udata->inlen) {
- 					if (ib_copy_from_udata(&ureq, udata,
- 					    min(sizeof(ureq), udata->inlen)))
- 						return -EINVAL;
- 
  					irdma_flush_wqes(iwqp,
  					    (ureq.sq_flush ? IRDMA_FLUSH_SQ : 0) |
  					    (ureq.rq_flush ? IRDMA_FLUSH_RQ : 0) |
@@@ -1633,7 -1672,6 +1672,6 @@@ exit
  int irdma_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask,
  		    struct ib_udata *udata)
  {
- #define IRDMA_MODIFY_QP_MIN_REQ_LEN offsetofend(struct irdma_modify_qp_req, rq_flush)
  #define IRDMA_MODIFY_QP_MIN_RESP_LEN offsetofend(struct irdma_modify_qp_resp, push_valid)
  	struct irdma_qp *iwqp = to_iwqp(ibqp);
  	struct irdma_device *iwdev = iwqp->iwdev;
@@@ -1649,11 -1687,20 +1687,20 @@@
  	int err;
  	unsigned long flags;
  
+ 	err = ib_respond_empty_udata(udata);
+ 	if (err)
+ 		return err;
+ 
  	if (udata) {
  		/* udata inlen/outlen can be 0 when supporting legacy libi40iw */
- 		if ((udata->inlen && udata->inlen < IRDMA_MODIFY_QP_MIN_REQ_LEN) ||
- 		    (udata->outlen && udata->outlen < IRDMA_MODIFY_QP_MIN_RESP_LEN))
+ 		if (udata->outlen && udata->outlen < IRDMA_MODIFY_QP_MIN_RESP_LEN)
  			return -EINVAL;
+ 
+ 		if (udata->inlen) {
+ 			err = ib_copy_validate_udata_in(udata, ureq, rsvd);
+ 			if (err)
+ 				return err;
+ 		}
  	}
  
  	if (attr_mask & ~IB_QP_ATTR_STANDARD_BITS)
@@@ -1743,10 -1790,6 +1790,6 @@@
  				iwqp->ibqp_state = attr->qp_state;
  				spin_unlock_irqrestore(&iwqp->lock, flags);
  				if (udata && udata->inlen) {
- 					if (ib_copy_from_udata(&ureq, udata,
- 					    min(sizeof(ureq), udata->inlen)))
- 						return -EINVAL;
- 
  					irdma_flush_wqes(iwqp,
  					    (ureq.sq_flush ? IRDMA_FLUSH_SQ : 0) |
  					    (ureq.rq_flush ? IRDMA_FLUSH_RQ : 0) |
@@@ -1880,6 -1923,11 +1923,11 @@@ static void irdma_srq_free_rsrc(struct 
  		dma_free_coherent(rf->sc_dev.hw->device, iwsrq->kmem.size,
  				  iwsrq->kmem.va, iwsrq->kmem.pa);
  		iwsrq->kmem.va = NULL;
+ 	} else {
+ 		/* Not called in any failure path, so iwpbl is valid. */
+ 		struct irdma_mr *iwmr = iwsrq->iwpbl->iwmr;
+ 
+ 		refcount_dec(&iwmr->user_ring_refs);
  	}
  
  	irdma_free_rsrc(rf, rf->allocated_srqs, srq->srq_uk.srq_id);
@@@ -1902,6 -1950,21 +1950,21 @@@ static void irdma_cq_free_rsrc(struct i
  				  iwcq->kmem_shadow.size,
  				  iwcq->kmem_shadow.va, iwcq->kmem_shadow.pa);
  		iwcq->kmem_shadow.va = NULL;
+ 	} else {
+ 		struct irdma_mr *iwmr;
+ 
+ 		/* May be called in a failure path before iwpbl is valid. */
+ 		if (iwcq->iwpbl) {
+ 			iwmr = iwcq->iwpbl->iwmr;
+ 
+ 			refcount_dec(&iwmr->user_ring_refs);
+ 		}
+ 
+ 		if (iwcq->iwpbl_shadow) {
+ 			iwmr = iwcq->iwpbl_shadow->iwmr;
+ 
+ 			refcount_dec(&iwmr->user_ring_refs);
+ 		}
  	}
  
  	irdma_free_rsrc(rf, rf->allocated_cqs, cq->cq_uk.cq_id);
@@@ -1958,6 -2021,11 +2021,11 @@@ static int irdma_destroy_srq(struct ib_
  	struct irdma_device *iwdev = to_iwdev(ibsrq->device);
  	struct irdma_srq *iwsrq = to_iwsrq(ibsrq);
  	struct irdma_sc_srq *srq = &iwsrq->sc_srq;
+ 	int ret;
+ 
+ 	ret = ib_no_udata_io(udata);
+ 	if (ret)
+ 		return ret;
  
  	irdma_srq_wq_destroy(iwdev->rf, srq);
  	irdma_srq_free_rsrc(iwdev->rf, iwsrq);
@@@ -1978,6 -2046,11 +2046,11 @@@ static int irdma_destroy_cq(struct ib_c
  	struct irdma_sc_ceq *ceq = dev->ceq[cq->ceq_id];
  	struct irdma_ceq *iwceq = container_of(ceq, struct irdma_ceq, sc_ceq);
  	unsigned long flags;
+ 	int ret;
+ 
+ 	ret = ib_no_udata_io(udata);
+ 	if (ret)
+ 		return ret;
  
  	spin_lock_irqsave(&iwcq->lock, flags);
  	if (!list_empty(&iwcq->cmpl_generated))
@@@ -2008,7 -2081,6 +2081,6 @@@
  static int irdma_resize_cq(struct ib_cq *ibcq, unsigned int entries,
  			   struct ib_udata *udata)
  {
- #define IRDMA_RESIZE_CQ_MIN_REQ_LEN offsetofend(struct irdma_resize_cq_req, user_cq_buffer)
  	struct irdma_cq *iwcq = to_iwcq(ibcq);
  	struct irdma_sc_dev *dev = iwcq->sc_cq.dev;
  	struct irdma_cqp_request *cqp_request;
@@@ -2017,7 -2089,7 +2089,7 @@@
  	struct irdma_modify_cq_info info = {};
  	struct irdma_dma_mem kmem_buf;
  	struct irdma_cq_mr *cqmr_buf;
- 	struct irdma_pbl *iwpbl_buf;
+ 	struct irdma_pbl *iwpbl_buf = NULL;
  	struct irdma_device *iwdev;
  	struct irdma_pci_f *rf;
  	struct irdma_cq_buf *cq_buf = NULL;
@@@ -2032,12 -2104,13 +2104,13 @@@
  	    IRDMA_FEATURE_CQ_RESIZE))
  		return -EOPNOTSUPP;
  
- 	if (udata && udata->inlen < IRDMA_RESIZE_CQ_MIN_REQ_LEN)
- 		return -EINVAL;
- 
  	if (entries > rf->max_cqe)
  		return -EINVAL;
  
+ 	ret = ib_respond_empty_udata(udata);
+ 	if (ret)
+ 		return ret;
+ 
  	if (!iwcq->user_mode) {
  		entries += 2;
  
@@@ -2064,9 -2137,9 +2137,9 @@@
  			rdma_udata_to_drv_context(udata, struct irdma_ucontext,
  						  ibucontext);
  
- 		if (ib_copy_from_udata(&req, udata,
- 				       min(sizeof(req), udata->inlen)))
- 			return -EINVAL;
+ 		ret = ib_copy_validate_udata_in(udata, req, user_cq_buffer);
+ 		if (ret)
+ 			return ret;
  
  		spin_lock_irqsave(&ucontext->cq_reg_mem_list_lock, flags);
  		iwpbl_buf = irdma_get_pbl((unsigned long)req.user_cq_buffer,
@@@ -2128,6 -2201,19 +2201,19 @@@
  		goto error;
  
  	spin_lock_irqsave(&iwcq->lock, flags);
+ 	if (udata) {
+ 		struct irdma_pbl *old_iwpbl = iwcq->iwpbl;
+ 
+ 		/* Only update if the resize was successful. Otherwise, HW is
+ 		 * still pointing to the old PBL.
+ 		 */
+ 		iwcq->iwpbl = iwpbl_buf;
+ 		if (old_iwpbl) {
+ 			struct irdma_mr *old_iwmr = old_iwpbl->iwmr;
+ 
+ 			refcount_dec(&old_iwmr->user_ring_refs);
+ 		}
+ 	}
  	if (cq_buf) {
  		cq_buf->kmem_buf = iwcq->kmem;
  		cq_buf->hw = dev->hw;
@@@ -2143,6 -2229,11 +2229,11 @@@
  
  	return 0;
  error:
+ 	if (iwpbl_buf) {
+ 		struct irdma_mr *iwmr = iwpbl_buf->iwmr;
+ 
+ 		refcount_dec(&iwmr->user_ring_refs);
+ 	}
  	if (!udata) {
  		dma_free_coherent(dev->hw->device, kmem_buf.size, kmem_buf.va,
  				  kmem_buf.pa);
@@@ -2194,6 -2285,10 +2285,10 @@@ static int irdma_modify_srq(struct ib_s
  	struct cqp_cmds_info *cqp_info;
  	int status;
  
+ 	status = ib_no_udata_io(udata);
+ 	if (status)
+ 		return status;
+ 
  	if (attr_mask & IB_SRQ_MAX_WR)
  		return -EINVAL;
  
@@@ -2236,24 -2331,20 +2331,20 @@@ static int irdma_setup_umode_srq(struc
  				 struct irdma_srq_init_info *info,
  				 struct ib_udata *udata)
  {
- #define IRDMA_CREATE_SRQ_MIN_REQ_LEN \
- 	offsetofend(struct irdma_create_srq_req, user_shadow_area)
  	struct irdma_create_srq_req req = {};
  	struct irdma_ucontext *ucontext;
  	struct irdma_srq_mr *srqmr;
  	struct irdma_pbl *iwpbl;
  	unsigned long flags;
+ 	int ret;
  
  	iwsrq->user_mode = true;
  	ucontext = rdma_udata_to_drv_context(udata, struct irdma_ucontext,
  					     ibucontext);
  
- 	if (udata->inlen < IRDMA_CREATE_SRQ_MIN_REQ_LEN)
- 		return -EINVAL;
- 
- 	if (ib_copy_from_udata(&req, udata,
- 			       min(sizeof(req), udata->inlen)))
- 		return -EFAULT;
+ 	ret = ib_copy_validate_udata_in(udata, req, user_shadow_area);
+ 	if (ret)
+ 		return ret;
  
  	spin_lock_irqsave(&ucontext->srq_reg_mem_list_lock, flags);
  	iwpbl = irdma_get_pbl((unsigned long)req.user_srq_buf,
@@@ -2316,6 -2407,7 +2407,7 @@@ static int irdma_create_srq(struct ib_s
  			    struct ib_srq_init_attr *initattrs,
  			    struct ib_udata *udata)
  {
+ #define IRDMA_CREATE_SRQ_MIN_RESP_LEN offsetofend(struct irdma_create_srq_resp, srq_size)
  	struct irdma_device *iwdev = to_iwdev(ibsrq->device);
  	struct ib_srq_attr *attr = &initattrs->attr;
  	struct irdma_pd *iwpd = to_iwpd(ibsrq->pd);
@@@ -2336,6 -2428,9 +2428,9 @@@
  	if (initattrs->srq_type != IB_SRQT_BASIC)
  		return -EOPNOTSUPP;
  
+ 	if (udata && udata->outlen < IRDMA_CREATE_SRQ_MIN_RESP_LEN)
+ 		return -EINVAL;
+ 
  	if (!(uk_attrs->feature_flags & IRDMA_FEATURE_SRQ) ||
  	    attr->max_sge > uk_attrs->max_hw_wq_frags)
  		return -EINVAL;
@@@ -2419,6 -2514,11 +2514,11 @@@ free_dmem
  		dma_free_coherent(rf->hw.device, iwsrq->kmem.size,
  				  iwsrq->kmem.va, iwsrq->kmem.pa);
  free_rsrc:
+ 	if (iwsrq->user_mode && iwsrq->iwpbl) {
+ 		struct irdma_mr *iwmr = iwsrq->iwpbl->iwmr;
+ 
+ 		refcount_dec(&iwmr->user_ring_refs);
+ 	}
  	irdma_free_rsrc(rf, rf->allocated_srqs, iwsrq->srq_num);
  	return err_code;
  }
@@@ -2458,7 -2558,6 +2558,6 @@@ static int irdma_create_cq(struct ib_c
  			   const struct ib_cq_init_attr *attr,
  			   struct uverbs_attr_bundle *attrs)
  {
- #define IRDMA_CREATE_CQ_MIN_REQ_LEN offsetofend(struct irdma_create_cq_req, user_cq_buf)
  #define IRDMA_CREATE_CQ_MIN_RESP_LEN offsetofend(struct irdma_create_cq_resp, cq_size)
  	struct ib_udata *udata = &attrs->driver_udata;
  	struct ib_device *ibdev = ibcq->device;
@@@ -2482,8 -2581,7 +2581,7 @@@
  	if (err_code)
  		return err_code;
  
- 	if (udata && (udata->inlen < IRDMA_CREATE_CQ_MIN_REQ_LEN ||
- 		      udata->outlen < IRDMA_CREATE_CQ_MIN_RESP_LEN))
+ 	if (udata && udata->outlen < IRDMA_CREATE_CQ_MIN_RESP_LEN)
  		return -EINVAL;
  
  	err_code = irdma_alloc_rsrc(rf, rf->allocated_cqs, rf->max_cq, &cq_num,
@@@ -2498,6 -2596,8 +2596,8 @@@
  	INIT_LIST_HEAD(&iwcq->resize_list);
  	INIT_LIST_HEAD(&iwcq->cmpl_generated);
  	iwcq->cq_num = cq_num;
+ 	iwcq->iwpbl = NULL;
+ 	iwcq->iwpbl_shadow = NULL;
  	info.dev = dev;
  	ukinfo->cq_size = max(entries, 4);
  	ukinfo->cq_id = cq_num;
@@@ -2517,49 -2617,50 +2617,50 @@@
  		struct irdma_ucontext *ucontext;
  		struct irdma_create_cq_req req = {};
  		struct irdma_cq_mr *cqmr;
- 		struct irdma_pbl *iwpbl;
- 		struct irdma_pbl *iwpbl_shadow;
  		struct irdma_cq_mr *cqmr_shadow;
  
  		iwcq->user_mode = true;
  		ucontext =
  			rdma_udata_to_drv_context(udata, struct irdma_ucontext,
  						  ibucontext);
- 		if (ib_copy_from_udata(&req, udata,
- 				       min(sizeof(req), udata->inlen))) {
- 			err_code = -EFAULT;
+ 		/* Even though the last member of struct irdma_create_cq_req
+ 		 * was always user_shadow_area, we need backwards compat with
+ 		 * the legacy i40iw struct i40iw_ucreate_cq which stopped
+ 		 * at user_cq_buffer.
+ 		 */
+ 		err_code = ib_copy_validate_udata_in(udata, req, user_cq_buf);
+ 		if (err_code)
  			goto cq_free_rsrc;
- 		}
  
  		spin_lock_irqsave(&ucontext->cq_reg_mem_list_lock, flags);
- 		iwpbl = irdma_get_pbl((unsigned long)req.user_cq_buf,
- 				      &ucontext->cq_reg_mem_list);
+ 		iwcq->iwpbl = irdma_get_pbl((unsigned long)req.user_cq_buf,
+ 					    &ucontext->cq_reg_mem_list);
  		spin_unlock_irqrestore(&ucontext->cq_reg_mem_list_lock, flags);
- 		if (!iwpbl) {
+ 		if (!iwcq->iwpbl) {
  			err_code = -EPROTO;
  			goto cq_free_rsrc;
  		}
  
- 		cqmr = &iwpbl->cq_mr;
+ 		cqmr = &iwcq->iwpbl->cq_mr;
  
  		if (rf->sc_dev.hw_attrs.uk_attrs.feature_flags &
  		    IRDMA_FEATURE_CQ_RESIZE) {
  			spin_lock_irqsave(&ucontext->cq_reg_mem_list_lock, flags);
- 			iwpbl_shadow = irdma_get_pbl(
+ 			iwcq->iwpbl_shadow = irdma_get_pbl(
  					(unsigned long)req.user_shadow_area,
  					&ucontext->cq_reg_mem_list);
  			spin_unlock_irqrestore(&ucontext->cq_reg_mem_list_lock, flags);
  
- 			if (!iwpbl_shadow) {
+ 			if (!iwcq->iwpbl_shadow) {
  				err_code = -EPROTO;
  				goto cq_free_rsrc;
  			}
- 			cqmr_shadow = &iwpbl_shadow->cq_mr;
+ 			cqmr_shadow = &iwcq->iwpbl_shadow->cq_mr;
  			info.shadow_area_pa = cqmr_shadow->cq_pbl.addr;
  		} else {
  			info.shadow_area_pa = cqmr->shadow;
  		}
- 		if (iwpbl->pbl_allocated) {
+ 		if (iwcq->iwpbl->pbl_allocated) {
  			info.virtual_map = true;
  			info.pbl_chunk_size = 1;
  			info.first_pm_pbl_idx = cqmr->cq_pbl.idx;
@@@ -2801,7 -2902,7 +2902,7 @@@ static bool irdma_check_mem_contiguous(
  	u32 pg_idx;
  
  	for (pg_idx = 0; pg_idx < npages; pg_idx++) {
 -		if ((*arr + (pg_size * pg_idx)) != arr[pg_idx])
 +		if ((*arr + ((u64)pg_size * pg_idx)) != arr[pg_idx])
  			return false;
  	}
  
@@@ -2834,7 -2935,7 +2935,7 @@@ static bool irdma_check_mr_contiguous(s
  
  	for (i = 0; i < lvl2->leaf_cnt; i++, leaf++) {
  		arr = leaf->addr;
 -		if ((*start_addr + (i * pg_size * PBLE_PER_PAGE)) != *arr)
 +		if ((*start_addr + ((u64)i * pg_size * PBLE_PER_PAGE)) != *arr)
  			return false;
  		ret = irdma_check_mem_contiguous(arr, leaf->cnt, pg_size);
  		if (!ret)
@@@ -3034,6 -3135,10 +3135,10 @@@ static int irdma_alloc_mw(struct ib_mw 
  	int err_code;
  	u32 stag;
  
+ 	err_code = ib_no_udata_io(udata);
+ 	if (err_code)
+ 		return err_code;
+ 
  	stag = irdma_create_stag(iwdev);
  	if (!stag)
  		return -ENOMEM;
@@@ -3362,6 -3467,7 +3467,7 @@@ static struct irdma_mr *irdma_alloc_iwm
  	if (!iwmr)
  		return ERR_PTR(-ENOMEM);
  
+ 	refcount_set(&iwmr->user_ring_refs, 1);
  	iwpbl = &iwmr->iwpbl;
  	iwpbl->iwmr = iwmr;
  	iwmr->region = region;
@@@ -3508,7 -3614,6 +3614,6 @@@ static struct ib_mr *irdma_reg_user_mr(
  				       struct ib_dmah *dmah,
  				       struct ib_udata *udata)
  {
- #define IRDMA_MEM_REG_MIN_REQ_LEN offsetofend(struct irdma_mem_reg_req, sq_pages)
  	struct irdma_device *iwdev = to_iwdev(pd->device);
  	struct irdma_mem_reg_req req = {};
  	struct ib_umem *region = NULL;
@@@ -3518,10 -3623,15 +3623,15 @@@
  	if (dmah)
  		return ERR_PTR(-EOPNOTSUPP);
  
- 	if (len > iwdev->rf->sc_dev.hw_attrs.max_mr_size)
- 		return ERR_PTR(-EINVAL);
+ 	err = ib_copy_validate_udata_in(udata, req, sq_pages);
+ 	if (err)
+ 		return ERR_PTR(err);
  
- 	if (udata->inlen < IRDMA_MEM_REG_MIN_REQ_LEN)
+ 	err = ib_respond_empty_udata(udata);
+ 	if (err)
+ 		return ERR_PTR(err);
+ 
+ 	if (len > iwdev->rf->sc_dev.hw_attrs.max_mr_size)
  		return ERR_PTR(-EINVAL);
  
  	region = ib_umem_get_va(pd->device, start, len, access);
@@@ -3532,11 -3642,6 +3642,6 @@@
  		return (struct ib_mr *)region;
  	}
  
- 	if (ib_copy_from_udata(&req, udata, min(sizeof(req), udata->inlen))) {
- 		ib_umem_release(region);
- 		return ERR_PTR(-EFAULT);
- 	}
- 
  	iwmr = irdma_alloc_iwmr(region, pd, virt, req.reg_type);
  	if (IS_ERR(iwmr)) {
  		ib_umem_release(region);
@@@ -3784,15 -3889,16 +3889,19 @@@ static struct ib_mr *irdma_rereg_user_m
  	struct ib_umem_dmabuf *umem_dmabuf;
  	int ret;
  
+ 	ret = ib_no_udata_io(udata);
+ 	if (ret)
+ 		return ERR_PTR(ret);
+ 
  	if (len > iwdev->rf->sc_dev.hw_attrs.max_mr_size)
  		return ERR_PTR(-EINVAL);
  
  	if (flags & ~(IB_MR_REREG_TRANS | IB_MR_REREG_PD | IB_MR_REREG_ACCESS))
  		return ERR_PTR(-EOPNOTSUPP);
  
 +	if (iwmr->type != IRDMA_MEMREG_TYPE_MEM)
 +	     return ERR_PTR(-EINVAL);
 +
  	ret = ib_umem_check_rereg(iwmr->region, flags, new_access);
  	if (ret)
  		return ERR_PTR(ret);
@@@ -3929,41 -4035,41 +4038,41 @@@ static struct ib_mr *irdma_get_dma_mr(s
   * irdma_del_memlist - Deleting pbl list entries for CQ/QP
   * @iwmr: iwmr for IB's user page addresses
   * @ucontext: ptr to user context
+  *
+  * Return: True if the MR is currently in-use by a QP/CQ/SRQ ring.
   */
- static void irdma_del_memlist(struct irdma_mr *iwmr,
+ static bool irdma_del_memlist(struct irdma_mr *iwmr,
  			      struct irdma_ucontext *ucontext)
  {
  	struct irdma_pbl *iwpbl = &iwmr->iwpbl;
  	unsigned long flags;
+ 	spinlock_t *lock;
+ 	bool in_use = false;
  
  	switch (iwmr->type) {
  	case IRDMA_MEMREG_TYPE_CQ:
- 		spin_lock_irqsave(&ucontext->cq_reg_mem_list_lock, flags);
- 		if (iwpbl->on_list) {
- 			iwpbl->on_list = false;
- 			list_del(&iwpbl->list);
- 		}
- 		spin_unlock_irqrestore(&ucontext->cq_reg_mem_list_lock, flags);
+ 		lock = &ucontext->cq_reg_mem_list_lock;
  		break;
  	case IRDMA_MEMREG_TYPE_QP:
- 		spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags);
- 		if (iwpbl->on_list) {
- 			iwpbl->on_list = false;
- 			list_del(&iwpbl->list);
- 		}
- 		spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags);
+ 		lock = &ucontext->qp_reg_mem_list_lock;
  		break;
  	case IRDMA_MEMREG_TYPE_SRQ:
- 		spin_lock_irqsave(&ucontext->srq_reg_mem_list_lock, flags);
- 		if (iwpbl->on_list) {
- 			iwpbl->on_list = false;
- 			list_del(&iwpbl->list);
- 		}
- 		spin_unlock_irqrestore(&ucontext->srq_reg_mem_list_lock, flags);
+ 		lock = &ucontext->srq_reg_mem_list_lock;
  		break;
  	default:
- 		break;
+ 		return false;
  	}
+ 
+ 	spin_lock_irqsave(lock, flags);
+ 	if (!refcount_dec_if_one(&iwmr->user_ring_refs)) {
+ 		in_use = true;
+ 	} else if (iwpbl->on_list) {
+ 		iwpbl->on_list = false;
+ 		list_del(&iwpbl->list);
+ 	}
+ 	spin_unlock_irqrestore(lock, flags);
+ 
+ 	return in_use;
  }
  
  /**
@@@ -3979,6 -4085,10 +4088,10 @@@ static int irdma_dereg_mr(struct ib_mr 
  	bool dmabuf_revocable = iwmr->region && iwmr->region->is_dmabuf;
  	int ret;
  
+ 	ret = ib_no_udata_io(udata);
+ 	if (ret)
+ 		return ret;
+ 
  	if (iwmr->type != IRDMA_MEMREG_TYPE_MEM) {
  		if (iwmr->region) {
  			struct irdma_ucontext *ucontext;
@@@ -3986,7 -4096,12 +4099,12 @@@
  			ucontext = rdma_udata_to_drv_context(udata,
  						struct irdma_ucontext,
  						ibucontext);
- 			irdma_del_memlist(iwmr, ucontext);
+ 
+ 			/* Do not allow the MR to be unpinned if it is still
+ 			 * backing a user ring.
+ 			 */
+ 			if (irdma_del_memlist(iwmr, ucontext))
+ 				return -EBUSY;
  		}
  		goto done;
  	}
@@@ -5295,6 -5410,10 +5413,10 @@@ static int irdma_create_user_ah(struct 
  	struct irdma_ah *parent_ah;
  	int err;
  
+ 	err = ib_is_udata_in_empty(udata);
+ 	if (err)
+ 		return err;
+ 
  	if (udata->outlen < IRDMA_CREATE_AH_MIN_RESP_LEN)
  		return -EINVAL;
  
@@@ -5346,6 -5465,10 +5468,10 @@@ static int irdma_create_ah(struct ib_a
  	struct irdma_device *iwdev = to_iwdev(ibah->pd->device);
  	int err;
  
+ 	err = ib_no_udata_io(udata);
+ 	if (err)
+ 		return err;
+ 
  	err = irdma_setup_ah(ibah, attr);
  	if (err)
  		return err;
@@@ -5428,6 -5551,7 +5554,7 @@@ static const struct ib_device_ops irdma
  	.owner = THIS_MODULE,
  	.driver_id = RDMA_DRIVER_IRDMA,
  	.uverbs_abi_ver = IRDMA_ABI_VER,
+ 	.uverbs_robust_udata = true,
  
  	.alloc_hw_port_stats = irdma_alloc_hw_port_stats,
  	.alloc_mr = irdma_alloc_mr,

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: manual merge of the rdma tree with the origin tree

[Leon Romanovsky]

On Mon, Jul 20, 2026 at 03:43:52PM +0100, Mark Brown wrote:
> Hi all,
> 
> Today's linux-next merge of the rdma tree got a conflict in:
> 
>   drivers/infiniband/hw/irdma/verbs.c
> 
> between commit:
> 
>   b9b0889071569 ("RDMA/irdma: Prevent user-triggered null deref on QP create")
> 
> from the origin tree and commit:
> 
>   d83bf998f719d ("RDMA/irdma: Prevent user-triggered null deref on QP create")

Jason,

By mistake, we ended up with two identical commits: one applied by
you to rdma-rc, and the other applied by me to rdma-next.

Thanks