| cf3ebd89 | 05-Aug-2026 |
Abhijit Gangurde <abhijit.gangurde@amd.com> |
RDMA/ionic: Embed counter driver data in rdma_counter allocation
Commit 7e53b31acc7f ("RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj()") requires drivers implementing counter
RDMA/ionic: Embed counter driver data in rdma_counter allocation
Commit 7e53b31acc7f ("RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj()") requires drivers implementing counter ops to embed struct rdma_counter in a driver-specific struct, register its size via INIT_RDMA_OBJ_SIZE, and provide a counter_init callback.
The ionic driver was merged without this adaptation, causing a NULL pointer dereference in alloc_and_bind() since rdma_zalloc_drv_obj() allocates zero bytes when size_rdma_counter is unset.
Consolidate struct ionic_counter into a new struct ionic_rdma_counter that embeds struct rdma_counter, replace the xarray with a lightweight ida for ID allocation, and add the required counter_init and INIT_RDMA_OBJ_SIZE declarations.
Fixes: ea4c399642b8 ("RDMA/ionic: Implement device stats ops") Cc: stable@vger.kernel.org # 6.18 Signed-off-by: Abhijit Gangurde <abhijit.gangurde@amd.com> Link: https://patch.msgid.link/20260805053254.4023262-2-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
show more ...
|
| 8ba04950 | 10-Jun-2026 |
Abhijit Gangurde <abhijit.gangurde@amd.com> |
RDMA/ionic: add completion timestamp to CQE format
Update the CQE structure to include hardware timestamp. When firmware supports RDMA completion timestamps, the hardware populates the timestamp fie
RDMA/ionic: add completion timestamp to CQE format
Update the CQE structure to include hardware timestamp. When firmware supports RDMA completion timestamps, the hardware populates the timestamp field.
Co-developed-by: Allen Hubbe <allen.hubbe@amd.com> Signed-off-by: Allen Hubbe <allen.hubbe@amd.com> Signed-off-by: Abhijit Gangurde <abhijit.gangurde@amd.com> Link: https://patch.msgid.link/20260610154216.712374-5-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
show more ...
|
| 654a27f2 | 07-Apr-2026 |
Kai Zen <kai.aizen.dev@gmail.com> |
RDMA/ionic: bound node_desc sysfs read with %.64s
node_desc[64] in struct ib_device is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason (drivers/i
RDMA/ionic: bound node_desc sysfs read with %.64s
node_desc[64] in struct ib_device is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason (drivers/infiniband/core/sysfs.c:1307), since node_desc_store() performs a raw memcpy of up to IB_DEVICE_NODE_DESC_MAX bytes with no NUL termination:
memcpy(desc.node_desc, buf, min_t(int, count, IB_DEVICE_NODE_DESC_MAX));
If exactly 64 bytes are written via the node_desc sysfs file, the array contains no NUL byte. The ionic hca_type_show() handler uses unbounded "%s" and will read past the end of node_desc into adjacent fields of struct ib_device until it encounters a NUL.
ionic supports IB_DEVICE_MODIFY_NODE_DESC, so this is triggerable by userspace.
Match the core handler and bound the format specifier.
Cc: stable@vger.kernel.org Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality") Link: https://patch.msgid.link/r/CALynFi7NAbhDCt1tdaDbf6TnLvAqbaHa6-Wqf6OkzREbA_PAfg@mail.gmail.com Signed-off-by: Kai Aizen <kai.aizen.dev@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
show more ...
|
| faa72102 | 16-Feb-2026 |
Jason Gunthorpe <jgg@nvidia.com> |
RDMA/ionic: Fix kernel stack leak in ionic_create_cq()
struct ionic_cq_resp resp { __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below) __u8 udma_mask; // offset 8 - SET (re
RDMA/ionic: Fix kernel stack leak in ionic_create_cq()
struct ionic_cq_resp resp { __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below) __u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask) __u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK };
rsvd[7]: 7 bytes of stack memory leaked unconditionally.
cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but udma_count could be 1, meaning cqid[1] might never be written via ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4 bytes) is also leaked. So potentially 11 bytes leaked.
Cc: stable@vger.kernel.org Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://patch.msgid.link/4-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com Acked-by: Abhijit Gangurde <abhijit.gangurde@amd.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
show more ...
|
| e6d736bd | 24-Sep-2025 |
Abhijit Gangurde <abhijit.gangurde@amd.com> |
RDMA/ionic: Fix memory leak of admin q_wr
The admin queue work request buffer, aq->q_wr, is allocated via kcalloc in __ionic_create_rdma_adminq. However, it was not being freed in the corresponding
RDMA/ionic: Fix memory leak of admin q_wr
The admin queue work request buffer, aq->q_wr, is allocated via kcalloc in __ionic_create_rdma_adminq. However, it was not being freed in the corresponding teardown function __ionic_destroy_rdma_adminq. This results in a memory leak. Fix this leak by adding the missing kfree(aq->q_wr) in the destruction path.
Fixes: f3bdbd42702c ("RDMA/ionic: Create device queues to support admin operations") Link: https://patch.msgid.link/r/20250924142123.18344-1-abhijit.gangurde@amd.com Signed-off-by: Abhijit Gangurde <abhijit.gangurde@amd.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
show more ...
|