2020-08-27 09:54:40 -05:00
|
|
|
// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB
|
2016-06-16 16:45:23 +03:00
|
|
|
/*
|
|
|
|
* Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved.
|
|
|
|
* Copyright (c) 2015 System Fabric Works, Inc. All rights reserved.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/skbuff.h>
|
|
|
|
#include <linux/if_arp.h>
|
|
|
|
#include <linux/netdevice.h>
|
|
|
|
#include <linux/if.h>
|
2021-01-20 17:19:13 +01:00
|
|
|
#include <linux/if_vlan.h>
|
2016-06-16 16:45:23 +03:00
|
|
|
#include <net/udp_tunnel.h>
|
|
|
|
#include <net/sch_generic.h>
|
|
|
|
#include <linux/netfilter.h>
|
|
|
|
#include <rdma/ib_addr.h>
|
|
|
|
|
|
|
|
#include "rxe.h"
|
|
|
|
#include "rxe_net.h"
|
|
|
|
#include "rxe_loc.h"
|
|
|
|
|
2018-01-07 07:08:48 -05:00
|
|
|
static struct rxe_recv_sockets recv_sockets;
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2022-11-03 12:10:04 -05:00
|
|
|
static struct dst_entry *rxe_find_route4(struct rxe_qp *qp,
|
|
|
|
struct net_device *ndev,
|
|
|
|
struct in_addr *saddr,
|
|
|
|
struct in_addr *daddr)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
|
|
|
struct rtable *rt;
|
|
|
|
struct flowi4 fl = { { 0 } };
|
|
|
|
|
|
|
|
memset(&fl, 0, sizeof(fl));
|
|
|
|
fl.flowi4_oif = ndev->ifindex;
|
|
|
|
memcpy(&fl.saddr, saddr, sizeof(*saddr));
|
|
|
|
memcpy(&fl.daddr, daddr, sizeof(*daddr));
|
|
|
|
fl.flowi4_proto = IPPROTO_UDP;
|
|
|
|
|
|
|
|
rt = ip_route_output_key(&init_net, &fl);
|
|
|
|
if (IS_ERR(rt)) {
|
2022-11-03 12:10:04 -05:00
|
|
|
rxe_dbg_qp(qp, "no route to %pI4\n", &daddr->s_addr);
|
2016-06-16 16:45:23 +03:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
return &rt->dst;
|
|
|
|
}
|
|
|
|
|
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2022-11-03 12:10:04 -05:00
|
|
|
static struct dst_entry *rxe_find_route6(struct rxe_qp *qp,
|
|
|
|
struct net_device *ndev,
|
2016-06-16 16:45:23 +03:00
|
|
|
struct in6_addr *saddr,
|
|
|
|
struct in6_addr *daddr)
|
|
|
|
{
|
|
|
|
struct dst_entry *ndst;
|
|
|
|
struct flowi6 fl6 = { { 0 } };
|
|
|
|
|
|
|
|
memset(&fl6, 0, sizeof(fl6));
|
|
|
|
fl6.flowi6_oif = ndev->ifindex;
|
|
|
|
memcpy(&fl6.saddr, saddr, sizeof(*saddr));
|
|
|
|
memcpy(&fl6.daddr, daddr, sizeof(*daddr));
|
|
|
|
fl6.flowi6_proto = IPPROTO_UDP;
|
|
|
|
|
2019-12-04 15:35:53 +01:00
|
|
|
ndst = ipv6_stub->ipv6_dst_lookup_flow(sock_net(recv_sockets.sk6->sk),
|
|
|
|
recv_sockets.sk6->sk, &fl6,
|
|
|
|
NULL);
|
2020-08-20 17:46:23 -05:00
|
|
|
if (IS_ERR(ndst)) {
|
2022-11-03 12:10:04 -05:00
|
|
|
rxe_dbg_qp(qp, "no route to %pI6\n", daddr);
|
2019-12-04 15:35:53 +01:00
|
|
|
return NULL;
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if (unlikely(ndst->error)) {
|
2022-11-03 12:10:04 -05:00
|
|
|
rxe_dbg_qp(qp, "no route to %pI6\n", daddr);
|
2016-06-16 16:45:23 +03:00
|
|
|
goto put;
|
|
|
|
}
|
|
|
|
|
|
|
|
return ndst;
|
|
|
|
put:
|
|
|
|
dst_release(ndst);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
#else
|
|
|
|
|
2022-11-03 12:10:04 -05:00
|
|
|
static struct dst_entry *rxe_find_route6(struct rxe_qp *qp,
|
|
|
|
struct net_device *ndev,
|
2016-06-16 16:45:23 +03:00
|
|
|
struct in6_addr *saddr,
|
|
|
|
struct in6_addr *daddr)
|
|
|
|
{
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
2018-08-28 13:51:37 +03:00
|
|
|
static struct dst_entry *rxe_find_route(struct net_device *ndev,
|
2017-04-20 20:55:56 +03:00
|
|
|
struct rxe_qp *qp,
|
|
|
|
struct rxe_av *av)
|
|
|
|
{
|
|
|
|
struct dst_entry *dst = NULL;
|
|
|
|
|
|
|
|
if (qp_type(qp) == IB_QPT_RC)
|
|
|
|
dst = sk_dst_get(qp->sk->sk);
|
|
|
|
|
2017-08-28 16:11:53 -04:00
|
|
|
if (!dst || !dst_check(dst, qp->dst_cookie)) {
|
2017-04-20 20:55:56 +03:00
|
|
|
if (dst)
|
|
|
|
dst_release(dst);
|
|
|
|
|
2020-10-15 20:42:18 -03:00
|
|
|
if (av->network_type == RXE_NETWORK_TYPE_IPV4) {
|
2017-04-20 20:55:56 +03:00
|
|
|
struct in_addr *saddr;
|
|
|
|
struct in_addr *daddr;
|
|
|
|
|
|
|
|
saddr = &av->sgid_addr._sockaddr_in.sin_addr;
|
|
|
|
daddr = &av->dgid_addr._sockaddr_in.sin_addr;
|
2022-11-03 12:10:04 -05:00
|
|
|
dst = rxe_find_route4(qp, ndev, saddr, daddr);
|
2020-10-15 20:42:18 -03:00
|
|
|
} else if (av->network_type == RXE_NETWORK_TYPE_IPV6) {
|
2017-04-20 20:55:56 +03:00
|
|
|
struct in6_addr *saddr6;
|
|
|
|
struct in6_addr *daddr6;
|
|
|
|
|
|
|
|
saddr6 = &av->sgid_addr._sockaddr_in6.sin6_addr;
|
|
|
|
daddr6 = &av->dgid_addr._sockaddr_in6.sin6_addr;
|
2022-11-03 12:10:04 -05:00
|
|
|
dst = rxe_find_route6(qp, ndev, saddr6, daddr6);
|
2017-08-28 16:11:53 -04:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
|
|
if (dst)
|
|
|
|
qp->dst_cookie =
|
|
|
|
rt6_get_cookie((struct rt6_info *)dst);
|
|
|
|
#endif
|
2017-04-20 20:55:56 +03:00
|
|
|
}
|
2018-06-18 18:48:56 -07:00
|
|
|
|
|
|
|
if (dst && (qp_type(qp) == IB_QPT_RC)) {
|
|
|
|
dst_hold(dst);
|
|
|
|
sk_dst_set(qp->sk->sk, dst);
|
|
|
|
}
|
2017-04-20 20:55:56 +03:00
|
|
|
}
|
|
|
|
return dst;
|
|
|
|
}
|
|
|
|
|
2016-06-16 16:45:23 +03:00
|
|
|
static int rxe_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
struct udphdr *udph;
|
2021-01-28 17:33:19 -06:00
|
|
|
struct rxe_dev *rxe;
|
2016-06-16 16:45:23 +03:00
|
|
|
struct net_device *ndev = skb->dev;
|
|
|
|
struct rxe_pkt_info *pkt = SKB_TO_PKT(skb);
|
|
|
|
|
2021-01-28 17:33:19 -06:00
|
|
|
/* takes a reference on rxe->ib_dev
|
|
|
|
* drop when skb is freed
|
|
|
|
*/
|
|
|
|
rxe = rxe_get_dev_from_net(ndev);
|
2021-02-18 11:17:24 -04:00
|
|
|
if (!rxe && is_vlan_dev(ndev))
|
|
|
|
rxe = rxe_get_dev_from_net(vlan_dev_real_dev(ndev));
|
2016-06-16 16:45:23 +03:00
|
|
|
if (!rxe)
|
|
|
|
goto drop;
|
|
|
|
|
|
|
|
if (skb_linearize(skb)) {
|
2019-02-12 21:12:52 -07:00
|
|
|
ib_device_put(&rxe->ib_dev);
|
2016-06-16 16:45:23 +03:00
|
|
|
goto drop;
|
|
|
|
}
|
|
|
|
|
|
|
|
udph = udp_hdr(skb);
|
|
|
|
pkt->rxe = rxe;
|
|
|
|
pkt->port_num = 1;
|
|
|
|
pkt->hdr = (u8 *)(udph + 1);
|
|
|
|
pkt->mask = RXE_GRH_MASK;
|
|
|
|
pkt->paylen = be16_to_cpu(udph->len) - sizeof(*udph);
|
|
|
|
|
2023-05-17 12:22:42 -05:00
|
|
|
/* remove udp header */
|
|
|
|
skb_pull(skb, sizeof(struct udphdr));
|
|
|
|
|
2018-04-20 17:05:03 +03:00
|
|
|
rxe_rcv(skb);
|
|
|
|
|
|
|
|
return 0;
|
2016-06-16 16:45:23 +03:00
|
|
|
drop:
|
|
|
|
kfree_skb(skb);
|
2018-04-20 17:05:03 +03:00
|
|
|
|
2016-06-16 16:45:23 +03:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port,
|
|
|
|
bool ipv6)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
struct socket *sock;
|
2017-01-10 11:15:40 -08:00
|
|
|
struct udp_port_cfg udp_cfg = { };
|
|
|
|
struct udp_tunnel_sock_cfg tnl_cfg = { };
|
2016-06-16 16:45:23 +03:00
|
|
|
|
|
|
|
if (ipv6) {
|
|
|
|
udp_cfg.family = AF_INET6;
|
|
|
|
udp_cfg.ipv6_v6only = 1;
|
|
|
|
} else {
|
|
|
|
udp_cfg.family = AF_INET;
|
|
|
|
}
|
|
|
|
|
|
|
|
udp_cfg.local_udp_port = port;
|
|
|
|
|
|
|
|
/* Create UDP socket */
|
|
|
|
err = udp_sock_create(net, &udp_cfg, &sock);
|
2021-06-03 12:01:12 +03:00
|
|
|
if (err < 0)
|
2016-06-16 16:45:23 +03:00
|
|
|
return ERR_PTR(err);
|
|
|
|
|
|
|
|
tnl_cfg.encap_type = 1;
|
|
|
|
tnl_cfg.encap_rcv = rxe_udp_encap_recv;
|
|
|
|
|
|
|
|
/* Setup UDP tunnel */
|
|
|
|
setup_udp_tunnel_sock(net, sock, &tnl_cfg);
|
|
|
|
|
|
|
|
return sock;
|
|
|
|
}
|
|
|
|
|
2018-04-09 08:19:18 -04:00
|
|
|
static void rxe_release_udp_tunnel(struct socket *sk)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
2016-09-07 14:04:04 +03:00
|
|
|
if (sk)
|
|
|
|
udp_tunnel_sock_release(sk);
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
static void prepare_udp_hdr(struct sk_buff *skb, __be16 src_port,
|
|
|
|
__be16 dst_port)
|
|
|
|
{
|
|
|
|
struct udphdr *udph;
|
|
|
|
|
|
|
|
__skb_push(skb, sizeof(*udph));
|
|
|
|
skb_reset_transport_header(skb);
|
|
|
|
udph = udp_hdr(skb);
|
|
|
|
|
|
|
|
udph->dest = dst_port;
|
|
|
|
udph->source = src_port;
|
|
|
|
udph->len = htons(skb->len);
|
|
|
|
udph->check = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void prepare_ipv4_hdr(struct dst_entry *dst, struct sk_buff *skb,
|
|
|
|
__be32 saddr, __be32 daddr, __u8 proto,
|
|
|
|
__u8 tos, __u8 ttl, __be16 df, bool xnet)
|
|
|
|
{
|
|
|
|
struct iphdr *iph;
|
|
|
|
|
|
|
|
skb_scrub_packet(skb, xnet);
|
|
|
|
|
|
|
|
skb_clear_hash(skb);
|
2017-04-20 20:55:56 +03:00
|
|
|
skb_dst_set(skb, dst_clone(dst));
|
2016-06-16 16:45:23 +03:00
|
|
|
memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
|
|
|
|
|
|
|
|
skb_push(skb, sizeof(struct iphdr));
|
|
|
|
skb_reset_network_header(skb);
|
|
|
|
|
|
|
|
iph = ip_hdr(skb);
|
|
|
|
|
|
|
|
iph->version = IPVERSION;
|
|
|
|
iph->ihl = sizeof(struct iphdr) >> 2;
|
2021-07-29 17:00:39 -05:00
|
|
|
iph->tot_len = htons(skb->len);
|
2016-06-16 16:45:23 +03:00
|
|
|
iph->frag_off = df;
|
|
|
|
iph->protocol = proto;
|
|
|
|
iph->tos = tos;
|
|
|
|
iph->daddr = daddr;
|
|
|
|
iph->saddr = saddr;
|
|
|
|
iph->ttl = ttl;
|
|
|
|
__ip_select_ident(dev_net(dst->dev), iph,
|
|
|
|
skb_shinfo(skb)->gso_segs ?: 1);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void prepare_ipv6_hdr(struct dst_entry *dst, struct sk_buff *skb,
|
|
|
|
struct in6_addr *saddr, struct in6_addr *daddr,
|
|
|
|
__u8 proto, __u8 prio, __u8 ttl)
|
|
|
|
{
|
|
|
|
struct ipv6hdr *ip6h;
|
|
|
|
|
|
|
|
memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
|
|
|
|
IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED
|
|
|
|
| IPSKB_REROUTED);
|
2017-08-28 16:11:54 -04:00
|
|
|
skb_dst_set(skb, dst_clone(dst));
|
2016-06-16 16:45:23 +03:00
|
|
|
|
|
|
|
__skb_push(skb, sizeof(*ip6h));
|
|
|
|
skb_reset_network_header(skb);
|
|
|
|
ip6h = ipv6_hdr(skb);
|
|
|
|
ip6_flow_hdr(ip6h, prio, htonl(0));
|
|
|
|
ip6h->payload_len = htons(skb->len);
|
|
|
|
ip6h->nexthdr = proto;
|
|
|
|
ip6h->hop_limit = ttl;
|
|
|
|
ip6h->daddr = *daddr;
|
|
|
|
ip6h->saddr = *saddr;
|
|
|
|
ip6h->payload_len = htons(skb->len - sizeof(*ip6h));
|
|
|
|
}
|
|
|
|
|
2022-03-03 18:07:57 -06:00
|
|
|
static int prepare4(struct rxe_av *av, struct rxe_pkt_info *pkt,
|
|
|
|
struct sk_buff *skb)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
2017-04-20 20:55:56 +03:00
|
|
|
struct rxe_qp *qp = pkt->qp;
|
2016-06-16 16:45:23 +03:00
|
|
|
struct dst_entry *dst;
|
|
|
|
bool xnet = false;
|
|
|
|
__be16 df = htons(IP_DF);
|
|
|
|
struct in_addr *saddr = &av->sgid_addr._sockaddr_in.sin_addr;
|
|
|
|
struct in_addr *daddr = &av->dgid_addr._sockaddr_in.sin_addr;
|
|
|
|
|
2018-08-28 13:51:37 +03:00
|
|
|
dst = rxe_find_route(skb->dev, qp, av);
|
2016-06-16 16:45:23 +03:00
|
|
|
if (!dst) {
|
2022-11-03 12:10:04 -05:00
|
|
|
rxe_dbg_qp(qp, "Host not reachable\n");
|
2016-06-16 16:45:23 +03:00
|
|
|
return -EHOSTUNREACH;
|
|
|
|
}
|
|
|
|
|
2018-07-05 18:43:47 -07:00
|
|
|
prepare_udp_hdr(skb, cpu_to_be16(qp->src_port),
|
|
|
|
cpu_to_be16(ROCE_V2_UDP_DPORT));
|
2016-06-16 16:45:23 +03:00
|
|
|
|
|
|
|
prepare_ipv4_hdr(dst, skb, saddr->s_addr, daddr->s_addr, IPPROTO_UDP,
|
|
|
|
av->grh.traffic_class, av->grh.hop_limit, df, xnet);
|
2017-04-20 20:55:56 +03:00
|
|
|
|
2018-06-18 18:48:56 -07:00
|
|
|
dst_release(dst);
|
2016-06-16 16:45:23 +03:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2022-03-03 18:07:57 -06:00
|
|
|
static int prepare6(struct rxe_av *av, struct rxe_pkt_info *pkt,
|
|
|
|
struct sk_buff *skb)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
2017-04-20 20:55:56 +03:00
|
|
|
struct rxe_qp *qp = pkt->qp;
|
2017-08-28 16:11:56 -04:00
|
|
|
struct dst_entry *dst;
|
2016-06-16 16:45:23 +03:00
|
|
|
struct in6_addr *saddr = &av->sgid_addr._sockaddr_in6.sin6_addr;
|
|
|
|
struct in6_addr *daddr = &av->dgid_addr._sockaddr_in6.sin6_addr;
|
|
|
|
|
2018-08-28 13:51:37 +03:00
|
|
|
dst = rxe_find_route(skb->dev, qp, av);
|
2016-06-16 16:45:23 +03:00
|
|
|
if (!dst) {
|
2022-11-03 12:10:04 -05:00
|
|
|
rxe_dbg_qp(qp, "Host not reachable\n");
|
2016-06-16 16:45:23 +03:00
|
|
|
return -EHOSTUNREACH;
|
|
|
|
}
|
|
|
|
|
2018-07-05 18:43:47 -07:00
|
|
|
prepare_udp_hdr(skb, cpu_to_be16(qp->src_port),
|
|
|
|
cpu_to_be16(ROCE_V2_UDP_DPORT));
|
2016-06-16 16:45:23 +03:00
|
|
|
|
|
|
|
prepare_ipv6_hdr(dst, skb, saddr, daddr, IPPROTO_UDP,
|
|
|
|
av->grh.traffic_class,
|
|
|
|
av->grh.hop_limit);
|
2017-04-20 20:55:56 +03:00
|
|
|
|
2018-06-18 18:48:56 -07:00
|
|
|
dst_release(dst);
|
2016-06-16 16:45:23 +03:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2022-03-03 18:07:57 -06:00
|
|
|
int rxe_prepare(struct rxe_av *av, struct rxe_pkt_info *pkt,
|
|
|
|
struct sk_buff *skb)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
|
|
|
int err = 0;
|
|
|
|
|
2019-03-27 05:50:47 -04:00
|
|
|
if (skb->protocol == htons(ETH_P_IP))
|
2022-03-03 18:07:57 -06:00
|
|
|
err = prepare4(av, pkt, skb);
|
2019-03-27 05:50:47 -04:00
|
|
|
else if (skb->protocol == htons(ETH_P_IPV6))
|
2022-03-03 18:07:57 -06:00
|
|
|
err = prepare6(av, pkt, skb);
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2022-03-03 18:07:57 -06:00
|
|
|
if (ether_addr_equal(skb->dev->dev_addr, av->dmac))
|
2019-01-29 12:08:50 +02:00
|
|
|
pkt->mask |= RXE_LOOPBACK_MASK;
|
|
|
|
|
2016-06-16 16:45:23 +03:00
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void rxe_skb_tx_dtor(struct sk_buff *skb)
|
|
|
|
{
|
2024-03-29 09:55:15 -05:00
|
|
|
struct net_device *ndev = skb->dev;
|
|
|
|
struct rxe_dev *rxe;
|
|
|
|
unsigned int qp_index;
|
|
|
|
struct rxe_qp *qp;
|
|
|
|
int skb_out;
|
|
|
|
|
|
|
|
rxe = rxe_get_dev_from_net(ndev);
|
|
|
|
if (!rxe && is_vlan_dev(ndev))
|
|
|
|
rxe = rxe_get_dev_from_net(vlan_dev_real_dev(ndev));
|
|
|
|
if (WARN_ON(!rxe))
|
|
|
|
return;
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2024-03-29 09:55:15 -05:00
|
|
|
qp_index = (int)(uintptr_t)skb->sk->sk_user_data;
|
|
|
|
if (!qp_index)
|
|
|
|
return;
|
|
|
|
|
|
|
|
qp = rxe_pool_get_index(&rxe->qp_pool, qp_index);
|
|
|
|
if (!qp)
|
|
|
|
goto put_dev;
|
|
|
|
|
|
|
|
skb_out = atomic_dec_return(&qp->skb_out);
|
|
|
|
if (qp->need_req_skb && skb_out < RXE_INFLIGHT_SKBS_PER_QP_LOW)
|
2024-03-29 09:55:07 -05:00
|
|
|
rxe_sched_task(&qp->send_task);
|
2017-06-22 17:09:59 +03:00
|
|
|
|
2022-03-03 18:08:05 -06:00
|
|
|
rxe_put(qp);
|
2024-03-29 09:55:15 -05:00
|
|
|
put_dev:
|
|
|
|
ib_device_put(&rxe->ib_dev);
|
|
|
|
sock_put(skb->sk);
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
2021-07-06 23:00:35 -05:00
|
|
|
static int rxe_send(struct sk_buff *skb, struct rxe_pkt_info *pkt)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
|
|
|
int err;
|
2024-03-29 09:55:15 -05:00
|
|
|
struct sock *sk = pkt->qp->sk->sk;
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2024-03-29 09:55:15 -05:00
|
|
|
sock_hold(sk);
|
|
|
|
skb->sk = sk;
|
2018-01-08 00:14:25 -05:00
|
|
|
skb->destructor = rxe_skb_tx_dtor;
|
2017-08-28 16:11:49 -04:00
|
|
|
atomic_inc(&pkt->qp->skb_out);
|
|
|
|
|
2024-03-29 09:55:12 -05:00
|
|
|
if (skb->protocol == htons(ETH_P_IP))
|
2018-01-08 00:14:25 -05:00
|
|
|
err = ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb);
|
2024-03-29 09:55:12 -05:00
|
|
|
else
|
2018-01-08 00:14:25 -05:00
|
|
|
err = ip6_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb);
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2024-03-29 09:55:14 -05:00
|
|
|
return err;
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
2021-03-04 13:20:49 -06:00
|
|
|
/* fix up a send packet to match the packets
|
|
|
|
* received from UDP before looping them back
|
|
|
|
*/
|
2021-07-06 23:00:35 -05:00
|
|
|
static int rxe_loopback(struct sk_buff *skb, struct rxe_pkt_info *pkt)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
2024-03-29 09:55:15 -05:00
|
|
|
struct sock *sk = pkt->qp->sk->sk;
|
|
|
|
|
2021-07-06 23:00:35 -05:00
|
|
|
memcpy(SKB_TO_PKT(skb), pkt, sizeof(*pkt));
|
2021-03-04 13:20:49 -06:00
|
|
|
|
2024-03-29 09:55:15 -05:00
|
|
|
sock_hold(sk);
|
|
|
|
skb->sk = sk;
|
2024-03-29 09:55:13 -05:00
|
|
|
skb->destructor = rxe_skb_tx_dtor;
|
|
|
|
atomic_inc(&pkt->qp->skb_out);
|
|
|
|
|
2021-01-28 12:23:02 -06:00
|
|
|
if (skb->protocol == htons(ETH_P_IP))
|
|
|
|
skb_pull(skb, sizeof(struct iphdr));
|
|
|
|
else
|
|
|
|
skb_pull(skb, sizeof(struct ipv6hdr));
|
|
|
|
|
2021-07-06 23:00:35 -05:00
|
|
|
if (WARN_ON(!ib_device_try_get(&pkt->rxe->ib_dev))) {
|
2021-03-04 13:20:49 -06:00
|
|
|
kfree_skb(skb);
|
2021-07-06 23:00:35 -05:00
|
|
|
return -EIO;
|
|
|
|
}
|
|
|
|
|
2023-05-17 12:22:42 -05:00
|
|
|
/* remove udp header */
|
|
|
|
skb_pull(skb, sizeof(struct udphdr));
|
|
|
|
|
2021-07-06 23:00:35 -05:00
|
|
|
rxe_rcv(skb);
|
|
|
|
|
|
|
|
return 0;
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
2021-07-06 23:00:34 -05:00
|
|
|
int rxe_xmit_packet(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
|
|
|
|
struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
int is_request = pkt->mask & RXE_REQ_MASK;
|
|
|
|
struct rxe_dev *rxe = to_rdev(qp->ibqp.device);
|
2023-05-10 11:50:56 +08:00
|
|
|
unsigned long flags;
|
2021-07-06 23:00:34 -05:00
|
|
|
|
2023-05-10 11:50:56 +08:00
|
|
|
spin_lock_irqsave(&qp->state_lock, flags);
|
2023-04-04 23:26:09 -05:00
|
|
|
if ((is_request && (qp_state(qp) < IB_QPS_RTS)) ||
|
|
|
|
(!is_request && (qp_state(qp) < IB_QPS_RTR))) {
|
2023-05-10 11:50:56 +08:00
|
|
|
spin_unlock_irqrestore(&qp->state_lock, flags);
|
2022-11-03 12:10:04 -05:00
|
|
|
rxe_dbg_qp(qp, "Packet dropped. QP is not in ready state\n");
|
2021-07-06 23:00:34 -05:00
|
|
|
goto drop;
|
|
|
|
}
|
2023-05-10 11:50:56 +08:00
|
|
|
spin_unlock_irqrestore(&qp->state_lock, flags);
|
2021-07-06 23:00:34 -05:00
|
|
|
|
2021-07-06 23:00:36 -05:00
|
|
|
rxe_icrc_generate(skb, pkt);
|
|
|
|
|
2021-07-06 23:00:35 -05:00
|
|
|
if (pkt->mask & RXE_LOOPBACK_MASK)
|
|
|
|
err = rxe_loopback(skb, pkt);
|
|
|
|
else
|
|
|
|
err = rxe_send(skb, pkt);
|
2021-07-06 23:00:34 -05:00
|
|
|
if (err) {
|
|
|
|
rxe_counter_inc(rxe, RXE_CNT_SEND_ERR);
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
rxe_counter_inc(rxe, RXE_CNT_SENT_PKTS);
|
|
|
|
goto done;
|
|
|
|
|
|
|
|
drop:
|
|
|
|
kfree_skb(skb);
|
|
|
|
err = 0;
|
|
|
|
done:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2017-01-10 11:15:53 -08:00
|
|
|
struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av,
|
|
|
|
int paylen, struct rxe_pkt_info *pkt)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
|
|
|
unsigned int hdr_len;
|
2019-05-02 10:48:05 +03:00
|
|
|
struct sk_buff *skb = NULL;
|
2018-02-14 21:45:43 +01:00
|
|
|
struct net_device *ndev;
|
2018-06-05 08:40:23 +03:00
|
|
|
const struct ib_gid_attr *attr;
|
2018-02-14 21:45:43 +01:00
|
|
|
const int port_num = 1;
|
|
|
|
|
2018-06-05 08:40:23 +03:00
|
|
|
attr = rdma_get_gid_attr(&rxe->ib_dev, port_num, av->grh.sgid_index);
|
|
|
|
if (IS_ERR(attr))
|
|
|
|
return NULL;
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2020-10-16 16:13:44 -05:00
|
|
|
if (av->network_type == RXE_NETWORK_TYPE_IPV4)
|
2016-06-16 16:45:23 +03:00
|
|
|
hdr_len = ETH_HLEN + sizeof(struct udphdr) +
|
|
|
|
sizeof(struct iphdr);
|
|
|
|
else
|
|
|
|
hdr_len = ETH_HLEN + sizeof(struct udphdr) +
|
|
|
|
sizeof(struct ipv6hdr);
|
|
|
|
|
2019-05-02 10:48:05 +03:00
|
|
|
rcu_read_lock();
|
|
|
|
ndev = rdma_read_gid_attr_ndev_rcu(attr);
|
|
|
|
if (IS_ERR(ndev)) {
|
|
|
|
rcu_read_unlock();
|
|
|
|
goto out;
|
|
|
|
}
|
2018-02-14 21:45:43 +01:00
|
|
|
skb = alloc_skb(paylen + hdr_len + LL_RESERVED_SPACE(ndev),
|
2016-06-16 16:45:23 +03:00
|
|
|
GFP_ATOMIC);
|
2018-02-14 21:45:43 +01:00
|
|
|
|
2019-05-02 10:48:05 +03:00
|
|
|
if (unlikely(!skb)) {
|
|
|
|
rcu_read_unlock();
|
2018-06-05 08:40:23 +03:00
|
|
|
goto out;
|
2019-05-02 10:48:05 +03:00
|
|
|
}
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2019-05-02 10:48:01 +03:00
|
|
|
skb_reserve(skb, hdr_len + LL_RESERVED_SPACE(ndev));
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2019-05-02 10:48:01 +03:00
|
|
|
/* FIXME: hold reference to this netdev until life of this skb. */
|
2018-02-14 21:45:43 +01:00
|
|
|
skb->dev = ndev;
|
2019-05-02 10:48:05 +03:00
|
|
|
rcu_read_unlock();
|
|
|
|
|
2020-10-15 20:42:18 -03:00
|
|
|
if (av->network_type == RXE_NETWORK_TYPE_IPV4)
|
2016-06-16 16:45:23 +03:00
|
|
|
skb->protocol = htons(ETH_P_IP);
|
|
|
|
else
|
|
|
|
skb->protocol = htons(ETH_P_IPV6);
|
|
|
|
|
|
|
|
pkt->rxe = rxe;
|
2018-02-14 21:45:43 +01:00
|
|
|
pkt->port_num = port_num;
|
2021-06-17 23:57:43 -05:00
|
|
|
pkt->hdr = skb_put(skb, paylen);
|
2016-06-16 16:45:23 +03:00
|
|
|
pkt->mask |= RXE_GRH_MASK;
|
|
|
|
|
2018-06-05 08:40:23 +03:00
|
|
|
out:
|
|
|
|
rdma_put_gid_attr(attr);
|
2016-06-16 16:45:23 +03:00
|
|
|
return skb;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* this is required by rxe_cfg to match rxe devices in
|
|
|
|
* /sys/class/infiniband up with their underlying ethernet devices
|
|
|
|
*/
|
2017-01-10 11:15:53 -08:00
|
|
|
const char *rxe_parent_name(struct rxe_dev *rxe, unsigned int port_num)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
RDMA/rxe: Remove the direct link to net_device
The similar patch in siw is in the link:
https://git.kernel.org/rdma/rdma/c/16b87037b48889
This problem also occurred in RXE. The following analyze this problem.
In the following Call Traces:
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295
CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted
6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0
Hardware name: Google Compute Engine/Google Compute Engine,
BIOS Google 09/13/2024
Workqueue: infiniband ib_cache_event_task
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60
__ib_query_port drivers/infiniband/core/device.c:2111 [inline]
ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143
ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494
ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
"
1). In the link [1],
"
infiniband syz2: set down
"
This means that on 839.350575, the event ib_cache_event_task was sent andi
queued in ib_wq.
2). In the link [1],
"
team0 (unregistering): Port device team_slave_0 removed
"
It indicates that before 843.251853, the net device should be freed.
3). In the link [1],
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0
"
This means that on 850.559070, this slab-use-after-free problem occurred.
In all, on 839.350575, the event ib_cache_event_task was sent and queued
in ib_wq,
before 843.251853, the net device veth was freed.
on 850.559070, this event was executed, and the mentioned freed net device
was called. Thus, the above call trace occurred.
[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000
Reported-by: syzbot+4b87489410b4efd181bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b87489410b4efd181bf
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20241220222325.2487767-1-yanjun.zhu@linux.dev
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2024-12-20 23:23:25 +01:00
|
|
|
struct net_device *ndev;
|
|
|
|
char *ndev_name;
|
|
|
|
|
|
|
|
ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);
|
|
|
|
if (!ndev)
|
|
|
|
return NULL;
|
|
|
|
ndev_name = ndev->name;
|
|
|
|
dev_put(ndev);
|
|
|
|
|
|
|
|
return ndev_name;
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
2019-02-15 11:03:57 -08:00
|
|
|
int rxe_net_add(const char *ibdev_name, struct net_device *ndev)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
|
|
|
int err;
|
|
|
|
struct rxe_dev *rxe = NULL;
|
|
|
|
|
2019-01-30 12:49:11 +02:00
|
|
|
rxe = ib_alloc_device(rxe_dev, ib_dev);
|
2016-06-16 16:45:23 +03:00
|
|
|
if (!rxe)
|
2019-02-12 21:12:56 -07:00
|
|
|
return -ENOMEM;
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2024-07-01 15:40:48 +03:00
|
|
|
ib_mark_name_assigned_by_user(&rxe->ib_dev);
|
2016-06-16 16:45:23 +03:00
|
|
|
|
RDMA/rxe: Remove the direct link to net_device
The similar patch in siw is in the link:
https://git.kernel.org/rdma/rdma/c/16b87037b48889
This problem also occurred in RXE. The following analyze this problem.
In the following Call Traces:
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295
CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted
6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0
Hardware name: Google Compute Engine/Google Compute Engine,
BIOS Google 09/13/2024
Workqueue: infiniband ib_cache_event_task
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60
__ib_query_port drivers/infiniband/core/device.c:2111 [inline]
ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143
ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494
ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
"
1). In the link [1],
"
infiniband syz2: set down
"
This means that on 839.350575, the event ib_cache_event_task was sent andi
queued in ib_wq.
2). In the link [1],
"
team0 (unregistering): Port device team_slave_0 removed
"
It indicates that before 843.251853, the net device should be freed.
3). In the link [1],
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0
"
This means that on 850.559070, this slab-use-after-free problem occurred.
In all, on 839.350575, the event ib_cache_event_task was sent and queued
in ib_wq,
before 843.251853, the net device veth was freed.
on 850.559070, this event was executed, and the mentioned freed net device
was called. Thus, the above call trace occurred.
[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000
Reported-by: syzbot+4b87489410b4efd181bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b87489410b4efd181bf
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20241220222325.2487767-1-yanjun.zhu@linux.dev
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2024-12-20 23:23:25 +01:00
|
|
|
err = rxe_add(rxe, ndev->mtu, ibdev_name, ndev);
|
2016-06-16 16:45:23 +03:00
|
|
|
if (err) {
|
|
|
|
ib_dealloc_device(&rxe->ib_dev);
|
2019-02-12 21:12:56 -07:00
|
|
|
return err;
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
2019-02-12 21:12:56 -07:00
|
|
|
return 0;
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
static void rxe_port_event(struct rxe_dev *rxe,
|
|
|
|
enum ib_event_type event)
|
|
|
|
{
|
|
|
|
struct ib_event ev;
|
|
|
|
|
|
|
|
ev.device = &rxe->ib_dev;
|
|
|
|
ev.element.port_num = 1;
|
|
|
|
ev.event = event;
|
|
|
|
|
|
|
|
ib_dispatch_event(&ev);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Caller must hold net_info_lock */
|
|
|
|
void rxe_port_up(struct rxe_dev *rxe)
|
|
|
|
{
|
|
|
|
rxe_port_event(rxe, IB_EVENT_PORT_ACTIVE);
|
2018-09-20 16:42:24 -06:00
|
|
|
dev_info(&rxe->ib_dev.dev, "set active\n");
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Caller must hold net_info_lock */
|
|
|
|
void rxe_port_down(struct rxe_dev *rxe)
|
|
|
|
{
|
|
|
|
rxe_port_event(rxe, IB_EVENT_PORT_ERR);
|
2018-11-01 09:18:46 -04:00
|
|
|
rxe_counter_inc(rxe, RXE_CNT_LINK_DOWNED);
|
2018-09-20 16:42:24 -06:00
|
|
|
dev_info(&rxe->ib_dev.dev, "set down\n");
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
2018-12-14 08:05:49 -08:00
|
|
|
void rxe_set_port_state(struct rxe_dev *rxe)
|
|
|
|
{
|
RDMA/rxe: Remove the direct link to net_device
The similar patch in siw is in the link:
https://git.kernel.org/rdma/rdma/c/16b87037b48889
This problem also occurred in RXE. The following analyze this problem.
In the following Call Traces:
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295
CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted
6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0
Hardware name: Google Compute Engine/Google Compute Engine,
BIOS Google 09/13/2024
Workqueue: infiniband ib_cache_event_task
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60
__ib_query_port drivers/infiniband/core/device.c:2111 [inline]
ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143
ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494
ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
"
1). In the link [1],
"
infiniband syz2: set down
"
This means that on 839.350575, the event ib_cache_event_task was sent andi
queued in ib_wq.
2). In the link [1],
"
team0 (unregistering): Port device team_slave_0 removed
"
It indicates that before 843.251853, the net device should be freed.
3). In the link [1],
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0
"
This means that on 850.559070, this slab-use-after-free problem occurred.
In all, on 839.350575, the event ib_cache_event_task was sent and queued
in ib_wq,
before 843.251853, the net device veth was freed.
on 850.559070, this event was executed, and the mentioned freed net device
was called. Thus, the above call trace occurred.
[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000
Reported-by: syzbot+4b87489410b4efd181bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b87489410b4efd181bf
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20241220222325.2487767-1-yanjun.zhu@linux.dev
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2024-12-20 23:23:25 +01:00
|
|
|
struct net_device *ndev;
|
|
|
|
|
|
|
|
ndev = rxe_ib_device_get_netdev(&rxe->ib_dev);
|
|
|
|
if (!ndev)
|
|
|
|
return;
|
|
|
|
|
RDMA v6.14 merge window pull request
Lighter that normal, but the now usual collection of driver fixes and
small improvements:
- Small fixes and minor improvements to cxgb4, bnxt_re, rxe, srp, efa,
cxgb4
- Update mlx4 to use the new umem APIs, avoiding direct use of scatterlist
- Support ROCEv2 in erdma
- Remove various uncalled functions, constify bin_attribute
- Provide core infrastructure to catch netdev events and route them to
drivers, consolidating duplicated driver code
- Fix rare race condition crashes in mlx5 ODP flows
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCZ5JkNAAKCRCFwuHvBreF
YeCwAP9nrzFZMBEa0DVx7V8w3sotQCOzaaoi+4UOigeleppKSAD+K7QA5CIwNf7j
x0apvJlNsXKSYJVUI2rch/qIL8ckQwM=
=wIYu
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Pull rdma updates from Jason Gunthorpe:
"Lighter that normal, but the now usual collection of driver fixes and
small improvements:
- Small fixes and minor improvements to cxgb4, bnxt_re, rxe, srp,
efa, cxgb4
- Update mlx4 to use the new umem APIs, avoiding direct use of
scatterlist
- Support ROCEv2 in erdma
- Remove various uncalled functions, constify bin_attribute
- Provide core infrastructure to catch netdev events and route them
to drivers, consolidating duplicated driver code
- Fix rare race condition crashes in mlx5 ODP flows"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (63 commits)
RDMA/mlx5: Fix implicit ODP use after free
RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
RDMA/qib: Constify 'struct bin_attribute'
RDMA/hfi1: Constify 'struct bin_attribute'
RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"
RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event
RDMA/bnxt_re: Allocate dev_attr information dynamically
RDMA/bnxt_re: Pass the context for ulp_irq_stop
RDMA/bnxt_re: Add support to handle DCB_CONFIG_CHANGE event
RDMA/bnxt_re: Query firmware defaults of CC params during probe
RDMA/bnxt_re: Add Async event handling support
bnxt_en: Add ULP call to notify async events
RDMA/mlx5: Fix indirect mkey ODP page count
MAINTAINERS: Update the bnxt_re maintainers
RDMA/hns: Clean up the legacy CONFIG_INFINIBAND_HNS
RDMA/rtrs: Add missing deinit() call
RDMA/efa: Align interrupt related fields to same type
RDMA/bnxt_re: Fix to drop reference to the mmap entry in case of error
RDMA/mlx5: Fix link status down event for MPV
RDMA/erdma: Support create_ah/destroy_ah in non-sleepable contexts
...
2025-01-24 12:21:28 -08:00
|
|
|
if (ib_get_curr_port_state(ndev) == IB_PORT_ACTIVE)
|
2018-12-14 08:05:49 -08:00
|
|
|
rxe_port_up(rxe);
|
|
|
|
else
|
|
|
|
rxe_port_down(rxe);
|
RDMA/rxe: Remove the direct link to net_device
The similar patch in siw is in the link:
https://git.kernel.org/rdma/rdma/c/16b87037b48889
This problem also occurred in RXE. The following analyze this problem.
In the following Call Traces:
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
Read of size 4 at addr ffff8880554640b0 by task kworker/1:4/5295
CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted
6.12.0-rc3-syzkaller-00399-g9197b73fd7bb #0
Hardware name: Google Compute Engine/Google Compute Engine,
BIOS Google 09/13/2024
Workqueue: infiniband ib_cache_event_task
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
dev_get_flags+0x188/0x1d0 net/core/dev.c:8782
rxe_query_port+0x12d/0x260 drivers/infiniband/sw/rxe/rxe_verbs.c:60
__ib_query_port drivers/infiniband/core/device.c:2111 [inline]
ib_query_port+0x168/0x7d0 drivers/infiniband/core/device.c:2143
ib_cache_update+0x1a9/0xb80 drivers/infiniband/core/cache.c:1494
ib_cache_event_task+0xf3/0x1e0 drivers/infiniband/core/cache.c:1568
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0xa65/0x1850 kernel/workqueue.c:3310
worker_thread+0x870/0xd30 kernel/workqueue.c:3391
kthread+0x2f2/0x390 kernel/kthread.c:389
ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
"
1). In the link [1],
"
infiniband syz2: set down
"
This means that on 839.350575, the event ib_cache_event_task was sent andi
queued in ib_wq.
2). In the link [1],
"
team0 (unregistering): Port device team_slave_0 removed
"
It indicates that before 843.251853, the net device should be freed.
3). In the link [1],
"
BUG: KASAN: slab-use-after-free in dev_get_flags+0x188/0x1d0
"
This means that on 850.559070, this slab-use-after-free problem occurred.
In all, on 839.350575, the event ib_cache_event_task was sent and queued
in ib_wq,
before 843.251853, the net device veth was freed.
on 850.559070, this event was executed, and the mentioned freed net device
was called. Thus, the above call trace occurred.
[1] https://syzkaller.appspot.com/x/log.txt?x=12e7025f980000
Reported-by: syzbot+4b87489410b4efd181bf@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4b87489410b4efd181bf
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/20241220222325.2487767-1-yanjun.zhu@linux.dev
Signed-off-by: Leon Romanovsky <leon@kernel.org>
2024-12-20 23:23:25 +01:00
|
|
|
|
|
|
|
dev_put(ndev);
|
2018-12-14 08:05:49 -08:00
|
|
|
}
|
|
|
|
|
2016-06-16 16:45:23 +03:00
|
|
|
static int rxe_notify(struct notifier_block *not_blk,
|
|
|
|
unsigned long event,
|
|
|
|
void *arg)
|
|
|
|
{
|
|
|
|
struct net_device *ndev = netdev_notifier_info_to_dev(arg);
|
2019-02-12 21:12:52 -07:00
|
|
|
struct rxe_dev *rxe = rxe_get_dev_from_net(ndev);
|
2016-06-16 16:45:23 +03:00
|
|
|
|
|
|
|
if (!rxe)
|
2019-02-12 21:12:52 -07:00
|
|
|
return NOTIFY_OK;
|
2016-06-16 16:45:23 +03:00
|
|
|
|
|
|
|
switch (event) {
|
|
|
|
case NETDEV_UNREGISTER:
|
2019-01-22 16:27:24 -07:00
|
|
|
ib_unregister_device_queued(&rxe->ib_dev);
|
|
|
|
break;
|
2016-06-16 16:45:23 +03:00
|
|
|
case NETDEV_CHANGEMTU:
|
2023-03-03 16:16:22 -06:00
|
|
|
rxe_dbg_dev(rxe, "%s changed mtu to %d\n", ndev->name, ndev->mtu);
|
2016-06-16 16:45:23 +03:00
|
|
|
rxe_set_mtu(rxe, ndev->mtu);
|
|
|
|
break;
|
2024-11-22 18:53:02 +08:00
|
|
|
case NETDEV_DOWN:
|
2016-06-16 16:45:23 +03:00
|
|
|
case NETDEV_CHANGE:
|
2024-11-22 18:53:02 +08:00
|
|
|
if (ib_get_curr_port_state(ndev) == IB_PORT_DOWN)
|
|
|
|
rxe_counter_inc(rxe, RXE_CNT_LINK_DOWNED);
|
2017-08-28 16:11:59 -04:00
|
|
|
break;
|
|
|
|
case NETDEV_REBOOT:
|
2016-06-16 16:45:23 +03:00
|
|
|
case NETDEV_GOING_DOWN:
|
|
|
|
case NETDEV_CHANGEADDR:
|
|
|
|
case NETDEV_CHANGENAME:
|
|
|
|
case NETDEV_FEAT_CHANGE:
|
|
|
|
default:
|
2023-03-03 16:16:22 -06:00
|
|
|
rxe_dbg_dev(rxe, "ignoring netdev event = %ld for %s\n",
|
2016-06-16 16:45:23 +03:00
|
|
|
event, ndev->name);
|
|
|
|
break;
|
|
|
|
}
|
2019-02-12 21:12:52 -07:00
|
|
|
|
|
|
|
ib_device_put(&rxe->ib_dev);
|
2016-06-16 16:45:23 +03:00
|
|
|
return NOTIFY_OK;
|
|
|
|
}
|
|
|
|
|
2018-04-03 20:08:20 -04:00
|
|
|
static struct notifier_block rxe_net_notifier = {
|
2016-06-16 16:45:23 +03:00
|
|
|
.notifier_call = rxe_notify,
|
|
|
|
};
|
|
|
|
|
2017-01-10 11:15:40 -08:00
|
|
|
static int rxe_net_ipv4_init(void)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
|
|
|
recv_sockets.sk4 = rxe_setup_udp_tunnel(&init_net,
|
2016-09-07 14:04:04 +03:00
|
|
|
htons(ROCE_V2_UDP_DPORT), false);
|
2016-06-16 16:45:23 +03:00
|
|
|
if (IS_ERR(recv_sockets.sk4)) {
|
|
|
|
recv_sockets.sk4 = NULL;
|
2016-09-28 20:26:26 +00:00
|
|
|
pr_err("Failed to create IPv4 UDP tunnel\n");
|
2016-06-16 16:45:23 +03:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
|
2016-09-07 14:04:04 +03:00
|
|
|
return 0;
|
2016-06-16 16:45:23 +03:00
|
|
|
}
|
|
|
|
|
2017-01-10 11:15:40 -08:00
|
|
|
static int rxe_net_ipv6_init(void)
|
2016-06-16 16:45:23 +03:00
|
|
|
{
|
2016-09-07 14:04:04 +03:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2016-06-16 16:45:23 +03:00
|
|
|
|
2016-09-07 14:04:04 +03:00
|
|
|
recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net,
|
|
|
|
htons(ROCE_V2_UDP_DPORT), true);
|
2021-06-03 12:01:12 +03:00
|
|
|
if (PTR_ERR(recv_sockets.sk6) == -EAFNOSUPPORT) {
|
|
|
|
recv_sockets.sk6 = NULL;
|
|
|
|
pr_warn("IPv6 is not supported, can not create a UDPv6 socket\n");
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2016-09-07 14:04:04 +03:00
|
|
|
if (IS_ERR(recv_sockets.sk6)) {
|
|
|
|
recv_sockets.sk6 = NULL;
|
2016-09-28 20:26:26 +00:00
|
|
|
pr_err("Failed to create IPv6 UDP tunnel\n");
|
2016-09-07 14:04:04 +03:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
void rxe_net_exit(void)
|
|
|
|
{
|
|
|
|
rxe_release_udp_tunnel(recv_sockets.sk6);
|
|
|
|
rxe_release_udp_tunnel(recv_sockets.sk4);
|
2016-06-16 16:45:23 +03:00
|
|
|
unregister_netdevice_notifier(&rxe_net_notifier);
|
|
|
|
}
|
2016-09-28 20:26:26 +00:00
|
|
|
|
|
|
|
int rxe_net_init(void)
|
|
|
|
{
|
|
|
|
int err;
|
|
|
|
|
|
|
|
recv_sockets.sk6 = NULL;
|
|
|
|
|
|
|
|
err = rxe_net_ipv4_init();
|
|
|
|
if (err)
|
|
|
|
return err;
|
|
|
|
err = rxe_net_ipv6_init();
|
|
|
|
if (err)
|
|
|
|
goto err_out;
|
|
|
|
err = register_netdevice_notifier(&rxe_net_notifier);
|
|
|
|
if (err) {
|
|
|
|
pr_err("Failed to register netdev notifier\n");
|
|
|
|
goto err_out;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
err_out:
|
|
|
|
rxe_net_exit();
|
|
|
|
return err;
|
|
|
|
}
|