IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache [Linux 4.14.137]

This Linux kernel change "IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache" is included in the Linux 4.14.137 release. This change is authored by Yishai Hadas <yishaih [at] mellanox.com> on Tue Jul 23 09:57:27 2019 +0300. The commit for this change in Linux stable tree is fcfb397 (patch) which is from upstream commit 9ec4483. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream 9ec4483.

IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache

commit 9ec4483a3f0f71a228a5933bc040441322bfb090 upstream.

Fix unreg_umr to move the MR to a kernel owned PD (i.e. the UMR PD) which
can't be accessed by userspace.

This ensures that nothing can continue to access the MR once it has been
placed in the kernels cache for reuse.

MRs in the cache continue to have their HW state, including DMA tables,
present. Even though the MR has been invalidated, changing the PD provides
an additional layer of protection against use of the MR.

Link: https://lore.kernel.org/r/20190723065733.4899-5-leon@kernel.org
Cc: <stable@vger.kernel.org> # 3.10
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Reviewed-by: Artemy Kovalyov <artemyko@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

There are 4 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/infiniband/hw/mlx5/mr.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 903f4c1..cfddca8 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1305,8 +1305,10 @@ static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
    if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)
        return 0;

-   umrwr.wr.send_flags = MLX5_IB_SEND_UMR_DISABLE_MR;
+   umrwr.wr.send_flags = MLX5_IB_SEND_UMR_DISABLE_MR |
+                 MLX5_IB_SEND_UMR_UPDATE_PD_ACCESS;
    umrwr.wr.opcode = MLX5_IB_WR_UMR;
+   umrwr.pd = dev->umrc.pd;
    umrwr.mkey = mr->mmkey.key;
    umrwr.ignore_free_state = 1;

Leave a Reply

Your email address will not be published. Required fields are marked *