215d0a755e
Currently the rdma_rxe driver has a security weakness due to giving objects which are partially initialized indices allowing external actors to gain access to them by sending packets which refer to their index (e.g. qpn, rkey, etc) causing unpredictable results. This patch adds a new API rxe_finalize(obj) which enables looking up pool objects from indices using rxe_pool_get_index() for AH, QP, MR, and MW. They are added in create verbs only after the objects are fully initialized. It also adds wait for completion to destroy/dealloc verbs to assure that all references have been dropped before returning to rdma_core by implementing a new rxe_pool API rxe_cleanup() which drops a reference to the object and then waits for all other references to be dropped. When the last reference is dropped the object is completed by kref. After that it cleans up the object and if locally allocated frees the memory. In the special case of address handle objects the delay is implemented separately if the destroy_ah call is not sleepable. Combined with deferring cleanup code to type specific cleanup routines this allows all pending activity referring to objects to complete before returning to rdma_core. Link: https://lore.kernel.org/r/20220612223434.31462-2-rpearsonhpe@gmail.com Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
86 lines
2.3 KiB
C
86 lines
2.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */
|
|
/*
|
|
* Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved.
|
|
* Copyright (c) 2015 System Fabric Works, Inc. All rights reserved.
|
|
*/
|
|
|
|
#ifndef RXE_POOL_H
|
|
#define RXE_POOL_H
|
|
|
|
enum rxe_elem_type {
|
|
RXE_TYPE_UC,
|
|
RXE_TYPE_PD,
|
|
RXE_TYPE_AH,
|
|
RXE_TYPE_SRQ,
|
|
RXE_TYPE_QP,
|
|
RXE_TYPE_CQ,
|
|
RXE_TYPE_MR,
|
|
RXE_TYPE_MW,
|
|
RXE_NUM_TYPES, /* keep me last */
|
|
};
|
|
|
|
struct rxe_pool_elem {
|
|
struct rxe_pool *pool;
|
|
void *obj;
|
|
struct kref ref_cnt;
|
|
struct list_head list;
|
|
struct completion complete;
|
|
u32 index;
|
|
};
|
|
|
|
struct rxe_pool {
|
|
struct rxe_dev *rxe;
|
|
const char *name;
|
|
void (*cleanup)(struct rxe_pool_elem *elem);
|
|
enum rxe_elem_type type;
|
|
|
|
unsigned int max_elem;
|
|
atomic_t num_elem;
|
|
size_t elem_size;
|
|
size_t elem_offset;
|
|
|
|
struct xarray xa;
|
|
struct xa_limit limit;
|
|
u32 next;
|
|
};
|
|
|
|
/* initialize a pool of objects with given limit on
|
|
* number of elements. gets parameters from rxe_type_info
|
|
* pool elements will be allocated out of a slab cache
|
|
*/
|
|
void rxe_pool_init(struct rxe_dev *rxe, struct rxe_pool *pool,
|
|
enum rxe_elem_type type);
|
|
|
|
/* free resources from object pool */
|
|
void rxe_pool_cleanup(struct rxe_pool *pool);
|
|
|
|
/* allocate an object from pool */
|
|
void *rxe_alloc(struct rxe_pool *pool);
|
|
|
|
/* connect already allocated object to pool */
|
|
int __rxe_add_to_pool(struct rxe_pool *pool, struct rxe_pool_elem *elem,
|
|
bool sleepable);
|
|
#define rxe_add_to_pool(pool, obj) __rxe_add_to_pool(pool, &(obj)->elem, true)
|
|
#define rxe_add_to_pool_ah(pool, obj, sleepable) __rxe_add_to_pool(pool, \
|
|
&(obj)->elem, sleepable)
|
|
|
|
/* lookup an indexed object from index. takes a reference on object */
|
|
void *rxe_pool_get_index(struct rxe_pool *pool, u32 index);
|
|
|
|
int __rxe_get(struct rxe_pool_elem *elem);
|
|
#define rxe_get(obj) __rxe_get(&(obj)->elem)
|
|
|
|
int __rxe_put(struct rxe_pool_elem *elem);
|
|
#define rxe_put(obj) __rxe_put(&(obj)->elem)
|
|
|
|
int __rxe_cleanup(struct rxe_pool_elem *elem, bool sleepable);
|
|
#define rxe_cleanup(obj) __rxe_cleanup(&(obj)->elem, true)
|
|
#define rxe_cleanup_ah(obj, sleepable) __rxe_cleanup(&(obj)->elem, sleepable)
|
|
|
|
#define rxe_read(obj) kref_read(&(obj)->elem.ref_cnt)
|
|
|
|
void __rxe_finalize(struct rxe_pool_elem *elem);
|
|
#define rxe_finalize(obj) __rxe_finalize(&(obj)->elem)
|
|
|
|
#endif /* RXE_POOL_H */
|