Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Fun set of conflict resolutions here...

For the mac80211 stuff, these were fortunately just parallel
adds.  Trivially resolved.

In drivers/net/phy/phy.c we had a bug fix in 'net' that moved the
function phy_disable_interrupts() earlier in the file, whilst in
'net-next' the phy_error() call from this function was removed.

In net/ipv4/xfrm4_policy.c, David Ahern's changes to remove the
'rt_table_id' member of rtable collided with a bug fix in 'net' that
added a new struct member "rt_mtu_locked" which needs to be copied
over here.

The mlxsw driver conflict consisted of net-next separating
the span code and definitions into separate files, whilst
a 'net' bug fix made some changes to that moved code.

The mlx5 infiniband conflict resolution was quite non-trivial,
the RDMA tree's merge commit was used as a guide here, and
here are their notes:

====================

    Due to bug fixes found by the syzkaller bot and taken into the for-rc
    branch after development for the 4.17 merge window had already started
    being taken into the for-next branch, there were fairly non-trivial
    merge issues that would need to be resolved between the for-rc branch
    and the for-next branch.  This merge resolves those conflicts and
    provides a unified base upon which ongoing development for 4.17 can
    be based.

    Conflicts:
            drivers/infiniband/hw/mlx5/main.c - Commit 42cea83f9524
            (IB/mlx5: Fix cleanup order on unload) added to for-rc and
            commit b5ca15ad7e61 (IB/mlx5: Add proper representors support)
            add as part of the devel cycle both needed to modify the
            init/de-init functions used by mlx5.  To support the new
            representors, the new functions added by the cleanup patch
            needed to be made non-static, and the init/de-init list
            added by the representors patch needed to be modified to
            match the init/de-init list changes made by the cleanup
            patch.
    Updates:
            drivers/infiniband/hw/mlx5/mlx5_ib.h - Update function
            prototypes added by representors patch to reflect new function
            names as changed by cleanup patch
            drivers/infiniband/hw/mlx5/ib_rep.c - Update init/de-init
            stage list to match new order from cleanup patch
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 32 insertions, 10 deletions

diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
index f015f1bf88c9..e5a1e7d81326 100644
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -132,7 +132,7 @@ static inline struct ucma_context *_ucma_find_context(int id,
         ctx = idr_find(&ctx_idr, id);
         if (!ctx)
                 ctx = ERR_PTR(-ENOENT);
-        else if (ctx->file != file)
+        else if (ctx->file != file || !ctx->cm_id)
                 ctx = ERR_PTR(-EINVAL);
         return ctx;
 }
@@ -456,6 +456,7 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
         struct rdma_ucm_create_id cmd;
         struct rdma_ucm_create_id_resp resp;
         struct ucma_context *ctx;
+        struct rdma_cm_id *cm_id;
         enum ib_qp_type qp_type;
         int ret;
 
@@ -476,10 +477,10 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
                 return -ENOMEM;
 
         ctx->uid = cmd.uid;
-        ctx->cm_id = rdma_create_id(current->nsproxy->net_ns,
-                                    ucma_event_handler, ctx, cmd.ps, qp_type);
-        if (IS_ERR(ctx->cm_id)) {
-                ret = PTR_ERR(ctx->cm_id);
+        cm_id = rdma_create_id(current->nsproxy->net_ns,
+                               ucma_event_handler, ctx, cmd.ps, qp_type);
+        if (IS_ERR(cm_id)) {
+                ret = PTR_ERR(cm_id);
                 goto err1;
         }
 
@@ -489,14 +490,19 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
                 ret = -EFAULT;
                 goto err2;
         }
+
+        ctx->cm_id = cm_id;
         return 0;
 
 err2:
-        rdma_destroy_id(ctx->cm_id);
+        rdma_destroy_id(cm_id);
 err1:
         mutex_lock(&mut);
         idr_remove(&ctx_idr, ctx->id);
         mutex_unlock(&mut);
+        mutex_lock(&file->mut);
+        list_del(&ctx->list);
+        mutex_unlock(&file->mut);
         kfree(ctx);
         return ret;
 }
@@ -664,19 +670,23 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file,
                                int in_len, int out_len)
 {
         struct rdma_ucm_resolve_ip cmd;
+        struct sockaddr *src, *dst;
         struct ucma_context *ctx;
         int ret;
 
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
+        src = (struct sockaddr *) &cmd.src_addr;
+        dst = (struct sockaddr *) &cmd.dst_addr;
+        if (!rdma_addr_size(src) || !rdma_addr_size(dst))
+                return -EINVAL;
+
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
-        ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr,
-                                (struct sockaddr *) &cmd.dst_addr,
-                                cmd.timeout_ms);
+        ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms);
         ucma_put_ctx(ctx);
         return ret;
 }
@@ -1149,6 +1159,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
+        if (cmd.qp_state > IB_QPS_ERR)
+                return -EINVAL;
+
         ctx = ucma_get_ctx(file, cmd.id);
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
@@ -1294,6 +1307,9 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
         if (IS_ERR(ctx))
                 return PTR_ERR(ctx);
 
+        if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
+                return -EINVAL;
+
         optval = memdup_user((void __user *) (unsigned long) cmd.optval,
                              cmd.optlen);
         if (IS_ERR(optval)) {
@@ -1343,7 +1359,7 @@ static ssize_t ucma_process_join(struct ucma_file *file,
                 return -ENOSPC;
 
         addr = (struct sockaddr *) &cmd->addr;
-        if (!cmd->addr_size || (cmd->addr_size != rdma_addr_size(addr)))
+        if (cmd->addr_size != rdma_addr_size(addr))
                 return -EINVAL;
 
         if (cmd->join_flags == RDMA_MC_JOIN_FLAG_FULLMEMBER)
@@ -1411,6 +1427,9 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file,
         join_cmd.uid = cmd.uid;
         join_cmd.id = cmd.id;
         join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr);
+        if (!join_cmd.addr_size)
+                return -EINVAL;
+
         join_cmd.join_flags = RDMA_MC_JOIN_FLAG_FULLMEMBER;
         memcpy(&join_cmd.addr, &cmd.addr, join_cmd.addr_size);
 
@@ -1426,6 +1445,9 @@ static ssize_t ucma_join_multicast(struct ucma_file *file,
         if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
                 return -EFAULT;
 
+        if (!rdma_addr_size((struct sockaddr *)&cmd.addr))
+                return -EINVAL;
+
         return ucma_process_join(file, &cmd, out_len);
 }