kernel.git/drivers/infiniband/hw/ionic/ionic_controlpath.c, branch linux-6.19.y

RDMA/ionic: Fix kernel stack leak in ionic_create_cq()

2026-03-12T11:09:35Z

commit faa72102b178c7ae6c6afea23879e7c84fc59b4e upstream. struct ionic_cq_resp resp { __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below) __u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask) __u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK }; rsvd[7]: 7 bytes of stack memory leaked unconditionally. cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but udma_count could be 1, meaning cqid[1] might never be written via ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4 bytes) is also leaked. So potentially 11 bytes leaked. Cc: stable@vger.kernel.org Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Signed-off-by: Jason Gunthorpe Link: https://patch.msgid.link/4-v1-83e918d69e73+a9-rdma_udata_rc_jgg@nvidia.com Acked-by: Abhijit Gangurde Signed-off-by: Leon Romanovsky Signed-off-by: Greg Kroah-Hartman

RDMA/ionic: Use ether_addr_copy instead of memcpy

2025-09-21T11:30:37Z

eth header from ib_ud_header structure packs the mac into 4B high and 2B low parts. But when 4B high is used in memcpy, it sees it as overflow. However, this is safe due to the 4B high and 2B low arrangement in the structure. To avoid the memcpy warning, use ether_addr_copy to copy the mac address. In function ‘fortify_memcpy_chk’, inlined from ‘ionic_set_ah_attr.isra’ at drivers/infiniband/hw/ionic/ionic_controlpath.c:609:3: ./include/linux/fortify-string.h:580:25: error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning] 580 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors make[6]: *** [scripts/Makefile.build:287: drivers/infiniband/hw/ionic/ionic_controlpath.o] Error 1 make[5]: *** [scripts/Makefile.build:556: drivers/infiniband/hw/ionic] Error 2 make[5]: *** Waiting for unfinished jobs.... make[4]: *** [scripts/Makefile.build:556: drivers/infiniband/hw] Error 2 make[3]: *** [scripts/Makefile.build:556: drivers/infiniband] Error 2 make[2]: *** [scripts/Makefile.build:556: drivers] Error 2 make[1]: *** [/tmp/tmp53nb1nwr/Makefile:2011: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 Fixes: e8521822c733 ("RDMA/ionic: Register device ops for control path") Reported-by: Leon Romanovsky Closes: https://lore.kernel.org/lkml/20250918180750.GA135135@unreal/ Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250919121301.1113759-2-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Register device ops for control path

2025-09-11T06:18:36Z

Implement device supported verb APIs for control path. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-11-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Create device queues to support admin operations

2025-09-11T06:18:36Z

Setup RDMA admin queues using device command exposed over auxiliary device and manage these queues using ida. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-10-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky