From: Greg Kroah-Hartman Date: Tue, 16 Jun 2026 03:32:14 +0000 (+0530) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c34c8d37b91778477a821c3b4f08b2b2f59eaaed;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: netfilter-nft_fib-fix-stale-stack-leak-via-the-oifname-register.patch rdma-during-rereg_mr-ensure-that-rereg_access-is-compatible.patch rdma-move-dma-block-iterator-logic-into-dedicated-files.patch rdma-umem-add-helpers-for-umem-dmabuf-revoke-lock.patch rdma-umem-add-ib_umem_dmabuf_get_pinned_and_lock-helper.patch rdma-umem-fix-kernel-doc-warnings.patch rdma-umem-fix-truncation-for-block-sizes-4g.patch rdma-umem-move-umem-dmabuf-revoke-logic-into-helper-function.patch --- diff --git a/queue-6.18/netfilter-nft_fib-fix-stale-stack-leak-via-the-oifname-register.patch b/queue-6.18/netfilter-nft_fib-fix-stale-stack-leak-via-the-oifname-register.patch new file mode 100644 index 0000000000..d4db6b918e --- /dev/null +++ b/queue-6.18/netfilter-nft_fib-fix-stale-stack-leak-via-the-oifname-register.patch @@ -0,0 +1,86 @@ +From stable+bounces-263200-greg=kroah.com@vger.kernel.org Mon Jun 15 18:58:07 2026 +From: Sasha Levin +Date: Mon, 15 Jun 2026 09:28:01 -0400 +Subject: netfilter: nft_fib: fix stale stack leak via the OIFNAME register +To: stable@vger.kernel.org +Cc: Davide Ornaghi , Florian Westphal , Pablo Neira Ayuso , Sasha Levin +Message-ID: <20260615132801.2063529-1-sashal@kernel.org> + +From: Davide Ornaghi + +[ Upstream commit ab185e0c4fb82dfba6fb86f8271e06f931d9c64c ] + +For NFT_FIB_RESULT_OIFNAME the destination register is declared with +len = IFNAMSIZ (four 32-bit registers), but on the lookup-fail, +RTN_LOCAL and oif-mismatch paths nft_fib{4,6}_eval() only writes one +register via "*dest = 0". The remaining three registers are left as +whatever was on the stack in nft_do_chain()'s struct nft_regs, and a +downstream expression that loads the register span can leak that +uninitialised kernel stack to userspace. + +The NFTA_FIB_F_PRESENT existence check has the same shape: it is only +meaningful for NFT_FIB_RESULT_OIF, yet it was accepted for any result type +while the eval stores a single byte via nft_reg_store8(), leaving the rest +of the declared span stale. + +Fix both: + + - replace the bare "*dest = 0" in the eval with nft_fib_store_result(), + which strscpy_pad()s the whole IFNAMSIZ for OIFNAME (and is already + used on the other early-return path), and + + - restrict NFTA_FIB_F_PRESENT to NFT_FIB_RESULT_OIF and declare its + destination as a single u8, so the marked span matches the one byte + the eval writes. + +Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression") +Suggested-by: Florian Westphal +Cc: stable@vger.kernel.org +Signed-off-by: Davide Ornaghi +Signed-off-by: Pablo Neira Ayuso +[ kept the tree's older `ip6_route_lookup()`/`rt6_info` IPv6 context and changed only `*dest = 0;` to `nft_fib_store_result(dest, priv, NULL);` ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- + net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- + net/netfilter/nft_fib.c | 6 ++++++ + 3 files changed, 8 insertions(+), 2 deletions(-) + +--- a/net/ipv4/netfilter/nft_fib_ipv4.c ++++ b/net/ipv4/netfilter/nft_fib_ipv4.c +@@ -128,7 +128,7 @@ void nft_fib4_eval(const struct nft_expr + fl4.saddr = get_saddr(iph->daddr); + } + +- *dest = 0; ++ nft_fib_store_result(dest, priv, NULL); + + if (fib_lookup(nft_net(pkt), &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE)) + return; +--- a/net/ipv6/netfilter/nft_fib_ipv6.c ++++ b/net/ipv6/netfilter/nft_fib_ipv6.c +@@ -192,7 +192,7 @@ void nft_fib6_eval(const struct nft_expr + + lookup_flags = nft_fib6_flowi_init(&fl6, priv, pkt, oif, iph); + +- *dest = 0; ++ nft_fib_store_result(dest, priv, NULL); + rt = (void *)ip6_route_lookup(nft_net(pkt), &fl6, pkt->skb, + lookup_flags); + if (rt->dst.error) +--- a/net/netfilter/nft_fib.c ++++ b/net/netfilter/nft_fib.c +@@ -107,6 +107,12 @@ int nft_fib_init(const struct nft_ctx *c + return -EINVAL; + } + ++ if (priv->flags & NFTA_FIB_F_PRESENT) { ++ if (priv->result != NFT_FIB_RESULT_OIF) ++ return -EINVAL; ++ len = sizeof(u8); ++ } ++ + err = nft_parse_register_store(ctx, tb[NFTA_FIB_DREG], &priv->dreg, + NULL, NFT_DATA_VALUE, len); + if (err < 0) diff --git a/queue-6.18/rdma-during-rereg_mr-ensure-that-rereg_access-is-compatible.patch b/queue-6.18/rdma-during-rereg_mr-ensure-that-rereg_access-is-compatible.patch new file mode 100644 index 0000000000..fa5e9d5602 --- /dev/null +++ b/queue-6.18/rdma-during-rereg_mr-ensure-that-rereg_access-is-compatible.patch @@ -0,0 +1,157 @@ +From stable+bounces-263461-greg=kroah.com@vger.kernel.org Tue Jun 16 02:46:24 2026 +From: Sasha Levin +Date: Mon, 15 Jun 2026 17:16:16 -0400 +Subject: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible +To: stable@vger.kernel.org +Cc: Jason Gunthorpe , Philip Tsukerman , Sasha Levin +Message-ID: <20260615211616.2460210-4-sashal@kernel.org> + +From: Jason Gunthorpe + +[ Upstream commit badad6fad60def1b9805559dd81dbab3d97b82aa ] + +If IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be +re-evaluated to ensure it is properly pinned as RW. Since the umem is +hidden inside each driver's mr struct add a ib_umem_check_rereg() function +that each driver has to call before processing IB_MR_REREG_ACCESS. + +mlx4 has to retain its duplicate ib_access_writable check because it +implements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items +in place sequentially while the MR is live, so it will continue to not +support this combination. + +Cc: stable@vger.kernel.org +Fixes: b40656aa7d55 ("RDMA/umem: remove FOLL_FORCE usage") +Link: https://patch.msgid.link/r/0-v1-06fb1a2d6cf5+107-rereg_access_jgg@nvidia.com +Reported-by: Philip Tsukerman +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/umem.c | 16 ++++++++++++++++ + drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++++ + drivers/infiniband/hw/irdma/verbs.c | 4 ++++ + drivers/infiniband/hw/mlx4/mr.c | 4 ++++ + drivers/infiniband/hw/mlx5/mr.c | 4 ++++ + drivers/infiniband/sw/rxe/rxe_verbs.c | 5 +++++ + include/rdma/ib_umem.h | 8 ++++++++ + 7 files changed, 45 insertions(+) + +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -326,3 +326,19 @@ int ib_umem_copy_from(void *dst, struct + return 0; + } + EXPORT_SYMBOL(ib_umem_copy_from); ++ ++/* ++ * Called during rereg mr if the driver is able to re-use a umem for ++ * IB_MR_REREG_ACCESS. ++ */ ++int ib_umem_check_rereg(struct ib_umem *umem, int flags, int new_access_flags) ++{ ++ if (!umem) ++ return 0; ++ ++ if ((flags & IB_MR_REREG_ACCESS) && !(flags & IB_MR_REREG_TRANS)) ++ if (ib_access_writable(new_access_flags) && !umem->writable) ++ return -EACCES; ++ return 0; ++} ++EXPORT_SYMBOL(ib_umem_check_rereg); +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -300,6 +300,10 @@ struct ib_mr *hns_roce_rereg_user_mr(str + goto err_out; + } + ++ ret = ib_umem_check_rereg(mr->pbl_mtr.umem, flags, mr_access_flags); ++ if (ret) ++ goto err_out; ++ + mailbox = hns_roce_alloc_cmd_mailbox(hr_dev); + ret = PTR_ERR_OR_ZERO(mailbox); + if (ret) +--- a/drivers/infiniband/hw/irdma/verbs.c ++++ b/drivers/infiniband/hw/irdma/verbs.c +@@ -3749,6 +3749,10 @@ static struct ib_mr *irdma_rereg_user_mr + if (flags & ~(IB_MR_REREG_TRANS | IB_MR_REREG_PD | IB_MR_REREG_ACCESS)) + return ERR_PTR(-EOPNOTSUPP); + ++ ret = ib_umem_check_rereg(iwmr->region, flags, new_access); ++ if (ret) ++ return ERR_PTR(ret); ++ + ret = irdma_hwdereg_mr(ib_mr); + if (ret) + return ERR_PTR(ret); +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -208,6 +208,10 @@ struct ib_mr *mlx4_ib_rereg_user_mr(stru + struct mlx4_mpt_entry **pmpt_entry = &mpt_entry; + int err; + ++ err = ib_umem_check_rereg(mmr->umem, flags, mr_access_flags); ++ if (err) ++ return ERR_PTR(err); ++ + /* Since we synchronize this call and mlx4_ib_dereg_mr via uverbs, + * we assume that the calls can't run concurrently. Otherwise, a + * race exists. +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1895,6 +1895,10 @@ struct ib_mr *mlx5_ib_rereg_user_mr(stru + if (flags & ~(IB_MR_REREG_TRANS | IB_MR_REREG_PD | IB_MR_REREG_ACCESS)) + return ERR_PTR(-EOPNOTSUPP); + ++ err = ib_umem_check_rereg(mr->umem, flags, new_access_flags); ++ if (err) ++ return ERR_PTR(err); ++ + if (!(flags & IB_MR_REREG_ACCESS)) + new_access_flags = mr->access_flags; + if (!(flags & IB_MR_REREG_PD)) +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -1332,6 +1332,7 @@ static struct ib_mr *rxe_rereg_user_mr(s + struct rxe_mr *mr = to_rmr(ibmr); + struct rxe_pd *old_pd = to_rpd(ibmr->pd); + struct rxe_pd *pd = to_rpd(ibpd); ++ int err; + + /* for now only support the two easy cases: + * rereg_pd and rereg_access +@@ -1341,6 +1342,10 @@ static struct ib_mr *rxe_rereg_user_mr(s + return ERR_PTR(-EOPNOTSUPP); + } + ++ err = ib_umem_check_rereg(mr->umem, flags, access); ++ if (err) ++ return ERR_PTR(err); ++ + if (flags & IB_MR_REREG_PD) { + rxe_put(old_pd); + rxe_get(pd); +--- a/include/rdma/ib_umem.h ++++ b/include/rdma/ib_umem.h +@@ -180,6 +180,8 @@ void ib_umem_dmabuf_revoke_lock(struct i + void ib_umem_dmabuf_revoke_unlock(struct ib_umem_dmabuf *umem_dmabuf); + void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf); + ++int ib_umem_check_rereg(struct ib_umem *umem, int flags, int new_access_flags); ++ + #else /* CONFIG_INFINIBAND_USER_MEM */ + + #include +@@ -242,5 +244,11 @@ static inline void ib_umem_dmabuf_revoke + static inline void ib_umem_dmabuf_revoke_unlock(struct ib_umem_dmabuf *umem_dmabuf) {} + static inline void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf) {} + ++static inline int ib_umem_check_rereg(struct ib_umem *umem, int flags, ++ int new_access_flags) ++{ ++ return -EOPNOTSUPP; ++} ++ + #endif /* CONFIG_INFINIBAND_USER_MEM */ + #endif /* IB_UMEM_H */ diff --git a/queue-6.18/rdma-move-dma-block-iterator-logic-into-dedicated-files.patch b/queue-6.18/rdma-move-dma-block-iterator-logic-into-dedicated-files.patch new file mode 100644 index 0000000000..7b29669e94 --- /dev/null +++ b/queue-6.18/rdma-move-dma-block-iterator-logic-into-dedicated-files.patch @@ -0,0 +1,523 @@ +From stable+bounces-263463-greg=kroah.com@vger.kernel.org Tue Jun 16 02:59:14 2026 +From: Sasha Levin +Date: Mon, 15 Jun 2026 17:29:07 -0400 +Subject: RDMA: Move DMA block iterator logic into dedicated files +To: stable@vger.kernel.org +Cc: Leon Romanovsky , Sasha Levin +Message-ID: <20260615212908.2473687-2-sashal@kernel.org> + +From: Leon Romanovsky + +[ Upstream commit 6094ea64c69520ed1e770e7c79c43412de202bfa ] + +The DMA iterator logic was mixed into verbs and umem-specific code, +forcing all users to include rdma/ib_umem.h. Move the block iterator +logic into iter.c and rdma/iter.h so that rdma/ib_umem.h and +rdma/ib_verbs.h can be separated in a follow-up patch. + +Link: https://patch.msgid.link/20260213-refactor-umem-v1-1-f3be85847922@nvidia.com +Signed-off-by: Leon Romanovsky +Stable-dep-of: 15fe76e23615 ("RDMA/umem: Fix truncation for block sizes >= 4G") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/Makefile | 2 + drivers/infiniband/core/iter.c | 43 +++++++++++++ + drivers/infiniband/core/verbs.c | 38 ----------- + drivers/infiniband/hw/bnxt_re/qplib_res.c | 2 + drivers/infiniband/hw/cxgb4/mem.c | 2 + drivers/infiniband/hw/efa/efa_verbs.c | 2 + drivers/infiniband/hw/erdma/erdma_verbs.c | 2 + drivers/infiniband/hw/hns/hns_roce_alloc.c | 2 + drivers/infiniband/hw/ionic/ionic_ibdev.h | 2 + drivers/infiniband/hw/irdma/main.h | 2 + drivers/infiniband/hw/mana/mana_ib.h | 2 + drivers/infiniband/hw/mlx4/mr.c | 1 + drivers/infiniband/hw/mlx5/mem.c | 1 + drivers/infiniband/hw/mlx5/umr.c | 1 + drivers/infiniband/hw/mthca/mthca_provider.c | 2 + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 + drivers/infiniband/hw/qedr/verbs.c | 2 + drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 2 + include/rdma/ib_umem.h | 32 --------- + include/rdma/ib_verbs.h | 48 -------------- + include/rdma/iter.h | 88 +++++++++++++++++++++++++++ + 21 files changed, 147 insertions(+), 131 deletions(-) + create mode 100644 drivers/infiniband/core/iter.c + create mode 100644 include/rdma/iter.h + +--- a/drivers/infiniband/core/Makefile ++++ b/drivers/infiniband/core/Makefile +@@ -12,7 +12,7 @@ ib_core-y := packer.o ud_header.o verb + roce_gid_mgmt.o mr_pool.o addr.o sa_query.o \ + multicast.o mad.o smi.o agent.o mad_rmpp.o \ + nldev.o restrack.o counters.o ib_core_uverbs.o \ +- trace.o lag.o ++ trace.o lag.o iter.o + + ib_core-$(CONFIG_SECURITY_INFINIBAND) += security.o + ib_core-$(CONFIG_CGROUP_RDMA) += cgroup.o +--- /dev/null ++++ b/drivers/infiniband/core/iter.c +@@ -0,0 +1,43 @@ ++// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB ++/* Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. */ ++ ++#include ++#include ++ ++void __rdma_block_iter_start(struct ib_block_iter *biter, ++ struct scatterlist *sglist, unsigned int nents, ++ unsigned long pgsz) ++{ ++ memset(biter, 0, sizeof(struct ib_block_iter)); ++ biter->__sg = sglist; ++ biter->__sg_nents = nents; ++ ++ /* Driver provides best block size to use */ ++ biter->__pg_bit = __fls(pgsz); ++} ++EXPORT_SYMBOL(__rdma_block_iter_start); ++ ++bool __rdma_block_iter_next(struct ib_block_iter *biter) ++{ ++ unsigned int block_offset; ++ unsigned int delta; ++ ++ if (!biter->__sg_nents || !biter->__sg) ++ return false; ++ ++ biter->__dma_addr = sg_dma_address(biter->__sg) + biter->__sg_advance; ++ block_offset = biter->__dma_addr & (BIT_ULL(biter->__pg_bit) - 1); ++ delta = BIT_ULL(biter->__pg_bit) - block_offset; ++ ++ while (biter->__sg_nents && biter->__sg && ++ sg_dma_len(biter->__sg) - biter->__sg_advance <= delta) { ++ delta -= sg_dma_len(biter->__sg) - biter->__sg_advance; ++ biter->__sg_advance = 0; ++ biter->__sg = sg_next(biter->__sg); ++ biter->__sg_nents--; ++ } ++ biter->__sg_advance += delta; ++ ++ return true; ++} ++EXPORT_SYMBOL(__rdma_block_iter_next); +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -3096,44 +3096,6 @@ int rdma_init_netdev(struct ib_device *d + } + EXPORT_SYMBOL(rdma_init_netdev); + +-void __rdma_block_iter_start(struct ib_block_iter *biter, +- struct scatterlist *sglist, unsigned int nents, +- unsigned long pgsz) +-{ +- memset(biter, 0, sizeof(struct ib_block_iter)); +- biter->__sg = sglist; +- biter->__sg_nents = nents; +- +- /* Driver provides best block size to use */ +- biter->__pg_bit = __fls(pgsz); +-} +-EXPORT_SYMBOL(__rdma_block_iter_start); +- +-bool __rdma_block_iter_next(struct ib_block_iter *biter) +-{ +- unsigned int block_offset; +- unsigned int delta; +- +- if (!biter->__sg_nents || !biter->__sg) +- return false; +- +- biter->__dma_addr = sg_dma_address(biter->__sg) + biter->__sg_advance; +- block_offset = biter->__dma_addr & (BIT_ULL(biter->__pg_bit) - 1); +- delta = BIT_ULL(biter->__pg_bit) - block_offset; +- +- while (biter->__sg_nents && biter->__sg && +- sg_dma_len(biter->__sg) - biter->__sg_advance <= delta) { +- delta -= sg_dma_len(biter->__sg) - biter->__sg_advance; +- biter->__sg_advance = 0; +- biter->__sg = sg_next(biter->__sg); +- biter->__sg_nents--; +- } +- biter->__sg_advance += delta; +- +- return true; +-} +-EXPORT_SYMBOL(__rdma_block_iter_next); +- + /** + * rdma_alloc_hw_stats_struct - Helper function to allocate dynamic struct + * for the drivers. +--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c +@@ -46,7 +46,7 @@ + #include + #include + #include +-#include ++#include + + #include "roce_hsi.h" + #include "qplib_res.h" +--- a/drivers/infiniband/hw/cxgb4/mem.c ++++ b/drivers/infiniband/hw/cxgb4/mem.c +@@ -32,9 +32,9 @@ + + #include + #include +-#include + #include + #include ++#include + + #include "iw_cxgb4.h" + +--- a/drivers/infiniband/hw/efa/efa_verbs.c ++++ b/drivers/infiniband/hw/efa/efa_verbs.c +@@ -9,9 +9,9 @@ + #include + + #include +-#include + #include + #include ++#include + #include + #define UVERBS_MODULE_NAME efa_ib + #include +--- a/drivers/infiniband/hw/erdma/erdma_verbs.c ++++ b/drivers/infiniband/hw/erdma/erdma_verbs.c +@@ -12,7 +12,7 @@ + #include + #include + #include +-#include ++#include + #include + + #include "erdma.h" +--- a/drivers/infiniband/hw/hns/hns_roce_alloc.c ++++ b/drivers/infiniband/hw/hns/hns_roce_alloc.c +@@ -32,7 +32,7 @@ + */ + + #include +-#include ++#include + #include "hns_roce_device.h" + + void hns_roce_buf_free(struct hns_roce_dev *hr_dev, struct hns_roce_buf *buf) +--- a/drivers/infiniband/hw/ionic/ionic_ibdev.h ++++ b/drivers/infiniband/hw/ionic/ionic_ibdev.h +@@ -4,9 +4,9 @@ + #ifndef _IONIC_IBDEV_H_ + #define _IONIC_IBDEV_H_ + +-#include + #include + #include ++#include + #include + + #include +--- a/drivers/infiniband/hw/irdma/main.h ++++ b/drivers/infiniband/hw/irdma/main.h +@@ -36,8 +36,8 @@ + #include + #include + #include +-#include + #include ++#include + #include + #include "osdep.h" + #include "defs.h" +--- a/drivers/infiniband/hw/mana/mana_ib.h ++++ b/drivers/infiniband/hw/mana/mana_ib.h +@@ -8,7 +8,7 @@ + + #include + #include +-#include ++#include + #include + #include + #include +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -33,6 +33,7 @@ + + #include + #include ++#include + + #include "mlx4_ib.h" + +--- a/drivers/infiniband/hw/mlx5/mem.c ++++ b/drivers/infiniband/hw/mlx5/mem.c +@@ -31,6 +31,7 @@ + */ + + #include ++#include + #include "mlx5_ib.h" + + /* +--- a/drivers/infiniband/hw/mlx5/umr.c ++++ b/drivers/infiniband/hw/mlx5/umr.c +@@ -2,6 +2,7 @@ + /* Copyright (c) 2022, NVIDIA CORPORATION & AFFILIATES. */ + + #include ++#include + #include "mlx5_ib.h" + #include "umr.h" + #include "wr.h" +--- a/drivers/infiniband/hw/mthca/mthca_provider.c ++++ b/drivers/infiniband/hw/mthca/mthca_provider.c +@@ -35,8 +35,8 @@ + */ + + #include +-#include + #include ++#include + #include + + #include +--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c ++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +@@ -45,9 +45,9 @@ + #include + #include + #include +-#include + #include + #include ++#include + #include + + #include "ocrdma.h" +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -39,9 +39,9 @@ + #include + #include + #include +-#include + #include + #include ++#include + #include + + #include +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h +@@ -53,8 +53,8 @@ + #include + #include + #include +-#include + #include ++#include + #include + + #include "pvrdma_ring.h" +--- a/include/rdma/ib_umem.h ++++ b/include/rdma/ib_umem.h +@@ -75,38 +75,6 @@ static inline size_t ib_umem_num_pages(s + { + return ib_umem_num_dma_blocks(umem, PAGE_SIZE); + } +- +-static inline void __rdma_umem_block_iter_start(struct ib_block_iter *biter, +- struct ib_umem *umem, +- unsigned long pgsz) +-{ +- __rdma_block_iter_start(biter, umem->sgt_append.sgt.sgl, +- umem->sgt_append.sgt.nents, pgsz); +- biter->__sg_advance = ib_umem_offset(umem) & ~(pgsz - 1); +- biter->__sg_numblocks = ib_umem_num_dma_blocks(umem, pgsz); +-} +- +-static inline bool __rdma_umem_block_iter_next(struct ib_block_iter *biter) +-{ +- return __rdma_block_iter_next(biter) && biter->__sg_numblocks--; +-} +- +-/** +- * rdma_umem_for_each_dma_block - iterate over contiguous DMA blocks of the umem +- * @umem: umem to iterate over +- * @biter: block iterator variable +- * @pgsz: Page size to split the list into +- * +- * pgsz must be <= PAGE_SIZE or computed by ib_umem_find_best_pgsz(). The +- * returned DMA blocks will be aligned to pgsz and span the range: +- * ALIGN_DOWN(umem->address, pgsz) to ALIGN(umem->address + umem->length, pgsz) +- * +- * Performs exactly ib_umem_num_dma_blocks() iterations. +- */ +-#define rdma_umem_for_each_dma_block(umem, biter, pgsz) \ +- for (__rdma_umem_block_iter_start(biter, umem, pgsz); \ +- __rdma_umem_block_iter_next(biter);) +- + #ifdef CONFIG_INFINIBAND_USER_MEM + + struct ib_umem *ib_umem_get(struct ib_device *device, unsigned long addr, +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -2931,22 +2931,6 @@ struct ib_client { + u8 no_kverbs_req:1; + }; + +-/* +- * IB block DMA iterator +- * +- * Iterates the DMA-mapped SGL in contiguous memory blocks aligned +- * to a HW supported page size. +- */ +-struct ib_block_iter { +- /* internal states */ +- struct scatterlist *__sg; /* sg holding the current aligned block */ +- dma_addr_t __dma_addr; /* unaligned DMA address of this block */ +- size_t __sg_numblocks; /* ib_umem_num_dma_blocks() */ +- unsigned int __sg_nents; /* number of SG entries */ +- unsigned int __sg_advance; /* number of bytes to advance in sg in next step */ +- unsigned int __pg_bit; /* alignment of current block */ +-}; +- + struct ib_device *_ib_alloc_device(size_t size, struct net *net); + #define ib_alloc_device(drv_struct, member) \ + container_of(_ib_alloc_device(sizeof(struct drv_struct) + \ +@@ -2975,38 +2959,6 @@ void ib_unregister_device_queued(struct + int ib_register_client (struct ib_client *client); + void ib_unregister_client(struct ib_client *client); + +-void __rdma_block_iter_start(struct ib_block_iter *biter, +- struct scatterlist *sglist, +- unsigned int nents, +- unsigned long pgsz); +-bool __rdma_block_iter_next(struct ib_block_iter *biter); +- +-/** +- * rdma_block_iter_dma_address - get the aligned dma address of the current +- * block held by the block iterator. +- * @biter: block iterator holding the memory block +- */ +-static inline dma_addr_t +-rdma_block_iter_dma_address(struct ib_block_iter *biter) +-{ +- return biter->__dma_addr & ~(BIT_ULL(biter->__pg_bit) - 1); +-} +- +-/** +- * rdma_for_each_block - iterate over contiguous memory blocks of the sg list +- * @sglist: sglist to iterate over +- * @biter: block iterator holding the memory block +- * @nents: maximum number of sg entries to iterate over +- * @pgsz: best HW supported page size to use +- * +- * Callers may use rdma_block_iter_dma_address() to get each +- * blocks aligned DMA address. +- */ +-#define rdma_for_each_block(sglist, biter, nents, pgsz) \ +- for (__rdma_block_iter_start(biter, sglist, nents, \ +- pgsz); \ +- __rdma_block_iter_next(biter);) +- + /** + * ib_get_client_data - Get IB client context + * @device:Device to get context for +--- /dev/null ++++ b/include/rdma/iter.h +@@ -0,0 +1,88 @@ ++/* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */ ++/* Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. */ ++ ++#ifndef _RDMA_ITER_H_ ++#define _RDMA_ITER_H_ ++ ++#include ++#include ++ ++/** ++ * IB block DMA iterator ++ * ++ * Iterates the DMA-mapped SGL in contiguous memory blocks aligned ++ * to a HW supported page size. ++ */ ++struct ib_block_iter { ++ /* internal states */ ++ struct scatterlist *__sg; /* sg holding the current aligned block */ ++ dma_addr_t __dma_addr; /* unaligned DMA address of this block */ ++ size_t __sg_numblocks; /* ib_umem_num_dma_blocks() */ ++ unsigned int __sg_nents; /* number of SG entries */ ++ unsigned int __sg_advance; /* number of bytes to advance in sg in next step */ ++ unsigned int __pg_bit; /* alignment of current block */ ++}; ++ ++void __rdma_block_iter_start(struct ib_block_iter *biter, ++ struct scatterlist *sglist, ++ unsigned int nents, ++ unsigned long pgsz); ++bool __rdma_block_iter_next(struct ib_block_iter *biter); ++ ++/** ++ * rdma_block_iter_dma_address - get the aligned dma address of the current ++ * block held by the block iterator. ++ * @biter: block iterator holding the memory block ++ */ ++static inline dma_addr_t ++rdma_block_iter_dma_address(struct ib_block_iter *biter) ++{ ++ return biter->__dma_addr & ~(BIT_ULL(biter->__pg_bit) - 1); ++} ++ ++/** ++ * rdma_for_each_block - iterate over contiguous memory blocks of the sg list ++ * @sglist: sglist to iterate over ++ * @biter: block iterator holding the memory block ++ * @nents: maximum number of sg entries to iterate over ++ * @pgsz: best HW supported page size to use ++ * ++ * Callers may use rdma_block_iter_dma_address() to get each ++ * blocks aligned DMA address. ++ */ ++#define rdma_for_each_block(sglist, biter, nents, pgsz) \ ++ for (__rdma_block_iter_start(biter, sglist, nents, \ ++ pgsz); \ ++ __rdma_block_iter_next(biter);) ++ ++static inline void __rdma_umem_block_iter_start(struct ib_block_iter *biter, ++ struct ib_umem *umem, ++ unsigned long pgsz) ++{ ++ __rdma_block_iter_start(biter, umem->sgt_append.sgt.sgl, ++ umem->sgt_append.sgt.nents, pgsz); ++ biter->__sg_advance = ib_umem_offset(umem) & ~(pgsz - 1); ++ biter->__sg_numblocks = ib_umem_num_dma_blocks(umem, pgsz); ++} ++ ++static inline bool __rdma_umem_block_iter_next(struct ib_block_iter *biter) ++{ ++ return __rdma_block_iter_next(biter) && biter->__sg_numblocks--; ++} ++ ++/** ++ * rdma_umem_for_each_dma_block - iterate over contiguous DMA blocks of the umem ++ * @umem: umem to iterate over ++ * @pgsz: Page size to split the list into ++ * ++ * pgsz must be <= PAGE_SIZE or computed by ib_umem_find_best_pgsz(). The ++ * returned DMA blocks will be aligned to pgsz and span the range: ++ * ALIGN_DOWN(umem->address, pgsz) to ALIGN(umem->address + umem->length, pgsz) ++ * ++ * Performs exactly ib_umem_num_dma_blocks() iterations. ++ */ ++#define rdma_umem_for_each_dma_block(umem, biter, pgsz) \ ++ for (__rdma_umem_block_iter_start(biter, umem, pgsz); \ ++ __rdma_umem_block_iter_next(biter);) ++ ++#endif /* _RDMA_ITER_H_ */ diff --git a/queue-6.18/rdma-umem-add-helpers-for-umem-dmabuf-revoke-lock.patch b/queue-6.18/rdma-umem-add-helpers-for-umem-dmabuf-revoke-lock.patch new file mode 100644 index 0000000000..742b24a5b2 --- /dev/null +++ b/queue-6.18/rdma-umem-add-helpers-for-umem-dmabuf-revoke-lock.patch @@ -0,0 +1,74 @@ +From stable+bounces-263460-greg=kroah.com@vger.kernel.org Tue Jun 16 02:46:22 2026 +From: Sasha Levin +Date: Mon, 15 Jun 2026 17:16:15 -0400 +Subject: RDMA/umem: Add helpers for umem dmabuf revoke lock +To: stable@vger.kernel.org +Cc: Jacob Moroni , Leon Romanovsky , Sasha Levin +Message-ID: <20260615211616.2460210-3-sashal@kernel.org> + +From: Jacob Moroni + +[ Upstream commit 3a0b171302eea1732a168e26db3b8461f51cc1f9 ] + +Added helpers to acquire and release the umem dmabuf revoke +lock. The intent is to avoid the need for drivers to peek +into the ib_umem_dmabuf internals to get the dma_resv_lock +and bring us one step closer to abstracting ib_umem_dmabuf +away from drivers in general. + +Signed-off-by: Jacob Moroni +Link: https://patch.msgid.link/20260305170826.3803155-5-jmoroni@google.com +Signed-off-by: Leon Romanovsky +Stable-dep-of: badad6fad60d ("RDMA: During rereg_mr ensure that REREG_ACCESS is compatible") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/umem_dmabuf.c | 16 ++++++++++++++++ + include/rdma/ib_umem.h | 4 ++++ + 2 files changed, 20 insertions(+) + +--- a/drivers/infiniband/core/umem_dmabuf.c ++++ b/drivers/infiniband/core/umem_dmabuf.c +@@ -276,6 +276,22 @@ struct ib_umem_dmabuf *ib_umem_dmabuf_ge + } + EXPORT_SYMBOL(ib_umem_dmabuf_get_pinned); + ++void ib_umem_dmabuf_revoke_lock(struct ib_umem_dmabuf *umem_dmabuf) ++{ ++ struct dma_buf *dmabuf = umem_dmabuf->attach->dmabuf; ++ ++ dma_resv_lock(dmabuf->resv, NULL); ++} ++EXPORT_SYMBOL(ib_umem_dmabuf_revoke_lock); ++ ++void ib_umem_dmabuf_revoke_unlock(struct ib_umem_dmabuf *umem_dmabuf) ++{ ++ struct dma_buf *dmabuf = umem_dmabuf->attach->dmabuf; ++ ++ dma_resv_unlock(dmabuf->resv); ++} ++EXPORT_SYMBOL(ib_umem_dmabuf_revoke_unlock); ++ + void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf) + { + struct dma_buf *dmabuf = umem_dmabuf->attach->dmabuf; +--- a/include/rdma/ib_umem.h ++++ b/include/rdma/ib_umem.h +@@ -176,6 +176,8 @@ ib_umem_dmabuf_get_pinned_with_dma_devic + int ib_umem_dmabuf_map_pages(struct ib_umem_dmabuf *umem_dmabuf); + void ib_umem_dmabuf_unmap_pages(struct ib_umem_dmabuf *umem_dmabuf); + void ib_umem_dmabuf_release(struct ib_umem_dmabuf *umem_dmabuf); ++void ib_umem_dmabuf_revoke_lock(struct ib_umem_dmabuf *umem_dmabuf); ++void ib_umem_dmabuf_revoke_unlock(struct ib_umem_dmabuf *umem_dmabuf); + void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf); + + #else /* CONFIG_INFINIBAND_USER_MEM */ +@@ -236,6 +238,8 @@ static inline int ib_umem_dmabuf_map_pag + } + static inline void ib_umem_dmabuf_unmap_pages(struct ib_umem_dmabuf *umem_dmabuf) { } + static inline void ib_umem_dmabuf_release(struct ib_umem_dmabuf *umem_dmabuf) { } ++static inline void ib_umem_dmabuf_revoke_lock(struct ib_umem_dmabuf *umem_dmabuf) {} ++static inline void ib_umem_dmabuf_revoke_unlock(struct ib_umem_dmabuf *umem_dmabuf) {} + static inline void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf) {} + + #endif /* CONFIG_INFINIBAND_USER_MEM */ diff --git a/queue-6.18/rdma-umem-add-ib_umem_dmabuf_get_pinned_and_lock-helper.patch b/queue-6.18/rdma-umem-add-ib_umem_dmabuf_get_pinned_and_lock-helper.patch new file mode 100644 index 0000000000..dbbb63535a --- /dev/null +++ b/queue-6.18/rdma-umem-add-ib_umem_dmabuf_get_pinned_and_lock-helper.patch @@ -0,0 +1,90 @@ +From stable+bounces-263458-greg=kroah.com@vger.kernel.org Tue Jun 16 02:46:26 2026 +From: Sasha Levin +Date: Mon, 15 Jun 2026 17:16:13 -0400 +Subject: RDMA/umem: Add ib_umem_dmabuf_get_pinned_and_lock helper +To: stable@vger.kernel.org +Cc: Jacob Moroni , Leon Romanovsky , Sasha Levin +Message-ID: <20260615211616.2460210-1-sashal@kernel.org> + +From: Jacob Moroni + +[ Upstream commit 553dfa8cbd0c6d36adae042d9738ddf8f8765ac7 ] + +Move the inner logic of ib_umem_dmabuf_get_pinned_with_dma_device() +to a new static function that returns with the lock held upon success. + +The intent is to allow reuse for the future get_pinned_revocable_and_lock +function. + +Signed-off-by: Jacob Moroni +Link: https://patch.msgid.link/20260305170826.3803155-2-jmoroni@google.com +Signed-off-by: Leon Romanovsky +Stable-dep-of: badad6fad60d ("RDMA: During rereg_mr ensure that REREG_ACCESS is compatible") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/umem_dmabuf.c | 35 +++++++++++++++++++++++++--------- + 1 file changed, 26 insertions(+), 9 deletions(-) + +--- a/drivers/infiniband/core/umem_dmabuf.c ++++ b/drivers/infiniband/core/umem_dmabuf.c +@@ -198,18 +198,19 @@ static struct dma_buf_attach_ops ib_umem + .move_notify = ib_umem_dmabuf_unsupported_move_notify, + }; + +-struct ib_umem_dmabuf * +-ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device, +- struct device *dma_device, +- unsigned long offset, size_t size, +- int fd, int access) ++static struct ib_umem_dmabuf * ++ib_umem_dmabuf_get_pinned_and_lock(struct ib_device *device, ++ struct device *dma_device, ++ unsigned long offset, ++ size_t size, int fd, int access, ++ const struct dma_buf_attach_ops *ops) + { + struct ib_umem_dmabuf *umem_dmabuf; + int err; + +- umem_dmabuf = ib_umem_dmabuf_get_with_dma_device(device, dma_device, offset, +- size, fd, access, +- &ib_umem_dmabuf_attach_pinned_ops); ++ umem_dmabuf = ++ ib_umem_dmabuf_get_with_dma_device(device, dma_device, offset, ++ size, fd, access, ops); + if (IS_ERR(umem_dmabuf)) + return umem_dmabuf; + +@@ -222,7 +223,6 @@ ib_umem_dmabuf_get_pinned_with_dma_devic + err = ib_umem_dmabuf_map_pages(umem_dmabuf); + if (err) + goto err_release; +- dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv); + + return umem_dmabuf; + +@@ -231,6 +231,23 @@ err_release: + ib_umem_release(&umem_dmabuf->umem); + return ERR_PTR(err); + } ++ ++struct ib_umem_dmabuf * ++ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device, ++ struct device *dma_device, ++ unsigned long offset, size_t size, ++ int fd, int access) ++{ ++ struct ib_umem_dmabuf *umem_dmabuf = ++ ib_umem_dmabuf_get_pinned_and_lock(device, dma_device, offset, ++ size, fd, access, ++ &ib_umem_dmabuf_attach_pinned_ops); ++ if (IS_ERR(umem_dmabuf)) ++ return umem_dmabuf; ++ ++ dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv); ++ return umem_dmabuf; ++} + EXPORT_SYMBOL(ib_umem_dmabuf_get_pinned_with_dma_device); + + struct ib_umem_dmabuf *ib_umem_dmabuf_get_pinned(struct ib_device *device, diff --git a/queue-6.18/rdma-umem-fix-kernel-doc-warnings.patch b/queue-6.18/rdma-umem-fix-kernel-doc-warnings.patch new file mode 100644 index 0000000000..0575516fed --- /dev/null +++ b/queue-6.18/rdma-umem-fix-kernel-doc-warnings.patch @@ -0,0 +1,60 @@ +From stable+bounces-263462-greg=kroah.com@vger.kernel.org Tue Jun 16 02:59:30 2026 +From: Sasha Levin +Date: Mon, 15 Jun 2026 17:29:06 -0400 +Subject: RDMA/umem: fix kernel-doc warnings +To: stable@vger.kernel.org +Cc: Randy Dunlap , Leon Romanovsky , Sasha Levin +Message-ID: <20260615212908.2473687-1-sashal@kernel.org> + +From: Randy Dunlap + +[ Upstream commit ff46d1392750444fab5ae5a0194764ffdc4ac0d2 ] + +Add or correct kernel-doc comments to eliminate warnings: + +Warning: include/rdma/ib_umem.h:104 function parameter 'biter' not + described in 'rdma_umem_for_each_dma_block' +Warning: include/rdma/ib_umem.h:140 function parameter 'pgsz_bitmap' not + described in 'ib_umem_find_best_pgoff' +Warning: include/rdma/ib_umem.h:141 No description found for return + value of 'ib_umem_find_best_pgoff' + +Signed-off-by: Randy Dunlap +Link: https://patch.msgid.link/20260224003120.3173892-1-rdunlap@infradead.org +Signed-off-by: Leon Romanovsky +Stable-dep-of: 15fe76e23615 ("RDMA/umem: Fix truncation for block sizes >= 4G") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/rdma/ib_umem.h | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/include/rdma/ib_umem.h ++++ b/include/rdma/ib_umem.h +@@ -94,6 +94,7 @@ static inline bool __rdma_umem_block_ite + /** + * rdma_umem_for_each_dma_block - iterate over contiguous DMA blocks of the umem + * @umem: umem to iterate over ++ * @biter: block iterator variable + * @pgsz: Page size to split the list into + * + * pgsz must be <= PAGE_SIZE or computed by ib_umem_find_best_pgsz(). The +@@ -121,7 +122,7 @@ unsigned long ib_umem_find_best_pgsz(str + * ib_umem_find_best_pgoff - Find best HW page size + * + * @umem: umem struct +- * @pgsz_bitmap bitmap of HW supported page sizes ++ * @pgsz_bitmap: bitmap of HW supported page sizes + * @pgoff_bitmask: Mask of bits that can be represented with an offset + * + * This is very similar to ib_umem_find_best_pgsz() except instead of accepting +@@ -134,6 +135,9 @@ unsigned long ib_umem_find_best_pgsz(str + * + * If the pgoff_bitmask requires either alignment in the low bit or an + * unavailable page size for the high bits, this function returns 0. ++ * ++ * Returns: best HW page size for the parameters or 0 if none available ++ * for the given parameters. + */ + static inline unsigned long ib_umem_find_best_pgoff(struct ib_umem *umem, + unsigned long pgsz_bitmap, diff --git a/queue-6.18/rdma-umem-fix-truncation-for-block-sizes-4g.patch b/queue-6.18/rdma-umem-fix-truncation-for-block-sizes-4g.patch new file mode 100644 index 0000000000..b0d1bff95a --- /dev/null +++ b/queue-6.18/rdma-umem-fix-truncation-for-block-sizes-4g.patch @@ -0,0 +1,44 @@ +From stable+bounces-263464-greg=kroah.com@vger.kernel.org Tue Jun 16 02:59:15 2026 +From: Sasha Levin +Date: Mon, 15 Jun 2026 17:29:08 -0400 +Subject: RDMA/umem: Fix truncation for block sizes >= 4G +To: stable@vger.kernel.org +Cc: Jason Gunthorpe , Sasha Levin +Message-ID: <20260615212908.2473687-3-sashal@kernel.org> + +From: Jason Gunthorpe + +[ Upstream commit 15fe76e23615f502d051ef0768f86babaf08746c ] + +When the iommu is used the linearization of the mapping can give a single +block that is very large split across multiple SG entries. + +When __rdma_block_iter_next() reassembles the split SG entries it is +overflowing the 32 bit stack values and computed the wrong DMA addresses +for blocks after the truncation. + +Use the right types to hold DMA addresses. + +Link: https://patch.msgid.link/r/1-v1-88303e9e509f+f7-ib_umem_types_jgg@nvidia.com +Cc: stable@vger.kernel.org +Fixes: a808273a495c ("RDMA/verbs: Add a DMA iterator to return aligned contiguous memory blocks") +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/iter.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/core/iter.c ++++ b/drivers/infiniband/core/iter.c +@@ -19,8 +19,8 @@ EXPORT_SYMBOL(__rdma_block_iter_start); + + bool __rdma_block_iter_next(struct ib_block_iter *biter) + { +- unsigned int block_offset; +- unsigned int delta; ++ dma_addr_t block_offset; ++ dma_addr_t delta; + + if (!biter->__sg_nents || !biter->__sg) + return false; diff --git a/queue-6.18/rdma-umem-move-umem-dmabuf-revoke-logic-into-helper-function.patch b/queue-6.18/rdma-umem-move-umem-dmabuf-revoke-logic-into-helper-function.patch new file mode 100644 index 0000000000..acf14cb40d --- /dev/null +++ b/queue-6.18/rdma-umem-move-umem-dmabuf-revoke-logic-into-helper-function.patch @@ -0,0 +1,68 @@ +From stable+bounces-263459-greg=kroah.com@vger.kernel.org Tue Jun 16 02:46:34 2026 +From: Sasha Levin +Date: Mon, 15 Jun 2026 17:16:14 -0400 +Subject: RDMA/umem: Move umem dmabuf revoke logic into helper function +To: stable@vger.kernel.org +Cc: Jacob Moroni , Leon Romanovsky , Sasha Levin +Message-ID: <20260615211616.2460210-2-sashal@kernel.org> + +From: Jacob Moroni + +[ Upstream commit 797291a66ce346c96114b72222fc290d402da005 ] + +This same logic will eventually be reused from within the +invalidate_mappings callback which already has the dma_resv_lock +held, so break it out into a separate function so it can be reused. + +Signed-off-by: Jacob Moroni +Link: https://patch.msgid.link/20260305170826.3803155-3-jmoroni@google.com +Signed-off-by: Leon Romanovsky +Stable-dep-of: badad6fad60d ("RDMA: During rereg_mr ensure that REREG_ACCESS is compatible") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/umem_dmabuf.c | 26 +++++++++++++++++--------- + 1 file changed, 17 insertions(+), 9 deletions(-) + +--- a/drivers/infiniband/core/umem_dmabuf.c ++++ b/drivers/infiniband/core/umem_dmabuf.c +@@ -198,6 +198,22 @@ static struct dma_buf_attach_ops ib_umem + .move_notify = ib_umem_dmabuf_unsupported_move_notify, + }; + ++static void ib_umem_dmabuf_revoke_locked(struct dma_buf_attachment *attach) ++{ ++ struct ib_umem_dmabuf *umem_dmabuf = attach->importer_priv; ++ ++ dma_resv_assert_held(attach->dmabuf->resv); ++ ++ if (umem_dmabuf->revoked) ++ return; ++ ib_umem_dmabuf_unmap_pages(umem_dmabuf); ++ if (umem_dmabuf->pinned) { ++ dma_buf_unpin(umem_dmabuf->attach); ++ umem_dmabuf->pinned = 0; ++ } ++ umem_dmabuf->revoked = 1; ++} ++ + static struct ib_umem_dmabuf * + ib_umem_dmabuf_get_pinned_and_lock(struct ib_device *device, + struct device *dma_device, +@@ -265,15 +281,7 @@ void ib_umem_dmabuf_revoke(struct ib_ume + struct dma_buf *dmabuf = umem_dmabuf->attach->dmabuf; + + dma_resv_lock(dmabuf->resv, NULL); +- if (umem_dmabuf->revoked) +- goto end; +- ib_umem_dmabuf_unmap_pages(umem_dmabuf); +- if (umem_dmabuf->pinned) { +- dma_buf_unpin(umem_dmabuf->attach); +- umem_dmabuf->pinned = 0; +- } +- umem_dmabuf->revoked = 1; +-end: ++ ib_umem_dmabuf_revoke_locked(umem_dmabuf->attach); + dma_resv_unlock(dmabuf->resv); + } + EXPORT_SYMBOL(ib_umem_dmabuf_revoke); diff --git a/queue-6.18/series b/queue-6.18/series index 03823dfb4e..58755cbaa7 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -306,3 +306,11 @@ driver-core-reject-devices-with-unregistered-buses.patch wifi-mac80211-skip-ieee80211_verify_sta_ht_mcs_support-check-in-non-strict-mode.patch wifi-mac80211-tests-mark-ht-check-strict.patch sched_ext-don-t-warn-on-null-cgrp_moving_from-in-scx.patch +rdma-umem-add-ib_umem_dmabuf_get_pinned_and_lock-helper.patch +rdma-umem-move-umem-dmabuf-revoke-logic-into-helper-function.patch +rdma-umem-add-helpers-for-umem-dmabuf-revoke-lock.patch +rdma-during-rereg_mr-ensure-that-rereg_access-is-compatible.patch +netfilter-nft_fib-fix-stale-stack-leak-via-the-oifname-register.patch +rdma-umem-fix-kernel-doc-warnings.patch +rdma-move-dma-block-iterator-logic-into-dedicated-files.patch +rdma-umem-fix-truncation-for-block-sizes-4g.patch