Hi,
There are multiple integer overflows that may lead to buffer overflows
in drivers/infiniband/core/uverbs_cmd.c. I will explain how an exploit
might work and suggest some patches. Thanks for reviewing.
Possible exploit
Consider ib_uverbs_unmarshall_recv(). The function is
On 4/26/2012 8:45 PM, Jim Foraker wrote:
On Thu, 2012-04-26 at 05:04 -0700, Hal Rosenstock wrote:
On 4/25/2012 7:24 PM, Jim Foraker wrote:
On Wed, 2012-04-25 at 05:57 -0700, Hal Rosenstock wrote:
On 4/24/2012 7:42 PM, Jim Foraker wrote:
On Tue, 2012-04-24 at 07:17 -0700, Hal Rosenstock
Hi,
i want to setup Mellanox/RoCE. My system is SUSE SLES11.2 with
Mellanox-OFED-1.5.3
I have ping on the ethernet interface working and also ibv_ud_pingpong.
ibv_rc_pingpong fails:
bc2x03:~ # ibv_rc_pingpong -g 0 -s 128 -d mlx4_0 -i 2 10.100.10.24
local address: LID 0x, QPN 0x600048, PSN
On 4/26/2012 9:40 PM, Ira Weiny wrote:
On Thu, 26 Apr 2012 08:47:21 -0400
Hal Rosenstock h...@dev.mellanox.co.il wrote:
On 4/25/2012 8:38 PM, Troy Leedberg wrote:
I noticed that doing ibstat, none of the iWARP RNIC adapters were showing
up.
Once upon a time, this used to work:
commit
Just log a warning.
Signed-off-by: Steve Wise sw...@opengridcomputing.com
Cc: sta...@vger.kernel.org
---
drivers/infiniband/hw/cxgb4/cm.c |5 -
1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index
Function import_ep() is incorrectly using ep-dst instead of the dst
ptr passed in. This causes a crash when accepting new rdma connections
becase ep-dst is not initialized yet.
Signed-off-by: Steve Wise sw...@opengridcomputing.com
Cc: sta...@vger.kernel.org
---
drivers/infiniband/hw/cxgb4/cm.c
Hello,
If I interpret the source code in drivers/infiniband/core/cm.c correctly
ib_destroy_cm_id() can return before an ongoing cm_id callback has
finished. Is this on purpose ? If not, isn't there a
flush_workqueue(cm.wq) call missing in cm_destroy_id() ?
Thanks,
Bart.
--
To unsubscribe from
Klaus,
You may be experiencing frame drops on our Ethernet fabric.
Is flow control (pause frames) enabled?
RDMA traffic requires lossless layer-2 network, it is not designed to handle
situation where multiple frames are re-transmitted due to packets being dropped.
Boris Shpolyansky
Director of
On 04/26/2012 11:11 PM, Stephen Rothwell wrote:
Hi all,
Changes since 20120424:
when IPV6 is not enabled:
ERROR: register_inet6addr_notifier [drivers/infiniband/hw/ocrdma/ocrdma.ko]
undefined!
ERROR: unregister_inet6addr_notifier [drivers/infiniband/hw/ocrdma/ocrdma.ko]
undefined!
If I interpret the source code in drivers/infiniband/core/cm.c correctly
ib_destroy_cm_id() can return before an ongoing cm_id callback has
finished. Is this on purpose ? If not, isn't there a
flush_workqueue(cm.wq) call missing in cm_destroy_id() ?
ib_destroy_cm_id() will block while there's
On Fri, 27 Apr 2012 08:19:15 -0400
Hal Rosenstock h...@dev.mellanox.co.il wrote:
On 4/26/2012 9:40 PM, Ira Weiny wrote:
On Thu, 26 Apr 2012 08:47:21 -0400
Hal Rosenstock h...@dev.mellanox.co.il wrote:
On 4/25/2012 8:38 PM, Troy Leedberg wrote:
I noticed that doing ibstat, none of the
On Thu, 26 Apr 2012 22:11:07 +
Hefty, Sean sean.he...@intel.com wrote:
Hal/Sean, I defer to you on whether you think we should add this change to
ibstat. If you all recommend against it,
we'll advise customers to use ibv_devinfo, which is included with libibverbs
and is required for
On Fri, Apr 27, 2012 at 9:56 AM, Randy Dunlap rdun...@xenotime.net wrote:
when IPV6 is not enabled:
ERROR: register_inet6addr_notifier [drivers/infiniband/hw/ocrdma/ocrdma.ko]
undefined!
ERROR: unregister_inet6addr_notifier
[drivers/infiniband/hw/ocrdma/ocrdma.ko] undefined!
Thanks, I'll
Events sent to ocrdma_inet6addr_event() are sent from an atomic context,
therefore
we can't try to lock a mutex within the notifier callback.
We could just switch the mutex to a spinlock since all it does it protect a
list,
but I've went ahead and switched the list to use RCU instead. I
14 matches
Mail list logo
