linux-next.git/drivers/infiniband/hw/ionic/ionic_ibdev.c, branch master

RDMA/ionic: Add robust udata compatibility checks to all uapi verbs

2026-07-20T13:45:44+00:00

Enable the robust udata contract by setting uverbs_robust_udata and adding proper input validation and output handling to all verbs that accept struct ib_udata. For verbs with no driver request or response struct, add ib_no_udata_io(). For create_ah, which already responds with ionic_ah_resp, add the missing input validation via ib_is_udata_in_empty(). Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20260717092345.2533564-1-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA: Use ib_no_udata_io() in query_device callbacks

2026-07-20T13:00:40+00:00

The query_device callbacks that neither accept driver-specific input nor return a driver-specific response open-code the empty udata handling as ib_is_udata_in_empty() on entry and ib_respond_empty_udata() on exit. ib_no_udata_io() already combines both steps, so replace the entry check with it and simply return 0 on success. Unlike the create and destroy flows, query_device owns no uobject or HW resource - the extended path fills a stack ib_device_attr that the core discards on error - so clearing the empty response buffer on entry rather than on exit is a mechanical change with no functional difference. Link: https://patch.msgid.link/20260714-convert-to-noio-udata-v1-1-f1f6b6c7c988@nvidia.com Signed-off-by: Leon Romanovsky

RDMA: Update the query_device() op

2026-06-03T18:12:43+00:00

This op hasn't followed the normal pattern of passing NULL for udata when invoked by the kernel. Instead the kernel caller creates a dummy ib_udata on the stack and passes that in. It does not seem to currently be a bug, but this flow should be modernized to use the new API flow and in the process accept NULL as well. Only mlx4 uses an input request structure, have every other driver call ib_is_udata_in_empty() to enforce the lack of request structs. Use ib_respond_empty_udata() in every driver that does not use a response struct. Ensure a check for NULL udata before calling ib_respond_udata() in bnxt_re, efa, and mlx5. Make mlx4 safe to be called with NULL. Link: https://patch.msgid.link/r/2-v1-922fa8e828ba+f7-ib_udata_stack_jgg@nvidia.com Signed-off-by: Jason Gunthorpe

RDMA/ionic: Fix typo in format string

2026-05-02T18:30:48+00:00

Applying the corrupted patch by hand mangled the format string, put the s in the right place. Cc: stable@vger.kernel.org Fixes: 654a27f25530 ("RDMA/ionic: bound node_desc sysfs read with %.64s") Link: https://patch.msgid.link/r/1-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Reported-by: Brad Spengler Signed-off-by: Jason Gunthorpe

RDMA/ionic: bound node_desc sysfs read with %.64s

2026-04-09T15:47:04+00:00

node_desc[64] in struct ib_device is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason (drivers/infiniband/core/sysfs.c:1307), since node_desc_store() performs a raw memcpy of up to IB_DEVICE_NODE_DESC_MAX bytes with no NUL termination: memcpy(desc.node_desc, buf, min_t(int, count, IB_DEVICE_NODE_DESC_MAX)); If exactly 64 bytes are written via the node_desc sysfs file, the array contains no NUL byte. The ionic hca_type_show() handler uses unbounded "%s" and will read past the end of node_desc into adjacent fields of struct ib_device until it encounters a NUL. ionic supports IB_DEVICE_MODIFY_NODE_DESC, so this is triggerable by userspace. Match the core handler and bound the format specifier. Cc: stable@vger.kernel.org Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality") Link: https://patch.msgid.link/r/CALynFi7NAbhDCt1tdaDbf6TnLvAqbaHa6-Wqf6OkzREbA_PAfg@mail.gmail.com Signed-off-by: Kai Aizen Signed-off-by: Jason Gunthorpe

RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port

2026-02-24T09:54:10+00:00

The function ionic_query_port() calls ib_device_get_netdev() without checking the return value which could lead to NULL pointer dereference, Fix it by checking the return value and return -ENODEV if the 'ndev' is NULL. Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality") Signed-off-by: Kamal Heib Link: https://patch.msgid.link/20260220222125.16973-2-kheib@redhat.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Implement device stats ops

2025-09-11T06:18:36+00:00

Implement device stats operations for hw stats and qp stats. Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-14-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Register device ops for miscellaneous functionality

2025-09-11T06:18:36+00:00

Implement idbdev ops for device and port information. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-13-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Register device ops for datapath

2025-09-11T06:18:36+00:00

Implement device supported verb APIs for datapath. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-12-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Register device ops for control path

2025-09-11T06:18:36+00:00

Implement device supported verb APIs for control path. Co-developed-by: Andrew Boyer Signed-off-by: Andrew Boyer Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20250903061606.4139957-11-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky