1 /* 2 * Copyright (c) 2016 Mellanox Technologies Ltd. All rights reserved. 3 * 4 * This software is available to you under a choice of one of two 5 * licenses. You may choose to be licensed under the terms of the GNU 6 * General Public License (GPL) Version 2, available from the file 7 * COPYING in the main directory of this source tree, or the 8 * OpenIB.org BSD license below: 9 * 10 * Redistribution and use in source and binary forms, with or 11 * without modification, are permitted provided that the following 12 * conditions are met: 13 * 14 * - Redistributions of source code must retain the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer. 17 * 18 * - Redistributions in binary form must reproduce the above 19 * copyright notice, this list of conditions and the following 20 * disclaimer in the documentation and/or other materials 21 * provided with the distribution. 22 * 23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND 26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS 27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN 28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 30 * SOFTWARE. 31 */ 32 33 #include <linux/security.h> 34 #include <linux/completion.h> 35 #include <linux/list.h> 36 37 #include <rdma/ib_verbs.h> 38 #include <rdma/ib_cache.h> 39 #include "core_priv.h" 40 #include "mad_priv.h" 41 42 static LIST_HEAD(mad_agent_list); 43 /* Lock to protect mad_agent_list */ 44 static DEFINE_SPINLOCK(mad_agent_list_lock); 45 46 static struct pkey_index_qp_list *get_pkey_idx_qp_list(struct ib_port_pkey *pp) 47 { 48 struct pkey_index_qp_list *pkey = NULL; 49 struct pkey_index_qp_list *tmp_pkey; 50 struct ib_device *dev = pp->sec->dev; 51 52 spin_lock(&dev->port_data[pp->port_num].pkey_list_lock); 53 list_for_each_entry (tmp_pkey, &dev->port_data[pp->port_num].pkey_list, 54 pkey_index_list) { 55 if (tmp_pkey->pkey_index == pp->pkey_index) { 56 pkey = tmp_pkey; 57 break; 58 } 59 } 60 spin_unlock(&dev->port_data[pp->port_num].pkey_list_lock); 61 return pkey; 62 } 63 64 static int get_pkey_and_subnet_prefix(struct ib_port_pkey *pp, 65 u16 *pkey, 66 u64 *subnet_prefix) 67 { 68 struct ib_device *dev = pp->sec->dev; 69 int ret; 70 71 ret = ib_get_cached_pkey(dev, pp->port_num, pp->pkey_index, pkey); 72 if (ret) 73 return ret; 74 75 ret = ib_get_cached_subnet_prefix(dev, pp->port_num, subnet_prefix); 76 77 return ret; 78 } 79 80 static int enforce_qp_pkey_security(u16 pkey, 81 u64 subnet_prefix, 82 struct ib_qp_security *qp_sec) 83 { 84 struct ib_qp_security *shared_qp_sec; 85 int ret; 86 87 ret = security_ib_pkey_access(qp_sec->security, subnet_prefix, pkey); 88 if (ret) 89 return ret; 90 91 list_for_each_entry(shared_qp_sec, 92 &qp_sec->shared_qp_list, 93 shared_qp_list) { 94 ret = security_ib_pkey_access(shared_qp_sec->security, 95 subnet_prefix, 96 pkey); 97 if (ret) 98 return ret; 99 } 100 return 0; 101 } 102 103 /* The caller of this function must hold the QP security 104 * mutex of the QP of the security structure in *pps. 105 * 106 * It takes separate ports_pkeys and security structure 107 * because in some cases the pps will be for a new settings 108 * or the pps will be for the real QP and security structure 109 * will be for a shared QP. 110 */ 111 static int check_qp_port_pkey_settings(struct ib_ports_pkeys *pps, 112 struct ib_qp_security *sec) 113 { 114 u64 subnet_prefix; 115 u16 pkey; 116 int ret = 0; 117 118 if (!pps) 119 return 0; 120 121 if (pps->main.state != IB_PORT_PKEY_NOT_VALID) { 122 ret = get_pkey_and_subnet_prefix(&pps->main, 123 &pkey, 124 &subnet_prefix); 125 if (ret) 126 return ret; 127 128 ret = enforce_qp_pkey_security(pkey, 129 subnet_prefix, 130 sec); 131 if (ret) 132 return ret; 133 } 134 135 if (pps->alt.state != IB_PORT_PKEY_NOT_VALID) { 136 ret = get_pkey_and_subnet_prefix(&pps->alt, 137 &pkey, 138 &subnet_prefix); 139 if (ret) 140 return ret; 141 142 ret = enforce_qp_pkey_security(pkey, 143 subnet_prefix, 144 sec); 145 } 146 147 return ret; 148 } 149 150 /* The caller of this function must hold the QP security 151 * mutex. 152 */ 153 static void qp_to_error(struct ib_qp_security *sec) 154 { 155 struct ib_qp_security *shared_qp_sec; 156 struct ib_qp_attr attr = { 157 .qp_state = IB_QPS_ERR 158 }; 159 struct ib_event event = { 160 .event = IB_EVENT_QP_FATAL 161 }; 162 163 /* If the QP is in the process of being destroyed 164 * the qp pointer in the security structure is 165 * undefined. It cannot be modified now. 166 */ 167 if (sec->destroying) 168 return; 169 170 ib_modify_qp(sec->qp, 171 &attr, 172 IB_QP_STATE); 173 174 if (sec->qp->event_handler && sec->qp->qp_context) { 175 event.element.qp = sec->qp; 176 sec->qp->event_handler(&event, 177 sec->qp->qp_context); 178 } 179 180 list_for_each_entry(shared_qp_sec, 181 &sec->shared_qp_list, 182 shared_qp_list) { 183 struct ib_qp *qp = shared_qp_sec->qp; 184 185 if (qp->event_handler && qp->qp_context) { 186 event.element.qp = qp; 187 event.device = qp->device; 188 qp->event_handler(&event, 189 qp->qp_context); 190 } 191 } 192 } 193 194 static inline void check_pkey_qps(struct pkey_index_qp_list *pkey, 195 struct ib_device *device, 196 u8 port_num, 197 u64 subnet_prefix) 198 { 199 struct ib_port_pkey *pp, *tmp_pp; 200 bool comp; 201 LIST_HEAD(to_error_list); 202 u16 pkey_val; 203 204 if (!ib_get_cached_pkey(device, 205 port_num, 206 pkey->pkey_index, 207 &pkey_val)) { 208 spin_lock(&pkey->qp_list_lock); 209 list_for_each_entry(pp, &pkey->qp_list, qp_list) { 210 if (atomic_read(&pp->sec->error_list_count)) 211 continue; 212 213 if (enforce_qp_pkey_security(pkey_val, 214 subnet_prefix, 215 pp->sec)) { 216 atomic_inc(&pp->sec->error_list_count); 217 list_add(&pp->to_error_list, 218 &to_error_list); 219 } 220 } 221 spin_unlock(&pkey->qp_list_lock); 222 } 223 224 list_for_each_entry_safe(pp, 225 tmp_pp, 226 &to_error_list, 227 to_error_list) { 228 mutex_lock(&pp->sec->mutex); 229 qp_to_error(pp->sec); 230 list_del(&pp->to_error_list); 231 atomic_dec(&pp->sec->error_list_count); 232 comp = pp->sec->destroying; 233 mutex_unlock(&pp->sec->mutex); 234 235 if (comp) 236 complete(&pp->sec->error_complete); 237 } 238 } 239 240 /* The caller of this function must hold the QP security 241 * mutex. 242 */ 243 static int port_pkey_list_insert(struct ib_port_pkey *pp) 244 { 245 struct pkey_index_qp_list *tmp_pkey; 246 struct pkey_index_qp_list *pkey; 247 struct ib_device *dev; 248 u8 port_num = pp->port_num; 249 int ret = 0; 250 251 if (pp->state != IB_PORT_PKEY_VALID) 252 return 0; 253 254 dev = pp->sec->dev; 255 256 pkey = get_pkey_idx_qp_list(pp); 257 258 if (!pkey) { 259 bool found = false; 260 261 pkey = kzalloc(sizeof(*pkey), GFP_KERNEL); 262 if (!pkey) 263 return -ENOMEM; 264 265 spin_lock(&dev->port_data[port_num].pkey_list_lock); 266 /* Check for the PKey again. A racing process may 267 * have created it. 268 */ 269 list_for_each_entry(tmp_pkey, 270 &dev->port_data[port_num].pkey_list, 271 pkey_index_list) { 272 if (tmp_pkey->pkey_index == pp->pkey_index) { 273 kfree(pkey); 274 pkey = tmp_pkey; 275 found = true; 276 break; 277 } 278 } 279 280 if (!found) { 281 pkey->pkey_index = pp->pkey_index; 282 spin_lock_init(&pkey->qp_list_lock); 283 INIT_LIST_HEAD(&pkey->qp_list); 284 list_add(&pkey->pkey_index_list, 285 &dev->port_data[port_num].pkey_list); 286 } 287 spin_unlock(&dev->port_data[port_num].pkey_list_lock); 288 } 289 290 spin_lock(&pkey->qp_list_lock); 291 list_add(&pp->qp_list, &pkey->qp_list); 292 spin_unlock(&pkey->qp_list_lock); 293 294 pp->state = IB_PORT_PKEY_LISTED; 295 296 return ret; 297 } 298 299 /* The caller of this function must hold the QP security 300 * mutex. 301 */ 302 static void port_pkey_list_remove(struct ib_port_pkey *pp) 303 { 304 struct pkey_index_qp_list *pkey; 305 306 if (pp->state != IB_PORT_PKEY_LISTED) 307 return; 308 309 pkey = get_pkey_idx_qp_list(pp); 310 311 spin_lock(&pkey->qp_list_lock); 312 list_del(&pp->qp_list); 313 spin_unlock(&pkey->qp_list_lock); 314 315 /* The setting may still be valid, i.e. after 316 * a destroy has failed for example. 317 */ 318 pp->state = IB_PORT_PKEY_VALID; 319 } 320 321 static void destroy_qp_security(struct ib_qp_security *sec) 322 { 323 security_ib_free_security(sec->security); 324 kfree(sec->ports_pkeys); 325 kfree(sec); 326 } 327 328 /* The caller of this function must hold the QP security 329 * mutex. 330 */ 331 static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp, 332 const struct ib_qp_attr *qp_attr, 333 int qp_attr_mask) 334 { 335 struct ib_ports_pkeys *new_pps; 336 struct ib_ports_pkeys *qp_pps = qp->qp_sec->ports_pkeys; 337 338 new_pps = kzalloc(sizeof(*new_pps), GFP_KERNEL); 339 if (!new_pps) 340 return NULL; 341 342 if (qp_attr_mask & IB_QP_PORT) 343 new_pps->main.port_num = 344 (qp_pps) ? qp_pps->main.port_num : qp_attr->port_num; 345 if (qp_attr_mask & IB_QP_PKEY_INDEX) 346 new_pps->main.pkey_index = (qp_pps) ? qp_pps->main.pkey_index : 347 qp_attr->pkey_index; 348 if ((qp_attr_mask & IB_QP_PKEY_INDEX) && (qp_attr_mask & IB_QP_PORT)) 349 new_pps->main.state = IB_PORT_PKEY_VALID; 350 351 if (!(qp_attr_mask & (IB_QP_PKEY_INDEX || IB_QP_PORT)) && qp_pps) { 352 new_pps->main.port_num = qp_pps->main.port_num; 353 new_pps->main.pkey_index = qp_pps->main.pkey_index; 354 if (qp_pps->main.state != IB_PORT_PKEY_NOT_VALID) 355 new_pps->main.state = IB_PORT_PKEY_VALID; 356 } 357 358 if (qp_attr_mask & IB_QP_ALT_PATH) { 359 new_pps->alt.port_num = qp_attr->alt_port_num; 360 new_pps->alt.pkey_index = qp_attr->alt_pkey_index; 361 new_pps->alt.state = IB_PORT_PKEY_VALID; 362 } else if (qp_pps) { 363 new_pps->alt.port_num = qp_pps->alt.port_num; 364 new_pps->alt.pkey_index = qp_pps->alt.pkey_index; 365 if (qp_pps->alt.state != IB_PORT_PKEY_NOT_VALID) 366 new_pps->alt.state = IB_PORT_PKEY_VALID; 367 } 368 369 new_pps->main.sec = qp->qp_sec; 370 new_pps->alt.sec = qp->qp_sec; 371 return new_pps; 372 } 373 374 int ib_open_shared_qp_security(struct ib_qp *qp, struct ib_device *dev) 375 { 376 struct ib_qp *real_qp = qp->real_qp; 377 int ret; 378 379 ret = ib_create_qp_security(qp, dev); 380 381 if (ret) 382 return ret; 383 384 if (!qp->qp_sec) 385 return 0; 386 387 mutex_lock(&real_qp->qp_sec->mutex); 388 ret = check_qp_port_pkey_settings(real_qp->qp_sec->ports_pkeys, 389 qp->qp_sec); 390 391 if (ret) 392 goto ret; 393 394 if (qp != real_qp) 395 list_add(&qp->qp_sec->shared_qp_list, 396 &real_qp->qp_sec->shared_qp_list); 397 ret: 398 mutex_unlock(&real_qp->qp_sec->mutex); 399 if (ret) 400 destroy_qp_security(qp->qp_sec); 401 402 return ret; 403 } 404 405 void ib_close_shared_qp_security(struct ib_qp_security *sec) 406 { 407 struct ib_qp *real_qp = sec->qp->real_qp; 408 409 mutex_lock(&real_qp->qp_sec->mutex); 410 list_del(&sec->shared_qp_list); 411 mutex_unlock(&real_qp->qp_sec->mutex); 412 413 destroy_qp_security(sec); 414 } 415 416 int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev) 417 { 418 unsigned int i; 419 bool is_ib = false; 420 int ret; 421 422 rdma_for_each_port (dev, i) { 423 is_ib = rdma_protocol_ib(dev, i); 424 if (is_ib) 425 break; 426 } 427 428 /* If this isn't an IB device don't create the security context */ 429 if (!is_ib) 430 return 0; 431 432 qp->qp_sec = kzalloc(sizeof(*qp->qp_sec), GFP_KERNEL); 433 if (!qp->qp_sec) 434 return -ENOMEM; 435 436 qp->qp_sec->qp = qp; 437 qp->qp_sec->dev = dev; 438 mutex_init(&qp->qp_sec->mutex); 439 INIT_LIST_HEAD(&qp->qp_sec->shared_qp_list); 440 atomic_set(&qp->qp_sec->error_list_count, 0); 441 init_completion(&qp->qp_sec->error_complete); 442 ret = security_ib_alloc_security(&qp->qp_sec->security); 443 if (ret) { 444 kfree(qp->qp_sec); 445 qp->qp_sec = NULL; 446 } 447 448 return ret; 449 } 450 EXPORT_SYMBOL(ib_create_qp_security); 451 452 void ib_destroy_qp_security_begin(struct ib_qp_security *sec) 453 { 454 /* Return if not IB */ 455 if (!sec) 456 return; 457 458 mutex_lock(&sec->mutex); 459 460 /* Remove the QP from the lists so it won't get added to 461 * a to_error_list during the destroy process. 462 */ 463 if (sec->ports_pkeys) { 464 port_pkey_list_remove(&sec->ports_pkeys->main); 465 port_pkey_list_remove(&sec->ports_pkeys->alt); 466 } 467 468 /* If the QP is already in one or more of those lists 469 * the destroying flag will ensure the to error flow 470 * doesn't operate on an undefined QP. 471 */ 472 sec->destroying = true; 473 474 /* Record the error list count to know how many completions 475 * to wait for. 476 */ 477 sec->error_comps_pending = atomic_read(&sec->error_list_count); 478 479 mutex_unlock(&sec->mutex); 480 } 481 482 void ib_destroy_qp_security_abort(struct ib_qp_security *sec) 483 { 484 int ret; 485 int i; 486 487 /* Return if not IB */ 488 if (!sec) 489 return; 490 491 /* If a concurrent cache update is in progress this 492 * QP security could be marked for an error state 493 * transition. Wait for this to complete. 494 */ 495 for (i = 0; i < sec->error_comps_pending; i++) 496 wait_for_completion(&sec->error_complete); 497 498 mutex_lock(&sec->mutex); 499 sec->destroying = false; 500 501 /* Restore the position in the lists and verify 502 * access is still allowed in case a cache update 503 * occurred while attempting to destroy. 504 * 505 * Because these setting were listed already 506 * and removed during ib_destroy_qp_security_begin 507 * we know the pkey_index_qp_list for the PKey 508 * already exists so port_pkey_list_insert won't fail. 509 */ 510 if (sec->ports_pkeys) { 511 port_pkey_list_insert(&sec->ports_pkeys->main); 512 port_pkey_list_insert(&sec->ports_pkeys->alt); 513 } 514 515 ret = check_qp_port_pkey_settings(sec->ports_pkeys, sec); 516 if (ret) 517 qp_to_error(sec); 518 519 mutex_unlock(&sec->mutex); 520 } 521 522 void ib_destroy_qp_security_end(struct ib_qp_security *sec) 523 { 524 int i; 525 526 /* Return if not IB */ 527 if (!sec) 528 return; 529 530 /* If a concurrent cache update is occurring we must 531 * wait until this QP security structure is processed 532 * in the QP to error flow before destroying it because 533 * the to_error_list is in use. 534 */ 535 for (i = 0; i < sec->error_comps_pending; i++) 536 wait_for_completion(&sec->error_complete); 537 538 destroy_qp_security(sec); 539 } 540 541 void ib_security_cache_change(struct ib_device *device, 542 u8 port_num, 543 u64 subnet_prefix) 544 { 545 struct pkey_index_qp_list *pkey; 546 547 list_for_each_entry (pkey, &device->port_data[port_num].pkey_list, 548 pkey_index_list) { 549 check_pkey_qps(pkey, 550 device, 551 port_num, 552 subnet_prefix); 553 } 554 } 555 556 void ib_security_release_port_pkey_list(struct ib_device *device) 557 { 558 struct pkey_index_qp_list *pkey, *tmp_pkey; 559 unsigned int i; 560 561 rdma_for_each_port (device, i) { 562 list_for_each_entry_safe(pkey, 563 tmp_pkey, 564 &device->port_data[i].pkey_list, 565 pkey_index_list) { 566 list_del(&pkey->pkey_index_list); 567 kfree(pkey); 568 } 569 } 570 } 571 572 int ib_security_modify_qp(struct ib_qp *qp, 573 struct ib_qp_attr *qp_attr, 574 int qp_attr_mask, 575 struct ib_udata *udata) 576 { 577 int ret = 0; 578 struct ib_ports_pkeys *tmp_pps; 579 struct ib_ports_pkeys *new_pps = NULL; 580 struct ib_qp *real_qp = qp->real_qp; 581 bool special_qp = (real_qp->qp_type == IB_QPT_SMI || 582 real_qp->qp_type == IB_QPT_GSI || 583 real_qp->qp_type >= IB_QPT_RESERVED1); 584 bool pps_change = ((qp_attr_mask & (IB_QP_PKEY_INDEX | IB_QP_PORT)) || 585 (qp_attr_mask & IB_QP_ALT_PATH)); 586 587 WARN_ONCE((qp_attr_mask & IB_QP_PORT && 588 rdma_protocol_ib(real_qp->device, qp_attr->port_num) && 589 !real_qp->qp_sec), 590 "%s: QP security is not initialized for IB QP: %d\n", 591 __func__, real_qp->qp_num); 592 593 /* The port/pkey settings are maintained only for the real QP. Open 594 * handles on the real QP will be in the shared_qp_list. When 595 * enforcing security on the real QP all the shared QPs will be 596 * checked as well. 597 */ 598 599 if (pps_change && !special_qp && real_qp->qp_sec) { 600 mutex_lock(&real_qp->qp_sec->mutex); 601 new_pps = get_new_pps(real_qp, 602 qp_attr, 603 qp_attr_mask); 604 if (!new_pps) { 605 mutex_unlock(&real_qp->qp_sec->mutex); 606 return -ENOMEM; 607 } 608 /* Add this QP to the lists for the new port 609 * and pkey settings before checking for permission 610 * in case there is a concurrent cache update 611 * occurring. Walking the list for a cache change 612 * doesn't acquire the security mutex unless it's 613 * sending the QP to error. 614 */ 615 ret = port_pkey_list_insert(&new_pps->main); 616 617 if (!ret) 618 ret = port_pkey_list_insert(&new_pps->alt); 619 620 if (!ret) 621 ret = check_qp_port_pkey_settings(new_pps, 622 real_qp->qp_sec); 623 } 624 625 if (!ret) 626 ret = real_qp->device->ops.modify_qp(real_qp, 627 qp_attr, 628 qp_attr_mask, 629 udata); 630 631 if (new_pps) { 632 /* Clean up the lists and free the appropriate 633 * ports_pkeys structure. 634 */ 635 if (ret) { 636 tmp_pps = new_pps; 637 } else { 638 tmp_pps = real_qp->qp_sec->ports_pkeys; 639 real_qp->qp_sec->ports_pkeys = new_pps; 640 } 641 642 if (tmp_pps) { 643 port_pkey_list_remove(&tmp_pps->main); 644 port_pkey_list_remove(&tmp_pps->alt); 645 } 646 kfree(tmp_pps); 647 mutex_unlock(&real_qp->qp_sec->mutex); 648 } 649 return ret; 650 } 651 652 static int ib_security_pkey_access(struct ib_device *dev, 653 u8 port_num, 654 u16 pkey_index, 655 void *sec) 656 { 657 u64 subnet_prefix; 658 u16 pkey; 659 int ret; 660 661 if (!rdma_protocol_ib(dev, port_num)) 662 return 0; 663 664 ret = ib_get_cached_pkey(dev, port_num, pkey_index, &pkey); 665 if (ret) 666 return ret; 667 668 ret = ib_get_cached_subnet_prefix(dev, port_num, &subnet_prefix); 669 670 if (ret) 671 return ret; 672 673 return security_ib_pkey_access(sec, subnet_prefix, pkey); 674 } 675 676 void ib_mad_agent_security_change(void) 677 { 678 struct ib_mad_agent *ag; 679 680 spin_lock(&mad_agent_list_lock); 681 list_for_each_entry(ag, 682 &mad_agent_list, 683 mad_agent_sec_list) 684 WRITE_ONCE(ag->smp_allowed, 685 !security_ib_endport_manage_subnet(ag->security, 686 dev_name(&ag->device->dev), ag->port_num)); 687 spin_unlock(&mad_agent_list_lock); 688 } 689 690 int ib_mad_agent_security_setup(struct ib_mad_agent *agent, 691 enum ib_qp_type qp_type) 692 { 693 int ret; 694 695 if (!rdma_protocol_ib(agent->device, agent->port_num)) 696 return 0; 697 698 INIT_LIST_HEAD(&agent->mad_agent_sec_list); 699 700 ret = security_ib_alloc_security(&agent->security); 701 if (ret) 702 return ret; 703 704 if (qp_type != IB_QPT_SMI) 705 return 0; 706 707 spin_lock(&mad_agent_list_lock); 708 ret = security_ib_endport_manage_subnet(agent->security, 709 dev_name(&agent->device->dev), 710 agent->port_num); 711 if (ret) 712 goto free_security; 713 714 WRITE_ONCE(agent->smp_allowed, true); 715 list_add(&agent->mad_agent_sec_list, &mad_agent_list); 716 spin_unlock(&mad_agent_list_lock); 717 return 0; 718 719 free_security: 720 spin_unlock(&mad_agent_list_lock); 721 security_ib_free_security(agent->security); 722 return ret; 723 } 724 725 void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent) 726 { 727 if (!rdma_protocol_ib(agent->device, agent->port_num)) 728 return; 729 730 if (agent->qp->qp_type == IB_QPT_SMI) { 731 spin_lock(&mad_agent_list_lock); 732 list_del(&agent->mad_agent_sec_list); 733 spin_unlock(&mad_agent_list_lock); 734 } 735 736 security_ib_free_security(agent->security); 737 } 738 739 int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index) 740 { 741 if (!rdma_protocol_ib(map->agent.device, map->agent.port_num)) 742 return 0; 743 744 if (map->agent.qp->qp_type == IB_QPT_SMI) { 745 if (!READ_ONCE(map->agent.smp_allowed)) 746 return -EACCES; 747 return 0; 748 } 749 750 return ib_security_pkey_access(map->agent.device, 751 map->agent.port_num, 752 pkey_index, 753 map->agent.security); 754 } 755