4.19-stable patches

added patches:
	cacheinfo-keep-the-old-value-if-of_property_read_u32-fails.patch
	ib-hfi1-add-limit-test-for-rc-uc-send-via-loopback.patch

diff --git a/queue-4.19/cacheinfo-keep-the-old-value-if-of_property_read_u32-fails.patch b/queue-4.19/cacheinfo-keep-the-old-value-if-of_property_read_u32-fails.patch
new file mode 100644 (file)
index 0000000..d059394
--- /dev/null
+++ b/queue-4.19/cacheinfo-keep-the-old-value-if-of_property_read_u32-fails.patch
@@ -0,0 +1,47 @@
+From 3a34c986324c07dde32903f7bb262e6138e77c2a Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhc@lemote.com>
+Date: Wed, 19 Dec 2018 16:16:03 +0800
+Subject: cacheinfo: Keep the old value if of_property_read_u32 fails
+
+From: Huacai Chen <chenhc@lemote.com>
+
+commit 3a34c986324c07dde32903f7bb262e6138e77c2a upstream.
+
+Commit 448a5a552f336bd7b847b1951 ("drivers: base: cacheinfo: use OF
+property_read_u32 instead of get_property,read_number") makes cache
+size and number_of_sets be 0 if DT doesn't provide there values. I
+think this is unreasonable so make them keep the old values, which is
+the same as old kernels.
+
+Fixes: 448a5a552f33 ("drivers: base: cacheinfo: use OF property_read_u32 instead of get_property,read_number")
+Cc: stable@vger.kernel.org
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/cacheinfo.c |    6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/base/cacheinfo.c
++++ b/drivers/base/cacheinfo.c
+@@ -79,8 +79,7 @@ static void cache_size(struct cacheinfo
+       ct_idx = get_cacheinfo_idx(this_leaf->type);
+       propname = cache_type_info[ct_idx].size_prop;
+ 
+-      if (of_property_read_u32(np, propname, &this_leaf->size))
+-              this_leaf->size = 0;
++      of_property_read_u32(np, propname, &this_leaf->size);
+ }
+ 
+ /* not cache_line_size() because that's a macro in include/linux/cache.h */
+@@ -114,8 +113,7 @@ static void cache_nr_sets(struct cachein
+       ct_idx = get_cacheinfo_idx(this_leaf->type);
+       propname = cache_type_info[ct_idx].nr_sets_prop;
+ 
+-      if (of_property_read_u32(np, propname, &this_leaf->number_of_sets))
+-              this_leaf->number_of_sets = 0;
++      of_property_read_u32(np, propname, &this_leaf->number_of_sets);
+ }
+ 
+ static void cache_associativity(struct cacheinfo *this_leaf)

diff --git a/queue-4.19/ib-hfi1-add-limit-test-for-rc-uc-send-via-loopback.patch b/queue-4.19/ib-hfi1-add-limit-test-for-rc-uc-send-via-loopback.patch
new file mode 100644 (file)
index 0000000..aa31344
--- /dev/null
+++ b/queue-4.19/ib-hfi1-add-limit-test-for-rc-uc-send-via-loopback.patch
@@ -0,0 +1,79 @@
+From 09ce351dff8e7636af0beb72cd4a86c3904a0500 Mon Sep 17 00:00:00 2001
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Thu, 17 Jan 2019 12:42:16 -0800
+Subject: IB/hfi1: Add limit test for RC/UC send via loopback
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+commit 09ce351dff8e7636af0beb72cd4a86c3904a0500 upstream.
+
+Fix potential memory corruption and panic in loopback for IB_WR_SEND
+variants.
+
+The code blindly assumes the posted length will fit in the fetched rwqe,
+which is not a valid assumption.
+
+Fix by adding a limit test, and triggering the appropriate send completion
+and putting the QP in an error state.  This mimics the handling for
+non-loopback QPs.
+
+Fixes: 15703461533a ("IB/{hfi1, qib, rdmavt}: Move ruc_loopback to rdmavt")
+Cc: <stable@vger.kernel.org> #v4.20+
+Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+---
+ drivers/infiniband/hw/hfi1/ruc.c    |    7 ++++++-
+ drivers/infiniband/hw/qib/qib_ruc.c |    7 ++++++-
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/hfi1/ruc.c
++++ b/drivers/infiniband/hw/hfi1/ruc.c
+@@ -278,6 +278,8 @@ send:
+                       goto op_err;
+               if (!ret)
+                       goto rnr_nak;
++              if (wqe->length > qp->r_len)
++                      goto inv_err;
+               break;
+ 
+       case IB_WR_RDMA_WRITE_WITH_IMM:
+@@ -445,7 +447,10 @@ op_err:
+       goto err;
+ 
+ inv_err:
+-      send_status = IB_WC_REM_INV_REQ_ERR;
++      send_status =
++              sqp->ibqp.qp_type == IB_QPT_RC ?
++                      IB_WC_REM_INV_REQ_ERR :
++                      IB_WC_SUCCESS;
+       wc.status = IB_WC_LOC_QP_OP_ERR;
+       goto err;
+ 
+--- a/drivers/infiniband/hw/qib/qib_ruc.c
++++ b/drivers/infiniband/hw/qib/qib_ruc.c
+@@ -274,6 +274,8 @@ again:
+                       goto op_err;
+               if (!ret)
+                       goto rnr_nak;
++              if (wqe->length > qp->r_len)
++                      goto inv_err;
+               break;
+ 
+       case IB_WR_RDMA_WRITE_WITH_IMM:
+@@ -434,7 +436,10 @@ op_err:
+       goto err;
+ 
+ inv_err:
+-      send_status = IB_WC_REM_INV_REQ_ERR;
++      send_status =
++              sqp->ibqp.qp_type == IB_QPT_RC ?
++                      IB_WC_REM_INV_REQ_ERR :
++                      IB_WC_SUCCESS;
+       wc.status = IB_WC_LOC_QP_OP_ERR;
+       goto err;
+ 

diff --git a/queue-4.19/series b/queue-4.19/series
index 8859c7f84bb2fbe547e6d18346ec1377d662c4e3..d2c85caa9e4ce5b0c3f28fa5a81d863282fdbe28 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -308,3 +308,5 @@ perf-tests-evsel-tp-sched-fix-bitwise-operator.patch
 serial-fix-race-between-flush_to_ldisc-and-tty_open.patch
 serial-8250_pci-make-pci-class-test-non-fatal.patch
 serial-sh-sci-do-not-free-irqs-that-have-already-been-freed.patch
+cacheinfo-keep-the-old-value-if-of_property_read_u32-fails.patch
+ib-hfi1-add-limit-test-for-rc-uc-send-via-loopback.patch