4.4-stable patches

added patches:
	rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch

diff --git a/queue-4.4/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch b/queue-4.4/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch
new file mode 100644 (file)
index 0000000..9835ad4
--- /dev/null
+++ b/queue-4.4/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch
@@ -0,0 +1,104 @@
+From 3840c5b78803b2b6cc1ff820100a74a092c40cbb Mon Sep 17 00:00:00 2001
+From: Greg KH <gregkh@linuxfoundation.org>
+Date: Tue, 1 Oct 2019 18:56:11 +0200
+Subject: RDMA/cxgb4: Do not dma memory off of the stack
+
+From: Greg KH <gregkh@linuxfoundation.org>
+
+commit 3840c5b78803b2b6cc1ff820100a74a092c40cbb upstream.
+
+Nicolas pointed out that the cxgb4 driver is doing dma off of the stack,
+which is generally considered a very bad thing.  On some architectures it
+could be a security problem, but odds are none of them actually run this
+driver, so it's just a "normal" bug.
+
+Resolve this by allocating the memory for a message off of the heap
+instead of the stack.  kmalloc() always will give us a proper memory
+location that DMA will work correctly from.
+
+Link: https://lore.kernel.org/r/20191001165611.GA3542072@kroah.com
+Reported-by: Nicolas Waisman <nico@semmle.com>
+Tested-by: Potnuri Bharat Teja <bharat@chelsio.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/cxgb4/mem.c |   28 +++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+--- a/drivers/infiniband/hw/cxgb4/mem.c
++++ b/drivers/infiniband/hw/cxgb4/mem.c
+@@ -254,13 +254,17 @@ static int write_tpt_entry(struct c4iw_r
+                          u64 len, u8 page_size, u32 pbl_size, u32 pbl_addr)
+ {
+       int err;
+-      struct fw_ri_tpte tpt;
++      struct fw_ri_tpte *tpt;
+       u32 stag_idx;
+       static atomic_t key;
+ 
+       if (c4iw_fatal_error(rdev))
+               return -EIO;
+ 
++      tpt = kmalloc(sizeof(*tpt), GFP_KERNEL);
++      if (!tpt)
++              return -ENOMEM;
++
+       stag_state = stag_state > 0;
+       stag_idx = (*stag) >> 8;
+ 
+@@ -270,6 +274,7 @@ static int write_tpt_entry(struct c4iw_r
+                       mutex_lock(&rdev->stats.lock);
+                       rdev->stats.stag.fail++;
+                       mutex_unlock(&rdev->stats.lock);
++                      kfree(tpt);
+                       return -ENOMEM;
+               }
+               mutex_lock(&rdev->stats.lock);
+@@ -284,28 +289,28 @@ static int write_tpt_entry(struct c4iw_r
+ 
+       /* write TPT entry */
+       if (reset_tpt_entry)
+-              memset(&tpt, 0, sizeof(tpt));
++              memset(tpt, 0, sizeof(*tpt));
+       else {
+-              tpt.valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
++              tpt->valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
+                       FW_RI_TPTE_STAGKEY_V((*stag & FW_RI_TPTE_STAGKEY_M)) |
+                       FW_RI_TPTE_STAGSTATE_V(stag_state) |
+                       FW_RI_TPTE_STAGTYPE_V(type) | FW_RI_TPTE_PDID_V(pdid));
+-              tpt.locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
++              tpt->locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
+                       (bind_enabled ? FW_RI_TPTE_MWBINDEN_F : 0) |
+                       FW_RI_TPTE_ADDRTYPE_V((zbva ? FW_RI_ZERO_BASED_TO :
+                                                     FW_RI_VA_BASED_TO))|
+                       FW_RI_TPTE_PS_V(page_size));
+-              tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
++              tpt->nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
+                       FW_RI_TPTE_PBLADDR_V(PBL_OFF(rdev, pbl_addr)>>3));
+-              tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
+-              tpt.va_hi = cpu_to_be32((u32)(to >> 32));
+-              tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
+-              tpt.dca_mwbcnt_pstag = cpu_to_be32(0);
+-              tpt.len_hi = cpu_to_be32((u32)(len >> 32));
++              tpt->len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
++              tpt->va_hi = cpu_to_be32((u32)(to >> 32));
++              tpt->va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
++              tpt->dca_mwbcnt_pstag = cpu_to_be32(0);
++              tpt->len_hi = cpu_to_be32((u32)(len >> 32));
+       }
+       err = write_adapter_mem(rdev, stag_idx +
+                               (rdev->lldi.vr->stag.start >> 5),
+-                              sizeof(tpt), &tpt);
++                              sizeof(*tpt), tpt);
+ 
+       if (reset_tpt_entry) {
+               c4iw_put_resource(&rdev->resource.tpt_table, stag_idx);
+@@ -313,6 +318,7 @@ static int write_tpt_entry(struct c4iw_r
+               rdev->stats.stag.cur -= 32;
+               mutex_unlock(&rdev->stats.lock);
+       }
++      kfree(tpt);
+       return err;
+ }
+ 

diff --git a/queue-4.4/series b/queue-4.4/series
index 7b3110a0e54b773c4178e1776168f66de54c2714..3a6b3509e1febff3a2d8692f277c52c633330162 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -38,3 +38,4 @@ cpufreq-avoid-cpufreq_suspend-deadlock-on-system-shutdown.patch
 xen-netback-fix-error-path-of-xenvif_connect_data.patch
 pci-pm-fix-pci_power_up.patch
 net-sched-fix-memory-exposure-from-short-tca_u32_sel.patch
+rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch