4.9-stable patches

added patches:
	ib-hfi1-fix-incorrect-mixing-of-err_ptr-and-null-return-values.patch

diff --git a/queue-4.9/ib-hfi1-fix-incorrect-mixing-of-err_ptr-and-null-return-values.patch b/queue-4.9/ib-hfi1-fix-incorrect-mixing-of-err_ptr-and-null-return-values.patch
new file mode 100644 (file)
index 0000000..b956bfd
--- /dev/null
+++ b/queue-4.9/ib-hfi1-fix-incorrect-mixing-of-err_ptr-and-null-return-values.patch
@@ -0,0 +1,119 @@
+From b697d7d8c741f27b728a878fc55852b06d0f6f5e Mon Sep 17 00:00:00 2001
+From: "Michael J. Ruhl" <michael.j.ruhl@intel.com>
+Date: Wed, 20 Jun 2018 09:29:08 -0700
+Subject: IB/hfi1: Fix incorrect mixing of ERR_PTR and NULL return values
+
+From: Michael J. Ruhl <michael.j.ruhl@intel.com>
+
+commit b697d7d8c741f27b728a878fc55852b06d0f6f5e upstream.
+
+The __get_txreq() function can return a pointer, ERR_PTR(-EBUSY), or NULL.
+All of the relevant call sites look for IS_ERR, so the NULL return would
+lead to a NULL pointer exception.
+
+Do not use the ERR_PTR mechanism for this function.
+
+Update all call sites to handle the return value correctly.
+
+Clean up error paths to reflect return value.
+
+Fixes: 45842abbb292 ("staging/rdma/hfi1: move txreq header code")
+Cc: <stable@vger.kernel.org> # 4.9.x+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Reviewed-by: Kamenee Arumugam <kamenee.arumugam@intel.com>
+Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/hfi1/rc.c          |    2 +-
+ drivers/infiniband/hw/hfi1/uc.c          |    4 ++--
+ drivers/infiniband/hw/hfi1/ud.c          |    4 ++--
+ drivers/infiniband/hw/hfi1/verbs_txreq.c |    4 ++--
+ drivers/infiniband/hw/hfi1/verbs_txreq.h |    4 ++--
+ 5 files changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/infiniband/hw/hfi1/rc.c
++++ b/drivers/infiniband/hw/hfi1/rc.c
+@@ -397,7 +397,7 @@ int hfi1_make_rc_req(struct rvt_qp *qp,
+ 
+       lockdep_assert_held(&qp->s_lock);
+       ps->s_txreq = get_txreq(ps->dev, qp);
+-      if (IS_ERR(ps->s_txreq))
++      if (!ps->s_txreq)
+               goto bail_no_tx;
+ 
+       ohdr = &ps->s_txreq->phdr.hdr.u.oth;
+--- a/drivers/infiniband/hw/hfi1/uc.c
++++ b/drivers/infiniband/hw/hfi1/uc.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright(c) 2015, 2016 Intel Corporation.
++ * Copyright(c) 2015 - 2018 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+  * redistributing this file, you may do so under either license.
+@@ -72,7 +72,7 @@ int hfi1_make_uc_req(struct rvt_qp *qp,
+       int middle = 0;
+ 
+       ps->s_txreq = get_txreq(ps->dev, qp);
+-      if (IS_ERR(ps->s_txreq))
++      if (!ps->s_txreq)
+               goto bail_no_tx;
+ 
+       if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_SEND_OK)) {
+--- a/drivers/infiniband/hw/hfi1/ud.c
++++ b/drivers/infiniband/hw/hfi1/ud.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright(c) 2015, 2016 Intel Corporation.
++ * Copyright(c) 2015 - 2018 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+  * redistributing this file, you may do so under either license.
+@@ -285,7 +285,7 @@ int hfi1_make_ud_req(struct rvt_qp *qp,
+       u8 sc5;
+ 
+       ps->s_txreq = get_txreq(ps->dev, qp);
+-      if (IS_ERR(ps->s_txreq))
++      if (!ps->s_txreq)
+               goto bail_no_tx;
+ 
+       if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_NEXT_SEND_OK)) {
+--- a/drivers/infiniband/hw/hfi1/verbs_txreq.c
++++ b/drivers/infiniband/hw/hfi1/verbs_txreq.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright(c) 2016 Intel Corporation.
++ * Copyright(c) 2016 - 2018 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+  * redistributing this file, you may do so under either license.
+@@ -94,7 +94,7 @@ struct verbs_txreq *__get_txreq(struct h
+                               struct rvt_qp *qp)
+       __must_hold(&qp->s_lock)
+ {
+-      struct verbs_txreq *tx = ERR_PTR(-EBUSY);
++      struct verbs_txreq *tx = NULL;
+ 
+       write_seqlock(&dev->iowait_lock);
+       if (ib_rvt_state_ops[qp->state] & RVT_PROCESS_RECV_OK) {
+--- a/drivers/infiniband/hw/hfi1/verbs_txreq.h
++++ b/drivers/infiniband/hw/hfi1/verbs_txreq.h
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright(c) 2016 Intel Corporation.
++ * Copyright(c) 2016 - 2018 Intel Corporation.
+  *
+  * This file is provided under a dual BSD/GPLv2 license.  When using or
+  * redistributing this file, you may do so under either license.
+@@ -82,7 +82,7 @@ static inline struct verbs_txreq *get_tx
+       if (unlikely(!tx)) {
+               /* call slow path to get the lock */
+               tx = __get_txreq(dev, qp);
+-              if (IS_ERR(tx))
++              if (!tx)
+                       return tx;
+       }
+       tx->qp = qp;

diff --git a/queue-4.9/series b/queue-4.9/series
index 53b1054f4e20318c61e1bdbefbde78f777fa573c..e009b9088c3c40352c1a69333d1d772531576084 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -13,3 +13,4 @@ btrfs-fix-file-data-corruption-after-cloning-a-range-and-fsync.patch
 tcp-add-tcp_ooo_try_coalesce-helper.patch
 kmemleak-clear-stale-pointers-from-task-stacks.patch
 fork-unconditionally-clear-stack-on-fork.patch
+ib-hfi1-fix-incorrect-mixing-of-err_ptr-and-null-return-values.patch