4.9-stable patches

added patches:
	rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch
	revert-net-sit-fix-memory-leak-in-sit_init_net.patch

diff --git a/queue-4.9/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch b/queue-4.9/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch
new file mode 100644 (file)
index 0000000..333b5c0
--- /dev/null
+++ b/queue-4.9/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch
@@ -0,0 +1,104 @@
+From 3840c5b78803b2b6cc1ff820100a74a092c40cbb Mon Sep 17 00:00:00 2001
+From: Greg KH <gregkh@linuxfoundation.org>
+Date: Tue, 1 Oct 2019 18:56:11 +0200
+Subject: RDMA/cxgb4: Do not dma memory off of the stack
+
+From: Greg KH <gregkh@linuxfoundation.org>
+
+commit 3840c5b78803b2b6cc1ff820100a74a092c40cbb upstream.
+
+Nicolas pointed out that the cxgb4 driver is doing dma off of the stack,
+which is generally considered a very bad thing.  On some architectures it
+could be a security problem, but odds are none of them actually run this
+driver, so it's just a "normal" bug.
+
+Resolve this by allocating the memory for a message off of the heap
+instead of the stack.  kmalloc() always will give us a proper memory
+location that DMA will work correctly from.
+
+Link: https://lore.kernel.org/r/20191001165611.GA3542072@kroah.com
+Reported-by: Nicolas Waisman <nico@semmle.com>
+Tested-by: Potnuri Bharat Teja <bharat@chelsio.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/cxgb4/mem.c |   28 +++++++++++++++++-----------
+ 1 file changed, 17 insertions(+), 11 deletions(-)
+
+--- a/drivers/infiniband/hw/cxgb4/mem.c
++++ b/drivers/infiniband/hw/cxgb4/mem.c
+@@ -264,13 +264,17 @@ static int write_tpt_entry(struct c4iw_r
+                          struct sk_buff *skb)
+ {
+       int err;
+-      struct fw_ri_tpte tpt;
++      struct fw_ri_tpte *tpt;
+       u32 stag_idx;
+       static atomic_t key;
+ 
+       if (c4iw_fatal_error(rdev))
+               return -EIO;
+ 
++      tpt = kmalloc(sizeof(*tpt), GFP_KERNEL);
++      if (!tpt)
++              return -ENOMEM;
++
+       stag_state = stag_state > 0;
+       stag_idx = (*stag) >> 8;
+ 
+@@ -280,6 +284,7 @@ static int write_tpt_entry(struct c4iw_r
+                       mutex_lock(&rdev->stats.lock);
+                       rdev->stats.stag.fail++;
+                       mutex_unlock(&rdev->stats.lock);
++                      kfree(tpt);
+                       return -ENOMEM;
+               }
+               mutex_lock(&rdev->stats.lock);
+@@ -294,28 +299,28 @@ static int write_tpt_entry(struct c4iw_r
+ 
+       /* write TPT entry */
+       if (reset_tpt_entry)
+-              memset(&tpt, 0, sizeof(tpt));
++              memset(tpt, 0, sizeof(*tpt));
+       else {
+-              tpt.valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
++              tpt->valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
+                       FW_RI_TPTE_STAGKEY_V((*stag & FW_RI_TPTE_STAGKEY_M)) |
+                       FW_RI_TPTE_STAGSTATE_V(stag_state) |
+                       FW_RI_TPTE_STAGTYPE_V(type) | FW_RI_TPTE_PDID_V(pdid));
+-              tpt.locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
++              tpt->locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
+                       (bind_enabled ? FW_RI_TPTE_MWBINDEN_F : 0) |
+                       FW_RI_TPTE_ADDRTYPE_V((zbva ? FW_RI_ZERO_BASED_TO :
+                                                     FW_RI_VA_BASED_TO))|
+                       FW_RI_TPTE_PS_V(page_size));
+-              tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
++              tpt->nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
+                       FW_RI_TPTE_PBLADDR_V(PBL_OFF(rdev, pbl_addr)>>3));
+-              tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
+-              tpt.va_hi = cpu_to_be32((u32)(to >> 32));
+-              tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
+-              tpt.dca_mwbcnt_pstag = cpu_to_be32(0);
+-              tpt.len_hi = cpu_to_be32((u32)(len >> 32));
++              tpt->len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
++              tpt->va_hi = cpu_to_be32((u32)(to >> 32));
++              tpt->va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
++              tpt->dca_mwbcnt_pstag = cpu_to_be32(0);
++              tpt->len_hi = cpu_to_be32((u32)(len >> 32));
+       }
+       err = write_adapter_mem(rdev, stag_idx +
+                               (rdev->lldi.vr->stag.start >> 5),
+-                              sizeof(tpt), &tpt, skb);
++                              sizeof(*tpt), tpt, skb);
+ 
+       if (reset_tpt_entry) {
+               c4iw_put_resource(&rdev->resource.tpt_table, stag_idx);
+@@ -323,6 +328,7 @@ static int write_tpt_entry(struct c4iw_r
+               rdev->stats.stag.cur -= 32;
+               mutex_unlock(&rdev->stats.lock);
+       }
++      kfree(tpt);
+       return err;
+ }
+ 

diff --git a/queue-4.9/revert-net-sit-fix-memory-leak-in-sit_init_net.patch b/queue-4.9/revert-net-sit-fix-memory-leak-in-sit_init_net.patch
new file mode 100644 (file)
index 0000000..162e73f
--- /dev/null
+++ b/queue-4.9/revert-net-sit-fix-memory-leak-in-sit_init_net.patch
@@ -0,0 +1,36 @@
+From akaher@vmware.com  Sun Oct 27 21:04:24 2019
+From: Ajay Kaher <akaher@vmware.com>
+Date: Wed, 16 Oct 2019 14:33:54 +0530
+Subject: Revert "net: sit: fix memory leak in sit_init_net()"
+To: <gregkh@linuxfoundation.org>
+Cc: <davem@davemloft.net>, <kuznet@ms2.inr.ac.ru>, <jmorris@namei.org>, <yoshfuji@linux-ipv6.org>, <kaber@trash.net>, <netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>, <stable@vger.kernel.org>, <srivatsab@vmware.com>, <srivatsa@csail.mit.edu>, <amakhalov@vmware.com>, <srinidhir@vmware.com>, <bvikas@vmware.com>, <anishs@vmware.com>, <vsirnapalli@vmware.com>, <srostedt@vmware.com>, <akaher@vmware.com>, Mao Wenan <maowenan@huawei.com>
+Message-ID: <1571216634-44834-1-git-send-email-akaher@vmware.com>
+
+From: Ajay Kaher <akaher@vmware.com>
+
+This reverts commit 375d6d454a95ebacb9c6eb0b715da05a4458ffef which is
+commit 07f12b26e21ab359261bf75cfcb424fdc7daeb6d upstream.
+
+Unnecessarily calling free_netdev() from sit_init_net().
+ipip6_dev_free() of 4.9.y called free_netdev(), so no need
+to call again after ipip6_dev_free().
+
+Cc: Mao Wenan <maowenan@huawei.com>
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Ajay Kaher <akaher@vmware.com>
+Reviewed-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/sit.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1856,7 +1856,6 @@ static int __net_init sit_init_net(struc
+ 
+ err_reg_dev:
+       ipip6_dev_free(sitn->fb_tunnel_dev);
+-      free_netdev(sitn->fb_tunnel_dev);
+ err_alloc_dev:
+       return err;
+ }

diff --git a/queue-4.9/series b/queue-4.9/series
index 0c4e0516001eac6cdee0ee1224af1644291d3b4f..f6ddbe03e9fe19e1bd7d804f0a9506bdb4d52947 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -45,3 +45,5 @@ memstick-jmb38x_ms-fix-an-error-handling-path-in-jmb38x_ms_probe.patch
 cpufreq-avoid-cpufreq_suspend-deadlock-on-system-shutdown.patch
 xen-netback-fix-error-path-of-xenvif_connect_data.patch
 pci-pm-fix-pci_power_up.patch
+revert-net-sit-fix-memory-leak-in-sit_init_net.patch
+rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch