--- /dev/null
+From 1da8347d8505c137fb07ff06bbcd3f2bf37409bc Mon Sep 17 00:00:00 2001
+From: Megha Dey <megha.dey@linux.intel.com>
+Date: Sat, 14 Mar 2020 11:39:59 +0800
+Subject: iommu/vt-d: Populate debugfs if IOMMUs are detected
+
+From: Megha Dey <megha.dey@linux.intel.com>
+
+commit 1da8347d8505c137fb07ff06bbcd3f2bf37409bc upstream.
+
+Currently, the intel iommu debugfs directory(/sys/kernel/debug/iommu/intel)
+gets populated only when DMA remapping is enabled (dmar_disabled = 0)
+irrespective of whether interrupt remapping is enabled or not.
+
+Instead, populate the intel iommu debugfs directory if any IOMMUs are
+detected.
+
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: ee2636b8670b1 ("iommu/vt-d: Enable base Intel IOMMU debugfs support")
+Signed-off-by: Megha Dey <megha.dey@linux.intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel-iommu-debugfs.c | 11 ++++++++++-
+ drivers/iommu/intel-iommu.c | 4 +++-
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/iommu/intel-iommu-debugfs.c
++++ b/drivers/iommu/intel-iommu-debugfs.c
+@@ -271,9 +271,16 @@ static int dmar_translation_struct_show(
+ {
+ struct dmar_drhd_unit *drhd;
+ struct intel_iommu *iommu;
++ u32 sts;
+
+ rcu_read_lock();
+ for_each_active_iommu(iommu, drhd) {
++ sts = dmar_readl(iommu->reg + DMAR_GSTS_REG);
++ if (!(sts & DMA_GSTS_TES)) {
++ seq_printf(m, "DMA Remapping is not enabled on %s\n",
++ iommu->name);
++ continue;
++ }
+ root_tbl_walk(m, iommu);
+ seq_putc(m, '\n');
+ }
+@@ -343,6 +350,7 @@ static int ir_translation_struct_show(st
+ struct dmar_drhd_unit *drhd;
+ struct intel_iommu *iommu;
+ u64 irta;
++ u32 sts;
+
+ rcu_read_lock();
+ for_each_active_iommu(iommu, drhd) {
+@@ -352,7 +360,8 @@ static int ir_translation_struct_show(st
+ seq_printf(m, "Remapped Interrupt supported on IOMMU: %s\n",
+ iommu->name);
+
+- if (iommu->ir_table) {
++ sts = dmar_readl(iommu->reg + DMAR_GSTS_REG);
++ if (iommu->ir_table && (sts & DMA_GSTS_IRES)) {
+ irta = virt_to_phys(iommu->ir_table->base);
+ seq_printf(m, " IR table address:%llx\n", irta);
+ ir_tbl_remap_entry_show(m, iommu);
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -4961,6 +4961,9 @@ int __init intel_iommu_init(void)
+
+ down_write(&dmar_global_lock);
+
++ if (!no_iommu)
++ intel_iommu_debugfs_init();
++
+ if (no_iommu || dmar_disabled) {
+ /*
+ * We exit the function here to ensure IOMMU's remapping and
+@@ -5056,7 +5059,6 @@ int __init intel_iommu_init(void)
+ pr_info("Intel(R) Virtualization Technology for Directed I/O\n");
+
+ intel_iommu_enabled = 1;
+- intel_iommu_debugfs_init();
+
+ return 0;
+
--- /dev/null
+From b6f6118901d1e867ac9177bbff3b00b185bd4fdc Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 25 Feb 2020 11:52:29 -0800
+Subject: ipv6: restrict IPV6_ADDRFORM operation
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit b6f6118901d1e867ac9177bbff3b00b185bd4fdc upstream.
+
+IPV6_ADDRFORM is able to transform IPv6 socket to IPv4 one.
+While this operation sounds illogical, we have to support it.
+
+One of the things it does for TCP socket is to switch sk->sk_prot
+to tcp_prot.
+
+We now have other layers playing with sk->sk_prot, so we should make
+sure to not interfere with them.
+
+This patch makes sure sk_prot is the default pointer for TCP IPv6 socket.
+
+syzbot reported :
+BUG: kernel NULL pointer dereference, address: 0000000000000000
+PGD a0113067 P4D a0113067 PUD a8771067 PMD 0
+Oops: 0010 [#1] PREEMPT SMP KASAN
+CPU: 0 PID: 10686 Comm: syz-executor.0 Not tainted 5.6.0-rc2-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+RIP: 0010:0x0
+Code: Bad RIP value.
+RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246
+RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40
+RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5
+R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098
+R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000
+FS: 00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ inet_release+0x165/0x1c0 net/ipv4/af_inet.c:427
+ __sock_release net/socket.c:605 [inline]
+ sock_close+0xe1/0x260 net/socket.c:1283
+ __fput+0x2e4/0x740 fs/file_table.c:280
+ ____fput+0x15/0x20 fs/file_table.c:313
+ task_work_run+0x176/0x1b0 kernel/task_work.c:113
+ tracehook_notify_resume include/linux/tracehook.h:188 [inline]
+ exit_to_usermode_loop arch/x86/entry/common.c:164 [inline]
+ prepare_exit_to_usermode+0x480/0x5b0 arch/x86/entry/common.c:195
+ syscall_return_slowpath+0x113/0x4a0 arch/x86/entry/common.c:278
+ do_syscall_64+0x11f/0x1c0 arch/x86/entry/common.c:304
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+RIP: 0033:0x45c429
+Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
+RSP: 002b:00007f2ae75dac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
+RAX: 0000000000000000 RBX: 00007f2ae75db6d4 RCX: 000000000045c429
+RDX: 0000000000000001 RSI: 000000000000011a RDI: 0000000000000004
+RBP: 000000000076bf20 R08: 0000000000000038 R09: 0000000000000000
+R10: 0000000020000180 R11: 0000000000000246 R12: 00000000ffffffff
+R13: 0000000000000a9d R14: 00000000004ccfb4 R15: 000000000076bf2c
+Modules linked in:
+CR2: 0000000000000000
+---[ end trace 82567b5207e87bae ]---
+RIP: 0010:0x0
+Code: Bad RIP value.
+RSP: 0018:ffffc9000281fce0 EFLAGS: 00010246
+RAX: 1ffffffff15f48ac RBX: ffffffff8afa4560 RCX: dffffc0000000000
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880a69a8f40
+RBP: ffffc9000281fd10 R08: ffffffff86ed9b0c R09: ffffed1014d351f5
+R10: ffffed1014d351f5 R11: 0000000000000000 R12: ffff8880920d3098
+R13: 1ffff1101241a613 R14: ffff8880a69a8f40 R15: 0000000000000000
+FS: 00007f2ae75db700(0000) GS:ffff8880aea00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffffffffffffffd6 CR3: 00000000a3b85000 CR4: 00000000001406f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot+1938db17e275e85dc328@syzkaller.appspotmail.com
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv6/ipv6_sockglue.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -183,9 +183,15 @@ static int do_ipv6_setsockopt(struct soc
+ retv = -EBUSY;
+ break;
+ }
+- } else if (sk->sk_protocol != IPPROTO_TCP)
++ } else if (sk->sk_protocol == IPPROTO_TCP) {
++ if (sk->sk_prot != &tcpv6_prot) {
++ retv = -EBUSY;
++ break;
++ }
++ break;
++ } else {
+ break;
+-
++ }
+ if (sk->sk_state != TCP_ESTABLISHED) {
+ retv = -ENOTCONN;
+ break;
--- /dev/null
+From ece0d7bd74615773268475b6b64d6f1ebbd4b4c6 Mon Sep 17 00:00:00 2001
+From: Karsten Graul <kgraul@linux.ibm.com>
+Date: Tue, 10 Mar 2020 09:33:30 +0100
+Subject: net/smc: cancel event worker during device removal
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+commit ece0d7bd74615773268475b6b64d6f1ebbd4b4c6 upstream.
+
+During IB device removal, cancel the event worker before the device
+structure is freed.
+
+Fixes: a4cf0443c414 ("smc: introduce SMC as an IB-client")
+Reported-by: syzbot+b297c6825752e7a07272@syzkaller.appspotmail.com
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/smc/smc_ib.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/smc/smc_ib.c
++++ b/net/smc/smc_ib.c
+@@ -568,6 +568,7 @@ static void smc_ib_remove_dev(struct ib_
+ spin_unlock(&smc_ib_devices.lock);
+ smc_ib_cleanup_per_ibdev(smcibdev);
+ ib_unregister_event_handler(&smcibdev->event_handler);
++ cancel_work_sync(&smcibdev->port_event_work);
+ kfree(smcibdev);
+ }
+
--- /dev/null
+From a2f2ef4a54c0d97aa6a8386f4ff23f36ebb488cf Mon Sep 17 00:00:00 2001
+From: Karsten Graul <kgraul@linux.ibm.com>
+Date: Wed, 26 Feb 2020 17:52:46 +0100
+Subject: net/smc: check for valid ib_client_data
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+commit a2f2ef4a54c0d97aa6a8386f4ff23f36ebb488cf upstream.
+
+In smc_ib_remove_dev() check if the provided ib device was actually
+initialized for SMC before.
+
+Reported-by: syzbot+84484ccebdd4e5451d91@syzkaller.appspotmail.com
+Fixes: a4cf0443c414 ("smc: introduce SMC as an IB-client")
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/smc/smc_ib.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/smc/smc_ib.c
++++ b/net/smc/smc_ib.c
+@@ -560,6 +560,8 @@ static void smc_ib_remove_dev(struct ib_
+ struct smc_ib_device *smcibdev;
+
+ smcibdev = ib_get_client_data(ibdev, &smc_ib_client);
++ if (!smcibdev || smcibdev->ibdev != ibdev)
++ return;
+ ib_set_client_data(ibdev, &smc_ib_client, NULL);
+ spin_lock(&smc_ib_devices.lock);
+ list_del_init(&smcibdev->list); /* remove from smc_ib_devices */
iommu-vt-d-ignore-devices-with-out-of-spec-domain-number.patch
i2c-acpi-put-device-when-verifying-client-fails.patch
iommu-amd-fix-iommu-avic-not-properly-update-the-is_run-bit-in-irte.patch
+iommu-vt-d-populate-debugfs-if-iommus-are-detected.patch
+ipv6-restrict-ipv6_addrform-operation.patch
+net-smc-check-for-valid-ib_client_data.patch
+net-smc-cancel-event-worker-during-device-removal.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
