--- /dev/null
+From 4f2c7583e33eb08dc09dd2e25574b80175ba7d93 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Tue, 6 Mar 2018 15:51:32 +0000
+Subject: irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit 4f2c7583e33eb08dc09dd2e25574b80175ba7d93 upstream.
+
+When struct its_device instances are created, the nr_ites member
+will be set to a power of 2 that equals or exceeds the requested
+number of MSIs passed to the msi_prepare() callback. At the same
+time, the LPI map is allocated to be some multiple of 32 in size,
+where the allocated size may be less than the requested size
+depending on whether a contiguous range of sufficient size is
+available in the global LPI bitmap.
+
+This may result in the situation where the nr_ites < nr_lpis, and
+since nr_ites is what we program into the hardware when we map the
+device, the additional LPIs will be non-functional.
+
+For bog standard hardware, this does not really matter. However,
+in cases where ITS device IDs are shared between different PCIe
+devices, we may end up allocating these additional LPIs without
+taking into account that they don't actually work.
+
+So let's make nr_ites at least 32. This ensures that all allocated
+LPIs are 'live', and that its_alloc_device_irq() will fail when
+attempts are made to allocate MSIs beyond what was allocated in
+the first place.
+
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+[maz: updated comment]
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+[ardb: trivial tweak of unrelated context]
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-gic-v3-its.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -684,7 +684,7 @@ static struct irq_chip its_irq_chip = {
+ * This gives us (((1UL << id_bits) - 8192) >> 5) possible allocations.
+ */
+ #define IRQS_PER_CHUNK_SHIFT 5
+-#define IRQS_PER_CHUNK (1 << IRQS_PER_CHUNK_SHIFT)
++#define IRQS_PER_CHUNK (1UL << IRQS_PER_CHUNK_SHIFT)
+
+ static unsigned long *lpi_bitmap;
+ static u32 lpi_chunks;
+@@ -1320,11 +1320,10 @@ static struct its_device *its_create_dev
+
+ dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+ /*
+- * At least one bit of EventID is being used, hence a minimum
+- * of two entries. No, the architecture doesn't let you
+- * express an ITT with a single entry.
++ * We allocate at least one chunk worth of LPIs bet device,
++ * and thus that many ITEs. The device may require less though.
+ */
+- nr_ites = max(2UL, roundup_pow_of_two(nvecs));
++ nr_ites = max(IRQS_PER_CHUNK, roundup_pow_of_two(nvecs));
+ sz = nr_ites * its->ite_size;
+ sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
+ itt = kzalloc(sz, GFP_KERNEL);
--- /dev/null
+From 68c59fcea1f2c6a54c62aa896cc623c1b5bc9b47 Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Fri, 7 Jul 2017 10:56:38 +0200
+Subject: scsi: sg: fix SG_DXFER_FROM_DEV transfers
+
+From: Johannes Thumshirn <jthumshirn@suse.de>
+
+commit 68c59fcea1f2c6a54c62aa896cc623c1b5bc9b47 upstream.
+
+SG_DXFER_FROM_DEV transfers do not necessarily have a dxferp as we set
+it to NULL for the old sg_io read/write interface, but must have a
+length bigger than 0. This fixes a regression introduced by commit
+28676d869bbb ("scsi: sg: check for valid direction before starting the
+request")
+
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Fixes: 28676d869bbb ("scsi: sg: check for valid direction before starting the request")
+Reported-by: Chris Clayton <chris2553@googlemail.com>
+Tested-by: Chris Clayton <chris2553@googlemail.com>
+Cc: Douglas Gilbert <dgilbert@interlog.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Tested-by: Chris Clayton <chris2553@googlemail.com>
+Acked-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Cc: Cristian Crinteanu <crinteanu.cristian@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sg.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -758,8 +758,11 @@ static bool sg_is_valid_dxfer(sg_io_hdr_
+ if (hp->dxferp || hp->dxfer_len > 0)
+ return false;
+ return true;
+- case SG_DXFER_TO_DEV:
+ case SG_DXFER_FROM_DEV:
++ if (hp->dxfer_len < 0)
++ return false;
++ return true;
++ case SG_DXFER_TO_DEV:
+ case SG_DXFER_TO_FROM_DEV:
+ if (!hp->dxferp || hp->dxfer_len == 0)
+ return false;
--- /dev/null
+From 14074aba4bcda3764c9a702b276308b89901d5b6 Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Mon, 17 Jul 2017 15:11:42 +0200
+Subject: scsi: sg: fix static checker warning in sg_is_valid_dxfer
+
+From: Johannes Thumshirn <jthumshirn@suse.de>
+
+commit 14074aba4bcda3764c9a702b276308b89901d5b6 upstream.
+
+dxfer_len is an unsigned int and we always assign a value > 0 to it, so
+it doesn't make any sense to check if it is < 0. We can't really check
+dxferp as well as we have both NULL and not NULL cases in the possible
+call paths.
+
+So just return true for SG_DXFER_FROM_DEV transfer in
+sg_is_valid_dxfer().
+
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sg.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -759,8 +759,11 @@ static bool sg_is_valid_dxfer(sg_io_hdr_
+ return false;
+ return true;
+ case SG_DXFER_FROM_DEV:
+- if (hp->dxfer_len < 0)
+- return false;
++ /*
++ * for SG_DXFER_FROM_DEV we always set dxfer_len to > 0. dxferp
++ * can either be NULL or != NULL so there's no point in checking
++ * it either. So just return true.
++ */
+ return true;
+ case SG_DXFER_TO_DEV:
+ case SG_DXFER_TO_FROM_DEV:
--- /dev/null
+From f930c7043663188429cd9b254e9d761edfc101ce Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Thu, 27 Jul 2017 09:11:26 +0200
+Subject: scsi: sg: only check for dxfer_len greater than 256M
+
+From: Johannes Thumshirn <jthumshirn@suse.de>
+
+commit f930c7043663188429cd9b254e9d761edfc101ce upstream.
+
+Don't make any assumptions on the sg_io_hdr_t::dxfer_direction or the
+sg_io_hdr_t::dxferp in order to determine if it is a valid request. The
+only way we can check for bad requests is by checking if the length
+exceeds 256M.
+
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Fixes: 28676d869bbb (scsi: sg: check for valid direction before starting the request)
+Reported-by: Jason L Tibbitts III <tibbs@math.uh.edu>
+Tested-by: Jason L Tibbitts III <tibbs@math.uh.edu>
+Suggested-by: Doug Gilbert <dgilbert@interlog.com>
+Cc: Doug Gilbert <dgilbert@interlog.com>
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sg.c | 31 +------------------------------
+ 1 file changed, 1 insertion(+), 30 deletions(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -751,35 +751,6 @@ sg_new_write(Sg_fd *sfp, struct file *fi
+ return count;
+ }
+
+-static bool sg_is_valid_dxfer(sg_io_hdr_t *hp)
+-{
+- switch (hp->dxfer_direction) {
+- case SG_DXFER_NONE:
+- if (hp->dxferp || hp->dxfer_len > 0)
+- return false;
+- return true;
+- case SG_DXFER_FROM_DEV:
+- /*
+- * for SG_DXFER_FROM_DEV we always set dxfer_len to > 0. dxferp
+- * can either be NULL or != NULL so there's no point in checking
+- * it either. So just return true.
+- */
+- return true;
+- case SG_DXFER_TO_DEV:
+- case SG_DXFER_TO_FROM_DEV:
+- if (!hp->dxferp || hp->dxfer_len == 0)
+- return false;
+- return true;
+- case SG_DXFER_UNKNOWN:
+- if ((!hp->dxferp && hp->dxfer_len) ||
+- (hp->dxferp && hp->dxfer_len == 0))
+- return false;
+- return true;
+- default:
+- return false;
+- }
+-}
+-
+ static int
+ sg_common_write(Sg_fd * sfp, Sg_request * srp,
+ unsigned char *cmnd, int timeout, int blocking)
+@@ -800,7 +771,7 @@ sg_common_write(Sg_fd * sfp, Sg_request
+ "sg_common_write: scsi opcode=0x%02x, cmd_size=%d\n",
+ (int) cmnd[0], (int) hp->cmd_len));
+
+- if (!sg_is_valid_dxfer(hp))
++ if (hp->dxfer_len >= SZ_256M)
+ return -EINVAL;
+
+ k = sg_start_req(srp, cmnd);
lock_parent-needs-to-recheck-if-dentry-got-__dentry_kill-ed-under-it.patch
fs-aio-add-explicit-rcu-grace-period-when-freeing-kioctx.patch
fs-aio-use-rcu-accessors-for-kioctx_table-table.patch
+irqchip-gic-v3-its-ensure-nr_ites-nr_lpis.patch
+scsi-sg-fix-sg_dxfer_from_dev-transfers.patch
+scsi-sg-fix-static-checker-warning-in-sg_is_valid_dxfer.patch
+scsi-sg-only-check-for-dxfer_len-greater-than-256m.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
