From: Greg Kroah-Hartman Date: Mon, 11 Feb 2019 13:44:24 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.9.156~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1121e4096071a54aecb5ee310d9d92e216947874;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: cacheinfo-keep-the-old-value-if-of_property_read_u32-fails.patch ib-hfi1-add-limit-test-for-rc-uc-send-via-loopback.patch --- diff --git a/queue-4.19/cacheinfo-keep-the-old-value-if-of_property_read_u32-fails.patch b/queue-4.19/cacheinfo-keep-the-old-value-if-of_property_read_u32-fails.patch new file mode 100644 index 00000000000..d0593943e4b --- /dev/null +++ b/queue-4.19/cacheinfo-keep-the-old-value-if-of_property_read_u32-fails.patch @@ -0,0 +1,47 @@ +From 3a34c986324c07dde32903f7bb262e6138e77c2a Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Wed, 19 Dec 2018 16:16:03 +0800 +Subject: cacheinfo: Keep the old value if of_property_read_u32 fails + +From: Huacai Chen + +commit 3a34c986324c07dde32903f7bb262e6138e77c2a upstream. + +Commit 448a5a552f336bd7b847b1951 ("drivers: base: cacheinfo: use OF +property_read_u32 instead of get_property,read_number") makes cache +size and number_of_sets be 0 if DT doesn't provide there values. I +think this is unreasonable so make them keep the old values, which is +the same as old kernels. + +Fixes: 448a5a552f33 ("drivers: base: cacheinfo: use OF property_read_u32 instead of get_property,read_number") +Cc: stable@vger.kernel.org +Signed-off-by: Huacai Chen +Reviewed-by: Sudeep Holla +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/cacheinfo.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/base/cacheinfo.c ++++ b/drivers/base/cacheinfo.c +@@ -79,8 +79,7 @@ static void cache_size(struct cacheinfo + ct_idx = get_cacheinfo_idx(this_leaf->type); + propname = cache_type_info[ct_idx].size_prop; + +- if (of_property_read_u32(np, propname, &this_leaf->size)) +- this_leaf->size = 0; ++ of_property_read_u32(np, propname, &this_leaf->size); + } + + /* not cache_line_size() because that's a macro in include/linux/cache.h */ +@@ -114,8 +113,7 @@ static void cache_nr_sets(struct cachein + ct_idx = get_cacheinfo_idx(this_leaf->type); + propname = cache_type_info[ct_idx].nr_sets_prop; + +- if (of_property_read_u32(np, propname, &this_leaf->number_of_sets)) +- this_leaf->number_of_sets = 0; ++ of_property_read_u32(np, propname, &this_leaf->number_of_sets); + } + + static void cache_associativity(struct cacheinfo *this_leaf) diff --git a/queue-4.19/ib-hfi1-add-limit-test-for-rc-uc-send-via-loopback.patch b/queue-4.19/ib-hfi1-add-limit-test-for-rc-uc-send-via-loopback.patch new file mode 100644 index 00000000000..aa3134497f1 --- /dev/null +++ b/queue-4.19/ib-hfi1-add-limit-test-for-rc-uc-send-via-loopback.patch @@ -0,0 +1,79 @@ +From 09ce351dff8e7636af0beb72cd4a86c3904a0500 Mon Sep 17 00:00:00 2001 +From: Mike Marciniszyn +Date: Thu, 17 Jan 2019 12:42:16 -0800 +Subject: IB/hfi1: Add limit test for RC/UC send via loopback + +From: Mike Marciniszyn + +commit 09ce351dff8e7636af0beb72cd4a86c3904a0500 upstream. + +Fix potential memory corruption and panic in loopback for IB_WR_SEND +variants. + +The code blindly assumes the posted length will fit in the fetched rwqe, +which is not a valid assumption. + +Fix by adding a limit test, and triggering the appropriate send completion +and putting the QP in an error state. This mimics the handling for +non-loopback QPs. + +Fixes: 15703461533a ("IB/{hfi1, qib, rdmavt}: Move ruc_loopback to rdmavt") +Cc: #v4.20+ +Reviewed-by: Michael J. Ruhl +Signed-off-by: Mike Marciniszyn +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Mike Marciniszyn + +--- + drivers/infiniband/hw/hfi1/ruc.c | 7 ++++++- + drivers/infiniband/hw/qib/qib_ruc.c | 7 ++++++- + 2 files changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/hfi1/ruc.c ++++ b/drivers/infiniband/hw/hfi1/ruc.c +@@ -278,6 +278,8 @@ send: + goto op_err; + if (!ret) + goto rnr_nak; ++ if (wqe->length > qp->r_len) ++ goto inv_err; + break; + + case IB_WR_RDMA_WRITE_WITH_IMM: +@@ -445,7 +447,10 @@ op_err: + goto err; + + inv_err: +- send_status = IB_WC_REM_INV_REQ_ERR; ++ send_status = ++ sqp->ibqp.qp_type == IB_QPT_RC ? ++ IB_WC_REM_INV_REQ_ERR : ++ IB_WC_SUCCESS; + wc.status = IB_WC_LOC_QP_OP_ERR; + goto err; + +--- a/drivers/infiniband/hw/qib/qib_ruc.c ++++ b/drivers/infiniband/hw/qib/qib_ruc.c +@@ -274,6 +274,8 @@ again: + goto op_err; + if (!ret) + goto rnr_nak; ++ if (wqe->length > qp->r_len) ++ goto inv_err; + break; + + case IB_WR_RDMA_WRITE_WITH_IMM: +@@ -434,7 +436,10 @@ op_err: + goto err; + + inv_err: +- send_status = IB_WC_REM_INV_REQ_ERR; ++ send_status = ++ sqp->ibqp.qp_type == IB_QPT_RC ? ++ IB_WC_REM_INV_REQ_ERR : ++ IB_WC_SUCCESS; + wc.status = IB_WC_LOC_QP_OP_ERR; + goto err; + diff --git a/queue-4.19/series b/queue-4.19/series index 8859c7f84bb..d2c85caa9e4 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -308,3 +308,5 @@ perf-tests-evsel-tp-sched-fix-bitwise-operator.patch serial-fix-race-between-flush_to_ldisc-and-tty_open.patch serial-8250_pci-make-pci-class-test-non-fatal.patch serial-sh-sci-do-not-free-irqs-that-have-already-been-freed.patch +cacheinfo-keep-the-old-value-if-of_property_read_u32-fails.patch +ib-hfi1-add-limit-test-for-rc-uc-send-via-loopback.patch