From: Greg Kroah-Hartman Date: Sun, 27 Oct 2019 20:12:51 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.198~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=23ae7a81d7fe273553341e4fa133ad2a556fe5a2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch --- diff --git a/queue-4.4/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch b/queue-4.4/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch new file mode 100644 index 00000000000..9835ad49311 --- /dev/null +++ b/queue-4.4/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch @@ -0,0 +1,104 @@ +From 3840c5b78803b2b6cc1ff820100a74a092c40cbb Mon Sep 17 00:00:00 2001 +From: Greg KH +Date: Tue, 1 Oct 2019 18:56:11 +0200 +Subject: RDMA/cxgb4: Do not dma memory off of the stack + +From: Greg KH + +commit 3840c5b78803b2b6cc1ff820100a74a092c40cbb upstream. + +Nicolas pointed out that the cxgb4 driver is doing dma off of the stack, +which is generally considered a very bad thing. On some architectures it +could be a security problem, but odds are none of them actually run this +driver, so it's just a "normal" bug. + +Resolve this by allocating the memory for a message off of the heap +instead of the stack. kmalloc() always will give us a proper memory +location that DMA will work correctly from. + +Link: https://lore.kernel.org/r/20191001165611.GA3542072@kroah.com +Reported-by: Nicolas Waisman +Tested-by: Potnuri Bharat Teja +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/cxgb4/mem.c | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +--- a/drivers/infiniband/hw/cxgb4/mem.c ++++ b/drivers/infiniband/hw/cxgb4/mem.c +@@ -254,13 +254,17 @@ static int write_tpt_entry(struct c4iw_r + u64 len, u8 page_size, u32 pbl_size, u32 pbl_addr) + { + int err; +- struct fw_ri_tpte tpt; ++ struct fw_ri_tpte *tpt; + u32 stag_idx; + static atomic_t key; + + if (c4iw_fatal_error(rdev)) + return -EIO; + ++ tpt = kmalloc(sizeof(*tpt), GFP_KERNEL); ++ if (!tpt) ++ return -ENOMEM; ++ + stag_state = stag_state > 0; + stag_idx = (*stag) >> 8; + +@@ -270,6 +274,7 @@ static int write_tpt_entry(struct c4iw_r + mutex_lock(&rdev->stats.lock); + rdev->stats.stag.fail++; + mutex_unlock(&rdev->stats.lock); ++ kfree(tpt); + return -ENOMEM; + } + mutex_lock(&rdev->stats.lock); +@@ -284,28 +289,28 @@ static int write_tpt_entry(struct c4iw_r + + /* write TPT entry */ + if (reset_tpt_entry) +- memset(&tpt, 0, sizeof(tpt)); ++ memset(tpt, 0, sizeof(*tpt)); + else { +- tpt.valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F | ++ tpt->valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F | + FW_RI_TPTE_STAGKEY_V((*stag & FW_RI_TPTE_STAGKEY_M)) | + FW_RI_TPTE_STAGSTATE_V(stag_state) | + FW_RI_TPTE_STAGTYPE_V(type) | FW_RI_TPTE_PDID_V(pdid)); +- tpt.locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) | ++ tpt->locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) | + (bind_enabled ? FW_RI_TPTE_MWBINDEN_F : 0) | + FW_RI_TPTE_ADDRTYPE_V((zbva ? FW_RI_ZERO_BASED_TO : + FW_RI_VA_BASED_TO))| + FW_RI_TPTE_PS_V(page_size)); +- tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32( ++ tpt->nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32( + FW_RI_TPTE_PBLADDR_V(PBL_OFF(rdev, pbl_addr)>>3)); +- tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL)); +- tpt.va_hi = cpu_to_be32((u32)(to >> 32)); +- tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL)); +- tpt.dca_mwbcnt_pstag = cpu_to_be32(0); +- tpt.len_hi = cpu_to_be32((u32)(len >> 32)); ++ tpt->len_lo = cpu_to_be32((u32)(len & 0xffffffffUL)); ++ tpt->va_hi = cpu_to_be32((u32)(to >> 32)); ++ tpt->va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL)); ++ tpt->dca_mwbcnt_pstag = cpu_to_be32(0); ++ tpt->len_hi = cpu_to_be32((u32)(len >> 32)); + } + err = write_adapter_mem(rdev, stag_idx + + (rdev->lldi.vr->stag.start >> 5), +- sizeof(tpt), &tpt); ++ sizeof(*tpt), tpt); + + if (reset_tpt_entry) { + c4iw_put_resource(&rdev->resource.tpt_table, stag_idx); +@@ -313,6 +318,7 @@ static int write_tpt_entry(struct c4iw_r + rdev->stats.stag.cur -= 32; + mutex_unlock(&rdev->stats.lock); + } ++ kfree(tpt); + return err; + } + diff --git a/queue-4.4/series b/queue-4.4/series index 7b3110a0e54..3a6b3509e1f 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -38,3 +38,4 @@ cpufreq-avoid-cpufreq_suspend-deadlock-on-system-shutdown.patch xen-netback-fix-error-path-of-xenvif_connect_data.patch pci-pm-fix-pci_power_up.patch net-sched-fix-memory-exposure-from-short-tca_u32_sel.patch +rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch