From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 27 Sep 2018 08:56:48 +0000 (+0200)
Subject: 4.9-stable patches
X-Git-Tag: v4.18.11~5
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2b833c3b96dab2cc4ad26ea855bca11f1d916a38;p=thirdparty%2Fkernel%2Fstable-queue.git

4.9-stable patches

added patches:
	iw_cxgb4-only-allow-1-flush-on-user-qps.patch
---

diff --git a/queue-4.9/iw_cxgb4-only-allow-1-flush-on-user-qps.patch b/queue-4.9/iw_cxgb4-only-allow-1-flush-on-user-qps.patch
new file mode 100644
index 00000000000..6cf21e5607c
--- /dev/null
+++ b/queue-4.9/iw_cxgb4-only-allow-1-flush-on-user-qps.patch
@@ -0,0 +1,57 @@
+From 308aa2b8f7b7db3332a7d41099fd37851fb793b2 Mon Sep 17 00:00:00 2001
+From: Steve Wise <swise@opengridcomputing.com>
+Date: Fri, 31 Aug 2018 07:15:56 -0700
+Subject: iw_cxgb4: only allow 1 flush on user qps
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+commit 308aa2b8f7b7db3332a7d41099fd37851fb793b2 upstream.
+
+Once the qp has been flushed, it cannot be flushed again.  The user qp
+flush logic wasn't enforcing it however.  The bug can cause
+touch-after-free crashes like:
+
+Unable to handle kernel paging request for data at address 0x000001ec
+Faulting instruction address: 0xc008000016069100
+Oops: Kernel access of bad area, sig: 11 [#1]
+...
+NIP [c008000016069100] flush_qp+0x80/0x480 [iw_cxgb4]
+LR [c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
+Call Trace:
+[c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
+[c00800001606e868] c4iw_ib_modify_qp+0x118/0x200 [iw_cxgb4]
+[c0080000119eae80] ib_security_modify_qp+0xd0/0x3d0 [ib_core]
+[c0080000119c4e24] ib_modify_qp+0xc4/0x2c0 [ib_core]
+[c008000011df0284] iwcm_modify_qp_err+0x44/0x70 [iw_cm]
+[c008000011df0fec] destroy_cm_id+0xcc/0x370 [iw_cm]
+[c008000011ed4358] rdma_destroy_id+0x3c8/0x520 [rdma_cm]
+[c0080000134b0540] ucma_close+0x90/0x1b0 [rdma_ucm]
+[c000000000444da4] __fput+0xe4/0x2f0
+
+So fix flush_qp() to only flush the wq once.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/infiniband/hw/cxgb4/qp.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -1258,6 +1258,12 @@ static void flush_qp(struct c4iw_qp *qhp
+ 
+ 	t4_set_wq_in_error(&qhp->wq);
+ 	if (qhp->ibqp.uobject) {
++
++		/* for user qps, qhp->wq.flushed is protected by qhp->mutex */
++		if (qhp->wq.flushed)
++			return;
++
++		qhp->wq.flushed = 1;
+ 		t4_set_cq_in_error(&rchp->cq);
+ 		spin_lock_irqsave(&rchp->comp_handler_lock, flag);
+ 		(*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context);
diff --git a/queue-4.9/series b/queue-4.9/series
index f59b9bfde50..3b337f3b66a 100644
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -41,3 +41,4 @@ hid-sony-update-device-ids.patch
 hid-sony-support-ds4-dongle.patch
 pci-aardvark-size-bridges-before-resources-allocation.patch
 vmw_balloon-include-asm-io.h.patch
+iw_cxgb4-only-allow-1-flush-on-user-qps.patch