From: Greg Kroah-Hartman Date: Tue, 7 Aug 2018 14:30:18 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v4.17.14~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=3f7735fb2c8bfbe383c809bc2ff5628b5917d140;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: ib-hfi1-fix-incorrect-mixing-of-err_ptr-and-null-return-values.patch --- diff --git a/queue-4.9/ib-hfi1-fix-incorrect-mixing-of-err_ptr-and-null-return-values.patch b/queue-4.9/ib-hfi1-fix-incorrect-mixing-of-err_ptr-and-null-return-values.patch new file mode 100644 index 00000000000..b956bfddb96 --- /dev/null +++ b/queue-4.9/ib-hfi1-fix-incorrect-mixing-of-err_ptr-and-null-return-values.patch @@ -0,0 +1,119 @@ +From b697d7d8c741f27b728a878fc55852b06d0f6f5e Mon Sep 17 00:00:00 2001 +From: "Michael J. Ruhl" +Date: Wed, 20 Jun 2018 09:29:08 -0700 +Subject: IB/hfi1: Fix incorrect mixing of ERR_PTR and NULL return values + +From: Michael J. Ruhl + +commit b697d7d8c741f27b728a878fc55852b06d0f6f5e upstream. + +The __get_txreq() function can return a pointer, ERR_PTR(-EBUSY), or NULL. +All of the relevant call sites look for IS_ERR, so the NULL return would +lead to a NULL pointer exception. + +Do not use the ERR_PTR mechanism for this function. + +Update all call sites to handle the return value correctly. + +Clean up error paths to reflect return value. + +Fixes: 45842abbb292 ("staging/rdma/hfi1: move txreq header code") +Cc: # 4.9.x+ +Reported-by: Dan Carpenter +Reviewed-by: Mike Marciniszyn +Reviewed-by: Kamenee Arumugam +Signed-off-by: Michael J. Ruhl +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/hfi1/rc.c | 2 +- + drivers/infiniband/hw/hfi1/uc.c | 4 ++-- + drivers/infiniband/hw/hfi1/ud.c | 4 ++-- + drivers/infiniband/hw/hfi1/verbs_txreq.c | 4 ++-- + drivers/infiniband/hw/hfi1/verbs_txreq.h | 4 ++-- + 5 files changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/infiniband/hw/hfi1/rc.c ++++ b/drivers/infiniband/hw/hfi1/rc.c +@@ -397,7 +397,7 @@ int hfi1_make_rc_req(struct rvt_qp *qp, + + lockdep_assert_held(&qp->s_lock); + ps->s_txreq = get_txreq(ps->dev, qp); +- if (IS_ERR(ps->s_txreq)) ++ if (!ps->s_txreq) + goto bail_no_tx; + + ohdr = &ps->s_txreq->phdr.hdr.u.oth; +--- a/drivers/infiniband/hw/hfi1/uc.c ++++ b/drivers/infiniband/hw/hfi1/uc.c +@@ -1,5 +1,5 @@ + /* +- * Copyright(c) 2015, 2016 Intel Corporation. ++ * Copyright(c) 2015 - 2018 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. +@@ -72,7 +72,7 @@ int hfi1_make_uc_req(struct rvt_qp *qp, + int middle = 0; + + ps->s_txreq = get_txreq(ps->dev, qp); +- if (IS_ERR(ps->s_txreq)) ++ if (!ps->s_txreq) + goto bail_no_tx; + + if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_SEND_OK)) { +--- a/drivers/infiniband/hw/hfi1/ud.c ++++ b/drivers/infiniband/hw/hfi1/ud.c +@@ -1,5 +1,5 @@ + /* +- * Copyright(c) 2015, 2016 Intel Corporation. ++ * Copyright(c) 2015 - 2018 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. +@@ -285,7 +285,7 @@ int hfi1_make_ud_req(struct rvt_qp *qp, + u8 sc5; + + ps->s_txreq = get_txreq(ps->dev, qp); +- if (IS_ERR(ps->s_txreq)) ++ if (!ps->s_txreq) + goto bail_no_tx; + + if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_NEXT_SEND_OK)) { +--- a/drivers/infiniband/hw/hfi1/verbs_txreq.c ++++ b/drivers/infiniband/hw/hfi1/verbs_txreq.c +@@ -1,5 +1,5 @@ + /* +- * Copyright(c) 2016 Intel Corporation. ++ * Copyright(c) 2016 - 2018 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. +@@ -94,7 +94,7 @@ struct verbs_txreq *__get_txreq(struct h + struct rvt_qp *qp) + __must_hold(&qp->s_lock) + { +- struct verbs_txreq *tx = ERR_PTR(-EBUSY); ++ struct verbs_txreq *tx = NULL; + + write_seqlock(&dev->iowait_lock); + if (ib_rvt_state_ops[qp->state] & RVT_PROCESS_RECV_OK) { +--- a/drivers/infiniband/hw/hfi1/verbs_txreq.h ++++ b/drivers/infiniband/hw/hfi1/verbs_txreq.h +@@ -1,5 +1,5 @@ + /* +- * Copyright(c) 2016 Intel Corporation. ++ * Copyright(c) 2016 - 2018 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. +@@ -82,7 +82,7 @@ static inline struct verbs_txreq *get_tx + if (unlikely(!tx)) { + /* call slow path to get the lock */ + tx = __get_txreq(dev, qp); +- if (IS_ERR(tx)) ++ if (!tx) + return tx; + } + tx->qp = qp; diff --git a/queue-4.9/series b/queue-4.9/series index 53b1054f4e2..e009b9088c3 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -13,3 +13,4 @@ btrfs-fix-file-data-corruption-after-cloning-a-range-and-fsync.patch tcp-add-tcp_ooo_try_coalesce-helper.patch kmemleak-clear-stale-pointers-from-task-stacks.patch fork-unconditionally-clear-stack-on-fork.patch +ib-hfi1-fix-incorrect-mixing-of-err_ptr-and-null-return-values.patch