From: Greg Kroah-Hartman Date: Wed, 26 Sep 2018 20:21:35 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.18.11~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=442bce2c416f67591b89898bf9c8fd10c8603239;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: iw_cxgb4-only-allow-1-flush-on-user-qps.patch --- diff --git a/queue-4.14/iw_cxgb4-only-allow-1-flush-on-user-qps.patch b/queue-4.14/iw_cxgb4-only-allow-1-flush-on-user-qps.patch new file mode 100644 index 00000000000..c6c8e425a72 --- /dev/null +++ b/queue-4.14/iw_cxgb4-only-allow-1-flush-on-user-qps.patch @@ -0,0 +1,57 @@ +From 308aa2b8f7b7db3332a7d41099fd37851fb793b2 Mon Sep 17 00:00:00 2001 +From: Steve Wise +Date: Fri, 31 Aug 2018 07:15:56 -0700 +Subject: iw_cxgb4: only allow 1 flush on user qps + +From: Steve Wise + +commit 308aa2b8f7b7db3332a7d41099fd37851fb793b2 upstream. + +Once the qp has been flushed, it cannot be flushed again. The user qp +flush logic wasn't enforcing it however. The bug can cause +touch-after-free crashes like: + +Unable to handle kernel paging request for data at address 0x000001ec +Faulting instruction address: 0xc008000016069100 +Oops: Kernel access of bad area, sig: 11 [#1] +... +NIP [c008000016069100] flush_qp+0x80/0x480 [iw_cxgb4] +LR [c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4] +Call Trace: +[c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4] +[c00800001606e868] c4iw_ib_modify_qp+0x118/0x200 [iw_cxgb4] +[c0080000119eae80] ib_security_modify_qp+0xd0/0x3d0 [ib_core] +[c0080000119c4e24] ib_modify_qp+0xc4/0x2c0 [ib_core] +[c008000011df0284] iwcm_modify_qp_err+0x44/0x70 [iw_cm] +[c008000011df0fec] destroy_cm_id+0xcc/0x370 [iw_cm] +[c008000011ed4358] rdma_destroy_id+0x3c8/0x520 [rdma_cm] +[c0080000134b0540] ucma_close+0x90/0x1b0 [rdma_ucm] +[c000000000444da4] __fput+0xe4/0x2f0 + +So fix flush_qp() to only flush the wq once. + +Cc: stable@vger.kernel.org +Signed-off-by: Steve Wise +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/infiniband/hw/cxgb4/qp.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/infiniband/hw/cxgb4/qp.c ++++ b/drivers/infiniband/hw/cxgb4/qp.c +@@ -1395,6 +1395,12 @@ static void flush_qp(struct c4iw_qp *qhp + schp = to_c4iw_cq(qhp->ibqp.send_cq); + + if (qhp->ibqp.uobject) { ++ ++ /* for user qps, qhp->wq.flushed is protected by qhp->mutex */ ++ if (qhp->wq.flushed) ++ return; ++ ++ qhp->wq.flushed = 1; + t4_set_wq_in_error(&qhp->wq); + t4_set_cq_in_error(&rchp->cq); + spin_lock_irqsave(&rchp->comp_handler_lock, flag); diff --git a/queue-4.14/series b/queue-4.14/series index ba11613d47c..a52b7feb9d8 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -59,4 +59,5 @@ ext4-show-test_dummy_encryption-mount-option-in-proc-mounts.patch sched-fair-fix-vruntime_normalized-for-remote-non-migration-wakeup.patch pci-aardvark-size-bridges-before-resources-allocation.patch vmw_balloon-include-asm-io.h.patch +iw_cxgb4-only-allow-1-flush-on-user-qps.patch crypto-x86-aegis-morus-do-not-require-osxsave-for-sse2.patch