From: Greg Kroah-Hartman Date: Sun, 27 Oct 2019 20:13:11 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.198~5 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=662739562411bd636ed372e5d20f54ba1ee76dcf;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch revert-net-sit-fix-memory-leak-in-sit_init_net.patch --- diff --git a/queue-4.9/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch b/queue-4.9/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch new file mode 100644 index 00000000000..333b5c0b3f5 --- /dev/null +++ b/queue-4.9/rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch @@ -0,0 +1,104 @@ +From 3840c5b78803b2b6cc1ff820100a74a092c40cbb Mon Sep 17 00:00:00 2001 +From: Greg KH +Date: Tue, 1 Oct 2019 18:56:11 +0200 +Subject: RDMA/cxgb4: Do not dma memory off of the stack + +From: Greg KH + +commit 3840c5b78803b2b6cc1ff820100a74a092c40cbb upstream. + +Nicolas pointed out that the cxgb4 driver is doing dma off of the stack, +which is generally considered a very bad thing. On some architectures it +could be a security problem, but odds are none of them actually run this +driver, so it's just a "normal" bug. + +Resolve this by allocating the memory for a message off of the heap +instead of the stack. kmalloc() always will give us a proper memory +location that DMA will work correctly from. + +Link: https://lore.kernel.org/r/20191001165611.GA3542072@kroah.com +Reported-by: Nicolas Waisman +Tested-by: Potnuri Bharat Teja +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/cxgb4/mem.c | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +--- a/drivers/infiniband/hw/cxgb4/mem.c ++++ b/drivers/infiniband/hw/cxgb4/mem.c +@@ -264,13 +264,17 @@ static int write_tpt_entry(struct c4iw_r + struct sk_buff *skb) + { + int err; +- struct fw_ri_tpte tpt; ++ struct fw_ri_tpte *tpt; + u32 stag_idx; + static atomic_t key; + + if (c4iw_fatal_error(rdev)) + return -EIO; + ++ tpt = kmalloc(sizeof(*tpt), GFP_KERNEL); ++ if (!tpt) ++ return -ENOMEM; ++ + stag_state = stag_state > 0; + stag_idx = (*stag) >> 8; + +@@ -280,6 +284,7 @@ static int write_tpt_entry(struct c4iw_r + mutex_lock(&rdev->stats.lock); + rdev->stats.stag.fail++; + mutex_unlock(&rdev->stats.lock); ++ kfree(tpt); + return -ENOMEM; + } + mutex_lock(&rdev->stats.lock); +@@ -294,28 +299,28 @@ static int write_tpt_entry(struct c4iw_r + + /* write TPT entry */ + if (reset_tpt_entry) +- memset(&tpt, 0, sizeof(tpt)); ++ memset(tpt, 0, sizeof(*tpt)); + else { +- tpt.valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F | ++ tpt->valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F | + FW_RI_TPTE_STAGKEY_V((*stag & FW_RI_TPTE_STAGKEY_M)) | + FW_RI_TPTE_STAGSTATE_V(stag_state) | + FW_RI_TPTE_STAGTYPE_V(type) | FW_RI_TPTE_PDID_V(pdid)); +- tpt.locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) | ++ tpt->locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) | + (bind_enabled ? FW_RI_TPTE_MWBINDEN_F : 0) | + FW_RI_TPTE_ADDRTYPE_V((zbva ? FW_RI_ZERO_BASED_TO : + FW_RI_VA_BASED_TO))| + FW_RI_TPTE_PS_V(page_size)); +- tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32( ++ tpt->nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32( + FW_RI_TPTE_PBLADDR_V(PBL_OFF(rdev, pbl_addr)>>3)); +- tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL)); +- tpt.va_hi = cpu_to_be32((u32)(to >> 32)); +- tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL)); +- tpt.dca_mwbcnt_pstag = cpu_to_be32(0); +- tpt.len_hi = cpu_to_be32((u32)(len >> 32)); ++ tpt->len_lo = cpu_to_be32((u32)(len & 0xffffffffUL)); ++ tpt->va_hi = cpu_to_be32((u32)(to >> 32)); ++ tpt->va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL)); ++ tpt->dca_mwbcnt_pstag = cpu_to_be32(0); ++ tpt->len_hi = cpu_to_be32((u32)(len >> 32)); + } + err = write_adapter_mem(rdev, stag_idx + + (rdev->lldi.vr->stag.start >> 5), +- sizeof(tpt), &tpt, skb); ++ sizeof(*tpt), tpt, skb); + + if (reset_tpt_entry) { + c4iw_put_resource(&rdev->resource.tpt_table, stag_idx); +@@ -323,6 +328,7 @@ static int write_tpt_entry(struct c4iw_r + rdev->stats.stag.cur -= 32; + mutex_unlock(&rdev->stats.lock); + } ++ kfree(tpt); + return err; + } + diff --git a/queue-4.9/revert-net-sit-fix-memory-leak-in-sit_init_net.patch b/queue-4.9/revert-net-sit-fix-memory-leak-in-sit_init_net.patch new file mode 100644 index 00000000000..162e73f84da --- /dev/null +++ b/queue-4.9/revert-net-sit-fix-memory-leak-in-sit_init_net.patch @@ -0,0 +1,36 @@ +From akaher@vmware.com Sun Oct 27 21:04:24 2019 +From: Ajay Kaher +Date: Wed, 16 Oct 2019 14:33:54 +0530 +Subject: Revert "net: sit: fix memory leak in sit_init_net()" +To: +Cc: , , , , , , , , , , , , , , , , , Mao Wenan +Message-ID: <1571216634-44834-1-git-send-email-akaher@vmware.com> + +From: Ajay Kaher + +This reverts commit 375d6d454a95ebacb9c6eb0b715da05a4458ffef which is +commit 07f12b26e21ab359261bf75cfcb424fdc7daeb6d upstream. + +Unnecessarily calling free_netdev() from sit_init_net(). +ipip6_dev_free() of 4.9.y called free_netdev(), so no need +to call again after ipip6_dev_free(). + +Cc: Mao Wenan +Cc: David S. Miller +Signed-off-by: Ajay Kaher +Reviewed-by: Mao Wenan +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/sit.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1856,7 +1856,6 @@ static int __net_init sit_init_net(struc + + err_reg_dev: + ipip6_dev_free(sitn->fb_tunnel_dev); +- free_netdev(sitn->fb_tunnel_dev); + err_alloc_dev: + return err; + } diff --git a/queue-4.9/series b/queue-4.9/series index 0c4e0516001..f6ddbe03e9f 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -45,3 +45,5 @@ memstick-jmb38x_ms-fix-an-error-handling-path-in-jmb38x_ms_probe.patch cpufreq-avoid-cpufreq_suspend-deadlock-on-system-shutdown.patch xen-netback-fix-error-path-of-xenvif_connect_data.patch pci-pm-fix-pci_power_up.patch +revert-net-sit-fix-memory-leak-in-sit_init_net.patch +rdma-cxgb4-do-not-dma-memory-off-of-the-stack.patch