From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 26 Sep 2018 20:21:55 +0000 (+0200)
Subject: 4.18-stable patches
X-Git-Tag: v4.18.11~9
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fbc23a8e0b9fbcf90813938f9275433499a86107;p=thirdparty%2Fkernel%2Fstable-queue.git

4.18-stable patches

added patches:
	iw_cxgb4-only-allow-1-flush-on-user-qps.patch
---

diff --git a/queue-4.18/iw_cxgb4-only-allow-1-flush-on-user-qps.patch b/queue-4.18/iw_cxgb4-only-allow-1-flush-on-user-qps.patch
new file mode 100644
index 00000000000..cc98d1961db
--- /dev/null
+++ b/queue-4.18/iw_cxgb4-only-allow-1-flush-on-user-qps.patch
@@ -0,0 +1,57 @@
+From 308aa2b8f7b7db3332a7d41099fd37851fb793b2 Mon Sep 17 00:00:00 2001
+From: Steve Wise <swise@opengridcomputing.com>
+Date: Fri, 31 Aug 2018 07:15:56 -0700
+Subject: iw_cxgb4: only allow 1 flush on user qps
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+commit 308aa2b8f7b7db3332a7d41099fd37851fb793b2 upstream.
+
+Once the qp has been flushed, it cannot be flushed again.  The user qp
+flush logic wasn't enforcing it however.  The bug can cause
+touch-after-free crashes like:
+
+Unable to handle kernel paging request for data at address 0x000001ec
+Faulting instruction address: 0xc008000016069100
+Oops: Kernel access of bad area, sig: 11 [#1]
+...
+NIP [c008000016069100] flush_qp+0x80/0x480 [iw_cxgb4]
+LR [c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
+Call Trace:
+[c00800001606cd6c] c4iw_modify_qp+0x71c/0x11d0 [iw_cxgb4]
+[c00800001606e868] c4iw_ib_modify_qp+0x118/0x200 [iw_cxgb4]
+[c0080000119eae80] ib_security_modify_qp+0xd0/0x3d0 [ib_core]
+[c0080000119c4e24] ib_modify_qp+0xc4/0x2c0 [ib_core]
+[c008000011df0284] iwcm_modify_qp_err+0x44/0x70 [iw_cm]
+[c008000011df0fec] destroy_cm_id+0xcc/0x370 [iw_cm]
+[c008000011ed4358] rdma_destroy_id+0x3c8/0x520 [rdma_cm]
+[c0080000134b0540] ucma_close+0x90/0x1b0 [rdma_ucm]
+[c000000000444da4] __fput+0xe4/0x2f0
+
+So fix flush_qp() to only flush the wq once.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/infiniband/hw/cxgb4/qp.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -1388,6 +1388,12 @@ static void flush_qp(struct c4iw_qp *qhp
+ 	schp = to_c4iw_cq(qhp->ibqp.send_cq);
+ 
+ 	if (qhp->ibqp.uobject) {
++
++		/* for user qps, qhp->wq.flushed is protected by qhp->mutex */
++		if (qhp->wq.flushed)
++			return;
++
++		qhp->wq.flushed = 1;
+ 		t4_set_wq_in_error(&qhp->wq);
+ 		t4_set_cq_in_error(&rchp->cq);
+ 		spin_lock_irqsave(&rchp->comp_handler_lock, flag);
diff --git a/queue-4.18/series b/queue-4.18/series
index 357aa8b0a4e..299e57e3e0f 100644
--- a/queue-4.18/series
+++ b/queue-4.18/series
@@ -85,3 +85,4 @@ ext4-dax-add-ext4_bmap-to-ext4_dax_aops.patch
 ext4-dax-set-ext4_dax_aops-for-dax-files.patch
 sched-fair-fix-vruntime_normalized-for-remote-non-migration-wakeup.patch
 vmw_balloon-include-asm-io.h.patch
+iw_cxgb4-only-allow-1-flush-on-user-qps.patch