5.10-stable patches

added patches:
	pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch
	rdma-irdma-prevent-zero-length-stag-registration.patch

diff --git a/queue-5.10/pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch b/queue-5.10/pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch
new file mode 100644 (file)
index 0000000..f64747f
--- /dev/null
+++ b/queue-5.10/pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch
@@ -0,0 +1,72 @@
+From nathan@kernel.org  Thu Nov 30 13:23:28 2023
+From: Nathan Chancellor <nathan@kernel.org>
+Date: Tue, 28 Nov 2023 17:35:17 -0700
+Subject: PCI: keystone: Drop __init from ks_pcie_add_pcie_{ep,port}()
+To: gregkh@linuxfoundation.org, sashal@kernel.org
+Cc: u.kleine-koenig@pengutronix.de, bhelgaas@google.com,  llvm@lists.linux.dev, stable@vger.kernel.org,  Naresh Kamboju <naresh.kamboju@linaro.org>,  Nathan Chancellor <nathan@kernel.org>
+Message-ID: <20231128-5-4-fix-pci-keystone-modpost-warning-v1-1-a999b944ac81@kernel.org>
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+This commit has no upstream equivalent.
+
+After commit db5ebaeb8fda ("PCI: keystone: Don't discard .probe()
+callback") in 5.10.202, there are two modpost warnings when building with
+clang:
+
+  WARNING: modpost: vmlinux.o(.text+0x5aa6dc): Section mismatch in reference from the function ks_pcie_probe() to the function .init.text:ks_pcie_add_pcie_port()
+  The function ks_pcie_probe() references
+  the function __init ks_pcie_add_pcie_port().
+  This is often because ks_pcie_probe lacks a __init
+  annotation or the annotation of ks_pcie_add_pcie_port is wrong.
+
+  WARNING: modpost: vmlinux.o(.text+0x5aa6f4): Section mismatch in reference from the function ks_pcie_probe() to the function .init.text:ks_pcie_add_pcie_ep()
+  The function ks_pcie_probe() references
+  the function __init ks_pcie_add_pcie_ep().
+  This is often because ks_pcie_probe lacks a __init
+  annotation or the annotation of ks_pcie_add_pcie_ep is wrong.
+
+ks_pcie_add_pcie_ep() was removed in upstream commit a0fd361db8e5 ("PCI:
+dwc: Move "dbi", "dbi2", and "addr_space" resource setup into common
+code") and ks_pcie_add_pcie_port() was removed in upstream
+commit 60f5b73fa0f2 ("PCI: dwc: Remove unnecessary wrappers around
+dw_pcie_host_init()"), both of which happened before upstream
+commit 7994db905c0f ("PCI: keystone: Don't discard .probe() callback").
+
+As neither of these removal changes are really suitable for stable, just
+remove __init from these functions in stable, as it is no longer a
+correct annotation after dropping __init from ks_pcie_probe().
+
+Fixes: 012dba0ab814 ("PCI: keystone: Don't discard .probe() callback")
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/pci-keystone.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/pci/controller/dwc/pci-keystone.c
++++ b/drivers/pci/controller/dwc/pci-keystone.c
+@@ -865,8 +865,8 @@ static irqreturn_t ks_pcie_err_irq_handl
+       return ks_pcie_handle_error_irq(ks_pcie);
+ }
+ 
+-static int __init ks_pcie_add_pcie_port(struct keystone_pcie *ks_pcie,
+-                                      struct platform_device *pdev)
++static int ks_pcie_add_pcie_port(struct keystone_pcie *ks_pcie,
++                               struct platform_device *pdev)
+ {
+       struct dw_pcie *pci = ks_pcie->pci;
+       struct pcie_port *pp = &pci->pp;
+@@ -978,8 +978,8 @@ static const struct dw_pcie_ep_ops ks_pc
+       .get_features = &ks_pcie_am654_get_features,
+ };
+ 
+-static int __init ks_pcie_add_pcie_ep(struct keystone_pcie *ks_pcie,
+-                                    struct platform_device *pdev)
++static int ks_pcie_add_pcie_ep(struct keystone_pcie *ks_pcie,
++                             struct platform_device *pdev)
+ {
+       int ret;
+       struct dw_pcie_ep *ep;

diff --git a/queue-5.10/rdma-irdma-prevent-zero-length-stag-registration.patch b/queue-5.10/rdma-irdma-prevent-zero-length-stag-registration.patch
new file mode 100644 (file)
index 0000000..6f0898e
--- /dev/null
+++ b/queue-5.10/rdma-irdma-prevent-zero-length-stag-registration.patch
@@ -0,0 +1,117 @@
+From bb6d73d9add68ad270888db327514384dfa44958 Mon Sep 17 00:00:00 2001
+From: Christopher Bednarz <christopher.n.bednarz@intel.com>
+Date: Fri, 18 Aug 2023 09:48:38 -0500
+Subject: RDMA/irdma: Prevent zero-length STAG registration
+
+From: Christopher Bednarz <christopher.n.bednarz@intel.com>
+
+commit bb6d73d9add68ad270888db327514384dfa44958 upstream.
+
+Currently irdma allows zero-length STAGs to be programmed in HW during
+the kernel mode fast register flow. Zero-length MR or STAG registration
+disable HW memory length checks.
+
+Improve gaps in bounds checking in irdma by preventing zero-length STAG or
+MR registrations except if the IB_PD_UNSAFE_GLOBAL_RKEY is set.
+
+This addresses the disclosure CVE-2023-25775.
+
+Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
+Signed-off-by: Christopher Bednarz <christopher.n.bednarz@intel.com>
+Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
+Link: https://lore.kernel.org/r/20230818144838.1758-1-shiraz.saleem@intel.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/i40iw/i40iw_ctrl.c  |    6 ++++++
+ drivers/infiniband/hw/i40iw/i40iw_type.h  |    2 ++
+ drivers/infiniband/hw/i40iw/i40iw_verbs.c |   10 ++++++++--
+ 3 files changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+@@ -3033,6 +3033,9 @@ static enum i40iw_status_code i40iw_sc_a
+       u64 header;
+       enum i40iw_page_size page_size;
+ 
++      if (!info->total_len && !info->all_memory)
++              return -EINVAL;
++
+       page_size = (info->page_size == 0x200000) ? I40IW_PAGE_SIZE_2M : I40IW_PAGE_SIZE_4K;
+       cqp = dev->cqp;
+       wqe = i40iw_sc_cqp_get_next_send_wqe(cqp, scratch);
+@@ -3091,6 +3094,9 @@ static enum i40iw_status_code i40iw_sc_m
+       u8 addr_type;
+       enum i40iw_page_size page_size;
+ 
++      if (!info->total_len && !info->all_memory)
++              return -EINVAL;
++
+       page_size = (info->page_size == 0x200000) ? I40IW_PAGE_SIZE_2M : I40IW_PAGE_SIZE_4K;
+       if (info->access_rights & (I40IW_ACCESS_FLAGS_REMOTEREAD_ONLY |
+                                  I40IW_ACCESS_FLAGS_REMOTEWRITE_ONLY))
+--- a/drivers/infiniband/hw/i40iw/i40iw_type.h
++++ b/drivers/infiniband/hw/i40iw/i40iw_type.h
+@@ -786,6 +786,7 @@ struct i40iw_allocate_stag_info {
+       bool use_hmc_fcn_index;
+       u8 hmc_fcn_index;
+       bool use_pf_rid;
++      bool all_memory;
+ };
+ 
+ struct i40iw_reg_ns_stag_info {
+@@ -804,6 +805,7 @@ struct i40iw_reg_ns_stag_info {
+       bool use_hmc_fcn_index;
+       u8 hmc_fcn_index;
+       bool use_pf_rid;
++      bool all_memory;
+ };
+ 
+ struct i40iw_fast_reg_stag_info {
+--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+@@ -1494,7 +1494,8 @@ static int i40iw_handle_q_mem(struct i40
+ static int i40iw_hw_alloc_stag(struct i40iw_device *iwdev, struct i40iw_mr *iwmr)
+ {
+       struct i40iw_allocate_stag_info *info;
+-      struct i40iw_pd *iwpd = to_iwpd(iwmr->ibmr.pd);
++      struct ib_pd *pd = iwmr->ibmr.pd;
++      struct i40iw_pd *iwpd = to_iwpd(pd);
+       enum i40iw_status_code status;
+       int err = 0;
+       struct i40iw_cqp_request *cqp_request;
+@@ -1511,6 +1512,7 @@ static int i40iw_hw_alloc_stag(struct i4
+       info->stag_idx = iwmr->stag >> I40IW_CQPSQ_STAG_IDX_SHIFT;
+       info->pd_id = iwpd->sc_pd.pd_id;
+       info->total_len = iwmr->length;
++      info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY;
+       info->remote_access = true;
+       cqp_info->cqp_cmd = OP_ALLOC_STAG;
+       cqp_info->post_sq = 1;
+@@ -1563,6 +1565,8 @@ static struct ib_mr *i40iw_alloc_mr(stru
+       iwmr->type = IW_MEMREG_TYPE_MEM;
+       palloc = &iwpbl->pble_alloc;
+       iwmr->page_cnt = max_num_sg;
++      /* Use system PAGE_SIZE as the sg page sizes are unknown at this point */
++      iwmr->length = max_num_sg * PAGE_SIZE;
+       mutex_lock(&iwdev->pbl_mutex);
+       status = i40iw_get_pble(&iwdev->sc_dev, iwdev->pble_rsrc, palloc, iwmr->page_cnt);
+       mutex_unlock(&iwdev->pbl_mutex);
+@@ -1659,7 +1663,8 @@ static int i40iw_hwreg_mr(struct i40iw_d
+ {
+       struct i40iw_pbl *iwpbl = &iwmr->iwpbl;
+       struct i40iw_reg_ns_stag_info *stag_info;
+-      struct i40iw_pd *iwpd = to_iwpd(iwmr->ibmr.pd);
++      struct ib_pd *pd = iwmr->ibmr.pd;
++      struct i40iw_pd *iwpd = to_iwpd(pd);
+       struct i40iw_pble_alloc *palloc = &iwpbl->pble_alloc;
+       enum i40iw_status_code status;
+       int err = 0;
+@@ -1679,6 +1684,7 @@ static int i40iw_hwreg_mr(struct i40iw_d
+       stag_info->total_len = iwmr->length;
+       stag_info->access_rights = access;
+       stag_info->pd_id = iwpd->sc_pd.pd_id;
++      stag_info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY;
+       stag_info->addr_type = I40IW_ADDR_TYPE_VA_BASED;
+       stag_info->page_size = iwmr->page_size;
+ 

diff --git a/queue-5.10/series b/queue-5.10/series
index 14bc5447fc419bc392d336aefc8782425bcc64fd..d2a6891daf973ad530fcd951a7efceaadc19cb14 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -1,3 +1,5 @@
+rdma-irdma-prevent-zero-length-stag-registration.patch
+pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch
 net-r8169-disable-multicast-filter-for-rtl8168h-and-.patch
 drm-amdgpu-fix-a-null-pointer-access-when-the-smc_rr.patch
 i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch