From: Greg Kroah-Hartman Date: Sun, 8 Oct 2023 05:38:47 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v4.14.327~43 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=357acc9652d80661f5d5428fdc38aa5afcb80ac0;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: dm-zoned-free-dmz-ddev-array-in-dmz_put_zoned_devices.patch gpio-aspeed-fix-the-gpio-number-passed-to-pinctrl_gpio_set_config.patch gpio-pxa-disable-pinctrl-calls-for-mmp_gpio.patch ib-mlx4-fix-the-size-of-a-buffer-in-add_port_entries.patch of-dynamic-fix-potential-memory-leak-in-of_changeset_action.patch rdma-cma-fix-truncation-compilation-warning-in-make_cma_ports.patch rdma-cma-initialize-ib_sa_multicast-structure-to-0-when-join.patch rdma-core-require-admin-capabilities-to-set-system-parameters.patch rdma-mlx5-fix-null-string-error.patch rdma-siw-fix-connection-failure-handling.patch rdma-uverbs-fix-typo-of-sizeof-argument.patch --- diff --git a/queue-5.10/dm-zoned-free-dmz-ddev-array-in-dmz_put_zoned_devices.patch b/queue-5.10/dm-zoned-free-dmz-ddev-array-in-dmz_put_zoned_devices.patch new file mode 100644 index 00000000000..3a051fa21d9 --- /dev/null +++ b/queue-5.10/dm-zoned-free-dmz-ddev-array-in-dmz_put_zoned_devices.patch @@ -0,0 +1,72 @@ +From 9850ccd5dd88075b2b7fd28d96299d5535f58cc5 Mon Sep 17 00:00:00 2001 +From: Fedor Pchelkin +Date: Wed, 20 Sep 2023 13:51:16 +0300 +Subject: dm zoned: free dmz->ddev array in dmz_put_zoned_devices + +From: Fedor Pchelkin + +commit 9850ccd5dd88075b2b7fd28d96299d5535f58cc5 upstream. + +Commit 4dba12881f88 ("dm zoned: support arbitrary number of devices") +made the pointers to additional zoned devices to be stored in a +dynamically allocated dmz->ddev array. However, this array is not freed. + +Rename dmz_put_zoned_device to dmz_put_zoned_devices and fix it to +free the dmz->ddev array when cleaning up zoned device information. +Remove NULL assignment for all dmz->ddev elements and just free the +dmz->ddev array instead. + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: 4dba12881f88 ("dm zoned: support arbitrary number of devices") +Cc: stable@vger.kernel.org +Signed-off-by: Fedor Pchelkin +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-zoned-target.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/drivers/md/dm-zoned-target.c ++++ b/drivers/md/dm-zoned-target.c +@@ -750,17 +750,16 @@ err: + /* + * Cleanup zoned device information. + */ +-static void dmz_put_zoned_device(struct dm_target *ti) ++static void dmz_put_zoned_devices(struct dm_target *ti) + { + struct dmz_target *dmz = ti->private; + int i; + +- for (i = 0; i < dmz->nr_ddevs; i++) { +- if (dmz->ddev[i]) { ++ for (i = 0; i < dmz->nr_ddevs; i++) ++ if (dmz->ddev[i]) + dm_put_device(ti, dmz->ddev[i]); +- dmz->ddev[i] = NULL; +- } +- } ++ ++ kfree(dmz->ddev); + } + + static int dmz_fixup_devices(struct dm_target *ti) +@@ -951,7 +950,7 @@ err_bio: + err_meta: + dmz_dtr_metadata(dmz->metadata); + err_dev: +- dmz_put_zoned_device(ti); ++ dmz_put_zoned_devices(ti); + err: + kfree(dmz->dev); + kfree(dmz); +@@ -982,7 +981,7 @@ static void dmz_dtr(struct dm_target *ti + + bioset_exit(&dmz->bio_set); + +- dmz_put_zoned_device(ti); ++ dmz_put_zoned_devices(ti); + + mutex_destroy(&dmz->chunk_lock); + diff --git a/queue-5.10/gpio-aspeed-fix-the-gpio-number-passed-to-pinctrl_gpio_set_config.patch b/queue-5.10/gpio-aspeed-fix-the-gpio-number-passed-to-pinctrl_gpio_set_config.patch new file mode 100644 index 00000000000..50f3da5a1f1 --- /dev/null +++ b/queue-5.10/gpio-aspeed-fix-the-gpio-number-passed-to-pinctrl_gpio_set_config.patch @@ -0,0 +1,33 @@ +From f9315f17bf778cb8079a29639419fcc8a41a3c84 Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Tue, 3 Oct 2023 09:39:26 +0200 +Subject: gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config() + +From: Bartosz Golaszewski + +commit f9315f17bf778cb8079a29639419fcc8a41a3c84 upstream. + +pinctrl_gpio_set_config() expects the GPIO number from the global GPIO +numberspace, not the controller-relative offset, which needs to be added +to the chip base. + +Fixes: 5ae4cb94b313 ("gpio: aspeed: Add debounce support") +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Andy Shevchenko +Reviewed-by: Andrew Jeffery +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-aspeed.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpio/gpio-aspeed.c ++++ b/drivers/gpio/gpio-aspeed.c +@@ -966,7 +966,7 @@ static int aspeed_gpio_set_config(struct + else if (param == PIN_CONFIG_BIAS_DISABLE || + param == PIN_CONFIG_BIAS_PULL_DOWN || + param == PIN_CONFIG_DRIVE_STRENGTH) +- return pinctrl_gpio_set_config(offset, config); ++ return pinctrl_gpio_set_config(chip->base + offset, config); + else if (param == PIN_CONFIG_DRIVE_OPEN_DRAIN || + param == PIN_CONFIG_DRIVE_OPEN_SOURCE) + /* Return -ENOTSUPP to trigger emulation, as per datasheet */ diff --git a/queue-5.10/gpio-pxa-disable-pinctrl-calls-for-mmp_gpio.patch b/queue-5.10/gpio-pxa-disable-pinctrl-calls-for-mmp_gpio.patch new file mode 100644 index 00000000000..17ee775090f --- /dev/null +++ b/queue-5.10/gpio-pxa-disable-pinctrl-calls-for-mmp_gpio.patch @@ -0,0 +1,34 @@ +From f0575116507b981e6a810e78ce3c9040395b958b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Duje=20Mihanovi=C4=87?= +Date: Fri, 29 Sep 2023 17:41:57 +0200 +Subject: gpio: pxa: disable pinctrl calls for MMP_GPIO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Duje Mihanović + +commit f0575116507b981e6a810e78ce3c9040395b958b upstream. + +Similarly to PXA3xx and MMP2, pinctrl-single isn't capable of setting +pin direction on MMP either. + +Fixes: a770d946371e ("gpio: pxa: add pin control gpio direction and request") +Signed-off-by: Duje Mihanović +Reviewed-by: Andy Shevchenko +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-pxa.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpio/gpio-pxa.c ++++ b/drivers/gpio/gpio-pxa.c +@@ -243,6 +243,7 @@ static bool pxa_gpio_has_pinctrl(void) + switch (gpio_type) { + case PXA3XX_GPIO: + case MMP2_GPIO: ++ case MMP_GPIO: + return false; + + default: diff --git a/queue-5.10/ib-mlx4-fix-the-size-of-a-buffer-in-add_port_entries.patch b/queue-5.10/ib-mlx4-fix-the-size-of-a-buffer-in-add_port_entries.patch new file mode 100644 index 00000000000..a75fd0f9313 --- /dev/null +++ b/queue-5.10/ib-mlx4-fix-the-size-of-a-buffer-in-add_port_entries.patch @@ -0,0 +1,51 @@ +From d7f393430a17c2bfcdf805462a5aa80be4285b27 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sat, 23 Sep 2023 07:55:56 +0200 +Subject: IB/mlx4: Fix the size of a buffer in add_port_entries() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christophe JAILLET + +commit d7f393430a17c2bfcdf805462a5aa80be4285b27 upstream. + +In order to be sure that 'buff' is never truncated, its size should be +12, not 11. + +When building with W=1, this fixes the following warnings: + + drivers/infiniband/hw/mlx4/sysfs.c: In function ‘add_port_entries’: + drivers/infiniband/hw/mlx4/sysfs.c:268:34: error: ‘sprintf’ may write a terminating nul past the end of the destination [-Werror=format-overflow=] + 268 | sprintf(buff, "%d", i); + | ^ + drivers/infiniband/hw/mlx4/sysfs.c:268:17: note: ‘sprintf’ output between 2 and 12 bytes into a destination of size 11 + 268 | sprintf(buff, "%d", i); + | ^~~~~~~~~~~~~~~~~~~~~~ + drivers/infiniband/hw/mlx4/sysfs.c:286:34: error: ‘sprintf’ may write a terminating nul past the end of the destination [-Werror=format-overflow=] + 286 | sprintf(buff, "%d", i); + | ^ + drivers/infiniband/hw/mlx4/sysfs.c:286:17: note: ‘sprintf’ output between 2 and 12 bytes into a destination of size 11 + 286 | sprintf(buff, "%d", i); + | ^~~~~~~~~~~~~~~~~~~~~~ + +Fixes: c1e7e466120b ("IB/mlx4: Add iov directory in sysfs under the ib device") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/0bb1443eb47308bc9be30232cc23004c4d4cf43e.1695448530.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx4/sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx4/sysfs.c ++++ b/drivers/infiniband/hw/mlx4/sysfs.c +@@ -221,7 +221,7 @@ void del_sysfs_port_mcg_attr(struct mlx4 + static int add_port_entries(struct mlx4_ib_dev *device, int port_num) + { + int i; +- char buff[11]; ++ char buff[12]; + struct mlx4_ib_iov_port *port = NULL; + int ret = 0 ; + struct ib_port_attr attr; diff --git a/queue-5.10/of-dynamic-fix-potential-memory-leak-in-of_changeset_action.patch b/queue-5.10/of-dynamic-fix-potential-memory-leak-in-of_changeset_action.patch new file mode 100644 index 00000000000..b3108a00fdf --- /dev/null +++ b/queue-5.10/of-dynamic-fix-potential-memory-leak-in-of_changeset_action.patch @@ -0,0 +1,51 @@ +From 55e95bfccf6db8d26a66c46e1de50d53c59a6774 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 8 Sep 2023 10:03:50 +0300 +Subject: of: dynamic: Fix potential memory leak in of_changeset_action() + +From: Dan Carpenter + +commit 55e95bfccf6db8d26a66c46e1de50d53c59a6774 upstream. + +Smatch complains that the error path where "action" is invalid leaks +the "ce" allocation: + drivers/of/dynamic.c:935 of_changeset_action() + warn: possible memory leak of 'ce' + +Fix this by doing the validation before the allocation. + +Note that there is not any actual problem with upstream kernels. All +callers of of_changeset_action() are static inlines with fixed action +values. + +Fixes: 914d9d831e61 ("of: dynamic: Refactor action prints to not use "%pOF" inside devtree_lock") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/r/202309011059.EOdr4im9-lkp@intel.com/ +Signed-off-by: Dan Carpenter +Reviewed-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/7dfaf999-30ad-491c-9615-fb1138db121c@moroto.mountain +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman +--- + drivers/of/dynamic.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/of/dynamic.c ++++ b/drivers/of/dynamic.c +@@ -893,13 +893,13 @@ int of_changeset_action(struct of_change + { + struct of_changeset_entry *ce; + ++ if (WARN_ON(action >= ARRAY_SIZE(action_names))) ++ return -EINVAL; ++ + ce = kzalloc(sizeof(*ce), GFP_KERNEL); + if (!ce) + return -ENOMEM; + +- if (WARN_ON(action >= ARRAY_SIZE(action_names))) +- return -EINVAL; +- + /* get a reference to the node */ + ce->action = action; + ce->np = of_node_get(np); diff --git a/queue-5.10/rdma-cma-fix-truncation-compilation-warning-in-make_cma_ports.patch b/queue-5.10/rdma-cma-fix-truncation-compilation-warning-in-make_cma_ports.patch new file mode 100644 index 00000000000..a0904e96afd --- /dev/null +++ b/queue-5.10/rdma-cma-fix-truncation-compilation-warning-in-make_cma_ports.patch @@ -0,0 +1,44 @@ +From 18126c767658ae8a831257c6cb7776c5ba5e7249 Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Mon, 11 Sep 2023 15:18:06 +0300 +Subject: RDMA/cma: Fix truncation compilation warning in make_cma_ports +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +commit 18126c767658ae8a831257c6cb7776c5ba5e7249 upstream. + +The following compilation error is false alarm as RDMA devices don't +have such large amount of ports to actually cause to format truncation. + +drivers/infiniband/core/cma_configfs.c: In function ‘make_cma_ports’: +drivers/infiniband/core/cma_configfs.c:223:57: error: ‘snprintf’ output may be truncated before the last format character [-Werror=format-truncation=] + 223 | snprintf(port_str, sizeof(port_str), "%u", i + 1); + | ^ +drivers/infiniband/core/cma_configfs.c:223:17: note: ‘snprintf’ output between 2 and 11 bytes into a destination of size 10 + 223 | snprintf(port_str, sizeof(port_str), "%u", i + 1); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +cc1: all warnings being treated as errors +make[5]: *** [scripts/Makefile.build:243: drivers/infiniband/core/cma_configfs.o] Error 1 + +Fixes: 045959db65c6 ("IB/cma: Add configfs for rdma_cm") +Link: https://lore.kernel.org/r/a7e3b347ee134167fa6a3787c56ef231a04bc8c2.1694434639.git.leonro@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/cma_configfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/core/cma_configfs.c ++++ b/drivers/infiniband/core/cma_configfs.c +@@ -221,7 +221,7 @@ static int make_cma_ports(struct cma_dev + } + + for (i = 0; i < ports_num; i++) { +- char port_str[10]; ++ char port_str[11]; + + ports[i].port_num = i + 1; + snprintf(port_str, sizeof(port_str), "%u", i + 1); diff --git a/queue-5.10/rdma-cma-initialize-ib_sa_multicast-structure-to-0-when-join.patch b/queue-5.10/rdma-cma-initialize-ib_sa_multicast-structure-to-0-when-join.patch new file mode 100644 index 00000000000..9686d712509 --- /dev/null +++ b/queue-5.10/rdma-cma-initialize-ib_sa_multicast-structure-to-0-when-join.patch @@ -0,0 +1,38 @@ +From e0fe97efdb00f0f32b038a4836406a82886aec9c Mon Sep 17 00:00:00 2001 +From: Mark Zhang +Date: Wed, 27 Sep 2023 12:05:11 +0300 +Subject: RDMA/cma: Initialize ib_sa_multicast structure to 0 when join + +From: Mark Zhang + +commit e0fe97efdb00f0f32b038a4836406a82886aec9c upstream. + +Initialize the structure to 0 so that it's fields won't have random +values. For example fields like rec.traffic_class (as well as +rec.flow_label and rec.sl) is used to generate the user AH through: + cma_iboe_join_multicast + cma_make_mc_event + ib_init_ah_from_mcmember + +And a random traffic_class causes a random IP DSCP in RoCEv2. + +Fixes: b5de0c60cc30 ("RDMA/cma: Fix use after free race in roce multicast join") +Signed-off-by: Mark Zhang +Link: https://lore.kernel.org/r/20230927090511.603595-1-markzhang@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/cma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -4723,7 +4723,7 @@ static int cma_iboe_join_multicast(struc + int err = 0; + struct sockaddr *addr = (struct sockaddr *)&mc->addr; + struct net_device *ndev = NULL; +- struct ib_sa_multicast ib; ++ struct ib_sa_multicast ib = {}; + enum ib_gid_type gid_type; + bool send_only; + diff --git a/queue-5.10/rdma-core-require-admin-capabilities-to-set-system-parameters.patch b/queue-5.10/rdma-core-require-admin-capabilities-to-set-system-parameters.patch new file mode 100644 index 00000000000..83e6a46f505 --- /dev/null +++ b/queue-5.10/rdma-core-require-admin-capabilities-to-set-system-parameters.patch @@ -0,0 +1,31 @@ +From c38d23a54445f9a8aa6831fafc9af0496ba02f9e Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Wed, 4 Oct 2023 21:17:49 +0300 +Subject: RDMA/core: Require admin capabilities to set system parameters + +From: Leon Romanovsky + +commit c38d23a54445f9a8aa6831fafc9af0496ba02f9e upstream. + +Like any other set command, require admin permissions to do it. + +Cc: stable@vger.kernel.org +Fixes: 2b34c5580226 ("RDMA/core: Add command to set ib_core device net namspace sharing mode") +Link: https://lore.kernel.org/r/75d329fdd7381b52cbdf87910bef16c9965abb1f.1696443438.git.leon@kernel.org +Reviewed-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/nldev.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/core/nldev.c ++++ b/drivers/infiniband/core/nldev.c +@@ -2148,6 +2148,7 @@ static const struct rdma_nl_cbs nldev_cb + }, + [RDMA_NLDEV_CMD_SYS_SET] = { + .doit = nldev_set_sys_set_doit, ++ .flags = RDMA_NL_ADMIN_PERM, + }, + [RDMA_NLDEV_CMD_STAT_SET] = { + .doit = nldev_stat_set_doit, diff --git a/queue-5.10/rdma-mlx5-fix-null-string-error.patch b/queue-5.10/rdma-mlx5-fix-null-string-error.patch new file mode 100644 index 00000000000..d525d0dcd9c --- /dev/null +++ b/queue-5.10/rdma-mlx5-fix-null-string-error.patch @@ -0,0 +1,31 @@ +From dab994bcc609a172bfdab15a0d4cb7e50e8b5458 Mon Sep 17 00:00:00 2001 +From: Shay Drory +Date: Wed, 20 Sep 2023 13:01:56 +0300 +Subject: RDMA/mlx5: Fix NULL string error + +From: Shay Drory + +commit dab994bcc609a172bfdab15a0d4cb7e50e8b5458 upstream. + +checkpath is complaining about NULL string, change it to 'Unknown'. + +Fixes: 37aa5c36aa70 ("IB/mlx5: Add UARs write-combining and non-cached mapping") +Signed-off-by: Shay Drory +Link: https://lore.kernel.org/r/8638e5c14fadbde5fa9961874feae917073af920.1695203958.git.leonro@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx5/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -2069,7 +2069,7 @@ static inline char *mmap_cmd2str(enum ml + case MLX5_IB_MMAP_DEVICE_MEM: + return "Device Memory"; + default: +- return NULL; ++ return "Unknown"; + } + } + diff --git a/queue-5.10/rdma-siw-fix-connection-failure-handling.patch b/queue-5.10/rdma-siw-fix-connection-failure-handling.patch new file mode 100644 index 00000000000..e3f6c706938 --- /dev/null +++ b/queue-5.10/rdma-siw-fix-connection-failure-handling.patch @@ -0,0 +1,71 @@ +From 53a3f777049771496f791504e7dc8ef017cba590 Mon Sep 17 00:00:00 2001 +From: Bernard Metzler +Date: Tue, 5 Sep 2023 16:58:22 +0200 +Subject: RDMA/siw: Fix connection failure handling + +From: Bernard Metzler + +commit 53a3f777049771496f791504e7dc8ef017cba590 upstream. + +In case immediate MPA request processing fails, the newly +created endpoint unlinks the listening endpoint and is +ready to be dropped. This special case was not handled +correctly by the code handling the later TCP socket close, +causing a NULL dereference crash in siw_cm_work_handler() +when dereferencing a NULL listener. We now also cancel +the useless MPA timeout, if immediate MPA request +processing fails. + +This patch furthermore simplifies MPA processing in general: +Scheduling a useless TCP socket read in sk_data_ready() upcall +is now surpressed, if the socket is already moved out of +TCP_ESTABLISHED state. + +Fixes: 6c52fdc244b5 ("rdma/siw: connection management") +Signed-off-by: Bernard Metzler +Link: https://lore.kernel.org/r/20230905145822.446263-1-bmt@zurich.ibm.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/sw/siw/siw_cm.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/drivers/infiniband/sw/siw/siw_cm.c ++++ b/drivers/infiniband/sw/siw/siw_cm.c +@@ -973,6 +973,7 @@ static void siw_accept_newconn(struct si + siw_cep_put(cep); + new_cep->listen_cep = NULL; + if (rv) { ++ siw_cancel_mpatimer(new_cep); + siw_cep_set_free(new_cep); + goto error; + } +@@ -1097,9 +1098,12 @@ static void siw_cm_work_handler(struct w + /* + * Socket close before MPA request received. + */ +- siw_dbg_cep(cep, "no mpareq: drop listener\n"); +- siw_cep_put(cep->listen_cep); +- cep->listen_cep = NULL; ++ if (cep->listen_cep) { ++ siw_dbg_cep(cep, ++ "no mpareq: drop listener\n"); ++ siw_cep_put(cep->listen_cep); ++ cep->listen_cep = NULL; ++ } + } + } + release_cep = 1; +@@ -1222,7 +1226,11 @@ static void siw_cm_llp_data_ready(struct + if (!cep) + goto out; + +- siw_dbg_cep(cep, "state: %d\n", cep->state); ++ siw_dbg_cep(cep, "cep state: %d, socket state %d\n", ++ cep->state, sk->sk_state); ++ ++ if (sk->sk_state != TCP_ESTABLISHED) ++ goto out; + + switch (cep->state) { + case SIW_EPSTATE_RDMA_MODE: diff --git a/queue-5.10/rdma-uverbs-fix-typo-of-sizeof-argument.patch b/queue-5.10/rdma-uverbs-fix-typo-of-sizeof-argument.patch new file mode 100644 index 00000000000..bf4139981a8 --- /dev/null +++ b/queue-5.10/rdma-uverbs-fix-typo-of-sizeof-argument.patch @@ -0,0 +1,35 @@ +From c489800e0d48097fc6afebd862c6afa039110a36 Mon Sep 17 00:00:00 2001 +From: Konstantin Meskhidze +Date: Tue, 5 Sep 2023 18:32:58 +0800 +Subject: RDMA/uverbs: Fix typo of sizeof argument + +From: Konstantin Meskhidze + +commit c489800e0d48097fc6afebd862c6afa039110a36 upstream. + +Since size of 'hdr' pointer and '*hdr' structure is equal on 64-bit +machines issue probably didn't cause any wrong behavior. But anyway, +fixing of typo is required. + +Fixes: da0f60df7bd5 ("RDMA/uverbs: Prohibit write() calls with too small buffers") +Co-developed-by: Ivanov Mikhail +Signed-off-by: Ivanov Mikhail +Signed-off-by: Konstantin Meskhidze +Link: https://lore.kernel.org/r/20230905103258.1738246-1-konstantin.meskhidze@huawei.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/uverbs_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -535,7 +535,7 @@ static ssize_t verify_hdr(struct ib_uver + if (hdr->in_words * 4 != count) + return -EINVAL; + +- if (count < method_elm->req_size + sizeof(hdr)) { ++ if (count < method_elm->req_size + sizeof(*hdr)) { + /* + * rdma-core v18 and v19 have a bug where they send DESTROY_CQ + * with a 16 byte write instead of 24. Old kernels didn't diff --git a/queue-5.10/series b/queue-5.10/series index da4d0332d5a..2e4721737bb 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -211,3 +211,14 @@ tcp-fix-delayed-acks-for-mss-boundary-condition.patch sctp-update-transport-state-when-processing-a-dupcoo.patch sctp-update-hb-timer-immediately-after-users-change-.patch cpupower-add-makefile-dependencies-for-install-targets.patch +dm-zoned-free-dmz-ddev-array-in-dmz_put_zoned_devices.patch +rdma-core-require-admin-capabilities-to-set-system-parameters.patch +of-dynamic-fix-potential-memory-leak-in-of_changeset_action.patch +ib-mlx4-fix-the-size-of-a-buffer-in-add_port_entries.patch +gpio-aspeed-fix-the-gpio-number-passed-to-pinctrl_gpio_set_config.patch +gpio-pxa-disable-pinctrl-calls-for-mmp_gpio.patch +rdma-cma-initialize-ib_sa_multicast-structure-to-0-when-join.patch +rdma-cma-fix-truncation-compilation-warning-in-make_cma_ports.patch +rdma-uverbs-fix-typo-of-sizeof-argument.patch +rdma-siw-fix-connection-failure-handling.patch +rdma-mlx5-fix-null-string-error.patch