From: Greg Kroah-Hartman Date: Thu, 30 Nov 2023 13:29:07 +0000 (+0000) Subject: 5.10-stable patches X-Git-Tag: v5.15.141~33 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=efc6c26728bacb60d1b40e5910551b902f52c471;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch rdma-irdma-prevent-zero-length-stag-registration.patch --- diff --git a/queue-5.10/pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch b/queue-5.10/pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch new file mode 100644 index 00000000000..f64747f8da4 --- /dev/null +++ b/queue-5.10/pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch @@ -0,0 +1,72 @@ +From nathan@kernel.org Thu Nov 30 13:23:28 2023 +From: Nathan Chancellor +Date: Tue, 28 Nov 2023 17:35:17 -0700 +Subject: PCI: keystone: Drop __init from ks_pcie_add_pcie_{ep,port}() +To: gregkh@linuxfoundation.org, sashal@kernel.org +Cc: u.kleine-koenig@pengutronix.de, bhelgaas@google.com, llvm@lists.linux.dev, stable@vger.kernel.org, Naresh Kamboju , Nathan Chancellor +Message-ID: <20231128-5-4-fix-pci-keystone-modpost-warning-v1-1-a999b944ac81@kernel.org> + +From: Nathan Chancellor + +This commit has no upstream equivalent. + +After commit db5ebaeb8fda ("PCI: keystone: Don't discard .probe() +callback") in 5.10.202, there are two modpost warnings when building with +clang: + + WARNING: modpost: vmlinux.o(.text+0x5aa6dc): Section mismatch in reference from the function ks_pcie_probe() to the function .init.text:ks_pcie_add_pcie_port() + The function ks_pcie_probe() references + the function __init ks_pcie_add_pcie_port(). + This is often because ks_pcie_probe lacks a __init + annotation or the annotation of ks_pcie_add_pcie_port is wrong. + + WARNING: modpost: vmlinux.o(.text+0x5aa6f4): Section mismatch in reference from the function ks_pcie_probe() to the function .init.text:ks_pcie_add_pcie_ep() + The function ks_pcie_probe() references + the function __init ks_pcie_add_pcie_ep(). + This is often because ks_pcie_probe lacks a __init + annotation or the annotation of ks_pcie_add_pcie_ep is wrong. + +ks_pcie_add_pcie_ep() was removed in upstream commit a0fd361db8e5 ("PCI: +dwc: Move "dbi", "dbi2", and "addr_space" resource setup into common +code") and ks_pcie_add_pcie_port() was removed in upstream +commit 60f5b73fa0f2 ("PCI: dwc: Remove unnecessary wrappers around +dw_pcie_host_init()"), both of which happened before upstream +commit 7994db905c0f ("PCI: keystone: Don't discard .probe() callback"). + +As neither of these removal changes are really suitable for stable, just +remove __init from these functions in stable, as it is no longer a +correct annotation after dropping __init from ks_pcie_probe(). + +Fixes: 012dba0ab814 ("PCI: keystone: Don't discard .probe() callback") +Reported-by: Naresh Kamboju +Signed-off-by: Nathan Chancellor +Reviewed-by: Uwe Kleine-König +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/dwc/pci-keystone.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/pci/controller/dwc/pci-keystone.c ++++ b/drivers/pci/controller/dwc/pci-keystone.c +@@ -865,8 +865,8 @@ static irqreturn_t ks_pcie_err_irq_handl + return ks_pcie_handle_error_irq(ks_pcie); + } + +-static int __init ks_pcie_add_pcie_port(struct keystone_pcie *ks_pcie, +- struct platform_device *pdev) ++static int ks_pcie_add_pcie_port(struct keystone_pcie *ks_pcie, ++ struct platform_device *pdev) + { + struct dw_pcie *pci = ks_pcie->pci; + struct pcie_port *pp = &pci->pp; +@@ -978,8 +978,8 @@ static const struct dw_pcie_ep_ops ks_pc + .get_features = &ks_pcie_am654_get_features, + }; + +-static int __init ks_pcie_add_pcie_ep(struct keystone_pcie *ks_pcie, +- struct platform_device *pdev) ++static int ks_pcie_add_pcie_ep(struct keystone_pcie *ks_pcie, ++ struct platform_device *pdev) + { + int ret; + struct dw_pcie_ep *ep; diff --git a/queue-5.10/rdma-irdma-prevent-zero-length-stag-registration.patch b/queue-5.10/rdma-irdma-prevent-zero-length-stag-registration.patch new file mode 100644 index 00000000000..6f0898e3739 --- /dev/null +++ b/queue-5.10/rdma-irdma-prevent-zero-length-stag-registration.patch @@ -0,0 +1,117 @@ +From bb6d73d9add68ad270888db327514384dfa44958 Mon Sep 17 00:00:00 2001 +From: Christopher Bednarz +Date: Fri, 18 Aug 2023 09:48:38 -0500 +Subject: RDMA/irdma: Prevent zero-length STAG registration + +From: Christopher Bednarz + +commit bb6d73d9add68ad270888db327514384dfa44958 upstream. + +Currently irdma allows zero-length STAGs to be programmed in HW during +the kernel mode fast register flow. Zero-length MR or STAG registration +disable HW memory length checks. + +Improve gaps in bounds checking in irdma by preventing zero-length STAG or +MR registrations except if the IB_PD_UNSAFE_GLOBAL_RKEY is set. + +This addresses the disclosure CVE-2023-25775. + +Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") +Signed-off-by: Christopher Bednarz +Signed-off-by: Shiraz Saleem +Link: https://lore.kernel.org/r/20230818144838.1758-1-shiraz.saleem@intel.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 6 ++++++ + drivers/infiniband/hw/i40iw/i40iw_type.h | 2 ++ + drivers/infiniband/hw/i40iw/i40iw_verbs.c | 10 ++++++++-- + 3 files changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +@@ -3033,6 +3033,9 @@ static enum i40iw_status_code i40iw_sc_a + u64 header; + enum i40iw_page_size page_size; + ++ if (!info->total_len && !info->all_memory) ++ return -EINVAL; ++ + page_size = (info->page_size == 0x200000) ? I40IW_PAGE_SIZE_2M : I40IW_PAGE_SIZE_4K; + cqp = dev->cqp; + wqe = i40iw_sc_cqp_get_next_send_wqe(cqp, scratch); +@@ -3091,6 +3094,9 @@ static enum i40iw_status_code i40iw_sc_m + u8 addr_type; + enum i40iw_page_size page_size; + ++ if (!info->total_len && !info->all_memory) ++ return -EINVAL; ++ + page_size = (info->page_size == 0x200000) ? I40IW_PAGE_SIZE_2M : I40IW_PAGE_SIZE_4K; + if (info->access_rights & (I40IW_ACCESS_FLAGS_REMOTEREAD_ONLY | + I40IW_ACCESS_FLAGS_REMOTEWRITE_ONLY)) +--- a/drivers/infiniband/hw/i40iw/i40iw_type.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_type.h +@@ -786,6 +786,7 @@ struct i40iw_allocate_stag_info { + bool use_hmc_fcn_index; + u8 hmc_fcn_index; + bool use_pf_rid; ++ bool all_memory; + }; + + struct i40iw_reg_ns_stag_info { +@@ -804,6 +805,7 @@ struct i40iw_reg_ns_stag_info { + bool use_hmc_fcn_index; + u8 hmc_fcn_index; + bool use_pf_rid; ++ bool all_memory; + }; + + struct i40iw_fast_reg_stag_info { +--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +@@ -1494,7 +1494,8 @@ static int i40iw_handle_q_mem(struct i40 + static int i40iw_hw_alloc_stag(struct i40iw_device *iwdev, struct i40iw_mr *iwmr) + { + struct i40iw_allocate_stag_info *info; +- struct i40iw_pd *iwpd = to_iwpd(iwmr->ibmr.pd); ++ struct ib_pd *pd = iwmr->ibmr.pd; ++ struct i40iw_pd *iwpd = to_iwpd(pd); + enum i40iw_status_code status; + int err = 0; + struct i40iw_cqp_request *cqp_request; +@@ -1511,6 +1512,7 @@ static int i40iw_hw_alloc_stag(struct i4 + info->stag_idx = iwmr->stag >> I40IW_CQPSQ_STAG_IDX_SHIFT; + info->pd_id = iwpd->sc_pd.pd_id; + info->total_len = iwmr->length; ++ info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY; + info->remote_access = true; + cqp_info->cqp_cmd = OP_ALLOC_STAG; + cqp_info->post_sq = 1; +@@ -1563,6 +1565,8 @@ static struct ib_mr *i40iw_alloc_mr(stru + iwmr->type = IW_MEMREG_TYPE_MEM; + palloc = &iwpbl->pble_alloc; + iwmr->page_cnt = max_num_sg; ++ /* Use system PAGE_SIZE as the sg page sizes are unknown at this point */ ++ iwmr->length = max_num_sg * PAGE_SIZE; + mutex_lock(&iwdev->pbl_mutex); + status = i40iw_get_pble(&iwdev->sc_dev, iwdev->pble_rsrc, palloc, iwmr->page_cnt); + mutex_unlock(&iwdev->pbl_mutex); +@@ -1659,7 +1663,8 @@ static int i40iw_hwreg_mr(struct i40iw_d + { + struct i40iw_pbl *iwpbl = &iwmr->iwpbl; + struct i40iw_reg_ns_stag_info *stag_info; +- struct i40iw_pd *iwpd = to_iwpd(iwmr->ibmr.pd); ++ struct ib_pd *pd = iwmr->ibmr.pd; ++ struct i40iw_pd *iwpd = to_iwpd(pd); + struct i40iw_pble_alloc *palloc = &iwpbl->pble_alloc; + enum i40iw_status_code status; + int err = 0; +@@ -1679,6 +1684,7 @@ static int i40iw_hwreg_mr(struct i40iw_d + stag_info->total_len = iwmr->length; + stag_info->access_rights = access; + stag_info->pd_id = iwpd->sc_pd.pd_id; ++ stag_info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY; + stag_info->addr_type = I40IW_ADDR_TYPE_VA_BASED; + stag_info->page_size = iwmr->page_size; + diff --git a/queue-5.10/series b/queue-5.10/series index 14bc5447fc4..d2a6891daf9 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1,3 +1,5 @@ +rdma-irdma-prevent-zero-length-stag-registration.patch +pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch net-r8169-disable-multicast-filter-for-rtl8168h-and-.patch drm-amdgpu-fix-a-null-pointer-access-when-the-smc_rr.patch i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch