1. 22 Aug, 2019 2 commits
    • Bernard Metzler's avatar
      RDMA/siw: Fix SGL mapping issues · fab4f97e
      Bernard Metzler authored
      All user level and most in-kernel applications submit WQEs
      where the SG list entries are all of a single type.
      iSER in particular, however, will send us WQEs with mixed SG
      types: sge[0] = kernel buffer, sge[1] = PBL region.
      Check and set is_kva on each SG entry individually instead of
      assuming the first SGE type carries through to the last.
      This fixes iSER over siw.
      
      Fixes: b9be6f18 ("rdma/siw: transmit path")
      Reported-by: default avatarKrishnamraju Eraparaju <krishna2@chelsio.com>
      Tested-by: default avatarKrishnamraju Eraparaju <krishna2@chelsio.com>
      Signed-off-by: default avatarBernard Metzler <bmt@zurich.ibm.com>
      Link: https://lore.kernel.org/r/20190822150741.21871-1-bmt@zurich.ibm.comSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
      fab4f97e
    • Selvin Xavier's avatar
      RDMA/bnxt_re: Fix stack-out-of-bounds in bnxt_qplib_rcfw_send_message · d37b1e53
      Selvin Xavier authored
      Driver copies FW commands to the HW queue as  units of 16 bytes. Some
      of the command structures are not exact multiple of 16. So while copying
      the data from those structures, the stack out of bounds messages are
      reported by KASAN. The following error is reported.
      
      [ 1337.530155] ==================================================================
      [ 1337.530277] BUG: KASAN: stack-out-of-bounds in bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
      [ 1337.530413] Read of size 16 at addr ffff888725477a48 by task rmmod/2785
      
      [ 1337.530540] CPU: 5 PID: 2785 Comm: rmmod Tainted: G           OE     5.2.0-rc6+ #75
      [ 1337.530541] Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.0.4 08/28/2014
      [ 1337.530542] Call Trace:
      [ 1337.530548]  dump_stack+0x5b/0x90
      [ 1337.530556]  ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
      [ 1337.530560]  print_address_description+0x65/0x22e
      [ 1337.530568]  ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
      [ 1337.530575]  ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
      [ 1337.530577]  __kasan_report.cold.3+0x37/0x77
      [ 1337.530581]  ? _raw_write_trylock+0x10/0xe0
      [ 1337.530588]  ? bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
      [ 1337.530590]  kasan_report+0xe/0x20
      [ 1337.530592]  memcpy+0x1f/0x50
      [ 1337.530600]  bnxt_qplib_rcfw_send_message+0x40a/0x850 [bnxt_re]
      [ 1337.530608]  ? bnxt_qplib_creq_irq+0xa0/0xa0 [bnxt_re]
      [ 1337.530611]  ? xas_create+0x3aa/0x5f0
      [ 1337.530613]  ? xas_start+0x77/0x110
      [ 1337.530615]  ? xas_clear_mark+0x34/0xd0
      [ 1337.530623]  bnxt_qplib_free_mrw+0x104/0x1a0 [bnxt_re]
      [ 1337.530631]  ? bnxt_qplib_destroy_ah+0x110/0x110 [bnxt_re]
      [ 1337.530633]  ? bit_wait_io_timeout+0xc0/0xc0
      [ 1337.530641]  bnxt_re_dealloc_mw+0x2c/0x60 [bnxt_re]
      [ 1337.530648]  bnxt_re_destroy_fence_mr+0x77/0x1d0 [bnxt_re]
      [ 1337.530655]  bnxt_re_dealloc_pd+0x25/0x60 [bnxt_re]
      [ 1337.530677]  ib_dealloc_pd_user+0xbe/0xe0 [ib_core]
      [ 1337.530683]  srpt_remove_one+0x5de/0x690 [ib_srpt]
      [ 1337.530689]  ? __srpt_close_all_ch+0xc0/0xc0 [ib_srpt]
      [ 1337.530692]  ? xa_load+0x87/0xe0
      ...
      [ 1337.530840]  do_syscall_64+0x6d/0x1f0
      [ 1337.530843]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
      [ 1337.530845] RIP: 0033:0x7ff5b389035b
      [ 1337.530848] Code: 73 01 c3 48 8b 0d 2d 0b 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d fd 0a 2c 00 f7 d8 64 89 01 48
      [ 1337.530849] RSP: 002b:00007fff83425c28 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
      [ 1337.530852] RAX: ffffffffffffffda RBX: 00005596443e6750 RCX: 00007ff5b389035b
      [ 1337.530853] RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005596443e67b8
      [ 1337.530854] RBP: 0000000000000000 R08: 00007fff83424ba1 R09: 0000000000000000
      [ 1337.530856] R10: 00007ff5b3902960 R11: 0000000000000206 R12: 00007fff83425e50
      [ 1337.530857] R13: 00007fff8342673c R14: 00005596443e6260 R15: 00005596443e6750
      
      [ 1337.530885] The buggy address belongs to the page:
      [ 1337.530962] page:ffffea001c951dc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
      [ 1337.530964] flags: 0x57ffffc0000000()
      [ 1337.530967] raw: 0057ffffc0000000 0000000000000000 ffffffff1c950101 0000000000000000
      [ 1337.530970] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
      [ 1337.530970] page dumped because: kasan: bad access detected
      
      [ 1337.530996] Memory state around the buggy address:
      [ 1337.531072]  ffff888725477900: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 f2 f2 f2
      [ 1337.531180]  ffff888725477980: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00
      [ 1337.531288] >ffff888725477a00: 00 f2 f2 f2 f2 f2 f2 00 00 00 f2 00 00 00 00 00
      [ 1337.531393]                                                  ^
      [ 1337.531478]  ffff888725477a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [ 1337.531585]  ffff888725477b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      [ 1337.531691] ==================================================================
      
      Fix this by passing the exact size of each FW command to
      bnxt_qplib_rcfw_send_message as req->cmd_size. Before sending
      the command to HW, modify the req->cmd_size to number of 16 byte units.
      
      Fixes: 1ac5a404 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
      Signed-off-by: default avatarSelvin Xavier <selvin.xavier@broadcom.com>
      Link: https://lore.kernel.org/r/1566468170-489-1-git-send-email-selvin.xavier@broadcom.comSigned-off-by: default avatarDoug Ledford <dledford@redhat.com>
      d37b1e53
  2. 20 Aug, 2019 18 commits
  3. 18 Aug, 2019 11 commits
    • Linus Torvalds's avatar
      Linux 5.3-rc5 · d1abaeb3
      Linus Torvalds authored
      d1abaeb3
    • Linus Torvalds's avatar
      Merge tag 'fixes-for-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux · 6825e5a6
      Linus Torvalds authored
      Pull MTD fix from Richard Weinberger:
       "A single fix for MTD to correctly set the spi-nor WP pin"
      
      * tag 'fixes-for-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
        mtd: spi-nor: Fix the disabling of write protection at init
      6825e5a6
    • Linus Torvalds's avatar
      Merge tag 'for-5.3-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 3039fadf
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
       "Two fixes that popped up during testing:
      
         - fix for sysfs-related code that adds/removes block groups, warnings
           appear during several fstests in connection with sysfs updates in
           5.3, the fix essentially replaces a workaround with scope NOFS and
           applies to 5.2-based branch too
      
         - add sanity check of trim range"
      
      * tag 'for-5.3-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: trim: Check the range passed into to prevent overflow
        Btrfs: fix sysfs warning and missing raid sysfs directories
      3039fadf
    • Linus Torvalds's avatar
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · c332f3a7
      Linus Torvalds authored
      Pull x86 fixes from Thomas Gleixner:
       "A set of fixes for x86:
      
         - Fix the inconsistent error handling in the umwait init code
      
         - Rework the boot param zeroing so gcc9 stops complaining about out
           of bound memset. The resulting source code is actually more sane to
           read than the smart solution we had
      
         - Maintainers update so Tony gets involved when Intel models are
           added
      
         - Some more fallthrough fixes"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/boot: Save fields explicitly, zero out everything else
        MAINTAINERS, x86/CPU: Tony Luck will maintain asm/intel-family.h
        x86/fpu/math-emu: Address fallthrough warnings
        x86/apic/32: Fix yet another implicit fallthrough warning
        x86/umwait: Fix error handling in umwait_init()
      c332f3a7
    • Linus Torvalds's avatar
      Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 645c03aa
      Linus Torvalds authored
      Pull EFI fix from Thomas Gleixner:
       "A single fix for a EFI mixed mode regression caused by recent rework
        which did not take the firmware bitwidth into account"
      
      * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        efi-stub: Fix get_efi_config_table on mixed-mode setups
      645c03aa
    • Linus Torvalds's avatar
      Merge tag 'spdx-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx · 5bba5c9c
      Linus Torvalds authored
      Pull SPDX fixes from Greg KH:
       "Here are four small SPDX fixes for 5.3-rc5.
      
        A few style fixes for some SPDX comments, added an SPDX tag for one
        file, and fix up some GPL boilerplate for another file.
      
        All of these have been in linux-next for a few weeks with no reported
        issues (they are comment changes only, so that's to be expected...)"
      
      * tag 'spdx-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx:
        i2c: stm32: Use the correct style for SPDX License Identifier
        intel_th: Use the correct style for SPDX License Identifier
        coccinelle: api/atomic_as_refcounter: add SPDX License Identifier
        kernel/configs: Replace GPL boilerplate code with SPDX identifier
      5bba5c9c
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 4503c0a4
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some small char and misc driver fixes for 5.3-rc5.
      
        These are two different subsystems needing some fixes, the habanalabs
        driver which is has some more big endian fixes for problems found. The
        other are some small soundwire fixes, including some Kconfig
        dependencies needed to resolve reported build errors.
      
        All of these have been in linux-next this week with no reported
        issues"
      
      * tag 'char-misc-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        misc: xilinx-sdfec: fix dependency and build error
        habanalabs: fix device IRQ unmasking for BE host
        habanalabs: fix endianness handling for internal QMAN submission
        habanalabs: fix completion queue handling when host is BE
        habanalabs: fix endianness handling for packets from user
        habanalabs: fix DRAM usage accounting on context tear down
        habanalabs: Avoid double free in error flow
        soundwire: fix regmap dependencies and align with other serial links
        soundwire: cadence_master: fix definitions for INTSTAT0/1
        soundwire: cadence_master: fix register definition for SLAVE_STATE
      4503c0a4
    • Linus Torvalds's avatar
      Merge tag 'staging-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · ae1a616a
      Linus Torvalds authored
      Pull staging/IIO fixes from Greg KH:
       "Here are four small staging and iio driver fixes for 5.3-rc5
      
        Two are for the dt3000 comedi driver for some reported problems found
        in that codebase, and two are some small iio fixes.
      
        All of these have been in linux-next this week with no reported
        issues"
      
      * tag 'staging-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: comedi: dt3000: Fix rounding up of timer divisor
        staging: comedi: dt3000: Fix signed integer overflow 'divider * base'
        iio: adc: max9611: Fix temperature reading in probe
        iio: frequency: adf4371: Fix output frequency setting
      ae1a616a
    • Linus Torvalds's avatar
      Merge tag 'usb-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 359334ca
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are number of small USB fixes for 5.3-rc5.
      
        Syzbot has been on a tear recently now that it has some good USB
        debugging hooks integrated, so there's a number of fixes in here found
        by those tools for some _very_ old bugs. Also a handful of gadget
        driver fixes for reported issues, some hopefully-final dma fixes for
        host controller drivers, and some new USB serial gadget driver ids.
      
        All of these have been in linux-next this week with no reported issues
        (the usb-serial ones were in linux-next in its own branch, but merged
        into mine on Friday)"
      
      * tag 'usb-5.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: add a hcd_uses_dma helper
        usb: don't create dma pools for HCDs with a localmem_pool
        usb: chipidea: imx: fix EPROBE_DEFER support during driver probe
        usb: host: fotg2: restart hcd after port reset
        USB: CDC: fix sanity checks in CDC union parser
        usb: cdc-acm: make sure a refcount is taken early enough
        USB: serial: option: add the BroadMobi BM818 card
        USB: serial: option: Add Motorola modem UARTs
        USB: core: Fix races in character device registration and deregistraion
        usb: gadget: mass_storage: Fix races between fsg_disable and fsg_set_alt
        usb: gadget: composite: Clear "suspended" on reset/disconnect
        usb: gadget: udc: renesas_usb3: Fix sysfs interface of "role"
        USB: serial: option: add D-Link DWM-222 device ID
        USB: serial: option: Add support for ZTE MF871A
      359334ca
    • Linus Torvalds's avatar
      Merge tag 'for-linus-2019-08-17' of git://git.kernel.dk/linux-block · 8fde2832
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A collection of fixes that should go into this series. This contains:
      
         - Revert of the REQ_NOWAIT_INLINE and associated dio changes. There
           were still corner cases there, and even though I had a solution for
           it, it's too involved for this stage. (me)
      
         - Set of NVMe fixes (via Sagi)
      
         - io_uring fix for fixed buffers (Anthony)
      
         - io_uring defer issue fix (Jackie)
      
         - Regression fix for queue sync at exit time (zhengbin)
      
         - xen blk-back memory leak fix (Wenwen)"
      
      * tag 'for-linus-2019-08-17' of git://git.kernel.dk/linux-block:
        io_uring: fix an issue when IOSQE_IO_LINK is inserted into defer list
        block: remove REQ_NOWAIT_INLINE
        io_uring: fix manual setup of iov_iter for fixed buffers
        xen/blkback: fix memory leaks
        blk-mq: move cancel of requeue_work to the front of blk_exit_queue
        nvme-pci: Fix async probe remove race
        nvme: fix controller removal race with scan work
        nvme-rdma: fix possible use-after-free in connect error flow
        nvme: fix a possible deadlock when passthru commands sent to a multipath device
        nvme-core: Fix extra device_put() call on error path
        nvmet-file: fix nvmet_file_flush() always returning an error
        nvmet-loop: Flush nvme_delete_wq when removing the port
        nvmet: Fix use-after-free bug when a port is removed
        nvme-multipath: revalidate nvme_ns_head gendisk in nvme_validate_ns
      8fde2832
    • Linus Torvalds's avatar
      Merge tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux · 85d8d3b1
      Linus Torvalds authored
      Pull Hyper-V fixes from Sasha Levin:
      
       - A few fixes for the userspace hyper-v tools from Adrian Vladu.
      
       - A fix for the hyper-v MAINTAINERs entry from Lan Tianyu.
      
       - Fix for SPDX license identifier in the userspace tools from Nishad
         Kamdar.
      
      * tag 'hyperv-fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
        MAINTAINERS: Fix Hyperv vIOMMU driver file name
        tools: hv: Use the correct style for SPDX License Identifier
        tools: hv: fix typos in toolchain
        tools: hv: fix KVP and VSS daemons exit code
        tools: hv: fixed Python pep8/flake8 warnings for lsvmbus
      85d8d3b1
  4. 17 Aug, 2019 9 commits