Home Home > GIT Browse > SLE12-SP3-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-02-13 07:00:28 +0100
committerKernel Build Daemon <kbuild@suse.de>2019-02-13 07:00:28 +0100
commit491ef95c18af1461051106fe8b80326e02ee986e (patch)
treec7a537bf0722c855a827faa2f123fb303ef2413e
parentd21c6f20057812ea77b30c331127024a76d37edf (diff)
parent6debd5c99d25df245d32afe899dc4e8d24ce277e (diff)
Merge branch 'SLE12-SP3' into SLE12-SP3-AZURE
-rw-r--r--patches.drivers/IB-core-type-promotion-bug-in-rdma_rw_init_one_mr.patch35
-rw-r--r--patches.fixes/acpi-nfit-fix-command-supported-detection.patch11
-rw-r--r--patches.fixes/nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch54
-rw-r--r--series.conf2
4 files changed, 97 insertions, 5 deletions
diff --git a/patches.drivers/IB-core-type-promotion-bug-in-rdma_rw_init_one_mr.patch b/patches.drivers/IB-core-type-promotion-bug-in-rdma_rw_init_one_mr.patch
new file mode 100644
index 0000000000..f2e73add9b
--- /dev/null
+++ b/patches.drivers/IB-core-type-promotion-bug-in-rdma_rw_init_one_mr.patch
@@ -0,0 +1,35 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 4 Jul 2018 12:32:12 +0300
+Subject: IB/core: type promotion bug in rdma_rw_init_one_mr()
+Patch-mainline: v4.19-rc1
+Git-commit: c2d7c8ff89b22ddefb1ac2986c0d48444a667689
+References: FATE#321732
+
+"nents" is an unsigned int, so if ib_map_mr_sg() returns a negative
+error code then it's type promoted to a high unsigned int which is
+treated as success.
+
+Fixes: a060b5629ab0 ("IB/core: generic RDMA READ/WRITE API")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/infiniband/core/rw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/rw.c b/drivers/infiniband/core/rw.c
+index c8963e91f92a..3ee0adfb45e9 100644
+--- a/drivers/infiniband/core/rw.c
++++ b/drivers/infiniband/core/rw.c
+@@ -87,7 +87,7 @@ static int rdma_rw_init_one_mr(struct ib_qp *qp, u8 port_num,
+ }
+
+ ret = ib_map_mr_sg(reg->mr, sg, nents, &offset, PAGE_SIZE);
+- if (ret < nents) {
++ if (ret < 0 || ret < nents) {
+ ib_mr_pool_put(qp, &qp->rdma_mrs, reg->mr);
+ return -EINVAL;
+ }
+--
+2.12.3
+
diff --git a/patches.fixes/acpi-nfit-fix-command-supported-detection.patch b/patches.fixes/acpi-nfit-fix-command-supported-detection.patch
index 799bd56e65..8981d5fc5c 100644
--- a/patches.fixes/acpi-nfit-fix-command-supported-detection.patch
+++ b/patches.fixes/acpi-nfit-fix-command-supported-detection.patch
@@ -64,7 +64,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
int acpi_nfit_ctl(struct nvdimm_bus_descriptor *nd_desc, struct nvdimm *nvdimm,
unsigned int cmd, void *buf, unsigned int buf_len, int *cmd_rc)
{
-@@ -206,16 +232,10 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+@@ -206,17 +232,11 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
unsigned long cmd_mask, dsm_mask;
u32 offset, fw_status = 0;
acpi_handle handle;
@@ -73,7 +73,8 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
- int rc, i;
+ int func, rc, i;
- *cmd_rc = -EINVAL;
+ if (cmd_rc)
+ *cmd_rc = -EINVAL;
- func = cmd;
- if (cmd == ND_CMD_CALL) {
- call_pkg = buf;
@@ -82,7 +83,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
if (nvdimm) {
struct nfit_mem *nfit_mem = nvdimm_provider_data(nvdimm);
-@@ -223,9 +243,12 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+@@ -224,9 +244,12 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
if (!adev)
return -ENOTTY;
@@ -97,7 +98,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
dimm_name = nvdimm_name(nvdimm);
cmd_name = nvdimm_cmd_name(cmd);
cmd_mask = nvdimm_cmd_mask(nvdimm);
-@@ -236,6 +259,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+@@ -237,6 +260,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
} else {
struct acpi_device *adev = to_acpi_dev(acpi_desc);
@@ -105,7 +106,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
cmd_name = nvdimm_bus_cmd_name(cmd);
cmd_mask = nd_desc->cmd_mask;
dsm_mask = cmd_mask;
-@@ -248,7 +272,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+@@ -249,7 +273,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
if (!desc || (cmd && (desc->out_num + desc->in_num == 0)))
return -ENOTTY;
diff --git a/patches.fixes/nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch b/patches.fixes/nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch
new file mode 100644
index 0000000000..3d2cc720fa
--- /dev/null
+++ b/patches.fixes/nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch
@@ -0,0 +1,54 @@
+From: Dave Jiang <dave.jiang@intel.com>
+Date: Wed, 11 Jul 2018 10:10:11 -0700
+Subject: nfit: fix unchecked dereference in acpi_nfit_ctl
+Git-commit: ee6581ceba7f8314b81b2f2a81f1cf3f67c679e2
+Patch-mainline: v4.18-rc5
+References: bsc#1125014
+
+Incremental patch to fix the unchecked dereference in acpi_nfit_ctl.
+Reported by Dan Carpenter:
+
+"acpi/nfit: fix cmd_rc for acpi_nfit_ctl to
+always return a value" from Jun 28, 2018, leads to the following
+Smatch complaint:
+
+ drivers/acpi/nfit/core.c:578 acpi_nfit_ctl()
+ warn: variable dereferenced before check 'cmd_rc' (see line 411)
+
+drivers/acpi/nfit/core.c
+ 410
+ 411 *cmd_rc = -EINVAL;
+ ^^^^^^^^^^^^^^^^^^
+Patch adds unchecked dereference.
+
+Fixes: c1985cefd844 ("acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value")
+
+Signed-off-by: Dave Jiang <dave.jiang@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/acpi/nfit/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -210,7 +210,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+ const u8 *uuid;
+ int rc, i;
+
+- *cmd_rc = -EINVAL;
++ if (cmd_rc)
++ *cmd_rc = -EINVAL;
+ func = cmd;
+ if (cmd == ND_CMD_CALL) {
+ call_pkg = buf;
+@@ -298,7 +299,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+ * If we return an error (like elsewhere) then caller wouldn't
+ * be able to rely upon data returned to make calculation.
+ */
+- *cmd_rc = 0;
++ if (cmd_rc)
++ *cmd_rc = 0;
+ return 0;
+ }
+
+
diff --git a/series.conf b/series.conf
index 6664374938..0aa352245f 100644
--- a/series.conf
+++ b/series.conf
@@ -23978,6 +23978,7 @@
patches.suse/msft-hv-1726-x86-hyper-v-Fix-the-circular-dependency-in-IPI-enlig.patch
patches.drivers/0004-mmc-dw_mmc-fix-card-threshold-control-configuration.patch
patches.fixes/acpi-nfit-fix-cmd_rc-for-acpi_nfit_ctl-to-always-return-a-value.patch
+ patches.fixes/nfit-fix-unchecked-dereference-in-acpi_nfit_ctl.patch
patches.suse/0001-btrfs-scrub-Don-t-use-inode-page-cache-in-scrub_hand.patch
patches.drivers/cxgb4-assume-flash-part-size-to-be-4MB-if-it-can-t-b.patch
patches.drivers/bnxt_en-Fix-inconsistent-BNXT_FLAG_AGG_RINGS-logic.patch
@@ -24149,6 +24150,7 @@
patches.arch/powerpc-64s-move-machine-check-SLB-flushing-to-mm-sl.patch
patches.drivers/iw_cxgb4-remove-duplicate-memcpy-in-c4iw_create_list.patch
patches.drivers/RDMA-i40w-Hold-read-semaphore-while-looking-after-VM.patch
+ patches.drivers/IB-core-type-promotion-bug-in-rdma_rw_init_one_mr.patch
patches.fixes/RDMA-rw-Fix-rdma_rw_ctx_signature_init-kernel-doc-he.patch
patches.suse/msft-hv-1718-use-the-new-async-probing-feature-for-the-hyperv-dri.patch
patches.suse/msft-hv-1719-x86-hyperv-Add-interrupt-handler-annotations.patch