Home Home > GIT Browse > SLE12-SP3-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-02-14 07:00:29 +0100
committerKernel Build Daemon <kbuild@suse.de>2019-02-14 07:00:29 +0100
commit692c0439272cc98e39e95ab72161a5d9498754f6 (patch)
tree2b105a00755d26646bdccd2f350ee9127af3544d
parent491ef95c18af1461051106fe8b80326e02ee986e (diff)
parent5fdcc9222f58490e8e5a46fb1c56807e90a8cc6f (diff)
Merge branch 'SLE12-SP3' into SLE12-SP3-AZURE
-rw-r--r--patches.arch/kvm-fix-kvm_ioctl_create_device-reference-counting-cve-2019-69747
-rw-r--r--patches.drivers/RDMA-bnxt_re-Fix-a-couple-off-by-one-bugs.patch45
-rw-r--r--series.conf1
3 files changed, 49 insertions, 4 deletions
diff --git a/patches.arch/kvm-fix-kvm_ioctl_create_device-reference-counting-cve-2019-6974 b/patches.arch/kvm-fix-kvm_ioctl_create_device-reference-counting-cve-2019-6974
index a9fa1ff81e..9e58838732 100644
--- a/patches.arch/kvm-fix-kvm_ioctl_create_device-reference-counting-cve-2019-6974
+++ b/patches.arch/kvm-fix-kvm_ioctl_create_device-reference-counting-cve-2019-6974
@@ -28,8 +28,8 @@ Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Joerg Roedel <jroedel@suse.de>
---
- virt/kvm/kvm_main.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
+ virt/kvm/kvm_main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -44,12 +44,11 @@ Acked-by: Joerg Roedel <jroedel@suse.de>
mutex_lock(&kvm->lock);
list_del(&dev->vm_node);
mutex_unlock(&kvm->lock);
-@@ -2798,7 +2800,7 @@ static int kvm_ioctl_create_device(struc
+@@ -2798,7 +2800,6 @@ static int kvm_ioctl_create_device(struc
return ret;
}
- kvm_get_kvm(kvm);
-+ list_add(&dev->vm_node, &kvm->devices);
cd->fd = ret;
return 0;
}
diff --git a/patches.drivers/RDMA-bnxt_re-Fix-a-couple-off-by-one-bugs.patch b/patches.drivers/RDMA-bnxt_re-Fix-a-couple-off-by-one-bugs.patch
new file mode 100644
index 0000000000..0610ab3053
--- /dev/null
+++ b/patches.drivers/RDMA-bnxt_re-Fix-a-couple-off-by-one-bugs.patch
@@ -0,0 +1,45 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 4 Jul 2018 12:57:11 +0300
+Subject: RDMA/bnxt_re: Fix a couple off by one bugs
+Patch-mainline: v4.19-rc1
+Git-commit: 474e5a86067e5f12c97d1db8b170c7f45b53097a
+References: bsc#1020413, FATE#321905
+
+The sgid_tbl->tbl[] array is allocated in bnxt_qplib_alloc_sgid_tbl().
+It has sgid_tbl->max elements. So the > should be >= to prevent
+accessing one element beyond the end of the array.
+
+Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_sp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+index 2f3f32eaa1d5..4097f3fa25c5 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+@@ -197,7 +197,7 @@ int bnxt_qplib_get_sgid(struct bnxt_qplib_res *res,
+ struct bnxt_qplib_sgid_tbl *sgid_tbl, int index,
+ struct bnxt_qplib_gid *gid)
+ {
+- if (index > sgid_tbl->max) {
++ if (index >= sgid_tbl->max) {
+ dev_err(&res->pdev->dev,
+ "QPLIB: Index %d exceeded SGID table max (%d)",
+ index, sgid_tbl->max);
+@@ -402,7 +402,7 @@ int bnxt_qplib_get_pkey(struct bnxt_qplib_res *res,
+ *pkey = 0xFFFF;
+ return 0;
+ }
+- if (index > pkey_tbl->max) {
++ if (index >= pkey_tbl->max) {
+ dev_err(&res->pdev->dev,
+ "QPLIB: Index %d exceeded PKEY table max (%d)",
+ index, pkey_tbl->max);
+--
+2.12.3
+
diff --git a/series.conf b/series.conf
index 0aa352245f..54d47c9852 100644
--- a/series.conf
+++ b/series.conf
@@ -24151,6 +24151,7 @@
patches.drivers/iw_cxgb4-remove-duplicate-memcpy-in-c4iw_create_list.patch
patches.drivers/RDMA-i40w-Hold-read-semaphore-while-looking-after-VM.patch
patches.drivers/IB-core-type-promotion-bug-in-rdma_rw_init_one_mr.patch
+ patches.drivers/RDMA-bnxt_re-Fix-a-couple-off-by-one-bugs.patch
patches.fixes/RDMA-rw-Fix-rdma_rw_ctx_signature_init-kernel-doc-he.patch
patches.suse/msft-hv-1718-use-the-new-async-probing-feature-for-the-hyperv-dri.patch
patches.suse/msft-hv-1719-x86-hyperv-Add-interrupt-handler-annotations.patch