TencentOS
/
TencentOS-kernel
mirror of https://github.com/Tencent/TencentOS-kernel
0
0
Fork 4
Code Issues Projects Releases Wiki Activity
TencentOS-kernel/drivers
History
Mike Marciniszyn a5fb47da07 IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE 
commit 54a485e9ec084da1a4b32dcf7749c7d760ed8aa5 upstream.

The lookaside count is improperly initialized to the size of the
Receive Queue with the additional +1.  In the traces below, the
RQ size is 384, so the count was set to 385.

The lookaside count is then rarely refreshed.  Note the high and
incorrect count in the trace below:

rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9008 wr_id 55c7206d75a0 qpn c
	qpt 2 pid 3018 num_sge 1 head 1 tail 0, count 385
rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1

The head,tail indicate there is only one RWQE posted although the count
says 385 and we correctly return the element 0.

The next call to rvt_get_rwqe with the decremented count:

rvt_get_rwqe: [hfi1_0] wqe ffffc900078e9058 wr_id 0 qpn c
	qpt 2 pid 3018 num_sge 0 head 1 tail 1, count 384
rvt_get_rwqe: (hfi1_rc_rcv+0x4eb/0x1480 [hfi1] <- rvt_get_rwqe) ret=0x1

Note that the RQ is empty (head == tail) yet we return the RWQE at tail 1,
which is not valid because of the bogus high count.

Best case, the RWQE has never been posted and the rc logic sees an RWQE
that is too small (all zeros) and puts the QP into an error state.

In the worst case, a server slow at posting receive buffers might fool
rvt_get_rwqe() into fetching an old RWQE and corrupt memory.

Fix by deleting the faulty initialization code and creating an
inline to fetch the posted count and convert all callers to use
new inline.

Fixes: f592ae3c999f ("IB/rdmavt: Fracture single lock used for posting and processing RWQEs")
Link: https://lore.kernel.org/r/20200728183848.22226.29132.stgit@awfm-01.aw.intel.com
Reported-by: Zhaojuan Guo <zguo@redhat.com>
Cc: <stable@vger.kernel.org> # 5.4.x
Reviewed-by: Kaike Wan <kaike.wan@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Tested-by: Honggang Li <honli@redhat.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2021-03-16 16:32:45 +08:00
..
accessibility Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
acpi ACPI: video: Use native backlight on Acer TravelMate 5735Z 2021-03-16 16:31:56 +08:00
amba Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
android binder: Don't use mmput() from shrinker function. 2021-03-16 16:32:34 +08:00
ata ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function 2021-03-16 16:31:03 +08:00
atm Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
auxdisplay Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
base PM: wakeup: Show statistics for deleted wakeup sources again 2021-03-16 16:32:43 +08:00
bcma Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
block Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()" 2021-03-16 16:32:11 +08:00
bluetooth Bluetooth: hci_bcm: fix freeing not-requested IRQ 2021-03-16 16:29:45 +08:00
bus bus: ti-sysc: Do not disable on suspend for no-idle 2021-03-16 16:31:58 +08:00
cdrom Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
char /dev/mem: Add missing memory barriers for devmem_inode 2021-03-16 16:32:37 +08:00
clk clk: qcom: gcc: Add missing UFS clocks for SM8150 2021-03-16 16:32:05 +08:00
clocksource arm64: arch_timer: Disable the compat vdso for cores affected by ARM64_WORKAROUND_1418040 2021-03-16 16:31:46 +08:00
connector Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
counter counter: 104-quad-8: Add lock guards - generic interface 2021-03-16 16:27:07 +08:00
cpufreq cpufreq: Fix up cpufreq_boost_set_sw() 2021-03-16 16:29:08 +08:00
cpuidle cpuidle: Fix three reference count leaks 2021-03-16 16:29:37 +08:00
crypto crypto: ccp - Release all allocated memory if sha type is invalid 2021-03-16 16:32:43 +08:00
dax device-dax: don't leak kernel memory to user space after unloading kmem 2021-03-16 16:28:19 +08:00
dca Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
devfreq PM / devfreq: Add missing locking while setting suspend_freq 2021-03-16 16:27:31 +08:00
dio Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
dma dmaengine: ioat setting ioat timeout as module parameter 2021-03-16 16:32:31 +08:00
dma-buf dmabuf: use spinlock to access dmabuf->name 2021-03-16 16:32:21 +08:00
edac EDAC/amd64: Read back the scrub rate PCI register on F15h 2021-03-16 16:31:13 +08:00
eisa Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
extcon extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()' 2021-03-16 16:30:26 +08:00
firewire Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
firmware drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups() 2021-03-16 16:32:20 +08:00
fpga fpga: dfl: fix bug in port reset handshake 2021-03-16 16:32:23 +08:00
fsi Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
gnss gnss: sirf: fix error return code in sirf_probe() 2021-03-16 16:29:47 +08:00
gpio gpio: arizona: put pm_runtime in case of failure 2021-03-16 16:32:18 +08:00
gpu drm/amd/powerplay: fix a crash when overclocking Vega M 2021-03-16 16:32:38 +08:00
greybus Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hid HID: apple: Disable Fn-key key-re-mapping on clone keyboards 2021-03-16 16:32:29 +08:00
hsi Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hv Drivers: hv: vmbus: Always handle the VMBus messages on CPU0 2021-03-16 16:29:25 +08:00
hwmon hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe() 2021-03-16 16:32:33 +08:00
hwspinlock Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hwtracing intel_th: Fix a NULL dereference when hub driver is not loaded 2021-03-16 16:32:13 +08:00
i2c i2c: i2c-qcom-geni: Fix DMA transfer race 2021-03-16 16:32:28 +08:00
i3c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ide Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
idle Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
iio iio: adc: ad7780: Fix a resource handling path in 'ad7780_probe()' 2021-03-16 16:31:58 +08:00
infiniband IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE 2021-03-16 16:32:45 +08:00
input Input: elan_i2c - only increment wakeup count on touch 2021-03-16 16:32:31 +08:00
interconnect Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
iommu irqdomain/treewide: Keep firmware node unconditionally allocated 2021-03-16 16:32:20 +08:00
ipack ipack: tpci200: fix error return code in tpci200_register() 2021-03-16 16:28:19 +08:00
irqchip irqchip/gic: Atomically update affinity 2021-03-16 16:31:22 +08:00
isdn Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
leds leds: core: Fix warning message when init_data 2021-03-16 16:26:37 +08:00
lightnvm Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
macintosh drivers/macintosh: Fix memleak in windfarm_pm112 driver 2021-03-16 16:29:49 +08:00
mailbox mailbox: zynqmp-ipi: Fix NULL vs IS_ERR() check in zynqmp_ipi_mbox_probe() 2021-03-16 16:30:27 +08:00
mcb Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
md dm integrity: fix integrity recalculation that is improperly skipped 2021-03-16 16:32:40 +08:00
media media: rc: prevent memory leak in cx23888_ir_probe 2021-03-16 16:32:44 +08:00
memory Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
memstick Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
message scsi: mptscsih: Fix read sense data size 2021-03-16 16:31:28 +08:00
mfd mfd: stmfx: Disable IRQ in suspend to avoid spurious interrupt 2021-03-16 16:30:24 +08:00
misc misc: atmel-ssc: lock with mutex instead of spinlock 2021-03-16 16:32:14 +08:00
mmc mmc: sdhci-of-aspeed: Fix clock divider calculation 2021-03-16 16:32:38 +08:00
mtd mtd: rawnand: oxnas: Release all devices in the _remove() path 2021-03-16 16:32:05 +08:00
mux Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
net ath10k: enable transmit data ack RSSI for QCA9884 2021-03-16 16:32:44 +08:00
nfc NFC: st21nfca: add missed kfree_skb() in an error path 2021-03-16 16:28:49 +08:00
ntb NTB: perf: Fix race condition when run with ntb_test 2021-03-16 16:30:32 +08:00
nubus Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
nvdimm libnvdimm: Out of bounds read in __nd_ioctl() 2021-03-16 16:26:40 +08:00
nvme nvme-rdma: assign completion vector correctly 2021-03-16 16:31:28 +08:00
nvmem nvmem: qfprom: remove incorrect write support 2021-03-16 16:28:52 +08:00
of of: of_mdio: Correct loop scanning logic 2021-03-16 16:31:51 +08:00
opp Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
oprofile Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
parisc Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
parport Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
pci PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge 2021-03-16 16:32:44 +08:00
pcmcia Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
perf drivers/perf: Prevent forced unbinding of PMU drivers 2021-03-16 16:32:34 +08:00
phy phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked 2021-03-16 16:31:57 +08:00
pinctrl pinctrl: amd: fix npins for uart0 in kerncz_groups 2021-03-16 16:32:18 +08:00
platform platform/x86: asus-wmi: allow BAT1 battery name 2021-03-16 16:32:33 +08:00
pnp Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
power power: supply: smb347-charger: IRQSTAT_D is volatile 2021-03-16 16:30:14 +08:00
powercap Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
pps Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ps3 Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ptp Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
pwm pwm: jz4740: Fix build failure 2021-03-16 16:31:41 +08:00
rapidio rapidio: fix an error in get_user_pages_fast() error handling 2021-03-16 16:28:19 +08:00
ras Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
regulator regualtor: pfuze100: correct sw1a/sw2 on pfuze3000 2021-03-16 16:30:56 +08:00
remoteproc remoteproc: qcom_q6v5_mss: map/unmap mpss segments before/after use 2021-03-16 16:29:59 +08:00
reset Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
rpmsg Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
rtc rtc: rv3028: Add missed check for devm_regmap_init_i2c() 2021-03-16 16:30:27 +08:00
s390 s390/qeth: fix error handling for isolation mode cmds 2021-03-16 16:30:59 +08:00
sbus Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
scsi scsi: dh: Add Fujitsu device to devinfo and dh lists 2021-03-16 16:32:20 +08:00
sfi Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sh Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
siox Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
slimbus slimbus: core: Fix mismatch in of_node_get/put 2021-03-16 16:32:05 +08:00
soc soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner 2021-03-16 16:32:18 +08:00
soundwire soundwire: intel: fix memory leak with devm_kasprintf 2021-03-16 16:31:57 +08:00
spi spi: mediatek: use correct SPI_CFG2_REG MACRO 2021-03-16 16:32:30 +08:00
spmi Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ssb Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
staging staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift 2021-03-16 16:32:36 +08:00
target scsi: target: tcmu: Fix a use after free in tcmu_check_expired_queue_cmd() 2021-03-16 16:30:24 +08:00
tc Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tee Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
thermal thermal/drivers/cpufreq_cooling: Fix wrong frequency converted from power 2021-03-16 16:32:15 +08:00
thunderbolt Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tty vt: Reject zero-sized screen buffer size. 2021-03-16 16:32:37 +08:00
uio uio_pdrv_genirq: fix use without device tree and no interrupt 2021-03-16 16:32:12 +08:00
usb usb: xhci: Fix ASM2142/ASM3142 DMA addressing 2021-03-16 16:32:35 +08:00
vfio vfio/mdev: Fix reference count leak in add_mdev_supported_type 2021-03-16 16:30:27 +08:00
vhost scsi: vhost: Notify TCM about the maximum sg entries supported per command 2021-03-16 16:30:04 +08:00
video fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. 2021-03-16 16:32:37 +08:00
virt virt: vbox: Fix guest capabilities mask check 2021-03-16 16:32:09 +08:00
virtio Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
visorbus Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
vlynq Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
vme Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
w1 w1: omap-hdq: cleanup to add missing newline for some dev_dbg 2021-03-16 16:29:53 +08:00
watchdog watchdog: da9062: No need to ping manually before setting timeout 2021-03-16 16:30:22 +08:00
xen xen/pvcalls-back: test for errors when calling backend_connect() 2021-03-16 16:29:13 +08:00
zorro Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Makefile Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00