These stable fixes were not correctly noted as fixes when originally submitted for 5.2-rc1. We are addressing the internal gap that led to this miss.
Please consider these patches for all stable kernels older than 5.2.0, I tried on 4.19 and 3 out of 4 apply cleanly with a cherry pick from Linus' tree, but one of them I had to rebase, so I'm just sending the whole series.
If you'd rather I send one at a time in the format specified at option 2) of the stable documentation, please just let me know.
Patch 4 depends on patch 1.
I tried to follow the stable commit format for each of the individual patches, referencing the upstream commit ID. I also added a "Fixes" to each, trying to assist the automation in knowing how far back to backport.
Shortlog:
Grzegorz Siwik (1): i40e: Wrong truncation from u16 to u8
Martyna Szapar (2): i40e: Fix of memory leak and integer truncation in i40e_virtchnl.c i40e: Memory leak in i40e_config_iwarp_qvlist
Sergey Nemov (1): i40e: add num_vectors checker in iwarp handler
.../ethernet/intel/i40e/i40e_virtchnl_pf.c | 51 +++++++++++++------ 1 file changed, 36 insertions(+), 15 deletions(-)
From: Sergey Nemov sergey.nemov@intel.com
[ Upstream commit 7015ca3df965378bcef072cca9cd63ed098665b5 ]
Field num_vectors from struct virtchnl_iwarp_qvlist_info should not be larger than num_msix_vectors_vf in the hw struct. The iwarp uses the same set of vectors as the LAN VF driver.
Fixes: e3219ce6a7754 ("i40e: Add support for client interface for IWARP driver") Signed-off-by: Sergey Nemov sergey.nemov@intel.com Tested-by: Andrew Bowers andrewx.bowers@intel.com Signed-off-by: Jeff Kirsher jeffrey.t.kirsher@intel.com Signed-off-by: Jesse Brandeburg jesse.brandeburg@intel.com --- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c index 6a677fd540d6..a1b464a91d93 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c @@ -442,6 +442,16 @@ static int i40e_config_iwarp_qvlist(struct i40e_vf *vf, u32 next_q_idx, next_q_type; u32 msix_vf, size;
+ msix_vf = pf->hw.func_caps.num_msix_vectors_vf; + + if (qvlist_info->num_vectors > msix_vf) { + dev_warn(&pf->pdev->dev, + "Incorrect number of iwarp vectors %u. Maximum %u allowed.\n", + qvlist_info->num_vectors, + msix_vf); + goto err; + } + size = sizeof(struct virtchnl_iwarp_qvlist_info) + (sizeof(struct virtchnl_iwarp_qv_info) * (qvlist_info->num_vectors - 1));
From: Grzegorz Siwik grzegorz.siwik@intel.com
[ Upstream commit c004804dceee9ca384d97d9857ea2e2795c2651d ]
In this patch fixed wrong truncation method from u16 to u8 during validation.
It was changed by changing u8 to u32 parameter in method declaration and arguments were changed to u32.
Fixes: 5c3c48ac6bf56 ("i40e: implement virtual device interface") Signed-off-by: Grzegorz Siwik grzegorz.siwik@intel.com Tested-by: Andrew Bowers andrewx.bowers@intel.com Signed-off-by: Jeff Kirsher jeffrey.t.kirsher@intel.com Signed-off-by: Jesse Brandeburg jesse.brandeburg@intel.com --- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c index a1b464a91d93..b26e41acd993 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c @@ -196,7 +196,7 @@ static inline bool i40e_vc_isvalid_queue_id(struct i40e_vf *vf, u16 vsi_id, * * check for the valid vector id **/ -static inline bool i40e_vc_isvalid_vector_id(struct i40e_vf *vf, u8 vector_id) +static inline bool i40e_vc_isvalid_vector_id(struct i40e_vf *vf, u32 vector_id) { struct i40e_pf *pf = vf->pf;
From: Martyna Szapar martyna.szapar@intel.com
[ Upstream commit 24474f2709af6729b9b1da1c5e160ab62e25e3a4 ]
Fixed possible memory leak in i40e_vc_add_cloud_filter function: cfilter is being allocated and in some error conditions the function returns without freeing the memory.
Fix of integer truncation from u16 (type of queue_id value) to u8 when calling i40e_vc_isvalid_queue_id function.
Fixes: e284fc280473b ("i40e: Add and delete cloud filter") Signed-off-by: Martyna Szapar martyna.szapar@intel.com Signed-off-by: Jeff Kirsher jeffrey.t.kirsher@intel.com Signed-off-by: Jesse Brandeburg jesse.brandeburg@intel.com --- .../net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c index b26e41acd993..c19da0ff888e 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c @@ -181,7 +181,7 @@ static inline bool i40e_vc_isvalid_vsi_id(struct i40e_vf *vf, u16 vsi_id) * check for the valid queue id **/ static inline bool i40e_vc_isvalid_queue_id(struct i40e_vf *vf, u16 vsi_id, - u8 qid) + u16 qid) { struct i40e_pf *pf = vf->pf; struct i40e_vsi *vsi = i40e_find_vsi_from_id(pf, vsi_id); @@ -3345,7 +3345,7 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg)
if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { aq_ret = I40E_ERR_PARAM; - goto err; + goto err_out; }
if (!vf->adq_enabled) { @@ -3353,15 +3353,15 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg) "VF %d: ADq is not enabled, can't apply cloud filter\n", vf->vf_id); aq_ret = I40E_ERR_PARAM; - goto err; + goto err_out; }
if (i40e_validate_cloud_filter(vf, vcf)) { dev_info(&pf->pdev->dev, "VF %d: Invalid input/s, can't apply cloud filter\n", vf->vf_id); - aq_ret = I40E_ERR_PARAM; - goto err; + aq_ret = I40E_ERR_PARAM; + goto err_out; }
cfilter = kzalloc(sizeof(*cfilter), GFP_KERNEL); @@ -3422,13 +3422,17 @@ static int i40e_vc_add_cloud_filter(struct i40e_vf *vf, u8 *msg) "VF %d: Failed to add cloud filter, err %s aq_err %s\n", vf->vf_id, i40e_stat_str(&pf->hw, ret), i40e_aq_str(&pf->hw, pf->hw.aq.asq_last_status)); - goto err; + goto err_free; }
INIT_HLIST_NODE(&cfilter->cloud_node); hlist_add_head(&cfilter->cloud_node, &vf->cloud_filter_list); + /* release the pointer passing it to the collection */ + cfilter = NULL; vf->num_cloud_filters++; -err: +err_free: + kfree(cfilter); +err_out: return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_ADD_CLOUD_FILTER, aq_ret); }
From: Martyna Szapar martyna.szapar@intel.com
[ Upstream commit 0b63644602cfcbac849f7ea49272a39e90fa95eb ]
Added freeing the old allocation of vf->qvlist_info in function i40e_config_iwarp_qvlist before overwriting it with the new allocation.
Fixes: e3219ce6a7754 ("i40e: Add support for client interface for IWARP driver") Signed-off-by: Martyna Szapar martyna.szapar@intel.com Tested-by: Andrew Bowers andrewx.bowers@intel.com Signed-off-by: Jeff Kirsher jeffrey.t.kirsher@intel.com Signed-off-by: Jesse Brandeburg jesse.brandeburg@intel.com --- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c index c19da0ff888e..bc4eda52372a 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c @@ -441,6 +441,7 @@ static int i40e_config_iwarp_qvlist(struct i40e_vf *vf, u32 v_idx, i, reg_idx, reg; u32 next_q_idx, next_q_type; u32 msix_vf, size; + int ret = 0;
msix_vf = pf->hw.func_caps.num_msix_vectors_vf;
@@ -449,16 +450,19 @@ static int i40e_config_iwarp_qvlist(struct i40e_vf *vf, "Incorrect number of iwarp vectors %u. Maximum %u allowed.\n", qvlist_info->num_vectors, msix_vf); - goto err; + ret = -EINVAL; + goto err_out; }
size = sizeof(struct virtchnl_iwarp_qvlist_info) + (sizeof(struct virtchnl_iwarp_qv_info) * (qvlist_info->num_vectors - 1)); + kfree(vf->qvlist_info); vf->qvlist_info = kzalloc(size, GFP_KERNEL); - if (!vf->qvlist_info) - return -ENOMEM; - + if (!vf->qvlist_info) { + ret = -ENOMEM; + goto err_out; + } vf->qvlist_info->num_vectors = qvlist_info->num_vectors;
msix_vf = pf->hw.func_caps.num_msix_vectors_vf; @@ -469,8 +473,10 @@ static int i40e_config_iwarp_qvlist(struct i40e_vf *vf, v_idx = qv_info->v_idx;
/* Validate vector id belongs to this vf */ - if (!i40e_vc_isvalid_vector_id(vf, v_idx)) - goto err; + if (!i40e_vc_isvalid_vector_id(vf, v_idx)) { + ret = -EINVAL; + goto err_free; + }
vf->qvlist_info->qv_info[i] = *qv_info;
@@ -512,10 +518,11 @@ static int i40e_config_iwarp_qvlist(struct i40e_vf *vf, }
return 0; -err: +err_free: kfree(vf->qvlist_info); vf->qvlist_info = NULL; - return -EINVAL; +err_out: + return ret; }
/**
On Fri, Aug 07, 2020 at 01:55:13PM -0700, Jesse Brandeburg wrote:
These stable fixes were not correctly noted as fixes when originally submitted for 5.2-rc1. We are addressing the internal gap that led to this miss.
Please consider these patches for all stable kernels older than 5.2.0, I tried on 4.19 and 3 out of 4 apply cleanly with a cherry pick from Linus' tree, but one of them I had to rebase, so I'm just sending the whole series.
If you'd rather I send one at a time in the format specified at option 2) of the stable documentation, please just let me know.
This works,, all queued up for 4.19.y now.
thanks,
greg k-h
linux-stable-mirror@lists.linaro.org
-
Greg KH -
Jesse Brandeburg