[Fwd: [PULL REQUEST] Please pull rdma.git]

[Fwd: [PULL REQUEST] Please pull rdma.git]

[Doug Ledford]

[-- Attachment #1.1: Type: text/plain, Size: 290 bytes --]

Forgot to Cc: people on this pull request to Linus...as soon as I hit
send I saw my mistake, sorry about that.

-- 
Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
    GPG KeyID: B826A3330E572FDD
    Key fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD

[-- Attachment #1.2: Forwarded message — [PULL REQUEST] Please pull rdma.git --]
[-- Type: message/rfc822, Size: 3943 bytes --]

[-- Attachment #1.2.1.1: Type: text/plain, Size: 2302 bytes --]

Hi Linus,

We had a few more items creep up over the last week.  Given we are in
-rc8, these are obviously limited to bugs that have a big downside and
for which we are certain of the fix.

The first is a straight up oops bug that all you have to do is read the
code to see it's a guaranteed 100% oops bug.

The second is a use-after-free issue.  We get away lucky if the queue we
are shutting down is empty, but if it isn't, we can end up oopsing.  We
really need to drain the queue before destroying it.

The final one is an issue with bad user input causing us to access our
port array out of bounds.  While fixing the array out of bounds issue,
it was noticed that the original code did the same thing twice (the call
to rdma_ah_set_port_num()), so its removal is not balanced by a readd
elsewhere, it was already where it needed to be in addition to where it
didn't need to be.

Anyway, here's the boilerplate:

The following changes since commit a1ffa4670cb97ae3a4b3e8535d88be5f643f7c3b:

  IB/srpt: Fix ACL lookup during login (2018-01-03 20:07:51 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git tags/for-linus

for you to fetch changes up to ae59c3f0b6cfd472fed96e50548a799b8971d876:

  RDMA/mlx5: Fix out-of-bound access while querying AH (2018-01-15 14:19:55 -0700)

----------------------------------------------------------------
Fifth pull request for 4.15-rc

- Oops fix in hfi1 driver
- Use-after-free issue in iser-target
- Use of user supplied array index without proper checking

----------------------------------------------------------------
Dan Carpenter (1):
      IB/hfi1: Prevent a NULL dereference

Leon Romanovsky (1):
      RDMA/mlx5: Fix out-of-bound access while querying AH

Sagi Grimberg (1):
      iser-target: Fix possible use-after-free in connection establishment error

 drivers/infiniband/hw/hfi1/file_ops.c   | 4 ++--
 drivers/infiniband/hw/mlx5/qp.c         | 7 +++----
 drivers/infiniband/ulp/isert/ib_isert.c | 1 +
 3 files changed, 6 insertions(+), 6 deletions(-)

-- 
Doug Ledford <dledford-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
    GPG KeyID: B826A3330E572FDD
    Key fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD

[-- Attachment #1.2.1.2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]