[5.17,049/343] mt76: dma: initialize skip_unmap in mt76_dma_rx_fill

From: Lorenzo Bianconi <lorenzo@kernel.org>

From: Lorenzo Bianconi <lorenzo@kernel.org>

[ Upstream commit 577298ec55dfc8b9aece54520f0258c3f93a6573 ]

Even if it is only a false-positive since skip_buf0/skip_buf1 are only
used in mt76_dma_tx_cleanup_idx routine, initialize skip_unmap in
mt76_dma_rx_fill in order to fix the following UBSAN report:

[   13.924906] UBSAN: invalid-load in linux-5.15.0/drivers/net/wireless/mediatek/mt76/dma.c:162:13
[   13.924909] load of value 225 is not a valid value for type '_Bool'
[   13.924912] CPU: 9 PID: 672 Comm: systemd-udevd Not tainted 5.15.0-18-generic #18-Ubuntu
[   13.924914] Hardware name: LENOVO 21A0000CMX/21A0000CMX, BIOS R1MET43W (1.13 ) 11/05/2021
[   13.924915] Call Trace:
[   13.924917]  <TASK>
[   13.924920]  show_stack+0x52/0x58
[   13.924925]  dump_stack_lvl+0x4a/0x5f
[   13.924931]  dump_stack+0x10/0x12
[   13.924932]  ubsan_epilogue+0x9/0x45
[   13.924934]  __ubsan_handle_load_invalid_value.cold+0x44/0x49
[   13.924935]  ? __iommu_dma_map+0x84/0xf0
[   13.924939]  mt76_dma_add_buf.constprop.0.cold+0x23/0x85 [mt76]
[   13.924949]  mt76_dma_rx_fill.isra.0+0x102/0x1f0 [mt76]
[   13.924954]  mt76_dma_init+0xc9/0x150 [mt76]
[   13.924959]  ? mt7921_dma_enable+0x110/0x110 [mt7921e]
[   13.924966]  mt7921_dma_init+0x1e3/0x260 [mt7921e]
[   13.924970]  mt7921_register_device+0x29d/0x510 [mt7921e]
[   13.924975]  mt7921_pci_probe.part.0+0x17f/0x1b0 [mt7921e]
[   13.924980]  mt7921_pci_probe+0x43/0x60 [mt7921e]
[   13.924984]  local_pci_probe+0x4b/0x90
[   13.924987]  pci_device_probe+0x115/0x1f0
[   13.924989]  really_probe+0x21e/0x420
[   13.924992]  __driver_probe_device+0x115/0x190
[   13.924994]  driver_probe_device+0x23/0xc0
[   13.924996]  __driver_attach+0xbd/0x1d0
[   13.924998]  ? __device_attach_driver+0x110/0x110
[   13.924999]  bus_for_each_dev+0x7e/0xc0
[   13.925001]  driver_attach+0x1e/0x20
[   13.925003]  bus_add_driver+0x135/0x200
[   13.925005]  driver_register+0x95/0xf0
[   13.925008]  ? 0xffffffffc0766000
[   13.925010]  __pci_register_driver+0x68/0x70
[   13.925011]  mt7921_pci_driver_init+0x23/0x1000 [mt7921e]
[   13.925015]  do_one_initcall+0x48/0x1d0
[   13.925019]  ? kmem_cache_alloc_trace+0x19e/0x2e0
[   13.925022]  do_init_module+0x62/0x280
[   13.925025]  load_module+0xac9/0xbb0
[   13.925027]  __do_sys_finit_module+0xbf/0x120
[   13.925029]  __x64_sys_finit_module+0x18/0x20
[   13.925030]  do_syscall_64+0x5c/0xc0
[   13.925033]  ? do_syscall_64+0x69/0xc0
[   13.925034]  ? sysvec_reschedule_ipi+0x78/0xe0
[   13.925036]  ? asm_sysvec_reschedule_ipi+0xa/0x20
[   13.925039]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   13.925040] RIP: 0033:0x7fbf2b90f94d
[   13.925045] RSP: 002b:00007ffe2ec7e5d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[   13.925047] RAX: ffffffffffffffda RBX: 000056106b0634e0 RCX: 00007fbf2b90f94d
[   13.925048] RDX: 0000000000000000 RSI: 00007fbf2baa3441 RDI: 0000000000000013
[   13.925049] RBP: 0000000000020000 R08: 0000000000000000 R09: 0000000000000002
[   13.925050] R10: 0000000000000013 R11: 0000000000000246 R12: 00007fbf2baa3441
[   13.925051] R13: 000056106b062620 R14: 000056106b0610c0 R15: 000056106b0640d0
[   13.925053]  </TASK>

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/dma.c | 1 +
 1 file changed, 1 insertion(+)

Message ID	20220412062952.522211251@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Lorenzo Bianconi <lorenzo@kernel.org>, Felix Fietkau <nbd@nbd.name>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.17 049/343] mt76: dma: initialize skip_unmap in mt76_dma_rx_fill Date: Tue, 12 Apr 2022 08:27:47 +0200 Message-Id: <20220412062952.522211251@linuxfoundation.org> In-Reply-To: <20220412062951.095765152@linuxfoundation.org> References: <20220412062951.095765152@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.17,005/343] mm: kfence: fix objcgs vector allocation [5.17,007/343] KVM: SVM: Fix kvm_cache_regs.h inclusions for is_guest_mode() [5.17,012/343] Bluetooth: hci_sync: Fix compilation warning [5.17,013/343] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 [5.17,014/343] Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt [5.17,015/343] drm/amd/display: Add signal type check when verify stream backends same [5.17,016/343] drm/amdkfd: enable heavy-weight TLB flush on Arcturus [5.17,017/343] drm/edid: remove non_desktop quirk for HPN-3515 and LEN-B800. [5.17,023/343] usb: gadget: tegra-xudc: Do not program SPARAM [5.17,027/343] Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set [5.17,031/343] drm/amdkfd: Ensure mm remain valid in svm deferred_list work [5.17,034/343] mlxsw: spectrum: Guard against invalid local ports [5.17,035/343] RDMA/rtrs-clt: Do stop and failover outside reconnect work. [5.17,037/343] powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 [5.17,039/343] ath11k: pci: fix crash on suspend if board file is not found [5.17,040/343] ath11k: mhi: use mhi_sync_power_up() [5.17,042/343] drm/bridge: Add missing pm_runtime_put_sync [5.17,043/343] bpf: Make dst_port field in struct bpf_sock 16-bit wide [5.17,045/343] scsi: bfa: Replace snprintf() with sysfs_emit() [5.17,046/343] drm/v3d: fix missing unlock [5.17,047/343] power: supply: axp20x_battery: properly report current when discharging [5.17,048/343] mt76: mt7921: fix crash when startup fails. [5.17,049/343] mt76: dma: initialize skip_unmap in mt76_dma_rx_fill [5.17,050/343] i40e: Add sending commands in atomic context [5.17,054/343] ref_tracker: implement use-after-free detection [5.17,058/343] scsi: smartpqi: Fix rmmod stack trace [5.17,059/343] scsi: smartpqi: Fix kdump issue when controller is locked up [5.17,060/343] PCI: aardvark: Fix support for MSI interrupts [5.17,063/343] kvm: selftests: aarch64: fix the failure check in kvm_set_gsi_routing_irqchip_check [5.17,064/343] kvm: selftests: aarch64: fix some vgic related comments [5.17,066/343] iommu/arm-smmu-v3: fix event handling soft lockup [5.17,068/343] KVM: arm64: Do not change the PMU event filter after a VCPU has run [5.17,071/343] libbpf: Fix accessing the first syscall argument on s390 [5.17,074/343] PCI: pciehp: Add Qualcomm quirk for Command Completed erratum [5.17,076/343] scsi: mpi3mr: Fix reporting of actual data transfer size [5.17,078/343] powerpc/set_memory: Avoid spinlock recursion in change_page_attr() [5.17,082/343] drm/amd/display: reset lane settings after each PHY repeater LT [5.17,086/343] usb: dwc3: pci: Set the swnode from inside dwc3_pci_quirks() [5.17,087/343] iwlwifi: mvm: Correctly set fragmented EBS [5.17,091/343] drm/msm/dsi: Remove spurious IRQF_ONESHOT flag [5.17,093/343] rtw89: fix RCU usage in rtw89_core_txq_push() [5.17,095/343] ipv4: Invalidate neighbour for broadcast address upon address addition [5.17,097/343] dm ioctl: prevent potential spectre v1 gadget [5.17,098/343] dm: requeue IO if mapping table not yet available [5.17,099/343] drm/amdkfd: make CRAT table missing message informational only [5.17,100/343] vfio/pci: Stub vfio_pci_vga_rw when !CONFIG_VFIO_PCI_VGA [5.17,102/343] scsi: pm8001: Fix pm8001_mpi_task_abort_resp() [5.17,104/343] scsi: pm8001: Fix task leak in pm8001_send_abort_all() [5.17,106/343] scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() [5.17,108/343] mctp: make __mctp_dev_get() take a refcount hold [5.17,110/343] mt76: mt7615: Fix assigning negative values to unsigned variable [5.17,113/343] scsi: aha152x: Fix aha152x_setup() __setup handler return value [5.17,114/343] scsi: hisi_sas: Free irq vectors in order for v3 HW [5.17,116/343] net/smc: correct settings of RMB window update limit [5.17,117/343] mips: ralink: fix a refcount leak in ill_acc_of_setup() [5.17,119/343] macvtap: advertise link netns via netlink [5.17,121/343] tuntap: add sanity checks about msg_controllen in sendmsg [5.17,123/343] Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg} [5.17,125/343] bnxt_en: Eliminate unintended link toggle during FW reset [5.17,126/343] PCI: endpoint: Fix misused goto label [5.17,127/343] MIPS: fix fortify panic when copying asm exception handlers [5.17,128/343] powerpc/code-patching: Pre-map patch area [5.17,131/343] scsi: libfc: Fix use after free in fc_exch_abts_resp() [5.17,132/343] platform/x86: x86-android-tablets: Depend on EFI and SPI [5.17,134/343] can: etas_es58x: es58x_fd_rx_event_msg(): initialize rx_event_msg before calling e... [5.17,136/343] net: account alternate interface name memory [5.17,138/343] net/mlx5e: Remove overzealous validations in netlink EEPROM query [5.17,140/343] platform/x86: hp-wmi: Fix 0x05 error code reported by several WMI calls [5.17,141/343] net: sfp: add 2500base-X quirk for Lantech SFP module [5.17,143/343] xen/usb: harden xen_hcd against malicious backends [5.17,146/343] iwlwifi: mei: fix building iwlmei [5.17,147/343] MIPS: ingenic: correct unit node address [5.17,151/343] ceph: fix inode reference leakage in ceph_get_snapdir() [5.17,153/343] lib/Kconfig.debug: add ARCH dependency for FUNCTION_ALIGN option [5.17,154/343] init/main.c: return 1 from handled __setup() functions [5.17,155/343] minix: fix bug when opening a file with O_DIRECT [5.17,157/343] clk: mediatek: Fix memory leaks on probe [5.17,163/343] clk: rockchip: drop CLK_SET_RATE_PARENT from dclk_vop* on rk3568 [5.17,164/343] cpufreq: CPPC: Fix performance/frequency conversion [5.17,166/343] staging: wfx: apply the necessary SDIO quirks for the Silabs WF200 [5.17,167/343] staging: wfx: fix an error handling in wfx_init_common() [5.17,168/343] w1: w1_therm: fixes w1_seq for ds28ea00 sensors [5.17,171/343] habanalabs: fix possible memory leak in MMU DR fini [5.17,173/343] habanalabs/gaudi: handle axi errors from NIC engines [5.17,174/343] xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 [5.17,175/343] clk: ti: Preserve node in ti_dt_clocks_register() [5.17,178/343] SUNRPC: remove scheduling boost for "SWAPPER" tasks. [5.17,179/343] NFS: swap IO handling is slightly different for O_DIRECT IO [5.17,180/343] NFS: swap-out must always use STABLE writes. [5.17,183/343] serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() [5.17,184/343] virtio_console: eliminate anonymous module_init & module_exit [5.17,186/343] SUNRPC: Fix socket waits for write buffer space [5.17,188/343] NFS: Avoid writeback threads getting stuck in mempool_alloc() [5.17,190/343] parisc: Fix CPU affinity for Lasi, WAX and Dino chips [5.17,192/343] mm: fix race between MADV_FREE reclaim and blkdev direct IO read [5.17,195/343] Drivers: hv: vmbus: Fix potential crash on module unload [5.17,197/343] Revert "NFSv4: Handle the special Linux file open access mode" [5.17,199/343] scsi: core: scsi_logging: Fix a BUG [5.17,200/343] scsi: sr: Fix typo in CDROM(CLOSETRAY\|EJECT) handling [5.17,201/343] scsi: core: Fix sbitmap depth in scsi_realloc_sdev_budget_map() [5.17,202/343] scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() [5.17,204/343] net: sfc: add missing xdp queue reinitialization [5.17,205/343] net/tls: fix slab-out-of-bounds bug in decrypt_internal [5.17,209/343] ice: Clear default forwarding VSI during VSI release [5.17,210/343] ice: Fix MAC address setting [5.17,211/343] mctp: Fix check for dev_hard_header() result [5.17,212/343] mctp: Use output netdev to allocate skb headroom [5.17,215/343] drm/imx: imx-ldb: Check for null pointer after calling kmemdup [5.17,216/343] drm/imx: Fix memory leak in imx_pd_connector_get_modes [5.17,219/343] spi: rpc-if: Fix RPM imbalance in probe error path [5.17,226/343] RDMA/mlx5: Dont remove cache MRs when a delay is needed [5.17,227/343] RDMA/mlx5: Add a missing update of cache->last_add [5.17,228/343] IB/cm: Cancel mad on the DREQ event when the state is MRA_REP_RCVD [5.17,232/343] dpaa2-ptp: Fix refcount leak in dpaa2_ptp_probe [5.17,234/343] ice: Do not skip not enabled queues in ice_vc_dis_qs_msg [5.17,237/343] ice: xsk: fix VSI state check in ice_xsk_wakeup() [5.17,243/343] net: sfc: fix using uninitialized xdp tx_queue [5.17,244/343] net: phy: mscc-miim: reject clause 45 register accesses [5.17,245/343] qede: confirm skb is allocated before using [5.17,246/343] spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op() [5.17,249/343] bpf: Support dual-stack sockets in bpf_tcp_check_syncookie [5.17,250/343] drbd: Fix five use after free bugs in get_initial_state [5.17,256/343] SUNRPC: Handle low memory situations in call_status() [5.17,257/343] SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() [5.17,260/343] perf: arm-spe: Fix perf report --mem-mode [5.17,261/343] perf tools: Fix perfs libperf_print callback [5.17,262/343] perf session: Remap buf if there is no space for event [5.17,264/343] scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove() [5.17,266/343] Revert "mmc: sdhci-xenon: fix annoying 1.8V regulator warning" [5.17,267/343] mmc: block: Check for errors after write on SPI [5.17,268/343] mmc: mmci: stm32: correctly check all elements of sg list [5.17,269/343] mmc: renesas_sdhi: special 4tap settings only apply to HS400 [5.17,271/343] mmc: core: Fixup support for writeback-cache for eMMC and SD [5.17,276/343] io_uring: dont check req->file in io_fsync_prep() [5.17,277/343] io_uring: defer splice/tee file validity check until command issue [5.17,279/343] io_uring: fix race between timeout flush and removal [5.17,280/343] x86/pm: Save the MSR validity status at context setup [5.17,283/343] btrfs: fix qgroup reserve overflow the qgroup limit [5.17,284/343] btrfs: zoned: traverse devices under chunk_mutex in btrfs_can_activate_zone [5.17,286/343] btrfs: avoid defragging extents whose next extents are not targets [5.17,288/343] spi: core: add dma_map_dev for __spi_unmap_msg() [5.17,289/343] cifs: force new session setup and tcon for dfs [5.17,291/343] arm64: patch_text: Fixup last cpu should be master [5.17,293/343] drbd: fix an invalid memory access caused by incorrect use of list iterator [5.17,295/343] x86/msi: Fix msi message data shadow struct [5.17,296/343] x86/mm/tlb: Revert retpoline avoidance approach [5.17,298/343] ata: sata_dwc_460ex: Fix crash due to OOB write [5.17,300/343] perf/core: Inherit event_caps [5.17,301/343] irqchip/gic-v3: Fix GICR_CTLR.RWP polling [5.17,305/343] drm/amd/display: Fix by adding FPU protection for dcn30_internal_validate_bw [5.17,307/343] drm/amdgpu/smu10: fix SoC/fclk units in auto mode [5.17,308/343] drm/amdgpu/vcn: Fix the register setting for vcn1 [5.17,311/343] drm/amdgpu: dont use BACO for reset in S3 [5.17,312/343] SUNRPC: Ensure we flush any closed sockets before xs_xprt_free() [5.17,313/343] Revert "ACPI: processor: idle: Only flush cache on entering C3" [5.17,315/343] net/smc: send directly on setting TCP_NODELAY [5.17,316/343] Revert "selftests: net: Add tls config dependency for tls selftests" [5.17,319/343] bpf: Treat bpf_sk_lookup remote_port as a 2-byte field [5.17,323/343] tools build: Use $(shell ) instead of `` to get embedded libperls ccopts [5.17,324/343] dmaengine: Revert "dmaengine: shdma: Fix runtime PM imbalance on error" [5.17,326/343] Drivers: hv: vmbus: Replace smp_store_mb() with virt_store_mb() [5.17,327/343] powerpc: Fix virt_addr_valid() for 64-bit Book3E & 32-bit [5.17,329/343] x86/bug: Prevent shadowing in __WARN_FLAGS [5.17,330/343] objtool: Fix SLS validation for kcov tail-call replacement [5.17,331/343] sched/core: Fix forceidle balancing [5.17,333/343] x86,static_call: Fix __static_call_return0 for i386 [5.17,335/343] irqchip/gic-v4: Wait for GICR_VPENDBASER.Dirty to clear before descheduling [5.17,336/343] powerpc/64: Fix build failure with allyesconfig in book3s_64_entry.S [5.17,338/343] mm/sparsemem: fix mem_section will never be NULL gcc 12 warning [5.17,343/343] io_uring: drop the old style inflight file tracking

[5.17,049/343] mt76: dma: initialize skip_unmap in mt76_dma_rx_fill

Commit Message

Patch