diff mbox series

[5.10,057/530] mt76: fix potential DMA mapping leak

Message ID	20210512144821.605251052@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Felix Fietkau <nbd@nbd.name> Subject: [PATCH 5.10 057/530] mt76: fix potential DMA mapping leak Date: Wed, 12 May 2021 16:42:47 +0200 Message-Id: <20210512144821.605251052@linuxfoundation.org> In-Reply-To: <20210512144819.664462530@linuxfoundation.org> References: <20210512144819.664462530@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,002/530] bluetooth: eliminate the potential race condition when removing the HCI controller [5.10,003/530] net/nfc: fix use-after-free llcp_sock_bind/connect [5.10,004/530] io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers [5.10,005/530] Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL" [5.10,006/530] usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() [5.10,007/530] tty: moxa: fix TIOCSSERIAL jiffies conversions [5.10,008/530] tty: amiserial: fix TIOCSSERIAL permission check [5.10,009/530] USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions [5.10,010/530] staging: greybus: uart: fix TIOCSSERIAL jiffies conversions [5.10,011/530] USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check [5.10,012/530] staging: fwserial: fix TIOCSSERIAL jiffies conversions [5.10,013/530] tty: moxa: fix TIOCSSERIAL permission check [5.10,014/530] staging: fwserial: fix TIOCSSERIAL permission check [5.10,015/530] drm: bridge: fix LONTIUM use of mipi_dsi_() functions [5.10,016/530] usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply [5.10,017/530] usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply [5.10,018/530] usb: typec: tcpm: update power supply once partner accepts [5.10,019/530] usb: xhci-mtk: remove or operator for setting schedule parameters [5.10,020/530] usb: xhci-mtk: improve bandwidth scheduling with TT [5.10,021/530] ASoC: samsung: tm2_wm5110: check of of_parse return value [5.10,022/530] ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function [5.10,023/530] ASoC: tlv320aic32x4: Register clocks before registering component [5.10,024/530] ASoC: tlv320aic32x4: Increase maximum register in regmap [5.10,025/530] MIPS: pci-mt7620: fix PLL lock check [5.10,026/530] MIPS: pci-rt2880: fix slot 0 configuration [5.10,027/530] FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR [5.10,028/530] PCI: Allow VPD access for QLogic ISP2722 [5.10,029/530] KVM: x86: Defer the MMU unload to the normal path on an global INVPCID [5.10,030/530] PCI: xgene: Fix cfg resource mapping [5.10,031/530] PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c [5.10,032/530] PM / devfreq: Unlock mutex and free devfreq struct in error path [5.10,033/530] soc/tegra: regulators: Fix locking up when voltage-spread is out of range [5.10,034/530] iio: inv_mpu6050: Fully validate gyro and accel scale writes [5.10,035/530] iio:accel:adis16201: Fix wrong axis assignment that prevents loading [5.10,036/530] iio:adc:ad7476: Fix remove handling [5.10,037/530] sc16is7xx: Defer probe if device read fails [5.10,038/530] phy: cadence: Sierra: Fix PHY power_on sequence [5.10,039/530] misc: lis3lv02d: Fix false-positive WARN on various HP models [5.10,040/530] phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create() [5.10,041/530] misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct [5.10,042/530] misc: vmw_vmci: explicitly initialize vmci_datagram payload [5.10,043/530] selinux: add proper NULL termination to the secclass_map permissions [5.10,044/530] x86, sched: Treat Intel SNC topology as default, COD as exception [5.10,045/530] async_xor: increase src_offs when dropping destination page [5.10,046/530] md/bitmap: wait for external bitmap writes to complete during tear down [5.10,047/530] md-cluster: fix use-after-free issue when removing rdev [5.10,048/530] md: split mddev_find [5.10,049/530] md: factor out a mddev_find_locked helper from mddev_find [5.10,050/530] md: md_open returns -EBUSY when entering racing area [5.10,051/530] md: Fix missing unused status line of /proc/mdstat [5.10,052/530] MIPS: Reinstate platform `__div64_32 handler [5.10,053/530] mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put() [5.10,054/530] ipw2x00: potential buffer overflow in libipw_wx_set_encodeext() [5.10,055/530] cfg80211: scan: drop entry from hidden_list on overflow [5.10,056/530] rtw88: Fix array overrun in rtw_get_tx_power_params() [5.10,057/530] mt76: fix potential DMA mapping leak [5.10,058/530] FDDI: defxx: Make MMIO the configuration default except for EISA [5.10,059/530] drm/i915/gvt: Fix virtual display setup for BXT/APL [5.10,060/530] drm/i915/gvt: Fix vfio_edid issue for BXT/APL [5.10,061/530] drm/qxl: use ttm bo priorities [5.10,062/530] drm/panfrost: Clear MMU irqs before handling the fault [5.10,063/530] drm/panfrost: Dont try to map pages that are already mapped [5.10,064/530] drm/radeon: fix copy of uninitialized variable back to userspace [5.10,065/530] drm/dp_mst: Revise broadcast msg lct & lcr [5.10,066/530] drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast [5.10,067/530] drm: bridge/panel: Cleanup connector on bridge detach [5.10,068/530] drm/amd/display: Reject non-zero src_y and src_x for video planes [5.10,069/530] drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2 [5.10,070/530] ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries [5.10,071/530] ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries [5.10,072/530] ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries [5.10,073/530] ALSA: hda/realtek: Re-order ALC269 HP quirk table entries [5.10,074/530] ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries [5.10,075/530] ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries [5.10,076/530] ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries [5.10,077/530] ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries [5.10,078/530] ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries [5.10,079/530] ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries [5.10,080/530] ALSA: hda/realtek: Re-order ALC662 quirk table entries [5.10,081/530] ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices [5.10,082/530] ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable [5.10,083/530] ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32 [5.10,084/530] KVM: s390: VSIE: correctly handle MVPG when in VSIE [5.10,085/530] KVM: s390: split kvm_s390_logical_to_effective [5.10,086/530] KVM: s390: fix guarded storage control register handling [5.10,087/530] s390: fix detection of vector enhancements facility 1 vs. vector packed decimal fa... [5.10,088/530] KVM: s390: VSIE: fix MVPG handling for prefixing and MSO [5.10,089/530] KVM: s390: split kvm_s390_real_to_abs [5.10,090/530] KVM: s390: extend kvm_s390_shadow_fault to return entry pointer [5.10,091/530] KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit [5.10,092/530] KVM: x86: Remove emulators broken checks on CR0/CR3/CR4 loads [5.10,093/530] KVM: nSVM: Set the shadow root level to the TDP level for nested NPT [5.10,094/530] KVM: SVM: Dont strip the C-bit from CR2 on #PF interception [5.10,095/530] KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created [5.10,096/530] KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported [5.10,097/530] KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch [5.10,098/530] KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit [5.10,099/530] KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit [5.10,100/530] KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read [5.10,101/530] KVM: Destroy I/O bus devices on unregister failure _after_ syncing SRCU [5.10,102/530] KVM: Stop looking for coalesced MMIO zones if the bus is destroyed [5.10,103/530] KVM: arm64: Fully zero the vcpu state on reset [5.10,104/530] KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read [5.10,105/530] Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit" [5.10,106/530] Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" [5.10,107/530] ovl: fix missing revert_creds() on error path [5.10,108/530] Revert "drm/qxl: do not run release if qxl failed to init" [5.10,109/530] usb: gadget: pch_udc: Revert d3cb25a12138 completely [5.10,110/530] Revert "tools/power turbostat: adjust for temperature offset" [5.10,111/530] firmware: xilinx: Fix dereferencing freed memory [5.10,112/530] firmware: xilinx: Add a blank line after function declaration [5.10,113/530] firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FI... [5.10,114/530] fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER [5.10,115/530] crypto: sun8i-ss - fix result memory leak on error path [5.10,116/530] memory: gpmc: fix out of bounds read and dereference on gpmc_cs[] [5.10,117/530] ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100 [5.10,118/530] ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family [5.10,119/530] ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family [5.10,120/530] ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family [5.10,121/530] ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family [5.10,122/530] ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250 [5.10,123/530] ARM: dts: exynos: correct PMIC interrupt trigger level on Snow [5.10,124/530] ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family [5.10,125/530] ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files [5.10,126/530] arm64: dts: renesas: Add mmc aliases into board dts files [5.10,127/530] x86/platform/uv: Set section block size for hubless architectures [5.10,128/530] serial: stm32: fix code cleaning warnings and checks [5.10,129/530] serial: stm32: add "_usart" prefix in functions name [5.10,130/530] serial: stm32: fix probe and remove order for dma [5.10,131/530] serial: stm32: Use of_device_get_match_data() [5.10,132/530] serial: stm32: fix startup by enabling usart for reception [5.10,133/530] serial: stm32: fix incorrect characters on console [5.10,134/530] serial: stm32: fix TX and RX FIFO thresholds [5.10,135/530] serial: stm32: fix a deadlock condition with wakeup event [5.10,136/530] serial: stm32: fix wake-up flag handling [5.10,137/530] serial: stm32: fix a deadlock in set_termios [5.10,138/530] serial: stm32: fix tx dma completion, release channel [5.10,139/530] serial: stm32: call stm32_transmit_chars locked [5.10,140/530] serial: stm32: fix FIFO flush in startup and set_termios [5.10,141/530] serial: stm32: add FIFO flush when port is closed [5.10,142/530] serial: stm32: fix tx_empty condition [5.10,143/530] usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS [5.10,144/530] usb: typec: tps6598x: Fix return value check in tps6598x_probe() [5.10,145/530] usb: typec: stusb160x: fix return value check in stusb160x_probe() [5.10,146/530] regmap: set debugfs_name to NULL after it is freed [5.10,147/530] spi: rockchip: avoid objtool warning [5.10,148/530] mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe() [5.10,149/530] mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC [5.10,150/530] mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions() [5.10,151/530] mtd: rawnand: qcom: Return actual error code instead of -ENODEV [5.10,152/530] mtd: dont lock when recursively deleting partitions [5.10,153/530] mtd: maps: fix error return code of physmap_flash_remove() [5.10,154/530] ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control [5.10,155/530] arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity [5.10,156/530] arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer [5.10,157/530] arm64: dts: qcom: sdm845: fix number of pins in gpio-ranges [5.10,158/530] arm64: dts: qcom: sm8150: fix number of pins in gpio-ranges [5.10,159/530] arm64: dts: qcom: sm8250: fix number of pins in gpio-ranges [5.10,160/530] arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x [5.10,161/530] crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map [5.10,162/530] spi: stm32: drop devres version of spi_register_master [5.10,163/530] regulator: bd9576: Fix return from bd957x_probe() [5.10,164/530] arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding [5.10,165/530] spi: stm32: Fix use-after-free on unbind [5.10,166/530] x86/microcode: Check for offline CPUs before requesting new microcode [5.10,167/530] devtmpfs: fix placement of complete() call [5.10,168/530] usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits() [5.10,169/530] usb: gadget: pch_udc: Check if driver is present before calling ->setup() [5.10,170/530] usb: gadget: pch_udc: Check for DMA mapping error [5.10,171/530] usb: gadget: pch_udc: Initialize device pointer before use [5.10,172/530] usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard (v1) [5.10,173/530] crypto: ccp - fix command queuing to TEE ring buffer [5.10,174/530] crypto: qat - dont release uninitialized resources [5.10,175/530] crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init [5.10,176/530] fotg210-udc: Fix DMA on EP0 for length > max packet size [5.10,177/530] fotg210-udc: Fix EP0 IN requests bigger than two packets [5.10,178/530] fotg210-udc: Remove a dubious condition leading to fotg210_done [5.10,179/530] fotg210-udc: Mask GRP2 interrupts we dont handle [5.10,180/530] fotg210-udc: Dont DMA more than the buffer can take [5.10,181/530] fotg210-udc: Complete OUT requests on short packets [5.10,182/530] usb: gadget: s3c: Fix incorrect resources releasing [5.10,183/530] usb: gadget: s3c: Fix the error handling path in s3c2410_udc_probe() [5.10,184/530] dt-bindings: serial: stm32: Use type: object instead of false for additionalProper... [5.10,185/530] mtd: require write permissions for locking and badblock ioctls [5.10,186/530] arm64: dts: renesas: r8a779a0: Fix PMU interrupt [5.10,187/530] bus: qcom: Put child node before return [5.10,188/530] soundwire: bus: Fix device found flag correctly [5.10,189/530] phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup [5.10,190/530] phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally [5.10,191/530] arm64: dts: mediatek: fix reset GPIO level on pumpkin [5.10,192/530] NFSD: Fix sparse warning in nfs4proc.c [5.10,193/530] NFSv4.2: fix copy stateid copying for the async copy [5.10,194/530] crypto: poly1305 - fix poly1305_core_setkey() declaration [5.10,195/530] crypto: qat - fix error path in adf_isr_resource_alloc() [5.10,196/530] usb: gadget: aspeed: fix dma map failure [5.10,197/530] USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR() [5.10,198/530] drivers: nvmem: Fix voltage settings for QTI qfprom-efuse [5.10,199/530] driver core: platform: Declare early_platform_cleanup() prototype [5.10,200/530] memory: pl353: fix mask of ECC page_size config register [5.10,201/530] soundwire: stream: fix memory leak in stream config error path [5.10,202/530] m68k: mvme147,mvme16x: Dont wipe PCC timer config bits [5.10,203/530] firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool [5.10,204/530] firmware: qcom_scm: Reduce locking section for __get_convention() [5.10,205/530] firmware: qcom_scm: Workaround lack of "is available" call on SC7180 [5.10,206/530] iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol [5.10,207/530] mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init [5.10,208/530] irqchip/gic-v3: Fix OF_BAD_ADDR error handling [5.10,209/530] staging: comedi: tests: ni_routes_test: Fix compilation error [5.10,210/530] staging: rtl8192u: Fix potential infinite loop [5.10,211/530] staging: fwserial: fix TIOCSSERIAL implementation [5.10,212/530] staging: fwserial: fix TIOCGSERIAL implementation [5.10,213/530] staging: greybus: uart: fix unprivileged TIOCCSERIAL [5.10,214/530] soc: qcom: pdr: Fix error return code in pdr_register_listener [5.10,215/530] PM / devfreq: Use more accurate returned new_freq as resume_freq [5.10,216/530] clocksource/drivers/timer-ti-dm: Fix posted mode status check order [5.10,217/530] clocksource/drivers/timer-ti-dm: Add missing set_state_oneshot_stopped [5.10,218/530] clocksource/drivers/ingenic_ost: Fix return value check in ingenic_ost_probe() [5.10,219/530] spi: Fix use-after-free with devm_spi_alloc_* [5.10,220/530] spi: fsl: add missing iounmap() on error in of_fsl_spi_probe() [5.10,221/530] soc: qcom: mdt_loader: Validate that p_filesz < p_memsz [5.10,222/530] soc: qcom: mdt_loader: Detect truncated read of segments [5.10,223/530] PM: runtime: Replace inline function pm_runtime_callbacks_present() [5.10,224/530] cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration [5.10,225/530] ACPI: CPPC: Replace cppc_attr with kobj_attribute [5.10,226/530] crypto: allwinner - add missing CRYPTO_ prefix [5.10,227/530] crypto: sun8i-ss - Fix memory leak of pad [5.10,228/530] crypto: sa2ul - Fix memory leak of rxd [5.10,229/530] crypto: qat - Fix a double free in adf_create_ring [5.10,230/530] cpufreq: armada-37xx: Fix setting TBG parent for load levels [5.10,231/530] clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock [5.10,232/530] cpufreq: armada-37xx: Fix the AVS value for load L1 [5.10,233/530] clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz [5.10,234/530] clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0 [5.10,235/530] cpufreq: armada-37xx: Fix driver cleanup when registration failed [5.10,236/530] cpufreq: armada-37xx: Fix determining base CPU frequency [5.10,237/530] spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make zynqmp_qspi_exec_op... [5.10,238/530] spi: spi-zynqmp-gqspi: add mutex locking for exec_op [5.10,239/530] spi: spi-zynqmp-gqspi: transmit dummy circles by using the controllers internal fu... [5.10,240/530] spi: spi-zynqmp-gqspi: fix incorrect operating mode in zynqmp_qspi_read_op [5.10,241/530] spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware() [5.10,242/530] usb: gadget: r8a66597: Add missing null check on return from platform_get_resource [5.10,243/530] USB: cdc-acm: fix unprivileged TIOCCSERIAL [5.10,244/530] USB: cdc-acm: fix TIOCGSERIAL implementation [5.10,245/530] tty: actually undefine superseded ASYNC flags [5.10,246/530] tty: fix return value for unsupported ioctls [5.10,247/530] tty: Remove dead termiox code [5.10,248/530] tty: fix return value for unsupported termiox ioctls [5.10,249/530] serial: core: return early on unsupported ioctls [5.10,250/530] firmware: qcom-scm: Fix QCOM_SCM configuration [5.10,251/530] node: fix device cleanups in error handling code [5.10,252/530] crypto: chelsio - Read rxchannel-id from firmware [5.10,253/530] usbip: vudc: fix missing unlock on error in usbip_sockfd_store() [5.10,254/530] m68k: Add missing mmap_read_lock() to sys_cacheflush() [5.10,255/530] spi: spi-zynqmp-gqspi: Fix missing unlock on error in zynqmp_qspi_exec_op() [5.10,256/530] memory: renesas-rpc-if: fix possible NULL pointer dereference of resource [5.10,257/530] memory: samsung: exynos5422-dmc: handle clk_set_parent() failure [5.10,258/530] security: keys: trusted: fix TPM2 authorizations [5.10,259/530] platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk... [5.10,260/530] ARM: dts: aspeed: Rainier: Fix humidity sensor bus address [5.10,261/530] Drivers: hv: vmbus: Use after free in __vmbus_open() [5.10,262/530] spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue [5.10,263/530] spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume [5.10,264/530] spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op [5.10,265/530] spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails [5.10,266/530] x86/platform/uv: Fix !KEXEC build failure [5.10,267/530] hwmon: (pmbus/pxe1610) dont bail out when not all pages are active [5.10,268/530] Drivers: hv: vmbus: Increase wait time for VMbus unload [5.10,269/530] PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check [5.10,270/530] usb: dwc2: Fix host mode hibernation exit with remote wakeup flow. [5.10,271/530] usb: dwc2: Fix hibernation between host and device modes. [5.10,272/530] ttyprintk: Add TTY hangup callback. [5.10,273/530] serial: omap: dont disable rs485 if rts gpio is missing [5.10,274/530] serial: omap: fix rs485 half-duplex filtering [5.10,275/530] xen-blkback: fix compatibility bug with single page rings [5.10,276/530] soc: aspeed: fix a ternary sign expansion bug [5.10,277/530] drm/tilcdc: send vblank event when disabling crtc [5.10,278/530] drm/stm: Fix bus_flags handling [5.10,279/530] drm/amd/display: Fix off by one in hdmi_14_process_transaction() [5.10,280/530] drm/mcde/panel: Inverse misunderstood flag [5.10,281/530] sched/fair: Fix shift-out-of-bounds in load_balance() [5.10,282/530] afs: Fix updating of i_mode due to 3rd party change [5.10,283/530] rcu: Remove spurious instrumentation_end() in rcu_nmi_enter() [5.10,284/530] media: vivid: fix assignment of dev->fbuf_out_flags [5.10,285/530] media: saa7134: use sg_dma_len when building pgtable [5.10,286/530] media: saa7146: use sg_dma_len when building pgtable [5.10,287/530] media: omap4iss: return error code when omap4iss_get() failed [5.10,288/530] media: rkisp1: rsz: crash fix when setting src format [5.10,289/530] media: aspeed: fix clock handling logic [5.10,290/530] drm/probe-helper: Check epoch counter in output_poll_execute() [5.10,291/530] media: venus: core: Fix some resource leaks in the error path of venus_probe() [5.10,292/530] media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_stre... [5.10,293/530] media: m88ds3103: fix return value check in m88ds3103_probe() [5.10,294/530] media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30 [5.10,295/530] media: [next] staging: media: atomisp: fix memory leak of object flash [5.10,296/530] media: atomisp: Fixed error handling path [5.10,297/530] media: m88rs6000t: avoid potential out-of-bounds reads on arrays [5.10,298/530] media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() [5.10,299/530] drm/amdkfd: fix build error with AMD_IOMMU_V2=m [5.10,300/530] of: overlay: fix for_each_child.cocci warnings [5.10,301/530] x86/kprobes: Fix to check non boostable prefixes correctly [5.10,302/530] selftests: fix prepending $(OUTPUT) to $(TEST_PROGS) [5.10,303/530] pata_arasan_cf: fix IRQ check [5.10,304/530] pata_ipx4xx_cf: fix IRQ check [5.10,305/530] sata_mv: add IRQ checks [5.10,306/530] ata: libahci_platform: fix IRQ check [5.10,307/530] seccomp: Fix CONFIG tests for Seccomp_filters [5.10,308/530] nvme-tcp: block BH in sk state_change sk callback [5.10,309/530] nvmet-tcp: fix incorrect locking in state_change sk callback [5.10,310/530] clk: imx: Fix reparenting of UARTs not associated with stdout [5.10,311/530] power: supply: bq25980: Move props from battery node [5.10,312/530] nvme: retrigger ANA log update if group descriptor isnt found [5.10,313/530] media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from im... [5.10,314/530] media: i2c: imx219: Balance runtime PM use-count [5.10,315/530] media: v4l2-ctrls.c: fix race condition in hdl->requests list [5.10,316/530] vfio/fsl-mc: Re-order vfio_fsl_mc_probe() [5.10,317/530] vfio/pci: Move VGA and VF initialization to functions [5.10,318/530] vfio/pci: Re-order vfio_pci_probe() [5.10,319/530] vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer [5.10,320/530] clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback [5.10,321/530] clk: zynqmp: pll: add set_pll_mode to check condition in zynqmp_pll_enable [5.10,322/530] drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train() [5.10,323/530] clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE [5.10,324/530] clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE [5.10,325/530] drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct [5.10,326/530] drm/radeon: Fix a missing check bug in radeon_dp_mst_detect() [5.10,327/530] clk: uniphier: Fix potential infinite loop [5.10,328/530] scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check() [5.10,329/530] scsi: pm80xx: Fix potential infinite loop [5.10,330/530] scsi: ufs: ufshcd-pltfrm: Fix deferred probing [5.10,331/530] scsi: hisi_sas: Fix IRQ checks [5.10,332/530] scsi: jazz_esp: Add IRQ check [5.10,333/530] scsi: sun3x_esp: Add IRQ check [5.10,334/530] scsi: sni_53c710: Add IRQ check [5.10,335/530] scsi: ibmvfc: Fix invalid state machine BUG_ON() [5.10,336/530] mailbox: sprd: Introduce refcnt when clients requests/free channels [5.10,337/530] mfd: stm32-timers: Avoid clearing auto reload register [5.10,338/530] nvmet-tcp: fix a segmentation fault during io parsing error [5.10,339/530] nvme-pci: dont simple map sgl when sgls are disabled [5.10,340/530] media: cedrus: Fix H265 status definitions [5.10,341/530] HSI: core: fix resource leaks in hsi_add_client_from_dt() [5.10,342/530] x86/events/amd/iommu: Fix sysfs type mismatch [5.10,343/530] perf/amd/uncore: Fix sysfs type mismatch [5.10,344/530] io_uring: fix overflows checks in provide buffers [5.10,345/530] sched/debug: Fix cgroup_path[] serialization [5.10,346/530] drivers/block/null_blk/main: Fix a double free in null_init. [5.10,347/530] xsk: Respect devices headroom and tailroom on generic xmit path [5.10,348/530] HID: plantronics: Workaround for double volume key presses [5.10,349/530] perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed c... [5.10,350/530] ASoC: Intel: boards: sof-wm8804: add check for PLL setting [5.10,351/530] ASoC: Intel: Skylake: Compile when any configuration is selected [5.10,352/530] RDMA/mlx5: Fix mlx5 rates to IB rates map [5.10,353/530] wilc1000: write value to WILC_INTR2_ENABLE register [5.10,354/530] KVM: x86/mmu: Retry page faults that hit an invalid memslot [5.10,355/530] Bluetooth: avoid deadlock between hci_dev->lock and socket lock [5.10,356/530] net: lapbether: Prevent racing when checking whether the netif is running [5.10,357/530] libbpf: Add explicit padding to bpf_xdp_set_link_opts [5.10,358/530] bpftool: Fix maybe-uninitialized warnings [5.10,359/530] iommu: Check dev->iommu in iommu_dev_xxx functions [5.10,360/530] iommu/vt-d: Reject unsupported page request modes [5.10,361/530] selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool changed [5.10,362/530] libbpf: Add explicit padding to btf_dump_emit_type_decl_opts [5.10,363/530] powerpc/fadump: Mark fadump_calculate_reserve_size as __init [5.10,364/530] powerpc/prom: Mark identical_pvr_fixup as __init [5.10,365/530] MIPS: fix local_irq_{disable,enable} in asmmacro.h [5.10,366/530] ima: Fix the error code for restoring the PCR value [5.10,367/530] inet: use bigger hash table for IP ID generation [5.10,368/530] pinctrl: pinctrl-single: remove unused parameter [5.10,369/530] pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is not zero [5.10,370/530] MIPS: loongson64: fix bug when PAGE_SIZE > 16KB [5.10,371/530] ASoC: wm8960: Remove bitclk relax condition in wm8960_configure_sysclk [5.10,372/530] iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK [5.10,373/530] RDMA/mlx5: Fix drop packet rule in egress table [5.10,374/530] IB/isert: Fix a use after free in isert_connect_request [5.10,375/530] powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration [5.10,376/530] MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again [5.10,377/530] gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP [5.10,378/530] ALSA: core: remove redundant spin_lock pair in snd_card_disconnect [5.10,379/530] net: phy: lan87xx: fix access to wrong register of LAN87xx [5.10,380/530] udp: never accept GSO_FRAGLIST packets [5.10,381/530] powerpc/pseries: Only register vio drivers if vio bus exists [5.10,382/530] net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start() [5.10,383/530] bug: Remove redundant condition check in report_bug [5.10,384/530] RDMA/core: Fix corrupted SL on passive side [5.10,385/530] nfc: pn533: prevent potential memory corruption [5.10,386/530] net: hns3: Limiting the scope of vector_ring_chain variable [5.10,387/530] mips: bmips: fix syscon-reboot nodes [5.10,388/530] iommu/vt-d: Dont set then clear private data in prq_event_thread() [5.10,389/530] iommu: Fix a boundary issue to avoid performance drop [5.10,390/530] iommu/vt-d: Report right snoop capability when using FL for IOVA [5.10,391/530] iommu/vt-d: Report the right page fault address [5.10,392/530] iommu/vt-d: Preset Access/Dirty bits for IOVA over FL [5.10,393/530] iommu/vt-d: Remove WO permissions on second-level paging entries [5.10,394/530] iommu/vt-d: Invalidate PASID cache when root/context entry changed [5.10,395/530] ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls [5.10,396/530] HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness [5.10,397/530] HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling [5.10,398/530] HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event() [5.10,399/530] HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE [5.10,400/530] KVM: arm64: Initialize VCPU mdcr_el2 before loading it [5.10,401/530] ASoC: simple-card: fix possible uninitialized single_cpu local variable [5.10,402/530] liquidio: Fix unintented sign extension of a left shift of a u16 [5.10,403/530] IB/hfi1: Use kzalloc() for mmu_rb_handler allocation [5.10,404/530] powerpc/64s: Fix pte update for kernel memory on radix [5.10,405/530] powerpc/perf: Fix PMU constraint check for EBB events [5.10,406/530] powerpc: iommu: fix build when neither PCI or IBMVIO is set [5.10,407/530] mac80211: bail out if cipher schemes are invalid [5.10,408/530] perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric [5.10,409/530] xfs: fix return of uninitialized value in variable error [5.10,410/530] rtw88: Fix an error code in rtw_debugfs_set_rsvd_page() [5.10,411/530] mt7601u: fix always true expression [5.10,412/530] mt76: mt7615: fix tx skb dma unmap [5.10,413/530] mt76: mt7915: fix tx skb dma unmap [5.10,414/530] mt76: mt7915: fix aggr len debugfs node [5.10,415/530] mt76: mt7615: fix mib stats counter reporting to mac80211 [5.10,416/530] mt76: mt7915: fix mib stats counter reporting to mac80211 [5.10,417/530] mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation [5.10,418/530] mt76: mt7663s: fix the possible device hang in high traffic [5.10,419/530] KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit [5.10,420/530] ovl: invalidate readdir cache on changes to dir with origin [5.10,421/530] RDMA/qedr: Fix error return code in qedr_iw_connect() [5.10,422/530] IB/hfi1: Fix error return code in parse_platform_config() [5.10,423/530] RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal() [5.10,424/530] cxgb4: Fix unintentional sign extension issues [5.10,425/530] net: thunderx: Fix unintentional sign extension issue [5.10,426/530] RDMA/srpt: Fix error return code in srpt_cm_req_recv() [5.10,427/530] RDMA/rtrs-clt: destroy sysfs after removing session from active list [5.10,428/530] i2c: cadence: fix reference leak when pm_runtime_get_sync fails [5.10,429/530] i2c: img-scb: fix reference leak when pm_runtime_get_sync fails [5.10,430/530] i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails [5.10,431/530] i2c: imx: fix reference leak when pm_runtime_get_sync fails [5.10,432/530] i2c: omap: fix reference leak when pm_runtime_get_sync fails [5.10,433/530] i2c: sprd: fix reference leak when pm_runtime_get_sync fails [5.10,434/530] i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails [5.10,435/530] i2c: xiic: fix reference leak when pm_runtime_get_sync fails [5.10,436/530] i2c: cadence: add IRQ check [5.10,437/530] i2c: emev2: add IRQ check [5.10,438/530] i2c: jz4780: add IRQ check [5.10,439/530] i2c: mlxbf: add IRQ check [5.10,440/530] i2c: rcar: make sure irq is not threaded on Gen2 and earlier [5.10,441/530] i2c: rcar: protect against supurious interrupts on V3U [5.10,442/530] i2c: rcar: add IRQ check [5.10,443/530] i2c: sh7760: add IRQ check [5.10,444/530] powerpc/xive: Drop check on irq_data in xive_core_debug_show() [5.10,445/530] powerpc/xive: Fix xmon command "dxi" [5.10,446/530] ASoC: ak5558: correct reset polarity [5.10,447/530] net/mlx5: Fix bit-wise and with zero [5.10,448/530] net/packet: make packet_fanout.arr size configurable up to 64K [5.10,449/530] net/packet: remove data races in fanout operations [5.10,450/530] drm/i915/gvt: Fix error code in intel_gvt_init_device() [5.10,451/530] iommu/amd: Put newline after closing bracket in warning [5.10,452/530] perf beauty: Fix fsconfig generator [5.10,453/530] drm/amd/pm: fix error code in smu_set_power_limit() [5.10,454/530] MIPS: pci-legacy: stop using of_pci_range_to_resource [5.10,455/530] powerpc/pseries: extract host bridge from pci_bus prior to bus removal [5.10,456/530] powerpc/smp: Reintroduce cpu_core_mask [5.10,457/530] KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid [5.10,458/530] rtlwifi: 8821ae: upgrade PHY and RF parameters [5.10,459/530] wlcore: fix overlapping snprintf arguments in debugfs [5.10,460/530] i2c: sh7760: fix IRQ error path [5.10,461/530] i2c: mediatek: Fix wrong dma sync flag [5.10,462/530] mwl8k: Fix a double Free in mwl8k_probe_hw [5.10,463/530] netfilter: nft_payload: fix C-VLAN offload support [5.10,464/530] netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector [5.10,465/530] netfilter: nftables_offload: special ethertype handling for VLAN [5.10,466/530] vsock/vmci: log once the failed queue pair allocation [5.10,467/530] libbpf: Initialize the bpf_seq_printf parameters array field by field [5.10,468/530] net: ethernet: ixp4xx: Set the DMA masks explicitly [5.10,469/530] gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check [5.10,470/530] RDMA/cxgb4: add missing qpid increment [5.10,471/530] RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails [5.10,472/530] ALSA: usb: midi: dont return -ENOMEM when usb_urb_ep_type_check fails [5.10,473/530] sfc: ef10: fix TX queue lookup in TX event handling [5.10,474/530] vsock/virtio: free queued packets when closing socket [5.10,475/530] net: marvell: prestera: fix port event handling on init [5.10,476/530] net: davinci_emac: Fix incorrect masking of tx and rx error channel [5.10,477/530] mt76: mt7615: fix memleak when mt7615_unregister_device() [5.10,478/530] crypto: ccp: Detect and reject "invalid" addresses destined for PSP [5.10,479/530] nfp: devlink: initialize the devlink port attribute "lanes" [5.10,480/530] net: stmmac: fix TSO and TBS feature enabling during driver open [5.10,481/530] net: renesas: ravb: Fix a stuck issue when a lot of frames are received [5.10,482/530] net: phy: intel-xway: enable integrated led functions [5.10,483/530] RDMA/rxe: Fix a bug in rxe_fill_ip_info() [5.10,484/530] RDMA/core: Add CM to restrack after successful attachment to a device [5.10,485/530] powerpc/64: Fix the definition of the fixmap area [5.10,486/530] ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices [5.10,487/530] ath10k: Fix a use after free in ath10k_htc_send_bundle [5.10,488/530] ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock [5.10,489/530] wlcore: Fix buffer overrun by snprintf due to incorrect buffer size [5.10,490/530] powerpc/perf: Fix the threshold event selection for memory events in power10 [5.10,491/530] powerpc/52xx: Fix an invalid ASM expression (addi used instead of add) [5.10,492/530] net: phy: marvell: fix m88e1011_set_downshift [5.10,493/530] net: phy: marvell: fix m88e1111_set_downshift [5.10,494/530] net: enetc: fix link error again [5.10,495/530] bnxt_en: fix ternary sign extension bug in bnxt_show_temp() [5.10,496/530] ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E [5.10,497/530] arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E [5.10,498/530] net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb [5.10,499/530] selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static [5.10,500/530] selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test [5.10,501/530] bnxt_en: Fix RX consumer index logic in the error path. [5.10,502/530] KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM [5.10,503/530] net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send [5.10,504/530] selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro [5.10,505/530] selftests/bpf: Fix field existence CO-RE reloc tests [5.10,506/530] selftests/bpf: Fix core_reloc test runner [5.10,507/530] bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds [5.10,508/530] RDMA/siw: Fix a use after free in siw_alloc_mr [5.10,509/530] RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res [5.10,510/530] net: bridge: mcast: fix broken length + header check for MRDv6 Adv. [5.10,511/530] net:nfc:digital: Fix a double free in digital_tg_recv_dep_req [5.10,512/530] perf tools: Change fields type in perf_record_time_conv [5.10,513/530] perf jit: Let convert_timestamp() to be backwards-compatible [5.10,514/530] perf session: Add swap operation for event TIME_CONV [5.10,515/530] ia64: fix EFI_DEBUG build [5.10,516/530] kfifo: fix ternary sign extension bugs [5.10,517/530] mm/sl?b.c: remove ctor argument from kmem_cache_flags [5.10,518/530] mm, slub: enable slub_debug static key when creating cache with explicit debug flags [5.10,519/530] mm: memcontrol: slab: fix obtain a reference to a freeing memcg [5.10,520/530] mm/sparse: add the missing sparse_buffer_fini() in error branch [5.10,521/530] mm/memory-failure: unnecessary amount of unmapping [5.10,522/530] afs: Fix speculative status fetches [5.10,523/530] bpf: Fix alu32 const subreg bound tracking on bitwise operations [5.10,524/530] bpf, ringbuf: Deny reserve of buffers larger than ringbuf [5.10,525/530] bpf: Prevent writable memory-mapping of read-only ringbuf pages [5.10,526/530] arm64: Remove arm64_dma32_phys_limit and its uses [5.10,527/530] net: Only allow init netns to set default tcp cong to a restricted algo [5.10,528/530] smp: Fix smp_call_function_single_async prototype [5.10,529/530] Revert "net/sctp: fix race condition in sctp_destroy_sock" [5.10,530/530] sctp: delay auto_asconf init until binding the first addr

Commit Message

Greg KH May 12, 2021, 2:42 p.m. UTC

From: Felix Fietkau <nbd@nbd.name>

commit b4403cee6400c5f679e9c4a82b91d61aa961eccf upstream.

With buf uninitialized in mt76_dma_tx_queue_skb_raw, its field skip_unmap
could potentially inherit a non-zero value from stack garbage.
If this happens, it will cause DMA mappings for MCU command frames to not be
unmapped after completion

Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/mediatek/mt76/dma.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -318,7 +318,7 @@  mt76_dma_tx_queue_skb_raw(struct mt76_de
 			  struct sk_buff *skb, u32 tx_info)
 {
 	struct mt76_queue *q = dev->q_tx[qid];
-	struct mt76_queue_buf buf;
+	struct mt76_queue_buf buf = {};
 	dma_addr_t addr;
 
 	if (q->queued + 1 >= q->ndesc - 1)