From patchwork Tue Jun 8 18:26:56 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456761 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C286DC4743D for ; Tue, 8 Jun 2021 18:30:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A8D01613C1 for ; Tue, 8 Jun 2021 18:30:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234260AbhFHSbx (ORCPT ); Tue, 8 Jun 2021 14:31:53 -0400 Received: from mail.kernel.org ([198.145.29.99]:56100 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233837AbhFHSb3 (ORCPT ); Tue, 8 Jun 2021 14:31:29 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id B1DE4613C0; Tue, 8 Jun 2021 18:29:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623176972; bh=2Db6rkopF7ONkmAIqwKKfx8ojq70/evfbaVxzrTkLWw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iGJa0Ua4MnRyq6wE9L70p9OF9xaKu9yDSQn2d3p9Q1awNJ7IEhgpuu9wU9aOyGPvq R0Ok1wHjQudtdylfO2tkXxqBpGvDRhBQTIXwqSX2BnhsxkEV6Y8U4kN9Kjdue9EFGI uF1Fq0qAMBRcZkWHHQVDiNriGT3qQ6SProiQ+44A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Heiner Kallweit , Ard Biesheuvel , Sasha Levin Subject: [PATCH 4.9 02/29] efi: Allow EFI_MEMORY_XP and EFI_MEMORY_RO both to be cleared Date: Tue, 8 Jun 2021 20:26:56 +0200 Message-Id: <20210608175927.901577449@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Heiner Kallweit [ Upstream commit 45add3cc99feaaf57d4b6f01d52d532c16a1caee ] UEFI spec 2.9, p.108, table 4-1 lists the scenario that both attributes are cleared with the description "No memory access protection is possible for Entry". So we can have valid entries where both attributes are cleared, so remove the check. Signed-off-by: Heiner Kallweit Fixes: 10f0d2f577053 ("efi: Implement generic support for the Memory Attributes table") Signed-off-by: Ard Biesheuvel Signed-off-by: Sasha Levin --- drivers/firmware/efi/memattr.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/drivers/firmware/efi/memattr.c b/drivers/firmware/efi/memattr.c index 9faa09e7c31f..c2b991b9fa9e 100644 --- a/drivers/firmware/efi/memattr.c +++ b/drivers/firmware/efi/memattr.c @@ -68,11 +68,6 @@ static bool entry_is_valid(const efi_memory_desc_t *in, efi_memory_desc_t *out) return false; } - if (!(in->attribute & (EFI_MEMORY_RO | EFI_MEMORY_XP))) { - pr_warn("Entry attributes invalid: RO and XP bits both cleared\n"); - return false; - } - if (PAGE_SIZE > EFI_PAGE_SIZE && (!PAGE_ALIGNED(in->phys_addr) || !PAGE_ALIGNED(in->num_pages << EFI_PAGE_SHIFT))) { From patchwork Tue Jun 8 18:26:57 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 457781 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 41C14C48BCD for ; Tue, 8 Jun 2021 18:30:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3079E613C1 for ; Tue, 8 Jun 2021 18:30:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234145AbhFHSby (ORCPT ); Tue, 8 Jun 2021 14:31:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:56452 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234130AbhFHSb3 (ORCPT ); Tue, 8 Jun 2021 14:31:29 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 2107B613C1; Tue, 8 Jun 2021 18:29:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623176974; bh=wd+BPha1Nb5yGMu5F8sdBCuibHKWsfyuWB9Y2bemk3Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QJ05sO7wn36X+H2rWAmQbbR6Lm8TUMOHOJj64ZJ52nAEl2+vyt2BPXe6m1tV/VFtW 2NqQXOwa4Ov1ULgdxABA8OToO9e37wsGUT3RbHYRu/yF+JP/bxPj5mv4y1kFFPNusk sKEf8DCTvt4QSfTft31Ky4ldn3v8Fg/W1LlSRe8g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rasmus Villemoes , Ard Biesheuvel , Sasha Levin Subject: [PATCH 4.9 03/29] efi: cper: fix snprintf() use in cper_dimm_err_location() Date: Tue, 8 Jun 2021 20:26:57 +0200 Message-Id: <20210608175927.932302866@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Rasmus Villemoes [ Upstream commit 942859d969de7f6f7f2659a79237a758b42782da ] snprintf() should be given the full buffer size, not one less. And it guarantees nul-termination, so doing it manually afterwards is pointless. It's even potentially harmful (though probably not in practice because CPER_REC_LEN is 256), due to the "return how much would have been written had the buffer been big enough" semantics. I.e., if the bank and/or device strings are long enough that the "DIMM location ..." output gets truncated, writing to msg[n] is a buffer overflow. Signed-off-by: Rasmus Villemoes Fixes: 3760cd20402d4 ("CPER: Adjust code flow of some functions") Signed-off-by: Ard Biesheuvel Signed-off-by: Sasha Levin --- drivers/firmware/efi/cper.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c index c0e54396f250..dc8d2603612e 100644 --- a/drivers/firmware/efi/cper.c +++ b/drivers/firmware/efi/cper.c @@ -257,8 +257,7 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg) if (!msg || !(mem->validation_bits & CPER_MEM_VALID_MODULE_HANDLE)) return 0; - n = 0; - len = CPER_REC_LEN - 1; + len = CPER_REC_LEN; dmi_memdev_name(mem->mem_dev_handle, &bank, &device); if (bank && device) n = snprintf(msg, len, "DIMM location: %s %s ", bank, device); @@ -267,7 +266,6 @@ static int cper_dimm_err_location(struct cper_mem_err_compact *mem, char *msg) "DIMM location: not present. DMI handle: 0x%.4x ", mem->mem_dev_handle); - msg[n] = '\0'; return n; } From patchwork Tue Jun 8 18:26:58 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 455787 Delivered-To: patch@linaro.org Received: by 2002:a02:735a:0:0:0:0:0 with SMTP id a26csp3994788jae; Tue, 8 Jun 2021 11:30:48 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyEPJNSqQruaYroYSJUvw03H6c49CdMPZDNpGKj6486DTN0HM/czwFomK4XbFBNI3Zrhxxf X-Received: by 2002:a17:906:308d:: with SMTP id 13mr24261399ejv.554.1623177047918; Tue, 08 Jun 2021 11:30:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1623177047; cv=none; d=google.com; s=arc-20160816; b=mps5HEdcQ2Nkv78a91xYdJnE8w0SkGsPfSYAHek4nTe7UrznzMqRCHn/TR1TaGicEt ghtrklRhaFYNKvI/UFQgvL0vFjweTwdULeaX2Gr1oDGUfqIv+/h5oHTW4ARYY5kfKSCV RedufK+qAe2iXwwcQGL3aqY0qKkDvFLjCLPdKad1vLykfNDmLhZ8lSdxF5kz5R24UBOk +UGBdTKwN/00UhnCxXnrlpkD+7rCsYJFG2JGCZXeRgRqCb9g3NKuZgipwcFiv1GYaejT wPw563kYhmya53+jV9O6Q11gPgS7RrtCQSDM59Il8SvGFAV+HiZlDmFhO4Sz49Kbwn2t K7dA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=eAgrB8bu/GEac8XjFkahsGhft5xOOP3CwCpXHhWf7BA=; b=iAT0F6pZ4jWUxnLXP+Kagmzo9Mj1lx8iG16FwL22/WLkTDA1TummzEeiU0ucxBCmz3 bqkEQm0+ekIJsaeY5XDWd+MWeF49R3lAPzw8f7UVtEMqJ++Fv8KF5wC88Nz6fKQZNmqU k+zbn40Uhq1n0Q75R09ic41RE96Xcb+KaLyd9hW/ib8KnoD3AfmSY9ATT81d55BtPIu4 D6EUGapgDKu1XTF/ljJqpWKxpj7wCVWfBA4QYw0VkVKOQPzreFOSaDjAjaeUrT0cW4r9 Q2BlRWoVwlniGsns/6sAJmhc0qUJtcNueSjCf/eH0kZKp12a9fYZEYhPnDsH2BCxhsEf 8OBw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=XIX4oTyD; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id e17si416787ejm.271.2021.06.08.11.30.47; Tue, 08 Jun 2021 11:30:47 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=XIX4oTyD; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234213AbhFHScZ (ORCPT + 12 others); Tue, 8 Jun 2021 14:32:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:55748 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234221AbhFHSbs (ORCPT ); Tue, 8 Jun 2021 14:31:48 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 6F600613CB; Tue, 8 Jun 2021 18:29:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623176977; bh=DtkpGIlSz7qqPuk4G/uy/HrLLxPvu5jhBLOU0tY58vo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XIX4oTyD675gvMAF+fkF5pAoLk+LCfkzHnLDAFzQr3Xqw8bZWA5Xsj2W32D/cwJ1w /vEqj2cAdEpQByCFL+AKAyOzgGu53ngvXD2/XzIlVcNqQXD4wmFch3iiwOYC0boqrh g8UIf8xEzweeAPGCGJ0I3LMKZVhJtsADrVmd5VZY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Zhen Lei , Max Gurtovoy , Alex Williamson , Sasha Levin Subject: [PATCH 4.9 04/29] vfio/pci: Fix error return code in vfio_ecap_init() Date: Tue, 8 Jun 2021 20:26:58 +0200 Message-Id: <20210608175927.963114322@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Zhen Lei [ Upstream commit d1ce2c79156d3baf0830990ab06d296477b93c26 ] The error code returned from vfio_ext_cap_len() is stored in 'len', not in 'ret'. Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver") Reported-by: Hulk Robot Signed-off-by: Zhen Lei Reviewed-by: Max Gurtovoy Message-Id: <20210515020458.6771-1-thunder.leizhen@huawei.com> Signed-off-by: Alex Williamson Signed-off-by: Sasha Levin --- drivers/vfio/pci/vfio_pci_config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.30.2 diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c index f3c2de04b20d..5b0f09b211be 100644 --- a/drivers/vfio/pci/vfio_pci_config.c +++ b/drivers/vfio/pci/vfio_pci_config.c @@ -1576,7 +1576,7 @@ static int vfio_ecap_init(struct vfio_pci_device *vdev) if (len == 0xFF) { len = vfio_ext_cap_len(vdev, ecap, epos); if (len < 0) - return ret; + return len; } } From patchwork Tue Jun 8 18:26:59 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456760 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD8BBC4743E for ; Tue, 8 Jun 2021 18:30:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A8334613C5 for ; Tue, 8 Jun 2021 18:30:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234308AbhFHScA (ORCPT ); Tue, 8 Jun 2021 14:32:00 -0400 Received: from mail.kernel.org ([198.145.29.99]:56494 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234180AbhFHSbc (ORCPT ); Tue, 8 Jun 2021 14:31:32 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id B8F05613CC; Tue, 8 Jun 2021 18:29:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623176979; bh=eaaYOqm4v2bgpowWPDk4ooz33NiH3VUpJWKI+0n3iLg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=czdEhxAyjWV0ZK5EXqfTZdTx1BYl7lKxxOsqTDTMMhZhPDt+w15zMmYVRxWx6aZrc BM9Co6mirxy461/aAK4xrXNDJUIN5p6wOKXwjwH0ge5hWwu7EaZ0OQnGPfoi9PzmBQ BGIg5MYVw1sGO1+3Qm1ndFKIqg/dmecntzHCpMmU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , kernel test robot , Alex Williamson , Cornelia Huck , kvm@vger.kernel.org, Jason Gunthorpe , Eric Auger , Sasha Levin Subject: [PATCH 4.9 05/29] vfio/pci: zap_vma_ptes() needs MMU Date: Tue, 8 Jun 2021 20:26:59 +0200 Message-Id: <20210608175927.993080466@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Randy Dunlap [ Upstream commit 2a55ca37350171d9b43d561528f23d4130097255 ] zap_vma_ptes() is only available when CONFIG_MMU is set/enabled. Without CONFIG_MMU, vfio_pci.o has build errors, so make VFIO_PCI depend on MMU. riscv64-linux-ld: drivers/vfio/pci/vfio_pci.o: in function `vfio_pci_mmap_open': vfio_pci.c:(.text+0x1ec): undefined reference to `zap_vma_ptes' riscv64-linux-ld: drivers/vfio/pci/vfio_pci.o: in function `.L0 ': vfio_pci.c:(.text+0x165c): undefined reference to `zap_vma_ptes' Fixes: 11c4cd07ba11 ("vfio-pci: Fault mmaps to enable vma tracking") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Alex Williamson Cc: Cornelia Huck Cc: kvm@vger.kernel.org Cc: Jason Gunthorpe Cc: Eric Auger Message-Id: <20210515190856.2130-1-rdunlap@infradead.org> Signed-off-by: Alex Williamson Signed-off-by: Sasha Levin --- drivers/vfio/pci/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/vfio/pci/Kconfig b/drivers/vfio/pci/Kconfig index 24ee2605b9f0..0da884bfc7a8 100644 --- a/drivers/vfio/pci/Kconfig +++ b/drivers/vfio/pci/Kconfig @@ -1,6 +1,7 @@ config VFIO_PCI tristate "VFIO support for PCI devices" depends on VFIO && PCI && EVENTFD + depends on MMU select VFIO_VIRQFD select IRQ_BYPASS_MANAGER help From patchwork Tue Jun 8 18:27:00 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 457777 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F126EC48BD1 for ; Tue, 8 Jun 2021 18:30:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DA98B61352 for ; Tue, 8 Jun 2021 18:30:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234222AbhFHScZ (ORCPT ); Tue, 8 Jun 2021 14:32:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:56050 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234226AbhFHSbs (ORCPT ); Tue, 8 Jun 2021 14:31:48 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 2CA15613AE; Tue, 8 Jun 2021 18:29:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623176981; bh=PvTMYSM//QiSbcO7Cf3Y6Xndh6R5qxxdqFOK/OzrvbY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=18kM63oXwWbE05T8mA5Oyr0JjmAivbMo7rMWZKzd9TEaywLN7RTqSntxzeFeKh0n9 ybqNd3H7nofXUpYCzspXlmpP/t3KBgqoGwixc59AnfFqdvhx7338D4ZcqDosaDzqjx yV58bJR6Qc2/Qic4kBfNEmS2HvwTSrvkBgDe21Qk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Max Gurtovoy , Alex Williamson , Sasha Levin Subject: [PATCH 4.9 06/29] vfio/platform: fix module_put call in error flow Date: Tue, 8 Jun 2021 20:27:00 +0200 Message-Id: <20210608175928.024686925@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Max Gurtovoy [ Upstream commit dc51ff91cf2d1e9a2d941da483602f71d4a51472 ] The ->parent_module is the one that use in try_module_get. It should also be the one the we use in module_put during vfio_platform_open(). Fixes: 32a2d71c4e80 ("vfio: platform: introduce vfio-platform-base module") Signed-off-by: Max Gurtovoy Message-Id: <20210518192133.59195-1-mgurtovoy@nvidia.com> Signed-off-by: Alex Williamson Signed-off-by: Sasha Levin --- drivers/vfio/platform/vfio_platform_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c index d143d08c4f0f..9b1b6c1e218d 100644 --- a/drivers/vfio/platform/vfio_platform_common.c +++ b/drivers/vfio/platform/vfio_platform_common.c @@ -288,7 +288,7 @@ err_irq: vfio_platform_regions_cleanup(vdev); err_reg: mutex_unlock(&driver_lock); - module_put(THIS_MODULE); + module_put(vdev->parent_module); return ret; } From patchwork Tue Jun 8 18:27:01 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456759 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3CF9C4743E for ; Tue, 8 Jun 2021 18:30:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DDDBD613EA for ; Tue, 8 Jun 2021 18:30:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234375AbhFHScQ (ORCPT ); Tue, 8 Jun 2021 14:32:16 -0400 Received: from mail.kernel.org ([198.145.29.99]:56244 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230330AbhFHSbh (ORCPT ); Tue, 8 Jun 2021 14:31:37 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8DDD461376; Tue, 8 Jun 2021 18:29:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623176984; bh=dHPTvnook4xNYA5OGHAVgeU+E/PrCK4BuJtHzBDss4g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DFlu7piktLqjR4lACGDicCUOSeLhqwz61anhEykaLhKaybTyqE9cbHUUwVNoiMYWR 1YqEK0Q89bxw/5hqk/aIOmXXlTAMh9Tk1TUK86cc2cIs1bA38KkVm50Eg1hI4LDnDo thWgY9xuo/IBIRe83twtOEnVWDvJUCgcsymkCsUI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julian Anastasov , Simon Horman , Pablo Neira Ayuso , Sasha Levin , syzbot+e562383183e4b1766930@syzkaller.appspotmail.com Subject: [PATCH 4.9 07/29] ipvs: ignore IP_VS_SVC_F_HASHED flag when adding service Date: Tue, 8 Jun 2021 20:27:01 +0200 Message-Id: <20210608175928.056505553@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Julian Anastasov [ Upstream commit 56e4ee82e850026d71223262c07df7d6af3bd872 ] syzbot reported memory leak [1] when adding service with HASHED flag. We should ignore this flag both from sockopt and netlink provided data, otherwise the service is not hashed and not visible while releasing resources. [1] BUG: memory leak unreferenced object 0xffff888115227800 (size 512): comm "syz-executor263", pid 8658, jiffies 4294951882 (age 12.560s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmalloc include/linux/slab.h:556 [inline] [] kzalloc include/linux/slab.h:686 [inline] [] ip_vs_add_service+0x598/0x7c0 net/netfilter/ipvs/ip_vs_ctl.c:1343 [] do_ip_vs_set_ctl+0x810/0xa40 net/netfilter/ipvs/ip_vs_ctl.c:2570 [] nf_setsockopt+0x68/0xa0 net/netfilter/nf_sockopt.c:101 [] ip_setsockopt+0x259/0x1ff0 net/ipv4/ip_sockglue.c:1435 [] raw_setsockopt+0x18c/0x1b0 net/ipv4/raw.c:857 [] __sys_setsockopt+0x1b0/0x360 net/socket.c:2117 [] __do_sys_setsockopt net/socket.c:2128 [inline] [] __se_sys_setsockopt net/socket.c:2125 [inline] [] __x64_sys_setsockopt+0x22/0x30 net/socket.c:2125 [] do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 [] entry_SYSCALL_64_after_hwframe+0x44/0xae Reported-and-tested-by: syzbot+e562383183e4b1766930@syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Julian Anastasov Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/ipvs/ip_vs_ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c index ba9e711f7e3d..4e08305a55c4 100644 --- a/net/netfilter/ipvs/ip_vs_ctl.c +++ b/net/netfilter/ipvs/ip_vs_ctl.c @@ -1256,7 +1256,7 @@ ip_vs_add_service(struct netns_ipvs *ipvs, struct ip_vs_service_user_kern *u, ip_vs_addr_copy(svc->af, &svc->addr, &u->addr); svc->port = u->port; svc->fwmark = u->fwmark; - svc->flags = u->flags; + svc->flags = u->flags & ~IP_VS_SVC_F_HASHED; svc->timeout = u->timeout * HZ; svc->netmask = u->netmask; svc->ipvs = ipvs; From patchwork Tue Jun 8 18:27:02 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 455786 Delivered-To: patch@linaro.org Received: by 2002:a02:735a:0:0:0:0:0 with SMTP id a26csp3994723jae; Tue, 8 Jun 2021 11:30:44 -0700 (PDT) X-Google-Smtp-Source: ABdhPJywsBjd6J11irsEam0VXnm9pKEmfDcfpgzeT4plGgjyThqklRyGYB4W+zjM1y9kgHSBfBZV X-Received: by 2002:a50:9b06:: with SMTP id o6mr27188087edi.284.1623177044820; Tue, 08 Jun 2021 11:30:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1623177044; cv=none; d=google.com; s=arc-20160816; b=K98HLluOUUXkB9PNooC8EnXgZpgIxbSUXic8X1xNX0ynqn5ntykdYh8ERyjTGF6G7R 6Hnrw55pjQ3o7RQ8sv1YtI5VTvis2bmYns20gBBfoYP+LOTHG1rWwvpiZwuDRrZEiVIU OqFT4FbpC87lFqCsG4dszFQ33OhqFWqMrmAmagua7eojUqmmwQJm+XEvhl2GI9o0Iuvc XyZ3Q6lcU7n16KVmwF0oPsrvaUNw2K2mqHVVt2PgDbuwLTkitQ7S6BkQSbXjaixr3SoG nawt/5rITvZim+U5C2gO+WY08frSzEwY/HEKg/UPGoJ9b5XMUqeEDahedKE0SpC/EtTx OaPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=J7UZByMJSOAY6reM4//XCQ6dn1xKG/ywPwyWwiZHH0M=; b=xymAH8fz9aC+7w1bDWC24BVS8wirXUqzVQBLzytME58/SNBwE0et2vMjXwn8z0ysoN VzohrZR0HcNn/bzU+Y45pMRtHSSweWrBGL59bNrzIfoohQNSYDsEV5QN0RYkR237YMay f83LeFF9K2f80m6P66HdoQSj/w05Nwu6NiB7CLIYgN3S5TfVpAk/ZNBJK5N+eD85kmeS HFjt11i2hUae6Xk6PRLDhgflc+wz4K31U2g3XNXE4DWWPIDl1f9IfULM1cZ38e3AqF7G KDftONLoSpGcLSVR+xo2h/YoJLvwAND7HLnzQsatna0H9ZB/hDecQ6kdW+dlkTefgdyl nkdA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=W5Ibkbhr; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id e17si416787ejm.271.2021.06.08.11.30.44; Tue, 08 Jun 2021 11:30:44 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=W5Ibkbhr; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234192AbhFHScR (ORCPT + 12 others); Tue, 8 Jun 2021 14:32:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:56654 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234191AbhFHSbk (ORCPT ); Tue, 8 Jun 2021 14:31:40 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 4EA35613B9; Tue, 8 Jun 2021 18:29:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623176986; bh=lKpCVtXD3B8w7NgXNJYxyJ62U+u4UoNXBhi14EH6Lao=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=W5IbkbhrpLp2syOJP3QXcn4CmZLiqVfoMJDlHOpMiWxXB3SXP7eP3jbDvuIHyTlwo 2IcZQum1hyD90U1ah2/kG+cljfkbWYWIenRXTw/GRHm9iSW9IB6N/4STI43vlNvCt8 FMHXGTxsmAgQxlsJ4Kx7luc0SeUKCaKiSEANm4dE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Zhen Lei , Jiri Kosina , Sasha Levin Subject: [PATCH 4.9 08/29] HID: pidff: fix error return code in hid_pidff_init() Date: Tue, 8 Jun 2021 20:27:02 +0200 Message-Id: <20210608175928.089643488@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Zhen Lei [ Upstream commit 3dd653c077efda8152f4dd395359617d577a54cd ] Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: 224ee88fe395 ("Input: add force feedback driver for PID devices") Reported-by: Hulk Robot Signed-off-by: Zhen Lei Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin --- drivers/hid/usbhid/hid-pidff.c | 1 + 1 file changed, 1 insertion(+) -- 2.30.2 diff --git a/drivers/hid/usbhid/hid-pidff.c b/drivers/hid/usbhid/hid-pidff.c index 08174d341f4a..bc75f1efa0f4 100644 --- a/drivers/hid/usbhid/hid-pidff.c +++ b/drivers/hid/usbhid/hid-pidff.c @@ -1304,6 +1304,7 @@ int hid_pidff_init(struct hid_device *hid) if (pidff->pool[PID_DEVICE_MANAGED_POOL].value && pidff->pool[PID_DEVICE_MANAGED_POOL].value[0] == 0) { + error = -EPERM; hid_notice(hid, "device does not support device managed pool\n"); goto fail; From patchwork Tue Jun 8 18:27:03 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 455790 Delivered-To: patch@linaro.org Received: by 2002:a02:735a:0:0:0:0:0 with SMTP id a26csp3996141jae; Tue, 8 Jun 2021 11:31:58 -0700 (PDT) X-Google-Smtp-Source: ABdhPJw1ceps8XY3fOBfus8S41FXDx5eb5Gvbgwcp5I2y2ViCqr1kl4eSKse4kXaLunFeoxaC/vi X-Received: by 2002:a17:906:d93:: with SMTP id m19mr12748373eji.177.1623177118611; Tue, 08 Jun 2021 11:31:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1623177118; cv=none; d=google.com; s=arc-20160816; b=M77zHWU6BWUo8qN5GpJR9iJbkmX/fxcVCTLBLJML586H8B1yN3y1QU/+0NNDBGFHC3 6vJB3M0M76cm63MwJFjSc0nwDSGPI27gNGsOtOMxURvSUsPBJ8HXwTiYr3MShBKempZ1 UUI9tNLXvJtw6lPL3NevmrMYGM/zikq3FuqwqT2TAkW4j55ntVkW3vW4gsH6JBq5GmTK qhXNup1ieUL3jKbdVJ1HDoyZ8pXHGZZWAeZpZBGXcYzuCHug5/+bsCrSEedsYbHpbvtR kPNlJhxX4iGAKFqdazUGkI6zroqt1+A0CPOD0eq82m7PBM+wB0i65037xaLpfTlTAmAX Y26g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=QY3ENXeBZal+FISOKLdRdhhtCCYqlh0SvEEL3UBf9CM=; b=Aamv5SiOYQRtVlEbYkcyL4YgSGWf0BvOrYp+2d1wN6awX6H7V6xfYkIFcZPzm7mtWo BofMa3aP8I/hYyB2FZ0j9Axyb8/5lBG9m3SnV8K28bnkMYxefMKoFLfmtO+JI+NGM/5d 4qu15ONsxLpLm+P3wiGc6UVI6OTjO9r05aWW5v8vf/ANJzzINYrRev9Fqx5CLdLNXFqr qQCnjWFHzzuvLP23lUFojGR0PtX/UmSlambTpHme/fZJ4HgoyI14KvtnUdiDecOEhj3/ pzwIYIXTdsGOuFKIJiQkhVWHi6rGi6Wqi88Cpxbekg8UWGffk3PxwCMNSMEe+E3y+aCx J26w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="cyBB/yQ6"; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id ly22si337502ejb.565.2021.06.08.11.31.58; Tue, 08 Jun 2021 11:31:58 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="cyBB/yQ6"; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234444AbhFHSdb (ORCPT + 12 others); Tue, 8 Jun 2021 14:33:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:57970 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234440AbhFHScd (ORCPT ); Tue, 8 Jun 2021 14:32:33 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 58E8A61380; Tue, 8 Jun 2021 18:30:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177039; bh=RGpMOJ16txcZmIJsuu42MGUiZJmBuqBIh/pHaydqCmU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cyBB/yQ6Wp/VsVDMO0N9oL1DWapC9C74uMi3qSsMe5FFN8Ms/7fd/XXh6+j3zlVbO K0CW3hrVpEOxobtdGGIQ8gJKaToZJHGDpsPYdouMTx6pPqnyhywFZVOHYjAqyBF+Zf H+cT08XspUcKZEblT7bZm3zENv/LU3Lg8GO2rXB8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arnd Bergmann , Nathan Chancellor , Jiri Kosina , Sasha Levin Subject: [PATCH 4.9 09/29] HID: i2c-hid: fix format string mismatch Date: Tue, 8 Jun 2021 20:27:03 +0200 Message-Id: <20210608175928.120985240@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Arnd Bergmann [ Upstream commit dc5f9f55502e13ba05731d5046a14620aa2ff456 ] clang doesn't like printing a 32-bit integer using %hX format string: drivers/hid/i2c-hid/i2c-hid-core.c:994:18: error: format specifies type 'unsigned short' but the argument has type '__u32' (aka 'unsigned int') [-Werror,-Wformat] client->name, hid->vendor, hid->product); ^~~~~~~~~~~ drivers/hid/i2c-hid/i2c-hid-core.c:994:31: error: format specifies type 'unsigned short' but the argument has type '__u32' (aka 'unsigned int') [-Werror,-Wformat] client->name, hid->vendor, hid->product); ^~~~~~~~~~~~ Use an explicit cast to truncate it to the low 16 bits instead. Fixes: 9ee3e06610fd ("HID: i2c-hid: override HID descriptors for certain devices") Signed-off-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin --- drivers/hid/i2c-hid/i2c-hid-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.30.2 diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c index 606fd875740c..800c477dd076 100644 --- a/drivers/hid/i2c-hid/i2c-hid-core.c +++ b/drivers/hid/i2c-hid/i2c-hid-core.c @@ -1157,8 +1157,8 @@ static int i2c_hid_probe(struct i2c_client *client, hid->vendor = le16_to_cpu(ihid->hdesc.wVendorID); hid->product = le16_to_cpu(ihid->hdesc.wProductID); - snprintf(hid->name, sizeof(hid->name), "%s %04hX:%04hX", - client->name, hid->vendor, hid->product); + snprintf(hid->name, sizeof(hid->name), "%s %04X:%04X", + client->name, (u16)hid->vendor, (u16)hid->product); strlcpy(hid->phys, dev_name(&client->dev), sizeof(hid->phys)); ihid->quirks = i2c_hid_lookup_quirk(hid->vendor, hid->product); From patchwork Tue Jun 8 18:27:04 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 457775 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F25AC4743F for ; Tue, 8 Jun 2021 18:31:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 187B7613EA for ; Tue, 8 Jun 2021 18:31:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233837AbhFHScx (ORCPT ); Tue, 8 Jun 2021 14:32:53 -0400 Received: from mail.kernel.org ([198.145.29.99]:56768 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233653AbhFHScA (ORCPT ); Tue, 8 Jun 2021 14:32:00 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id B342B613AC; Tue, 8 Jun 2021 18:29:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623176991; bh=wtStW2NSvFCE9dbD5KI9A/NpOyQmvPopXx6VPXcXqUo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i7IxpWxFs6NyRtENQRD5674jE9I6oNzHSNJ7RyHenvrCk9dMON3nOag2Ofle50srp bkZWsOpEMnXPPkwDocAYUapRuxw2UzGWJAejhiefagzbZ+nqeYKED9MhiCHysxQDdO 82BebJ7lkBPOrKk1u8XcU7tGID45LqQcpBfvDlcU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.9 10/29] netfilter: nfnetlink_cthelper: hit EBUSY on updates if size mismatches Date: Tue, 8 Jun 2021 20:27:04 +0200 Message-Id: <20210608175928.152758687@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pablo Neira Ayuso [ Upstream commit 8971ee8b087750a23f3cd4dc55bff2d0303fd267 ] The private helper data size cannot be updated. However, updates that contain NFCTH_PRIV_DATA_LEN might bogusly hit EBUSY even if the size is the same. Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin --- net/netfilter/nfnetlink_cthelper.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c index 8396dc8ee247..babe42ff3eec 100644 --- a/net/netfilter/nfnetlink_cthelper.c +++ b/net/netfilter/nfnetlink_cthelper.c @@ -355,10 +355,14 @@ static int nfnl_cthelper_update(const struct nlattr * const tb[], struct nf_conntrack_helper *helper) { + u32 size; int ret; - if (tb[NFCTH_PRIV_DATA_LEN]) - return -EBUSY; + if (tb[NFCTH_PRIV_DATA_LEN]) { + size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN])); + if (size != helper->data_len) + return -EBUSY; + } if (tb[NFCTH_POLICY]) { ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]); From patchwork Tue Jun 8 18:27:05 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 455789 Delivered-To: patch@linaro.org Received: by 2002:a02:735a:0:0:0:0:0 with SMTP id a26csp3995135jae; Tue, 8 Jun 2021 11:31:07 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzkQHxSVTWpXPPDL9Tmo85bzoCdp6/kPJxoV4oghOuxJ65w0fGBbJqNomcgbzgcw51rPZPJ X-Received: by 2002:a50:bb6a:: with SMTP id y97mr27172080ede.345.1623177067242; Tue, 08 Jun 2021 11:31:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1623177067; cv=none; d=google.com; s=arc-20160816; b=ZRfabtDEjH6we1whwv4fx/xb/iNdokgQQg7PJcoI0n9WCQkWgZZURz9zqgHJ+IC/LX 6HQKKyGGzv8SioQZGj4HWZqnr/VTeYnEKDzgkQFlpALkb00lgET+aoOE4zAMiR+2ueOy DHs58FYvEsSaTVdrvgrqMZr3UdJ2kVgNReMG+pdZrsUpJmKikbb7CgOJUZaFme8aI5d4 4ggZ17ynpAMCBzv34+tcGZi6OWCRpIYIqBofgq91tfbphn3YmhUyr3a5kxsVE5EsUZHo QdOp2kiZbAlxrP/jjIFhx5y8WQJ0bnRn8L7Q9oUI0xJHT1R+fLL+IAzCu3MKVEurNkVM YjgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=fQlo6ak4GDGJ0MEacg3BDQ2NACjQKOPvwxbcAQUOB3E=; b=QBy6H+HfxoFHIpVJFLSLSCYC+6mZBPv5wqVxF/D1xjeo8Eub0d7Ysm3H76wPHjFDGT /vYUfU1WU7nVhZQMpqBMP5rOdNENw3h+jjXLDwARFVl6Dtd7tl9CYzITSX5NvXcP+xhF S6MuveFwL6sAY+vtnnzYBfUv3lmAbLeEtwSuuzhUUhLjsNW8bpvLJk5wkpFlCKdY5cX6 N2DEQ1Eo2tInYXkFaRmZzB6dfs0iqChBpBTLiUNwu3uO3F9isSVRsH2ougJdtXpGHfpL PUR9CdoJ+yrFJWJjE683a2lpDiujFpv21kVlDe6wRzlQFK8LQURahzoqt4BB90nOG3jX 5mAQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=i2rZuXdj; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id e17si416787ejm.271.2021.06.08.11.31.07; Tue, 08 Jun 2021 11:31:07 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=i2rZuXdj; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234332AbhFHSc6 (ORCPT + 12 others); Tue, 8 Jun 2021 14:32:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:57434 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234342AbhFHScL (ORCPT ); Tue, 8 Jun 2021 14:32:11 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 6E82A613CA; Tue, 8 Jun 2021 18:30:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177018; bh=cq+BDAlz6yVWbPDX5SFSPBUVhukvOyz3I7Ra/jMwicA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i2rZuXdjrWZuWTGEUOZ12XpVvIyWodtZMpIo3WAIw3vKDE2yK41JygYkZTeTcoIFn XlZWk1sF0GlXYomY1QvL8Yg4AE9Yq/naKswSB2kRgrQQikWl1cLN3LOn/LRk+Yf1x5 yLOsmQD/3yUn7KVdH1zQsbJzWQknPhcSGUx/jPMc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Zhen Lei , Stefan Schmidt , Sasha Levin Subject: [PATCH 4.9 11/29] ieee802154: fix error return code in ieee802154_add_iface() Date: Tue, 8 Jun 2021 20:27:05 +0200 Message-Id: <20210608175928.184179568@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Zhen Lei [ Upstream commit 79c6b8ed30e54b401c873dbad2511f2a1c525fd5 ] Fix to return a negative error code from the error handling case instead of 0, as done elsewhere in this function. Fixes: be51da0f3e34 ("ieee802154: Stop using NLA_PUT*().") Reported-by: Hulk Robot Signed-off-by: Zhen Lei Link: https://lore.kernel.org/r/20210508062517.2574-1-thunder.leizhen@huawei.com Signed-off-by: Stefan Schmidt Signed-off-by: Sasha Levin --- net/ieee802154/nl-phy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.30.2 diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c index 77d73014bde3..11f53dc0c1c0 100644 --- a/net/ieee802154/nl-phy.c +++ b/net/ieee802154/nl-phy.c @@ -249,8 +249,10 @@ int ieee802154_add_iface(struct sk_buff *skb, struct genl_info *info) } if (nla_put_string(msg, IEEE802154_ATTR_PHY_NAME, wpan_phy_name(phy)) || - nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name)) + nla_put_string(msg, IEEE802154_ATTR_DEV_NAME, dev->name)) { + rc = -EMSGSIZE; goto nla_put_failure; + } dev_put(dev); wpan_phy_put(phy); From patchwork Tue Jun 8 18:27:06 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456751 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A0202C4743D for ; Tue, 8 Jun 2021 18:31:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8E040610A2 for ; Tue, 8 Jun 2021 18:31:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234597AbhFHSd1 (ORCPT ); Tue, 8 Jun 2021 14:33:27 -0400 Received: from mail.kernel.org ([198.145.29.99]:57488 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234084AbhFHSc3 (ORCPT ); Tue, 8 Jun 2021 14:32:29 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 5CE37613D4; Tue, 8 Jun 2021 18:30:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177023; bh=/Kk5XFC71RKixZ0KeWmKO2J/s1lNjqmgXRxjBCww5eM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=om/ftAHuErnsu2vXbXs7lbawbQbhl18uGTyKtVwMKN9RK9eSzPqIxAgZznbK7Rv0Y 18jyzPY1nD9pC9drPNHK9afSCVoqGYpcVrMh8/3xNEH6JDJflvJnZ8z9KMku0xwRlg gmHKNqKf3L2okjeAI7dOoPoT4R1DuHDqaCP3UcIQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wei Yongjun , Stefan Schmidt , Sasha Levin Subject: [PATCH 4.9 12/29] ieee802154: fix error return code in ieee802154_llsec_getparams() Date: Tue, 8 Jun 2021 20:27:06 +0200 Message-Id: <20210608175928.217990188@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Wei Yongjun [ Upstream commit 373e864cf52403b0974c2f23ca8faf9104234555 ] Fix to return negative error code -ENOBUFS from the error handling case instead of 0, as done elsewhere in this function. Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Link: https://lore.kernel.org/r/20210519141614.3040055-1-weiyongjun1@huawei.com Signed-off-by: Stefan Schmidt Signed-off-by: Sasha Levin --- net/ieee802154/nl-mac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c index c0930b9fe848..7531cb1665d2 100644 --- a/net/ieee802154/nl-mac.c +++ b/net/ieee802154/nl-mac.c @@ -688,8 +688,10 @@ int ieee802154_llsec_getparams(struct sk_buff *skb, struct genl_info *info) nla_put_u8(msg, IEEE802154_ATTR_LLSEC_SECLEVEL, params.out_level) || nla_put_u32(msg, IEEE802154_ATTR_LLSEC_FRAME_COUNTER, be32_to_cpu(params.frame_counter)) || - ieee802154_llsec_fill_key_id(msg, ¶ms.out_key)) + ieee802154_llsec_fill_key_id(msg, ¶ms.out_key)) { + rc = -ENOBUFS; goto out_free; + } dev_put(dev); From patchwork Tue Jun 8 18:27:07 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456749 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 190B0C47082 for ; Tue, 8 Jun 2021 18:31:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 06FE961182 for ; Tue, 8 Jun 2021 18:31:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234608AbhFHSdb (ORCPT ); Tue, 8 Jun 2021 14:33:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:57560 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234124AbhFHSce (ORCPT ); Tue, 8 Jun 2021 14:32:34 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id D70DC613CD; Tue, 8 Jun 2021 18:30:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177025; bh=jl8Z6ZgrA67B1nrcFs3fiCeBUftXiBdarqG5ygOvl9Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pI/22bxZRt7qPlSGGd3+J+ZP0NDcqMYF7cx3B+0VLCqEvuNhSWkzY9LJBH43MmMwf Ydr5Rt2Fg0aLOfKqblgMektOf3KynEv8j7my2dCN1KLo70xWVTZBnCBNBitQ73RLQB T1p3GLb9GYca3pNF3dudTxtoBZMwfJ7HnhBVRD9Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , "David S. Miller" , Jakub Kicinski , linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, Lin Ma , Hao Xiong Subject: [PATCH 4.9 13/29] Bluetooth: fix the erroneous flush_work() order Date: Tue, 8 Jun 2021 20:27:07 +0200 Message-Id: <20210608175928.248830114@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lin Ma commit 6a137caec23aeb9e036cdfd8a46dd8a366460e5d upstream. In the cleanup routine for failed initialization of HCI device, the flush_work(&hdev->rx_work) need to be finished before the flush_work(&hdev->cmd_work). Otherwise, the hci_rx_work() can possibly invoke new cmd_work and cause a bug, like double free, in late processings. This was assigned CVE-2021-3564. This patch reorder the flush_work() to fix this bug. Cc: Marcel Holtmann Cc: Johan Hedberg Cc: Luiz Augusto von Dentz Cc: "David S. Miller" Cc: Jakub Kicinski Cc: linux-bluetooth@vger.kernel.org Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Lin Ma Signed-off-by: Hao Xiong Cc: stable Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman --- net/bluetooth/hci_core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1422,8 +1422,13 @@ static int hci_dev_do_open(struct hci_de } else { /* Init failed, cleanup */ flush_work(&hdev->tx_work); - flush_work(&hdev->cmd_work); + + /* Since hci_rx_work() is possible to awake new cmd_work + * it should be flushed first to avoid unexpected call of + * hci_cmd_work() + */ flush_work(&hdev->rx_work); + flush_work(&hdev->cmd_work); skb_queue_purge(&hdev->cmd_q); skb_queue_purge(&hdev->rx_q); From patchwork Tue Jun 8 18:27:08 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 457768 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22E10C4743D for ; Tue, 8 Jun 2021 18:31:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 056BC61376 for ; Tue, 8 Jun 2021 18:31:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233682AbhFHSdh (ORCPT ); Tue, 8 Jun 2021 14:33:37 -0400 Received: from mail.kernel.org ([198.145.29.99]:57600 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234309AbhFHSch (ORCPT ); Tue, 8 Jun 2021 14:32:37 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 4DE7D613B9; Tue, 8 Jun 2021 18:30:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177027; bh=EHZJLvG/aunoeWaZiHpji8erF1KoKgD/dmIWqn/lG2c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bD6Wim8vEYWpYuqPxPiVenG0QrQJ9swPHMmMAjxhRspKGdXsbwcwyHStQO+cCb5eM I1DAMLyBWE++fQjd5ucCM+lzUG0ODDiMGrHpSK90TaJPUe4Q0qhD04yeJ78mg1ghgx jUF1RO6RDSr9h92x0pYPfnYi9KADKTsU3xywNphg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Ma , Marcel Holtmann Subject: [PATCH 4.9 14/29] Bluetooth: use correct lock to prevent UAF of hdev object Date: Tue, 8 Jun 2021 20:27:08 +0200 Message-Id: <20210608175928.284131791@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lin Ma commit e305509e678b3a4af2b3cfd410f409f7cdaabb52 upstream. The hci_sock_dev_event() function will cleanup the hdev object for sockets even if this object may still be in used within the hci_sock_bound_ioctl() function, result in UAF vulnerability. This patch replace the BH context lock to serialize these affairs and prevent the race condition. Signed-off-by: Lin Ma Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman --- net/bluetooth/hci_sock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -750,7 +750,7 @@ void hci_sock_dev_event(struct hci_dev * /* Detach sockets from device */ read_lock(&hci_sk_list.lock); sk_for_each(sk, &hci_sk_list.head) { - bh_lock_sock_nested(sk); + lock_sock(sk); if (hci_pi(sk)->hdev == hdev) { hci_pi(sk)->hdev = NULL; sk->sk_err = EPIPE; @@ -759,7 +759,7 @@ void hci_sock_dev_event(struct hci_dev * hci_dev_put(hdev); } - bh_unlock_sock(sk); + release_sock(sk); } read_unlock(&hci_sk_list.lock); } From patchwork Tue Jun 8 18:27:09 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456748 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E84F3C47082 for ; Tue, 8 Jun 2021 18:31:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D06E561380 for ; Tue, 8 Jun 2021 18:31:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234268AbhFHSdk (ORCPT ); Tue, 8 Jun 2021 14:33:40 -0400 Received: from mail.kernel.org ([198.145.29.99]:57666 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234447AbhFHSch (ORCPT ); Tue, 8 Jun 2021 14:32:37 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 96381613BF; Tue, 8 Jun 2021 18:30:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177030; bh=rsED8s3r44/lFHHL2PzzG5LOJomieDVl4CR1CyvZD0c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BT+ZhVSHlfYcHTq2tbg5jeAnPZ557mbV7qY7CGHicOXL4gyTUcELiY5S7TxznlOgN SQWThB1EyWPQpQDO8Hrudrb9CiR3bN0BbtPJkHwvIVri/dTbYD1GSQYp4t9oUyqRG9 iyltkdu/AdbWa07z72dG4s+zEGONiqLEd1oyqHyk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , "David S. Miller" Subject: [PATCH 4.9 15/29] net: caif: added cfserl_release function Date: Tue, 8 Jun 2021 20:27:09 +0200 Message-Id: <20210608175928.313977485@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pavel Skripkin commit bce130e7f392ddde8cfcb09927808ebd5f9c8669 upstream. Added cfserl_release() function. Cc: stable@vger.kernel.org Signed-off-by: Pavel Skripkin Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/net/caif/cfserl.h | 1 + net/caif/cfserl.c | 5 +++++ 2 files changed, 6 insertions(+) --- a/include/net/caif/cfserl.h +++ b/include/net/caif/cfserl.h @@ -9,4 +9,5 @@ #include struct cflayer *cfserl_create(int instance, bool use_stx); +void cfserl_release(struct cflayer *layer); #endif --- a/net/caif/cfserl.c +++ b/net/caif/cfserl.c @@ -31,6 +31,11 @@ static int cfserl_transmit(struct cflaye static void cfserl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl, int phyid); +void cfserl_release(struct cflayer *layer) +{ + kfree(layer); +} + struct cflayer *cfserl_create(int instance, bool use_stx) { struct cfserl *this = kzalloc(sizeof(struct cfserl), GFP_ATOMIC); From patchwork Tue Jun 8 18:27:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 457767 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BACF1C4743F for ; Tue, 8 Jun 2021 18:31:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A76E5613B9 for ; Tue, 8 Jun 2021 18:31:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234446AbhFHSdl (ORCPT ); Tue, 8 Jun 2021 14:33:41 -0400 Received: from mail.kernel.org ([198.145.29.99]:56838 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234269AbhFHScm (ORCPT ); Tue, 8 Jun 2021 14:32:42 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 553CD61376; Tue, 8 Jun 2021 18:30:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177032; bh=dOmcRJm6Y37kvcI1vAX4/vWOo7WEzddVyjrsNS8JqB4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D8RW81/DCRrZznPzEWaN16cSc2sfbz/gUd0ZomgsgvwTTbRc8lw91WbTAPsu9foS1 iOrryIJh1MAjjD/mok0B/g1yktR4XcqmSVaufuCSDGIPXCLeR0bz5M4E8AJ/sf+9DA kWDleF8avRMjFZ76WGMp1AJU0x2QNvK9+qteEHY0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , "David S. Miller" Subject: [PATCH 4.9 16/29] net: caif: add proper error handling Date: Tue, 8 Jun 2021 20:27:10 +0200 Message-Id: <20210608175928.347383299@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pavel Skripkin commit a2805dca5107d5603f4bbc027e81e20d93476e96 upstream. caif_enroll_dev() can fail in some cases. Ingnoring these cases can lead to memory leak due to not assigning link_support pointer to anywhere. Fixes: 7c18d2205ea7 ("caif: Restructure how link caif link layer enroll") Cc: stable@vger.kernel.org Signed-off-by: Pavel Skripkin Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/net/caif/caif_dev.h | 2 +- include/net/caif/cfcnfg.h | 2 +- net/caif/caif_dev.c | 8 +++++--- net/caif/cfcnfg.c | 16 +++++++++++----- 4 files changed, 18 insertions(+), 10 deletions(-) --- a/include/net/caif/caif_dev.h +++ b/include/net/caif/caif_dev.h @@ -119,7 +119,7 @@ void caif_free_client(struct cflayer *ad * The link_support layer is used to add any Link Layer specific * framing. */ -void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev, +int caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev, struct cflayer *link_support, int head_room, struct cflayer **layer, int (**rcv_func)( struct sk_buff *, struct net_device *, --- a/include/net/caif/cfcnfg.h +++ b/include/net/caif/cfcnfg.h @@ -62,7 +62,7 @@ void cfcnfg_remove(struct cfcnfg *cfg); * @fcs: Specify if checksum is used in CAIF Framing Layer. * @head_room: Head space needed by link specific protocol. */ -void +int cfcnfg_add_phy_layer(struct cfcnfg *cnfg, struct net_device *dev, struct cflayer *phy_layer, enum cfcnfg_phy_preference pref, --- a/net/caif/caif_dev.c +++ b/net/caif/caif_dev.c @@ -303,7 +303,7 @@ static void dev_flowctrl(struct net_devi caifd_put(caifd); } -void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev, +int caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev, struct cflayer *link_support, int head_room, struct cflayer **layer, int (**rcv_func)(struct sk_buff *, struct net_device *, @@ -314,11 +314,12 @@ void caif_enroll_dev(struct net_device * enum cfcnfg_phy_preference pref; struct cfcnfg *cfg = get_cfcnfg(dev_net(dev)); struct caif_device_entry_list *caifdevs; + int res; caifdevs = caif_device_list(dev_net(dev)); caifd = caif_device_alloc(dev); if (!caifd) - return; + return -ENOMEM; *layer = &caifd->layer; spin_lock_init(&caifd->flow_lock); @@ -340,7 +341,7 @@ void caif_enroll_dev(struct net_device * sizeof(caifd->layer.name) - 1); caifd->layer.name[sizeof(caifd->layer.name) - 1] = 0; caifd->layer.transmit = transmit; - cfcnfg_add_phy_layer(cfg, + res = cfcnfg_add_phy_layer(cfg, dev, &caifd->layer, pref, @@ -350,6 +351,7 @@ void caif_enroll_dev(struct net_device * mutex_unlock(&caifdevs->lock); if (rcv_func) *rcv_func = receive; + return res; } EXPORT_SYMBOL(caif_enroll_dev); --- a/net/caif/cfcnfg.c +++ b/net/caif/cfcnfg.c @@ -455,7 +455,7 @@ unlock: rcu_read_unlock(); } -void +int cfcnfg_add_phy_layer(struct cfcnfg *cnfg, struct net_device *dev, struct cflayer *phy_layer, enum cfcnfg_phy_preference pref, @@ -464,7 +464,7 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg { struct cflayer *frml; struct cfcnfg_phyinfo *phyinfo = NULL; - int i; + int i, res = 0; u8 phyid; mutex_lock(&cnfg->lock); @@ -478,12 +478,15 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg goto got_phyid; } pr_warn("Too many CAIF Link Layers (max 6)\n"); + res = -EEXIST; goto out; got_phyid: phyinfo = kzalloc(sizeof(struct cfcnfg_phyinfo), GFP_ATOMIC); - if (!phyinfo) + if (!phyinfo) { + res = -ENOMEM; goto out_err; + } phy_layer->id = phyid; phyinfo->pref = pref; @@ -497,8 +500,10 @@ got_phyid: frml = cffrml_create(phyid, fcs); - if (!frml) + if (!frml) { + res = -ENOMEM; goto out_err; + } phyinfo->frm_layer = frml; layer_set_up(frml, cnfg->mux); @@ -516,11 +521,12 @@ got_phyid: list_add_rcu(&phyinfo->node, &cnfg->phys); out: mutex_unlock(&cnfg->lock); - return; + return res; out_err: kfree(phyinfo); mutex_unlock(&cnfg->lock); + return res; } EXPORT_SYMBOL(cfcnfg_add_phy_layer); From patchwork Tue Jun 8 18:27:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 457771 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68DCEC47082 for ; Tue, 8 Jun 2021 18:31:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 553376101A for ; Tue, 8 Jun 2021 18:31:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234408AbhFHSd1 (ORCPT ); Tue, 8 Jun 2021 14:33:27 -0400 Received: from mail.kernel.org ([198.145.29.99]:57858 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234126AbhFHSc2 (ORCPT ); Tue, 8 Jun 2021 14:32:28 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8B0B0613AE; Tue, 8 Jun 2021 18:30:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177035; bh=3HOKnaVi71YUI+jEO9hylFIiLEbQbbKztLrOt1LrGG4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e3jSw4uUQYjVQXwZRHHvFIv5CTV13AYmBlIvU14FSFiP1rIyInDlwUaUjeQ0ueB44 64SbUJb8vfeYCOL0g0o8lR2pVfSsdTbXBi7oIQHKGIgVyDM2iTTIUpoAEPWn2NbhCU /8ymxhBcrSzKUUHPKZon5iv5tCtusojo4fazBAKs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , "David S. Miller" , syzbot+7ec324747ce876a29db6@syzkaller.appspotmail.com Subject: [PATCH 4.9 17/29] net: caif: fix memory leak in caif_device_notify Date: Tue, 8 Jun 2021 20:27:11 +0200 Message-Id: <20210608175928.382528927@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pavel Skripkin commit b53558a950a89824938e9811eddfc8efcd94e1bb upstream. In case of caif_enroll_dev() fail, allocated link_support won't be assigned to the corresponding structure. So simply free allocated pointer in case of error Fixes: 7c18d2205ea7 ("caif: Restructure how link caif link layer enroll") Cc: stable@vger.kernel.org Reported-and-tested-by: syzbot+7ec324747ce876a29db6@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/caif/caif_dev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/net/caif/caif_dev.c +++ b/net/caif/caif_dev.c @@ -366,6 +366,7 @@ static int caif_device_notify(struct not struct cflayer *layer, *link_support; int head_room = 0; struct caif_device_entry_list *caifdevs; + int res; cfg = get_cfcnfg(dev_net(dev)); caifdevs = caif_device_list(dev_net(dev)); @@ -391,8 +392,10 @@ static int caif_device_notify(struct not break; } } - caif_enroll_dev(dev, caifdev, link_support, head_room, + res = caif_enroll_dev(dev, caifdev, link_support, head_room, &layer, NULL); + if (res) + cfserl_release(link_support); caifdev->flowctrl = dev_flowctrl; break; From patchwork Tue Jun 8 18:27:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456750 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 94B32C4743E for ; Tue, 8 Jun 2021 18:31:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7D77161351 for ; Tue, 8 Jun 2021 18:31:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234438AbhFHSda (ORCPT ); Tue, 8 Jun 2021 14:33:30 -0400 Received: from mail.kernel.org ([198.145.29.99]:57916 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234430AbhFHSca (ORCPT ); Tue, 8 Jun 2021 14:32:30 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 1B488613BC; Tue, 8 Jun 2021 18:30:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177037; bh=u/YoHiPNvaOjM6DSUbtCv9cuDvMIjhzS/H0FsmXQYhk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=w1ecqlHdMex9EDLjmMArCL1OmZoCNlowmcIcaOATCHtaalPenNWr4LL0soVc9i4tn 2KsFI6I/LMYVakcqZsh+iN9XGYxMf++t3IB/hWRaCQHF2jTOocPSqiheL28HOjY+1w iuSUR3l01Jmv7xotMtNXd6nvDP9nnpp7iKXukY9o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , "David S. Miller" Subject: [PATCH 4.9 18/29] net: caif: fix memory leak in cfusbl_device_notify Date: Tue, 8 Jun 2021 20:27:12 +0200 Message-Id: <20210608175928.416437286@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pavel Skripkin commit 7f5d86669fa4d485523ddb1d212e0a2d90bd62bb upstream. In case of caif_enroll_dev() fail, allocated link_support won't be assigned to the corresponding structure. So simply free allocated pointer in case of error. Fixes: 7ad65bf68d70 ("caif: Add support for CAIF over CDC NCM USB interface") Cc: stable@vger.kernel.org Signed-off-by: Pavel Skripkin Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/caif/caif_usb.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) --- a/net/caif/caif_usb.c +++ b/net/caif/caif_usb.c @@ -116,6 +116,11 @@ static struct cflayer *cfusbl_create(int return (struct cflayer *) this; } +static void cfusbl_release(struct cflayer *layer) +{ + kfree(layer); +} + static struct packet_type caif_usb_type __read_mostly = { .type = cpu_to_be16(ETH_P_802_EX1), }; @@ -128,6 +133,7 @@ static int cfusbl_device_notify(struct n struct cflayer *layer, *link_support; struct usbnet *usbnet; struct usb_device *usbdev; + int res; /* Check whether we have a NCM device, and find its VID/PID. */ if (!(dev->dev.parent && dev->dev.parent->driver && @@ -170,8 +176,11 @@ static int cfusbl_device_notify(struct n if (dev->num_tx_queues > 1) pr_warn("USB device uses more than one tx queue\n"); - caif_enroll_dev(dev, &common, link_support, CFUSB_MAX_HEADLEN, + res = caif_enroll_dev(dev, &common, link_support, CFUSB_MAX_HEADLEN, &layer, &caif_usb_type.func); + if (res) + goto err; + if (!pack_added) dev_add_pack(&caif_usb_type); pack_added = true; @@ -181,6 +190,9 @@ static int cfusbl_device_notify(struct n layer->name[sizeof(layer->name) - 1] = 0; return 0; +err: + cfusbl_release(link_support); + return res; } static struct notifier_block caif_device_notifier = { From patchwork Tue Jun 8 18:27:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456758 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0387BC48BCF for ; Tue, 8 Jun 2021 18:30:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E62DF613BC for ; Tue, 8 Jun 2021 18:30:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233763AbhFHScY (ORCPT ); Tue, 8 Jun 2021 14:32:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:56838 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234103AbhFHSbr (ORCPT ); Tue, 8 Jun 2021 14:31:47 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 0572A613BC; Tue, 8 Jun 2021 18:29:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623176993; bh=06ZmTQ+z7oj3b7cCuxAOCEeUQA+Q6HQ2sA3Pu0ez2B0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AMAlJvDlQii+L/mhmyftmkFM5SgNFsLujq17Dc5Ow5ZZao1EdpUHYpNQBHjQvZMaf CfPs1wGzYILik1p6CT/n1JR7OY6SCChp6t/t4XKtX8VzXbm0QYYTWpATGRcb4Qvi7J cEhi09Z9BsXcORUQCX1qoq2cM+M1Gh3eNg/zJzb0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+d102fa5b35335a7e544e@syzkaller.appspotmail.com, Jaroslav Kysela , Takashi Iwai Subject: [PATCH 4.9 19/29] ALSA: timer: Fix master timer notification Date: Tue, 8 Jun 2021 20:27:13 +0200 Message-Id: <20210608175928.444527666@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Takashi Iwai commit 9c1fe96bded935369f8340c2ac2e9e189f697d5d upstream. snd_timer_notify1() calls the notification to each slave for a master event, but it passes a wrong event number. It should be +10 offset, corresponding to SNDRV_TIMER_EVENT_MXXX, but it's incorrectly with +100 offset. Casually this was spotted by UBSAN check via syzkaller. Reported-by: syzbot+d102fa5b35335a7e544e@syzkaller.appspotmail.com Reviewed-by: Jaroslav Kysela Cc: Link: https://lore.kernel.org/r/000000000000e5560e05c3bd1d63@google.com Link: https://lore.kernel.org/r/20210602113823.23777-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/core/timer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -488,9 +488,10 @@ static void snd_timer_notify1(struct snd return; if (timer->hw.flags & SNDRV_TIMER_HW_SLAVE) return; + event += 10; /* convert to SNDRV_TIMER_EVENT_MXXX */ list_for_each_entry(ts, &ti->slave_active_head, active_list) if (ts->ccallback) - ts->ccallback(ts, event + 100, &tstamp, resolution); + ts->ccallback(ts, event, &tstamp, resolution); } /* start/continue a master timer */ From patchwork Tue Jun 8 18:27:14 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456757 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C606C4743F for ; Tue, 8 Jun 2021 18:30:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6B4CB613BC for ; Tue, 8 Jun 2021 18:30:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232905AbhFHSc0 (ORCPT ); Tue, 8 Jun 2021 14:32:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:56878 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234124AbhFHSbt (ORCPT ); Tue, 8 Jun 2021 14:31:49 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 6B74F61352; Tue, 8 Jun 2021 18:29:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623176995; bh=VflrBC4eeexjlERvv1bC2/3Ncwtj0N2AwS8rE4uQ2ek=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jisRT0cPAmyr/dbq8VU/EpPK1ohRj++JK/rHF+YnF2eSeBQTGAbinQa0uc+K1K6lK +dOi60v/13lfaLuLND6yjByO9Gtmbe8qzg3LzYSu/7H2/PnwkUnq7kKPo7vAOqKrbN Xro5J9rQwEFWTf8PVJkuF1SjCB5WYZ5UeV9Fk56k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Ye Bin , Jan Kara , Theodore Tso Subject: [PATCH 4.9 20/29] ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed Date: Tue, 8 Jun 2021 20:27:14 +0200 Message-Id: <20210608175928.473651477@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Ye Bin commit 082cd4ec240b8734a82a89ffb890216ac98fec68 upstream. We got follow bug_on when run fsstress with injecting IO fault: [130747.323114] kernel BUG at fs/ext4/extents_status.c:762! [130747.323117] Internal error: Oops - BUG: 0 [#1] SMP ...... [130747.334329] Call trace: [130747.334553] ext4_es_cache_extent+0x150/0x168 [ext4] [130747.334975] ext4_cache_extents+0x64/0xe8 [ext4] [130747.335368] ext4_find_extent+0x300/0x330 [ext4] [130747.335759] ext4_ext_map_blocks+0x74/0x1178 [ext4] [130747.336179] ext4_map_blocks+0x2f4/0x5f0 [ext4] [130747.336567] ext4_mpage_readpages+0x4a8/0x7a8 [ext4] [130747.336995] ext4_readpage+0x54/0x100 [ext4] [130747.337359] generic_file_buffered_read+0x410/0xae8 [130747.337767] generic_file_read_iter+0x114/0x190 [130747.338152] ext4_file_read_iter+0x5c/0x140 [ext4] [130747.338556] __vfs_read+0x11c/0x188 [130747.338851] vfs_read+0x94/0x150 [130747.339110] ksys_read+0x74/0xf0 This patch's modification is according to Jan Kara's suggestion in: https://patchwork.ozlabs.org/project/linux-ext4/patch/20210428085158.3728201-1-yebin10@huawei.com/ "I see. Now I understand your patch. Honestly, seeing how fragile is trying to fix extent tree after split has failed in the middle, I would probably go even further and make sure we fix the tree properly in case of ENOSPC and EDQUOT (those are easily user triggerable). Anything else indicates a HW problem or fs corruption so I'd rather leave the extent tree as is and don't try to fix it (which also means we will not create overlapping extents)." Cc: stable@kernel.org Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20210506141042.3298679-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman --- fs/ext4/extents.c | 43 +++++++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 20 deletions(-) --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3274,7 +3274,10 @@ static int ext4_split_extent_at(handle_t ext4_ext_mark_unwritten(ex2); err = ext4_ext_insert_extent(handle, inode, ppath, &newex, flags); - if (err == -ENOSPC && (EXT4_EXT_MAY_ZEROOUT & split_flag)) { + if (err != -ENOSPC && err != -EDQUOT) + goto out; + + if (EXT4_EXT_MAY_ZEROOUT & split_flag) { if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) { if (split_flag & EXT4_EXT_DATA_VALID1) { err = ext4_ext_zeroout(inode, ex2); @@ -3300,30 +3303,30 @@ static int ext4_split_extent_at(handle_t ext4_ext_pblock(&orig_ex)); } - if (err) - goto fix_extent_len; - /* update the extent length and mark as initialized */ - ex->ee_len = cpu_to_le16(ee_len); - ext4_ext_try_to_merge(handle, inode, path, ex); - err = ext4_ext_dirty(handle, inode, path + path->p_depth); - if (err) - goto fix_extent_len; - - /* update extent status tree */ - err = ext4_zeroout_es(inode, &zero_ex); - - goto out; - } else if (err) - goto fix_extent_len; - -out: - ext4_ext_show_leaf(inode, path); - return err; + if (!err) { + /* update the extent length and mark as initialized */ + ex->ee_len = cpu_to_le16(ee_len); + ext4_ext_try_to_merge(handle, inode, path, ex); + err = ext4_ext_dirty(handle, inode, path + path->p_depth); + if (!err) + /* update extent status tree */ + err = ext4_zeroout_es(inode, &zero_ex); + /* If we failed at this point, we don't know in which + * state the extent tree exactly is so don't try to fix + * length of the original extent as it may do even more + * damage. + */ + goto out; + } + } fix_extent_len: ex->ee_len = orig_ex.ee_len; ext4_ext_dirty(handle, inode, path + path->p_depth); return err; +out: + ext4_ext_show_leaf(inode, path); + return err; } /* From patchwork Tue Jun 8 18:27:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 455788 Delivered-To: patch@linaro.org Received: by 2002:a02:735a:0:0:0:0:0 with SMTP id a26csp3994860jae; Tue, 8 Jun 2021 11:30:52 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyPB0Zu9xyq9xjNPLYN1B12ingQ8fS4+c7SGYYv5SQhSlcVA5FdvBTrlC/px34vQbFH8ENh X-Received: by 2002:a05:6402:b89:: with SMTP id cf9mr27591360edb.198.1623177051989; Tue, 08 Jun 2021 11:30:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1623177051; cv=none; d=google.com; s=arc-20160816; b=NJSTFOjiLGelw4Gw7dT3OkZzGp8Ps0JmyVO32Br7q3Jds6fRInQ1xkbUkWpMhQ4MoU l2k2iXVEXtRlhi2GA7ZLL9yQbFLKJBzd1ua79mJ0YaFPs2fHX+7Fp/CXGzp2F0SSivkz WRiMKn9P94Ijt3PhQQzGU8P0h7G4oCIYkHz2Od7kZX7QAEARjGiVInTe32sr+GSHxdo+ uXkq5R7GUb0P8JJV3Wb0WhDbygRfdiY+yEuNKrLNJEt3q9he5i69/lFLDFm+F389I/XR MuEM72nHaBXRVIS5gnStyaYTH4FTSLYkN5C5ebRSK/HnUmjkreCh68FSDojXQdzQNLJm GZ/w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=qq4aWG9SxtQ6/7Gvzc2qRPmfEDYxqCIJtU6yg+QpEDs=; b=l9EJxnA+WdVUR0ukt5rE7Z/eVvbDHU0mzl/WEh/9tv78j9H1yiq97TV6cgm4yMTCoD tzQZyr01GMtesw7LiMWn8/7dD70Sqz8w8UH4fAA/WX39aWP3qWS2Xgyo6PyMm3TKxtfk G8+GS/bk9JkrBdVNof+OII6xPmBVmm0Q9w1aANBuoH0jGKS711AQJ6lIoErLzWxY2Ptp XLa0B523Oj+F/YpRhH+ETCWTL4t06RyUZPVFYZ2CfW9vIk5YfbLB7q/5WiuuCaTDOpNH 70WDiCXDqiWhKFqQq4a/680sLvjtQhc00giGYcBvSHyZIqGI6TxYxGjxjSfvs5sXSk9U daVg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=SlvSkVa5; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id e17si416787ejm.271.2021.06.08.11.30.51; Tue, 08 Jun 2021 11:30:51 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=SlvSkVa5; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234435AbhFHScc (ORCPT + 12 others); Tue, 8 Jun 2021 14:32:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:56958 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233603AbhFHSbv (ORCPT ); Tue, 8 Jun 2021 14:31:51 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8F3D3613BD; Tue, 8 Jun 2021 18:29:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623176998; bh=6SU8kpbSsRnPbOKNw1kw0rqc+7ngXbluko5dKSxa0wc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SlvSkVa59a7luLP1c0ue2NS19QjUgblRBMAO/4gPuvoLECNmlK2ri22Pb7++QrQjc oznd/uc+XTJrmAwkxv5ghklTi2i0lWG+WlvAu56iPX7eQEqbWGQ4sPMUzAsw7lXgDo CEaRBXWN+LJUvkTVZ/NiRcfisONP9G1V5RIOc8fg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Rutland , Christian Brauner , Cedric Le Goater , Christian Brauner , "Eric W. Biederman" , Martin Schwidefsky , Paul Mackerras , Andrew Morton , Linus Torvalds Subject: [PATCH 4.9 21/29] pid: take a reference when initializing `cad_pid` Date: Tue, 8 Jun 2021 20:27:15 +0200 Message-Id: <20210608175928.505394675@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mark Rutland commit 0711f0d7050b9e07c44bc159bbc64ac0a1022c7f upstream. During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never incremented, can therefore free the init task's struct pid early. As there can be dangling references to the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the conversion of `cad_pid` to struct pid in commit 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid") from the pre-KASAN stone age of v2.6.19. Fix this by getting a reference to the init task's struct pid when we assign it to `cad_pid`. Full KASAN splat below. ================================================================== BUG: KASAN: use-after-free in ns_of_pid include/linux/pid.h:153 [inline] BUG: KASAN: use-after-free in task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 Read of size 4 at addr ffff23794dda0004 by task syz-executor.0/273 CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1 Hardware name: linux,dummy-virt (DT) Call trace: ns_of_pid include/linux/pid.h:153 [inline] task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 do_notify_parent+0x308/0xe60 kernel/signal.c:1950 exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_exit+0x108/0x2c8 kernel/exit.c:922 get_signal+0x4e4/0x2a88 kernel/signal.c:2781 do_signal arch/arm64/kernel/signal.c:882 [inline] do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936 work_pending+0xc/0x2dc Allocated by task 0: slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516 slab_alloc_node mm/slub.c:2907 [inline] slab_alloc mm/slub.c:2915 [inline] kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920 alloc_pid+0xdc/0xc00 kernel/pid.c:180 copy_process+0x2794/0x5e18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500 kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init+0x44/0x4a0 init/main.c:687 arch_call_rest_init+0x1c/0x28 start_kernel+0x520/0x554 init/main.c:1064 0x0 Freed by task 270: slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600 slab_free mm/slub.c:3161 [inline] kmem_cache_free+0x224/0x8e0 mm/slub.c:3177 put_pid.part.4+0xe0/0x1a8 kernel/pid.c:114 put_pid+0x30/0x48 kernel/pid.c:109 proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401 proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591 proc_sys_write+0x34/0x48 fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x3ac/0x510 fs/read_write.c:518 vfs_write fs/read_write.c:605 [inline] vfs_write+0x9c4/0x1018 fs/read_write.c:585 ksys_write+0x124/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write fs/read_write.c:667 [inline] __arm64_sys_write+0x78/0xb0 fs/read_write.c:667 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline] el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150 arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416 el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432 el0_sync+0x154/0x180 arch/arm64/kernel/entry.S:701 The buggy address belongs to the object at ffff23794dda0000 which belongs to the cache pid of size 224 The buggy address is located 4 bytes inside of 224-byte region [ffff23794dda0000, ffff23794dda00e0) The buggy address belongs to the page: page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4dda0 head:(____ptrval____) order:1 compound_mapcount:0 flags: 0x3fffc0000010200(slab|head) raw: 03fffc0000010200 dead000000000100 dead000000000122 ffff23794d40d080 raw: 0000000000000000 0000000000190019 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff23794dd9ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff23794dd9ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff23794dda0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff23794dda0080: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff23794dda0100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 ================================================================== Link: https://lkml.kernel.org/r/20210524172230.38715-1-mark.rutland@arm.com Fixes: 9ec52099e4b8678a ("[PATCH] replace cad_pid by a struct pid") Signed-off-by: Mark Rutland Acked-by: Christian Brauner Cc: Cedric Le Goater Cc: Christian Brauner Cc: Eric W. Biederman Cc: Kees Cook Cc: Paul Mackerras Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- init/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/init/main.c +++ b/init/main.c @@ -1005,7 +1005,7 @@ static noinline void __init kernel_init_ */ set_cpus_allowed_ptr(current, cpu_all_mask); - cad_pid = task_pid(current); + cad_pid = get_pid(task_pid(current)); smp_prepare_cpus(setup_max_cpus); From patchwork Tue Jun 8 18:27:16 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 457774 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF749C4743E for ; Tue, 8 Jun 2021 18:31:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C9D08613E6 for ; Tue, 8 Jun 2021 18:31:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234338AbhFHSc5 (ORCPT ); Tue, 8 Jun 2021 14:32:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:56100 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234339AbhFHScJ (ORCPT ); Tue, 8 Jun 2021 14:32:09 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id EC681613C7; Tue, 8 Jun 2021 18:29:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177000; bh=yHRN7I+ZeID/JRlimvH6QP0ZLujQO5RRLhCFHJKFofc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uunBUYLwM++1h2gO7lSbqJ70C9HQOqWFd5duFm6NxrZOJwM9xvrQgnStprRk7dvij +W2SsCNNKH3gScyb9RWKGIuBa1Lfyj2lm00C3pLyrlvXIPYfNal/Tg8kyTT827UkL3 yDKEBu6x5FwV3laP0KoYoJ++I7YYJ6Jl0qCrkDKY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Junxiao Bi , Joseph Qi , Jan Kara , Mark Fasheh , Joel Becker , Changwei Ge , Gang He , Jun Piao , Andrew Morton , Linus Torvalds Subject: [PATCH 4.9 22/29] ocfs2: fix data corruption by fallocate Date: Tue, 8 Jun 2021 20:27:16 +0200 Message-Id: <20210608175928.538636040@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Junxiao Bi commit 6bba4471f0cc1296fe3c2089b9e52442d3074b2e upstream. When fallocate punches holes out of inode size, if original isize is in the middle of last cluster, then the part from isize to the end of the cluster will be zeroed with buffer write, at that time isize is not yet updated to match the new size, if writeback is kicked in, it will invoke ocfs2_writepage()->block_write_full_page() where the pages out of inode size will be dropped. That will cause file corruption. Fix this by zero out eof blocks when extending the inode size. Running the following command with qemu-image 4.2.1 can get a corrupted coverted image file easily. qemu-img convert -p -t none -T none -f qcow2 $qcow_image \ -O qcow2 -o compat=1.1 $qcow_image.conv The usage of fallocate in qemu is like this, it first punches holes out of inode size, then extend the inode size. fallocate(11, FALLOC_FL_KEEP_SIZE|FALLOC_FL_PUNCH_HOLE, 2276196352, 65536) = 0 fallocate(11, 0, 2276196352, 65536) = 0 v1: https://www.spinics.net/lists/linux-fsdevel/msg193999.html v2: https://lore.kernel.org/linux-fsdevel/20210525093034.GB4112@quack2.suse.cz/T/ Link: https://lkml.kernel.org/r/20210528210648.9124-1-junxiao.bi@oracle.com Signed-off-by: Junxiao Bi Reviewed-by: Joseph Qi Cc: Jan Kara Cc: Mark Fasheh Cc: Joel Becker Cc: Changwei Ge Cc: Gang He Cc: Jun Piao Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/ocfs2/file.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 50 insertions(+), 5 deletions(-) --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1839,6 +1839,45 @@ out: } /* + * zero out partial blocks of one cluster. + * + * start: file offset where zero starts, will be made upper block aligned. + * len: it will be trimmed to the end of current cluster if "start + len" + * is bigger than it. + */ +static int ocfs2_zeroout_partial_cluster(struct inode *inode, + u64 start, u64 len) +{ + int ret; + u64 start_block, end_block, nr_blocks; + u64 p_block, offset; + u32 cluster, p_cluster, nr_clusters; + struct super_block *sb = inode->i_sb; + u64 end = ocfs2_align_bytes_to_clusters(sb, start); + + if (start + len < end) + end = start + len; + + start_block = ocfs2_blocks_for_bytes(sb, start); + end_block = ocfs2_blocks_for_bytes(sb, end); + nr_blocks = end_block - start_block; + if (!nr_blocks) + return 0; + + cluster = ocfs2_bytes_to_clusters(sb, start); + ret = ocfs2_get_clusters(inode, cluster, &p_cluster, + &nr_clusters, NULL); + if (ret) + return ret; + if (!p_cluster) + return 0; + + offset = start_block - ocfs2_clusters_to_blocks(sb, cluster); + p_block = ocfs2_clusters_to_blocks(sb, p_cluster) + offset; + return sb_issue_zeroout(sb, p_block, nr_blocks, GFP_NOFS); +} + +/* * Parts of this function taken from xfs_change_file_space() */ static int __ocfs2_change_file_space(struct file *file, struct inode *inode, @@ -1848,7 +1887,7 @@ static int __ocfs2_change_file_space(str { int ret; s64 llen; - loff_t size; + loff_t size, orig_isize; struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); struct buffer_head *di_bh = NULL; handle_t *handle; @@ -1879,6 +1918,7 @@ static int __ocfs2_change_file_space(str goto out_inode_unlock; } + orig_isize = i_size_read(inode); switch (sr->l_whence) { case 0: /*SEEK_SET*/ break; @@ -1886,7 +1926,7 @@ static int __ocfs2_change_file_space(str sr->l_start += f_pos; break; case 2: /*SEEK_END*/ - sr->l_start += i_size_read(inode); + sr->l_start += orig_isize; break; default: ret = -EINVAL; @@ -1940,6 +1980,14 @@ static int __ocfs2_change_file_space(str default: ret = -EINVAL; } + + /* zeroout eof blocks in the cluster. */ + if (!ret && change_size && orig_isize < size) { + ret = ocfs2_zeroout_partial_cluster(inode, orig_isize, + size - orig_isize); + if (!ret) + i_size_write(inode, size); + } up_write(&OCFS2_I(inode)->ip_alloc_sem); if (ret) { mlog_errno(ret); @@ -1956,9 +2004,6 @@ static int __ocfs2_change_file_space(str goto out_inode_unlock; } - if (change_size && i_size_read(inode) < size) - i_size_write(inode, size); - inode->i_ctime = inode->i_mtime = current_time(inode); ret = ocfs2_mark_inode_dirty(handle, inode, di_bh); if (ret < 0) From patchwork Tue Jun 8 18:27:17 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 457773 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07C24C4743E for ; Tue, 8 Jun 2021 18:31:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E5486613C1 for ; Tue, 8 Jun 2021 18:31:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234346AbhFHSdE (ORCPT ); Tue, 8 Jun 2021 14:33:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:57090 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234032AbhFHScM (ORCPT ); Tue, 8 Jun 2021 14:32:12 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 6E111613B6; Tue, 8 Jun 2021 18:30:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177002; bh=BjwMVZV29dd47sjI8xClz0qNUCf6RXp1w1uXhyzZKOU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vPKnaeiR8IP2W8VYYTDP95FhJXrbUCAUMDMost4fyw2fqbSemyouZ87QgrCmXAIXg Rn7nvaXK7MTef+TV8ZaEJ2BUOasYHedcWBjDIWIk58Rqkm9ef5uGMzaBD8TOpF6Uv8 Kz+kFHUXoafJcqWPIXeJkYuZCbxq4xpzk5c5NvRA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+80fb126e7f7d8b1a5914@syzkaller.appspotmail.com, butt3rflyh4ck , Krzysztof Kozlowski , Jakub Kicinski Subject: [PATCH 4.9 23/29] nfc: fix NULL ptr dereference in llcp_sock_getname() after failed connect Date: Tue, 8 Jun 2021 20:27:17 +0200 Message-Id: <20210608175928.571940894@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Krzysztof Kozlowski commit 4ac06a1e013cf5fdd963317ffd3b968560f33bba upstream. It's possible to trigger NULL pointer dereference by local unprivileged user, when calling getsockname() after failed bind() (e.g. the bind fails because LLCP_SAP_MAX used as SAP): BUG: kernel NULL pointer dereference, address: 0000000000000000 CPU: 1 PID: 426 Comm: llcp_sock_getna Not tainted 5.13.0-rc2-next-20210521+ #9 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1 04/01/2014 Call Trace: llcp_sock_getname+0xb1/0xe0 __sys_getpeername+0x95/0xc0 ? lockdep_hardirqs_on_prepare+0xd5/0x180 ? syscall_enter_from_user_mode+0x1c/0x40 __x64_sys_getpeername+0x11/0x20 do_syscall_64+0x36/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xae This can be reproduced with Syzkaller C repro (bind followed by getpeername): https://syzkaller.appspot.com/x/repro.c?x=14def446e00000 Cc: Fixes: d646960f7986 ("NFC: Initial LLCP support") Reported-by: syzbot+80fb126e7f7d8b1a5914@syzkaller.appspotmail.com Reported-by: butt3rflyh4ck Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20210531072138.5219-1-krzysztof.kozlowski@canonical.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/nfc/llcp_sock.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -121,6 +121,7 @@ static int llcp_sock_bind(struct socket if (!llcp_sock->service_name) { nfc_llcp_local_put(llcp_sock->local); llcp_sock->local = NULL; + llcp_sock->dev = NULL; ret = -ENOMEM; goto put_dev; } @@ -130,6 +131,7 @@ static int llcp_sock_bind(struct socket llcp_sock->local = NULL; kfree(llcp_sock->service_name); llcp_sock->service_name = NULL; + llcp_sock->dev = NULL; ret = -EADDRINUSE; goto put_dev; } From patchwork Tue Jun 8 18:27:18 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 457776 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51E39C4743E for ; Tue, 8 Jun 2021 18:31:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3E38F613BE for ; Tue, 8 Jun 2021 18:31:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234286AbhFHScw (ORCPT ); Tue, 8 Jun 2021 14:32:52 -0400 Received: from mail.kernel.org ([198.145.29.99]:57158 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234300AbhFHSb6 (ORCPT ); Tue, 8 Jun 2021 14:31:58 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 1D935613C0; Tue, 8 Jun 2021 18:30:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177005; bh=Y1PqacJlLMxZczr5xfpqkS3te1WGm8Q8pKLUTEjGdWM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=opQlOe7k6jZ+e7BF1XZL6vMT8b+F8hLVkBvSfNny9eHAt76umdkbvGd8u+LOp1btX 6Xu1OGQYf/Fqh6/44a5Qu5uV3b9YzVUK278+Ae72yB82/J9/S001m3eQnBorVpP8gR F5OvI75RXZhZnkWZH/KX7XjbXhKakAhiTXtBBvKY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qu Wenruo , Josef Bacik , David Sterba Subject: [PATCH 4.9 24/29] btrfs: fix error handling in btrfs_del_csums Date: Tue, 8 Jun 2021 20:27:18 +0200 Message-Id: <20210608175928.604350746@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Josef Bacik commit b86652be7c83f70bf406bed18ecf55adb9bfb91b upstream. Error injection stress would sometimes fail with checksums on disk that did not have a corresponding extent. This occurred because the pattern in btrfs_del_csums was while (1) { ret = btrfs_search_slot(); if (ret < 0) break; } ret = 0; out: btrfs_free_path(path); return ret; If we got an error from btrfs_search_slot we'd clear the error because we were breaking instead of goto out. Instead of using goto out, simply handle the cases where we may leave a random value in ret, and get rid of the ret = 0; out: pattern and simply allow break to have the proper error reporting. With this fix we properly abort the transaction and do not commit thinking we successfully deleted the csum. Reviewed-by: Qu Wenruo CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/file-item.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/fs/btrfs/file-item.c +++ b/fs/btrfs/file-item.c @@ -608,7 +608,7 @@ int btrfs_del_csums(struct btrfs_trans_h u64 end_byte = bytenr + len; u64 csum_end; struct extent_buffer *leaf; - int ret; + int ret = 0; u16 csum_size = btrfs_super_csum_size(root->fs_info->super_copy); int blocksize_bits = root->fs_info->sb->s_blocksize_bits; @@ -626,6 +626,7 @@ int btrfs_del_csums(struct btrfs_trans_h path->leave_spinning = 1; ret = btrfs_search_slot(trans, root, &key, path, -1, 1); if (ret > 0) { + ret = 0; if (path->slots[0] == 0) break; path->slots[0]--; @@ -656,7 +657,7 @@ int btrfs_del_csums(struct btrfs_trans_h if (key.offset >= bytenr && csum_end <= end_byte) { ret = btrfs_del_item(trans, root, path); if (ret) - goto out; + break; if (key.offset == bytenr) break; } else if (key.offset < bytenr && csum_end > end_byte) { @@ -700,8 +701,9 @@ int btrfs_del_csums(struct btrfs_trans_h ret = btrfs_split_item(trans, root, path, &key, offset); if (ret && ret != -EAGAIN) { btrfs_abort_transaction(trans, ret); - goto out; + break; } + ret = 0; key.offset = end_byte - 1; } else { @@ -711,8 +713,6 @@ int btrfs_del_csums(struct btrfs_trans_h } btrfs_release_path(path); } - ret = 0; -out: btrfs_free_path(path); return ret; } From patchwork Tue Jun 8 18:27:19 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 457772 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 72CB6C4743D for ; Tue, 8 Jun 2021 18:31:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 57FC0613D5 for ; Tue, 8 Jun 2021 18:31:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234533AbhFHSdF (ORCPT ); Tue, 8 Jun 2021 14:33:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:56494 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234352AbhFHScN (ORCPT ); Tue, 8 Jun 2021 14:32:13 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8C18B613C1; Tue, 8 Jun 2021 18:30:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177008; bh=dSyeHuNH5G6Zk5YC/0ejhgdsju/WCR3ntE2LanrYy6o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Eu4KZuRdFa0uwDUAbLGRJCKT70P7dSxOSiX9jjqSRIxtVj8NQ1OwrIPhUj90ILZ0N RP2CU6LVG67Jv/Hd9FG/rJ12YRC87HQSeJIJn8HOizu2KXJyLVyGy39Qy9h0lXAbbw tnHp1PGuKZ34R37cfgY8uybiniPbWJEnM5LdPSlk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , David Sterba Subject: [PATCH 4.9 25/29] btrfs: fixup error handling in fixup_inode_link_counts Date: Tue, 8 Jun 2021 20:27:19 +0200 Message-Id: <20210608175928.637405503@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Josef Bacik commit 011b28acf940eb61c000059dd9e2cfcbf52ed96b upstream. This function has the following pattern while (1) { ret = whatever(); if (ret) goto out; } ret = 0 out: return ret; However several places in this while loop we simply break; when there's a problem, thus clearing the return value, and in one case we do a return -EIO, and leak the memory for the path. Fix this by re-arranging the loop to deal with ret == 1 coming from btrfs_search_slot, and then simply delete the ret = 0; out: bit so everybody can break if there is an error, which will allow for proper error handling to occur. CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/tree-log.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -1529,6 +1529,7 @@ static noinline int fixup_inode_link_cou break; if (ret == 1) { + ret = 0; if (path->slots[0] == 0) break; path->slots[0]--; @@ -1541,17 +1542,19 @@ static noinline int fixup_inode_link_cou ret = btrfs_del_item(trans, root, path); if (ret) - goto out; + break; btrfs_release_path(path); inode = read_one_inode(root, key.offset); - if (!inode) - return -EIO; + if (!inode) { + ret = -EIO; + break; + } ret = fixup_inode_link_count(trans, root, inode); iput(inode); if (ret) - goto out; + break; /* * fixup on a directory may create new entries, @@ -1560,8 +1563,6 @@ static noinline int fixup_inode_link_cou */ key.offset = (u64)-1; } - ret = 0; -out: btrfs_release_path(path); return ret; } From patchwork Tue Jun 8 18:27:20 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456753 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D316EC4743F for ; Tue, 8 Jun 2021 18:31:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B90C0613CA for ; Tue, 8 Jun 2021 18:31:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234020AbhFHSdF (ORCPT ); Tue, 8 Jun 2021 14:33:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:57310 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234355AbhFHScN (ORCPT ); Tue, 8 Jun 2021 14:32:13 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 26940613C5; Tue, 8 Jun 2021 18:30:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177010; bh=bNPUCVGmymxx+AMhaYS0kFv0psUZ7hmT5CTAZCJz0jU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RPNpgSFRspIJLosJlnJpG01v29dEG5AXOsiD99CveszhgnSoeV4WCMkxHgfrMJM7W OdgPtNCchhrdiv8FWyIN0Rmze5Lp2dTJGxPqCX6Yb93yMBzmg57lBwYEhac/dKfylN jb74N4zMiQ6ngJBFK2glLnLyxEX+A/hbAvCXU3Fw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Chan , "David S. Miller" , Krzysztof Kozlowski Subject: [PATCH 4.9 26/29] bnxt_en: Remove the setting of dev_port. Date: Tue, 8 Jun 2021 20:27:20 +0200 Message-Id: <20210608175928.669082541@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Michael Chan commit 1d86859fdf31a0d50cc82b5d0d6bfb5fe98f6c00 upstream. The dev_port is meant to distinguish the network ports belonging to the same PCI function. Our devices only have one network port associated with each PCI function and so we should not set it for correctness. Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Krzysztof Kozlowski Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -4262,7 +4262,6 @@ int bnxt_hwrm_func_qcaps(struct bnxt *bp pf->fw_fid = le16_to_cpu(resp->fid); pf->port_id = le16_to_cpu(resp->port_id); - bp->dev->dev_port = pf->port_id; memcpy(pf->mac_addr, resp->mac_address, ETH_ALEN); memcpy(bp->dev->dev_addr, pf->mac_addr, ETH_ALEN); pf->max_rsscos_ctxs = le16_to_cpu(resp->max_rsscos_ctx); From patchwork Tue Jun 8 18:27:21 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456755 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 96A92C48BD1 for ; Tue, 8 Jun 2021 18:31:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 86952613E3 for ; Tue, 8 Jun 2021 18:31:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234333AbhFHScz (ORCPT ); Tue, 8 Jun 2021 14:32:55 -0400 Received: from mail.kernel.org ([198.145.29.99]:57386 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234332AbhFHScH (ORCPT ); Tue, 8 Jun 2021 14:32:07 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7E1C7613C3; Tue, 8 Jun 2021 18:30:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177013; bh=B/Gs+pCslajavBfIyGu+Uc4kJDxnpnewLxxNa9+NQ8E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0fR5L8Qosk3JBUscKN3Hwh59jyzdOPPH5RrQ8v98PJEzwo1K2FZzT4T7CpW6fTJQE PQXr7K93t6vBqETQ07LrIjyL73YIbcDEtOFZTXCEzcGqMaxhIgjfdrMFt9nvTHMHv4 sEEQXIFAWgaurXThkd2PcV4S0PkfnIbf9u/yFnNA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sean Christopherson , Paolo Bonzini , Sudip Mukherjee Subject: [PATCH 4.9 27/29] KVM: SVM: Truncate GPR value for DR and CR accesses in !64-bit mode Date: Tue, 8 Jun 2021 20:27:21 +0200 Message-Id: <20210608175928.700196575@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Sean Christopherson commit 0884335a2e653b8a045083aa1d57ce74269ac81d upstream. Drop bits 63:32 on loads/stores to/from DRs and CRs when the vCPU is not in 64-bit mode. The APM states bits 63:32 are dropped for both DRs and CRs: In 64-bit mode, the operand size is fixed at 64 bits without the need for a REX prefix. In non-64-bit mode, the operand size is fixed at 32 bits and the upper 32 bits of the destination are forced to 0. Fixes: 7ff76d58a9dc ("KVM: SVM: enhance MOV CR intercept handler") Fixes: cae3797a4639 ("KVM: SVM: enhance mov DR intercept handler") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20210422022128.3464144-4-seanjc@google.com> Signed-off-by: Paolo Bonzini [sudip: manual backport to old file] Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman --- arch/x86/kvm/svm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -3412,7 +3412,7 @@ static int cr_interception(struct vcpu_s err = 0; if (cr >= 16) { /* mov to cr */ cr -= 16; - val = kvm_register_read(&svm->vcpu, reg); + val = kvm_register_readl(&svm->vcpu, reg); switch (cr) { case 0: if (!check_selective_cr0_intercepted(svm, val)) @@ -3457,7 +3457,7 @@ static int cr_interception(struct vcpu_s kvm_queue_exception(&svm->vcpu, UD_VECTOR); return 1; } - kvm_register_write(&svm->vcpu, reg, val); + kvm_register_writel(&svm->vcpu, reg, val); } kvm_complete_insn_gp(&svm->vcpu, err); @@ -3489,13 +3489,13 @@ static int dr_interception(struct vcpu_s if (dr >= 16) { /* mov to DRn */ if (!kvm_require_dr(&svm->vcpu, dr - 16)) return 1; - val = kvm_register_read(&svm->vcpu, reg); + val = kvm_register_readl(&svm->vcpu, reg); kvm_set_dr(&svm->vcpu, dr - 16, val); } else { if (!kvm_require_dr(&svm->vcpu, dr)) return 1; kvm_get_dr(&svm->vcpu, dr, &val); - kvm_register_write(&svm->vcpu, reg, val); + kvm_register_writel(&svm->vcpu, reg, val); } skip_emulated_instruction(&svm->vcpu); From patchwork Tue Jun 8 18:27:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 456752 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F018C47082 for ; Tue, 8 Jun 2021 18:31:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 58E87613E7 for ; Tue, 8 Jun 2021 18:31:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234588AbhFHSdS (ORCPT ); Tue, 8 Jun 2021 14:33:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:57406 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234389AbhFHScV (ORCPT ); Tue, 8 Jun 2021 14:32:21 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 2DF86613CC; Tue, 8 Jun 2021 18:30:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177015; bh=MmRXoHVfQm9eZj+KJphfdg8lo9nB1RfG2eYSEECiXdw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ex5A948qXJSTqTFNaXkmRlofkSTQw7ak6GzUF6FhFv3u0pMu3GIJfBQNfzZZxzSYI vberP4B2HW21eSfLv28Kl71DL8b7UWUm40H1dkp+U5qBlznZ5gDbXJvkbF0FmllIj8 SNbYSoVbwSwRuWoaoUtI2qHOh9cLFMW6Ci9OW17w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Will Deacon , Michael Weiser , Arnd Bergmann Subject: [PATCH 4.9 28/29] arm64: Remove unimplemented syscall log message Date: Tue, 8 Jun 2021 20:27:22 +0200 Message-Id: <20210608175928.730163589@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Michael Weiser commit 1962682d2b2fbe6cfa995a85c53c069fadda473e upstream. Stop printing a (ratelimited) kernel message for each instance of an unimplemented syscall being called. Userland making an unimplemented syscall is not necessarily misbehaviour and to be expected with a current userland running on an older kernel. Also, the current message looks scary to users but does not actually indicate a real problem nor help them narrow down the cause. Just rely on sys_ni_syscall() to return -ENOSYS. Cc: Acked-by: Will Deacon Signed-off-by: Michael Weiser Signed-off-by: Will Deacon Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman --- arch/arm64/kernel/traps.c | 8 -------- 1 file changed, 8 deletions(-) --- a/arch/arm64/kernel/traps.c +++ b/arch/arm64/kernel/traps.c @@ -543,14 +543,6 @@ asmlinkage long do_ni_syscall(struct pt_ } #endif - if (show_unhandled_signals_ratelimited()) { - pr_info("%s[%d]: syscall %d\n", current->comm, - task_pid_nr(current), (int)regs->syscallno); - dump_instr("", regs); - if (user_mode(regs)) - __show_regs(regs); - } - return sys_ni_syscall(); } From patchwork Tue Jun 8 18:27:23 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 457770 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.9 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50E63C4743F for ; Tue, 8 Jun 2021 18:31:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3DCAE610A2 for ; Tue, 8 Jun 2021 18:31:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234599AbhFHSd2 (ORCPT ); Tue, 8 Jun 2021 14:33:28 -0400 Received: from mail.kernel.org ([198.145.29.99]:57466 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234221AbhFHSc3 (ORCPT ); Tue, 8 Jun 2021 14:32:29 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id E7D66613D3; Tue, 8 Jun 2021 18:30:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1623177020; bh=xVMsWp26lw0ReF/0QrK6B1Ds64/IDcKJGNXPTJopo9E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QC4JxbQKs6pDyo5FvBS/IWFytvPvxR4LGW0qLc15+7qgbNzspN4AWsFTJcK9Musqv fIou9m1qofLsAudNzGwjbc6cULQsSjCG+talNrtOaJrFn7uoY0qa0ZpNfyQkJEcZGV z+ntY/dyiCEMQ0iQ81RQ/Y10uGjqXX9xBEewQ1kI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jan Beulich , Boris Ostrovsky , Juergen Gross Subject: [PATCH 4.9 29/29] xen-pciback: redo VF placement in the virtual topology Date: Tue, 8 Jun 2021 20:27:23 +0200 Message-Id: <20210608175928.763231955@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210608175927.821075974@linuxfoundation.org> References: <20210608175927.821075974@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jan Beulich The commit referenced below was incomplete: It merely affected what would get written to the vdev- xenstore node. The guest would still find the function at the original function number as long as __xen_pcibk_get_pci_dev() wouldn't be in sync. The same goes for AER wrt __xen_pcibk_get_pcifront_dev(). Undo overriding the function to zero and instead make sure that VFs at function zero remain alone in their slot. This has the added benefit of improving overall capacity, considering that there's only a total of 32 slots available right now (PCI segment and bus can both only ever be zero at present). This is upstream commit 4ba50e7c423c29639878c00573288869aa627068. Fixes: 8a5248fe10b1 ("xen PV passthru: assign SR-IOV virtual functions to separate virtual slots") Signed-off-by: Jan Beulich Reviewed-by: Boris Ostrovsky Link: https://lore.kernel.org/r/8def783b-404c-3452-196d-3f3fd4d72c9e@suse.com Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman --- drivers/xen/xen-pciback/vpci.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) --- a/drivers/xen/xen-pciback/vpci.c +++ b/drivers/xen/xen-pciback/vpci.c @@ -68,7 +68,7 @@ static int __xen_pcibk_add_pci_dev(struc struct pci_dev *dev, int devid, publish_pci_dev_cb publish_cb) { - int err = 0, slot, func = -1; + int err = 0, slot, func = PCI_FUNC(dev->devfn); struct pci_dev_entry *t, *dev_entry; struct vpci_dev_data *vpci_dev = pdev->pci_dev_data; @@ -93,23 +93,26 @@ static int __xen_pcibk_add_pci_dev(struc /* * Keep multi-function devices together on the virtual PCI bus, except - * virtual functions. + * that we want to keep virtual functions at func 0 on their own. They + * aren't multi-function devices and hence their presence at func 0 + * may cause guests to not scan the other functions. */ - if (!dev->is_virtfn) { + if (!dev->is_virtfn || func) { for (slot = 0; slot < PCI_SLOT_MAX; slot++) { if (list_empty(&vpci_dev->dev_list[slot])) continue; t = list_entry(list_first(&vpci_dev->dev_list[slot]), struct pci_dev_entry, list); + if (t->dev->is_virtfn && !PCI_FUNC(t->dev->devfn)) + continue; if (match_slot(dev, t->dev)) { pr_info("vpci: %s: assign to virtual slot %d func %d\n", pci_name(dev), slot, - PCI_FUNC(dev->devfn)); + func); list_add_tail(&dev_entry->list, &vpci_dev->dev_list[slot]); - func = PCI_FUNC(dev->devfn); goto unlock; } } @@ -122,7 +125,6 @@ static int __xen_pcibk_add_pci_dev(struc pci_name(dev), slot); list_add_tail(&dev_entry->list, &vpci_dev->dev_list[slot]); - func = dev->is_virtfn ? 0 : PCI_FUNC(dev->devfn); goto unlock; } }