From patchwork Mon Dec 13 09:29:44 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524208 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7F71C433EF for ; Mon, 13 Dec 2021 09:34:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234294AbhLMJez (ORCPT ); Mon, 13 Dec 2021 04:34:55 -0500 Received: from sin.source.kernel.org ([145.40.73.55]:58434 "EHLO sin.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233971AbhLMJeK (ORCPT ); Mon, 13 Dec 2021 04:34:10 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id DBAE9CE0E77; Mon, 13 Dec 2021 09:34:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87253C00446; Mon, 13 Dec 2021 09:34:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388047; bh=vJQ6ymBTQJdFTgo0RwDmqrh+qj8MQP8lRhHa+QDcWeo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y6V5wTT/6dQ3NsY3HwzEu70/fSoj00REBsSsUEcw6L4+agwmYMOi18oZFrZC8OxkC unHETcXF5ba5eh9Xn3OoPD2BtRRazfQ4ioe/OKn+Olb97dkYA53z+1CDkBrj8OqFk1 Fc+AjhrAS9w6VW+4GodjPna/EQ0s+eh6Or9y+778= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiri Kosina , Benjamin Tissoires , linux-input@vger.kernel.org Subject: [PATCH 4.9 02/42] HID: add hid_is_usb() function to make it simpler for USB detection Date: Mon, 13 Dec 2021 10:29:44 +0100 Message-Id: <20211213092926.660321136@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Greg Kroah-Hartman commit f83baa0cb6cfc92ebaf7f9d3a99d7e34f2e77a8a upstream. A number of HID drivers already call hid_is_using_ll_driver() but only for the detection of if this is a USB device or not. Make this more obvious by creating hid_is_usb() and calling the function that way. Also converts the existing hid_is_using_ll_driver() functions to use the new call. Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: linux-input@vger.kernel.org Cc: stable@vger.kernel.org Tested-by: Benjamin Tissoires Signed-off-by: Greg Kroah-Hartman Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20211201183503.2373082-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman --- include/linux/hid.h | 5 +++++ 1 file changed, 5 insertions(+) --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -773,6 +773,11 @@ static inline bool hid_is_using_ll_drive return hdev->ll_driver == driver; } +static inline bool hid_is_usb(struct hid_device *hdev) +{ + return hid_is_using_ll_driver(hdev, &usb_hid_driver); +} + #define PM_HINT_FULLON 1<<5 #define PM_HINT_NORMAL 1<<1 From patchwork Mon Dec 13 09:29:45 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524207 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0FF9BC433F5 for ; Mon, 13 Dec 2021 09:35:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234034AbhLMJe7 (ORCPT ); Mon, 13 Dec 2021 04:34:59 -0500 Received: from sin.source.kernel.org ([145.40.73.55]:58774 "EHLO sin.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234191AbhLMJeN (ORCPT ); Mon, 13 Dec 2021 04:34:13 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 9C850CE0E80; Mon, 13 Dec 2021 09:34:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7475EC341C8; Mon, 13 Dec 2021 09:34:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388049; bh=QjdaLbiw6/LNQx4pLtEM/V8Ju6WDBpt/VOhOLjDxbRU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NeKWYJzTJhFIj4vRmsDuUrxIQv/LNfBZ/32/iqVd1vzNlnJsVvLFGM2Ti86qLRHFR 8+kKsrDM4VUdKsgvQKcn7DuHc3nkvzvvIr5tkBx7GA7KkHtbMqGa+MNHEslp+rjlTc eJ7nd3Zh+EFxhzReDF9jZutlrBSUSFTngLCbgUsE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Jiri Kosina , Benjamin Tissoires Subject: [PATCH 4.9 03/42] HID: add USB_HID dependancy to hid-prodikeys Date: Mon, 13 Dec 2021 10:29:45 +0100 Message-Id: <20211213092926.689680730@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Greg Kroah-Hartman commit 30cb3c2ad24b66fb7639a6d1f4390c74d6e68f94 upstream. The prodikeys HID driver only controls USB devices, yet did not have a dependancy on USB_HID. This causes build errors on some configurations like nios2 when building due to new changes to the prodikeys driver. Reported-by: kernel test robot Cc: stable@vger.kernel.org Cc: Jiri Kosina Cc: Benjamin Tissoires Signed-off-by: Greg Kroah-Hartman Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20211203081231.2856936-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman --- drivers/hid/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/hid/Kconfig +++ b/drivers/hid/Kconfig @@ -194,7 +194,7 @@ config HID_CORSAIR config HID_PRODIKEYS tristate "Prodikeys PC-MIDI Keyboard support" - depends on HID && SND + depends on USB_HID && SND select SND_RAWMIDI ---help--- Support for Prodikeys PC-MIDI Keyboard device support. From patchwork Mon Dec 13 09:29:48 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524206 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B3FDC433F5 for ; Mon, 13 Dec 2021 09:35:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234047AbhLMJfK (ORCPT ); Mon, 13 Dec 2021 04:35:10 -0500 Received: from sin.source.kernel.org ([145.40.73.55]:58892 "EHLO sin.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234058AbhLMJeV (ORCPT ); Mon, 13 Dec 2021 04:34:21 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 192F6CE0E8B; Mon, 13 Dec 2021 09:34:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B965CC341C8; Mon, 13 Dec 2021 09:34:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388058; bh=2h2SHIPC2S9rx7FduwV2BKAFGGp9otTwfecsbTSF6iw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XIdDILMc5FO7oum8uzRALnfHDV5FBm0Bww5DukGTkBeWaeWkR+d0LrpYa6xeh2szH Ypp+C0KhjBs7G4B7MNnYOb0WleCelBxff7nCS7KeWZW59j9AojHZUnamtlgALZwmKy AUamNdWvx8jRHx/WzTy9oERmEdBREjeduSOTaV9I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiri Kosina , Benjamin Tissoires , linux-input@vger.kernel.org Subject: [PATCH 4.9 06/42] HID: wacom: fix problems when device is not a valid USB device Date: Mon, 13 Dec 2021 10:29:48 +0100 Message-Id: <20211213092926.780562238@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Greg Kroah-Hartman commit 720ac467204a70308bd687927ed475afb904e11b upstream. The wacom driver accepts devices of more than just USB types, but some code paths can cause problems if the device being controlled is not a USB device due to a lack of checking. Add the needed checks to ensure that the USB device accesses are only happening on a "real" USB device, and not one on some other bus. Cc: Jiri Kosina Cc: Benjamin Tissoires Cc: linux-input@vger.kernel.org Cc: stable@vger.kernel.org Tested-by: Benjamin Tissoires Signed-off-by: Greg Kroah-Hartman Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20211201183503.2373082-2-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman --- drivers/hid/wacom_sys.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -506,7 +506,7 @@ static void wacom_retrieve_hid_descripto * Skip the query for this type and modify defaults based on * interface number. */ - if (features->type == WIRELESS) { + if (features->type == WIRELESS && intf) { if (intf->cur_altsetting->desc.bInterfaceNumber == 0) features->device_type = WACOM_DEVICETYPE_WL_MONITOR; else @@ -2115,6 +2115,9 @@ static void wacom_wireless_work(struct w wacom_destroy_battery(wacom); + if (!usbdev) + return; + /* Stylus interface */ hdev1 = usb_get_intfdata(usbdev->config->interface[1]); wacom1 = hid_get_drvdata(hdev1); @@ -2354,8 +2357,6 @@ static void wacom_remote_work(struct wor static int wacom_probe(struct hid_device *hdev, const struct hid_device_id *id) { - struct usb_interface *intf = to_usb_interface(hdev->dev.parent); - struct usb_device *dev = interface_to_usbdev(intf); struct wacom *wacom; struct wacom_wac *wacom_wac; struct wacom_features *features; @@ -2388,8 +2389,14 @@ static int wacom_probe(struct hid_device wacom_wac->hid_data.inputmode = -1; wacom_wac->mode_report = -1; - wacom->usbdev = dev; - wacom->intf = intf; + if (hid_is_usb(hdev)) { + struct usb_interface *intf = to_usb_interface(hdev->dev.parent); + struct usb_device *dev = interface_to_usbdev(intf); + + wacom->usbdev = dev; + wacom->intf = intf; + } + mutex_init(&wacom->lock); INIT_WORK(&wacom->wireless_work, wacom_wireless_work); INIT_WORK(&wacom->battery_work, wacom_battery_work); From patchwork Mon Dec 13 09:29:50 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524205 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3AB8C433FE for ; Mon, 13 Dec 2021 09:35:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233854AbhLMJfS (ORCPT ); Mon, 13 Dec 2021 04:35:18 -0500 Received: from sin.source.kernel.org ([145.40.73.55]:58940 "EHLO sin.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234228AbhLMJe1 (ORCPT ); Mon, 13 Dec 2021 04:34:27 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id CEDC0CE0E76; Mon, 13 Dec 2021 09:34:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D3C8C341C5; Mon, 13 Dec 2021 09:34:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388064; bh=ENgPx5OkxDJcwKlrbQgZkXRGBAk/W6IXPLXjBp12eas=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0JG19fO6ZYGQsR7EdmTZ4COICctfetooiF3zpf6Rokrc4TH44MjYp8UkvB4FPjXpr YPyIBYM0l8C6pqW4cfbCQJqs52ohqwb6Pj4jq5tT9BoNXF81XtSk1Gz3dVmz+mJ7Bj VLAsr4FyciOgDrXOvSHfJQEV6csiz0UhUfxVllgA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Oliver Hartkopp , Marc Kleine-Budde Subject: [PATCH 4.9 08/42] can: sja1000: fix use after free in ems_pcmcia_add_card() Date: Mon, 13 Dec 2021 10:29:50 +0100 Message-Id: <20211213092926.856019651@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dan Carpenter commit 3ec6ca6b1a8e64389f0212b5a1b0f6fed1909e45 upstream. If the last channel is not available then "dev" is freed. Fortunately, we can just use "pdev->irq" instead. Also we should check if at least one channel was set up. Fixes: fd734c6f25ae ("can/sja1000: add driver for EMS PCMCIA card") Link: https://lore.kernel.org/all/20211124145041.GB13656@kili Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter Acked-by: Oliver Hartkopp Tested-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman --- drivers/net/can/sja1000/ems_pcmcia.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/net/can/sja1000/ems_pcmcia.c +++ b/drivers/net/can/sja1000/ems_pcmcia.c @@ -243,7 +243,12 @@ static int ems_pcmcia_add_card(struct pc free_sja1000dev(dev); } - err = request_irq(dev->irq, &ems_pcmcia_interrupt, IRQF_SHARED, + if (!card->channels) { + err = -ENODEV; + goto failure_cleanup; + } + + err = request_irq(pdev->irq, &ems_pcmcia_interrupt, IRQF_SHARED, DRV_NAME, card); if (!err) return 0; From patchwork Mon Dec 13 09:29:53 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524183 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7168EC433EF for ; Mon, 13 Dec 2021 09:37:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232985AbhLMJhw (ORCPT ); Mon, 13 Dec 2021 04:37:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54702 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234589AbhLMJgT (ORCPT ); Mon, 13 Dec 2021 04:36:19 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9A671C061201; Mon, 13 Dec 2021 01:36:04 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 670B6B80E1A; Mon, 13 Dec 2021 09:36:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 81224C341C5; Mon, 13 Dec 2021 09:36:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388162; bh=PEW5JwRnVWEkYcLV4SbNhbgEEuIYDpogGayn3ZHK2N0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MP2qCzWgzwE1Owa5mJtsqlyyp1ni3bQgBn7HaBTeOhUFFkV5ftNC6MginMKiFhcLU YJEVvhOXi/RiuqXj5ALrPWLjkAPcmch+S24HyycuLjWrQgzsd6jZmgXe8TriUOEHH6 jQPSjCFWKqg6yGU6AhAvRaZemgZyI9ibjO9h5W4Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Manjong Lee , "Peter Zijlstra (Intel)" , Changheun Lee , Jens Axboe , Christoph Hellwig , Matthew Wilcox , seunghwan.hyun@samsung.com, sookwan7.kim@samsung.com, yt0928.kim@samsung.com, junho89.kim@samsung.com, jisoo2146.oh@samsung.com, Andrew Morton , Linus Torvalds Subject: [PATCH 4.9 11/42] mm: bdi: initialize bdi_min_ratio when bdi is unregistered Date: Mon, 13 Dec 2021 10:29:53 +0100 Message-Id: <20211213092926.950166266@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Manjong Lee commit 3c376dfafbf7a8ea0dea212d095ddd83e93280bb upstream. Initialize min_ratio if it is set during bdi unregistration. This can prevent problems that may occur a when bdi is removed without resetting min_ratio. For example. 1) insert external sdcard 2) set external sdcard's min_ratio 70 3) remove external sdcard without setting min_ratio 0 4) insert external sdcard 5) set external sdcard's min_ratio 70 << error occur(can't set) Because when an sdcard is removed, the present bdi_min_ratio value will remain. Currently, the only way to reset bdi_min_ratio is to reboot. [akpm@linux-foundation.org: tweak comment and coding style] Link: https://lkml.kernel.org/r/20211021161942.5983-1-mj0123.lee@samsung.com Signed-off-by: Manjong Lee Acked-by: Peter Zijlstra (Intel) Cc: Changheun Lee Cc: Jens Axboe Cc: Christoph Hellwig Cc: Matthew Wilcox Cc: Cc: Cc: Cc: Cc: Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/backing-dev.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -865,6 +865,13 @@ void bdi_unregister(struct backing_dev_i wb_shutdown(&bdi->wb); cgwb_bdi_destroy(bdi); + /* + * If this BDI's min ratio has been set, use bdi_set_min_ratio() to + * update the global bdi_min_ratio. + */ + if (bdi->min_ratio) + bdi_set_min_ratio(bdi, 0); + if (bdi->dev) { bdi_debug_unregister(bdi); device_unregister(bdi->dev); From patchwork Mon Dec 13 09:29:54 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524204 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5BC45C4332F for ; Mon, 13 Dec 2021 09:35:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234243AbhLMJf0 (ORCPT ); Mon, 13 Dec 2021 04:35:26 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:48358 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234123AbhLMJeg (ORCPT ); Mon, 13 Dec 2021 04:34:36 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 26A07B80E0E; Mon, 13 Dec 2021 09:34:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6FB69C341C8; Mon, 13 Dec 2021 09:34:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388073; bh=txRjvqdPoP9bXfWGgH14tGapvUXAwE0Jl0sRvtiVegU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AoQ5t9yxLWR3RjGM53FV/vFVh4783eviwujDgceXrcR83GHDzxaXU5MxsQgbgmQyZ I5rz9ksg8jNRmc/VbuYJ34aVLaWdYxrKwI6f2A+debCZSIBSLv7wg0MqDUdFbPZNIU UaN3r4Y3tzb+1SBBI7a94+X4cf+3JC9XHFdyHkIc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Young , Takashi Iwai Subject: [PATCH 4.9 12/42] ALSA: ctl: Fix copy of updated id with element read/write Date: Mon, 13 Dec 2021 10:29:54 +0100 Message-Id: <20211213092926.979784266@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Alan Young commit b6409dd6bdc03aa178bbff0d80db2a30d29b63ac upstream. When control_compat.c:copy_ctl_value_to_user() is used, by ctl_elem_read_user() & ctl_elem_write_user(), it must also copy back the snd_ctl_elem_id value that may have been updated (filled in) by the call to snd_ctl_elem_read/snd_ctl_elem_write(). This matches the functionality provided by snd_ctl_elem_read_user() and snd_ctl_elem_write_user(), via snd_ctl_build_ioff(). Without this, and without making additional calls to snd_ctl_info() which are unnecessary when using the non-compat calls, a userspace application will not know the numid value for the element and consequently will not be able to use the poll/read interface on the control file to determine which elements have updates. Signed-off-by: Alan Young Cc: Link: https://lore.kernel.org/r/20211202150607.543389-1-consult.awy@gmail.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/core/control_compat.c | 3 +++ 1 file changed, 3 insertions(+) --- a/sound/core/control_compat.c +++ b/sound/core/control_compat.c @@ -281,6 +281,7 @@ static int copy_ctl_value_to_user(void _ struct snd_ctl_elem_value *data, int type, int count) { + struct snd_ctl_elem_value32 __user *data32 = userdata; int i, size; if (type == SNDRV_CTL_ELEM_TYPE_BOOLEAN || @@ -297,6 +298,8 @@ static int copy_ctl_value_to_user(void _ if (copy_to_user(valuep, data->value.bytes.data, size)) return -EFAULT; } + if (copy_to_user(&data32->id, &data->id, sizeof(data32->id))) + return -EFAULT; return 0; } From patchwork Mon Dec 13 09:29:55 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524198 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75F4BC433EF for ; Mon, 13 Dec 2021 09:36:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234493AbhLMJgD (ORCPT ); Mon, 13 Dec 2021 04:36:03 -0500 Received: from sin.source.kernel.org ([145.40.73.55]:59438 "EHLO sin.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234321AbhLMJfH (ORCPT ); Mon, 13 Dec 2021 04:35:07 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id D2A8ECE0E7F; Mon, 13 Dec 2021 09:35:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 825F2C341DA; Mon, 13 Dec 2021 09:35:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388104; bh=VI8xP7ZuvldA6Iec36rX9eA/AtZCIL+Lvw7PCXDDm8k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KvdfIVdriLMpb9hE+40gLVFbbvWDHmJ9TE3Dh3zB+kaxeslGYi42i+YjODteHzZjo QYsf5PRNd53cA7FCQeIkUciMLP62qeKgKuwfFWxT6A7cAQ8sSwhBq7YRwjTmavGpHw 3gEQE316rIu80rx0jcG9MM1V+io2Tvr5D995o1fU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+bb348e9f9a954d42746f@syzkaller.appspotmail.com, Bixuan Cui , Takashi Iwai Subject: [PATCH 4.9 13/42] ALSA: pcm: oss: Fix negative period/buffer sizes Date: Mon, 13 Dec 2021 10:29:55 +0100 Message-Id: <20211213092927.010408221@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Takashi Iwai commit 9d2479c960875ca1239bcb899f386970c13d9cfe upstream. The period size calculation in OSS layer may receive a negative value as an error, but the code there assumes only the positive values and handle them with size_t. Due to that, a too big value may be passed to the lower layers. This patch changes the code to handle with ssize_t and adds the proper error checks appropriately. Reported-by: syzbot+bb348e9f9a954d42746f@syzkaller.appspotmail.com Reported-by: Bixuan Cui Cc: Link: https://lore.kernel.org/r/1638270978-42412-1-git-send-email-cuibixuan@linux.alibaba.com Link: https://lore.kernel.org/r/20211201073606.11660-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/core/oss/pcm_oss.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -173,7 +173,7 @@ snd_pcm_hw_param_value_min(const struct * * Return the maximum value for field PAR. */ -static unsigned int +static int snd_pcm_hw_param_value_max(const struct snd_pcm_hw_params *params, snd_pcm_hw_param_t var, int *dir) { @@ -708,18 +708,24 @@ static int snd_pcm_oss_period_size(struc struct snd_pcm_hw_params *oss_params, struct snd_pcm_hw_params *slave_params) { - size_t s; - size_t oss_buffer_size, oss_period_size, oss_periods; - size_t min_period_size, max_period_size; + ssize_t s; + ssize_t oss_buffer_size; + ssize_t oss_period_size, oss_periods; + ssize_t min_period_size, max_period_size; struct snd_pcm_runtime *runtime = substream->runtime; size_t oss_frame_size; oss_frame_size = snd_pcm_format_physical_width(params_format(oss_params)) * params_channels(oss_params) / 8; + oss_buffer_size = snd_pcm_hw_param_value_max(slave_params, + SNDRV_PCM_HW_PARAM_BUFFER_SIZE, + NULL); + if (oss_buffer_size <= 0) + return -EINVAL; oss_buffer_size = snd_pcm_plug_client_size(substream, - snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_BUFFER_SIZE, NULL)) * oss_frame_size; - if (!oss_buffer_size) + oss_buffer_size * oss_frame_size); + if (oss_buffer_size <= 0) return -EINVAL; oss_buffer_size = rounddown_pow_of_two(oss_buffer_size); if (atomic_read(&substream->mmap_count)) { @@ -756,7 +762,7 @@ static int snd_pcm_oss_period_size(struc min_period_size = snd_pcm_plug_client_size(substream, snd_pcm_hw_param_value_min(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL)); - if (min_period_size) { + if (min_period_size > 0) { min_period_size *= oss_frame_size; min_period_size = roundup_pow_of_two(min_period_size); if (oss_period_size < min_period_size) @@ -765,7 +771,7 @@ static int snd_pcm_oss_period_size(struc max_period_size = snd_pcm_plug_client_size(substream, snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIOD_SIZE, NULL)); - if (max_period_size) { + if (max_period_size > 0) { max_period_size *= oss_frame_size; max_period_size = rounddown_pow_of_two(max_period_size); if (oss_period_size > max_period_size) @@ -778,7 +784,7 @@ static int snd_pcm_oss_period_size(struc oss_periods = substream->oss.setup.periods; s = snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIODS, NULL); - if (runtime->oss.maxfrags && s > runtime->oss.maxfrags) + if (s > 0 && runtime->oss.maxfrags && s > runtime->oss.maxfrags) s = runtime->oss.maxfrags; if (oss_periods > s) oss_periods = s; From patchwork Mon Dec 13 09:29:56 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524193 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32FF4C433FE for ; Mon, 13 Dec 2021 09:36:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232339AbhLMJgn (ORCPT ); Mon, 13 Dec 2021 04:36:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234417AbhLMJfj (ORCPT ); Mon, 13 Dec 2021 04:35:39 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A3AEEC0698D5; Mon, 13 Dec 2021 01:35:38 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6C3EBB80E07; Mon, 13 Dec 2021 09:35:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ADA1BC341E1; Mon, 13 Dec 2021 09:35:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388136; bh=d8IkJ1LJXr8uMdLK9d1D1Ye1F6i9Ntzvl94KvcSNHxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=o/S31orCErdZHCR9Vu790u3BxLJ5/pOsuN+C7dbsWsl6Xi8hbdLnMHNaX7UcWsBCE vC39wC4WfedLdFLaVXNz6LCKhmBYh0HPWGITyFHVwihR9rsc7bao/Ebt3HWh73Id/D a1uIA3QVxjVj7bS0jL680aplZyWuEtbgv1bwAT8w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+bb348e9f9a954d42746f@syzkaller.appspotmail.com, Bixuan Cui , Takashi Iwai Subject: [PATCH 4.9 14/42] ALSA: pcm: oss: Limit the period size to 16MB Date: Mon, 13 Dec 2021 10:29:56 +0100 Message-Id: <20211213092927.043931503@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Takashi Iwai commit 8839c8c0f77ab8fc0463f4ab8b37fca3f70677c2 upstream. Set the practical limit to the period size (the fragment shift in OSS) instead of a full 31bit; a too large value could lead to the exhaust of memory as we allocate temporary buffers of the period size, too. As of this patch, we set to 16MB limit, which should cover all use cases. Reported-by: syzbot+bb348e9f9a954d42746f@syzkaller.appspotmail.com Reported-by: Bixuan Cui Cc: Link: https://lore.kernel.org/r/1638270978-42412-1-git-send-email-cuibixuan@linux.alibaba.com Link: https://lore.kernel.org/r/20211201073606.11660-3-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/core/oss/pcm_oss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -2019,7 +2019,7 @@ static int snd_pcm_oss_set_fragment1(str if (runtime->oss.subdivision || runtime->oss.fragshift) return -EINVAL; fragshift = val & 0xffff; - if (fragshift >= 31) + if (fragshift >= 25) /* should be large enough */ return -EINVAL; runtime->oss.fragshift = fragshift; runtime->oss.maxfrags = (val >> 16) & 0xffff; From patchwork Mon Dec 13 09:29:58 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524191 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B50EC433F5 for ; Mon, 13 Dec 2021 09:37:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234159AbhLMJhC (ORCPT ); Mon, 13 Dec 2021 04:37:02 -0500 Received: from sin.source.kernel.org ([145.40.73.55]:59990 "EHLO sin.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232580AbhLMJfu (ORCPT ); Mon, 13 Dec 2021 04:35:50 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 40AEACE0E85; Mon, 13 Dec 2021 09:35:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BC2F0C341C5; Mon, 13 Dec 2021 09:35:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388147; bh=hwFRtmyEf/mAFJdBB3fQiFSrTYHKvyvgW5eCodCTbH8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZWwqIDYHmo7wcVShq1AZDZNindGYCLiNglRtXo+t7oeziBssjr49VjsEesYELKvS/ qZ/zNDTxrMEEvh6TbZgBytBcV4Xr29NK9Y1kuIDWmNt0ZBdu4Q83vIzCX3R25EZKyx u9p/YLMxsIzaI2nYtRXG4jfL2JmrihWs8GONHDOo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kees Cook , Ingo Molnar , Andrew Morton , Linus Torvalds , Al Viro , Yabin Cui , Christian Brauner , Kalesh Singh , "Steven Rostedt (VMware)" Subject: [PATCH 4.9 16/42] tracefs: Have new files inherit the ownership of their parent Date: Mon, 13 Dec 2021 10:29:58 +0100 Message-Id: <20211213092927.108231338@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Steven Rostedt (VMware) commit ee7f3666995d8537dec17b1d35425f28877671a9 upstream. If directories in tracefs have their ownership changed, then any new files and directories that are created under those directories should inherit the ownership of the director they are created in. Link: https://lkml.kernel.org/r/20211208075720.4855d180@gandalf.local.home Cc: Kees Cook Cc: Ingo Molnar Cc: Andrew Morton Cc: Linus Torvalds Cc: Al Viro Cc: Greg Kroah-Hartman Cc: Yabin Cui Cc: Christian Brauner Cc: stable@vger.kernel.org Fixes: 4282d60689d4f ("tracefs: Add new tracefs file system") Reported-by: Kalesh Singh Reported: https://lore.kernel.org/all/CAC_TJve8MMAv+H_NdLSJXZUSoxOEq2zB_pVaJ9p=7H6Bu3X76g@mail.gmail.com/ Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Greg Kroah-Hartman --- fs/tracefs/inode.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -411,6 +411,8 @@ struct dentry *tracefs_create_file(const inode->i_mode = mode; inode->i_fop = fops ? fops : &tracefs_file_operations; inode->i_private = data; + inode->i_uid = d_inode(dentry->d_parent)->i_uid; + inode->i_gid = d_inode(dentry->d_parent)->i_gid; d_instantiate(dentry, inode); fsnotify_create(dentry->d_parent->d_inode, dentry); return end_creating(dentry); @@ -433,6 +435,8 @@ static struct dentry *__create_dir(const inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP; inode->i_op = ops; inode->i_fop = &simple_dir_operations; + inode->i_uid = d_inode(dentry->d_parent)->i_uid; + inode->i_gid = d_inode(dentry->d_parent)->i_gid; /* directory inodes start off with i_nlink == 2 (for "." entry) */ inc_nlink(inode); From patchwork Mon Dec 13 09:30:01 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524187 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42672C433FE for ; Mon, 13 Dec 2021 09:37:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234558AbhLMJhb (ORCPT ); Mon, 13 Dec 2021 04:37:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54688 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234579AbhLMJgT (ORCPT ); Mon, 13 Dec 2021 04:36:19 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7E795C07E5EB; Mon, 13 Dec 2021 01:35:58 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 41AC2B80E25; Mon, 13 Dec 2021 09:35:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6D542C00446; Mon, 13 Dec 2021 09:35:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388156; bh=eQgkcUpbF7Tdw0t+i2I44ylmm409CKrMFQdqKD8Ua+w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G1Q4WBD1unB2biwxyHWrQcLnVN1Yl9LQ//lmkVyOA6nvJ/IYT1J+WEpSlCDG5SMxR FsFUPbXFEieVP12+GdeJSaAwFbyEPH5SkaPyIwuL6SWA5PQ97Y3UilANIwhVntwkpn FaRskrnsnAwNoQuuGIXg1b885FOwA/Y2+zVBaBbg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , "linux-kernel@vger.kernel.org, Linus Torvalds" , Eric Biggers , Linus Torvalds Subject: [PATCH 4.9 19/42] wait: add wake_up_pollfree() Date: Mon, 13 Dec 2021 10:30:01 +0100 Message-Id: <20211213092927.203069108@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Biggers commit 42288cb44c4b5fff7653bc392b583a2b8bd6a8c0 upstream. Several ->poll() implementations are special in that they use a waitqueue whose lifetime is the current task, rather than the struct file as is normally the case. This is okay for blocking polls, since a blocking poll occurs within one task; however, non-blocking polls require another solution. This solution is for the queue to be cleared before it is freed, using 'wake_up_poll(wq, EPOLLHUP | POLLFREE);'. However, that has a bug: wake_up_poll() calls __wake_up() with nr_exclusive=1. Therefore, if there are multiple "exclusive" waiters, and the wakeup function for the first one returns a positive value, only that one will be called. That's *not* what's needed for POLLFREE; POLLFREE is special in that it really needs to wake up everyone. Considering the three non-blocking poll systems: - io_uring poll doesn't handle POLLFREE at all, so it is broken anyway. - aio poll is unaffected, since it doesn't support exclusive waits. However, that's fragile, as someone could add this feature later. - epoll doesn't appear to be broken by this, since its wakeup function returns 0 when it sees POLLFREE. But this is fragile. Although there is a workaround (see epoll), it's better to define a function which always sends POLLFREE to all waiters. Add such a function. Also make it verify that the queue really becomes empty after all waiters have been woken up. Reported-by: Linus Torvalds Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211209010455.42744-2-ebiggers@kernel.org Signed-off-by: Eric Biggers Signed-off-by: Greg Kroah-Hartman --- include/linux/wait.h | 26 ++++++++++++++++++++++++++ kernel/sched/wait.c | 8 ++++++++ 2 files changed, 34 insertions(+) --- a/include/linux/wait.h +++ b/include/linux/wait.h @@ -202,6 +202,7 @@ void __wake_up_locked_key(wait_queue_hea void __wake_up_sync_key(wait_queue_head_t *q, unsigned int mode, int nr, void *key); void __wake_up_locked(wait_queue_head_t *q, unsigned int mode, int nr); void __wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr); +void __wake_up_pollfree(wait_queue_head_t *wq_head); void __wake_up_bit(wait_queue_head_t *, void *, int); int __wait_on_bit(wait_queue_head_t *, struct wait_bit_queue *, wait_bit_action_f *, unsigned); int __wait_on_bit_lock(wait_queue_head_t *, struct wait_bit_queue *, wait_bit_action_f *, unsigned); @@ -236,6 +237,31 @@ wait_queue_head_t *bit_waitqueue(void *, #define wake_up_interruptible_sync_poll(x, m) \ __wake_up_sync_key((x), TASK_INTERRUPTIBLE, 1, (void *) (m)) +/** + * wake_up_pollfree - signal that a polled waitqueue is going away + * @wq_head: the wait queue head + * + * In the very rare cases where a ->poll() implementation uses a waitqueue whose + * lifetime is tied to a task rather than to the 'struct file' being polled, + * this function must be called before the waitqueue is freed so that + * non-blocking polls (e.g. epoll) are notified that the queue is going away. + * + * The caller must also RCU-delay the freeing of the wait_queue_head, e.g. via + * an explicit synchronize_rcu() or call_rcu(), or via SLAB_DESTROY_BY_RCU. + */ +static inline void wake_up_pollfree(wait_queue_head_t *wq_head) +{ + /* + * For performance reasons, we don't always take the queue lock here. + * Therefore, we might race with someone removing the last entry from + * the queue, and proceed while they still hold the queue lock. + * However, rcu_read_lock() is required to be held in such cases, so we + * can safely proceed with an RCU-delayed free. + */ + if (waitqueue_active(wq_head)) + __wake_up_pollfree(wq_head); +} + #define ___wait_cond_timeout(condition) \ ({ \ bool __cond = (condition); \ --- a/kernel/sched/wait.c +++ b/kernel/sched/wait.c @@ -10,6 +10,7 @@ #include #include #include +#include void __init_waitqueue_head(wait_queue_head_t *q, const char *name, struct lock_class_key *key) { @@ -156,6 +157,13 @@ void __wake_up_sync(wait_queue_head_t *q } EXPORT_SYMBOL_GPL(__wake_up_sync); /* For internal use only */ +void __wake_up_pollfree(wait_queue_head_t *wq_head) +{ + __wake_up(wq_head, TASK_NORMAL, 0, (void *)(POLLHUP | POLLFREE)); + /* POLLFREE must have cleared the queue. */ + WARN_ON_ONCE(waitqueue_active(wq_head)); +} + /* * Note: we use "set_current_state()" _after_ the wait-queue add, * because we need a memory barrier there on SMP, so that any From patchwork Mon Dec 13 09:30:02 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524189 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42A60C43217 for ; Mon, 13 Dec 2021 09:37:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234206AbhLMJhL (ORCPT ); Mon, 13 Dec 2021 04:37:11 -0500 Received: from sin.source.kernel.org ([145.40.73.55]:60148 "EHLO sin.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234481AbhLMJgC (ORCPT ); Mon, 13 Dec 2021 04:36:02 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id AA9D5CE0E79; Mon, 13 Dec 2021 09:36:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53624C341C5; Mon, 13 Dec 2021 09:35:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388158; bh=rL/lp714uv9WSyeOsvL2X/QdccsZx2rm/eVD2yB2QFo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ryhj1bROuMdb4ZWrpcCrWG98dcBbOXR25p4DM/RLPtFUkUGd4rGO23YTM5Nbsjqex GcOTXoor3c6FEARRViUGPaVGlxbB40zumsNYJnFePOTsHQSPz21xf5N2zTHBrDAu7b 0/bygXgHvGKfWLv0XBYkrFTGZ1uLoR4fUZCvEFlA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , "linux-kernel@vger.kernel.org, Linus Torvalds" , Eric Biggers , Linus Torvalds Subject: [PATCH 4.9 20/42] binder: use wake_up_pollfree() Date: Mon, 13 Dec 2021 10:30:02 +0100 Message-Id: <20211213092927.234096819@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Biggers commit a880b28a71e39013e357fd3adccd1d8a31bc69a8 upstream. wake_up_poll() uses nr_exclusive=1, so it's not guaranteed to wake up all exclusive waiters. Yet, POLLFREE *must* wake up all waiters. epoll and aio poll are fortunately not affected by this, but it's very fragile. Thus, the new function wake_up_pollfree() has been introduced. Convert binder to use wake_up_pollfree(). Reported-by: Linus Torvalds Fixes: f5cb779ba163 ("ANDROID: binder: remove waitqueue when thread exits.") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211209010455.42744-3-ebiggers@kernel.org Signed-off-by: Eric Biggers Signed-off-by: Greg Kroah-Hartman --- drivers/android/binder.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2641,21 +2641,18 @@ static int binder_free_thread(struct bin } /* - * If this thread used poll, make sure we remove the waitqueue - * from any epoll data structures holding it with POLLFREE. - * waitqueue_active() is safe to use here because we're holding - * the global lock. + * If this thread used poll, make sure we remove the waitqueue from any + * poll data structures holding it. */ - if ((thread->looper & BINDER_LOOPER_STATE_POLL) && - waitqueue_active(&thread->wait)) { - wake_up_poll(&thread->wait, POLLHUP | POLLFREE); - } + if (thread->looper & BINDER_LOOPER_STATE_POLL) + wake_up_pollfree(&thread->wait); /* - * This is needed to avoid races between wake_up_poll() above and - * and ep_remove_waitqueue() called for other reasons (eg the epoll file - * descriptor being closed); ep_remove_waitqueue() holds an RCU read - * lock, so we can be sure it's done after calling synchronize_rcu(). + * This is needed to avoid races between wake_up_pollfree() above and + * someone else removing the last entry from the queue for other reasons + * (e.g. ep_remove_wait_queue() being called due to an epoll file + * descriptor being closed). Such other users hold an RCU read lock, so + * we can be sure they're done after we call synchronize_rcu(). */ if (thread->looper & BINDER_LOOPER_STATE_POLL) synchronize_rcu(); From patchwork Mon Dec 13 09:30:04 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524203 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 333DAC4332F for ; Mon, 13 Dec 2021 09:35:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234373AbhLMJf2 (ORCPT ); Mon, 13 Dec 2021 04:35:28 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:48464 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233902AbhLMJel (ORCPT ); Mon, 13 Dec 2021 04:34:41 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AE9DAB80E16; Mon, 13 Dec 2021 09:34:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 04400C341CA; Mon, 13 Dec 2021 09:34:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388078; bh=xzVkQ9hdLO29h6SFG2SXAulAR8G5KxM/+U2yM8ovitM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rthby03NgExDjGQ7PqGwi2Ru7BhaCzf5GbCWgGV2qpGgdLznlPYmEfstO7IW9xBPB g5CvG/rrX+cC+Pkolj5uVCaxid2NXKjpjlMKTgjzERUC4pMVyEpD1HdlDNf4b2cVK9 +kMA++gHkCusWYd07B2uUu/nhUTGivZY/LAU+Mjs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ingo Molnar , Kees Cook , Andrew Morton , Linus Torvalds , linux-fsdevel@vger.kernel.org, Al Viro , Kalesh Singh , Yabin Cui , "Steven Rostedt (VMware)" Subject: [PATCH 4.9 22/42] tracefs: Set all files to the same group ownership as the mount option Date: Mon, 13 Dec 2021 10:30:04 +0100 Message-Id: <20211213092927.298812141@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Steven Rostedt (VMware) commit 48b27b6b5191e2e1f2798cd80877b6e4ef47c351 upstream. As people have been asking to allow non-root processes to have access to the tracefs directory, it was considered best to only allow groups to have access to the directory, where it is easier to just set the tracefs file system to a specific group (as other would be too dangerous), and that way the admins could pick which processes would have access to tracefs. Unfortunately, this broke tooling on Android that expected the other bit to be set. For some special cases, for non-root tools to trace the system, tracefs would be mounted and change the permissions of the top level directory which gave access to all running tasks permission to the tracing directory. Even though this would be dangerous to do in a production environment, for testing environments this can be useful. Now with the new changes to not allow other (which is still the proper thing to do), it breaks the testing tooling. Now more code needs to be loaded on the system to change ownership of the tracing directory. The real solution is to have tracefs honor the gid=xxx option when mounting. That is, (tracing group tracing has value 1003) mount -t tracefs -o gid=1003 tracefs /sys/kernel/tracing should have it that all files in the tracing directory should be of the given group. Copy the logic from d_walk() from dcache.c and simplify it for the mount case of tracefs if gid is set. All the files in tracefs will be walked and their group will be set to the value passed in. Link: https://lkml.kernel.org/r/20211207171729.2a54e1b3@gandalf.local.home Cc: Ingo Molnar Cc: Kees Cook Cc: Andrew Morton Cc: Linus Torvalds Cc: linux-fsdevel@vger.kernel.org Cc: Al Viro Cc: Greg Kroah-Hartman Reported-by: Kalesh Singh Reported-by: Yabin Cui Fixes: 49d67e445742 ("tracefs: Have tracefs directories not set OTH permission bits by default") Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Greg Kroah-Hartman --- fs/tracefs/inode.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -162,6 +162,77 @@ struct tracefs_fs_info { struct tracefs_mount_opts mount_opts; }; +static void change_gid(struct dentry *dentry, kgid_t gid) +{ + if (!dentry->d_inode) + return; + dentry->d_inode->i_gid = gid; +} + +/* + * Taken from d_walk, but without he need for handling renames. + * Nothing can be renamed while walking the list, as tracefs + * does not support renames. This is only called when mounting + * or remounting the file system, to set all the files to + * the given gid. + */ +static void set_gid(struct dentry *parent, kgid_t gid) +{ + struct dentry *this_parent; + struct list_head *next; + + this_parent = parent; + spin_lock(&this_parent->d_lock); + + change_gid(this_parent, gid); +repeat: + next = this_parent->d_subdirs.next; +resume: + while (next != &this_parent->d_subdirs) { + struct list_head *tmp = next; + struct dentry *dentry = list_entry(tmp, struct dentry, d_child); + next = tmp->next; + + spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); + + change_gid(dentry, gid); + + if (!list_empty(&dentry->d_subdirs)) { + spin_unlock(&this_parent->d_lock); + spin_release(&dentry->d_lock.dep_map, 1, _RET_IP_); + this_parent = dentry; + spin_acquire(&this_parent->d_lock.dep_map, 0, 1, _RET_IP_); + goto repeat; + } + spin_unlock(&dentry->d_lock); + } + /* + * All done at this level ... ascend and resume the search. + */ + rcu_read_lock(); +ascend: + if (this_parent != parent) { + struct dentry *child = this_parent; + this_parent = child->d_parent; + + spin_unlock(&child->d_lock); + spin_lock(&this_parent->d_lock); + + /* go into the first sibling still alive */ + do { + next = child->d_child.next; + if (next == &this_parent->d_subdirs) + goto ascend; + child = list_entry(next, struct dentry, d_child); + } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)); + rcu_read_unlock(); + goto resume; + } + rcu_read_unlock(); + spin_unlock(&this_parent->d_lock); + return; +} + static int tracefs_parse_options(char *data, struct tracefs_mount_opts *opts) { substring_t args[MAX_OPT_ARGS]; @@ -194,6 +265,7 @@ static int tracefs_parse_options(char *d if (!gid_valid(gid)) return -EINVAL; opts->gid = gid; + set_gid(tracefs_mount->mnt_root, gid); break; case Opt_mode: if (match_octal(&args[0], &option)) From patchwork Mon Dec 13 09:30:05 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524202 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88F21C433EF for ; Mon, 13 Dec 2021 09:35:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232533AbhLMJfg (ORCPT ); Mon, 13 Dec 2021 04:35:36 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:48488 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234268AbhLMJen (ORCPT ); Mon, 13 Dec 2021 04:34:43 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9E506B80E07; Mon, 13 Dec 2021 09:34:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9C41C341D9; Mon, 13 Dec 2021 09:34:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388081; bh=6lxXqNWseBnVtGFh0FJVIQIGP0qhOdZ31Hk4L439YdM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XLogPnmIlBQUfIwrmut7FY3awJQudSqi61RXb0Qf84Vj3haRqBUNxgY1RTCbm5uYT zgAaiz/t29rkRwbmq6My/QJCgRvTvR2xbZfrZGTIdghIK7ah+0gkau5vFYMof+Hcww HG774PkHYZ8lo/HowFe+GWTYPn4Wn9n5iUAHgUf4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oleg Nesterov , Davidlohr Bueso , Jens Axboe Subject: [PATCH 4.9 23/42] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) Date: Mon, 13 Dec 2021 10:30:05 +0100 Message-Id: <20211213092927.332822590@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Davidlohr Bueso commit e6a59aac8a8713f335a37d762db0dbe80e7f6d38 upstream. do_each_pid_thread(PIDTYPE_PGID) can race with a concurrent change_pid(PIDTYPE_PGID) that can move the task from one hlist to another while iterating. Serialize ioprio_get to take the tasklist_lock in this case, just like it's set counterpart. Fixes: d69b78ba1de (ioprio: grab rcu_read_lock in sys_ioprio_{set,get}()) Acked-by: Oleg Nesterov Signed-off-by: Davidlohr Bueso Link: https://lore.kernel.org/r/20211210182058.43417-1-dave@stgolabs.net Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- block/ioprio.c | 3 +++ 1 file changed, 3 insertions(+) --- a/block/ioprio.c +++ b/block/ioprio.c @@ -202,6 +202,7 @@ SYSCALL_DEFINE2(ioprio_get, int, which, pgrp = task_pgrp(current); else pgrp = find_vpid(who); + read_lock(&tasklist_lock); do_each_pid_thread(pgrp, PIDTYPE_PGID, p) { tmpio = get_task_ioprio(p); if (tmpio < 0) @@ -211,6 +212,8 @@ SYSCALL_DEFINE2(ioprio_get, int, which, else ret = ioprio_best(ret, tmpio); } while_each_pid_thread(pgrp, PIDTYPE_PGID, p); + read_unlock(&tasklist_lock); + break; case IOPRIO_WHO_USER: uid = make_kuid(current_user_ns(), who); From patchwork Mon Dec 13 09:30:07 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524201 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93E85C433EF for ; Mon, 13 Dec 2021 09:35:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232769AbhLMJfo (ORCPT ); Mon, 13 Dec 2021 04:35:44 -0500 Received: from sin.source.kernel.org ([145.40.73.55]:59248 "EHLO sin.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234159AbhLMJeu (ORCPT ); Mon, 13 Dec 2021 04:34:50 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id DA5A5CE0E63; Mon, 13 Dec 2021 09:34:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 89EF4C00446; Mon, 13 Dec 2021 09:34:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388087; bh=927BIJLixGI3sCCasW0Z48GPjYIGWlEIXDIWQTg4LH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mKTlsliC2kqUamrnmliwLv8wH28tNbyVlRQk8MoF7mopXfTX4hdlx3L6+cNxocXKV s1ZXl4tyOjxx8ChvsGrFWR/LS7XwB6JLHOTrPSa87yys2AYiT1o5VOtjucYjY/L9Zf v6Ksnv+db4CZzPpbwvZkFB9PZc7M2ybHSbyVSJPg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , "David S. Miller" Subject: [PATCH 4.9 25/42] net: altera: set a couple error code in probe() Date: Mon, 13 Dec 2021 10:30:07 +0100 Message-Id: <20211213092927.395124739@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dan Carpenter commit badd7857f5c933a3dc34942a2c11d67fdbdc24de upstream. There are two error paths which accidentally return success instead of a negative error code. Fixes: bbd2190ce96d ("Altera TSE: Add main and header file for Altera Ethernet Driver") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/altera/altera_tse_main.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/drivers/net/ethernet/altera/altera_tse_main.c +++ b/drivers/net/ethernet/altera/altera_tse_main.c @@ -1361,16 +1361,19 @@ static int altera_tse_probe(struct platf priv->rxdescmem_busaddr = dma_res->start; } else { + ret = -ENODEV; goto err_free_netdev; } - if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask))) + if (!dma_set_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask))) { dma_set_coherent_mask(priv->device, DMA_BIT_MASK(priv->dmaops->dmamask)); - else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32))) + } else if (!dma_set_mask(priv->device, DMA_BIT_MASK(32))) { dma_set_coherent_mask(priv->device, DMA_BIT_MASK(32)); - else + } else { + ret = -EIO; goto err_free_netdev; + } /* MAC address space */ ret = request_and_map(pdev, "control_port", &control_port, From patchwork Mon Dec 13 09:30:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524200 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8A33C433EF for ; Mon, 13 Dec 2021 09:35:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234456AbhLMJfy (ORCPT ); Mon, 13 Dec 2021 04:35:54 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:48724 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234187AbhLMJe6 (ORCPT ); Mon, 13 Dec 2021 04:34:58 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B14B2B80E15; Mon, 13 Dec 2021 09:34:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09855C341C8; Mon, 13 Dec 2021 09:34:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388095; bh=0/TqD2fLN/WfxHKsUjSXtWtrXwGmySEVT/iwwE4ZUVc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ykr21ktHclfqIKnGMpD8UL0lVEHOcbqA8I5aBr2NkKLGc16P0mM8kFNMiDA8U8ty7 yrUX/WcXNO5orWJu0YEU9ubYzxBmDwtOptuy8isJ7h7Z1utnlw29EMtLBkzk2Bnn3p N8HIuqeyo6DU9/sQDZkPGtHT9PuTcdJVs8eNVbQw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Jakub Kicinski Subject: [PATCH 4.9 28/42] net/qla3xxx: fix an error code in ql_adapter_up() Date: Mon, 13 Dec 2021 10:30:10 +0100 Message-Id: <20211213092927.487719816@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dan Carpenter commit d17b9737c2bc09b4ac6caf469826e5a7ce3ffab7 upstream. The ql_wait_for_drvr_lock() fails and returns false, then this function should return an error code instead of returning success. The other problem is that the success path prints an error message netdev_err(ndev, "Releasing driver lock\n"); Delete that and re-order the code a little to make it more clear. Fixes: 5a4faa873782 ("[PATCH] qla3xxx NIC driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20211207082416.GA16110@kili Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/qlogic/qla3xxx.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) --- a/drivers/net/ethernet/qlogic/qla3xxx.c +++ b/drivers/net/ethernet/qlogic/qla3xxx.c @@ -3491,20 +3491,19 @@ static int ql_adapter_up(struct ql3_adap spin_lock_irqsave(&qdev->hw_lock, hw_flags); - err = ql_wait_for_drvr_lock(qdev); - if (err) { - err = ql_adapter_initialize(qdev); - if (err) { - netdev_err(ndev, "Unable to initialize adapter\n"); - goto err_init; - } - netdev_err(ndev, "Releasing driver lock\n"); - ql_sem_unlock(qdev, QL_DRVR_SEM_MASK); - } else { + if (!ql_wait_for_drvr_lock(qdev)) { netdev_err(ndev, "Could not acquire driver lock\n"); + err = -ENODEV; goto err_lock; } + err = ql_adapter_initialize(qdev); + if (err) { + netdev_err(ndev, "Unable to initialize adapter\n"); + goto err_init; + } + ql_sem_unlock(qdev, QL_DRVR_SEM_MASK); + spin_unlock_irqrestore(&qdev->hw_lock, hw_flags); set_bit(QL_ADAPTER_UP, &qdev->flags); From patchwork Mon Dec 13 09:30:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524199 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C080AC433F5 for ; Mon, 13 Dec 2021 09:35:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234306AbhLMJf4 (ORCPT ); Mon, 13 Dec 2021 04:35:56 -0500 Received: from sin.source.kernel.org ([145.40.73.55]:59388 "EHLO sin.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230467AbhLMJfB (ORCPT ); Mon, 13 Dec 2021 04:35:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 36FACCE0E7D; Mon, 13 Dec 2021 09:35:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D8A82C00446; Mon, 13 Dec 2021 09:34:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388098; bh=FjB8u9hGsxLMZnkmOfnwddADvaN5d8Fwik2pVsj3iWk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=N2oVMolpyqhIDyxtR/xm7bj6EAyAJRZfix2NIuX1mrGmaPmDe5crH6J54s7f5Pfa8 o0PgHVF15xz03i9jlww758kWHbTa/5p1F80SSHygKwTrAeSThdPQBQi+UUqAJyRXuN jSlUSI/nWhND1T8uySTNSJWAYW+02FIiKa1xhw9g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Szymon Heidrich Subject: [PATCH 4.9 29/42] USB: gadget: detect too-big endpoint 0 requests Date: Mon, 13 Dec 2021 10:30:11 +0100 Message-Id: <20211213092927.518264100@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Greg Kroah-Hartman commit 153a2d7e3350cc89d406ba2d35be8793a64c2038 upstream. Sometimes USB hosts can ask for buffers that are too large from endpoint 0, which should not be allowed. If this happens for OUT requests, stall the endpoint, but for IN requests, trim the request size to the endpoint buffer size. Co-developed-by: Szymon Heidrich Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/composite.c | 12 ++++++++++++ drivers/usb/gadget/legacy/dbgp.c | 13 +++++++++++++ drivers/usb/gadget/legacy/inode.c | 16 +++++++++++++++- 3 files changed, 40 insertions(+), 1 deletion(-) --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -1631,6 +1631,18 @@ composite_setup(struct usb_gadget *gadge struct usb_function *f = NULL; u8 endp; + if (w_length > USB_COMP_EP0_BUFSIZ) { + if (ctrl->bRequestType == USB_DIR_OUT) { + goto done; + } else { + /* Cast away the const, we are going to overwrite on purpose. */ + __le16 *temp = (__le16 *)&ctrl->wLength; + + *temp = cpu_to_le16(USB_COMP_EP0_BUFSIZ); + w_length = USB_COMP_EP0_BUFSIZ; + } + } + /* partial re-init of the response message; the function or the * gadget might need to intercept e.g. a control-OUT completion * when we delegate to it. --- a/drivers/usb/gadget/legacy/dbgp.c +++ b/drivers/usb/gadget/legacy/dbgp.c @@ -344,6 +344,19 @@ static int dbgp_setup(struct usb_gadget void *data = NULL; u16 len = 0; + if (length > DBGP_REQ_LEN) { + if (ctrl->bRequestType == USB_DIR_OUT) { + return err; + } else { + /* Cast away the const, we are going to overwrite on purpose. */ + __le16 *temp = (__le16 *)&ctrl->wLength; + + *temp = cpu_to_le16(DBGP_REQ_LEN); + length = DBGP_REQ_LEN; + } + } + + if (request == USB_REQ_GET_DESCRIPTOR) { switch (value>>8) { case USB_DT_DEVICE: --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -113,6 +113,8 @@ enum ep0_state { /* enough for the whole queue: most events invalidate others */ #define N_EVENT 5 +#define RBUF_SIZE 256 + struct dev_data { spinlock_t lock; atomic_t count; @@ -147,7 +149,7 @@ struct dev_data { struct dentry *dentry; /* except this scratch i/o buffer for ep0 */ - u8 rbuf [256]; + u8 rbuf[RBUF_SIZE]; }; static inline void get_dev (struct dev_data *data) @@ -1336,6 +1338,18 @@ gadgetfs_setup (struct usb_gadget *gadge u16 w_value = le16_to_cpu(ctrl->wValue); u16 w_length = le16_to_cpu(ctrl->wLength); + if (w_length > RBUF_SIZE) { + if (ctrl->bRequestType == USB_DIR_OUT) { + return value; + } else { + /* Cast away the const, we are going to overwrite on purpose. */ + __le16 *temp = (__le16 *)&ctrl->wLength; + + *temp = cpu_to_le16(RBUF_SIZE); + w_length = RBUF_SIZE; + } + } + spin_lock (&dev->lock); dev->setup_abort = 0; if (dev->state == STATE_DEV_UNCONNECTED) { From patchwork Mon Dec 13 09:30:14 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524197 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52747C433EF for ; Mon, 13 Dec 2021 09:36:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232864AbhLMJgM (ORCPT ); Mon, 13 Dec 2021 04:36:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54440 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234338AbhLMJfM (ORCPT ); Mon, 13 Dec 2021 04:35:12 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 86233C061B38; Mon, 13 Dec 2021 01:35:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 52194B80E1A; Mon, 13 Dec 2021 09:35:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97BB8C00446; Mon, 13 Dec 2021 09:35:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388110; bh=MHNxRwqc8kSvDt8LkerObcAGIt+g8qrMDoR9dMxVI+o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VVuzBGMXJLgekIueoSoax56PgWaKeG4ccY0BNuJ5FDN9e+6q+pNb0iDgTpQcNdR6T 52oB1f0mfl9h1tpPCP6OXF3ioc2fI1cJDKzLe48zend+N+wUk6d4ragQ+68WAWoU/u K9cYl6+SnTMskiM60ojazQbcSaACSPcszH2fVxjU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Pavel Hofman Subject: [PATCH 4.9 32/42] usb: core: config: using bit mask instead of individual bits Date: Mon, 13 Dec 2021 10:30:14 +0100 Message-Id: <20211213092927.608444374@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pavel Hofman commit ca5737396927afd4d57b133fd2874bbcf3421cdb upstream. Using standard USB_EP_MAXP_MULT_MASK instead of individual bits for extracting multiple-transactions bits from wMaxPacketSize value. Acked-by: Alan Stern Signed-off-by: Pavel Hofman Link: https://lore.kernel.org/r/20211210085219.16796-2-pavel.hofman@ivitera.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/config.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -420,9 +420,9 @@ static int usb_parse_endpoint(struct dev maxpacket_maxes = full_speed_maxpacket_maxes; break; case USB_SPEED_HIGH: - /* Bits 12..11 are allowed only for HS periodic endpoints */ + /* Multiple-transactions bits are allowed only for HS periodic endpoints */ if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) { - i = maxp & (BIT(12) | BIT(11)); + i = maxp & USB_EP_MAXP_MULT_MASK; maxp &= ~i; } /* fallthrough */ From patchwork Mon Dec 13 09:30:16 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524196 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F04BC433F5 for ; Mon, 13 Dec 2021 09:36:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234351AbhLMJgR (ORCPT ); Mon, 13 Dec 2021 04:36:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234356AbhLMJfS (ORCPT ); Mon, 13 Dec 2021 04:35:18 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 55E24C061D60; Mon, 13 Dec 2021 01:35:18 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1BC87B80DE8; Mon, 13 Dec 2021 09:35:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3DA54C00446; Mon, 13 Dec 2021 09:35:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388115; bh=yTL7CmjZG6xz30O8PoMmheZN4yNRL66a0A+PaZ50ITo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1ZddOJxv/ynh5rCE8DLS3jGAxJduWKDoetrPTTjKNZvcmczQ2mygcTcOaHnTu1PJI 1V/CAZiFZ+eQlv6EAdpmPQOyhBZkHRUMIsFV/fLPnN0CBNaSm9BWAhJMvMnoz6PXmt wpDGU9w8nEj7c6cput/OhAJoHy7EntGsOm+6JhfY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars-Peter Clausen , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.9 34/42] iio: mma8452: Fix trigger reference couting Date: Mon, 13 Dec 2021 10:30:16 +0100 Message-Id: <20211213092927.668087324@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lars-Peter Clausen commit cd0082235783f814241a1c9483fb89e405f4f892 upstream. The mma8452 driver directly assigns a trigger to the struct iio_dev. The IIO core when done using this trigger will call `iio_trigger_put()` to drop the reference count by 1. Without the matching `iio_trigger_get()` in the driver the reference count can reach 0 too early, the trigger gets freed while still in use and a use-after-free occurs. Fix this by getting a reference to the trigger before assigning it to the IIO device. Fixes: ae6d9ce05691 ("iio: mma8452: Add support for interrupt driven triggers.") Signed-off-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20211024092700.6844-1-lars@metafoo.de Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --- drivers/iio/accel/mma8452.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/accel/mma8452.c +++ b/drivers/iio/accel/mma8452.c @@ -1389,7 +1389,7 @@ static int mma8452_trigger_setup(struct if (ret) return ret; - indio_dev->trig = trig; + indio_dev->trig = iio_trigger_get(trig); return 0; } From patchwork Mon Dec 13 09:30:17 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524195 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA0CEC433EF for ; Mon, 13 Dec 2021 09:36:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234121AbhLMJgZ (ORCPT ); Mon, 13 Dec 2021 04:36:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54694 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234103AbhLMJfU (ORCPT ); Mon, 13 Dec 2021 04:35:20 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2BAD3C0698C6; Mon, 13 Dec 2021 01:35:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CB0BDB80E18; Mon, 13 Dec 2021 09:35:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1F68BC00446; Mon, 13 Dec 2021 09:35:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388118; bh=fwKfU68T5Hd0pP7zVDoYkgUMpmAPRlZHPW4STjVw6ks=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mFBgn6LorfEBBkxaJsJCCm0aHGtkguvStZb+rb91H7ZgbGZ/71QttzTl2gyZwXzZ8 BO+iTEnw3tx/aJsi0lwaxOq48OPe3rav86JxomuIakc5p18VtonLK9KsPZQylJ/QY4 qtFHrolZYbcYXsaPB9q9bqTmn0Sbpgrd+4U2NPCo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars-Peter Clausen , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.9 35/42] iio: ltr501: Dont return error code in trigger handler Date: Mon, 13 Dec 2021 10:30:17 +0100 Message-Id: <20211213092927.702177942@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lars-Peter Clausen commit ef9d67fa72c1b149a420587e435a3e888bdbf74f upstream. IIO trigger handlers need to return one of the irqreturn_t values. Returning an error code is not supported. The ltr501 interrupt handler gets this right for most error paths, but there is one case where it returns the error code. In addition for this particular case the trigger handler does not call `iio_trigger_notify_done()`. Which when not done keeps the triggered disabled forever. Modify the code so that the function returns a valid irqreturn_t value as well as calling `iio_trigger_notify_done()` on all exit paths. Fixes: 2690be905123 ("iio: Add Lite-On ltr501 ambient light / proximity sensor driver") Signed-off-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20211024171251.22896-1-lars@metafoo.de Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --- drivers/iio/light/ltr501.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/light/ltr501.c +++ b/drivers/iio/light/ltr501.c @@ -1248,7 +1248,7 @@ static irqreturn_t ltr501_trigger_handle ret = regmap_bulk_read(data->regmap, LTR501_ALS_DATA1, (u8 *)als_buf, sizeof(als_buf)); if (ret < 0) - return ret; + goto done; if (test_bit(0, indio_dev->active_scan_mask)) scan.channels[j++] = le16_to_cpu(als_buf[1]); if (test_bit(1, indio_dev->active_scan_mask)) From patchwork Mon Dec 13 09:30:20 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524194 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4DA8C4332F for ; Mon, 13 Dec 2021 09:36:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234265AbhLMJge (ORCPT ); Mon, 13 Dec 2021 04:36:34 -0500 Received: from sin.source.kernel.org ([145.40.73.55]:59734 "EHLO sin.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233945AbhLMJfc (ORCPT ); Mon, 13 Dec 2021 04:35:32 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 81416CE0E80; Mon, 13 Dec 2021 09:35:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A85FAC341C5; Mon, 13 Dec 2021 09:35:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388127; bh=gP5bIQKF/CgU1meDcP930ZrWnAXRWSY3Put21RWhR7E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MOXug1Smiynk5ebqxIIsMnDXfUFiJtHvqxH/J3zsukV8cmQT7dUOMYYDh7SkXVqyx p87itiIT1WUQst1fDcjMNv1slAxAm5zrk6wNE0vPU8YMNLwgu9WYhoUDTT6KIHhS64 aVdca7sfmP2gGptJ32wR6MtGUH0NLqTNcmcVrgls= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Yang Yingliang , Stable@vger.kernel.org, Hans de Goede , Jonathan Cameron Subject: [PATCH 4.9 38/42] iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove Date: Mon, 13 Dec 2021 10:30:20 +0100 Message-Id: <20211213092927.795360763@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Yang Yingliang commit 70c9774e180d151abaab358108e3510a8e615215 upstream. When ACPI type is ACPI_SMO8500, the data->dready_trig will not be set, the memory allocated by iio_triggered_buffer_setup() will not be freed, and cause memory leak as follows: unreferenced object 0xffff888009551400 (size 512): comm "i2c-SMO8500-125", pid 911, jiffies 4294911787 (age 83.852s) hex dump (first 32 bytes): 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 20 e2 e5 c0 ff ff ff ff ........ ....... backtrace: [<0000000041ce75ee>] kmem_cache_alloc_trace+0x16d/0x360 [<000000000aeb17b0>] iio_kfifo_allocate+0x41/0x130 [kfifo_buf] [<000000004b40c1f5>] iio_triggered_buffer_setup_ext+0x2c/0x210 [industrialio_triggered_buffer] [<000000004375b15f>] kxcjk1013_probe+0x10c3/0x1d81 [kxcjk_1013] Fix it by remove data->dready_trig condition in probe and remove. Reported-by: Hulk Robot Fixes: a25691c1f967 ("iio: accel: kxcjk1013: allow using an external trigger") Signed-off-by: Yang Yingliang Cc: Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20211025124159.2700301-1-yangyingliang@huawei.com Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --- drivers/iio/accel/kxcjk-1013.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/drivers/iio/accel/kxcjk-1013.c +++ b/drivers/iio/accel/kxcjk-1013.c @@ -1290,8 +1290,7 @@ static int kxcjk1013_probe(struct i2c_cl return 0; err_buffer_cleanup: - if (data->dready_trig) - iio_triggered_buffer_cleanup(indio_dev); + iio_triggered_buffer_cleanup(indio_dev); err_trigger_unregister: if (data->dready_trig) iio_trigger_unregister(data->dready_trig); @@ -1314,8 +1313,8 @@ static int kxcjk1013_remove(struct i2c_c pm_runtime_set_suspended(&client->dev); pm_runtime_put_noidle(&client->dev); + iio_triggered_buffer_cleanup(indio_dev); if (data->dready_trig) { - iio_triggered_buffer_cleanup(indio_dev); iio_trigger_unregister(data->dready_trig); iio_trigger_unregister(data->motion_trig); } From patchwork Mon Dec 13 09:30:23 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524192 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1467EC4332F for ; Mon, 13 Dec 2021 09:36:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232538AbhLMJgr (ORCPT ); Mon, 13 Dec 2021 04:36:47 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:49348 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234268AbhLMJfl (ORCPT ); Mon, 13 Dec 2021 04:35:41 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 37819B80DE8; Mon, 13 Dec 2021 09:35:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82EACC00446; Mon, 13 Dec 2021 09:35:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388139; bh=KEwpGxzthSbeRbKlmHcAfEnwBqMBYTZVoND14SFo2j0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lXCAKmrl9CxK4igTJbfkEnYHq1zEE7Je+v9QTZ1kS6DOSl8J5+8IHGWiIzh1JeipB HGhtrZfcHHFxr29msUJOO+BZt9Zv3X2WdBvkTsMVo9y94mtIFES60qZNJk10dRwByP aHK1iNLmjA91Fxk0iW6PE3awzf2mXbCBa1i1Mlt4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wudi Wang , Shaokun Zhang , Marc Zyngier Subject: [PATCH 4.9 41/42] irqchip/irq-gic-v3-its.c: Force synchronisation when issuing INVALL Date: Mon, 13 Dec 2021 10:30:23 +0100 Message-Id: <20211213092927.893205161@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Wudi Wang commit b383a42ca523ce54bcbd63f7c8f3cf974abc9b9a upstream. INVALL CMD specifies that the ITS must ensure any caching associated with the interrupt collection defined by ICID is consistent with the LPI configuration tables held in memory for all Redistributors. SYNC is required to ensure that INVALL is executed. Currently, LPI configuration data may be inconsistent with that in the memory within a short period of time after the INVALL command is executed. Signed-off-by: Wudi Wang Signed-off-by: Shaokun Zhang Signed-off-by: Marc Zyngier Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Link: https://lore.kernel.org/r/20211208015429.5007-1-zhangshaokun@hisilicon.com Signed-off-by: Greg Kroah-Hartman --- drivers/irqchip/irq-gic-v3-its.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -369,7 +369,7 @@ static struct its_collection *its_build_ its_fixup_cmd(cmd); - return NULL; + return desc->its_invall_cmd.col; } static u64 its_cmd_ptr_to_offset(struct its_node *its, From patchwork Mon Dec 13 09:30:24 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 524190 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0FBBC433F5 for ; Mon, 13 Dec 2021 09:37:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234187AbhLMJhJ (ORCPT ); Mon, 13 Dec 2021 04:37:09 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54626 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229600AbhLMJf5 (ORCPT ); Mon, 13 Dec 2021 04:35:57 -0500 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 51F51C06173F; Mon, 13 Dec 2021 01:35:45 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 9DBB9CE0E39; Mon, 13 Dec 2021 09:35:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 51C76C00446; Mon, 13 Dec 2021 09:35:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639388141; bh=IEH0SgXW32ZJv2QeLrjSktkpfigNy0ReA7GV2QSSPMs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nd8ifUUBggRbF+8NkQmQfyxgKkERSbfl9APJIZS4GQnvM1FR5AeASyjMrmq7WuPeO 8swF6jfQ9JFPB63UboKXO6DbA3YMAT1QDHsGJ9ZWmHqwEeD1DgqHPHHyopVYHiV9sg fbo28X97Fe4iRqG66/ExfQ1uXqsDuelSWh98zwFs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vladimir Murzin , Marc Zyngier Subject: [PATCH 4.9 42/42] irqchip: nvic: Fix offset for Interrupt Priority Offsets Date: Mon, 13 Dec 2021 10:30:24 +0100 Message-Id: <20211213092927.923222339@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211213092926.578829548@linuxfoundation.org> References: <20211213092926.578829548@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Vladimir Murzin commit c5e0cbe2858d278a27d5b3fe31890aea5be064c4 upstream. According to ARM(v7M) ARM Interrupt Priority Offsets located at 0xE000E400-0xE000E5EC, while 0xE000E300-0xE000E33C covers read-only Interrupt Active Bit Registers Fixes: 292ec080491d ("irqchip: Add support for ARMv7-M NVIC") Signed-off-by: Vladimir Murzin Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20211201110259.84857-1-vladimir.murzin@arm.com Signed-off-by: Greg Kroah-Hartman --- drivers/irqchip/irq-nvic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/irqchip/irq-nvic.c +++ b/drivers/irqchip/irq-nvic.c @@ -29,7 +29,7 @@ #define NVIC_ISER 0x000 #define NVIC_ICER 0x080 -#define NVIC_IPR 0x300 +#define NVIC_IPR 0x400 #define NVIC_MAX_BANKS 16 /*