From patchwork Tue Jun 9 17:45:04 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224684 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18444C433DF for ; Tue, 9 Jun 2020 17:53:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EBC7320774 for ; Tue, 9 Jun 2020 17:53:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725206; bh=JQyg/s0HqtLyCxBcXD9gCIAN9Lzl40U+aQE4K9CJ/nY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=W9uCIq8pLfMa2NbcSNE9Rtk334b05Jx188oc74orFeaQqzzGItiqlR8eKqW3WY2ia tzpqznpMub61cpkedWPZ5KuV3mYwiSHK2kSbf7ksyBBa6lpcLnETbLNTPN8JUF7e5+ 3igXV2a3OZKg8/wh/IsU2orVjZk8l1Udhm3cQT1o= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733028AbgFIRxZ (ORCPT ); Tue, 9 Jun 2020 13:53:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:44354 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731767AbgFIRxY (ORCPT ); Tue, 9 Jun 2020 13:53:24 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 027F32074B; Tue, 9 Jun 2020 17:53:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725203; bh=JQyg/s0HqtLyCxBcXD9gCIAN9Lzl40U+aQE4K9CJ/nY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=scI12Ix1HEavWMSueLGI8w99CajOKYPyiNJGyaED+S0nhfHQuFw3LTBW0TJYX2rQm OjDkT3x7ohrboEZ0UciLgul4tHZI2Nr9LGeK1sVO/dUe+R7B5P1FcekJr9Y5kgPG8B 6sjeuBBQ2311yoLGHBrc1eCzFJAzHz8a6XUsxoWg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , James Chapman , Guillaume Nault , syzbot , "David S. Miller" Subject: [PATCH 5.6 02/41] l2tp: add sk_family checks to l2tp_validate_socket Date: Tue, 9 Jun 2020 19:45:04 +0200 Message-Id: <20200609174112.344246631@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Dumazet [ Upstream commit d9a81a225277686eb629938986d97629ea102633 ] syzbot was able to trigger a crash after using an ISDN socket and fool l2tp. Fix this by making sure the UDP socket is of the proper family. BUG: KASAN: slab-out-of-bounds in setup_udp_tunnel_sock+0x465/0x540 net/ipv4/udp_tunnel.c:78 Write of size 1 at addr ffff88808ed0c590 by task syz-executor.5/3018 CPU: 0 PID: 3018 Comm: syz-executor.5 Not tainted 5.7.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:382 __kasan_report.cold+0x20/0x38 mm/kasan/report.c:511 kasan_report+0x33/0x50 mm/kasan/common.c:625 setup_udp_tunnel_sock+0x465/0x540 net/ipv4/udp_tunnel.c:78 l2tp_tunnel_register+0xb15/0xdd0 net/l2tp/l2tp_core.c:1523 l2tp_nl_cmd_tunnel_create+0x4b2/0xa60 net/l2tp/l2tp_netlink.c:249 genl_family_rcv_msg_doit net/netlink/genetlink.c:673 [inline] genl_family_rcv_msg net/netlink/genetlink.c:718 [inline] genl_rcv_msg+0x627/0xdf0 net/netlink/genetlink.c:735 netlink_rcv_skb+0x15a/0x410 net/netlink/af_netlink.c:2469 genl_rcv+0x24/0x40 net/netlink/genetlink.c:746 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x537/0x740 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x882/0xe10 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:672 ____sys_sendmsg+0x6e6/0x810 net/socket.c:2352 ___sys_sendmsg+0x100/0x170 net/socket.c:2406 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x45ca29 Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007effe76edc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004fe1c0 RCX: 000000000045ca29 RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 000000000000094e R14: 00000000004d5d00 R15: 00007effe76ee6d4 Allocated by task 3018: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468 __do_kmalloc mm/slab.c:3656 [inline] __kmalloc+0x161/0x7a0 mm/slab.c:3665 kmalloc include/linux/slab.h:560 [inline] sk_prot_alloc+0x223/0x2f0 net/core/sock.c:1612 sk_alloc+0x36/0x1100 net/core/sock.c:1666 data_sock_create drivers/isdn/mISDN/socket.c:600 [inline] mISDN_sock_create+0x272/0x400 drivers/isdn/mISDN/socket.c:796 __sock_create+0x3cb/0x730 net/socket.c:1428 sock_create net/socket.c:1479 [inline] __sys_socket+0xef/0x200 net/socket.c:1521 __do_sys_socket net/socket.c:1530 [inline] __se_sys_socket net/socket.c:1528 [inline] __x64_sys_socket+0x6f/0xb0 net/socket.c:1528 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Freed by task 2484: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] kasan_set_free_info mm/kasan/common.c:317 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456 __cache_free mm/slab.c:3426 [inline] kfree+0x109/0x2b0 mm/slab.c:3757 kvfree+0x42/0x50 mm/util.c:603 __free_fdtable+0x2d/0x70 fs/file.c:31 put_files_struct fs/file.c:420 [inline] put_files_struct+0x248/0x2e0 fs/file.c:413 exit_files+0x7e/0xa0 fs/file.c:445 do_exit+0xb04/0x2dd0 kernel/exit.c:791 do_group_exit+0x125/0x340 kernel/exit.c:894 get_signal+0x47b/0x24e0 kernel/signal.c:2739 do_signal+0x81/0x2240 arch/x86/kernel/signal.c:784 exit_to_usermode_loop+0x26c/0x360 arch/x86/entry/common.c:161 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:279 [inline] do_syscall_64+0x6b1/0x7d0 arch/x86/entry/common.c:305 entry_SYSCALL_64_after_hwframe+0x49/0xb3 The buggy address belongs to the object at ffff88808ed0c000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1424 bytes inside of 2048-byte region [ffff88808ed0c000, ffff88808ed0c800) The buggy address belongs to the page: page:ffffea00023b4300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea0002838208 ffffea00015ba288 ffff8880aa000e00 raw: 0000000000000000 ffff88808ed0c000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808ed0c480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88808ed0c500: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88808ed0c580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88808ed0c600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88808ed0c680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Fixes: 6b9f34239b00 ("l2tp: fix races in tunnel creation") Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Signed-off-by: Eric Dumazet Cc: James Chapman Cc: Guillaume Nault Reported-by: syzbot Acked-by: Guillaume Nault Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/l2tp/l2tp_core.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1458,6 +1458,9 @@ static int l2tp_validate_socket(const st if (sk->sk_type != SOCK_DGRAM) return -EPROTONOSUPPORT; + if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6) + return -EPROTONOSUPPORT; + if ((encap == L2TP_ENCAPTYPE_UDP && sk->sk_protocol != IPPROTO_UDP) || (encap == L2TP_ENCAPTYPE_IP && sk->sk_protocol != IPPROTO_L2TP)) return -EPROTONOSUPPORT; From patchwork Tue Jun 9 17:45:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224683 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CDB27C433DF for ; Tue, 9 Jun 2020 17:53:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A71CF2074B for ; Tue, 9 Jun 2020 17:53:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725213; bh=2wq8q15ub0uB0vMe8hgGxS46CrFW/myQrAZmv2wOkoE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=UgXwBx48b2ChG8Z8DFBG1vrWIMZ7jS27I5lNHsBANO2NXJuWPZlPzz4YHl9bgkwqj bD1Hzdmu4SkG8Qf3dDTqamyGQr4+MmqkExige0wupGP0oUIpyMGuSqxDxLLjwyV4go U4LaPavScnI5igPrSW9Lz135+bxItfApUyGoSt00= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729437AbgFIRxa (ORCPT ); Tue, 9 Jun 2020 13:53:30 -0400 Received: from mail.kernel.org ([198.145.29.99]:44476 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730044AbgFIRx2 (ORCPT ); Tue, 9 Jun 2020 13:53:28 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7A9172074B; Tue, 9 Jun 2020 17:53:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725207; bh=2wq8q15ub0uB0vMe8hgGxS46CrFW/myQrAZmv2wOkoE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vdK05X/wjwaeOItAE6xBBgHBreDcR0Sx5Ti0h9gBylSB5EY1mg+BkRu/OAV3VhK26 yL3vEP1si+B/JQ0AZh/ThE0RNOyHcD6AgwoQbz4r3GoTHulRJlCZLuUiR2ctDihOWn Uk61LOEKivyeyX5ak1URUyDF1pvrIoFz7hdL8RxQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Willem de Bruijn , "David S. Miller" Subject: [PATCH 5.6 04/41] net: check untrusted gso_size at kernel entry Date: Tue, 9 Jun 2020 19:45:06 +0200 Message-Id: <20200609174112.535027419@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Willem de Bruijn [ Upstream commit 6dd912f82680761d8fb6b1bb274a69d4c7010988 ] Syzkaller again found a path to a kernel crash through bad gso input: a packet with gso size exceeding len. These packets are dropped in tcp_gso_segment and udp[46]_ufo_fragment. But they may affect gso size calculations earlier in the path. Now that we have thlen as of commit 9274124f023b ("net: stricter validation of untrusted gso packets"), check gso_size at entry too. Fixes: bfd5f4a3d605 ("packet: Add GSO/csum offload support.") Reported-by: syzbot Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/linux/virtio_net.h | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -31,6 +31,7 @@ static inline int virtio_net_hdr_to_skb( { unsigned int gso_type = 0; unsigned int thlen = 0; + unsigned int p_off = 0; unsigned int ip_proto; if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { @@ -68,7 +69,8 @@ static inline int virtio_net_hdr_to_skb( if (!skb_partial_csum_set(skb, start, off)) return -EINVAL; - if (skb_transport_offset(skb) + thlen > skb_headlen(skb)) + p_off = skb_transport_offset(skb) + thlen; + if (p_off > skb_headlen(skb)) return -EINVAL; } else { /* gso packets without NEEDS_CSUM do not set transport_offset. @@ -92,17 +94,25 @@ retry: return -EINVAL; } - if (keys.control.thoff + thlen > skb_headlen(skb) || + p_off = keys.control.thoff + thlen; + if (p_off > skb_headlen(skb) || keys.basic.ip_proto != ip_proto) return -EINVAL; skb_set_transport_header(skb, keys.control.thoff); + } else if (gso_type) { + p_off = thlen; + if (p_off > skb_headlen(skb)) + return -EINVAL; } } if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); + if (skb->len - p_off <= gso_size) + return -EINVAL; + skb_shinfo(skb)->gso_size = gso_size; skb_shinfo(skb)->gso_type = gso_type; From patchwork Tue Jun 9 17:45:08 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224682 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9E72AC433DF for ; Tue, 9 Jun 2020 17:53:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7B37420801 for ; Tue, 9 Jun 2020 17:53:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725221; bh=ViZa30ypR7/xokQKb3odmSsdv+h/Zb0AyqQm1aaQY/s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=XkBQBt8gbK+W7wXQi4GXdMRInzv3GS7bjtcFWAngy4l/07raOh9O4LK+KHkRSgtDc Vwo2u461oBzUaKicc6wh+DXl/0u1AR51FLpJUg1Jri6D1Z6L9pEzt5r6647iGyHED8 o8m1JFuwkF/EmePx9/iLQsds2nikwHLDdPphaMWY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733041AbgFIRxj (ORCPT ); Tue, 9 Jun 2020 13:53:39 -0400 Received: from mail.kernel.org ([198.145.29.99]:44632 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729780AbgFIRxc (ORCPT ); Tue, 9 Jun 2020 13:53:32 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E315D207C3; Tue, 9 Jun 2020 17:53:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725212; bh=ViZa30ypR7/xokQKb3odmSsdv+h/Zb0AyqQm1aaQY/s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mwnljX3Q1iclmZQz29HZTBLKgU+Xn933AFtQeFUXy7EbzL0W5MTN2jqufNQNXYNKr I2ex/UI07/IP+xdGx904kAFkX4EsUWoMhlzjsaEL0EWCUkPZ2HdX8EXeqIqhNGcS0A cs0wsi8DoFSEltqSpT4bYzOLmsaAfKycgSWrsJuY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Fugang Duan , "David S. Miller" Subject: [PATCH 5.6 06/41] net: stmmac: enable timestamp snapshot for required PTP packets in dwmac v5.10a Date: Tue, 9 Jun 2020 19:45:08 +0200 Message-Id: <20200609174112.719785772@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Fugang Duan [ Upstream commit f2fb6b6275eba9d312957ca44c487bd780da6169 ] For rx filter 'HWTSTAMP_FILTER_PTP_V2_EVENT', it should be PTP v2/802.AS1, any layer, any kind of event packet, but HW only take timestamp snapshot for below PTP message: sync, Pdelay_req, Pdelay_resp. Then it causes below issue when test E2E case: ptp4l[2479.534]: port 1: received DELAY_REQ without timestamp ptp4l[2481.423]: port 1: received DELAY_REQ without timestamp ptp4l[2481.758]: port 1: received DELAY_REQ without timestamp ptp4l[2483.524]: port 1: received DELAY_REQ without timestamp ptp4l[2484.233]: port 1: received DELAY_REQ without timestamp ptp4l[2485.750]: port 1: received DELAY_REQ without timestamp ptp4l[2486.888]: port 1: received DELAY_REQ without timestamp ptp4l[2487.265]: port 1: received DELAY_REQ without timestamp ptp4l[2487.316]: port 1: received DELAY_REQ without timestamp Timestamp snapshot dependency on register bits in received path: SNAPTYPSEL TSMSTRENA TSEVNTENA PTP_Messages 01 x 0 SYNC, Follow_Up, Delay_Req, Delay_Resp, Pdelay_Req, Pdelay_Resp, Pdelay_Resp_Follow_Up 01 0 1 SYNC, Pdelay_Req, Pdelay_Resp For dwmac v5.10a, enabling all events by setting register DWC_EQOS_TIME_STAMPING[SNAPTYPSEL] to 2’b01, clearing bit [TSEVNTENA] to 0’b0, which can support all required events. Signed-off-by: Fugang Duan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -630,7 +630,8 @@ static int stmmac_hwtstamp_set(struct ne config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; ptp_v2 = PTP_TCR_TSVER2ENA; snap_type_sel = PTP_TCR_SNAPTYPSEL_1; - ts_event_en = PTP_TCR_TSEVNTENA; + if (priv->synopsys_id != DWMAC_CORE_5_10) + ts_event_en = PTP_TCR_TSEVNTENA; ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA; ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA; ptp_over_ethernet = PTP_TCR_TSIPENA; From patchwork Tue Jun 9 17:45:09 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224663 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB08AC433DF for ; Tue, 9 Jun 2020 17:59:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C031720734 for ; Tue, 9 Jun 2020 17:59:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725586; bh=tlrqTCvHAD7zvP2mZ+lUjBeNaDmgSx14Us+yObbsOvM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=jJHaRCzZaCKqSyTe1hi+BGCAnTDaZe3iZmo1bvYdiLK2kWkF4hxH7XXn5yugTU7KC mm8ONwKow98DAI31mCkaEPH4MnfLTb9evLDAVgUxyI8ESe8Z0BMFyLlv8HfTUFbWwN nVNICHaiYWyE48tc6MIo8Rct8wN2/KYg2zaitQgQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731732AbgFIRys (ORCPT ); Tue, 9 Jun 2020 13:54:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:46718 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733143AbgFIRyq (ORCPT ); Tue, 9 Jun 2020 13:54:46 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6E64F20734; Tue, 9 Jun 2020 17:54:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725286; bh=tlrqTCvHAD7zvP2mZ+lUjBeNaDmgSx14Us+yObbsOvM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2td65ZtK6CHm4FaIlSw/dCM366iAYRSG7QeJwJQlqpdfLgdi+bzuDi5Y/IblSL9QZ XkeWMzSC0CUKpJHrqwvgmURqBw21rfr0m9zUlaCkyDQUShBF3Uhm71qYFOjS1QKyud +iWtCIZyLGeN+TpQZ5/vmqlFSNxznxxjC4JkxkrE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniele Palmas , =?utf-8?q?Bj=C3=B8rn_Mork?= , "David S. Miller" Subject: [PATCH 5.6 07/41] net: usb: qmi_wwan: add Telit LE910C1-EUX composition Date: Tue, 9 Jun 2020 19:45:09 +0200 Message-Id: <20200609174112.819775734@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Daniele Palmas [ Upstream commit 591612aa578cd7148b7b9d74869ef40118978389 ] Add support for Telit LE910C1-EUX composition 0x1031: tty, tty, tty, rmnet Signed-off-by: Daniele Palmas Acked-by: Bjørn Mork Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/usb/qmi_wwan.c +++ b/drivers/net/usb/qmi_wwan.c @@ -1324,6 +1324,7 @@ static const struct usb_device_id produc {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ From patchwork Tue Jun 9 17:45:10 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224652 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5BE92C433DF for ; Tue, 9 Jun 2020 18:02:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2D3D2206D5 for ; Tue, 9 Jun 2020 18:02:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725746; bh=CVLB4NPLvhL0KLMKjfEPnTma5oOJb9KeyFMZwVnC/aE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=UzMwTted4aqYidC+3Q1HN2z3zxEbboGj5LrPN1VLFGMmKGtwqnZn0H0DngoD91Cu5 Orrqio174p7K3mtJ6pbGPPh94gICs43070evMcE5mZ+CAGHgUHsbNYJw8RyU86cK4J vyR828tm5Icl+/AbldZ6R4JgkgpaRJXI0S8u4xuk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729657AbgFISCZ (ORCPT ); Tue, 9 Jun 2020 14:02:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:44780 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733036AbgFIRxg (ORCPT ); Tue, 9 Jun 2020 13:53:36 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 58F9F207C3; Tue, 9 Jun 2020 17:53:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725216; bh=CVLB4NPLvhL0KLMKjfEPnTma5oOJb9KeyFMZwVnC/aE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qEZ5rNkCcXAE/7tM+9Fv7K1lQbFSLV9jxuRrVori8Jhe4t9yH7N0GueZI+TjoyBC3 lkDtuUz88FTRRRxuNB9Cv9cYOuqNcNf/VtQ5dDr8Hx4Xq6oyaOhWJ3q79XWE+MqFSY nedXK5Xa0aJqH0xX+u5HZzpJeMRlLHR5VZVzZTGo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chuhong Yuan , "David S. Miller" Subject: [PATCH 5.6 08/41] NFC: st21nfca: add missed kfree_skb() in an error path Date: Tue, 9 Jun 2020 19:45:10 +0200 Message-Id: <20200609174112.909045794@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Chuhong Yuan [ Upstream commit 3decabdc714ca56c944f4669b4cdec5c2c1cea23 ] st21nfca_tm_send_atr_res() misses to call kfree_skb() in an error path. Add the missed function call to fix it. Fixes: 1892bf844ea0 ("NFC: st21nfca: Adding P2P support to st21nfca in Initiator & Target mode") Signed-off-by: Chuhong Yuan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/nfc/st21nfca/dep.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/nfc/st21nfca/dep.c +++ b/drivers/nfc/st21nfca/dep.c @@ -173,8 +173,10 @@ static int st21nfca_tm_send_atr_res(stru memcpy(atr_res->gbi, atr_req->gbi, gb_len); r = nfc_set_remote_general_bytes(hdev->ndev, atr_res->gbi, gb_len); - if (r < 0) + if (r < 0) { + kfree_skb(skb); return r; + } } info->dep_info.curr_nfc_dep_pni = 0; From patchwork Tue Jun 9 17:45:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224655 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C530CC433DF for ; Tue, 9 Jun 2020 18:01:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9C5A7207C3 for ; Tue, 9 Jun 2020 18:01:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725711; bh=ArYRBpuJodeEIGm6WlIhSRxpcfAXCQI3/0XRtuztKYw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=j2UiEkPAslf/g1I1PR6RTTW98ARHSuAbS3//m86MqsTl+fNQVdSpZdr5Ul59YYpwf SXop3hQcTE1TIGs5BhLcmH1LQjOF3jEyKngHMXRnTCjqAFpYvPg2Vcn1jVFpw/8UyQ EjokVdJJE0NA7RujtY0dYLo0/Z7uRfV2V78buFN8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387642AbgFISBY (ORCPT ); Tue, 9 Jun 2020 14:01:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:45422 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731682AbgFIRyD (ORCPT ); Tue, 9 Jun 2020 13:54:03 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 34E2D207ED; Tue, 9 Jun 2020 17:54:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725241; bh=ArYRBpuJodeEIGm6WlIhSRxpcfAXCQI3/0XRtuztKYw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rKp9kcTidBUsUbRc2jjJMF5ZCJvQJhVLkkEVYdExeuHH918tgPnJ8CXG+avgGx8po SEI9ECGDhgpyMi5HVSEVjBOxHYbGYgfAKH/YvQ9SxtKlGGKMAyXLzDE4x5XpyCu7qG 2VX+v46V9ddj5oCKIcgpS6VY0HsZNLOK35Ow+trU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Heinrich Kuhn , Simon Horman , "David S. Miller" Subject: [PATCH 5.6 09/41] nfp: flower: fix used time of merge flow statistics Date: Tue, 9 Jun 2020 19:45:11 +0200 Message-Id: <20200609174113.004985779@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Heinrich Kuhn [ Upstream commit 5b186cd60f033110960a3db424ffbd6de4cee528 ] Prior to this change the correct value for the used counter is calculated but not stored nor, therefore, propagated to user-space. In use-cases such as OVS use-case at least this results in active flows being removed from the hardware datapath. Which results in both unnecessary flow tear-down and setup, and packet processing on the host. This patch addresses the problem by saving the calculated used value which allows the value to propagate to user-space. Found by inspection. Fixes: aa6ce2ea0c93 ("nfp: flower: support stats update for merge flows") Signed-off-by: Heinrich Kuhn Signed-off-by: Simon Horman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/netronome/nfp/flower/offload.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/netronome/nfp/flower/offload.c +++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c @@ -1440,7 +1440,8 @@ __nfp_flower_update_merge_stats(struct n ctx_id = be32_to_cpu(sub_flow->meta.host_ctx_id); priv->stats[ctx_id].pkts += pkts; priv->stats[ctx_id].bytes += bytes; - max_t(u64, priv->stats[ctx_id].used, used); + priv->stats[ctx_id].used = max_t(u64, used, + priv->stats[ctx_id].used); } } From patchwork Tue Jun 9 17:45:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224659 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CB9A6C433E0 for ; Tue, 9 Jun 2020 18:00:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9FFF1206D5 for ; Tue, 9 Jun 2020 18:00:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725648; bh=4+Cz8ptYSoYm2xcypo5QyXImcSVs9nbjvhvcyN0v64c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=qUXlpEWN0EjHejkXxbuUzFzec2PszvJlPfOYDav8v3DJM7Dt+2wLgLv2jhw4/F/NW OwJu+J0w+S4PvpLKU/HizZEjIrgmGMI3pkX8HrHg+CgKDp0CqSgyMvzUY8aQNOrmzp pTBiR4mFPkYWI4sfJ8jEF4BPCx1rVeAg+HBXU6LQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732010AbgFISAk (ORCPT ); Tue, 9 Jun 2020 14:00:40 -0400 Received: from mail.kernel.org ([198.145.29.99]:46088 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733092AbgFIRy0 (ORCPT ); Tue, 9 Jun 2020 13:54:26 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1ECE120774; Tue, 9 Jun 2020 17:54:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725266; bh=4+Cz8ptYSoYm2xcypo5QyXImcSVs9nbjvhvcyN0v64c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cnwQIgllwGswcu7NpFpE9/NEPjcvetNjzIot1nGmOXGIl8MwJBAimsRqJp17CJqTO 6U5MAxfrXl0wcE2pRWyj0La3fjTeqjKjOWBvy+bcZPttXaPWt+kx0GnHGJXunJFqHS Jr2zTlk4srqxcrNmpBH0/QtVCNtxxg46maPGeP1M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonas Falkevik , Marcelo Ricardo Leitner , Xin Long , "David S. Miller" Subject: [PATCH 5.6 10/41] sctp: check assoc before SCTP_ADDR_{MADE_PRIM, ADDED} event Date: Tue, 9 Jun 2020 19:45:12 +0200 Message-Id: <20200609174113.106939763@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jonas Falkevik [ Upstream commit 45ebf73ebcec88a34a778f5feaa0b82b1c76069e ] Make sure SCTP_ADDR_{MADE_PRIM,ADDED} are sent only for associations that have been established. These events are described in rfc6458#section-6.1 SCTP_PEER_ADDR_CHANGE: This tag indicates that an address that is part of an existing association has experienced a change of state (e.g., a failure or return to service of the reachability of an endpoint via a specific transport address). Signed-off-by: Jonas Falkevik Acked-by: Marcelo Ricardo Leitner Reviewed-by: Xin Long Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/sctp/ulpevent.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/sctp/ulpevent.c +++ b/net/sctp/ulpevent.c @@ -343,6 +343,9 @@ void sctp_ulpevent_nofity_peer_addr_chan struct sockaddr_storage addr; struct sctp_ulpevent *event; + if (asoc->state < SCTP_STATE_ESTABLISHED) + return; + memset(&addr, 0, sizeof(struct sockaddr_storage)); memcpy(&addr, &transport->ipaddr, transport->af_specific->sockaddr_len); From patchwork Tue Jun 9 17:45:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224660 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1CCEDC433DF for ; Tue, 9 Jun 2020 18:00:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id F100C206D5 for ; Tue, 9 Jun 2020 18:00:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725631; bh=7nZ/+o5UaRLwkNrovTT646FBi7lBEF3IetlxK2JdAAY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=0KCe/owLkGqT/6Y9Vk3gW8sZVwcLAmuJFB+mbjZoOkvcAX6GmcZcHFPMKeV0WenaO tCNContLvr9O1a4K/t4hrnZW87SC/kj6jN+bH85e1eDCPiCrOgsM+CVsWv2W6pJdow dM9bMsS+/kUnd/oLjejPHKF8GnZBvfaXsGzgGyCs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731821AbgFISA2 (ORCPT ); Tue, 9 Jun 2020 14:00:28 -0400 Received: from mail.kernel.org ([198.145.29.99]:46294 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731784AbgFIRye (ORCPT ); Tue, 9 Jun 2020 13:54:34 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DB01D20774; Tue, 9 Jun 2020 17:54:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725273; bh=7nZ/+o5UaRLwkNrovTT646FBi7lBEF3IetlxK2JdAAY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=snuHhQTkAA4X8SI/sS9Y9bjiuHtsjdt9kCNhw/CsWzkm8Re8f6gR5RoCEo8HiXAcN Ml9fLpETCgKaWBukzs9qwmjoEkA2+jtAEARGahOYxB81UBDm6FYLuwYF7btf1+5CK9 KDYXbHBw/g80q3Xa+nxmepTNGsQSWhKgtUu13loY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jia He , Stefano Garzarella , "David S. Miller" Subject: [PATCH 5.6 11/41] virtio_vsock: Fix race condition in virtio_transport_recv_pkt Date: Tue, 9 Jun 2020 19:45:13 +0200 Message-Id: <20200609174113.221123784@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jia He [ Upstream commit 8692cefc433f282228fd44938dd4d26ed38254a2 ] When client on the host tries to connect(SOCK_STREAM, O_NONBLOCK) to the server on the guest, there will be a panic on a ThunderX2 (armv8a server): [ 463.718844] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 463.718848] Mem abort info: [ 463.718849] ESR = 0x96000044 [ 463.718852] EC = 0x25: DABT (current EL), IL = 32 bits [ 463.718853] SET = 0, FnV = 0 [ 463.718854] EA = 0, S1PTW = 0 [ 463.718855] Data abort info: [ 463.718856] ISV = 0, ISS = 0x00000044 [ 463.718857] CM = 0, WnR = 1 [ 463.718859] user pgtable: 4k pages, 48-bit VAs, pgdp=0000008f6f6e9000 [ 463.718861] [0000000000000000] pgd=0000000000000000 [ 463.718866] Internal error: Oops: 96000044 [#1] SMP [...] [ 463.718977] CPU: 213 PID: 5040 Comm: vhost-5032 Tainted: G O 5.7.0-rc7+ #139 [ 463.718980] Hardware name: GIGABYTE R281-T91-00/MT91-FS1-00, BIOS F06 09/25/2018 [ 463.718982] pstate: 60400009 (nZCv daif +PAN -UAO) [ 463.718995] pc : virtio_transport_recv_pkt+0x4c8/0xd40 [vmw_vsock_virtio_transport_common] [ 463.718999] lr : virtio_transport_recv_pkt+0x1fc/0xd40 [vmw_vsock_virtio_transport_common] [ 463.719000] sp : ffff80002dbe3c40 [...] [ 463.719025] Call trace: [ 463.719030] virtio_transport_recv_pkt+0x4c8/0xd40 [vmw_vsock_virtio_transport_common] [ 463.719034] vhost_vsock_handle_tx_kick+0x360/0x408 [vhost_vsock] [ 463.719041] vhost_worker+0x100/0x1a0 [vhost] [ 463.719048] kthread+0x128/0x130 [ 463.719052] ret_from_fork+0x10/0x18 The race condition is as follows: Task1 Task2 ===== ===== __sock_release virtio_transport_recv_pkt __vsock_release vsock_find_bound_socket (found sk) lock_sock_nested vsock_remove_sock sock_orphan sk_set_socket(sk, NULL) sk->sk_shutdown = SHUTDOWN_MASK ... release_sock lock_sock virtio_transport_recv_connecting sk->sk_socket->state (panic!) The root cause is that vsock_find_bound_socket can't hold the lock_sock, so there is a small race window between vsock_find_bound_socket() and lock_sock(). If __vsock_release() is running in another task, sk->sk_socket will be set to NULL inadvertently. This fixes it by checking sk->sk_shutdown(suggested by Stefano) after lock_sock since sk->sk_shutdown is set to SHUTDOWN_MASK under the protection of lock_sock_nested. Signed-off-by: Jia He Reviewed-by: Stefano Garzarella Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/vmw_vsock/virtio_transport_common.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -1128,6 +1128,14 @@ void virtio_transport_recv_pkt(struct vi lock_sock(sk); + /* Check if sk has been released before lock_sock */ + if (sk->sk_shutdown == SHUTDOWN_MASK) { + (void)virtio_transport_reset_no_sock(t, pkt); + release_sock(sk); + sock_put(sk); + goto free_pkt; + } + /* Update CID in case it has changed after a transport reset event */ vsk->local_addr.svm_cid = dst.svm_cid; From patchwork Tue Jun 9 17:45:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224677 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E1AC6C433E0 for ; Tue, 9 Jun 2020 17:54:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ADF03207C3 for ; Tue, 9 Jun 2020 17:54:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725281; bh=R/2+iH0ntOAXXcyfdHjyJIeGtR8m6nlM7VYdO+xk6Gs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=yQiMUAxFCjSaMKOWZ6UdTKkf5IyUHM9/sV6CaaUCT/sqzfQM5OhkFyvjDSmZWfYiT LWqt/p13/zmmbmL5qMu7H/icvUOMGC4V2dDUS0ZwL4MDbjIWRQpQY6kmQ1qwPLRZs1 hapMPLf7X2JMHAcmcmcGN80RIiiNu649Jy8s6m8M= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733128AbgFIRyj (ORCPT ); Tue, 9 Jun 2020 13:54:39 -0400 Received: from mail.kernel.org ([198.145.29.99]:46442 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732970AbgFIRyi (ORCPT ); Tue, 9 Jun 2020 13:54:38 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6CF4F20774; Tue, 9 Jun 2020 17:54:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725277; bh=R/2+iH0ntOAXXcyfdHjyJIeGtR8m6nlM7VYdO+xk6Gs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nWI/ZHvDVuBt3fhPUnKKFe6R+Dg7gVhJzf5U60NVtP96I3ICIX3aYxawDA7rpE6dD uHETDWS7bKb9yD9HtUnsrH4VLoA5VRnewfcEW6UXpy7gNNG+W9QAZgTP8c43B5UUW0 CpKWWmy0SUaxMN+J3Vr7Xny3hK3/oVjMZtcVSzfs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Willem de Bruijn , "David S. Miller" Subject: [PATCH 5.6 13/41] net: be more gentle about silly gso requests coming from user Date: Tue, 9 Jun 2020 19:45:15 +0200 Message-Id: <20200609174113.413018047@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Dumazet [ Upstream commit 7c6d2ecbda83150b2036a2b36b21381ad4667762 ] Recent change in virtio_net_hdr_to_skb() broke some packetdrill tests. When --mss=XXX option is set, packetdrill always provide gso_type & gso_size for its inbound packets, regardless of packet size. if (packet->tcp && packet->mss) { if (packet->ipv4) gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4; else gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6; gso.gso_size = packet->mss; } Since many other programs could do the same, relax virtio_net_hdr_to_skb() to no longer return an error, but instead ignore gso settings. This keeps Willem intent to make sure no malicious packet could reach gso stack. Note that TCP stack has a special logic in tcp_set_skb_tso_segs() to clear gso_size for small packets. Fixes: 6dd912f82680 ("net: check untrusted gso_size at kernel entry") Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Acked-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/linux/virtio_net.h | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -109,16 +109,17 @@ retry: if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); + struct skb_shared_info *shinfo = skb_shinfo(skb); - if (skb->len - p_off <= gso_size) - return -EINVAL; + /* Too small packets are not really GSO ones. */ + if (skb->len - p_off > gso_size) { + shinfo->gso_size = gso_size; + shinfo->gso_type = gso_type; - skb_shinfo(skb)->gso_size = gso_size; - skb_shinfo(skb)->gso_type = gso_type; - - /* Header must be checked, and gso_segs computed. */ - skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY; - skb_shinfo(skb)->gso_segs = 0; + /* Header must be checked, and gso_segs computed. */ + shinfo->gso_type |= SKB_GSO_DODGY; + shinfo->gso_segs = 0; + } } return 0; From patchwork Tue Jun 9 17:45:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224676 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13CFEC433E0 for ; Tue, 9 Jun 2020 17:54:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D7927207F9 for ; Tue, 9 Jun 2020 17:54:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725286; bh=jM0oMkokSpwwffYJacSP7JNj/zACzPww+HO/X0xDT+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=OxWZ9Ln+qTR+EH3UiCD/0j3yju182oUDxHL5akGszBl2P5OggWMcktHwwPakRcMz9 jSo6rlLr7gCBxMfFvQZnGw4RDfo0eeED2sfld2XNPzpFjElnSEgtoFC7c0HeJIbkaX ROZnPRDURVY9jNNjpgMkdn//+PKSA0Np/1QIjAYE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733139AbgFIRyo (ORCPT ); Tue, 9 Jun 2020 13:54:44 -0400 Received: from mail.kernel.org ([198.145.29.99]:46582 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733131AbgFIRym (ORCPT ); Tue, 9 Jun 2020 13:54:42 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E3662207F9; Tue, 9 Jun 2020 17:54:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725282; bh=jM0oMkokSpwwffYJacSP7JNj/zACzPww+HO/X0xDT+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0dsKjld7Hhv/k/FsYIDnP6LyWaRrNizMQ7Xf9AulK+gYc3jY1pzwkT4kK0W/1eIXt +wasvdKbE7MnhWM6Mj8rDoML3aXA25OEkbS37JbHwHzSY4ZKRL5IfLHpXVkvcR993G gGbqkZzbEnxX0tcQcxr5GyrLQV2iYGJ4iAsu0Pl0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paolo Abeni , Mat Martineau , "David S. Miller" Subject: [PATCH 5.6 15/41] mptcp: fix unblocking connect() Date: Tue, 9 Jun 2020 19:45:17 +0200 Message-Id: <20200609174113.589926014@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Paolo Abeni [ Upstream commit 41be81a8d3d09acb9033799938306349328861f9 ] Currently unblocking connect() on MPTCP sockets fails frequently. If mptcp_stream_connect() is invoked to complete a previously attempted unblocking connection, it will still try to create the first subflow via __mptcp_socket_create(). If the 3whs is completed and the 'can_ack' flag is already set, the latter will fail with -EINVAL. This change addresses the issue checking for pending connect and delegating the completion to the first subflow. Additionally do msk addresses and sk_state changes only when needed. Fixes: 2303f994b3e1 ("mptcp: Associate MPTCP context with TCP socket") Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/mptcp/protocol.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -920,6 +920,14 @@ static int mptcp_stream_connect(struct s int err; lock_sock(sock->sk); + if (sock->state != SS_UNCONNECTED && msk->subflow) { + /* pending connection or invalid state, let existing subflow + * cope with that + */ + ssock = msk->subflow; + goto do_connect; + } + ssock = __mptcp_socket_create(msk, TCP_SYN_SENT); if (IS_ERR(ssock)) { err = PTR_ERR(ssock); @@ -934,9 +942,17 @@ static int mptcp_stream_connect(struct s mptcp_subflow_ctx(ssock->sk)->request_mptcp = 0; #endif +do_connect: err = ssock->ops->connect(ssock, uaddr, addr_len, flags); - inet_sk_state_store(sock->sk, inet_sk_state_load(ssock->sk)); - mptcp_copy_inaddrs(sock->sk, ssock->sk); + sock->state = ssock->state; + + /* on successful connect, the msk state will be moved to established by + * subflow_finish_connect() + */ + if (!err || err == EINPROGRESS) + mptcp_copy_inaddrs(sock->sk, ssock->sk); + else + inet_sk_state_store(sock->sk, inet_sk_state_load(ssock->sk)); unlock: release_sock(sock->sk); From patchwork Tue Jun 9 17:45:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224661 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DCCCEC433E2 for ; Tue, 9 Jun 2020 18:00:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B85FC20734 for ; Tue, 9 Jun 2020 18:00:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725603; bh=55xVFPoFEr5iTuis4xbFShwfW/HkegS1sk4Cc6Lcbs0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=tKIF2hxQVQNvvOEWOhgc6XdzXGcfBrpYRALKH4SGMfxGg2cXQQCMstilEWzei0bec q8yJ659vv4hV+Ml3dlTKHkzs2Nc4nrHLXVgunMrWMSSlYNI4sjzLhgjnzFjASFQgfW D0gnkKQ9Hs+90YfEmcGbV51gsM8yaSs18IT1LkgM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733025AbgFISAC (ORCPT ); Tue, 9 Jun 2020 14:00:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:46690 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731910AbgFIRyp (ORCPT ); Tue, 9 Jun 2020 13:54:45 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2A589207C3; Tue, 9 Jun 2020 17:54:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725284; bh=55xVFPoFEr5iTuis4xbFShwfW/HkegS1sk4Cc6Lcbs0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C9O7BrC2fIvjP/DxqB3qxS097imSmGkn7ts+ygyC00UtA5IzQoCBihyTb/rG6R4uv XfFcfzA5AysugOBxLdL7XgG7+XIeazjLqYQdNTUzWu90MvXfgLJw4MAmtTj4+boVx+ tBpOrJusXT/4CLfJZg9Sdv8d8kwXnrKIQAOrzRY8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ivan Vecera , Davide Caratti , "David S. Miller" Subject: [PATCH 5.6 16/41] net/sched: fix infinite loop in sch_fq_pie Date: Tue, 9 Jun 2020 19:45:18 +0200 Message-Id: <20200609174113.683589069@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Davide Caratti [ Upstream commit bb2f930d6dd708469a587dc9ed1efe1ef969c0bf ] this command hangs forever: # tc qdisc add dev eth0 root fq_pie flows 65536 watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [tc:1028] [...] CPU: 1 PID: 1028 Comm: tc Not tainted 5.7.0-rc6+ #167 RIP: 0010:fq_pie_init+0x60e/0x8b7 [sch_fq_pie] Code: 4c 89 65 50 48 89 f8 48 c1 e8 03 42 80 3c 30 00 0f 85 2a 02 00 00 48 8d 7d 10 4c 89 65 58 48 89 f8 48 c1 e8 03 42 80 3c 30 00 <0f> 85 a7 01 00 00 48 8d 7d 18 48 c7 45 10 46 c3 23 00 48 89 f8 48 RSP: 0018:ffff888138d67468 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 1ffff9200018d2b2 RBX: ffff888139c1c400 RCX: ffffffffffffffff RDX: 000000000000c5e8 RSI: ffffc900000e5000 RDI: ffffc90000c69590 RBP: ffffc90000c69580 R08: fffffbfff79a9699 R09: fffffbfff79a9699 R10: 0000000000000700 R11: fffffbfff79a9698 R12: ffffc90000c695d0 R13: 0000000000000000 R14: dffffc0000000000 R15: 000000002347c5e8 FS: 00007f01e1850e40(0000) GS:ffff88814c880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000067c340 CR3: 000000013864c000 CR4: 0000000000340ee0 Call Trace: qdisc_create+0x3fd/0xeb0 tc_modify_qdisc+0x3be/0x14a0 rtnetlink_rcv_msg+0x5f3/0x920 netlink_rcv_skb+0x121/0x350 netlink_unicast+0x439/0x630 netlink_sendmsg+0x714/0xbf0 sock_sendmsg+0xe2/0x110 ____sys_sendmsg+0x5b4/0x890 ___sys_sendmsg+0xe9/0x160 __sys_sendmsg+0xd3/0x170 do_syscall_64+0x9a/0x370 entry_SYSCALL_64_after_hwframe+0x44/0xa9 we can't accept 65536 as a valid number for 'nflows', because the loop on 'idx' in fq_pie_init() will never end. The extack message is correct, but it doesn't say that 0 is not a valid number for 'flows': while at it, fix this also. Add a tdc selftest to check correct validation of 'flows'. CC: Ivan Vecera Fixes: ec97ecf1ebe4 ("net: sched: add Flow Queue PIE packet scheduler") Signed-off-by: Davide Caratti Reviewed-by: Ivan Vecera Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/sched/sch_fq_pie.c | 4 - tools/testing/selftests/tc-testing/tc-tests/qdiscs/fq_pie.json | 21 ++++++++++ 2 files changed, 23 insertions(+), 2 deletions(-) create mode 100644 tools/testing/selftests/tc-testing/tc-tests/qdiscs/fq_pie.json --- a/net/sched/sch_fq_pie.c +++ b/net/sched/sch_fq_pie.c @@ -298,9 +298,9 @@ static int fq_pie_change(struct Qdisc *s goto flow_error; } q->flows_cnt = nla_get_u32(tb[TCA_FQ_PIE_FLOWS]); - if (!q->flows_cnt || q->flows_cnt > 65536) { + if (!q->flows_cnt || q->flows_cnt >= 65536) { NL_SET_ERR_MSG_MOD(extack, - "Number of flows must be < 65536"); + "Number of flows must range in [1..65535]"); goto flow_error; } } --- /dev/null +++ b/tools/testing/selftests/tc-testing/tc-tests/qdiscs/fq_pie.json @@ -0,0 +1,21 @@ +[ + { + "id": "83be", + "name": "Create FQ-PIE with invalid number of flows", + "category": [ + "qdisc", + "fq_pie" + ], + "setup": [ + "$IP link add dev $DUMMY type dummy || /bin/true" + ], + "cmdUnderTest": "$TC qdisc add dev $DUMMY root fq_pie flows 65536", + "expExitCode": "2", + "verifyCmd": "$TC qdisc show dev $DUMMY", + "matchPattern": "qdisc", + "matchCount": "0", + "teardown": [ + "$IP link del dev $DUMMY" + ] + } +] From patchwork Tue Jun 9 17:45:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224653 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E588EC433DF for ; Tue, 9 Jun 2020 18:02:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BEC31206D5 for ; Tue, 9 Jun 2020 18:02:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725730; bh=TUchAfSP3c+TsOsIJC3hkMN+LDRDbG1kStznIlC4JxY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=hI+/Ok8cAPbn5R1HWQqlq0tGIRkCk9tp+d2++30NeILsutk/v/prC3rrzSZBZEhlx TBAOVu2YYwke/HFZGPIyGLA1MSBU/4bG3v0sbjwY5Sq78qTiK8tgC6DUFHlCyxHfVI njOh6d/7Ie+NuQXf3GxjXEuXVW70xMSlVZZ68bMY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387840AbgFISCJ (ORCPT ); Tue, 9 Jun 2020 14:02:09 -0400 Received: from mail.kernel.org ([198.145.29.99]:44932 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729657AbgFIRxn (ORCPT ); Tue, 9 Jun 2020 13:53:43 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2E3B420734; Tue, 9 Jun 2020 17:53:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725223; bh=TUchAfSP3c+TsOsIJC3hkMN+LDRDbG1kStznIlC4JxY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yQqJ0vqpm6w7Wn9es3HqoXD87QzYRLlBxuxwOXuPymoFVYqBpI8uJ3RfoSUZg5lov CDmIWY6x3Tz473bIe+ylpvoBSp8CZ9Ehqq/JltwzI0/Xnm7y4QVRpcXKHofuHbuCFI UVDBcWcCkdj3QiAbDgPXeAtlrT9kv2W3wghkj8QU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bin Liu , Johan Hovold Subject: [PATCH 5.6 19/41] USB: serial: usb_wwan: do not resubmit rx urb on fatal errors Date: Tue, 9 Jun 2020 19:45:21 +0200 Message-Id: <20200609174113.975002897@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Bin Liu commit 986c1748c84d7727defeaeca74a73b37f7d5cce1 upstream. usb_wwan_indat_callback() shouldn't resubmit rx urb if the previous urb status is a fatal error. Or the usb controller would keep processing the new urbs then run into interrupt storm, and has no chance to recover. Fixes: 6c1ee66a0b2b ("USB-Serial: Fix error handling of usb_wwan") Cc: stable@vger.kernel.org Signed-off-by: Bin Liu Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/usb_wwan.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/usb/serial/usb_wwan.c +++ b/drivers/usb/serial/usb_wwan.c @@ -270,6 +270,10 @@ static void usb_wwan_indat_callback(stru if (status) { dev_dbg(dev, "%s: nonzero status: %d on endpoint %02x.\n", __func__, status, endpoint); + + /* don't resubmit on fatal errors */ + if (status == -ESHUTDOWN || status == -ENOENT) + return; } else { if (urb->actual_length) { tty_insert_flip_string(&port->port, data, From patchwork Tue Jun 9 17:45:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224681 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A3A8C433DF for ; Tue, 9 Jun 2020 17:53:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1ADF22081A for ; Tue, 9 Jun 2020 17:53:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725228; bh=Faj6ySPN4NhaH1lHmRfYbHVD4GDrDtfBMnqzZGepr5g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Tauc8UB6a7nf06QODd1dwzmYU5T9zM8fr/KFWZqDhJBXXZSNTPaRJfbRTvmo6VVAw yWSoO4XzU8F+v7lsce2bs2mvRhoPaVU4rGBhf5uRYd7eQzYC2HLXRnkvjs0RJVCAPd fOStY03/Cs/lsLIdpaGbzVIBMm32j5QVBDAs5XW4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731337AbgFIRxq (ORCPT ); Tue, 9 Jun 2020 13:53:46 -0400 Received: from mail.kernel.org ([198.145.29.99]:45002 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731587AbgFIRxq (ORCPT ); Tue, 9 Jun 2020 13:53:46 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7437D20734; Tue, 9 Jun 2020 17:53:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725225; bh=Faj6ySPN4NhaH1lHmRfYbHVD4GDrDtfBMnqzZGepr5g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EUKg0+dsEOotLyvBZ9nr+9B51XXOIkqklQqKWUGdO75TR2nCuMctRKkJqyyMAGhZB Q2j5PAUmob5ApTrOA0a9mPqJqt+0sUqUE2hkpQ71JR+NsjsbQNDIg6uqCg4dnExVeD oAeDjeVa1jQBAxinRNPG8nzk8P1fuCNJKlDhHp5g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniele Palmas , Johan Hovold Subject: [PATCH 5.6 20/41] USB: serial: option: add Telit LE910C1-EUX compositions Date: Tue, 9 Jun 2020 19:45:22 +0200 Message-Id: <20200609174114.065212758@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Daniele Palmas commit 399ad9477c523f721f8e51d4f824bdf7267f120c upstream. Add Telit LE910C1-EUX compositions: 0x1031: tty, tty, tty, rmnet 0x1033: tty, tty, tty, ecm Signed-off-by: Daniele Palmas Link: https://lore.kernel.org/r/20200525211106.27338-1-dnlplm@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1157,6 +1157,10 @@ static const struct usb_device_id option { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1031, 0xff), /* Telit LE910C1-EUX */ + .driver_info = NCTRL(0) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1033, 0xff), /* Telit LE910C1-EUX (ECM) */ + .driver_info = NCTRL(0) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), .driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1), From patchwork Tue Jun 9 17:45:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 187693 Delivered-To: patch@linaro.org Received: by 2002:a92:cf06:0:0:0:0:0 with SMTP id c6csp768122ilo; Tue, 9 Jun 2020 11:01:56 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyIShOJlijRelm7Y4/eHXxwJGmMWQnawrB7HojYOjmB/OGyQaSRoC+KM+23dt535mjPFLfz X-Received: by 2002:a17:906:abca:: with SMTP id kq10mr26017418ejb.242.1591725716555; Tue, 09 Jun 2020 11:01:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1591725716; cv=none; d=google.com; s=arc-20160816; b=lCwE2ZUFZXWaX/+KA8tkI9Zp27LKbBbOYspW8R4vELYwiq8zUHmGYjoUTv6IyK3H6t sKPvbK/TthTYJcIcN1nYo+NcIQgmY+6CNuQZZ+o5nzVptnaTp+aRARYjhX198+yivBLk 76vZfYY+sObgDD29UUE/P9LYhK0sYkz6oGauR7ZCWLguJvVF+N/J4TXRqP8tsTfOUBUm PlLl5c+OOvEWPfyyFUeM6ubqljWJSKwQwZDfqDB32YdYL5qUs16c2yHRGzYUq0lwM+1h vyqI5Re6i3lmzEZlVcKp1VXRyRW3FHC5dlW2lB7bKB7aUzwnjQV4YmBseHd750XN6LTE UHOA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=bY+5RgWAuj4+Fukc/KBqnT65+4+MKFT1kIjxWaD0A6Q=; b=x4oqfwRBiQ95q2YPxEnMNo9WfBq78ze2e36QXornzEU+24wKiY2nQgWIeWRu3CGh7+ 3zI82fOl12S33kd4ex/Dhy3aFUYQb9T37KbSx8hjjKhILBA6avFKXFIJ3fJY+8oC2l3x 12Mp2O5jmmvFbVy44hl+QMqym08lGd9uVzhKZ3VtBd0mQ5eKT1qhyfgTiPePQc0Tq7n6 hhYMp5HHYLKaYyvwQOK7kFnQ/tjf4scrEukW7Ulu4ChasVAq36qAGHEPaigtMBCx0hC4 u5lKiCYYLyKgBJK/91xL2MTIPhAfGDoPp+NPgwJs9y2h159ZPr+Lasridd9LaYCf7uQV n5Pg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=KTfcrRVN; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id sa14si10609583ejb.297.2020.06.09.11.01.56; Tue, 09 Jun 2020 11:01:56 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=KTfcrRVN; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387494AbgFISBx (ORCPT + 15 others); Tue, 9 Jun 2020 14:01:53 -0400 Received: from mail.kernel.org ([198.145.29.99]:45192 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733050AbgFIRxx (ORCPT ); Tue, 9 Jun 2020 13:53:53 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3299F20734; Tue, 9 Jun 2020 17:53:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725232; bh=9QiSaFPCF+LjbweQTWvY4JtLf48Yd8AZc7D1koPx13M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KTfcrRVN+Q4ElyHH+62b5l9J2IzMldIdirPp5+FZ6K+2FeD8llzJygHBAwpP1oJxa A9fha9y6+ihvsuOzdXV2CUZ922vzuegk9gNYk4JX1/1w3iqNDTtfcxTnOfUXwLmEPD 8uknm97IvXwXD3ELlgLPYLBtaM7wVn/8C6iAoOfw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars-Peter Clausen , Jonathan Cameron , Stable@vger.kernel.org, Tomasz Duszynski Subject: [PATCH 5.6 23/41] iio:chemical:sps30: Fix timestamp alignment Date: Tue, 9 Jun 2020 19:45:25 +0200 Message-Id: <20200609174114.336417041@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jonathan Cameron commit a5bf6fdd19c327bcfd9073a8740fa19ca4525fd4 upstream. One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. Fixes: 232e0f6ddeae ("iio: chemical: add support for Sensirion SPS30 sensor") Reported-by: Lars-Peter Clausen Signed-off-by: Jonathan Cameron Cc: Acked-by: Tomasz Duszynski Signed-off-by: Greg Kroah-Hartman --- drivers/iio/chemical/sps30.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/drivers/iio/chemical/sps30.c +++ b/drivers/iio/chemical/sps30.c @@ -230,15 +230,18 @@ static irqreturn_t sps30_trigger_handler struct iio_dev *indio_dev = pf->indio_dev; struct sps30_state *state = iio_priv(indio_dev); int ret; - s32 data[4 + 2]; /* PM1, PM2P5, PM4, PM10, timestamp */ + struct { + s32 data[4]; /* PM1, PM2P5, PM4, PM10 */ + s64 ts; + } scan; mutex_lock(&state->lock); - ret = sps30_do_meas(state, data, 4); + ret = sps30_do_meas(state, scan.data, ARRAY_SIZE(scan.data)); mutex_unlock(&state->lock); if (ret) goto err; - iio_push_to_buffers_with_timestamp(indio_dev, data, + iio_push_to_buffers_with_timestamp(indio_dev, &scan, iio_get_time_ns(indio_dev)); err: iio_trigger_notify_done(indio_dev->trig); From patchwork Tue Jun 9 17:45:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224680 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AB6D2C433DF for ; Tue, 9 Jun 2020 17:54:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7905C20801 for ; Tue, 9 Jun 2020 17:54:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725246; bh=ZMv3ezj23sl3iB5uhJe069xw5SiAAJNn15tfc3mWTyg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rO3StxH+iYB/pD3mN4RS5qKPf5WPGazbvciHokrxdjNJKj/gYm6bl2vnEo5nMJ53O WhXCr6hmoHH943T8N6CRhYB4oPH4niI1U/n8Xnge2cDOVyU8wkxDSZm8tSnSwTKgTC 0LH25Gr967XO82LYxD3bK0S4OQiJ4PuzgprwgZ5c= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731614AbgFIRyE (ORCPT ); Tue, 9 Jun 2020 13:54:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:45242 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731306AbgFIRxz (ORCPT ); Tue, 9 Jun 2020 13:53:55 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 70D7F2074B; Tue, 9 Jun 2020 17:53:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725234; bh=ZMv3ezj23sl3iB5uhJe069xw5SiAAJNn15tfc3mWTyg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Re/cS1NMSuOfcxE2WTauEywNcQOIYE3V6+U4zaZcy1JYizfYGYXocRnCJ4KZfMJ75 xmxbDpfVOiCD8XNYVlCPStJGa6GZlD3L0nOlzV1GhbRqxozQoDU48b4+F/ZlUZHPM3 93cXzEM/0lOdxb9qMRsN6KwYrdvlMgoPSCDqhQf0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mathieu Othacehe , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 5.6 24/41] iio: vcnl4000: Fix i2c swapped word reading. Date: Tue, 9 Jun 2020 19:45:26 +0200 Message-Id: <20200609174114.436397956@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mathieu Othacehe commit 18dfb5326370991c81a6d1ed6d1aeee055cb8c05 upstream. The bytes returned by the i2c reading need to be swapped unconditionally. Otherwise, on be16 platforms, an incorrect value will be returned. Taking the slow path via next merge window as its been around a while and we have a patch set dependent on this which would be held up. Fixes: 62a1efb9f868 ("iio: add vcnl4000 combined ALS and proximity sensor") Signed-off-by: Mathieu Othacehe Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --- drivers/iio/light/vcnl4000.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) --- a/drivers/iio/light/vcnl4000.c +++ b/drivers/iio/light/vcnl4000.c @@ -193,7 +193,6 @@ static int vcnl4000_measure(struct vcnl4 u8 rdy_mask, u8 data_reg, int *val) { int tries = 20; - __be16 buf; int ret; mutex_lock(&data->vcnl4000_lock); @@ -220,13 +219,12 @@ static int vcnl4000_measure(struct vcnl4 goto fail; } - ret = i2c_smbus_read_i2c_block_data(data->client, - data_reg, sizeof(buf), (u8 *) &buf); + ret = i2c_smbus_read_word_swapped(data->client, data_reg); if (ret < 0) goto fail; mutex_unlock(&data->vcnl4000_lock); - *val = be16_to_cpu(buf); + *val = ret; return 0; From patchwork Tue Jun 9 17:45:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 187692 Delivered-To: patch@linaro.org Received: by 2002:a92:cf06:0:0:0:0:0 with SMTP id c6csp768102ilo; Tue, 9 Jun 2020 11:01:56 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwM/MEyZa4c4g7Mi7bb79qzJbCZUC59rJ6h8I4UKOvIh6PzYlwwjP8IO3OUyNmAMbtVRnOa X-Received: by 2002:a50:afc2:: with SMTP id h60mr26932755edd.110.1591725715814; Tue, 09 Jun 2020 11:01:55 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1591725715; cv=none; d=google.com; s=arc-20160816; b=TY5bFeg0a5BwPaJVYYH1YJwtVOmttcXCzKGGKIFLUmve9dGuLjyvQ5kTK2uvi3yvok RO4YINvqGklpDCs2Qf5BV87VE/l3XAsUxRu9/DyLizko0VrI8y2vqa0jZNmW3RKMGDqG Wyhr4X6PhtJDH8HJ6rXC3wxcrPjcQjLXjuIkUMlocABlkk2dqEA0hhLtnb+fwEYhQEKz taOc/qLnllVFSqZjxsOaRxzxNb/Gr5sC1eUvzeJFswMHVQyQneJ2uZOqDCDuQEDKp8PE OjE3iCYfCJGX/oS8zZoLl04IZqqzACKPKr73Lc0abbS50JU5uodzmIXC0Yw2xS2xDyTv gxbA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=dgBt0LQaYjXgUNjPmsg9FIck0ZlAxf/ZvWgM8/nd01g=; b=kMz675Rk1YPhTlTUDvGwhfPnJF1t5PiOiT0UFtvYz6mrFF4eAYrAnvVSTgo0ieD2ow NaXZ92s2AMRYVfTLfJKDkVx58d8AsNXkLuZo8kXwx8Xv6PmcrQ7K87Nc+WvN5EUxA92o HgnKjPr58ukGC62vKfdTU9q2lCZrxrNd2c2jqJviXvRjS0W0YsGgfz2twWOb7RJq6Y0e VVfPEEUXsJ/4syiojUf2PSBpe3Iy6Pf7ao0Od0M1xzsg2EjabutLXZz0gA1i7BPozFgy xMITwGZZyreL6z1VSFXgDdO0ov2W+fiQivVYnwOfMadQhMjfA6DDuhNag2aaL01/nqRF mWMQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=HH6LvVGA; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id sa14si10609583ejb.297.2020.06.09.11.01.55; Tue, 09 Jun 2020 11:01:55 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=HH6LvVGA; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733285AbgFISBv (ORCPT + 15 others); Tue, 9 Jun 2020 14:01:51 -0400 Received: from mail.kernel.org ([198.145.29.99]:45284 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731629AbgFIRx6 (ORCPT ); Tue, 9 Jun 2020 13:53:58 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B188D20774; Tue, 9 Jun 2020 17:53:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725237; bh=tJ7i3gI0/ijEe7QVglU/MZNhpV1Jc+al4aF2FGTCKJs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HH6LvVGATvXuYASpVir3jQF2Ssz1mej/7F69ejj9R/ce8autHCgtp52UZiF/10rle 6IKlPZYyWGF8gsf9h0nei2VBRpnfJTjfJszMGQQo8HXVaWP/ZTQiFc4xYZUGH6GnGA PpoV7EqgEQonVwFuoJ6iwQjfBFj9mfoJDUba6cyU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars-Peter Clausen , Jonathan Cameron , Stable@vger.kernel.org, Tomasz Duszynski Subject: [PATCH 5.6 25/41] iio:chemical:pms7003: Fix timestamp alignment and prevent data leak. Date: Tue, 9 Jun 2020 19:45:27 +0200 Message-Id: <20200609174114.531191397@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jonathan Cameron commit 13e945631c2ffb946c0af342812a3cd39227de6e upstream. One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak appart from previous readings. Fixes: a1d642266c14 ("iio: chemical: add support for Plantower PMS7003 sensor") Reported-by: Lars-Peter Clausen Signed-off-by: Jonathan Cameron Cc: Acked-by: Tomasz Duszynski Signed-off-by: Greg Kroah-Hartman --- drivers/iio/chemical/pms7003.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) --- a/drivers/iio/chemical/pms7003.c +++ b/drivers/iio/chemical/pms7003.c @@ -73,6 +73,11 @@ struct pms7003_state { struct pms7003_frame frame; struct completion frame_ready; struct mutex lock; /* must be held whenever state gets touched */ + /* Used to construct scan to push to the IIO buffer */ + struct { + u16 data[3]; /* PM1, PM2P5, PM10 */ + s64 ts; + } scan; }; static int pms7003_do_cmd(struct pms7003_state *state, enum pms7003_cmd cmd) @@ -104,7 +109,6 @@ static irqreturn_t pms7003_trigger_handl struct iio_dev *indio_dev = pf->indio_dev; struct pms7003_state *state = iio_priv(indio_dev); struct pms7003_frame *frame = &state->frame; - u16 data[3 + 1 + 4]; /* PM1, PM2P5, PM10, padding, timestamp */ int ret; mutex_lock(&state->lock); @@ -114,12 +118,15 @@ static irqreturn_t pms7003_trigger_handl goto err; } - data[PM1] = pms7003_get_pm(frame->data + PMS7003_PM1_OFFSET); - data[PM2P5] = pms7003_get_pm(frame->data + PMS7003_PM2P5_OFFSET); - data[PM10] = pms7003_get_pm(frame->data + PMS7003_PM10_OFFSET); + state->scan.data[PM1] = + pms7003_get_pm(frame->data + PMS7003_PM1_OFFSET); + state->scan.data[PM2P5] = + pms7003_get_pm(frame->data + PMS7003_PM2P5_OFFSET); + state->scan.data[PM10] = + pms7003_get_pm(frame->data + PMS7003_PM10_OFFSET); mutex_unlock(&state->lock); - iio_push_to_buffers_with_timestamp(indio_dev, data, + iio_push_to_buffers_with_timestamp(indio_dev, &state->scan, iio_get_time_ns(indio_dev)); err: iio_trigger_notify_done(indio_dev->trig); From patchwork Tue Jun 9 17:45:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224656 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BFC70C433E0 for ; Tue, 9 Jun 2020 18:01:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9823E206D5 for ; Tue, 9 Jun 2020 18:01:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725688; bh=fl6azMfhIGuZjCmH+CkUOjvcD7goDESkGF2l0XOjBvo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=RK8jc6/PPKewEXZ529lkph1ux+X3tRVCQ1KEIh9yJA04nTP+s7GM5Eo3yznK0VdKb wyRplLGaPdrsO0PeHVzv1QQaYMELnVpDyaLVYY6VGlN4aJumi4LRJb8XZ2HljVykIN WjXJBsTUZxAKLKABxKqls50qFRcOM+yEskoWTZMg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733210AbgFISBY (ORCPT ); Tue, 9 Jun 2020 14:01:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:45470 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731647AbgFIRyE (ORCPT ); Tue, 9 Jun 2020 13:54:04 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7D5E22074B; Tue, 9 Jun 2020 17:54:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725244; bh=fl6azMfhIGuZjCmH+CkUOjvcD7goDESkGF2l0XOjBvo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bObg96Zakf/+xt298EL5SaGADzXV7SRIyhRpv8ZXZB15ugXTepoRb1zGFmIu/7wJo 8Mqk0Pk173ZxkvvKbROU9inYd22w+VBnxCojX5Qy1PGovTITvA60nWS+sN1UmkPGZy Da+NdDu1Iu2hjceXW2645NmgmmGBfgBtibwjKK8E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bin Liu Subject: [PATCH 5.6 27/41] usb: musb: start session in resume for host port Date: Tue, 9 Jun 2020 19:45:29 +0200 Message-Id: <20200609174114.713662820@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Bin Liu commit 7f88a5ac393f39319f69b8b20cc8d5759878d1a1 upstream. Commit 17539f2f4f0b ("usb: musb: fix enumeration after resume") replaced musb_start() in musb_resume() to not override softconnect bit, but it doesn't restart the session for host port which was done in musb_start(). The session could be disabled in musb_suspend(), which leads the host port doesn't stay in host mode. So let's start the session specifically for host port in musb_resume(). Fixes: 17539f2f4f0b ("usb: musb: fix enumeration after resume") Cc: stable@vger.kernel.org Signed-off-by: Bin Liu Link: https://lore.kernel.org/r/20200525025049.3400-3-b-liu@ti.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/musb/musb_core.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/usb/musb/musb_core.c +++ b/drivers/usb/musb/musb_core.c @@ -2877,6 +2877,13 @@ static int musb_resume(struct device *de musb_enable_interrupts(musb); musb_platform_enable(musb); + /* session might be disabled in suspend */ + if (musb->port_mode == MUSB_HOST && + !(musb->ops->quirks & MUSB_PRESERVE_SESSION)) { + devctl |= MUSB_DEVCTL_SESSION; + musb_writeb(musb->mregs, MUSB_DEVCTL, devctl); + } + spin_lock_irqsave(&musb->lock, flags); error = musb_run_resume_work(musb); if (error) From patchwork Tue Jun 9 17:45:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224657 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 815B3C433E0 for ; Tue, 9 Jun 2020 18:01:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 62653206D5 for ; Tue, 9 Jun 2020 18:01:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725676; bh=7H0o9iPkpfeRrO+kK8fHciPXul+ErU2mXc1tBvSlrxs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=jgoUMPxyvODIOj0So4gWHyv4LM78mTbEz3yu1aYO035p8eoEp94Am/0IPuyjvtNyS 9EcVPP3aKTOehN59udK5DsNEJjFPrjflowp1l2XrUu0pgkxZv4GAoUtvYvu+xVxUmg y3qUIxzKIJiP3dQfy6VDfGOnv9nOYjJDAys9JjFI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387470AbgFISAt (ORCPT ); Tue, 9 Jun 2020 14:00:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:45756 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733071AbgFIRyN (ORCPT ); Tue, 9 Jun 2020 13:54:13 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 833AF20801; Tue, 9 Jun 2020 17:54:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725253; bh=7H0o9iPkpfeRrO+kK8fHciPXul+ErU2mXc1tBvSlrxs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fuNdg4krJBg/3222C9pFqowxCLjvqaD2qXsUallGff7InQVImI6fWJd0XPKX4OI0w Fq+45pSCtBGtFsGbzxKMzDFmnI7gJSJ1RXA0g/fzY6mh33MSNjNTxui7oY4PFu99y/ AMY0oodi/PLpBdWpw2mujDaqjTu1TodvBdGBj7Vg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiri Slaby , Raghavendra Subject: [PATCH 5.6 31/41] tty: hvc_console, fix crashes on parallel open/close Date: Tue, 9 Jun 2020 19:45:33 +0200 Message-Id: <20200609174115.064905891@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jiri Slaby commit 24eb2377f977fe06d84fca558f891f95bc28a449 upstream. hvc_open sets tty->driver_data to NULL when open fails at some point. Typically, the failure happens in hp->ops->notifier_add(). If there is a racing process which tries to open such mangled tty, which was not closed yet, the process will crash in hvc_open as tty->driver_data is NULL. All this happens because close wants to know whether open failed or not. But ->open should not NULL this and other tty fields for ->close to be happy. ->open should call tty_port_set_initialized(true) and close should check by tty_port_initialized() instead. So do this properly in this driver. So this patch removes these from ->open: * tty_port_tty_set(&hp->port, NULL). This happens on last close. * tty->driver_data = NULL. Dtto. * tty_port_put(&hp->port). This happens in shutdown and until now, this must have been causing a reference underflow, if I am not missing something. Signed-off-by: Jiri Slaby Cc: stable Reported-and-tested-by: Raghavendra Link: https://lore.kernel.org/r/20200526145632.13879-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman --- drivers/tty/hvc/hvc_console.c | 23 ++++++++--------------- 1 file changed, 8 insertions(+), 15 deletions(-) --- a/drivers/tty/hvc/hvc_console.c +++ b/drivers/tty/hvc/hvc_console.c @@ -371,15 +371,14 @@ static int hvc_open(struct tty_struct *t * tty fields and return the kref reference. */ if (rc) { - tty_port_tty_set(&hp->port, NULL); - tty->driver_data = NULL; - tty_port_put(&hp->port); printk(KERN_ERR "hvc_open: request_irq failed with rc %d.\n", rc); - } else + } else { /* We are ready... raise DTR/RTS */ if (C_BAUD(tty)) if (hp->ops->dtr_rts) hp->ops->dtr_rts(hp, 1); + tty_port_set_initialized(&hp->port, true); + } /* Force wakeup of the polling thread */ hvc_kick(); @@ -389,22 +388,12 @@ static int hvc_open(struct tty_struct *t static void hvc_close(struct tty_struct *tty, struct file * filp) { - struct hvc_struct *hp; + struct hvc_struct *hp = tty->driver_data; unsigned long flags; if (tty_hung_up_p(filp)) return; - /* - * No driver_data means that this close was issued after a failed - * hvc_open by the tty layer's release_dev() function and we can just - * exit cleanly because the kref reference wasn't made. - */ - if (!tty->driver_data) - return; - - hp = tty->driver_data; - spin_lock_irqsave(&hp->port.lock, flags); if (--hp->port.count == 0) { @@ -412,6 +401,9 @@ static void hvc_close(struct tty_struct /* We are done with the tty pointer now. */ tty_port_tty_set(&hp->port, NULL); + if (!tty_port_initialized(&hp->port)) + return; + if (C_HUPCL(tty)) if (hp->ops->dtr_rts) hp->ops->dtr_rts(hp, 0); @@ -428,6 +420,7 @@ static void hvc_close(struct tty_struct * waking periodically to check chars_in_buffer(). */ tty_wait_until_sent(tty, HVC_CLOSE_WAIT); + tty_port_set_initialized(&hp->port, false); } else { if (hp->port.count < 0) printk(KERN_ERR "hvc_close %X: oops, count is %d\n", From patchwork Tue Jun 9 17:45:34 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224679 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81536C433DF for ; Tue, 9 Jun 2020 17:54:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5ADB62081A for ; Tue, 9 Jun 2020 17:54:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725263; bh=miLTQdPwzuk9lQFiqP5cxP8nhx922KpR3g6Sz11QT1U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=PClRk+LeXw79pd2ZZ6epd2V/scELxK3gNR8rUFOLGOnfExc0VQuXT/vbKgtQ67R0Z /CYZmhNb0U2dsb4wT7/zp7/7sXtobTU/y5yE/xoHxKBIoMKIPQisCiwucRCIn7dcib Y7AGiZiCfydCVVCjEJ5cA83rU6PWGY1/AS7U0PVg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732864AbgFIRyS (ORCPT ); Tue, 9 Jun 2020 13:54:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:45796 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733072AbgFIRyP (ORCPT ); Tue, 9 Jun 2020 13:54:15 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CA7502074B; Tue, 9 Jun 2020 17:54:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725255; bh=miLTQdPwzuk9lQFiqP5cxP8nhx922KpR3g6Sz11QT1U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1aRaydkc+B/OwLKD2bjyEGp/Zh8aopevXaE2KVz/gUQgd3dIXJK3BF4adxj5xnu2m KF2ZTodggkZuXbOcsr9Akvux8rgLDk6VxqYeiq8Pgf4MitMEMEtGVPedRhL0wHfEie NuXzr+RanUGxGI0gLnHxGU58EH3Ppw/PY3bz7/+M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pascal Terjan Subject: [PATCH 5.6 32/41] staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK Date: Tue, 9 Jun 2020 19:45:34 +0200 Message-Id: <20200609174115.150785569@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pascal Terjan commit 15ea976a1f12b5fd76b1bd6ff3eb5132fd28047f upstream. The value in shared headers was fixed 9 years ago in commit 8d661f1e462d ("ieee80211: correct IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK macro") and while looking at using shared headers for other duplicated constants I noticed this driver uses the old value. The macros are also defined twice in this file so I am deleting the second definition. Signed-off-by: Pascal Terjan Cc: stable Link: https://lore.kernel.org/r/20200523211247.23262-1-pterjan@google.com Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8712/wifi.h | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) --- a/drivers/staging/rtl8712/wifi.h +++ b/drivers/staging/rtl8712/wifi.h @@ -440,7 +440,7 @@ static inline unsigned char *get_hdr_bss /* block-ack parameters */ #define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002 #define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C -#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0 +#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFC0 #define IEEE80211_DELBA_PARAM_TID_MASK 0xF000 #define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800 @@ -532,13 +532,6 @@ struct ieee80211_ht_addt_info { #define IEEE80211_HT_IE_NON_GF_STA_PRSNT 0x0004 #define IEEE80211_HT_IE_NON_HT_STA_PRSNT 0x0010 -/* block-ack parameters */ -#define IEEE80211_ADDBA_PARAM_POLICY_MASK 0x0002 -#define IEEE80211_ADDBA_PARAM_TID_MASK 0x003C -#define IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK 0xFFA0 -#define IEEE80211_DELBA_PARAM_TID_MASK 0xF000 -#define IEEE80211_DELBA_PARAM_INITIATOR_MASK 0x0800 - /* * A-PMDU buffer sizes * According to IEEE802.11n spec size varies from 8K to 64K (in powers of 2) From patchwork Tue Jun 9 17:45:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224658 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8414C433E1 for ; Tue, 9 Jun 2020 18:00:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C032D206D5 for ; Tue, 9 Jun 2020 18:00:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725649; bh=XEGidvdyGCOiAiBQ9Tc8EFoGZ03ZmvSA/xlWKKMAXOo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=oMd2nULIo8a8uyNxEpCmtNM4GvwETo9IxVg4HSODxfPm5k85RgFL8gm1R9C83fBcq 1I093wygpJnuhrkGRhNoUn8h/n90/WdiUwdxkF1zcVg18JR5YPBStaHJUSl/sc4KGe RPFwABFiSIjuq8FSfmxuPhTDVqBx3uuWufHkmH4o= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733143AbgFISAt (ORCPT ); Tue, 9 Jun 2020 14:00:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:45836 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731571AbgFIRyR (ORCPT ); Tue, 9 Jun 2020 13:54:17 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1DCC520774; Tue, 9 Jun 2020 17:54:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725257; bh=XEGidvdyGCOiAiBQ9Tc8EFoGZ03ZmvSA/xlWKKMAXOo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QFQPGNtZTA/ug4qD1sgjpPxjqtzJ+3I33slp85jX15vKs42Qt7cJKxPADoWz2m/eg C+SAfDmbMX2sV/LJUGWlv1f8lg7i9gb2g/IWVysZKzl0HE5HIWh2EPNqBqGf2ArzkM 3p7K4rg4gi3LDWeitlTtYjNSeX/eP1TfNJNNq9YM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , Jean Rene Dawin Subject: [PATCH 5.6 33/41] CDC-ACM: heed quirk also in error handling Date: Tue, 9 Jun 2020 19:45:35 +0200 Message-Id: <20200609174115.238537419@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Oliver Neukum commit 97fe809934dd2b0b37dfef3a2fc70417f485d7af upstream. If buffers are iterated over in the error case, the lower limits for quirky devices must be heeded. Signed-off-by: Oliver Neukum Reported-by: Jean Rene Dawin Fixes: a4e7279cd1d19 ("cdc-acm: introduce a cool down") Cc: stable Link: https://lore.kernel.org/r/20200526124420.22160-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/class/cdc-acm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -584,7 +584,7 @@ static void acm_softint(struct work_stru } if (test_and_clear_bit(ACM_ERROR_DELAY, &acm->flags)) { - for (i = 0; i < ACM_NR; i++) + for (i = 0; i < acm->rx_buflimit; i++) if (test_and_clear_bit(i, &acm->urbs_in_error_delay)) acm_submit_read_urb(acm, i, GFP_NOIO); } From patchwork Tue Jun 9 17:45:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 187691 Delivered-To: patch@linaro.org Received: by 2002:a92:cf06:0:0:0:0:0 with SMTP id c6csp767056ilo; Tue, 9 Jun 2020 11:00:50 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyMXbAB2rn/un61kwXMnFT+DivEOeYrrcsqkvlGLhtWBS2Q797+N9N6w6A2W0o3odDV1Pfq X-Received: by 2002:a17:906:f2c2:: with SMTP id gz2mr19289749ejb.260.1591725649947; Tue, 09 Jun 2020 11:00:49 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1591725649; cv=none; d=google.com; s=arc-20160816; b=V8dYjbH2VedOdretsEHUR2mpU2rttuwhxCFm6r8jdWiVUVe24FEZduRJLt8hNWinqC /+/P1dOISfSxbpVmgmTTo8VXBT0bOn3CIqAx26HT1kjJYdHjb4+VIVuoL9Cre6igNtW1 c1XMKHEMp+Qv+ZwNHVqNuVc8yj99bsx1CnbkmMj8pQbhOXknuYcoRoDWF4NDUA3c61gE 5kF3kolW4H1LbNuiPuuhn1XNnG1CoRegNOTqkOGtoBaO5GfqqAOQzzFeg/2Ia0/o/eAR sw3guJZo0YXipNelVlD2eu66NVXWnNu6vRelW/zKwkkU4zanP6P/0iXN4hixyUy2iNwD IApA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=/rtbpW0aQEeZ4NFcx2rYrdvLKJmdYcGqqwuOKRuwTdk=; b=yjK8h5YjMzmbXpb8V+vgluSHcpqdV3SU78H0Tt5B/qCx7SNizR6dCSfN87qJwNKWCb aH5f3m/jhupr+ZLHkJ1Kgr0Zi2pYzD/CiT4BcEmFqRimP+yhVf/fIoPl88JYeaAIb0cT 9HGjJXZ2BJhTahvxow9rVlUFZdvG5c+CSpgD/ODI/dseui8e2/ea72ON0CmuT7EptWRJ Ax+AMhC+r16sJgg3lZSMNq2cgYLtJ57OadmKbys2S2mnBcrRo8EFiao65Y6Yr61wEzBo yuiA6yc0Osh7AF6kdGsVTaBrrVBO82DCZaTcjBAxIdu3/DKZYIDmf35t+XqVNDUNgv2l 4Eqg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=rNZL6LZ0; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id bf15si11825969edb.553.2020.06.09.11.00.49; Tue, 09 Jun 2020 11:00:49 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=rNZL6LZ0; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733092AbgFISAs (ORCPT + 15 others); Tue, 9 Jun 2020 14:00:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:45896 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733074AbgFIRyU (ORCPT ); Tue, 9 Jun 2020 13:54:20 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5AD66207C3; Tue, 9 Jun 2020 17:54:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725259; bh=mlChgyTv5SQLeyzNVZm89cxyxj49nT+0TF3uaH4MMaI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rNZL6LZ0wzYL1ltexgz6kaOe4ef0DqMstMUXx2e7REfsRLPL8FBsY1S/VWr6FLAis IyakcJ3Ie6vrkTOdKq5J6a+tDTqXAWyoBJkDLB28HIOVfLjppzggOjRJrsBmT4YbBs PuLPk5V3fYW0XqpS6c1+rniIoZsatgob628TJXeE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Srinivas Kandagatla , Douglas Anderson Subject: [PATCH 5.6 34/41] nvmem: qfprom: remove incorrect write support Date: Tue, 9 Jun 2020 19:45:36 +0200 Message-Id: <20200609174115.324191619@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Srinivas Kandagatla commit 8d9eb0d6d59a5d7028c80a30831143d3e75515a7 upstream. qfprom has different address spaces for read and write. Reads are always done from corrected address space, where as writes are done on raw address space. Writing to corrected address space is invalid and ignored, so it does not make sense to have this support in the driver which only supports corrected address space regions at the moment. Fixes: 4ab11996b489 ("nvmem: qfprom: Add Qualcomm QFPROM support.") Signed-off-by: Srinivas Kandagatla Reviewed-by: Douglas Anderson Cc: stable Link: https://lore.kernel.org/r/20200522113341.7728-1-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/nvmem/qfprom.c | 14 -------------- 1 file changed, 14 deletions(-) --- a/drivers/nvmem/qfprom.c +++ b/drivers/nvmem/qfprom.c @@ -27,25 +27,11 @@ static int qfprom_reg_read(void *context return 0; } -static int qfprom_reg_write(void *context, - unsigned int reg, void *_val, size_t bytes) -{ - struct qfprom_priv *priv = context; - u8 *val = _val; - int i = 0, words = bytes; - - while (words--) - writeb(*val++, priv->base + reg + i++); - - return 0; -} - static struct nvmem_config econfig = { .name = "qfprom", .stride = 1, .word_size = 1, .reg_read = qfprom_reg_read, - .reg_write = qfprom_reg_write, }; static int qfprom_probe(struct platform_device *pdev) From patchwork Tue Jun 9 17:45:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224678 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09A0DC433E1 for ; Tue, 9 Jun 2020 17:54:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D9165207C3 for ; Tue, 9 Jun 2020 17:54:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725267; bh=f+8D/Ne//89piy8TFZmlemtTQKewWDLM3HEqhNsGpig=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=oYHjw5dp86lHZBVyt1XQV0Wz7/4Ylf03mRI/tsIT64Dd+8D6T/z21M/JrKiZVl33V axkB5yd+jQla90YKqUcX99jOfGnPYQPWVOA/ikAge8VPFyfaUN6b1HYhLJzga6l1NX 3/VeDM/2Z1xcpobMDHVd2EUvn5TT12Ebhv2CMJXM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733087AbgFIRyZ (ORCPT ); Tue, 9 Jun 2020 13:54:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:46028 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733086AbgFIRyY (ORCPT ); Tue, 9 Jun 2020 13:54:24 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D0AA320801; Tue, 9 Jun 2020 17:54:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725264; bh=f+8D/Ne//89piy8TFZmlemtTQKewWDLM3HEqhNsGpig=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RCAnRjm7NRCv6cVGH+8+MzoZmOUDkRCsCwAEnENJV9HMNeNz0OQw272G41PwZbN0S +vco09oznt1y7iJ8D7wVdJjhopJrU7W2L05MBps5HKAgIL3UUBy37wJoS9vodtIAGt 9W25YwSSuAwJC5hshRh0Ol6Vu+0pX+jFdrTFQuc0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Gross , Borislav Petkov , Thomas Gleixner , Josh Poimboeuf Subject: [PATCH 5.6 36/41] x86/cpu: Add table argument to cpu_matches() Date: Tue, 9 Jun 2020 19:45:38 +0200 Message-Id: <20200609174115.494862120@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mark Gross commit 93920f61c2ad7edb01e63323832585796af75fc9 upstream To make cpu_matches() reusable for other matching tables, have it take a pointer to a x86_cpu_id table as an argument. [ bp: Flip arguments order. ] Signed-off-by: Mark Gross Signed-off-by: Borislav Petkov Signed-off-by: Thomas Gleixner Reviewed-by: Josh Poimboeuf Signed-off-by: Greg Kroah-Hartman --- arch/x86/kernel/cpu/common.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -1075,9 +1075,9 @@ static const __initconst struct x86_cpu_ {} }; -static bool __init cpu_matches(unsigned long which) +static bool __init cpu_matches(const struct x86_cpu_id *table, unsigned long which) { - const struct x86_cpu_id *m = x86_match_cpu(cpu_vuln_whitelist); + const struct x86_cpu_id *m = x86_match_cpu(table); return m && !!(m->driver_data & which); } @@ -1097,31 +1097,34 @@ static void __init cpu_set_bug_bits(stru u64 ia32_cap = x86_read_arch_cap_msr(); /* Set ITLB_MULTIHIT bug if cpu is not in the whitelist and not mitigated */ - if (!cpu_matches(NO_ITLB_MULTIHIT) && !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO)) + if (!cpu_matches(cpu_vuln_whitelist, NO_ITLB_MULTIHIT) && + !(ia32_cap & ARCH_CAP_PSCHANGE_MC_NO)) setup_force_cpu_bug(X86_BUG_ITLB_MULTIHIT); - if (cpu_matches(NO_SPECULATION)) + if (cpu_matches(cpu_vuln_whitelist, NO_SPECULATION)) return; setup_force_cpu_bug(X86_BUG_SPECTRE_V1); - if (!cpu_matches(NO_SPECTRE_V2)) + if (!cpu_matches(cpu_vuln_whitelist, NO_SPECTRE_V2)) setup_force_cpu_bug(X86_BUG_SPECTRE_V2); - if (!cpu_matches(NO_SSB) && !(ia32_cap & ARCH_CAP_SSB_NO) && + if (!cpu_matches(cpu_vuln_whitelist, NO_SSB) && + !(ia32_cap & ARCH_CAP_SSB_NO) && !cpu_has(c, X86_FEATURE_AMD_SSB_NO)) setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS); if (ia32_cap & ARCH_CAP_IBRS_ALL) setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED); - if (!cpu_matches(NO_MDS) && !(ia32_cap & ARCH_CAP_MDS_NO)) { + if (!cpu_matches(cpu_vuln_whitelist, NO_MDS) && + !(ia32_cap & ARCH_CAP_MDS_NO)) { setup_force_cpu_bug(X86_BUG_MDS); - if (cpu_matches(MSBDS_ONLY)) + if (cpu_matches(cpu_vuln_whitelist, MSBDS_ONLY)) setup_force_cpu_bug(X86_BUG_MSBDS_ONLY); } - if (!cpu_matches(NO_SWAPGS)) + if (!cpu_matches(cpu_vuln_whitelist, NO_SWAPGS)) setup_force_cpu_bug(X86_BUG_SWAPGS); /* @@ -1139,7 +1142,7 @@ static void __init cpu_set_bug_bits(stru (ia32_cap & ARCH_CAP_TSX_CTRL_MSR))) setup_force_cpu_bug(X86_BUG_TAA); - if (cpu_matches(NO_MELTDOWN)) + if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) return; /* Rogue Data Cache Load? No! */ @@ -1148,7 +1151,7 @@ static void __init cpu_set_bug_bits(stru setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN); - if (cpu_matches(NO_L1TF)) + if (cpu_matches(cpu_vuln_whitelist, NO_L1TF)) return; setup_force_cpu_bug(X86_BUG_L1TF); From patchwork Tue Jun 9 17:45:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 224662 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D26AC433E2 for ; Tue, 9 Jun 2020 17:59:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3A381206D5 for ; Tue, 9 Jun 2020 17:59:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725588; bh=mQlyIZpsFwSxbxKyryxpvl6ccsVmLfLXK1O83SaWYIw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=LERKVE0ZdHf7V+1umIyWnBK7jJFMGVDmzLOQvJMeEOvTCfSYwSLLqfbpW4gDq8POD s+/Wn+ZXDQvJHcHvqwPUjZo+95ca7S35C7DGzxSbqDX4l32KwMsTwA/tXHdNTSqrdY zpWNmY7tDdX767GW900NAO2lyg4NbqTya02D+U/Q= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732908AbgFIR7q (ORCPT ); Tue, 9 Jun 2020 13:59:46 -0400 Received: from mail.kernel.org ([198.145.29.99]:46802 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733152AbgFIRyt (ORCPT ); Tue, 9 Jun 2020 13:54:49 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A3451207ED; Tue, 9 Jun 2020 17:54:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591725289; bh=mQlyIZpsFwSxbxKyryxpvl6ccsVmLfLXK1O83SaWYIw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PkcR/eZiBKy4A3uwc/7rhCwd7xvafGZpFmzadO4gfIph4iz7fQw6exTPkxfcN72pm 7N939ZaeW+Fx3fb7MEXO5SbFvPRw6TKH8wX2OyoFvaxbeVJC86qWuE5jR9262i9oRl v3iK6VR4/ByMJFIEZTKGDZZGEFLx9ezrVrpczh2A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Torvalds , Oleg Nesterov , Srikar Dronamraju , Christian Borntraeger , Sven Schnelle , Steven Rostedt Subject: [PATCH 5.6 40/41] uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned Date: Tue, 9 Jun 2020 19:45:42 +0200 Message-Id: <20200609174115.918001432@linuxfoundation.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: <20200609174112.129412236@linuxfoundation.org> References: <20200609174112.129412236@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Oleg Nesterov commit 013b2deba9a6b80ca02f4fafd7dedf875e9b4450 upstream. uprobe_write_opcode() must not cross page boundary; prepare_uprobe() relies on arch_uprobe_analyze_insn() which should validate "vaddr" but some architectures (csky, s390, and sparc) don't do this. We can remove the BUG_ON() check in prepare_uprobe() and validate the offset early in __uprobe_register(). The new IS_ALIGNED() check matches the alignment check in arch_prepare_kprobe() on supported architectures, so I think that all insns must be aligned to UPROBE_SWBP_INSN_SIZE. Another problem is __update_ref_ctr() which was wrong from the very beginning, it can read/write outside of kmap'ed page unless "vaddr" is aligned to sizeof(short), __uprobe_register() should check this too. Reported-by: Linus Torvalds Suggested-by: Linus Torvalds Signed-off-by: Oleg Nesterov Reviewed-by: Srikar Dronamraju Acked-by: Christian Borntraeger Tested-by: Sven Schnelle Cc: Steven Rostedt Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- kernel/events/uprobes.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -867,10 +867,6 @@ static int prepare_uprobe(struct uprobe if (ret) goto out; - /* uprobe_write_opcode() assumes we don't cross page boundary */ - BUG_ON((uprobe->offset & ~PAGE_MASK) + - UPROBE_SWBP_INSN_SIZE > PAGE_SIZE); - smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */ set_bit(UPROBE_COPY_INSN, &uprobe->flags); @@ -1166,6 +1162,15 @@ static int __uprobe_register(struct inod if (offset > i_size_read(inode)) return -EINVAL; + /* + * This ensures that copy_from_page(), copy_to_page() and + * __update_ref_ctr() can't cross page boundary. + */ + if (!IS_ALIGNED(offset, UPROBE_SWBP_INSN_SIZE)) + return -EINVAL; + if (!IS_ALIGNED(ref_ctr_offset, sizeof(short))) + return -EINVAL; + retry: uprobe = alloc_uprobe(inode, offset, ref_ctr_offset); if (!uprobe) @@ -2014,6 +2019,9 @@ static int is_trap_at_addr(struct mm_str uprobe_opcode_t opcode; int result; + if (WARN_ON_ONCE(!IS_ALIGNED(vaddr, UPROBE_SWBP_INSN_SIZE))) + return -EINVAL; + pagefault_disable(); result = __get_user(opcode, (uprobe_opcode_t __user *)vaddr); pagefault_enable();