From patchwork Fri May 1 13:20:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226462 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE516C47253 for ; Fri, 1 May 2020 14:01:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C9EAE2051A for ; Fri, 1 May 2020 14:01:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341716; bh=bFFNqUMVNmsd3/hfjpSCuoNAqXjfE+K6AZrMgJ6pcMs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=yU3J/1kIRQtxE3NN810V8vHd1DhcExakMsVZYIPTLRnNYvykIc8oPqzScndFswHde oRU9jxTx6fa3PyOrLJbkzaQTJ6Eai5ilPJQvTEpYnSeH8yE+PN66jY9zkTZFbOOogz sY+c3czKD+HqUfHDjnp14nkDlagzgEJVnYUJdkjU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728919AbgEANZB (ORCPT ); Fri, 1 May 2020 09:25:01 -0400 Received: from mail.kernel.org ([198.145.29.99]:45644 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728931AbgEANZA (ORCPT ); Fri, 1 May 2020 09:25:00 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7D20A2173E; Fri, 1 May 2020 13:24:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339500; bh=bFFNqUMVNmsd3/hfjpSCuoNAqXjfE+K6AZrMgJ6pcMs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uHbtyW/Eah/2TDtvqMQSJpP6tm3wyZUthygIrpyM4oRLmWFvPq6orxtLyvB80VWhN uIJKbEuPlhVO2FKN5NbDeCX+W3YV05JZUxpo0o/vDnMQrnTTtl8KlB/sNVWj9zYJd0 Vsh1vqM5A5k08hJHT+lS/RImnLQ6ZAnjUYE0I3NQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arnd Bergmann , Sabrina Dubroca , "David S. Miller" , Guenter Roeck Subject: [PATCH 4.4 04/70] net: ipv4: avoid unused variable warning for sysctl Date: Fri, 1 May 2020 15:20:52 +0200 Message-Id: <20200501131514.469024590@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Arnd Bergmann commit 773daa3caf5d3f87fdb1ab43e9c1b367a38fa394 upstream. The newly introudced ip_min_valid_pmtu variable is only used when CONFIG_SYSCTL is set: net/ipv4/route.c:135:12: error: 'ip_min_valid_pmtu' defined but not used [-Werror=unused-variable] This moves it to the other variables like it, to avoid the harmless warning. Fixes: c7272c2f1229 ("net: ipv4: don't allow setting net.ipv4.route.min_pmtu below 68") Signed-off-by: Arnd Bergmann Acked-by: Sabrina Dubroca Signed-off-by: David S. Miller Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman --- net/ipv4/route.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -131,8 +131,6 @@ static int ip_rt_min_advmss __read_mostl static int ip_rt_gc_timeout __read_mostly = RT_GC_TIMEOUT; -static int ip_min_valid_pmtu __read_mostly = IPV4_MIN_MTU; - /* * Interface to generic destination cache. */ @@ -2705,6 +2703,7 @@ void ip_rt_multicast_event(struct in_dev static int ip_rt_gc_interval __read_mostly = 60 * HZ; static int ip_rt_gc_min_interval __read_mostly = HZ / 2; static int ip_rt_gc_elasticity __read_mostly = 8; +static int ip_min_valid_pmtu __read_mostly = IPV4_MIN_MTU; static int ipv4_sysctl_rtcache_flush(struct ctl_table *__ctl, int write, void __user *buffer, From patchwork Fri May 1 13:20:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226707 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EFCB0C4724C for ; Fri, 1 May 2020 13:25:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CD6B824954 for ; Fri, 1 May 2020 13:25:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339503; bh=9RzJxy4Upa/s9eKqiIKMjlPo8dJwUDtbafz0tltfjg4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Zvt3rmxiJC41uzHgmsi8VcsWLoCFoDcs2yyk3owQAg50FNbO+dP8M3VHZyclpntPA REkR8cFg46vmqJkDbLpIyQD7HPEbmUFjgyYTOLDWGy4zk7sUz1d/GNq94B2+VZA995 R5SIUUgssocmHrOINIPabNvO8BsBV7gUJJuhOVFU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728944AbgEANZD (ORCPT ); Fri, 1 May 2020 09:25:03 -0400 Received: from mail.kernel.org ([198.145.29.99]:45710 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728942AbgEANZC (ORCPT ); Fri, 1 May 2020 09:25:02 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E8BB72166E; Fri, 1 May 2020 13:25:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339502; bh=9RzJxy4Upa/s9eKqiIKMjlPo8dJwUDtbafz0tltfjg4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EBLtRvvF5g7/SpW6IujDX+Z+fNhwkX7Ax55D1Rcv3guM+xWZeNWJd5aIKu4pUlsIC 9pCkfFsOcL6L7gldiHA83XUIJu3bOUzGC+FFRA34XXEf8PqUC0WlnpgYCaXlGBjUKm juT0f1NxwgjN8Wnw4Lo6Knm51g7R6VkMXkmvF7HQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wei Yongjun , Herbert Xu , Guenter Roeck Subject: [PATCH 4.4 05/70] crypto: mxs-dcp - make symbols sha1_null_hash and sha256_null_hash static Date: Fri, 1 May 2020 15:20:53 +0200 Message-Id: <20200501131514.617601793@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Wei Yongjun commit ce4e45842de3eb54b8dd6e081765d741f5b92b56 upstream. Fixes the following sparse warnings: drivers/crypto/mxs-dcp.c:39:15: warning: symbol 'sha1_null_hash' was not declared. Should it be static? drivers/crypto/mxs-dcp.c:43:15: warning: symbol 'sha256_null_hash' was not declared. Should it be static? Fixes: c709eebaf5c5 ("crypto: mxs-dcp - Fix SHA null hashes and output length") Signed-off-by: Wei Yongjun Signed-off-by: Herbert Xu Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/mxs-dcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/crypto/mxs-dcp.c +++ b/drivers/crypto/mxs-dcp.c @@ -37,11 +37,11 @@ * Null hashes to align with hw behavior on imx6sl and ull * these are flipped for consistency with hw output */ -const uint8_t sha1_null_hash[] = +static const uint8_t sha1_null_hash[] = "\x09\x07\xd8\xaf\x90\x18\x60\x95\xef\xbf" "\x55\x32\x0d\x4b\x6b\x5e\xee\xa3\x39\xda"; -const uint8_t sha256_null_hash[] = +static const uint8_t sha256_null_hash[] = "\x55\xb8\x52\x78\x1b\x99\x95\xa4" "\x4c\x93\x9b\x64\xe4\x41\xae\x27" "\x24\xb9\x6f\x99\xc8\xf4\xfb\x9a" From patchwork Fri May 1 13:20:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226706 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80A56C4724C for ; Fri, 1 May 2020 13:25:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 612922495E for ; Fri, 1 May 2020 13:25:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339510; bh=Z5FTm0I7htD8O8iicnQOKr9GS7r2PJvsZxRMoXwPYHw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=vXzVrHBJKWFuuM+TgWSTtQpRfHDdhG/sGluBpFnim+Juo015Tbbjlr/TVdNUNNtn4 wZTN2xrWqlvwj52DUzowGS0RZkr+VBoX8egFjtqWUi2Mx39DesPiT48XZbQTGsdWoa fPOn73YTGzU1LuEIQQKiZUOoWTDCW0HYl51W1L9c= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728843AbgEANZJ (ORCPT ); Fri, 1 May 2020 09:25:09 -0400 Received: from mail.kernel.org ([198.145.29.99]:45878 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728942AbgEANZH (ORCPT ); Fri, 1 May 2020 09:25:07 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C355B24959; Fri, 1 May 2020 13:25:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339507; bh=Z5FTm0I7htD8O8iicnQOKr9GS7r2PJvsZxRMoXwPYHw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ebConEbzQyvUOBNlCc3TO5oGErSg8uvhQQd1MUR/VXQKBhhRH+t/d8HMULG98MQMA fJYM/GTnsdnNa24VqxByOBtOVFyMOosbuAJpCbdDyoQSRVE8zy1ToLU+84WsoYKdqj zH4Fo2Kzaw1LR5l+TaVH6nB0ziRnUfF+JsTC19tQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, James Smart , Dick Kennedy , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.4 07/70] scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login Date: Fri, 1 May 2020 15:20:55 +0200 Message-Id: <20200501131514.951810627@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: James Smart [ Upstream commit 38503943c89f0bafd9e3742f63f872301d44cbea ] The following kasan bug was called out: BUG: KASAN: slab-out-of-bounds in lpfc_unreg_login+0x7c/0xc0 [lpfc] Read of size 2 at addr ffff889fc7c50a22 by task lpfc_worker_3/6676 ... Call Trace: dump_stack+0x96/0xe0 ? lpfc_unreg_login+0x7c/0xc0 [lpfc] print_address_description.constprop.6+0x1b/0x220 ? lpfc_unreg_login+0x7c/0xc0 [lpfc] ? lpfc_unreg_login+0x7c/0xc0 [lpfc] __kasan_report.cold.9+0x37/0x7c ? lpfc_unreg_login+0x7c/0xc0 [lpfc] kasan_report+0xe/0x20 lpfc_unreg_login+0x7c/0xc0 [lpfc] lpfc_sli_def_mbox_cmpl+0x334/0x430 [lpfc] ... When processing the completion of a "Reg Rpi" login mailbox command in lpfc_sli_def_mbox_cmpl, a call may be made to lpfc_unreg_login. The vpi is extracted from the completing mailbox context and passed as an input for the next. However, the vpi stored in the mailbox command context is an absolute vpi, which for SLI4 represents both base + offset. When used with a non-zero base component, (function id > 0) this results in an out-of-range access beyond the allocated phba->vpi_ids array. Fix by subtracting the function's base value to get an accurate vpi number. Link: https://lore.kernel.org/r/20200322181304.37655-2-jsmart2021@gmail.com Signed-off-by: James Smart Signed-off-by: Dick Kennedy Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/lpfc/lpfc_sli.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c index 065fdc17bbfbb..7a94c2d352390 100644 --- a/drivers/scsi/lpfc/lpfc_sli.c +++ b/drivers/scsi/lpfc/lpfc_sli.c @@ -2186,6 +2186,8 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) !pmb->u.mb.mbxStatus) { rpi = pmb->u.mb.un.varWords[0]; vpi = pmb->u.mb.un.varRegLogin.vpi; + if (phba->sli_rev == LPFC_SLI_REV4) + vpi -= phba->sli4_hba.max_cfg_param.vpi_base; lpfc_unreg_login(phba, vpi, rpi, pmb); pmb->mbox_cmpl = lpfc_sli_def_mbox_cmpl; rc = lpfc_sli_issue_mbox(phba, pmb, MBX_NOWAIT); From patchwork Fri May 1 13:20:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226705 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 352D4C47254 for ; Fri, 1 May 2020 13:25:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 104BE2173E for ; Fri, 1 May 2020 13:25:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339519; bh=/GX9T0D4odWQTx9IHT/mYKVbwAc7xE3hb7UQOZAveCM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=JQYKQmjTlk+Zz+H8ho4rLrbbPtHJKaH7pIBNDe+88VBSOX3YAvMhuTGk9340Z5y9w ZlCCIO6osxUSJqEaUsmJ1AjSVraFRWkphsjU7Fc7DCeKLy34B078UjbOCqlAOYUpEd u7d/K+wWwM2tFbTeFG0oPjA4S3snDuFT4FRtM0+k= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728984AbgEANZP (ORCPT ); Fri, 1 May 2020 09:25:15 -0400 Received: from mail.kernel.org ([198.145.29.99]:46002 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728979AbgEANZM (ORCPT ); Fri, 1 May 2020 09:25:12 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A806724955; Fri, 1 May 2020 13:25:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339512; bh=/GX9T0D4odWQTx9IHT/mYKVbwAc7xE3hb7UQOZAveCM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Otr2T64zKqvcAvMKZ2afRTh0+apWLKiXOQU6bkjaIizfaYZ4mX0UVQLHBFJsqpA5h +yczS+mXAb8Rp7ctR+21AJkHj+AZ5GV2aJ+NuNFlVOgsUeKavUO5c0b5u3UWL89x+A yyc+Kotyb34oY2x0qiq7xzDIxWffqQYkcTszg0wQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Yan, Zheng" , Jeff Layton , Ilya Dryomov , Sasha Levin Subject: [PATCH 4.4 09/70] ceph: dont skip updating wanted caps when cap is stale Date: Fri, 1 May 2020 15:20:57 +0200 Message-Id: <20200501131515.294796911@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Yan, Zheng [ Upstream commit 0aa971b6fd3f92afef6afe24ef78d9bb14471519 ] 1. try_get_cap_refs() fails to get caps and finds that mds_wanted does not include what it wants. It returns -ESTALE. 2. ceph_get_caps() calls ceph_renew_caps(). ceph_renew_caps() finds that inode has cap, so it calls ceph_check_caps(). 3. ceph_check_caps() finds that issued caps (without checking if it's stale) already includes caps wanted by open file, so it skips updating wanted caps. Above events can cause an infinite loop inside ceph_get_caps(). Signed-off-by: "Yan, Zheng" Reviewed-by: Jeff Layton Signed-off-by: Ilya Dryomov Signed-off-by: Sasha Levin --- fs/ceph/caps.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index aa4df4a022525..efdf81ea3b5f8 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -1734,8 +1734,12 @@ retry_locked: } /* want more caps from mds? */ - if (want & ~(cap->mds_wanted | cap->issued)) - goto ack; + if (want & ~cap->mds_wanted) { + if (want & ~(cap->mds_wanted | cap->issued)) + goto ack; + if (!__cap_is_valid(cap)) + goto ack; + } /* things we might delay */ if ((cap->issued & ~retain) == 0 && From patchwork Fri May 1 13:20:59 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226708 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C81F2C4724C for ; Fri, 1 May 2020 13:24:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A9E4E24955 for ; Fri, 1 May 2020 13:24:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339495; bh=J/Vduuc6K4oG5QaPbPv+hZlHI7uJ73AU87b85d0RVSg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=LZJRsvRLlZmF9Qg08kFcKS5+Y6SUP0wySvmVlvIUn17K6tD9+DlXYeNyQc3Br9KiL uv4snLhzUkBaJlAfsjOxJO8xjsbWaT6IPumYwbDUbdZYGC3XEc+gMcTObVMsoot5fM ps6YIRbEMwmf/eL2yBkpDKEYfP5iMqFgav2ZaJT4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728901AbgEANYy (ORCPT ); Fri, 1 May 2020 09:24:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:45312 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728586AbgEANYx (ORCPT ); Fri, 1 May 2020 09:24:53 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2B1EE20757; Fri, 1 May 2020 13:24:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339492; bh=J/Vduuc6K4oG5QaPbPv+hZlHI7uJ73AU87b85d0RVSg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xt2qqRiFdUWTxSp+HxfVHYJCQ865e082JPnciqoR3SoSRRUiEOS7V+/JfXzDi2Is+ QqzIA9xuyrAMCuzYD9qjzvYcWKrhEy9nYrmu+7X8lBGjPfpXwFmbqDNI8WAa852D0e 6xZLDF2lD+Bldvr8qTaiAIGwBUiZZFEa6KP9K3m8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lee Duncan , Wu Bo , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.4 11/70] scsi: iscsi: Report unbind session event when the target has been removed Date: Fri, 1 May 2020 15:20:59 +0200 Message-Id: <20200501131516.273977049@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Wu Bo [ Upstream commit 13e60d3ba287d96eeaf1deaadba51f71578119a3 ] If the daemon is restarted or crashes while logging out of a session, the unbind session event sent by the kernel is not processed and is lost. When the daemon starts again, the session can't be unbound because the daemon is waiting for the event message. However, the kernel has already logged out and the event will not be resent. When iscsid restart is complete, logout session reports error: Logging out of session [sid: 6, target: iqn.xxxxx, portal: xx.xx.xx.xx,3260] iscsiadm: Could not logout of [sid: 6, target: iscsiadm -m node iqn.xxxxx, portal: xx.xx.xx.xx,3260]. iscsiadm: initiator reported error (9 - internal error) iscsiadm: Could not logout of all requested sessions Make sure the unbind event is emitted. [mkp: commit desc and applied by hand since patch was mangled] Link: https://lore.kernel.org/r/4eab1771-2cb3-8e79-b31c-923652340e99@huawei.com Reviewed-by: Lee Duncan Signed-off-by: Wu Bo Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/scsi_transport_iscsi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c index 20cf01d6ded7e..de10b461ec7ef 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2014,7 +2014,7 @@ static void __iscsi_unbind_session(struct work_struct *work) if (session->target_id == ISCSI_MAX_TARGET) { spin_unlock_irqrestore(&session->lock, flags); mutex_unlock(&ihost->mutex); - return; + goto unbind_session_exit; } target_id = session->target_id; @@ -2026,6 +2026,8 @@ static void __iscsi_unbind_session(struct work_struct *work) ida_simple_remove(&iscsi_sess_ida, target_id); scsi_remove_target(&session->dev); + +unbind_session_exit: iscsi_session_event(session, ISCSI_KEVENT_UNBIND_SESSION); ISCSI_DBG_TRANS_SESSION(session, "Completed target removal\n"); } From patchwork Fri May 1 13:21:01 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226463 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 213EBC47254 for ; Fri, 1 May 2020 14:01:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E827520757 for ; Fri, 1 May 2020 14:01:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341709; bh=kn3vplV2Ajsfs0kgxnWd05XDF0uaf40IGq6aiy9WXAM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=F7Y19LVLDA/hvwYEbgahec3PQ8gHCucPETUqOJBeEe3h3nNiVE21YzY3QAZlQBgK3 4P8DYU7yONAKls2ZoP1GfXbcEOgecm5WP/sNx42zAqGz9xKQRsvykfkpYz/+/jdQU8 P0X95W8IWG8XJ5MMnQ/UeS9lFt3Q41Ap0RfIF7RE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728996AbgEANZV (ORCPT ); Fri, 1 May 2020 09:25:21 -0400 Received: from mail.kernel.org ([198.145.29.99]:46104 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728854AbgEANZS (ORCPT ); Fri, 1 May 2020 09:25:18 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8CF31216FD; Fri, 1 May 2020 13:25:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339517; bh=kn3vplV2Ajsfs0kgxnWd05XDF0uaf40IGq6aiy9WXAM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CAGLkMFE54n9wtf7FY5Ms5GyLYvlPiVfRWwkav4RzWAUHeO/4PX5fPGbi9myHMh+u IMiVYUm2fJbCTfK1j5aTdJb1GhtkxNXww/djWeGEtRB0NartbbGd4nCIrLqkQZnfPe JRDmOWYC+SgEmFwdIbppvJ5vAFe7bo37nxdgD/tA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vasily Averin , Andrew Morton , Peter Oberparleiter , Al Viro , Davidlohr Bueso , Ingo Molnar , Manfred Spraul , NeilBrown , Steven Rostedt , Waiman Long , Linus Torvalds , Sasha Levin Subject: [PATCH 4.4 13/70] kernel/gcov/fs.c: gcov_seq_next() should increase position index Date: Fri, 1 May 2020 15:21:01 +0200 Message-Id: <20200501131517.518119097@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Vasily Averin [ Upstream commit f4d74ef6220c1eda0875da30457bef5c7111ab06 ] If seq_file .next function does not change position index, read after some lseek can generate unexpected output. https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: Andrew Morton Acked-by: Peter Oberparleiter Cc: Al Viro Cc: Davidlohr Bueso Cc: Ingo Molnar Cc: Manfred Spraul Cc: NeilBrown Cc: Steven Rostedt Cc: Waiman Long Link: http://lkml.kernel.org/r/f65c6ee7-bd00-f910-2f8a-37cc67e4ff88@virtuozzo.com Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- kernel/gcov/fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/gcov/fs.c b/kernel/gcov/fs.c index edf67c493a8e1..e473f6a1f6ca7 100644 --- a/kernel/gcov/fs.c +++ b/kernel/gcov/fs.c @@ -108,9 +108,9 @@ static void *gcov_seq_next(struct seq_file *seq, void *data, loff_t *pos) { struct gcov_iterator *iter = data; + (*pos)++; if (gcov_iter_next(iter)) return NULL; - (*pos)++; return iter; } From patchwork Fri May 1 13:21:02 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226465 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67D46C4724C for ; Fri, 1 May 2020 14:01:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 37BEC206D9 for ; Fri, 1 May 2020 14:01:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341698; bh=0XSd+zX45sJ8FoxhyxF46ZGpGhtossW6oMCG/N5mrks=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rS520so+xmWsakWIJzD88mFcvj/IUXdcs3G6ziMbuUqyB14FaVWErniOCK0XvgHaC x1q4v7oTTzW1xDbU9f3u7xzrvDwYaSMaWbcqWSv/b1JUg+teoYP9EodhVTGXYPVlSW +xaKp+uVWRxCk41+hbYbRpnWd3D863xFm/Bh5rFY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728851AbgEANZb (ORCPT ); Fri, 1 May 2020 09:25:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:46462 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729031AbgEANZ3 (ORCPT ); Fri, 1 May 2020 09:25:29 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D85B12173E; Fri, 1 May 2020 13:25:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339529; bh=0XSd+zX45sJ8FoxhyxF46ZGpGhtossW6oMCG/N5mrks=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hdeIn4CcFWc3+h5jwg2FsJriomh2TTfD2ZAKCWxJWZYmQzFoZPhVRkmC/AzjpZce/ +5U11rpsvekz2cN2Rw23TfzUGpFWGBQORrNq+1fWo9XWAN9fBdq4/AFD2QynElHXuj Png04GoEXHRLdHDPDP380qdVE+Cg/mdCsnhHsYwg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vasily Averin , Andrew Morton , Waiman Long , Davidlohr Bueso , Manfred Spraul , Al Viro , Ingo Molnar , NeilBrown , Peter Oberparleiter , Steven Rostedt , Linus Torvalds , Sasha Levin Subject: [PATCH 4.4 14/70] ipc/util.c: sysvipc_find_ipc() should increase position index Date: Fri, 1 May 2020 15:21:02 +0200 Message-Id: <20200501131517.910739446@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Vasily Averin [ Upstream commit 89163f93c6f969da5811af5377cc10173583123b ] If seq_file .next function does not change position index, read after some lseek can generate unexpected output. https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin Signed-off-by: Andrew Morton Acked-by: Waiman Long Cc: Davidlohr Bueso Cc: Manfred Spraul Cc: Al Viro Cc: Ingo Molnar Cc: NeilBrown Cc: Peter Oberparleiter Cc: Steven Rostedt Link: http://lkml.kernel.org/r/b7a20945-e315-8bb0-21e6-3875c14a8494@virtuozzo.com Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- ipc/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipc/util.c b/ipc/util.c index 0f401d94b7c65..2724f9071ab39 100644 --- a/ipc/util.c +++ b/ipc/util.c @@ -756,13 +756,13 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos, total++; } + *new_pos = pos + 1; if (total >= ids->in_use) return NULL; for (; pos < IPCMNI; pos++) { ipc = idr_find(&ids->ipcs_idr, pos); if (ipc != NULL) { - *new_pos = pos + 1; rcu_read_lock(); ipc_lock_object(ipc); return ipc; From patchwork Fri May 1 13:21:05 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226466 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78392C4724C for ; Fri, 1 May 2020 14:01:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5907B20757 for ; Fri, 1 May 2020 14:01:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341690; bh=/hbFuv6W4bAgGS1r/lRqpWFE7EgMEMRTh9NpIFTXlr4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=bEypS1ljeVyYATviaPdDGJ5FLQPBsFXyB9AKcrW5Z9mf8tkAK8Uyjc2j28wtwb3/G 4seqiHpEcDGurwyETUIaxityUskQvO0a6E5nqYKQfH3sAh5sgdAXn3SJ+EGsX3Oc+3 CgL6j/KL98+NZWj3ofqeihC20QLd5/BAhZpZG34Q= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729065AbgEANZh (ORCPT ); Fri, 1 May 2020 09:25:37 -0400 Received: from mail.kernel.org ([198.145.29.99]:46670 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729059AbgEANZh (ORCPT ); Fri, 1 May 2020 09:25:37 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 489F9208D6; Fri, 1 May 2020 13:25:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339536; bh=/hbFuv6W4bAgGS1r/lRqpWFE7EgMEMRTh9NpIFTXlr4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mTqeeo3zZTd5FmIdMsPJC1vbqGEKFS2ex+SGj6eI45KUFbXYWrxXBslLBIyTn/Gu+ esrzH1KxMw3WVytaNQzMMwIyaAbh2h/CxZXYeEFFI1xAGeHnjZPrSe1RSuFRswdKzZ HxtQRbkyoiLw2mAKx+8NhxQmti7/quQNAlnS9p7Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Florian Fainelli , =?utf-8?q?Uwe_Kleine-K=C3=B6nig?= , Nicolas Saenz Julienne , Thierry Reding , Sasha Levin Subject: [PATCH 4.4 17/70] pwm: bcm2835: Dynamically allocate base Date: Fri, 1 May 2020 15:21:05 +0200 Message-Id: <20200501131519.063372497@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Florian Fainelli [ Upstream commit 2c25b07e5ec119cab609e41407a1fb3fa61442f5 ] The newer 2711 and 7211 chips have two PWM controllers and failure to dynamically allocate the PWM base would prevent the second PWM controller instance being probed for succeeding with an -EEXIST error from alloc_pwms(). Fixes: e5a06dc5ac1f ("pwm: Add BCM2835 PWM driver") Signed-off-by: Florian Fainelli Acked-by: Uwe Kleine-König Reviewed-by: Nicolas Saenz Julienne Signed-off-by: Thierry Reding Signed-off-by: Sasha Levin --- drivers/pwm/pwm-bcm2835.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/pwm/pwm-bcm2835.c b/drivers/pwm/pwm-bcm2835.c index b4c7f956b6fa6..388a9fa5c1d24 100644 --- a/drivers/pwm/pwm-bcm2835.c +++ b/drivers/pwm/pwm-bcm2835.c @@ -160,6 +160,7 @@ static int bcm2835_pwm_probe(struct platform_device *pdev) pc->chip.dev = &pdev->dev; pc->chip.ops = &bcm2835_pwm_ops; + pc->chip.base = -1; pc->chip.npwm = 2; platform_set_drvdata(pdev, pc); From patchwork Fri May 1 13:21:07 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226703 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3F9BC4724C for ; Fri, 1 May 2020 13:25:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ADDBA2166E for ; Fri, 1 May 2020 13:25:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339544; bh=1261mRWm35wCWIvo4LlMuXY4uqC6P1O6XbPJo8laiZw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Mo1X20BsyIeLYIMiIC7BdqHk2bD9tkEtjx+NEcslH/P6UiYAy/1GfPsjWnbE3blL2 3PORa3ODdWKktxm7eV8sV70b8FDmahwpoINlesKh1aBbKEr91kUV1pRwM2yalTJB82 f+RR7p9FjDmr+QUPF+vZ70xrQOZLZxeSIDiMua20= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729090AbgEANZn (ORCPT ); Fri, 1 May 2020 09:25:43 -0400 Received: from mail.kernel.org ([198.145.29.99]:46814 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729085AbgEANZm (ORCPT ); Fri, 1 May 2020 09:25:42 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3FCBE20757; Fri, 1 May 2020 13:25:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339541; bh=1261mRWm35wCWIvo4LlMuXY4uqC6P1O6XbPJo8laiZw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LbHhv01X3majs7bq51O3lrVeDAHDa4+fnY6XtQS37StU54+3ndRDJmcfJ1HWClXb0 nRBORe+CZI+Cyu1jMTPviwjcNBuwuh3pUm7oS2UKXolN1TBkmB8wttc0wo3YVErub/ pjU39eymNhCuCJFXxxwLpQK412WrDoj0JOMrbN74= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+5035b1f9dc7ea4558d5a@syzkaller.appspotmail.com, Taehee Yoo , "David S. Miller" Subject: [PATCH 4.4 19/70] macvlan: fix null dereference in macvlan_device_event() Date: Fri, 1 May 2020 15:21:07 +0200 Message-Id: <20200501131519.981945141@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Taehee Yoo [ Upstream commit 4dee15b4fd0d61ec6bbd179238191e959d34cf7a ] In the macvlan_device_event(), the list_first_entry_or_null() is used. This function could return null pointer if there is no node. But, the macvlan module doesn't check the null pointer. So, null-ptr-deref would occur. bond0 | +----+-----+ | | macvlan0 macvlan1 | | dummy0 dummy1 The problem scenario. If dummy1 is removed, 1. ->dellink() of dummy1 is called. 2. NETDEV_UNREGISTER of dummy1 notification is sent to macvlan module. 3. ->dellink() of macvlan1 is called. 4. NETDEV_UNREGISTER of macvlan1 notification is sent to bond module. 5. __bond_release_one() is called and it internally calls dev_set_mac_address(). 6. dev_set_mac_address() calls the ->ndo_set_mac_address() of macvlan1, which is macvlan_set_mac_address(). 7. macvlan_set_mac_address() calls the dev_set_mac_address() with dummy1. 8. NETDEV_CHANGEADDR of dummy1 is sent to macvlan module. 9. In the macvlan_device_event(), it calls list_first_entry_or_null(). At this point, dummy1 and macvlan1 were removed. So, list_first_entry_or_null() will return NULL. Test commands: ip netns add nst ip netns exec nst ip link add bond0 type bond for i in {0..10} do ip netns exec nst ip link add dummy$i type dummy ip netns exec nst ip link add macvlan$i link dummy$i \ type macvlan mode passthru ip netns exec nst ip link set macvlan$i master bond0 done ip netns del nst Splat looks like: [ 40.585687][ T146] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP DEI [ 40.587249][ T146] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 40.588342][ T146] CPU: 1 PID: 146 Comm: kworker/u8:2 Not tainted 5.7.0-rc1+ #532 [ 40.589299][ T146] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 [ 40.590469][ T146] Workqueue: netns cleanup_net [ 40.591045][ T146] RIP: 0010:macvlan_device_event+0x4e2/0x900 [macvlan] [ 40.591905][ T146] Code: 00 00 00 00 00 fc ff df 80 3c 06 00 0f 85 45 02 00 00 48 89 da 48 b8 00 00 00 00 00 fc ff d2 [ 40.594126][ T146] RSP: 0018:ffff88806116f4a0 EFLAGS: 00010246 [ 40.594783][ T146] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 40.595653][ T146] RDX: 0000000000000000 RSI: ffff88806547ddd8 RDI: ffff8880540f1360 [ 40.596495][ T146] RBP: ffff88804011a808 R08: fffffbfff4fb8421 R09: fffffbfff4fb8421 [ 40.597377][ T146] R10: ffffffffa7dc2107 R11: 0000000000000000 R12: 0000000000000008 [ 40.598186][ T146] R13: ffff88804011a000 R14: ffff8880540f1000 R15: 1ffff1100c22de9a [ 40.599012][ T146] FS: 0000000000000000(0000) GS:ffff888067800000(0000) knlGS:0000000000000000 [ 40.600004][ T146] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 40.600665][ T146] CR2: 00005572d3a807b8 CR3: 000000005fcf4003 CR4: 00000000000606e0 [ 40.601485][ T146] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 40.602461][ T146] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 40.603443][ T146] Call Trace: [ 40.603871][ T146] ? nf_tables_dump_setelem+0xa0/0xa0 [nf_tables] [ 40.604587][ T146] ? macvlan_uninit+0x100/0x100 [macvlan] [ 40.605212][ T146] ? __module_text_address+0x13/0x140 [ 40.605842][ T146] notifier_call_chain+0x90/0x160 [ 40.606477][ T146] dev_set_mac_address+0x28e/0x3f0 [ 40.607117][ T146] ? netdev_notify_peers+0xc0/0xc0 [ 40.607762][ T146] ? __module_text_address+0x13/0x140 [ 40.608440][ T146] ? notifier_call_chain+0x90/0x160 [ 40.609097][ T146] ? dev_set_mac_address+0x1f0/0x3f0 [ 40.609758][ T146] dev_set_mac_address+0x1f0/0x3f0 [ 40.610402][ T146] ? __local_bh_enable_ip+0xe9/0x1b0 [ 40.611071][ T146] ? bond_hw_addr_flush+0x77/0x100 [bonding] [ 40.611823][ T146] ? netdev_notify_peers+0xc0/0xc0 [ 40.612461][ T146] ? bond_hw_addr_flush+0x77/0x100 [bonding] [ 40.613213][ T146] ? bond_hw_addr_flush+0x77/0x100 [bonding] [ 40.613963][ T146] ? __local_bh_enable_ip+0xe9/0x1b0 [ 40.614631][ T146] ? bond_time_in_interval.isra.31+0x90/0x90 [bonding] [ 40.615484][ T146] ? __bond_release_one+0x9f0/0x12c0 [bonding] [ 40.616230][ T146] __bond_release_one+0x9f0/0x12c0 [bonding] [ 40.616949][ T146] ? bond_enslave+0x47c0/0x47c0 [bonding] [ 40.617642][ T146] ? lock_downgrade+0x730/0x730 [ 40.618218][ T146] ? check_flags.part.42+0x450/0x450 [ 40.618850][ T146] ? __mutex_unlock_slowpath+0xd0/0x670 [ 40.619519][ T146] ? trace_hardirqs_on+0x30/0x180 [ 40.620117][ T146] ? wait_for_completion+0x250/0x250 [ 40.620754][ T146] bond_netdev_event+0x822/0x970 [bonding] [ 40.621460][ T146] ? __module_text_address+0x13/0x140 [ 40.622097][ T146] notifier_call_chain+0x90/0x160 [ 40.622806][ T146] rollback_registered_many+0x660/0xcf0 [ 40.623522][ T146] ? netif_set_real_num_tx_queues+0x780/0x780 [ 40.624290][ T146] ? notifier_call_chain+0x90/0x160 [ 40.624957][ T146] ? netdev_upper_dev_unlink+0x114/0x180 [ 40.625686][ T146] ? __netdev_adjacent_dev_unlink_neighbour+0x30/0x30 [ 40.626421][ T146] ? mutex_is_locked+0x13/0x50 [ 40.627016][ T146] ? unregister_netdevice_queue+0xf2/0x240 [ 40.627663][ T146] unregister_netdevice_many.part.134+0x13/0x1b0 [ 40.628362][ T146] default_device_exit_batch+0x2d9/0x390 [ 40.628987][ T146] ? unregister_netdevice_many+0x40/0x40 [ 40.629615][ T146] ? dev_change_net_namespace+0xcb0/0xcb0 [ 40.630279][ T146] ? prepare_to_wait_exclusive+0x2e0/0x2e0 [ 40.630943][ T146] ? ops_exit_list.isra.9+0x97/0x140 [ 40.631554][ T146] cleanup_net+0x441/0x890 [ ... ] Fixes: e289fd28176b ("macvlan: fix the problem when mac address changes for passthru mode") Reported-by: syzbot+5035b1f9dc7ea4558d5a@syzkaller.appspotmail.com Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/macvlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -1561,7 +1561,7 @@ static int macvlan_device_event(struct n struct macvlan_dev, list); - if (macvlan_sync_address(vlan->dev, dev->dev_addr)) + if (vlan && macvlan_sync_address(vlan->dev, dev->dev_addr)) return NOTIFY_BAD; break; From patchwork Fri May 1 13:21:09 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226702 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B266C47254 for ; Fri, 1 May 2020 13:25:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DA7C4216FD for ; Fri, 1 May 2020 13:25:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339550; bh=1bJXgS9EGSsKXLluKrL63N6r/YnFN67KmUdN1uqhg/E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=2d4Hf5q1KQMKGPAE0X+xaw9yFCtZfG3gmDA5zE1SE8SZuSM1ptfK9BjSfOGaT/Cky 85/G04PQjVCeXvByU/cXs2R8/ZPOVy4T8KOmbm0Z6Ug8JewUfKiYrkNqkW0qNWISlh CYFOowl9Yi+YAjcurw0RokD43LETeEvJA0W+VpSI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729112AbgEANZu (ORCPT ); Fri, 1 May 2020 09:25:50 -0400 Received: from mail.kernel.org ([198.145.29.99]:46942 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729103AbgEANZq (ORCPT ); Fri, 1 May 2020 09:25:46 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3102D208D6; Fri, 1 May 2020 13:25:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339546; bh=1bJXgS9EGSsKXLluKrL63N6r/YnFN67KmUdN1uqhg/E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qy5r1JfOsJMqU3m1VPMcqENC3r9++OFfGUnbbTBKwb5a6q8eETPENq4i0D4Lj9NlS aJVDEsasO+SnWvkU5A6jPyN/ME69Q3bgdf01xovEtIU1MrEFi4yXvG+QgrgDS7txcE BtG+RfQV6RceJhf0rtNfIi/9bJSXwFyk6uv/6O5M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiyu Yang , Xin Tan , "David S. Miller" Subject: [PATCH 4.4 21/70] net/x25: Fix x25_neigh refcnt leak when receiving frame Date: Fri, 1 May 2020 15:21:09 +0200 Message-Id: <20200501131520.809525053@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Xiyu Yang [ Upstream commit f35d12971b4d814cdb2f659d76b42f0c545270b6 ] x25_lapb_receive_frame() invokes x25_get_neigh(), which returns a reference of the specified x25_neigh object to "nb" with increased refcnt. When x25_lapb_receive_frame() returns, local variable "nb" becomes invalid, so the refcount should be decreased to keep refcount balanced. The reference counting issue happens in one path of x25_lapb_receive_frame(). When pskb_may_pull() returns false, the function forgets to decrease the refcnt increased by x25_get_neigh(), causing a refcnt leak. Fix this issue by calling x25_neigh_put() when pskb_may_pull() returns false. Fixes: cb101ed2c3c7 ("x25: Handle undersized/fragmented skbs") Signed-off-by: Xiyu Yang Signed-off-by: Xin Tan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/x25/x25_dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/net/x25/x25_dev.c +++ b/net/x25/x25_dev.c @@ -120,8 +120,10 @@ int x25_lapb_receive_frame(struct sk_buf goto drop; } - if (!pskb_may_pull(skb, 1)) + if (!pskb_may_pull(skb, 1)) { + x25_neigh_put(nb); return 0; + } switch (skb->data[0]) { From patchwork Fri May 1 13:21:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226464 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CEA1C4724C for ; Fri, 1 May 2020 14:01:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0A7BF206D9 for ; Fri, 1 May 2020 14:01:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341704; bh=Qs78r1hJQ7eIwNzO01q2Oa9PHG7c6wH58tUjB1MxkYA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=uJBBXYuHWeMCfNdYWiUYP2EfmYSzC7Im0AWCKcmPUDV3Ip6GKh9Q54kZgxEvPV+Wp uvYykv7thm/Cq1eDEGVdHJJM52F4t45zM2S0JhQ5R+p3mSgNrp3QVzxVcl/bwiEetv zeOjUojeFQRp92aGyf8tGcQHvkHcjyR/2oR2ziyA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729881AbgEAOBm (ORCPT ); Fri, 1 May 2020 10:01:42 -0400 Received: from mail.kernel.org ([198.145.29.99]:46316 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728854AbgEANZY (ORCPT ); Fri, 1 May 2020 09:25:24 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1607E2166E; Fri, 1 May 2020 13:25:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339524; bh=Qs78r1hJQ7eIwNzO01q2Oa9PHG7c6wH58tUjB1MxkYA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mj4OlbWmWcK+FcSqEKPsDvYEq2j4o1ORl+XrFdDO0dmO5BJNThducBtkEvIJzF6kC b2w0kkW1de/lGwo1uH7DxE05lMaK+Ctc8umspVqttEMoFYs07nr3RtjsRAQKp4nVcl KIH+PlD1kfnQkBk5GZkMeWwrLqpr/Hza73MwIMtA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , "David S. Miller" Subject: [PATCH 4.4 24/70] xfrm: Always set XFRM_TRANSFORMED in xfrm{4, 6}_output_finish Date: Fri, 1 May 2020 15:21:12 +0200 Message-Id: <20200501131521.946706660@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: David Ahern [ Upstream commit 0c922a4850eba2e668f73a3f1153196e09abb251 ] IPSKB_XFRM_TRANSFORMED and IP6SKB_XFRM_TRANSFORMED are skb flags set by xfrm code to tell other skb handlers that the packet has been passed through the xfrm output functions. Simplify the code and just always set them rather than conditionally based on netfilter enabled thus making the flag available for other users. Signed-off-by: David Ahern Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/xfrm4_output.c | 2 -- net/ipv6/xfrm6_output.c | 2 -- 2 files changed, 4 deletions(-) --- a/net/ipv4/xfrm4_output.c +++ b/net/ipv4/xfrm4_output.c @@ -75,9 +75,7 @@ int xfrm4_output_finish(struct sock *sk, { memset(IPCB(skb), 0, sizeof(*IPCB(skb))); -#ifdef CONFIG_NETFILTER IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED; -#endif return xfrm_output(sk, skb); } --- a/net/ipv6/xfrm6_output.c +++ b/net/ipv6/xfrm6_output.c @@ -125,9 +125,7 @@ int xfrm6_output_finish(struct sock *sk, { memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); -#ifdef CONFIG_NETFILTER IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED; -#endif return xfrm_output(sk, skb); } From patchwork Fri May 1 13:21:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226704 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3CBBC47254 for ; Fri, 1 May 2020 13:25:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D3D8D2495A for ; Fri, 1 May 2020 13:25:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339533; bh=ZaolymePEi9YN4pYSwp3fniWhkkwp1vSbCFUxaZWuFY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=NQbrC61Rq9v1TKW8TxNUEbB+pvLB2jiP5zY9+yabiPx0wYldkeDtKDE2MH0n5o5lX aZ2BaFCfb7uj5MGfhK9L7+a8s6XQ8JVojJ1KDfk+aS7gXXFgz83huz+8GvTmAANU9G 8EF0/H/fRhsAR6RToaD0mQFMQHqrXG3jRYGEM0q0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729034AbgEANZc (ORCPT ); Fri, 1 May 2020 09:25:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:46390 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729023AbgEANZ1 (ORCPT ); Fri, 1 May 2020 09:25:27 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9395D208D6; Fri, 1 May 2020 13:25:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339527; bh=ZaolymePEi9YN4pYSwp3fniWhkkwp1vSbCFUxaZWuFY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uWrAjzL5ohNKu8Sfpiz2OwGNeIv+3HmjYowQHFsB+hifDI/SFgDdmMLb1xfWTK53u yFHEMkIwvJW0DLBIKGDOU6pJ2D6RxmfYJuYaL+/rU+V6Min2JDlNoIxKHq7MCK61tT TLvvGwVd4szB0S0+lAeLVFuL2FUv1umGw7740NU4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johnathan Smithinovic , Takashi Iwai , Sasha Levin Subject: [PATCH 4.4 25/70] ALSA: hda: Remove ASUS ROG Zenith from the blacklist Date: Fri, 1 May 2020 15:21:13 +0200 Message-Id: <20200501131522.222176485@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Takashi Iwai [ Upstream commit a8cf44f085ac12c0b5b8750ebb3b436c7f455419 ] The commit 3c6fd1f07ed0 ("ALSA: hda: Add driver blacklist") added a new blacklist for the devices that are known to have empty codecs, and one of the entries was ASUS ROG Zenith II (PCI SSID 1043:874f). However, it turned out that the very same PCI SSID is used for the previous model that does have the valid HD-audio codecs and the change broke the sound on it. This patch reverts the corresponding entry as a temporary solution. Although Zenith II and co will see get the empty HD-audio bus again, it'd be merely resource wastes and won't affect the functionality, so it's no end of the world. We'll need to address this later, e.g. by either switching to DMI string matching or using PCI ID & SSID pairs. Fixes: 3c6fd1f07ed0 ("ALSA: hda: Add driver blacklist") Reported-by: Johnathan Smithinovic Cc: Link: https://lore.kernel.org/r/20200419071926.22683-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin --- sound/pci/hda/hda_intel.c | 1 - 1 file changed, 1 deletion(-) diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c index faf2554397021..da9f6749b3be2 100644 --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -1978,7 +1978,6 @@ static const struct hdac_io_ops pci_hda_io_ops = { * should be ignored from the beginning. */ static const struct snd_pci_quirk driver_blacklist[] = { - SND_PCI_QUIRK(0x1043, 0x874f, "ASUS ROG Zenith II / Strix", 0), SND_PCI_QUIRK(0x1462, 0xcb59, "MSI TRX40 Creator", 0), SND_PCI_QUIRK(0x1462, 0xcb60, "MSI TRX40", 0), {} From patchwork Fri May 1 13:21:14 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226470 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A61DC47253 for ; Fri, 1 May 2020 14:01:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id F2CE42051A for ; Fri, 1 May 2020 14:01:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341669; bh=zUCiPF1saQAniHcWkEVbc4jYJQ/5z6kvlySYJdaGaC8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=tchtUI7RVyBUsOQHPFoS/BbSv+WmqIWbDEZRIwu5+brGaYiYsIj4ocFEsiElip9kJ ytVSuLSWw6A6qPBnmvx7VTJNDXd43XC7FWualFsajpU8NH/HoLvZhVHQbPerUzyyxs MUIC7s5yEQOk3g5xtX4NrMBI7HzBAwTTSnrGs2OQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729242AbgEAN0Z (ORCPT ); Fri, 1 May 2020 09:26:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:47944 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728900AbgEAN0V (ORCPT ); Fri, 1 May 2020 09:26:21 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id BE874208D6; Fri, 1 May 2020 13:26:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339581; bh=zUCiPF1saQAniHcWkEVbc4jYJQ/5z6kvlySYJdaGaC8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m8F5roJCz8T8Abq17s4UURHwtLA8ETinVF6aCa/xPWt8S/PllmN2wT4ewP1KD1Qwl NccgijZTTZfi6iZUlK6eKW6KBOQO4vmynusEqNO79SYSm328FQQq2xhyeJma84WHpi iaznoWcqKI6OyzEHepXOACaNmgumDJa8/EUe5Arc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars-Peter Clausen , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.4 26/70] iio: xilinx-xadc: Fix ADC-B powerdown Date: Fri, 1 May 2020 15:21:14 +0200 Message-Id: <20200501131522.464085211@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lars-Peter Clausen commit e44ec7794d88f918805d700240211a9ec05ed89d upstream. The check for shutting down the second ADC is inverted. This causes it to be powered down when it should be enabled. As a result channels that are supposed to be handled by the second ADC return invalid conversion results. Signed-off-by: Lars-Peter Clausen Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --- drivers/iio/adc/xilinx-xadc-core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -709,13 +709,14 @@ static int xadc_power_adc_b(struct xadc { uint16_t val; + /* Powerdown the ADC-B when it is not needed. */ switch (seq_mode) { case XADC_CONF1_SEQ_SIMULTANEOUS: case XADC_CONF1_SEQ_INDEPENDENT: - val = XADC_CONF2_PD_ADC_B; + val = 0; break; default: - val = 0; + val = XADC_CONF2_PD_ADC_B; break; } From patchwork Fri May 1 13:21:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226468 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F25ACC47258 for ; Fri, 1 May 2020 14:01:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D3607206D6 for ; Fri, 1 May 2020 14:01:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341677; bh=U+U2iYpx0DbAp2Qok+ROLY7JqeDXOVnqZQgUxYD8ArQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=tdhldhqyM57Ed+ajIbfLUPaImk5AoA9Ct2O8IA6qlEgOJKVqDB4+zo6yP1KMOc9w/ J3WLyi159Q/w06BLhlwFB9UCRExQnKmXuI8B0AdzyrRCYnDUX1hpoUm65PhpyGm1Ze Q6xNA/SmuJ/Qp3qNZWSD+uj9N2s1LXAj31LMv6ms= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729221AbgEAOBR (ORCPT ); Fri, 1 May 2020 10:01:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:47372 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729149AbgEAN0C (ORCPT ); Fri, 1 May 2020 09:26:02 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D8362208D6; Fri, 1 May 2020 13:26:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339561; bh=U+U2iYpx0DbAp2Qok+ROLY7JqeDXOVnqZQgUxYD8ArQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1IkHQ4plDP+GTX49uu/HvY0JgA0z4l9BZ5+rPYv1GgAKIhoMqEzBUyqzCkXK4iPtc wqRjyxWqSNRVpZE8l8E9wW6IQxgUW8MQX3dM5WgmRTNinYmO7llh6wlsopegsmY4x+ Qno4j55guaHRT0iOYgRSj9KqR8V9qmu6HCwYNedY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars-Peter Clausen , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.4 28/70] iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode Date: Fri, 1 May 2020 15:21:16 +0200 Message-Id: <20200501131523.072180588@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lars-Peter Clausen commit 8bef455c8b1694547ee59e8b1939205ed9d901a6 upstream. The XADC has two internal ADCs. Depending on the mode it is operating in either one or both of them are used. The device manual calls this continuous (one ADC) and simultaneous (both ADCs) mode. The meaning of the sequencing register for the aux channels changes depending on the mode. In continuous mode each bit corresponds to one of the 16 aux channels. And the single ADC will convert them one by one in order. In simultaneous mode the aux channels are split into two groups the first 8 channels are assigned to the first ADC and the other 8 channels to the second ADC. The upper 8 bits of the sequencing register are unused and the lower 8 bits control both ADCs. This means a bit needs to be set if either the corresponding channel from the first group or the second group (or both) are set. Currently the driver does not have the special handling required for simultaneous mode. Add it. Signed-off-by: Lars-Peter Clausen Fixes: bdc8cda1d010 ("iio:adc: Add Xilinx XADC driver") Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --- drivers/iio/adc/xilinx-xadc-core.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -785,6 +785,16 @@ static int xadc_preenable(struct iio_dev if (ret) goto err; + /* + * In simultaneous mode the upper and lower aux channels are samples at + * the same time. In this mode the upper 8 bits in the sequencer + * register are don't care and the lower 8 bits control two channels + * each. As such we must set the bit if either the channel in the lower + * group or the upper group is enabled. + */ + if (seq_mode == XADC_CONF1_SEQ_SIMULTANEOUS) + scan_mask = ((scan_mask >> 8) | scan_mask) & 0xff0000; + ret = xadc_write_adc_reg(xadc, XADC_REG_SEQ(1), scan_mask >> 16); if (ret) goto err; From patchwork Fri May 1 13:21:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226700 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, UNWANTED_LANGUAGE_BODY, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F322C47253 for ; Fri, 1 May 2020 13:26:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5E56D24953 for ; Fri, 1 May 2020 13:26:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339568; bh=CX7U7DU7t3Ya7Z9Q+P+Uq8o3g8D0HfAOR0whle/rmlA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=jrLnMhtaKXxH/IBnGuhk1ZFzKX3StwVjS+D5vc5uyjZwSU9zT9sKt5OaJHGABAW4I FZ4NfvKrGjmORhjTnQHk6lLXdJa9FV7hfkz6SJZWGv+do3/IQy5gEqojQSTDaUcLhr /7NZ89DBgq6mmApi+abOA6HQtJb76ifiAkzOZbD8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729174AbgEAN0H (ORCPT ); Fri, 1 May 2020 09:26:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:47494 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729134AbgEAN0H (ORCPT ); Fri, 1 May 2020 09:26:07 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C09E020757; Fri, 1 May 2020 13:26:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339566; bh=CX7U7DU7t3Ya7Z9Q+P+Uq8o3g8D0HfAOR0whle/rmlA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TtoAglTFcbbPmz0ZQ6K7S9uoEqaLGjgt07GpGD5ZZKEmZQp2BGInX84JlDl2IgATd eFl0vXLvWyp18r3qF1Q5nTdUbR6PywhctJ9qfeyIVyMAvHbLG3loRAW2KbPFyFr4Yf t3S5SbHTBVTXflMIDoyM6QxLL5D/+F3GQfN5GgW8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Changming Liu Subject: [PATCH 4.4 30/70] USB: sisusbvga: Change port variable from signed to unsigned Date: Fri, 1 May 2020 15:21:18 +0200 Message-Id: <20200501131523.639274148@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Changming Liu commit 2df7405f79ce1674d73c2786fe1a8727c905d65b upstream. Change a bunch of arguments of wrapper functions which pass signed integer to an unsigned integer which might cause undefined behaviors when sign integer overflow. Signed-off-by: Changming Liu Cc: stable Link: https://lore.kernel.org/r/BL0PR06MB45482D71EA822D75A0E60A2EE5D50@BL0PR06MB4548.namprd06.prod.outlook.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/misc/sisusbvga/sisusb.c | 20 ++++++++++---------- drivers/usb/misc/sisusbvga/sisusb_init.h | 14 +++++++------- 2 files changed, 17 insertions(+), 17 deletions(-) --- a/drivers/usb/misc/sisusbvga/sisusb.c +++ b/drivers/usb/misc/sisusbvga/sisusb.c @@ -1243,20 +1243,20 @@ static int sisusb_read_mem_bulk(struct s #ifdef INCL_SISUSB_CON int -sisusb_setreg(struct sisusb_usb_data *sisusb, int port, u8 data) +sisusb_setreg(struct sisusb_usb_data *sisusb, u32 port, u8 data) { return sisusb_write_memio_byte(sisusb, SISUSB_TYPE_IO, port, data); } int -sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 *data) +sisusb_getreg(struct sisusb_usb_data *sisusb, u32 port, u8 *data) { return sisusb_read_memio_byte(sisusb, SISUSB_TYPE_IO, port, data); } #endif int -sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 data) +sisusb_setidxreg(struct sisusb_usb_data *sisusb, u32 port, u8 index, u8 data) { int ret; ret = sisusb_write_memio_byte(sisusb, SISUSB_TYPE_IO, port, index); @@ -1265,7 +1265,7 @@ sisusb_setidxreg(struct sisusb_usb_data } int -sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, u8 index, u8 *data) +sisusb_getidxreg(struct sisusb_usb_data *sisusb, u32 port, u8 index, u8 *data) { int ret; ret = sisusb_write_memio_byte(sisusb, SISUSB_TYPE_IO, port, index); @@ -1274,7 +1274,7 @@ sisusb_getidxreg(struct sisusb_usb_data } int -sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, u8 idx, +sisusb_setidxregandor(struct sisusb_usb_data *sisusb, u32 port, u8 idx, u8 myand, u8 myor) { int ret; @@ -1289,7 +1289,7 @@ sisusb_setidxregandor(struct sisusb_usb_ } static int -sisusb_setidxregmask(struct sisusb_usb_data *sisusb, int port, u8 idx, +sisusb_setidxregmask(struct sisusb_usb_data *sisusb, u32 port, u8 idx, u8 data, u8 mask) { int ret; @@ -1303,13 +1303,13 @@ sisusb_setidxregmask(struct sisusb_usb_d } int -sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port, u8 index, u8 myor) +sisusb_setidxregor(struct sisusb_usb_data *sisusb, u32 port, u8 index, u8 myor) { return(sisusb_setidxregandor(sisusb, port, index, 0xff, myor)); } int -sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port, u8 idx, u8 myand) +sisusb_setidxregand(struct sisusb_usb_data *sisusb, u32 port, u8 idx, u8 myand) { return(sisusb_setidxregandor(sisusb, port, idx, myand, 0x00)); } @@ -2849,8 +2849,8 @@ static int sisusb_handle_command(struct sisusb_usb_data *sisusb, struct sisusb_command *y, unsigned long arg) { - int retval, port, length; - u32 address; + int retval, length; + u32 port, address; /* All our commands require the device * to be initialized. --- a/drivers/usb/misc/sisusbvga/sisusb_init.h +++ b/drivers/usb/misc/sisusbvga/sisusb_init.h @@ -811,17 +811,17 @@ static const struct SiS_VCLKData SiSUSB_ int SiSUSBSetMode(struct SiS_Private *SiS_Pr, unsigned short ModeNo); int SiSUSBSetVESAMode(struct SiS_Private *SiS_Pr, unsigned short VModeNo); -extern int sisusb_setreg(struct sisusb_usb_data *sisusb, int port, u8 data); -extern int sisusb_getreg(struct sisusb_usb_data *sisusb, int port, u8 * data); -extern int sisusb_setidxreg(struct sisusb_usb_data *sisusb, int port, +extern int sisusb_setreg(struct sisusb_usb_data *sisusb, u32 port, u8 data); +extern int sisusb_getreg(struct sisusb_usb_data *sisusb, u32 port, u8 * data); +extern int sisusb_setidxreg(struct sisusb_usb_data *sisusb, u32 port, u8 index, u8 data); -extern int sisusb_getidxreg(struct sisusb_usb_data *sisusb, int port, +extern int sisusb_getidxreg(struct sisusb_usb_data *sisusb, u32 port, u8 index, u8 * data); -extern int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, int port, +extern int sisusb_setidxregandor(struct sisusb_usb_data *sisusb, u32 port, u8 idx, u8 myand, u8 myor); -extern int sisusb_setidxregor(struct sisusb_usb_data *sisusb, int port, +extern int sisusb_setidxregor(struct sisusb_usb_data *sisusb, u32 port, u8 index, u8 myor); -extern int sisusb_setidxregand(struct sisusb_usb_data *sisusb, int port, +extern int sisusb_setidxregand(struct sisusb_usb_data *sisusb, u32 port, u8 idx, u8 myand); void sisusb_delete(struct kref *kref); From patchwork Fri May 1 13:21:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226469 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E387DC4724C for ; Fri, 1 May 2020 14:01:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B80532051A for ; Fri, 1 May 2020 14:01:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341675; bh=NVWrPhJfnyt59n+JxxM935SAPZawW9c0/ULMAUsj5oM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ed8PEIp5jgS0E6Nrw6jHg4xmrzNFbejNE983p2b8fnZx9HUYmymY/RqQLcruttgD0 g1zCdOqShKD+P6NP8OmN/ydqARUyg2S2fVfcEiAxsdW3Vvfk+EBxlmdDNqrPOLT1PY 9AOvc6p2tm3ByXwnZFmtEV+su6k3n/Kln1IRH73o= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729184AbgEAN0R (ORCPT ); Fri, 1 May 2020 09:26:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:47720 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729197AbgEAN0O (ORCPT ); Fri, 1 May 2020 09:26:14 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7587C208D6; Fri, 1 May 2020 13:26:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339573; bh=NVWrPhJfnyt59n+JxxM935SAPZawW9c0/ULMAUsj5oM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2njpnFuZA2CHhnolHZ4Im/Hj613UWvvP1TY1aIsKTzBss7ie1QuS+r75M7vf9suVO nKn/iPNWrbAYTnNwdXwE7NONZ2Rr83kv5L0mUKIBwWA5a9Zv4MWY5M4H/x/E4V4Ldt d2C2uTKsWrpxFHHMZani6SBfdPeBXeW6I8GK9uIE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , David Mosberger Subject: [PATCH 4.4 33/70] drivers: usb: core: Minimize irq disabling in usb_sg_cancel() Date: Fri, 1 May 2020 15:21:21 +0200 Message-Id: <20200501131524.490779383@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: David Mosberger commit 5f2e5fb873e269fcb806165715d237f0de4ecf1d upstream. Restructure usb_sg_cancel() so we don't have to disable interrupts while cancelling the URBs. Suggested-by: Alan Stern Signed-off-by: David Mosberger Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/message.c | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -581,31 +581,28 @@ EXPORT_SYMBOL_GPL(usb_sg_wait); void usb_sg_cancel(struct usb_sg_request *io) { unsigned long flags; + int i, retval; spin_lock_irqsave(&io->lock, flags); + if (io->status) { + spin_unlock_irqrestore(&io->lock, flags); + return; + } + /* shut everything down */ + io->status = -ECONNRESET; + spin_unlock_irqrestore(&io->lock, flags); - /* shut everything down, if it didn't already */ - if (!io->status) { - int i; - - io->status = -ECONNRESET; - spin_unlock(&io->lock); - for (i = 0; i < io->entries; i++) { - int retval; - - usb_block_urb(io->urbs[i]); + for (i = io->entries - 1; i >= 0; --i) { + usb_block_urb(io->urbs[i]); - retval = usb_unlink_urb(io->urbs[i]); - if (retval != -EINPROGRESS - && retval != -ENODEV - && retval != -EBUSY - && retval != -EIDRM) - dev_warn(&io->dev->dev, "%s, unlink --> %d\n", - __func__, retval); - } - spin_lock(&io->lock); + retval = usb_unlink_urb(io->urbs[i]); + if (retval != -EINPROGRESS + && retval != -ENODEV + && retval != -EBUSY + && retval != -EIDRM) + dev_warn(&io->dev->dev, "%s, unlink --> %d\n", + __func__, retval); } - spin_unlock_irqrestore(&io->lock, flags); } EXPORT_SYMBOL_GPL(usb_sg_cancel); From patchwork Fri May 1 13:21:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226699 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CD51C4724C for ; Fri, 1 May 2020 13:26:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5D39D208D6 for ; Fri, 1 May 2020 13:26:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339578; bh=R6UamDJw4+3i3yj/3AJ3ccIrqCqsDtmzcI8grnRycKY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=l0QeMm4jiYEqpsX3NOkfnx0oh5elAUc30pZQWgcngRbLpe8SzGcL+N5TQD4t+7DlN 2t4HAuxW5Y4EGYLPFMX6FL/lHV+IMrz6YRrCuapqJnzX79kg3Z+mum1yQpc+QMiign hcNY/36zD0jZptCjTdJMbrjvIJgnZS/npb/c/BDE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729211AbgEAN0R (ORCPT ); Fri, 1 May 2020 09:26:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:47802 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728900AbgEAN0R (ORCPT ); Fri, 1 May 2020 09:26:17 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DEAD620757; Fri, 1 May 2020 13:26:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339576; bh=R6UamDJw4+3i3yj/3AJ3ccIrqCqsDtmzcI8grnRycKY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FpYpwSuUeyUVwwHOcwRWvAzo1pDe3k/2fB9IlqeJSfAe0+85jhDhgxVzpJjO3eIJc 6Oh+YLLTBASRIoChRttlr5VuYBf5Y/QkO0bbW2clvj2G+AmA5tISYRPUlKKrVBJWmq bmuxtwFrfGXD56LgpN6E9nH/O8PGt7GJntdCNzkY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Kyungtae Kim Subject: [PATCH 4.4 34/70] USB: core: Fix free-while-in-use bug in the USB S-Glibrary Date: Fri, 1 May 2020 15:21:22 +0200 Message-Id: <20200501131524.704761628@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Alan Stern commit 056ad39ee9253873522f6469c3364964a322912b upstream. FuzzUSB (a variant of syzkaller) found a free-while-still-in-use bug in the USB scatter-gather library: BUG: KASAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] BUG: KASAN: use-after-free in usb_hcd_unlink_urb+0x5f/0x170 drivers/usb/core/hcd.c:1607 Read of size 4 at addr ffff888065379610 by task kworker/u4:1/27 CPU: 1 PID: 27 Comm: kworker/u4:1 Not tainted 5.5.11 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueue: scsi_tmf_2 scmd_eh_abort_handler Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 __kasan_report+0x153/0x1cb mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:639 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x152/0x1b0 mm/kasan/generic.c:192 __kasan_check_read+0x11/0x20 mm/kasan/common.c:95 atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] usb_hcd_unlink_urb+0x5f/0x170 drivers/usb/core/hcd.c:1607 usb_unlink_urb+0x72/0xb0 drivers/usb/core/urb.c:657 usb_sg_cancel+0x14e/0x290 drivers/usb/core/message.c:602 usb_stor_stop_transport+0x5e/0xa0 drivers/usb/storage/transport.c:937 This bug occurs when cancellation of the S-G transfer races with transfer completion. When that happens, usb_sg_cancel() may continue to access the transfer's URBs after usb_sg_wait() has freed them. The bug is caused by the fact that usb_sg_cancel() does not take any sort of reference to the transfer, and so there is nothing to prevent the URBs from being deallocated while the routine is trying to use them. The fix is to take such a reference by incrementing the transfer's io->count field while the cancellation is in progres and decrementing it afterward. The transfer's URBs are not deallocated until io->complete is triggered, which happens when io->count reaches zero. Signed-off-by: Alan Stern Reported-and-tested-by: Kyungtae Kim CC: Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.2003281615140.14837-100000@netrider.rowland.org Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/message.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -584,12 +584,13 @@ void usb_sg_cancel(struct usb_sg_request int i, retval; spin_lock_irqsave(&io->lock, flags); - if (io->status) { + if (io->status || io->count == 0) { spin_unlock_irqrestore(&io->lock, flags); return; } /* shut everything down */ io->status = -ECONNRESET; + io->count++; /* Keep the request alive until we're done */ spin_unlock_irqrestore(&io->lock, flags); for (i = io->entries - 1; i >= 0; --i) { @@ -603,6 +604,12 @@ void usb_sg_cancel(struct usb_sg_request dev_warn(&io->dev->dev, "%s, unlink --> %d\n", __func__, retval); } + + spin_lock_irqsave(&io->lock, flags); + io->count--; + if (!io->count) + complete(&io->complete); + spin_unlock_irqrestore(&io->lock, flags); } EXPORT_SYMBOL_GPL(usb_sg_cancel); From patchwork Fri May 1 13:21:24 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226701 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35894C47254 for ; Fri, 1 May 2020 13:25:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 13E2920757 for ; Fri, 1 May 2020 13:25:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339557; bh=9brijW7GuhDSeY1AtCRbki20nRFuzUWvoIMQLuBG7Rg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=wQU5Z/a79c2dYcl/D3BidlbqoXtAliUJUPzZouE33oIz0I7MY9dXXn/QcQ+GwOuY1 MqQ/V0J1/ZUeZrAIsIsw8Puc4Z64XncF1hoDvl1VqRVgKwLIm7mFjXM+mvr5nnxv38 InMJU1kP7jY+kbzMXnl1X6bETxSZojpJhn/s/3gY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729128AbgEANZz (ORCPT ); Fri, 1 May 2020 09:25:55 -0400 Received: from mail.kernel.org ([198.145.29.99]:47158 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729124AbgEANZy (ORCPT ); Fri, 1 May 2020 09:25:54 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8AA5F20757; Fri, 1 May 2020 13:25:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339554; bh=9brijW7GuhDSeY1AtCRbki20nRFuzUWvoIMQLuBG7Rg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oGPY9U62Zyn817soWYb9gTVX3tlf35KgeOV/TRSlh0ohjjz4JCu86zN3SAxMc7FxX /f8zXDyho1B52NdthpdhrJnyv64FE1wnshWApunPC6RGHixfKFpR0vibvHopaduC6t sLE5wZjyMS/lcjeBVRiW5L0M6pVd3f2v7EYpuimg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Yi , Takashi Iwai Subject: [PATCH 4.4 36/70] ALSA: usx2y: Fix potential NULL dereference Date: Fri, 1 May 2020 15:21:24 +0200 Message-Id: <20200501131525.176394685@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Takashi Iwai commit 7686e3485253635c529cdd5f416fc640abaf076f upstream. The error handling code in usX2Y_rate_set() may hit a potential NULL dereference when an error occurs before allocating all us->urb[]. Add a proper NULL check for fixing the corner case. Reported-by: Lin Yi Cc: Link: https://lore.kernel.org/r/20200420075529.27203-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/usb/usx2y/usbusx2yaudio.c | 2 ++ 1 file changed, 2 insertions(+) --- a/sound/usb/usx2y/usbusx2yaudio.c +++ b/sound/usb/usx2y/usbusx2yaudio.c @@ -691,6 +691,8 @@ static int usX2Y_rate_set(struct usX2Yde us->submitted = 2*NOOF_SETRATE_URBS; for (i = 0; i < NOOF_SETRATE_URBS; ++i) { struct urb *urb = us->urb[i]; + if (!urb) + continue; if (urb->status) { if (!err) err = -ENODEV; From patchwork Fri May 1 13:21:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226467 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4405C47253 for ; Fri, 1 May 2020 14:01:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 84488206D6 for ; Fri, 1 May 2020 14:01:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341683; bh=0ddaoSfvKALWn7x17WA7VemeWlSQsiVyT/+WjRgZR3M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=dDKSLl3CUH34sa1RtttihelWJYsFKuMOuP6fAhjCxUUmRuxIyR4RqLt+KfRo3Kapc Gxh/tJNcFFFbNFlib1FOpJqlXPz6swnhAyTtbw3Q6pXZ5D3I455U4zixwPe6NeFCEf 352Els6KWVZTYHFzjDXcU9uwO7sFwexnzeulR1UM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729143AbgEAN0A (ORCPT ); Fri, 1 May 2020 09:26:00 -0400 Received: from mail.kernel.org ([198.145.29.99]:47302 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729124AbgEANZ7 (ORCPT ); Fri, 1 May 2020 09:25:59 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6B3AA20757; Fri, 1 May 2020 13:25:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339558; bh=0ddaoSfvKALWn7x17WA7VemeWlSQsiVyT/+WjRgZR3M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JCr95xPyf433kh3RpgsWjnoXegIJuV/DI4y+aTpf7JvIo8PIb30EG0H4PWr2wGgYZ E7QSrlC5/GqWrKOtU94JwlMVQEi+HUG2KYUgjN9PIFSYYMlpio9M9epeBMm0NrCFgX J1tSigZg950iJFPGihaUpehOsF1+l3ifKgHWQ+WE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexey Skobkin , Alexander Tsoy , Takashi Iwai Subject: [PATCH 4.4 38/70] ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices Date: Fri, 1 May 2020 15:21:26 +0200 Message-Id: <20200501131525.578464968@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Alexander Tsoy commit 1c826792586f526a5a5cd21d55aad388f5bb0b23 upstream. Many Focusrite devices supports a limited set of sample rates per altsetting. These includes audio interfaces with ADAT ports: - Scarlett 18i6, 18i8 1st gen, 18i20 1st gen; - Scarlett 18i8 2nd gen, 18i20 2nd gen; - Scarlett 18i8 3rd gen, 18i20 3rd gen; - Clarett 2Pre USB, 4Pre USB, 8Pre USB. Maximum rate is exposed in the last 4 bytes of Format Type descriptor which has a non-standard bLength = 10. Tested-by: Alexey Skobkin Signed-off-by: Alexander Tsoy Cc: Link: https://lore.kernel.org/r/20200418175815.12211-1-alexander@tsoy.me Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/usb/format.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) --- a/sound/usb/format.c +++ b/sound/usb/format.c @@ -223,6 +223,52 @@ static int parse_audio_format_rates_v1(s } /* + * Many Focusrite devices supports a limited set of sampling rates per + * altsetting. Maximum rate is exposed in the last 4 bytes of Format Type + * descriptor which has a non-standard bLength = 10. + */ +static bool focusrite_valid_sample_rate(struct snd_usb_audio *chip, + struct audioformat *fp, + unsigned int rate) +{ + struct usb_interface *iface; + struct usb_host_interface *alts; + unsigned char *fmt; + unsigned int max_rate; + + iface = usb_ifnum_to_if(chip->dev, fp->iface); + if (!iface) + return true; + + alts = &iface->altsetting[fp->altset_idx]; + fmt = snd_usb_find_csint_desc(alts->extra, alts->extralen, + NULL, UAC_FORMAT_TYPE); + if (!fmt) + return true; + + if (fmt[0] == 10) { /* bLength */ + max_rate = combine_quad(&fmt[6]); + + /* Validate max rate */ + if (max_rate != 48000 && + max_rate != 96000 && + max_rate != 192000 && + max_rate != 384000) { + + usb_audio_info(chip, + "%u:%d : unexpected max rate: %u\n", + fp->iface, fp->altsetting, max_rate); + + return true; + } + + return rate <= max_rate; + } + + return true; +} + +/* * Helper function to walk the array of sample rate triplets reported by * the device. The problem is that we need to parse whole array first to * get to know how many sample rates we have to expect. @@ -258,6 +304,11 @@ static int parse_uac2_sample_rate_range( } for (rate = min; rate <= max; rate += res) { + /* Filter out invalid rates on Focusrite devices */ + if (USB_ID_VENDOR(chip->usb_id) == 0x1235 && + !focusrite_valid_sample_rate(chip, fp, rate)) + goto skip_rate; + if (fp->rate_table) fp->rate_table[nr_rates] = rate; if (!fp->rate_min || rate < fp->rate_min) @@ -272,6 +323,7 @@ static int parse_uac2_sample_rate_range( break; } +skip_rate: /* avoid endless loop */ if (res == 0) break; From patchwork Fri May 1 13:21:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226474 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C710C47253 for ; Fri, 1 May 2020 14:00:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4BE05206D9 for ; Fri, 1 May 2020 14:00:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341652; bh=vE4sw5pXGrs+jUPMxqzbdGisJdgJaBReRiGMoZcKJXw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=tLa/tD1ZbZ/1mXPKAq4P3D7pELsNkieOOZuDpA6rdyfUdwMD0cKwZJAVw1CeOp3r7 OORZyuFu1sqiiEB4rvrqqr1/AEgF9ecr3IQi6myDKtdHn912AFQO7dSIcTvOyjcK8I X4fAQPnyuJ8NgrwTrDrJEkmCrXw878UejC3mXJOA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729039AbgEAOAs (ORCPT ); Fri, 1 May 2020 10:00:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:48964 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728933AbgEAN06 (ORCPT ); Fri, 1 May 2020 09:26:58 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DCE50208D6; Fri, 1 May 2020 13:26:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339618; bh=vE4sw5pXGrs+jUPMxqzbdGisJdgJaBReRiGMoZcKJXw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nUoZaNG9/BX5DKHfbWdFjxbAvR7Czu3epjTfwmLLPrcs+CJBy6ZdSWCRCmcyRLJf1 NDs3tk7h2dWmLuyZ1seY+DxEPx2K/kMKLX4NvGPx25B4/qPkYhqL6akjtks1wl5Xc7 7GfKLlFC3yjPVx4Zt44r27ybpcFWKaO5Ovgv5p5w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+d889b59b2bb87d4047a2@syzkaller.appspotmail.com, Sean Christopherson , Cornelia Huck , Paolo Bonzini Subject: [PATCH 4.4 39/70] KVM: Check validity of resolved slot when searching memslots Date: Fri, 1 May 2020 15:21:27 +0200 Message-Id: <20200501131525.781677076@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Sean Christopherson commit b6467ab142b708dd076f6186ca274f14af379c72 upstream. Check that the resolved slot (somewhat confusingly named 'start') is a valid/allocated slot before doing the final comparison to see if the specified gfn resides in the associated slot. The resolved slot can be invalid if the binary search loop terminated because the search index was incremented beyond the number of used slots. This bug has existed since the binary search algorithm was introduced, but went unnoticed because KVM statically allocated memory for the max number of slots, i.e. the access would only be truly out-of-bounds if all possible slots were allocated and the specified gfn was less than the base of the lowest memslot. Commit 36947254e5f98 ("KVM: Dynamically size memslot array based on number of used slots") eliminated the "all possible slots allocated" condition and made the bug embarrasingly easy to hit. Fixes: 9c1a5d38780e6 ("kvm: optimize GFN to memslot lookup with large slots amount") Reported-by: syzbot+d889b59b2bb87d4047a2@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Message-Id: <20200408064059.8957-2-sean.j.christopherson@intel.com> Reviewed-by: Cornelia Huck Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman --- include/linux/kvm_host.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -934,7 +934,7 @@ search_memslots(struct kvm_memslots *slo start = slot + 1; } - if (gfn >= memslots[start].base_gfn && + if (start < slots->used_slots && gfn >= memslots[start].base_gfn && gfn < memslots[start].base_gfn + memslots[start].npages) { atomic_set(&slots->lru_slot, start); return &memslots[start]; From patchwork Fri May 1 13:21:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226473 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46BCDC47254 for ; Fri, 1 May 2020 14:00:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1DD4A206D9 for ; Fri, 1 May 2020 14:00:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341656; bh=pd924RWWF35qaMXbApnuAGEJ0+1JdwtPLSCIFr1pg8E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=gbkfkQUrlOcN62YVIcD2qc3hS0mw3umaTQ8OLNOexWxcDQG5dlv2lAZF0t5N7CFg/ Qv1ZlOX0fqTESgtWJim0pEXnollsH0ofb3/W5E9fsCAWMrPXajRIwB+W+/wDOrxutx JV9pIpZF3N8QkmBWr6Y836rnRto/Gqxo9/r4TBZ0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729301AbgEAN0o (ORCPT ); Fri, 1 May 2020 09:26:44 -0400 Received: from mail.kernel.org ([198.145.29.99]:48472 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729299AbgEAN0j (ORCPT ); Fri, 1 May 2020 09:26:39 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E798D24962; Fri, 1 May 2020 13:26:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339598; bh=pd924RWWF35qaMXbApnuAGEJ0+1JdwtPLSCIFr1pg8E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cLSQkJ7tfCBoNzMNfjWlvGF4ZmeApIZEnSYxMAfucBgLNng8CvLTJsFSJk3xueRE2 YC5+/vZZIu8D/9rDeKjmqWjW2sfYkqEBPRuzCd5c02+x+NqGU1BK3NOC0KI8laxspk HfwQX1mNTCCbH3sUO4mEDbe893Acwr4jsetrAbOI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrew Melnychenko Subject: [PATCH 4.4 41/70] tty: hvc: fix buffer overflow during hvc_alloc(). Date: Fri, 1 May 2020 15:21:29 +0200 Message-Id: <20200501131526.249327086@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Andrew Melnychenko commit 9a9fc42b86c06120744555fea43fdcabe297c656 upstream. If there is a lot(more then 16) of virtio-console devices or virtio_console module is reloaded - buffers 'vtermnos' and 'cons_ops' are overflowed. In older kernels it overruns spinlock which leads to kernel freezing: https://bugzilla.redhat.com/show_bug.cgi?id=1786239 To reproduce the issue, you can try simple script that loads/unloads module. Something like this: while [ 1 ] do modprobe virtio_console sleep 2 modprobe -r virtio_console sleep 2 done Description of problem: Guest get 'Call Trace' when loading module "virtio_console" and unloading it frequently - clearly reproduced on kernel-4.18.0: [ 81.498208] ------------[ cut here ]------------ [ 81.499263] pvqspinlock: lock 0xffffffff92080020 has corrupted value 0xc0774ca0! [ 81.501000] WARNING: CPU: 0 PID: 785 at kernel/locking/qspinlock_paravirt.h:500 __pv_queued_spin_unlock_slowpath+0xc0/0xd0 [ 81.503173] Modules linked in: virtio_console fuse xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nft_counter nf_nat_tftp nft_objref nf_conntrack_tftp tun bridge stp llc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_tables_set nft_chain_nat_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 nft_chain_route_ipv6 nft_chain_nat_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack nft_chain_route_ipv4 ip6_tables nft_compat ip_set nf_tables nfnetlink sunrpc bochs_drm drm_vram_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm i2c_piix4 pcspkr crct10dif_pclmul crc32_pclmul joydev ghash_clmulni_intel ip_tables xfs libcrc32c sd_mod sg ata_generic ata_piix virtio_net libata crc32c_intel net_failover failover serio_raw virtio_scsi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: virtio_console] [ 81.517019] CPU: 0 PID: 785 Comm: kworker/0:2 Kdump: loaded Not tainted 4.18.0-167.el8.x86_64 #1 [ 81.518639] Hardware name: Red Hat KVM, BIOS 1.12.0-5.scrmod+el8.2.0+5159+d8aa4d83 04/01/2014 [ 81.520205] Workqueue: events control_work_handler [virtio_console] [ 81.521354] RIP: 0010:__pv_queued_spin_unlock_slowpath+0xc0/0xd0 [ 81.522450] Code: 07 00 48 63 7a 10 e8 bf 64 f5 ff 66 90 c3 8b 05 e6 cf d6 01 85 c0 74 01 c3 8b 17 48 89 fe 48 c7 c7 38 4b 29 91 e8 3a 6c fa ff <0f> 0b c3 0f 0b 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 [ 81.525830] RSP: 0018:ffffb51a01ffbd70 EFLAGS: 00010282 [ 81.526798] RAX: 0000000000000000 RBX: 0000000000000010 RCX: 0000000000000000 [ 81.528110] RDX: ffff9e66f1826480 RSI: ffff9e66f1816a08 RDI: ffff9e66f1816a08 [ 81.529437] RBP: ffffffff9153ff10 R08: 000000000000026c R09: 0000000000000053 [ 81.530732] R10: 0000000000000000 R11: ffffb51a01ffbc18 R12: ffff9e66cd682200 [ 81.532133] R13: ffffffff9153ff10 R14: ffff9e6685569500 R15: ffff9e66cd682000 [ 81.533442] FS: 0000000000000000(0000) GS:ffff9e66f1800000(0000) knlGS:0000000000000000 [ 81.534914] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 81.535971] CR2: 00005624c55b14d0 CR3: 00000003a023c000 CR4: 00000000003406f0 [ 81.537283] Call Trace: [ 81.537763] __raw_callee_save___pv_queued_spin_unlock_slowpath+0x11/0x20 [ 81.539011] .slowpath+0x9/0xe [ 81.539585] hvc_alloc+0x25e/0x300 [ 81.540237] init_port_console+0x28/0x100 [virtio_console] [ 81.541251] handle_control_message.constprop.27+0x1c4/0x310 [virtio_console] [ 81.542546] control_work_handler+0x70/0x10c [virtio_console] [ 81.543601] process_one_work+0x1a7/0x3b0 [ 81.544356] worker_thread+0x30/0x390 [ 81.545025] ? create_worker+0x1a0/0x1a0 [ 81.545749] kthread+0x112/0x130 [ 81.546358] ? kthread_flush_work_fn+0x10/0x10 [ 81.547183] ret_from_fork+0x22/0x40 [ 81.547842] ---[ end trace aa97649bd16c8655 ]--- [ 83.546539] general protection fault: 0000 [#1] SMP NOPTI [ 83.547422] CPU: 5 PID: 3225 Comm: modprobe Kdump: loaded Tainted: G W --------- - - 4.18.0-167.el8.x86_64 #1 [ 83.549191] Hardware name: Red Hat KVM, BIOS 1.12.0-5.scrmod+el8.2.0+5159+d8aa4d83 04/01/2014 [ 83.550544] RIP: 0010:__pv_queued_spin_lock_slowpath+0x19a/0x2a0 [ 83.551504] Code: c4 c1 ea 12 41 be 01 00 00 00 4c 8d 6d 14 41 83 e4 03 8d 42 ff 49 c1 e4 05 48 98 49 81 c4 40 a5 02 00 4c 03 24 c5 60 48 34 91 <49> 89 2c 24 b8 00 80 00 00 eb 15 84 c0 75 0a 41 0f b6 54 24 14 84 [ 83.554449] RSP: 0018:ffffb51a0323fdb0 EFLAGS: 00010202 [ 83.555290] RAX: 000000000000301c RBX: ffffffff92080020 RCX: 0000000000000001 [ 83.556426] RDX: 000000000000301d RSI: 0000000000000000 RDI: 0000000000000000 [ 83.557556] RBP: ffff9e66f196a540 R08: 000000000000028a R09: ffff9e66d2757788 [ 83.558688] R10: 0000000000000000 R11: 0000000000000000 R12: 646e61725f770b07 [ 83.559821] R13: ffff9e66f196a554 R14: 0000000000000001 R15: 0000000000180000 [ 83.560958] FS: 00007fd5032e8740(0000) GS:ffff9e66f1940000(0000) knlGS:0000000000000000 [ 83.562233] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.563149] CR2: 00007fd5022b0da0 CR3: 000000038c334000 CR4: 00000000003406e0 Signed-off-by: Andrew Melnychenko Cc: stable Link: https://lore.kernel.org/r/20200414191503.3471783-1-andrew@daynix.com Signed-off-by: Greg Kroah-Hartman --- drivers/tty/hvc/hvc_console.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) --- a/drivers/tty/hvc/hvc_console.c +++ b/drivers/tty/hvc/hvc_console.c @@ -289,10 +289,6 @@ int hvc_instantiate(uint32_t vtermno, in vtermnos[index] = vtermno; cons_ops[index] = ops; - /* reserve all indices up to and including this index */ - if (last_hvc < index) - last_hvc = index; - /* check if we need to re-register the kernel console */ hvc_check_console(index); @@ -896,13 +892,22 @@ struct hvc_struct *hvc_alloc(uint32_t vt cons_ops[i] == hp->ops) break; - /* no matching slot, just use a counter */ - if (i >= MAX_NR_HVC_CONSOLES) - i = ++last_hvc; + if (i >= MAX_NR_HVC_CONSOLES) { + + /* find 'empty' slot for console */ + for (i = 0; i < MAX_NR_HVC_CONSOLES && vtermnos[i] != -1; i++) { + } + + /* no matching slot, just use a counter */ + if (i == MAX_NR_HVC_CONSOLES) + i = ++last_hvc + MAX_NR_HVC_CONSOLES; + } hp->index = i; - cons_ops[i] = ops; - vtermnos[i] = vtermno; + if (i < MAX_NR_HVC_CONSOLES) { + cons_ops[i] = ops; + vtermnos[i] = vtermno; + } list_add_tail(&(hp->next), &hvc_structs); spin_unlock(&hvc_structs_lock); From patchwork Fri May 1 13:21:32 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226696 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EBA1AC4724C for ; Fri, 1 May 2020 13:26:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C7664216FD for ; Fri, 1 May 2020 13:26:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339610; bh=DTGMImZJ7jUD9f8TAsQZWCyL6EtzNSwatzM2gU3fHMw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=yfuzuBNZErukKkZ/sae+r0hKoEHjagJACaxIx0yrSI/A+2EstW1mUP3C45wYmmPIp VcfHsKfzmh4EbkxK9W9n8VX1uWwjlRjo59Xuj0umbFB9y0zaf+hgm3hnUq5NqshMuo rPhmd0qKeB5DGLHEgiEN2BRfTlP8n/fbWpN2JzgM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729337AbgEAN0q (ORCPT ); Fri, 1 May 2020 09:26:46 -0400 Received: from mail.kernel.org ([198.145.29.99]:48636 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729330AbgEAN0q (ORCPT ); Fri, 1 May 2020 09:26:46 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3FEFF20757; Fri, 1 May 2020 13:26:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339605; bh=DTGMImZJ7jUD9f8TAsQZWCyL6EtzNSwatzM2gU3fHMw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KltfDJypKk7QlNWzlO8JaOmDIde4Lz0DaUUDzkIEpiQVSiH94sBRBANiUg2fWX3Kf LoOchQ5y9WKbB8pRYnie4pXiPLeT6UE0cBb8eqgJWr9I0Y78dZk4C81KZP2L6+Ce4p e1dGwV22zCPqE3RH7h2DcsZ9NOxiSZou98rRyVPw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+49e69b4d71a420ceda3e@syzkaller.appspotmail.com, Paul Moore Subject: [PATCH 4.4 44/70] audit: check the length of userspace generated audit records Date: Fri, 1 May 2020 15:21:32 +0200 Message-Id: <20200501131527.057140108@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Paul Moore commit 763dafc520add02a1f4639b500c509acc0ea8e5b upstream. Commit 756125289285 ("audit: always check the netlink payload length in audit_receive_msg()") fixed a number of missing message length checks, but forgot to check the length of userspace generated audit records. The good news is that you need CAP_AUDIT_WRITE to submit userspace audit records, which is generally only given to trusted processes, so the impact should be limited. Cc: stable@vger.kernel.org Fixes: 756125289285 ("audit: always check the netlink payload length in audit_receive_msg()") Reported-by: syzbot+49e69b4d71a420ceda3e@syzkaller.appspotmail.com Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman --- kernel/audit.c | 3 +++ 1 file changed, 3 insertions(+) --- a/kernel/audit.c +++ b/kernel/audit.c @@ -919,6 +919,9 @@ static int audit_receive_msg(struct sk_b case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: if (!audit_enabled && msg_type != AUDIT_USER_AVC) return 0; + /* exit early if there isn't at least one character to print */ + if (data_len < 2) + return -EINVAL; err = audit_filter_user(msg_type); if (err == 1) { /* match or error */ From patchwork Fri May 1 13:21:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226695 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3326BC47253 for ; Fri, 1 May 2020 13:26:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 11638208D6 for ; Fri, 1 May 2020 13:26:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339615; bh=VsYap1cvGow2jSCcWvjNno49atcuMeOuC56eocJemgs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ADewQ0TJY/ZaHYZnu6K7LUP9sCgMbmJ8iPlyMgnmxXKTMGG+xIvuvWM0CD+NM8NMD RQQLu/WF7ScuJUM+/SzbttbrstT4mG/MOW6ORoTfhMeOUgN+u8pyblllhTDhu2xgZN nLRNJiYrn8DtsvFY+/wO8cLdMRT7h6pk17nd+WwI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729340AbgEAN0y (ORCPT ); Fri, 1 May 2020 09:26:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:48824 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729357AbgEAN0x (ORCPT ); Fri, 1 May 2020 09:26:53 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D7205208D6; Fri, 1 May 2020 13:26:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339613; bh=VsYap1cvGow2jSCcWvjNno49atcuMeOuC56eocJemgs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KFZPWLwfPhPx+/bfBS3nL1Ygpqi7HN2z8WTEKHfweaiLprUaoHsdGZFwaFIep9OkO VUKW7kxiQCVTnExMU7vVBPDxqtAHU0vTd69OGd+LCceXce5KdWSPpFee1PxBo0ia57 1pvbekTBk7pHhbdm/lFKizLVv5G0zBgnqQoctW+g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ian Abbott Subject: [PATCH 4.4 47/70] staging: comedi: dt2815: fix writing hi byte of analog output Date: Fri, 1 May 2020 15:21:35 +0200 Message-Id: <20200501131528.012059340@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Ian Abbott commit ed87d33ddbcd9a1c3b5ae87995da34e6f51a862c upstream. The DT2815 analog output command is 16 bits wide, consisting of the 12-bit sample value in bits 15 to 4, the channel number in bits 3 to 1, and a voltage or current selector in bit 0. Both bytes of the 16-bit command need to be written in turn to a single 8-bit data register. However, the driver currently only writes the low 8-bits. It is broken and appears to have always been broken. Electronic copies of the DT2815 User's Manual seem impossible to find online, but looking at the source code, a best guess for the sequence the driver intended to use to write the analog output command is as follows: 1. Wait for the status register to read 0x00. 2. Write the low byte of the command to the data register. 3. Wait for the status register to read 0x80. 4. Write the high byte of the command to the data register. Step 4 is missing from the driver. Add step 4 to (hopefully) fix the driver. Also add a "FIXME" comment about setting bit 0 of the low byte of the command. Supposedly, it is used to choose between voltage output and current output, but the current driver always sets it to 1. Signed-off-by: Ian Abbott Cc: stable Link: https://lore.kernel.org/r/20200406142015.126982-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/staging/comedi/drivers/dt2815.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/staging/comedi/drivers/dt2815.c +++ b/drivers/staging/comedi/drivers/dt2815.c @@ -101,6 +101,7 @@ static int dt2815_ao_insn(struct comedi_ int ret; for (i = 0; i < insn->n; i++) { + /* FIXME: lo bit 0 chooses voltage output or current output */ lo = ((data[i] & 0x0f) << 4) | (chan << 1) | 0x01; hi = (data[i] & 0xff0) >> 4; @@ -114,6 +115,8 @@ static int dt2815_ao_insn(struct comedi_ if (ret) return ret; + outb(hi, dev->iobase + DT2815_DATA); + devpriv->ao_readback[chan] = data[i]; } return i; From patchwork Fri May 1 13:21:37 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226698 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B73C5C47258 for ; Fri, 1 May 2020 13:26:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9895A208DB for ; Fri, 1 May 2020 13:26:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339588; bh=M45ArbKlZ4EsHTyDzyqRLKYdnTh/3Q0IedxNGk/ZHcI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=zdG+DnIDulUduvAe+iMzlK6uj8dTihiuGwfqfQvIg6gvug02qqvUaMiz3Y8pe6CvE LrYJfKzcXrdRTHnY6NK1fxPQm3pf9VD3R1Ou32+iO89LWPYhXkILjdjaVNelRhiiiw UsmTox+q4HCQVVCxnHQ7yMLB9st+/YmBciW3bWz4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729253AbgEAN01 (ORCPT ); Fri, 1 May 2020 09:26:27 -0400 Received: from mail.kernel.org ([198.145.29.99]:48126 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729248AbgEAN00 (ORCPT ); Fri, 1 May 2020 09:26:26 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A4C652166E; Fri, 1 May 2020 13:26:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339586; bh=M45ArbKlZ4EsHTyDzyqRLKYdnTh/3Q0IedxNGk/ZHcI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IYyA1EIAg4vi1/S/HmgRXFFbT2ynBKAZDmcsp1GVQoZ6b7xiW6fnF7OkrLd1O+iVA E7/YvhoqFhdMej4FWVlQheNQ7657CxHmPrwrOMRxVYDIxpla2P1xO1QE4JO2RovKpD mGuffaOtHK8UCF9JTdOt74Nm8aX+J8OqhSm6S0cg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Malcolm Priestley Subject: [PATCH 4.4 49/70] staging: vt6656: Fix drivers TBTT timing counter. Date: Fri, 1 May 2020 15:21:37 +0200 Message-Id: <20200501131528.435193611@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Malcolm Priestley commit 09057742af98a39ebffa27fac4f889dc873132de upstream. The drivers TBTT counter is not synchronized with mac80211 timestamp. Reorder the functions and use vnt_update_next_tbtt to do the final synchronize. Fixes: c15158797df6 ("staging: vt6656: implement TSF counter") Cc: stable Signed-off-by: Malcolm Priestley Link: https://lore.kernel.org/r/375d0b25-e8bc-c8f7-9b10-6cc705d486ee@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/staging/vt6656/main_usb.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/drivers/staging/vt6656/main_usb.c +++ b/drivers/staging/vt6656/main_usb.c @@ -762,12 +762,15 @@ static void vnt_bss_info_changed(struct vnt_mac_reg_bits_on(priv, MAC_REG_TFTCTL, TFTCTL_TSFCNTREN); - vnt_adjust_tsf(priv, conf->beacon_rate->hw_value, - conf->sync_tsf, priv->current_tsf); - vnt_mac_set_beacon_interval(priv, conf->beacon_int); vnt_reset_next_tbtt(priv, conf->beacon_int); + + vnt_adjust_tsf(priv, conf->beacon_rate->hw_value, + conf->sync_tsf, priv->current_tsf); + + vnt_update_next_tbtt(priv, + conf->sync_tsf, conf->beacon_int); } else { vnt_clear_current_tsf(priv); From patchwork Fri May 1 13:21:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226471 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D5C62C4724C for ; Fri, 1 May 2020 14:01:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A9DE62051A for ; Fri, 1 May 2020 14:01:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341663; bh=2C+zaXH0NcVwovhzxCpIT+U1m1TU7namuJZfIR6ant8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=DAHmD7tR82k4FQWSa+eLufiwd3QssychiLoYaE0LzcAtw3ow7e+F7F6syM55rfRoL ksiXPxmkBBbr7vmHZ19AS97gG+Bh6MvKOoaj4AhAKBSEcPc372NVJewpNRoOqrzGYu y68FBe0OoztO5Ho4aNmAw2E2JQjzAWoC0c/jM1qc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729275AbgEAN0d (ORCPT ); Fri, 1 May 2020 09:26:33 -0400 Received: from mail.kernel.org ([198.145.29.99]:48286 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729266AbgEAN0b (ORCPT ); Fri, 1 May 2020 09:26:31 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9996C2166E; Fri, 1 May 2020 13:26:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339591; bh=2C+zaXH0NcVwovhzxCpIT+U1m1TU7namuJZfIR6ant8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OeqCCltue2xirhxZMjDiOwgT6sXlbk5f/Inj+mSCAym5GWmCvoGLQ+oPk/LTAVkS5 oZSCW2CyterWok1i/+WBrJeWRbSQMWkoj3as51IuluVajr80nIYzMyS023M3AaVJQE gggXCS9IV58laQ10Pn/as2DAThc9MiS3xzf1Wifg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum Subject: [PATCH 4.4 51/70] UAS: no use logging any details in case of ENODEV Date: Fri, 1 May 2020 15:21:39 +0200 Message-Id: <20200501131529.217441706@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Oliver Neukum commit 5963dec98dc52d52476390485f07a29c30c6a582 upstream. Once a device is gone, the internal state does not matter anymore. There is no need to spam the logs. Signed-off-by: Oliver Neukum Cc: stable Fixes: 326349f824619 ("uas: add dead request list") Link: https://lore.kernel.org/r/20200415141750.811-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/storage/uas.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/storage/uas.c +++ b/drivers/usb/storage/uas.c @@ -191,6 +191,9 @@ static void uas_log_cmd_state(struct scs struct uas_cmd_info *ci = (void *)&cmnd->SCp; struct uas_cmd_info *cmdinfo = (void *)&cmnd->SCp; + if (status == -ENODEV) /* too late */ + return; + scmd_printk(KERN_INFO, cmnd, "%s %d uas-tag %d inflight:%s%s%s%s%s%s%s%s%s%s%s%s ", prefix, status, cmdinfo->uas_tag, From patchwork Fri May 1 13:21:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226697 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C651CC47253 for ; Fri, 1 May 2020 13:26:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A3D03208D6 for ; Fri, 1 May 2020 13:26:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339600; bh=pfLbE4VzKyFtdeGfDyuYIWsD/fCOmU/zkT+bA4jZ3ek=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=1aGSSCIznR1S9ldDtSgvcyaR+Nefay/KDPXP4acIG3uDJnj/jG0Em7KIsA3+1X9xP nQUqs3D9S2bhY09Xr2Zc+Ul+wYuw/uaMpU/8N0gVFlIFhs/1lUUBCUIgiSYllZsGpJ zR3/qEKqUNmPcl3T3BpOhI03nd8kPbv79br22sjk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729278AbgEAN0i (ORCPT ); Fri, 1 May 2020 09:26:38 -0400 Received: from mail.kernel.org ([198.145.29.99]:48396 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729292AbgEAN0g (ORCPT ); Fri, 1 May 2020 09:26:36 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 77107208D6; Fri, 1 May 2020 13:26:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339595; bh=pfLbE4VzKyFtdeGfDyuYIWsD/fCOmU/zkT+bA4jZ3ek=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m1Vt4vyKyqRLo2kVas2o1HvPzBYEOm/GsA80ti4CajODug1UznDrkq8TB0ptWEnmD FtdqVMMV/AeKbphvQbuz6gh8cdRoxx6NOx2DEpCDsWtI22dxhb2fgiCTY8AJvEA1gj SH/IozgREWvOYfUGyasRyL3bQXFui7AzHKKW3O3U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Udipto Goswami , Sriharsha Allenki , Manu Gautam Subject: [PATCH 4.4 53/70] usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset() Date: Fri, 1 May 2020 15:21:41 +0200 Message-Id: <20200501131529.693541005@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Udipto Goswami commit 1c2e54fbf1da5e5445a0ab132c862b02ccd8d230 upstream. For userspace functions using OS Descriptors, if a function also supplies Extended Property descriptors currently the counts and lengths stored in the ms_os_descs_ext_prop_{count,name_len,data_len} variables are not getting reset to 0 during an unbind or when the epfiles are closed. If the same function is re-bound and the descriptors are re-written, this results in those count/length variables to monotonically increase causing the VLA allocation in _ffs_func_bind() to grow larger and larger at each bind/unbind cycle and eventually fail to allocate. Fix this by clearing the ms_os_descs_ext_prop count & lengths to 0 in ffs_data_reset(). Fixes: f0175ab51993 ("usb: gadget: f_fs: OS descriptors support") Cc: stable@vger.kernel.org Signed-off-by: Udipto Goswami Signed-off-by: Sriharsha Allenki Reviewed-by: Manu Gautam Link: https://lore.kernel.org/r/20200402044521.9312-1-sallenki@codeaurora.org Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/function/f_fs.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1511,6 +1511,10 @@ static void ffs_data_reset(struct ffs_da ffs->state = FFS_READ_DESCRIPTORS; ffs->setup_state = FFS_NO_SETUP; ffs->flags = 0; + + ffs->ms_os_descs_ext_prop_count = 0; + ffs->ms_os_descs_ext_prop_name_len = 0; + ffs->ms_os_descs_ext_prop_data_len = 0; } From patchwork Fri May 1 13:21:43 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226475 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD00FC47253 for ; Fri, 1 May 2020 14:00:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BBC822051A for ; Fri, 1 May 2020 14:00:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341646; bh=bFzTwxNpNnXKW5y0Ld8IcgIJN0YnBTHn+0HciPjoj/Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=D0WMFTtXlkQRmzXA95F3S+cn9lBsmFHSNFmd683AjkX1MCzZtZEdqN9bP/G89xMbP RBp70K3flYXfNK4NG9JTS59O/SFD+uXQAUkkJ139jqsA5iSKbqBBp366n85Sc62OAd hcxECIos8hVE0T59ug0VpcN65NCYpQNXXUUUUDGY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729389AbgEAN1F (ORCPT ); Fri, 1 May 2020 09:27:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:49038 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729363AbgEAN1C (ORCPT ); Fri, 1 May 2020 09:27:02 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 527EE24955; Fri, 1 May 2020 13:27:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339620; bh=bFzTwxNpNnXKW5y0Ld8IcgIJN0YnBTHn+0HciPjoj/Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Gq37U9jn0X8hPrt/P8FkapXV4TX/9OmG5QBuRF23MsH3NlqbdghaFyV6xQ+ooDdw8 8kkVF5z7eyMmQ8IpKNF+MLe9AdDFGdjrT1DrND+cUZZ+h05/YqtGNGBuw/SUNpR+Yi Wsa+16i+GybYYwnrMZaYVem0MKKEt0SsTzk+/7Pw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xin Long , Marcelo Ricardo Leitner , Neil Horman , "David S. Miller" , Guenter Roeck Subject: [PATCH 4.4 55/70] sctp: use right member as the param of list_for_each_entry Date: Fri, 1 May 2020 15:21:43 +0200 Message-Id: <20200501131530.005417399@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Xin Long commit a8dd397903a6e57157f6265911f7d35681364427 upstream. Commit d04adf1b3551 ("sctp: reset owner sk for data chunks on out queues when migrating a sock") made a mistake that using 'list' as the param of list_for_each_entry to traverse the retransmit, sacked and abandoned queues, while chunks are using 'transmitted_list' to link into these queues. It could cause NULL dereference panic if there are chunks in any of these queues when peeling off one asoc. So use the chunk member 'transmitted_list' instead in this patch. Fixes: d04adf1b3551 ("sctp: reset owner sk for data chunks on out queues when migrating a sock") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: David S. Miller Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman --- net/sctp/socket.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -185,13 +185,13 @@ static void sctp_for_each_tx_datachunk(s list_for_each_entry(chunk, &t->transmitted, transmitted_list) cb(chunk); - list_for_each_entry(chunk, &q->retransmit, list) + list_for_each_entry(chunk, &q->retransmit, transmitted_list) cb(chunk); - list_for_each_entry(chunk, &q->sacked, list) + list_for_each_entry(chunk, &q->sacked, transmitted_list) cb(chunk); - list_for_each_entry(chunk, &q->abandoned, list) + list_for_each_entry(chunk, &q->abandoned, transmitted_list) cb(chunk); list_for_each_entry(chunk, &q->out_chunk_list, list) From patchwork Fri May 1 13:21:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226693 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8EC1EC47253 for ; Fri, 1 May 2020 13:27:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 640082173E for ; Fri, 1 May 2020 13:27:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339635; bh=baC/hUKXrxs/tjNcbhgr2gs9AikJqaDGQ8pWgO2QMMI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=siZ0rSI74rqDwklURh2jq7yCEpCIFB9aC/UM4Yn8E1MZTPwv1w1fuhuiAO5q/M6/N JI2VJiIHHQAJhvZWFXdMxGryUxmlhBfA8jA/K43RjEQ+uHoDoUT11vSFplPR+N2bUG 7ZKQO657aBwygyt3qiTRSCN3w/EVnHGJd2WQSv8I= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728914AbgEAN1O (ORCPT ); Fri, 1 May 2020 09:27:14 -0400 Received: from mail.kernel.org ([198.145.29.99]:49366 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729425AbgEAN1N (ORCPT ); Fri, 1 May 2020 09:27:13 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 73442208D6; Fri, 1 May 2020 13:27:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339632; bh=baC/hUKXrxs/tjNcbhgr2gs9AikJqaDGQ8pWgO2QMMI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iQbyZSMG6HqgvUIFrz/tGFufjuY5fNxaMAjjKJ/udNpgUJcccRb54QWmZAm4Qg8L7 ks95qPcVzv5x3R9qVYDCL4zWxnlv4IdB4mm1TZASR7KYPddQweuA+z5s1Iw8oiuhxi +c7ZocvGu9569sxp1oE/MsiJgdppNY4mf0x3L+rU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miklos Szeredi , Guenter Roeck Subject: [PATCH 4.4 56/70] fuse: fix possibly missed wake-up after abort Date: Fri, 1 May 2020 15:21:44 +0200 Message-Id: <20200501131530.296926543@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Miklos Szeredi commit 2d84a2d19b6150c6dbac1e6ebad9c82e4c123772 upstream. In current fuse_drop_waiting() implementation it's possible that fuse_wait_aborted() will not be woken up in the unlikely case that fuse_abort_conn() + fuse_wait_aborted() runs in between checking fc->connected and calling atomic_dec(&fc->num_waiting). Do the atomic_dec_and_test() unconditionally, which also provides the necessary barrier against reordering with the fc->connected check. The explicit smp_mb() in fuse_wait_aborted() is not actually needed, since the spin_unlock() in fuse_abort_conn() provides the necessary RELEASE barrier after resetting fc->connected. However, this is not a performance sensitive path, and adding the explicit barrier makes it easier to document. Signed-off-by: Miklos Szeredi Fixes: b8f95e5d13f5 ("fuse: umount should wait for all requests") Cc: #v4.19 Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman --- fs/fuse/dev.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -145,9 +145,13 @@ static bool fuse_block_alloc(struct fuse static void fuse_drop_waiting(struct fuse_conn *fc) { - if (fc->connected) { - atomic_dec(&fc->num_waiting); - } else if (atomic_dec_and_test(&fc->num_waiting)) { + /* + * lockess check of fc->connected is okay, because atomic_dec_and_test() + * provides a memory barrier mached with the one in fuse_wait_aborted() + * to ensure no wake-up is missed. + */ + if (atomic_dec_and_test(&fc->num_waiting) && + !READ_ONCE(fc->connected)) { /* wake up aborters */ wake_up_all(&fc->blocked_waitq); } @@ -2222,6 +2226,8 @@ EXPORT_SYMBOL_GPL(fuse_abort_conn); void fuse_wait_aborted(struct fuse_conn *fc) { + /* matches implicit memory barrier in fuse_drop_waiting() */ + smp_mb(); wait_event(fc->blocked_waitq, atomic_read(&fc->num_waiting) == 0); } From patchwork Fri May 1 13:21:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226477 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 793F4C47253 for ; Fri, 1 May 2020 14:00:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 483C7206D9 for ; Fri, 1 May 2020 14:00:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341630; bh=mOL8kwx0fJd6+yTK39aLKxU65pkth2YFc6ofJzLg4Hk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=MbQbKAaj4K+BleFUNdz/lAm/MzrODGP8e6MLMj1LgSxyOVa7WKBPflvV5bcczVAq0 5rHbJKK5UtuYElsby34OScD795X8Rrd7assqsVHXbQGnea9Z9Id+TVTI0TVpPjy0+Y fZ6u760xJNPk+CUI2RtdE6ilEZGDuL/lBjE50uaQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728923AbgEAN1V (ORCPT ); Fri, 1 May 2020 09:27:21 -0400 Received: from mail.kernel.org ([198.145.29.99]:49496 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729436AbgEAN1S (ORCPT ); Fri, 1 May 2020 09:27:18 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5FAD32166E; Fri, 1 May 2020 13:27:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339637; bh=mOL8kwx0fJd6+yTK39aLKxU65pkth2YFc6ofJzLg4Hk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TuGYznY5ypPFz5busYAnuOPXTcp0ZRaHzRQn/aIRzqxN5ZEqB/RVhIp5JMDenTJxK /zn9jSMeEEwQbUA2ucYMd6g3PKCEwWFf9Cm59ZNqId9ZvuENEXbvn69CkOUcgJHFES jVs6O9O9KW+uIRh0oSZOofqh3PTVPRVnDHEJtCko= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor , Felipe Balbi Subject: [PATCH 4.4 58/70] usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete Date: Fri, 1 May 2020 15:21:46 +0200 Message-Id: <20200501131530.923569359@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Nathan Chancellor commit 09b04abb70f096333bef6bc95fa600b662e7ee13 upstream. When building with Clang + -Wtautological-pointer-compare: drivers/usb/gadget/udc/bdc/bdc_ep.c:543:28: warning: comparison of address of 'req->queue' equal to a null pointer is always false [-Wtautological-pointer-compare] if (req == NULL || &req->queue == NULL || &req->usb_req == NULL) ~~~~~^~~~~ ~~~~ drivers/usb/gadget/udc/bdc/bdc_ep.c:543:51: warning: comparison of address of 'req->usb_req' equal to a null pointer is always false [-Wtautological-pointer-compare] if (req == NULL || &req->queue == NULL || &req->usb_req == NULL) ~~~~~^~~~~~~ ~~~~ 2 warnings generated. As it notes, these statements will always evaluate to false so remove them. Fixes: efed421a94e6 ("usb: gadget: Add UDC driver for Broadcom USB3.0 device controller IP BDC") Link: https://github.com/ClangBuiltLinux/linux/issues/749 Signed-off-by: Nathan Chancellor Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/udc/bdc/bdc_ep.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/gadget/udc/bdc/bdc_ep.c +++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c @@ -546,7 +546,7 @@ static void bdc_req_complete(struct bdc_ { struct bdc *bdc = ep->bdc; - if (req == NULL || &req->queue == NULL || &req->usb_req == NULL) + if (req == NULL) return; dev_dbg(bdc->dev, "%s ep:%s status:%d\n", __func__, ep->name, status); From patchwork Fri May 1 13:21:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226692 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5BD8C47254 for ; Fri, 1 May 2020 13:27:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8825D20757 for ; Fri, 1 May 2020 13:27:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339649; bh=oN4xXc//JXVyLYe37q429CpdJ1zd5XafytMl0uRgsEU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=OEMUcRae6nsQ9tFTYwxho3v4KcbtgKQLWHuYp/vVJHIG99u41lwHm1b+ybqwkvAj9 qBWVTWuyPE2x9KU0OESoRTM98+/X5h8WyJUK2SX+b9NDFJ4JgTA0B+7zI3CIMvDCFS wVwmMtqP9oGgkjJ6JFoFTcsL8/zIg9yO2mfSbGK4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728946AbgEAN12 (ORCPT ); Fri, 1 May 2020 09:27:28 -0400 Received: from mail.kernel.org ([198.145.29.99]:49790 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729462AbgEAN12 (ORCPT ); Fri, 1 May 2020 09:27:28 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 274D12166E; Fri, 1 May 2020 13:27:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339647; bh=oN4xXc//JXVyLYe37q429CpdJ1zd5XafytMl0uRgsEU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XvDDWkxd04b0EJiZF+jj6OEI0VW0o1ca6ppnrBtKmHsPIjfQ8jAu4KiogmjlGClIU ytPo1r2mtYYc1FQ1v9FiSFaET9nbNfhu3s8hOuUKkF9yVWkNKyCMFNgDULXKRxWYV/ vpBmHPGiuIg4oVnaqZhuTbwScy5KLZcbFr/4h714= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bodo Stroesser , Mike Christie , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.4 62/70] scsi: target: fix PR IN / READ FULL STATUS for FC Date: Fri, 1 May 2020 15:21:50 +0200 Message-Id: <20200501131531.563955312@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Bodo Stroesser [ Upstream commit 8fed04eb79a74cbf471dfaa755900a51b37273ab ] Creation of the response to READ FULL STATUS fails for FC based reservations. Reason is the too high loop limit (< 24) in fc_get_pr_transport_id(). The string representation of FC WWPN is 23 chars long only ("11:22:33:44:55:66:77:88"). So when i is 23, the loop body is executed a last time for the ending '\0' of the string and thus hex2bin() reports an error. Link: https://lore.kernel.org/r/20200408132610.14623-3-bstroesser@ts.fujitsu.com Signed-off-by: Bodo Stroesser Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/target/target_core_fabric_lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/target/target_core_fabric_lib.c b/drivers/target/target_core_fabric_lib.c index 6e75095af6818..2ecb2f7042a13 100644 --- a/drivers/target/target_core_fabric_lib.c +++ b/drivers/target/target_core_fabric_lib.c @@ -75,7 +75,7 @@ static int fc_get_pr_transport_id( * encoded TransportID. */ ptr = &se_nacl->initiatorname[0]; - for (i = 0; i < 24; ) { + for (i = 0; i < 23; ) { if (!strncmp(&ptr[i], ":", 1)) { i++; continue; From patchwork Fri May 1 13:21:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226478 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 238FEC4724C for ; Fri, 1 May 2020 14:00:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E70B2206D6 for ; Fri, 1 May 2020 14:00:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341625; bh=GqiAjsB0umloZVqaiehWJl9SaeTz4QMV4YkOimw4U6U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=It9KnOgKIMiYZZJYH1K7jYn7nhpJQN/CKOlgMN9iRGpHzEagyo56/R5oGtYvNLU/u EKcIQswzmhL8b5UwSNYCmQIqUTY0tw2HKYYVHbFksFrBTLMzKm3HpJNkjUqAVgEclN CjW1+5qwreQp8U+F/Xiv0B7tB9KjMHyVzZeKt9cw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729462AbgEAN1c (ORCPT ); Fri, 1 May 2020 09:27:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:49864 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728947AbgEAN1a (ORCPT ); Fri, 1 May 2020 09:27:30 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9ED9424953; Fri, 1 May 2020 13:27:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339650; bh=GqiAjsB0umloZVqaiehWJl9SaeTz4QMV4YkOimw4U6U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=f5agDgExmrnhM8rqsa2yW2N64bej4DJMXB5TQOu5/0wQMP8hLq3Ony39CGLXkfLJD zJQQE1r7/wrFHmej3hrAQbf1v4SC8ZcJLVison8BAm3artvws2zRzYZVkK1mxjkEWF tqxgIpK53aCgzNqWp+ds+D2cl0ATyxNNT3UDkg0g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Juergen Gross , Wei Liu , Sasha Levin Subject: [PATCH 4.4 63/70] xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status Date: Fri, 1 May 2020 15:21:51 +0200 Message-Id: <20200501131531.787932427@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Juergen Gross [ Upstream commit 6b51fd3f65a22e3d1471b18a1d56247e246edd46 ] xenbus_map_ring_valloc() maps a ring page and returns the status of the used grant (0 meaning success). There are Xen hypervisors which might return the value 1 for the status of a failed grant mapping due to a bug. Some callers of xenbus_map_ring_valloc() test for errors by testing the returned status to be less than zero, resulting in no error detected and crashing later due to a not available ring page. Set the return value of xenbus_map_ring_valloc() to GNTST_general_error in case the grant status reported by Xen is greater than zero. This is part of XSA-316. Signed-off-by: Juergen Gross Reviewed-by: Wei Liu Link: https://lore.kernel.org/r/20200326080358.1018-1-jgross@suse.com Signed-off-by: Juergen Gross Signed-off-by: Sasha Levin --- drivers/xen/xenbus/xenbus_client.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c index 056da6ee1a357..df27cefb2fa35 100644 --- a/drivers/xen/xenbus/xenbus_client.c +++ b/drivers/xen/xenbus/xenbus_client.c @@ -469,7 +469,14 @@ EXPORT_SYMBOL_GPL(xenbus_free_evtchn); int xenbus_map_ring_valloc(struct xenbus_device *dev, grant_ref_t *gnt_refs, unsigned int nr_grefs, void **vaddr) { - return ring_ops->map(dev, gnt_refs, nr_grefs, vaddr); + int err; + + err = ring_ops->map(dev, gnt_refs, nr_grefs, vaddr); + /* Some hypervisors are buggy and can return 1. */ + if (err > 0) + err = GNTST_general_error; + + return err; } EXPORT_SYMBOL_GPL(xenbus_map_ring_valloc); From patchwork Fri May 1 13:21:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226694 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA365C4724C for ; Fri, 1 May 2020 13:27:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BEF3824963 for ; Fri, 1 May 2020 13:27:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339627; bh=6ztxaQqiGIA1m1sIcnvYH1NX9Mz0deoFS5BI/XcdXkY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=wnAHKd1bkZTRLKI4GuAq/Ktkg5Q4gfjJ1vsMvSRa+ojPEMJco3KUqSFZUJOeaLQwy 9JIflXz6Q0ynOE+gm2VKJMappwHMYtJlNHOQVaQ2IUqFRYH3CYNFqHkYNNUKtHDYWS E2u5w0QB6rz56AXW71kVYCHhLhVbF2bsyrUU/vQQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729396AbgEAN1G (ORCPT ); Fri, 1 May 2020 09:27:06 -0400 Received: from mail.kernel.org ([198.145.29.99]:49188 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729392AbgEAN1G (ORCPT ); Fri, 1 May 2020 09:27:06 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2FD37208D6; Fri, 1 May 2020 13:27:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339625; bh=6ztxaQqiGIA1m1sIcnvYH1NX9Mz0deoFS5BI/XcdXkY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hnemTW6dVImfZ+WDfFb+iZR264K/4CMfNpohGbUD5S6n0vJEPYn2oW0wTEj49Qm1O IKuZAtZewe4iU+bTmN8gYuPwddNG38LyxPtXnfThjvMSnrebgvBHNEicKWqdRefS0z 4Tk/08rvJNmuNkX0IU0XLNm876UePZR2z/hzRZCE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Erhard F." , Frank Rowand , Rob Herring , Sasha Levin Subject: [PATCH 4.4 65/70] of: unittest: kmemleak on changeset destroy Date: Fri, 1 May 2020 15:21:53 +0200 Message-Id: <20200501131532.508180734@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Frank Rowand [ Upstream commit b3fb36ed694b05738d45218ea72cf7feb10ce2b1 ] kmemleak reports several memory leaks from devicetree unittest. This is the fix for problem 1 of 5. of_unittest_changeset() reaches deeply into the dynamic devicetree functions. Several nodes were left with an elevated reference count and thus were not properly cleaned up. Fix the reference counts so that the memory will be freed. Fixes: 201c910bd689 ("of: Transactional DT support.") Reported-by: Erhard F. Signed-off-by: Frank Rowand Signed-off-by: Rob Herring Signed-off-by: Sasha Levin --- drivers/of/unittest.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c index 91e6891b777b6..109497dbfba08 100644 --- a/drivers/of/unittest.c +++ b/drivers/of/unittest.c @@ -544,6 +544,10 @@ static void __init of_unittest_changeset(void) mutex_unlock(&of_mutex); of_changeset_destroy(&chgset); + + of_node_put(n1); + of_node_put(n2); + of_node_put(n21); #endif } From patchwork Fri May 1 13:21:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226476 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42BD7C47253 for ; Fri, 1 May 2020 14:00:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1E43C2051A for ; Fri, 1 May 2020 14:00:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588341637; bh=06WB4Sn8XRHbJuL4eKdIbrrh8LdhZBrzwa+PEZNVp3A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rm3w3M1W2DuLx4a8AFBnOnm5dQhpoSvLWsl6KyaGGP809k1DcMO7LyGUeCzg/kswl rXk/7LjVsU2kF36vS8Et2ni6djMpON5l+F1KRWBlYPMbJm1HjQA69DKDRlG6yr8Y1q YPqEtl8Zht5LUEgk/WDd+5WNCSN2bMKiz4Z25yVQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729418AbgEAN1L (ORCPT ); Fri, 1 May 2020 09:27:11 -0400 Received: from mail.kernel.org ([198.145.29.99]:49282 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728908AbgEAN1J (ORCPT ); Fri, 1 May 2020 09:27:09 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9AD9B2166E; Fri, 1 May 2020 13:27:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339628; bh=06WB4Sn8XRHbJuL4eKdIbrrh8LdhZBrzwa+PEZNVp3A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D13AigSaGpZ5W7fnna90+3TohgmOAQgPyHLyxKDrEt/Bc7kU2VA7e1MBB1QH5oFKM Nzsr/8NqCCnax9Quwx1mNuvBSqYnUiTPPdqK9JwJkQcL+lNGaHJk/aiso2VWdpTjhx YPaRW5Cha68W/ZDLilEE+ZyFjd0e1TpjiitnrW48= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Theodore Tso , stable@kernel.org, Ashwin H Subject: [PATCH 4.4 66/70] ext4: avoid declaring fs inconsistent due to invalid file handles Date: Fri, 1 May 2020 15:21:54 +0200 Message-Id: <20200501131532.839974052@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Theodore Ts'o commit 8a363970d1dc38c4ec4ad575c862f776f468d057 upstream. If we receive a file handle, either from NFS or open_by_handle_at(2), and it points at an inode which has not been initialized, and the file system has metadata checksums enabled, we shouldn't try to get the inode, discover the checksum is invalid, and then declare the file system as being inconsistent. This can be reproduced by creating a test file system via "mke2fs -t ext4 -O metadata_csum /tmp/foo.img 8M", mounting it, cd'ing into that directory, and then running the following program. #define _GNU_SOURCE #include struct handle { struct file_handle fh; unsigned char fid[MAX_HANDLE_SZ]; }; int main(int argc, char **argv) { struct handle h = {{8, 1 }, { 12, }}; open_by_handle_at(AT_FDCWD, &h.fh, O_RDONLY); return 0; } Google-Bug-Id: 120690101 Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Signed-off-by: Ashwin H Signed-off-by: Greg Kroah-Hartman --- fs/ext4/ext4.h | 15 +++++++++++++-- fs/ext4/ialloc.c | 2 +- fs/ext4/inode.c | 44 +++++++++++++++++++++++++++++++------------- fs/ext4/ioctl.c | 2 +- fs/ext4/namei.c | 4 ++-- fs/ext4/resize.c | 5 +++-- fs/ext4/super.c | 28 ++++++++++------------------ 7 files changed, 61 insertions(+), 39 deletions(-) --- a/fs/ext4/ext4.h +++ b/fs/ext4/ext4.h @@ -2497,8 +2497,19 @@ int do_journal_get_write_access(handle_t #define FALL_BACK_TO_NONDELALLOC 1 #define CONVERT_INLINE_DATA 2 -extern struct inode *ext4_iget(struct super_block *, unsigned long); -extern struct inode *ext4_iget_normal(struct super_block *, unsigned long); +typedef enum { + EXT4_IGET_NORMAL = 0, + EXT4_IGET_SPECIAL = 0x0001, /* OK to iget a system inode */ + EXT4_IGET_HANDLE = 0x0002 /* Inode # is from a handle */ +} ext4_iget_flags; + +extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, + ext4_iget_flags flags, const char *function, + unsigned int line); + +#define ext4_iget(sb, ino, flags) \ + __ext4_iget((sb), (ino), (flags), __func__, __LINE__) + extern int ext4_write_inode(struct inode *, struct writeback_control *); extern int ext4_setattr(struct dentry *, struct iattr *); extern int ext4_getattr(struct vfsmount *mnt, struct dentry *dentry, --- a/fs/ext4/ialloc.c +++ b/fs/ext4/ialloc.c @@ -1150,7 +1150,7 @@ struct inode *ext4_orphan_get(struct sup if (!ext4_test_bit(bit, bitmap_bh->b_data)) goto bad_orphan; - inode = ext4_iget(sb, ino); + inode = ext4_iget(sb, ino, EXT4_IGET_NORMAL); if (IS_ERR(inode)) { err = PTR_ERR(inode); ext4_error(sb, "couldn't read orphan inode %lu (err %d)", --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -4214,7 +4214,9 @@ static inline void ext4_iget_extra_inode EXT4_I(inode)->i_inline_off = 0; } -struct inode *ext4_iget(struct super_block *sb, unsigned long ino) +struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, + ext4_iget_flags flags, const char *function, + unsigned int line) { struct ext4_iloc iloc; struct ext4_inode *raw_inode; @@ -4227,6 +4229,18 @@ struct inode *ext4_iget(struct super_blo uid_t i_uid; gid_t i_gid; + if (((flags & EXT4_IGET_NORMAL) && + (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)) || + (ino < EXT4_ROOT_INO) || + (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))) { + if (flags & EXT4_IGET_HANDLE) + return ERR_PTR(-ESTALE); + __ext4_error(sb, function, line, + "inode #%lu: comm %s: iget: illegal inode #", + ino, current->comm); + return ERR_PTR(-EFSCORRUPTED); + } + inode = iget_locked(sb, ino); if (!inode) return ERR_PTR(-ENOMEM); @@ -4242,11 +4256,18 @@ struct inode *ext4_iget(struct super_blo raw_inode = ext4_raw_inode(&iloc); if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) { - EXT4_ERROR_INODE(inode, "root inode unallocated"); + ext4_error_inode(inode, function, line, 0, + "iget: root inode unallocated"); ret = -EFSCORRUPTED; goto bad_inode; } + if ((flags & EXT4_IGET_HANDLE) && + (raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) { + ret = -ESTALE; + goto bad_inode; + } + if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) { ei->i_extra_isize = le16_to_cpu(raw_inode->i_extra_isize); if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > @@ -4273,7 +4294,8 @@ struct inode *ext4_iget(struct super_blo } if (!ext4_inode_csum_verify(inode, raw_inode, ei)) { - EXT4_ERROR_INODE(inode, "checksum invalid"); + ext4_error_inode(inode, function, line, 0, + "iget: checksum invalid"); ret = -EFSBADCRC; goto bad_inode; } @@ -4321,7 +4343,8 @@ struct inode *ext4_iget(struct super_blo ((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32; inode->i_size = ext4_isize(raw_inode); if ((size = i_size_read(inode)) < 0) { - EXT4_ERROR_INODE(inode, "bad i_size value: %lld", size); + ext4_error_inode(inode, function, line, 0, + "iget: bad i_size value: %lld", size); ret = -EFSCORRUPTED; goto bad_inode; } @@ -4404,7 +4427,8 @@ struct inode *ext4_iget(struct super_blo ret = 0; if (ei->i_file_acl && !ext4_data_block_valid(EXT4_SB(sb), ei->i_file_acl, 1)) { - EXT4_ERROR_INODE(inode, "bad extended attribute block %llu", + ext4_error_inode(inode, function, line, 0, + "iget: bad extended attribute block %llu", ei->i_file_acl); ret = -EFSCORRUPTED; goto bad_inode; @@ -4459,7 +4483,8 @@ struct inode *ext4_iget(struct super_blo make_bad_inode(inode); } else { ret = -EFSCORRUPTED; - EXT4_ERROR_INODE(inode, "bogus i_mode (%o)", inode->i_mode); + ext4_error_inode(inode, function, line, 0, + "iget: bogus i_mode (%o)", inode->i_mode); goto bad_inode; } brelse(iloc.bh); @@ -4473,13 +4498,6 @@ bad_inode: return ERR_PTR(ret); } -struct inode *ext4_iget_normal(struct super_block *sb, unsigned long ino) -{ - if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) - return ERR_PTR(-EFSCORRUPTED); - return ext4_iget(sb, ino); -} - static int ext4_inode_blocks_set(handle_t *handle, struct ext4_inode *raw_inode, struct ext4_inode_info *ei) --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -105,7 +105,7 @@ static long swap_inode_boot_loader(struc if (!inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN)) return -EPERM; - inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO); + inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO, EXT4_IGET_SPECIAL); if (IS_ERR(inode_bl)) return PTR_ERR(inode_bl); ei_bl = EXT4_I(inode_bl); --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -1601,7 +1601,7 @@ static struct dentry *ext4_lookup(struct dentry); return ERR_PTR(-EFSCORRUPTED); } - inode = ext4_iget_normal(dir->i_sb, ino); + inode = ext4_iget(dir->i_sb, ino, EXT4_IGET_NORMAL); if (inode == ERR_PTR(-ESTALE)) { EXT4_ERROR_INODE(dir, "deleted inode referenced: %u", @@ -1646,7 +1646,7 @@ struct dentry *ext4_get_parent(struct de return ERR_PTR(-EFSCORRUPTED); } - return d_obtain_alias(ext4_iget_normal(d_inode(child)->i_sb, ino)); + return d_obtain_alias(ext4_iget(d_inode(child)->i_sb, ino, EXT4_IGET_NORMAL)); } /* --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1649,7 +1649,7 @@ int ext4_group_add(struct super_block *s "No reserved GDT blocks, can't resize"); return -EPERM; } - inode = ext4_iget(sb, EXT4_RESIZE_INO); + inode = ext4_iget(sb, EXT4_RESIZE_INO, EXT4_IGET_SPECIAL); if (IS_ERR(inode)) { ext4_warning(sb, "Error opening resize inode"); return PTR_ERR(inode); @@ -1977,7 +1977,8 @@ retry: } if (!resize_inode) - resize_inode = ext4_iget(sb, EXT4_RESIZE_INO); + resize_inode = ext4_iget(sb, EXT4_RESIZE_INO, + EXT4_IGET_SPECIAL); if (IS_ERR(resize_inode)) { ext4_warning(sb, "Error opening resize inode"); return PTR_ERR(resize_inode); --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -1022,20 +1022,11 @@ static struct inode *ext4_nfs_get_inode( { struct inode *inode; - if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO) - return ERR_PTR(-ESTALE); - if (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count)) - return ERR_PTR(-ESTALE); - - /* iget isn't really right if the inode is currently unallocated!! - * - * ext4_read_inode will return a bad_inode if the inode had been - * deleted, so we should be safe. - * + /* * Currently we don't know the generation for parent directory, so * a generation of 0 means "accept any" */ - inode = ext4_iget_normal(sb, ino); + inode = ext4_iget(sb, ino, EXT4_IGET_HANDLE); if (IS_ERR(inode)) return ERR_CAST(inode); if (generation && inode->i_generation != generation) { @@ -4036,7 +4027,7 @@ no_journal: * so we can safely mount the rest of the filesystem now. */ - root = ext4_iget(sb, EXT4_ROOT_INO); + root = ext4_iget(sb, EXT4_ROOT_INO, EXT4_IGET_SPECIAL); if (IS_ERR(root)) { ext4_msg(sb, KERN_ERR, "get root inode failed"); ret = PTR_ERR(root); @@ -4273,11 +4264,12 @@ static journal_t *ext4_get_journal(struc BUG_ON(!ext4_has_feature_journal(sb)); - /* First, test for the existence of a valid inode on disk. Bad - * things happen if we iget() an unused inode, as the subsequent - * iput() will try to delete it. */ - - journal_inode = ext4_iget(sb, journal_inum); + /* + * Test for the existence of a valid inode on disk. Bad things + * happen if we iget() an unused inode, as the subsequent iput() + * will try to delete it. + */ + journal_inode = ext4_iget(sb, journal_inum, EXT4_IGET_SPECIAL); if (IS_ERR(journal_inode)) { ext4_msg(sb, KERN_ERR, "no journal found"); return NULL; @@ -5241,7 +5233,7 @@ static int ext4_quota_enable(struct supe if (!qf_inums[type]) return -EPERM; - qf_inode = ext4_iget(sb, qf_inums[type]); + qf_inode = ext4_iget(sb, qf_inums[type], EXT4_IGET_SPECIAL); if (IS_ERR(qf_inode)) { ext4_error(sb, "Bad quota inode # %lu", qf_inums[type]); return PTR_ERR(qf_inode); From patchwork Fri May 1 13:21:56 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226690 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D130C47253 for ; Fri, 1 May 2020 13:27:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2393020757 for ; Fri, 1 May 2020 13:27:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339666; bh=HLOmRGuur+d7bxrS1mkmXhq7aO6VGkqNWulZ7KMdfTw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=mWAV8e9rVNd/3ZRTqdSe41xWrr/qUBNtndGXNuREL69hdnvuk8349QMUcZAos2E7w lSCk8EsSA/JlxTPKdVbvz/BoBlBKHkYdzHeNYqk5dNxdvA6X93m2b1S2IjBH2ZQPTM ngN4/b8r1gJcWYbxj7iDMwA4Y62jixXjgwt6TH1M= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729514AbgEAN1o (ORCPT ); Fri, 1 May 2020 09:27:44 -0400 Received: from mail.kernel.org ([198.145.29.99]:50134 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729508AbgEAN1k (ORCPT ); Fri, 1 May 2020 09:27:40 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C8A54208DB; Fri, 1 May 2020 13:27:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339660; bh=HLOmRGuur+d7bxrS1mkmXhq7aO6VGkqNWulZ7KMdfTw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Rzf1UflIgEoRqH9vzVhODqgy8nWBqP7Ve5jp6fWoT0lP1UzAbNGK+6nANKMP1AwPt fYa54ScPr9aBtMHz6YWktgKpzv796pFwe1wl2s2ctmVh/bejAFQeyML+L3v7gaMjDH UWPT1SpsHR8L+eGN0JlzA92nFUKzmdt1b/gDBtic= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Rue , Theodore Tso , Naresh Kamboju , Ashwin H Subject: [PATCH 4.4 68/70] ext4: dont perform block validity checks on the journal inode Date: Fri, 1 May 2020 15:21:56 +0200 Message-Id: <20200501131534.574938892@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Theodore Ts'o commit 0a944e8a6c66ca04c7afbaa17e22bf208a8b37f0 upstream. Since the journal inode is already checked when we added it to the block validity's system zone, if we check it again, we'll just trigger a failure. This was causing failures like this: [ 53.897001] EXT4-fs error (device sda): ext4_find_extent:909: inode #8: comm jbd2/sda-8: pblk 121667583 bad header/extent: invalid extent entries - magic f30a, entries 8, max 340(340), depth 0(0) [ 53.931430] jbd2_journal_bmap: journal block not found at offset 49 on sda-8 [ 53.938480] Aborting journal on device sda-8. ... but only if the system was under enough memory pressure that logical->physical mapping for the journal inode gets pushed out of the extent cache. (This is why it wasn't noticed earlier.) Fixes: 345c0dbf3a30 ("ext4: protect journal inode's blocks using block_validity") Reported-by: Dan Rue Signed-off-by: Theodore Ts'o Tested-by: Naresh Kamboju Signed-off-by: Ashwin H Signed-off-by: Greg Kroah-Hartman --- fs/ext4/extents.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -549,10 +549,14 @@ __read_extent_tree_block(const char *fun } if (buffer_verified(bh) && !(flags & EXT4_EX_FORCE_CACHE)) return bh; - err = __ext4_ext_check(function, line, inode, - ext_block_hdr(bh), depth, pblk); - if (err) - goto errout; + if (!ext4_has_feature_journal(inode->i_sb) || + (inode->i_ino != + le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) { + err = __ext4_ext_check(function, line, inode, + ext_block_hdr(bh), depth, pblk); + if (err) + goto errout; + } set_buffer_verified(bh); /* * If this is a leaf block, cache all of its entries From patchwork Fri May 1 13:21:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 226691 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A491C47253 for ; Fri, 1 May 2020 13:27:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2F2862166E for ; Fri, 1 May 2020 13:27:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339659; bh=0bmmoobu5JO6/P+JWnOrpzSDyd+b/gmKezvE5yBlgME=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=R1BdONOMuax18pcYM18ew7absrvNazTNm1bgEMwMKCU4VHE0R6MaE/AVx0H3mbGtY 4nXNcV+Nilkmf2y4qidS1rkhKLORWqSN2fs9B4Ele934P6gXReD+Tm9i/ElX5nONHk BV/VBoWhILsybsohUHIFpHd2oiFpjiAG5cRdMwmk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729497AbgEAN1i (ORCPT ); Fri, 1 May 2020 09:27:38 -0400 Received: from mail.kernel.org ([198.145.29.99]:49970 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729488AbgEAN1g (ORCPT ); Fri, 1 May 2020 09:27:36 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B0D92208D6; Fri, 1 May 2020 13:27:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588339655; bh=0bmmoobu5JO6/P+JWnOrpzSDyd+b/gmKezvE5yBlgME=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qdp1eN8bcbEHwdfNTll6ki+qD3t1uw2CpOGs1Ou/4rzgyiIGdbessqVgqducEPxGi RJOcYUB6Uy0Wim9uwuMUH8dGxkEYmzck95KSonY+SEAkCSSlz7p1COgpRduO+QOZ7S TLOIbK8rZ0hl7jWKXMyAT4aJpcVj8kQgHKzIf3/s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arthur Marsh , Theodore Tso , Ashwin H Subject: [PATCH 4.4 69/70] ext4: fix block validity checks for journal inodes using indirect blocks Date: Fri, 1 May 2020 15:21:57 +0200 Message-Id: <20200501131534.862556194@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200501131513.302599262@linuxfoundation.org> References: <20200501131513.302599262@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Theodore Ts'o commit 170417c8c7bb2cbbdd949bf5c443c0c8f24a203b upstream. Commit 345c0dbf3a30 ("ext4: protect journal inode's blocks using block_validity") failed to add an exception for the journal inode in ext4_check_blockref(), which is the function used by ext4_get_branch() for indirect blocks. This caused attempts to read from the ext3-style journals to fail with: [ 848.968550] EXT4-fs error (device sdb7): ext4_get_branch:171: inode #8: block 30343695: comm jbd2/sdb7-8: invalid block Fix this by adding the missing exception check. Fixes: 345c0dbf3a30 ("ext4: protect journal inode's blocks using block_validity") Reported-by: Arthur Marsh Signed-off-by: Theodore Ts'o Signed-off-by: Ashwin H Signed-off-by: Greg Kroah-Hartman --- fs/ext4/block_validity.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/fs/ext4/block_validity.c +++ b/fs/ext4/block_validity.c @@ -274,6 +274,11 @@ int ext4_check_blockref(const char *func __le32 *bref = p; unsigned int blk; + if (ext4_has_feature_journal(inode->i_sb) && + (inode->i_ino == + le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_journal_inum))) + return 0; + while (bref < p+max) { blk = le32_to_cpu(*bref++); if (blk &&