From patchwork Thu Aug 20 09:21:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265637 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E705DC433E3 for ; Thu, 20 Aug 2020 10:40:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BDFB820738 for ; Thu, 20 Aug 2020 10:40:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597920047; bh=u6dXuoPiaENmRNqE8B4CVCL/ojOT6YVvOGiNB+YjyjU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=2AnXXn1FM7JbfAcu4mqVrAwWMxreUuYZoX+INeX+x48J2LmeoZDovvVWd5Ki1UP6o 4iQA8p2nWM+JKCH4Ihr0OK0nMBy5mIN+PuO2zKNHAqWmp0BbKNTCrwUH/nSXCu38Fc xL4PX6zQ6WEy0fGk6e2QZo7QBbwzCq4iI+n50chg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726435AbgHTKkp (ORCPT ); Thu, 20 Aug 2020 06:40:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:38130 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731297AbgHTKRJ (ORCPT ); Thu, 20 Aug 2020 06:17:09 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8A0B7206DA; Thu, 20 Aug 2020 10:17:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918629; bh=u6dXuoPiaENmRNqE8B4CVCL/ojOT6YVvOGiNB+YjyjU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y+D1O7dJWMwZmXv9cKHWn7cVHxGbuAVOrdXV9b45KPbdBzSLWOXocC8fM8atT7D6F JgBnPdyLP4uqGiyAhN5ZGnRMGAna2YBrbVAWwms7AtfahuWD6btvYLUYfUtOkw81fe 5lFKEAg7pJKs3h6rG2f3OO76quQVeaSYSeiRPY3Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wei Yongjun , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 002/149] net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe() Date: Thu, 20 Aug 2020 11:21:19 +0200 Message-Id: <20200820092125.808314571@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Wei Yongjun [ Upstream commit 297a6961ffb8ff4dc66c9fbf53b924bd1dda05d5 ] platform_get_resource() may fail and return NULL, so we should better check it's return value to avoid a NULL pointer dereference a bit later in the code. This is detected by Coccinelle semantic patch. @@ expression pdev, res, n, t, e, e1, e2; @@ res = platform_get_resource(pdev, t, n); + if (!res) + return -EINVAL; ... when != res == NULL e = devm_ioremap(e1, res->start, e2); Signed-off-by: Wei Yongjun Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/phy/mdio-bcm-unimac.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/phy/mdio-bcm-unimac.c b/drivers/net/phy/mdio-bcm-unimac.c index 4bde5e728fe0a..fd8692b477c96 100644 --- a/drivers/net/phy/mdio-bcm-unimac.c +++ b/drivers/net/phy/mdio-bcm-unimac.c @@ -177,6 +177,8 @@ static int unimac_mdio_probe(struct platform_device *pdev) return -ENOMEM; r = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!r) + return -EINVAL; /* Just ioremap, as this MDIO block is usually integrated into an * Ethernet MAC controller register range From patchwork Thu Aug 20 09:21:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265710 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1D14BC433DF for ; Thu, 20 Aug 2020 10:18:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E2C722075E for ; Thu, 20 Aug 2020 10:18:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918699; bh=dLSZoe0U68+XiHw2ZjmLR1zZjUunThM8XsBc5V+pY8I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ktNcDnvqRgKJJQaF63x6jbjw2jj03B7ZlOq1fEJzNHAVCSHdkF2Mh/9gQylFh44AK 9MqxHTXxaG9Se8Uwdf0OtLnpRk1+zxic4qqldWSpPnLAZ6rKz+JYKoDIOc+zZFroLS DtljTNPMrbl8ClTxTYFQXXLUWs/8/FSiegNpxp8k= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730252AbgHTKSQ (ORCPT ); Thu, 20 Aug 2020 06:18:16 -0400 Received: from mail.kernel.org ([198.145.29.99]:39314 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731369AbgHTKRq (ORCPT ); Thu, 20 Aug 2020 06:17:46 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4CC5020658; Thu, 20 Aug 2020 10:17:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918665; bh=dLSZoe0U68+XiHw2ZjmLR1zZjUunThM8XsBc5V+pY8I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EiVq4kBqo9EvpB7OT6o7jy0vjYu4Gd6niDfUlvzcHwn5afeY6zj58HV31/fS4WP5r eJWVMQSHt1T3N/U4UgtN5ANS0Su/i+47YM7IA/Pj47XbzAA2KyTDFXXmVYhVX/oEaC t+60aYpOR2nsdinGyuDhH/Y8/wYt2IzU97b7yoks= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Navid Emamdoost , Kalle Valo , Sasha Levin Subject: [PATCH 4.4 005/149] ath9k: release allocated buffer if timed out Date: Thu, 20 Aug 2020 11:21:22 +0200 Message-Id: <20200820092125.952949273@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Navid Emamdoost [ Upstream commit 728c1e2a05e4b5fc52fab3421dce772a806612a2 ] In ath9k_wmi_cmd, the allocated network buffer needs to be released if timeout happens. Otherwise memory will be leaked. Signed-off-by: Navid Emamdoost Signed-off-by: Kalle Valo Signed-off-by: Sasha Levin --- drivers/net/wireless/ath/ath9k/wmi.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c index 8f14897ae5a33..f100533eb7adc 100644 --- a/drivers/net/wireless/ath/ath9k/wmi.c +++ b/drivers/net/wireless/ath/ath9k/wmi.c @@ -340,6 +340,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", wmi_cmd_to_name(cmd_id)); mutex_unlock(&wmi->op_mutex); + kfree_skb(skb); return -ETIMEDOUT; } From patchwork Thu Aug 20 09:21:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265643 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 12D25C433E1 for ; Thu, 20 Aug 2020 10:39:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D757420639 for ; Thu, 20 Aug 2020 10:39:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919962; bh=BlN7wP9X3mfNk+7n63+33ec50yLnjHUOxUUiaJFJXQg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=LUVkenR5r/YNQcVToKNZvoFMdsKCs/37xmVFBdNffRRGjnzWvAu7ksYM1Vju0Wvc5 rpmdBA63SshrdCU/Dn031pVnmnG+xp681DqqJgbfA66U9tQUEwOmtp4k6nc+7MhbAS SzquwH2OYcUgvbLWw5bMvzIRd0S3V8+oyUznjNxM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731213AbgHTKhl (ORCPT ); Thu, 20 Aug 2020 06:37:41 -0400 Received: from mail.kernel.org ([198.145.29.99]:40708 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731384AbgHTKSc (ORCPT ); Thu, 20 Aug 2020 06:18:32 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 40A4B20658; Thu, 20 Aug 2020 10:18:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918711; bh=BlN7wP9X3mfNk+7n63+33ec50yLnjHUOxUUiaJFJXQg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SxDijN0oUGMpWTlkoAz62RLD8+93z/jwdS/S9xqJqL3imk9PQI2AUuAylarbVy68X QIDo+PIaS+xVazUlxG6sM9DK2J6JsO4rEpScihzb1Oi1vpwErJYyKmA1bMMfM13lZF 1BjvlLtTuUXZApC17kiLXf+c61oPqpid6LZEkrKA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Steve Cohen , Daniel Vetter Subject: [PATCH 4.4 009/149] drm: hold gem reference until object is no longer accessed Date: Thu, 20 Aug 2020 11:21:26 +0200 Message-Id: <20200820092126.146437427@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Steve Cohen commit 8490d6a7e0a0a6fab5c2d82d57a3937306660864 upstream. A use-after-free in drm_gem_open_ioctl can happen if the GEM object handle is closed between the idr lookup and retrieving the size from said object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to fix this and plug the potential security hole. Signed-off-by: Steve Cohen Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/drm_gem.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -652,9 +652,6 @@ err: * @file_priv: drm file-private structure * * Open an object using the global name, returning a handle and the size. - * - * This handle (of course) holds a reference to the object, so the object - * will not go away until the handle is deleted. */ int drm_gem_open_ioctl(struct drm_device *dev, void *data, @@ -679,14 +676,15 @@ drm_gem_open_ioctl(struct drm_device *de /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ ret = drm_gem_handle_create_tail(file_priv, obj, &handle); - drm_gem_object_unreference_unlocked(obj); if (ret) - return ret; + goto err; args->handle = handle; args->size = obj->size; - return 0; +err: + drm_gem_object_unreference_unlocked(obj); + return ret; } /** From patchwork Thu Aug 20 09:21:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265648 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50791C433DF for ; Thu, 20 Aug 2020 10:37:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 248D320639 for ; Thu, 20 Aug 2020 10:37:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919837; bh=yagczh+iHj1VfsCNXZk3FCq2susSWJzKubnXov3ZVQE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ezjXD6xdA9x0hdFRqRgWfBEISEZ7zfendXoGUxzFLH8wgAiEZo1FKdCB72iOrBOKc QA01PBi+a4YDMsxHXIfI+9i9zflZEVQf3PhkXw+Sb5+tgPSY31beM1OzAhT4lDX77s AFv6kBVBRqRz+rvLVit54dd0dieaUAsROtmKDzok= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730399AbgHTKgu (ORCPT ); Thu, 20 Aug 2020 06:36:50 -0400 Received: from mail.kernel.org ([198.145.29.99]:41158 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731386AbgHTKSl (ORCPT ); Thu, 20 Aug 2020 06:18:41 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CFC842067C; Thu, 20 Aug 2020 10:18:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918714; bh=yagczh+iHj1VfsCNXZk3FCq2susSWJzKubnXov3ZVQE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=slubSfLaUdS+IzwDA09iBQbBPk4nxkKojr2FCBQ7HpUu6xoMAEmxe6u7EAnQ9xyut z0YplaiggEfnzVbUvjNk1CHXetkxtzclvhRn3HxCTDRiXRzfoK7vpM+9PSuHSDUac8 qIyBAti4PXdy5NkV9EB7polOiwdT2Q71FpWnLr5I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chao Yu , Jaegeuk Kim , Sasha Levin Subject: [PATCH 4.4 010/149] f2fs: check memory boundary by insane namelen Date: Thu, 20 Aug 2020 11:21:27 +0200 Message-Id: <20200820092126.196020416@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jaegeuk Kim [ Upstream commit 4e240d1bab1ead280ddf5eb05058dba6bbd57d10 ] If namelen is corrupted to have very long value, fill_dentries can copy wrong memory area. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Sasha Levin --- fs/f2fs/dir.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c index 92a240616f520..5411d6667781f 100644 --- a/fs/f2fs/dir.c +++ b/fs/f2fs/dir.c @@ -805,6 +805,16 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, de_name.name = d->filename[bit_pos]; de_name.len = le16_to_cpu(de->name_len); + /* check memory boundary before moving forward */ + bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len)); + if (unlikely(bit_pos > d->max)) { + f2fs_msg(F2FS_I_SB(d->inode)->sb, KERN_WARNING, + "%s: corrupted namelen=%d, run fsck to fix.", + __func__, le16_to_cpu(de->name_len)); + set_sbi_flag(F2FS_I_SB(d->inode)->sb->s_fs_info, SBI_NEED_FSCK); + return -EINVAL; + } + if (f2fs_encrypted_inode(d->inode)) { int save_len = fstr->len; int ret; @@ -829,7 +839,6 @@ bool f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, le32_to_cpu(de->ino), d_type)) return true; - bit_pos += GET_DENTRY_SLOTS(le16_to_cpu(de->name_len)); ctx->pos = start_pos + bit_pos; } return false; From patchwork Thu Aug 20 09:21:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265650 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77FBDC433E3 for ; Thu, 20 Aug 2020 10:35:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 574A9208DB for ; Thu, 20 Aug 2020 10:35:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919746; bh=lu8YdjRAoO37AzoS6BKU+m9uMfPbro2rrdOyBq4AXxA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=S1OqElKvTdNWySpa7NvHYxZFDgplfQNc/H6r8Kfd7Pa4AynnIFeJ/RqLg7P5H4w6F kYfEEmpGK3oR5jZS8Ar0raOMSn3nvv8SbCQbnRHja9qkxKAUMpUrIsywGkbbwlKzvz 1YNtDH4KPCNLEZ8EqgZFNp+83ZWdiONN5sp/eaWQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731237AbgHTKSr (ORCPT ); Thu, 20 Aug 2020 06:18:47 -0400 Received: from mail.kernel.org ([198.145.29.99]:41340 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731390AbgHTKSl (ORCPT ); Thu, 20 Aug 2020 06:18:41 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A909D2078D; Thu, 20 Aug 2020 10:18:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918719; bh=lu8YdjRAoO37AzoS6BKU+m9uMfPbro2rrdOyBq4AXxA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YKB1T7KXJPRMEOXM7N7bALIpxx7l/OVs4K0gg0GHLG5HoDKTjg7WimbMhYIWS5t8H H/rQPPyryB5ADhVxx26gOUZ2PzskZbbPKYChrmn0jK753W6sjsSuCZyArtDbGVfxrJ i04I4pnqBf+iHDnp0esKtuZQKha0jr9lJoGcUu5I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Luis Machado , Will Deacon , Russell King , Sasha Levin Subject: [PATCH 4.4 012/149] ARM: 8986/1: hw_breakpoint: Dont invoke overflow handler on uaccess watchpoints Date: Thu, 20 Aug 2020 11:21:29 +0200 Message-Id: <20200820092126.284846663@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Will Deacon [ Upstream commit eec13b42d41b0f3339dcf0c4da43734427c68620 ] Unprivileged memory accesses generated by the so-called "translated" instructions (e.g. LDRT) in kernel mode can cause user watchpoints to fire unexpectedly. In such cases, the hw_breakpoint logic will invoke the user overflow handler which will typically raise a SIGTRAP back to the current task. This is futile when returning back to the kernel because (a) the signal won't have been delivered and (b) userspace can't handle the thing anyway. Avoid invoking the user overflow handler for watchpoints triggered by kernel uaccess routines, and instead single-step over the faulting instruction as we would if no overflow handler had been installed. Cc: Fixes: f81ef4a920c8 ("ARM: 6356/1: hw-breakpoint: add ARM backend for the hw-breakpoint framework") Reported-by: Luis Machado Tested-by: Luis Machado Signed-off-by: Will Deacon Signed-off-by: Russell King Signed-off-by: Sasha Levin --- arch/arm/kernel/hw_breakpoint.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c index abcbea1ae30ba..78c6be1b27145 100644 --- a/arch/arm/kernel/hw_breakpoint.c +++ b/arch/arm/kernel/hw_breakpoint.c @@ -688,6 +688,12 @@ static void disable_single_step(struct perf_event *bp) arch_install_hw_breakpoint(bp); } +static int watchpoint_fault_on_uaccess(struct pt_regs *regs, + struct arch_hw_breakpoint *info) +{ + return !user_mode(regs) && info->ctrl.privilege == ARM_BREAKPOINT_USER; +} + static void watchpoint_handler(unsigned long addr, unsigned int fsr, struct pt_regs *regs) { @@ -747,16 +753,27 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr, } pr_debug("watchpoint fired: address = 0x%x\n", info->trigger); + + /* + * If we triggered a user watchpoint from a uaccess routine, + * then handle the stepping ourselves since userspace really + * can't help us with this. + */ + if (watchpoint_fault_on_uaccess(regs, info)) + goto step; + perf_bp_event(wp, regs); /* - * If no overflow handler is present, insert a temporary - * mismatch breakpoint so we can single-step over the - * watchpoint trigger. + * Defer stepping to the overflow handler if one is installed. + * Otherwise, insert a temporary mismatch breakpoint so that + * we can single-step over the watchpoint trigger. */ - if (!wp->overflow_handler) - enable_single_step(wp, instruction_pointer(regs)); + if (wp->overflow_handler) + goto unlock; +step: + enable_single_step(wp, instruction_pointer(regs)); unlock: rcu_read_unlock(); } From patchwork Thu Aug 20 09:21:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265638 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 076EBC433E1 for ; Thu, 20 Aug 2020 10:40:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CE4AB20738 for ; Thu, 20 Aug 2020 10:40:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597920035; bh=1IIpIrA4Hszo9m350XB8njrSAlGAYp0Vv7DBdwIc/VE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=QRsuycSw1O3KJxBYQcJOva7KqFUedAQ7OdHjlm6Q3JN/U6KoN7XiaoHnfwFr4Ow4c X3KMLjyp8pZzv77AF8uJ5VDiKAE8h5WqPkXVqJyobrA7IbiCcw4sgeLjECHgUuSvnm IpL0YzPEmFt/D6Fgzft0rfOvHn0x0hVgglbULvPU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729702AbgHTKkd (ORCPT ); Thu, 20 Aug 2020 06:40:33 -0400 Received: from mail.kernel.org ([198.145.29.99]:38416 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730853AbgHTKRS (ORCPT ); Thu, 20 Aug 2020 06:17:18 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E05CC206DA; Thu, 20 Aug 2020 10:17:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918637; bh=1IIpIrA4Hszo9m350XB8njrSAlGAYp0Vv7DBdwIc/VE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mxHpSBisdjT0amXeLxt2NgGlJJosrMmjzR+jxpAXRjzdxZWtgAfF31ip7JwPyehLS l0eoIcA5ixTLL6QNNQ9DxSjnMv4i1DP1LwJGP/fMSeRAbJy6SmcDCAeewHMti0xsZW kZCbYrOzSKIF6oPjfO0EY7D94VvBDurWruj9KEeY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tetsuo Handa , Daniel Vetter , Sasha Levin , syzbot Subject: [PATCH 4.4 013/149] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins. Date: Thu, 20 Aug 2020 11:21:30 +0200 Message-Id: <20200820092126.334320645@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tetsuo Handa [ Upstream commit 033724d6864245a11f8e04c066002e6ad22b3fd0 ] syzbot is reporting general protection fault in bitfill_aligned() [1] caused by integer underflow in bit_clear_margins(). The cause of this problem is when and how do_vc_resize() updates vc->vc_{cols,rows}. If vc_do_resize() fails (e.g. kzalloc() fails) when var.xres or var.yres is going to shrink, vc->vc_{cols,rows} will not be updated. This allows bit_clear_margins() to see info->var.xres < (vc->vc_cols * cw) or info->var.yres < (vc->vc_rows * ch). Unexpectedly large rw or bh will try to overrun the __iomem region and causes general protection fault. Also, vc_resize(vc, 0, 0) does not set vc->vc_{cols,rows} = 0 due to new_cols = (cols ? cols : vc->vc_cols); new_rows = (lines ? lines : vc->vc_rows); exception. Since cols and lines are calculated as cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); cols /= vc->vc_font.width; rows /= vc->vc_font.height; vc_resize(vc, cols, rows); in fbcon_modechanged(), var.xres < vc->vc_font.width makes cols = 0 and var.yres < vc->vc_font.height makes rows = 0. This means that const int fd = open("/dev/fb0", O_ACCMODE); struct fb_var_screeninfo var = { }; ioctl(fd, FBIOGET_VSCREENINFO, &var); var.xres = var.yres = 1; ioctl(fd, FBIOPUT_VSCREENINFO, &var); easily reproduces integer underflow bug explained above. Of course, callers of vc_resize() are not handling vc_do_resize() failure is bad. But we can't avoid vc_resize(vc, 0, 0) which returns 0. Therefore, as a band-aid workaround, this patch checks integer underflow in "struct fbcon_ops"->clear_margins call, assuming that vc->vc_cols * vc->vc_font.width and vc->vc_rows * vc->vc_font.heigh do not cause integer overflow. [1] https://syzkaller.appspot.com/bug?id=a565882df74fa76f10d3a6fec4be31098dbb37c6 Reported-and-tested-by: syzbot Signed-off-by: Tetsuo Handa Acked-by: Daniel Vetter Cc: stable Link: https://lore.kernel.org/r/20200715015102.3814-1-penguin-kernel@I-love.SAKURA.ne.jp Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/video/console/bitblit.c | 4 ++-- drivers/video/console/fbcon_ccw.c | 4 ++-- drivers/video/console/fbcon_cw.c | 4 ++-- drivers/video/console/fbcon_ud.c | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c index dbfe4eecf12e5..05d1d36a56654 100644 --- a/drivers/video/console/bitblit.c +++ b/drivers/video/console/bitblit.c @@ -216,7 +216,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, region.color = 0; region.rop = ROP_COPY; - if (rw && !bottom_only) { + if ((int) rw > 0 && !bottom_only) { region.dx = info->var.xoffset + rs; region.dy = 0; region.width = rw; @@ -224,7 +224,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info, info->fbops->fb_fillrect(info, ®ion); } - if (bh) { + if ((int) bh > 0) { region.dx = info->var.xoffset; region.dy = info->var.yoffset + bs; region.width = rs; diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c index 5a3cbf6dff4d9..34da8bba9273a 100644 --- a/drivers/video/console/fbcon_ccw.c +++ b/drivers/video/console/fbcon_ccw.c @@ -201,7 +201,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, region.color = 0; region.rop = ROP_COPY; - if (rw && !bottom_only) { + if ((int) rw > 0 && !bottom_only) { region.dx = 0; region.dy = info->var.yoffset; region.height = rw; @@ -209,7 +209,7 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info, info->fbops->fb_fillrect(info, ®ion); } - if (bh) { + if ((int) bh > 0) { region.dx = info->var.xoffset + bs; region.dy = 0; region.height = info->var.yres_virtual; diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c index e7ee44db4e98b..0b552b3fc22ab 100644 --- a/drivers/video/console/fbcon_cw.c +++ b/drivers/video/console/fbcon_cw.c @@ -184,7 +184,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, region.color = 0; region.rop = ROP_COPY; - if (rw && !bottom_only) { + if ((int) rw > 0 && !bottom_only) { region.dx = 0; region.dy = info->var.yoffset + rs; region.height = rw; @@ -192,7 +192,7 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info, info->fbops->fb_fillrect(info, ®ion); } - if (bh) { + if ((int) bh > 0) { region.dx = info->var.xoffset; region.dy = info->var.yoffset; region.height = info->var.yres; diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c index 19e3714abfe8f..7f62efe2da526 100644 --- a/drivers/video/console/fbcon_ud.c +++ b/drivers/video/console/fbcon_ud.c @@ -231,7 +231,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, region.color = 0; region.rop = ROP_COPY; - if (rw && !bottom_only) { + if ((int) rw > 0 && !bottom_only) { region.dy = 0; region.dx = info->var.xoffset; region.width = rw; @@ -239,7 +239,7 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info, info->fbops->fb_fillrect(info, ®ion); } - if (bh) { + if ((int) bh > 0) { region.dy = info->var.yoffset; region.dx = info->var.xoffset; region.height = bh; From patchwork Thu Aug 20 09:21:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265639 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54998C433E1 for ; Thu, 20 Aug 2020 10:40:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1F24F20738 for ; Thu, 20 Aug 2020 10:40:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597920033; bh=QG+9dxGsIKi3If5pONGdBxr2CB5gnvr30BE7fpx6EuY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=15ErrEkgJTtpj8CAkI8+7IotrFEwLp1kVfG+KotHAO/j9s35IGNM64OKD3WaDADjE XG1pbpjtbjYLhSMNBYSsEtdTvzv/LgjED6YiFdzONmfSUDq/sGPFcSE5sl6ZWj6J6x Vn9uYi/ji9kXMi0jJE/AMDi8jjKRoWu/u8qaigSs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728400AbgHTKRw (ORCPT ); Thu, 20 Aug 2020 06:17:52 -0400 Received: from mail.kernel.org ([198.145.29.99]:38698 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731021AbgHTKR0 (ORCPT ); Thu, 20 Aug 2020 06:17:26 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DD24E208E4; Thu, 20 Aug 2020 10:17:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918645; bh=QG+9dxGsIKi3If5pONGdBxr2CB5gnvr30BE7fpx6EuY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rSoGie0pqKm+gx3YR8jRgMWto/pHDD60bwOYq875wPS/ybMYox+M4YDPKxWvfa1Tz Oy7PoiRgO/9yof1HlWnuggb788l82eSaZ4VzEQRiCcLbMdYc+forcDcMggkaPbBcYK N5eaXa3FRmQTo/TcM0hIeDA7QWlBkTyUgvF35rOE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+6db548b615e5aeefdce2@syzkaller.appspotmail.com, YueHaibing , "David S. Miller" Subject: [PATCH 4.4 016/149] net/x25: Fix null-ptr-deref in x25_disconnect Date: Thu, 20 Aug 2020 11:21:33 +0200 Message-Id: <20200820092126.483903460@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: YueHaibing commit 8999dc89497ab1c80d0718828e838c7cd5f6bffe upstream. We should check null before do x25_neigh_put in x25_disconnect, otherwise may cause null-ptr-deref like this: #include #include int main() { int sck_x25; sck_x25 = socket(AF_X25, SOCK_SEQPACKET, 0); close(sck_x25); return 0; } BUG: kernel NULL pointer dereference, address: 00000000000000d8 CPU: 0 PID: 4817 Comm: t2 Not tainted 5.7.0-rc3+ #159 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3- RIP: 0010:x25_disconnect+0x91/0xe0 Call Trace: x25_release+0x18a/0x1b0 __sock_release+0x3d/0xc0 sock_close+0x13/0x20 __fput+0x107/0x270 ____fput+0x9/0x10 task_work_run+0x6d/0xb0 exit_to_usermode_loop+0x102/0x110 do_syscall_64+0x23c/0x260 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Reported-by: syzbot+6db548b615e5aeefdce2@syzkaller.appspotmail.com Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect") Signed-off-by: YueHaibing Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/x25/x25_subr.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/net/x25/x25_subr.c +++ b/net/x25/x25_subr.c @@ -368,10 +368,12 @@ void x25_disconnect(struct sock *sk, int sk->sk_state_change(sk); sock_set_flag(sk, SOCK_DEAD); } - read_lock_bh(&x25_list_lock); - x25_neigh_put(x25->neighbour); - x25->neighbour = NULL; - read_unlock_bh(&x25_list_lock); + if (x25->neighbour) { + read_lock_bh(&x25_list_lock); + x25_neigh_put(x25->neighbour); + x25->neighbour = NULL; + read_unlock_bh(&x25_list_lock); + } } /* From patchwork Thu Aug 20 09:21:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265711 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99C88C433E1 for ; Thu, 20 Aug 2020 10:18:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 65BAC20738 for ; Thu, 20 Aug 2020 10:18:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918696; bh=eJhFz4v4nKBgF25umfzVqWnZlZbuwOlzvVBA5wXrxhQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rvYA1JpNrzR5tfthU/06sayOcSg5njYyTqUESRMOOzO/EO0bs4SNLdvKcBb6+yqk/ sVlLb8zrfca+5I+BJpdkFxWL0YxV6PvU9fLn8rZmTZ3R8VL20CdQdIOZGOIPH0wbJR ZClcD9cn03JuCmQCr8LYk8G169xsIlHoiomKTS78= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729777AbgHTKR7 (ORCPT ); Thu, 20 Aug 2020 06:17:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:38880 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729557AbgHTKRc (ORCPT ); Thu, 20 Aug 2020 06:17:32 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E7AF12078D; Thu, 20 Aug 2020 10:17:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918651; bh=eJhFz4v4nKBgF25umfzVqWnZlZbuwOlzvVBA5wXrxhQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mW6stgRrQGisPRH7UIpVN1928gRpxj9jsmX1DYfiCOO1YJ9UJBIRg2E3mwJKY158Q JrD2+YZ2hXSynmSDZ8Y4Fhj5a9twNiwVOBUUvkw92+0jPyRzueq9mk6e2GgdG6wU/X 62KRzRNJJS0EujPeUxi+w1F7Ih+5HumtNCqw7YNk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Woojung.Huh@microchip.com" , Johan Hovold , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 018/149] net: lan78xx: add missing endpoint sanity check Date: Thu, 20 Aug 2020 11:21:35 +0200 Message-Id: <20200820092126.583678502@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johan Hovold [ Upstream commit 8d8e95fd6d69d774013f51e5f2ee10c6e6d1fc14 ] Add the missing endpoint sanity check to prevent a NULL-pointer dereference should a malicious device lack the expected endpoints. Note that the driver has a broken endpoint-lookup helper, lan78xx_get_endpoints(), which can end up accepting interfaces in an altsetting without endpoints as long as *some* altsetting has a bulk-in and a bulk-out endpoint. Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Cc: Woojung.Huh@microchip.com Signed-off-by: Johan Hovold Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/usb/lan78xx.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c index 75a3865a80d23..3f2f524c338d6 100644 --- a/drivers/net/usb/lan78xx.c +++ b/drivers/net/usb/lan78xx.c @@ -2978,6 +2978,11 @@ static int lan78xx_probe(struct usb_interface *intf, netdev->mtu = dev->hard_mtu - netdev->hard_header_len; netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER); + if (intf->cur_altsetting->desc.bNumEndpoints < 3) { + ret = -ENODEV; + goto out3; + } + dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0; dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1; dev->ep_intr = (intf->cur_altsetting)->endpoint + 2; From patchwork Thu Aug 20 09:21:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265707 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 812B9C433DF for ; Thu, 20 Aug 2020 10:19:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 55A1B20738 for ; Thu, 20 Aug 2020 10:19:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918781; bh=srXWZiN4UvRjQoGJzlyOEKNDr9gqff2/ELi12xw0MRM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=YS1X8rqQI1nvs+5VOX4m+XC/jh8fef5O0BGYYKmdIafxfnyqHxZOq7SweVU6lidHY ag+QJn3yXuXC53SRelSi83oOQrbBpEsvOk93zoiFfdKmaBwOGN1xOfWucCf6etxcQ0 7zvCgnk4SQMnCBKMWuhg7/vAQ1XW0zZyXzh8V7nA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731442AbgHTKTb (ORCPT ); Thu, 20 Aug 2020 06:19:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:38972 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731050AbgHTKRe (ORCPT ); Thu, 20 Aug 2020 06:17:34 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AFBC020885; Thu, 20 Aug 2020 10:17:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918654; bh=srXWZiN4UvRjQoGJzlyOEKNDr9gqff2/ELi12xw0MRM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xaN4BIIRiD5cCeyyFCW1uxLuIBnuXvkEHoqpqmO+mgPFIfnLoY5BgsStsN+hFiyq6 gY7AI2mSSiEMfeSoUpj5wqcppkuNuXqvbPwMPRW1p28drwGIOCOnpIYQcYyU2l0D9f WTCsVcGW23MB1FmP8Y6KZd3OdrSv8vM8+yKDSYZU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Woojung.Huh@microchip.com" , Johan Hovold , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 019/149] net: lan78xx: fix transfer-buffer memory leak Date: Thu, 20 Aug 2020 11:21:36 +0200 Message-Id: <20200820092126.635106821@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johan Hovold [ Upstream commit 63634aa679ba8b5e306ad0727120309ae6ba8a8e ] The interrupt URB transfer-buffer was never freed on disconnect or after probe errors. Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") Cc: Woojung.Huh@microchip.com Signed-off-by: Johan Hovold Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/usb/lan78xx.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c index 3f2f524c338d6..1fb5d5f3475cf 100644 --- a/drivers/net/usb/lan78xx.c +++ b/drivers/net/usb/lan78xx.c @@ -3006,6 +3006,7 @@ static int lan78xx_probe(struct usb_interface *intf, usb_fill_int_urb(dev->urb_intr, dev->udev, dev->pipe_intr, buf, maxp, intr_complete, dev, period); + dev->urb_intr->transfer_flags |= URB_FREE_BUFFER; } } From patchwork Thu Aug 20 09:21:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265642 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD825C433DF for ; Thu, 20 Aug 2020 10:39:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8394020639 for ; Thu, 20 Aug 2020 10:39:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919970; bh=gjOagStaWLs3BiWr22nlgMN5Wfv0Ptg1Vn6Tuvoxuyw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=IWNU9KA8w+v/OqDH5Qzw4pyxNzeFjlfhipqJveHysmAoM8cUL8YoacFrXSVmA900B iInupvyvk38LPj0p/n/0y9P9yS6K6cY9+6FsjqpZooprZpVK3q0OtLKDyyYcmJZ3zv ZYrmZsnhMbanXfU4LTVLCQaG0AJvPoJBUjaIsI7A= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730154AbgHTKSA (ORCPT ); Thu, 20 Aug 2020 06:18:00 -0400 Received: from mail.kernel.org ([198.145.29.99]:39152 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731346AbgHTKRk (ORCPT ); Thu, 20 Aug 2020 06:17:40 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A10E5206DA; Thu, 20 Aug 2020 10:17:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918660; bh=gjOagStaWLs3BiWr22nlgMN5Wfv0Ptg1Vn6Tuvoxuyw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=P/oBGg9CeL82LMdu1uBlv9btfyPIS2zhWBAiZD3fQnbg44/9ByV5vooNvcBVNAico Oc+vPEaogQrN5Cv7I6L+FIo2z7rGfGIJ/U93XNOCO5tOXDcEByDTNbQJ+J6iNSs+gS HVWyP3G3qKtZ4sw6AvHa0O/V3CoQ0iPJBuJmKiEM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Remi Pommarel , Johannes Berg , Sasha Levin Subject: [PATCH 4.4 021/149] mac80211: mesh: Free ie data when leaving mesh Date: Thu, 20 Aug 2020 11:21:38 +0200 Message-Id: <20200820092126.736852958@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Remi Pommarel [ Upstream commit 6a01afcf8468d3ca2bd8bbb27503f60dcf643b20 ] At ieee80211_join_mesh() some ie data could have been allocated (see copy_mesh_setup()) and need to be cleaned up when leaving the mesh. This fixes the following kmemleak report: unreferenced object 0xffff0000116bc600 (size 128): comm "wpa_supplicant", pid 608, jiffies 4294898983 (age 293.484s) hex dump (first 32 bytes): 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 0............... 00 0f ac 08 00 00 00 00 c4 65 40 00 00 00 00 00 .........e@..... backtrace: [<00000000bebe439d>] __kmalloc_track_caller+0x1c0/0x330 [<00000000a349dbe1>] kmemdup+0x28/0x50 [<0000000075d69baa>] ieee80211_join_mesh+0x6c/0x3b8 [mac80211] [<00000000683bb98b>] __cfg80211_join_mesh+0x1e8/0x4f0 [cfg80211] [<0000000072cb507f>] nl80211_join_mesh+0x520/0x6b8 [cfg80211] [<0000000077e9bcf9>] genl_family_rcv_msg+0x374/0x680 [<00000000b1bd936d>] genl_rcv_msg+0x78/0x108 [<0000000022c53788>] netlink_rcv_skb+0xb0/0x1c0 [<0000000011af8ec9>] genl_rcv+0x34/0x48 [<0000000069e41f53>] netlink_unicast+0x268/0x2e8 [<00000000a7517316>] netlink_sendmsg+0x320/0x4c0 [<0000000069cba205>] ____sys_sendmsg+0x354/0x3a0 [<00000000e06bab0f>] ___sys_sendmsg+0xd8/0x120 [<0000000037340728>] __sys_sendmsg+0xa4/0xf8 [<000000004fed9776>] __arm64_sys_sendmsg+0x44/0x58 [<000000001c1e5647>] el0_svc_handler+0xd0/0x1a0 Fixes: c80d545da3f7 (mac80211: Let userspace enable and configure vendor specific path selection.) Signed-off-by: Remi Pommarel Link: https://lore.kernel.org/r/20200704135007.27292-1-repk@triplefau.lt Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- net/mac80211/cfg.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index cf3917c6da0a6..8360fda24bca0 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -1766,6 +1766,7 @@ static int ieee80211_leave_mesh(struct wiphy *wiphy, struct net_device *dev) ieee80211_stop_mesh(sdata); mutex_lock(&sdata->local->mtx); ieee80211_vif_release_channel(sdata); + kfree(sdata->u.mesh.ie); mutex_unlock(&sdata->local->mtx); return 0; From patchwork Thu Aug 20 09:21:40 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265647 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C520CC433E1 for ; Thu, 20 Aug 2020 10:37:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9F544208DB for ; Thu, 20 Aug 2020 10:37:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919860; bh=5lM8KCwnYSYrdF78ZiUyZHdioymTZ03frSXpaWniM2Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ojs9M+hGva5bOFAVgQWDj2b9oHVWAaUeMKJYJjmktLn23SjQ/78RPz8F6hVrAEpTP hiEv2C+mbdwzWi7Em7eMRzB2Yv65N0c9HhsnKY0wEjFZ4S6xA6Qk7A0sIzu04FJqTc RaJnfmVv6KVb/JyI06/HZ/0q+obTz3cbtN/YMBRY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730027AbgHTKSS (ORCPT ); Thu, 20 Aug 2020 06:18:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:39418 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731371AbgHTKRu (ORCPT ); Thu, 20 Aug 2020 06:17:50 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7B63D2067C; Thu, 20 Aug 2020 10:17:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918669; bh=5lM8KCwnYSYrdF78ZiUyZHdioymTZ03frSXpaWniM2Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RSY4gi1OQlnngH8lih67CN8AHM4v2bVqripqhjzxI2c0wc3ZNnWkm9Dr/f7C+wOGc VpwrK2BQMoU2xGeFC2NJAvZITZL8v+hd7Trc8AQolwXHb8BXrDm9/uIy958E5WObUQ FXhOke88PPV03Szih8VRJ/yzUVcY1sLdvFdOmj5A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dirk Behme , Yoshihiro Shimoda , Sergei Shtylyov , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 023/149] net: ethernet: ravb: exit if re-initialization fails in tx timeout Date: Thu, 20 Aug 2020 11:21:40 +0200 Message-Id: <20200820092126.839451261@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Yoshihiro Shimoda [ Upstream commit 015c5d5e6aa3523c758a70eb87b291cece2dbbb4 ] According to the report of [1], this driver is possible to cause the following error in ravb_tx_timeout_work(). ravb e6800000.ethernet ethernet: failed to switch device to config mode This error means that the hardware could not change the state from "Operation" to "Configuration" while some tx and/or rx queue are operating. After that, ravb_config() in ravb_dmac_init() will fail, and then any descriptors will be not allocaled anymore so that NULL pointer dereference happens after that on ravb_start_xmit(). To fix the issue, the ravb_tx_timeout_work() should check the return values of ravb_stop_dma() and ravb_dmac_init(). If ravb_stop_dma() fails, ravb_tx_timeout_work() re-enables TX and RX and just exits. If ravb_dmac_init() fails, just exits. [1] https://lore.kernel.org/linux-renesas-soc/20200518045452.2390-1-dirk.behme@de.bosch.com/ Reported-by: Dirk Behme Signed-off-by: Yoshihiro Shimoda Reviewed-by: Sergei Shtylyov Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/ethernet/renesas/ravb_main.c | 26 ++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c index 5b6320f9c935f..460b29ac5fd86 100644 --- a/drivers/net/ethernet/renesas/ravb_main.c +++ b/drivers/net/ethernet/renesas/ravb_main.c @@ -1291,6 +1291,7 @@ static void ravb_tx_timeout_work(struct work_struct *work) struct ravb_private *priv = container_of(work, struct ravb_private, work); struct net_device *ndev = priv->ndev; + int error; netif_tx_stop_all_queues(ndev); @@ -1298,15 +1299,36 @@ static void ravb_tx_timeout_work(struct work_struct *work) ravb_ptp_stop(ndev); /* Wait for DMA stopping */ - ravb_stop_dma(ndev); + if (ravb_stop_dma(ndev)) { + /* If ravb_stop_dma() fails, the hardware is still operating + * for TX and/or RX. So, this should not call the following + * functions because ravb_dmac_init() is possible to fail too. + * Also, this should not retry ravb_stop_dma() again and again + * here because it's possible to wait forever. So, this just + * re-enables the TX and RX and skip the following + * re-initialization procedure. + */ + ravb_rcv_snd_enable(ndev); + goto out; + } ravb_ring_free(ndev, RAVB_BE); ravb_ring_free(ndev, RAVB_NC); /* Device init */ - ravb_dmac_init(ndev); + error = ravb_dmac_init(ndev); + if (error) { + /* If ravb_dmac_init() fails, descriptors are freed. So, this + * should return here to avoid re-enabling the TX and RX in + * ravb_emac_init(). + */ + netdev_err(ndev, "%s: ravb_dmac_init() failed, error %d\n", + __func__, error); + return; + } ravb_emac_init(ndev); +out: /* Initialise PTP Clock driver */ ravb_ptp_init(ndev, priv->pdev); From patchwork Thu Aug 20 09:21:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265640 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id ECB56C433E3 for ; Thu, 20 Aug 2020 10:40:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C89C720738 for ; Thu, 20 Aug 2020 10:40:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597920025; bh=FssRAtjvO9q3R2ql3sbZw5EJB0pb70GEDIhbn2tG0Gc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ylFhYZ2ugWNw2SBBCXh507vDuzlJCkbBN374x/XT8mv0qtEe+d1mBX2IIZ/DTtq5+ PmpwCKlbPVI/DQ0JxXVoQKvddMtHaOm3e8SeieXfjBEAypSBTWjXi3Lp6iyFr7D9YL LpwPF8zymL/jw7BALRYsOyW8xBAT6vt2+w3hpoug= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731684AbgHTKjc (ORCPT ); Thu, 20 Aug 2020 06:39:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:39644 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729721AbgHTKR4 (ORCPT ); Thu, 20 Aug 2020 06:17:56 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B62642067C; Thu, 20 Aug 2020 10:17:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918675; bh=FssRAtjvO9q3R2ql3sbZw5EJB0pb70GEDIhbn2tG0Gc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HM0k7QQubnvPSpgtU18u961Y1LaDEYpEHD32vrjwPVYswaGggRjzooQP5AP2EFbla Uk3TRMfhzdVLKyUoUNsFPGoftsU7JqA/rPx4/rWMkhVrrR7YInUhdRqT8gEPpuh3Kv WxkPjuVV4VMVAvRwf6OgASZKtWf9XtDxmVK2nAgA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrea Righi , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 025/149] xen-netfront: fix potential deadlock in xennet_remove() Date: Thu, 20 Aug 2020 11:21:42 +0200 Message-Id: <20200820092126.939313881@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Andrea Righi [ Upstream commit c2c633106453611be07821f53dff9e93a9d1c3f0 ] There's a potential race in xennet_remove(); this is what the driver is doing upon unregistering a network device: 1. state = read bus state 2. if state is not "Closed": 3. request to set state to "Closing" 4. wait for state to be set to "Closing" 5. request to set state to "Closed" 6. wait for state to be set to "Closed" If the state changes to "Closed" immediately after step 1 we are stuck forever in step 4, because the state will never go back from "Closed" to "Closing". Make sure to check also for state == "Closed" in step 4 to prevent the deadlock. Also add a 5 sec timeout any time we wait for the bus state to change, to avoid getting stuck forever in wait_event(). Signed-off-by: Andrea Righi Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/xen-netfront.c | 64 +++++++++++++++++++++++++++++---------------- 1 file changed, 42 insertions(+), 22 deletions(-) --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -62,6 +62,8 @@ module_param_named(max_queues, xennet_ma MODULE_PARM_DESC(max_queues, "Maximum number of queues per virtual interface"); +#define XENNET_TIMEOUT (5 * HZ) + static const struct ethtool_ops xennet_ethtool_ops; struct netfront_cb { @@ -1349,12 +1351,15 @@ static struct net_device *xennet_create_ netif_carrier_off(netdev); - xenbus_switch_state(dev, XenbusStateInitialising); - wait_event(module_wq, - xenbus_read_driver_state(dev->otherend) != - XenbusStateClosed && - xenbus_read_driver_state(dev->otherend) != - XenbusStateUnknown); + do { + xenbus_switch_state(dev, XenbusStateInitialising); + err = wait_event_timeout(module_wq, + xenbus_read_driver_state(dev->otherend) != + XenbusStateClosed && + xenbus_read_driver_state(dev->otherend) != + XenbusStateUnknown, XENNET_TIMEOUT); + } while (!err); + return netdev; exit: @@ -2166,28 +2171,43 @@ static const struct attribute_group xenn }; #endif /* CONFIG_SYSFS */ -static int xennet_remove(struct xenbus_device *dev) +static void xennet_bus_close(struct xenbus_device *dev) { - struct netfront_info *info = dev_get_drvdata(&dev->dev); - - dev_dbg(&dev->dev, "%s\n", dev->nodename); + int ret; - if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) { + if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed) + return; + do { xenbus_switch_state(dev, XenbusStateClosing); - wait_event(module_wq, - xenbus_read_driver_state(dev->otherend) == - XenbusStateClosing || - xenbus_read_driver_state(dev->otherend) == - XenbusStateUnknown); + ret = wait_event_timeout(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosing || + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosed || + xenbus_read_driver_state(dev->otherend) == + XenbusStateUnknown, + XENNET_TIMEOUT); + } while (!ret); + if (xenbus_read_driver_state(dev->otherend) == XenbusStateClosed) + return; + + do { xenbus_switch_state(dev, XenbusStateClosed); - wait_event(module_wq, - xenbus_read_driver_state(dev->otherend) == - XenbusStateClosed || - xenbus_read_driver_state(dev->otherend) == - XenbusStateUnknown); - } + ret = wait_event_timeout(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosed || + xenbus_read_driver_state(dev->otherend) == + XenbusStateUnknown, + XENNET_TIMEOUT); + } while (!ret); +} + +static int xennet_remove(struct xenbus_device *dev) +{ + struct netfront_info *info = dev_get_drvdata(&dev->dev); + xennet_bus_close(dev); xennet_disconnect_backend(info); if (info->netdev->reg_state == NETREG_REGISTERED) From patchwork Thu Aug 20 09:21:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 248020 Delivered-To: patch@linaro.org Received: by 2002:a05:6e02:522:0:0:0:0 with SMTP id h2csp1229843ils; Thu, 20 Aug 2020 03:37:53 -0700 (PDT) X-Google-Smtp-Source: ABdhPJx5Tr6Q0N27lg1xttGqTiG+xE+l8JJ/bKS6ANWXT07qbQxMYoagUINtfq+tscOhUaS+lie4 X-Received: by 2002:aa7:c983:: with SMTP id c3mr2149463edt.383.1597919873666; Thu, 20 Aug 2020 03:37:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1597919873; cv=none; d=google.com; s=arc-20160816; b=Hz3RomqbbuZGjl6g5j/OH2Pj9/z6wCGSrKs8IVaMdREHacC22NxvYgvMNYlqfu05Yg 5WKIlamyIP5EdJi45VGZEMA4+Ytjbk/QoRhDqTmPMqAe1NEW0s9EYg/AmyzMqyEBayKP bTejPQ8pmCIb15fz5tYMJL3GnlJXhTlI/XsQqY4WOE6rHsdILdD/SYBRZY8iNhJtpHTc IAl8Jki1LS4zSN4rgJ6Y/LlLBKTbnV0mxhr1xCbGDWn1wfGStcdKuAD12hFYdb9GGyzH hLcZpPuJzfZoMvc2fZi4qCGQNyN8XETwbxxRVrzMCdnlyze7eHzbBxyTY2CbuUQAnP7x gGww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=JTmLZY3YaUSQeVTrmJ1iXa5w7QTIY45VHmnwDrPFqcw=; b=B5qNO4D6b8O3mMuoJOlM09m5xl86F/U4iiggpg9eiOYsXjv/VKLsqFbnmBoNVVx3WO NoGqDyDvIkZdlpyPzDah+Eei2kwSqnHHw/Y6tbdoM5sKXV2wmI+SfYWdHIrudXG16bv2 j/wUx2Gsds9b1z9TjguUMe4CZE3HByPBLAyjwEiZPRTZ3DJ69n8iBtSEaXxLzOsnR9il 4HNM5qJgyu5ry37WqRYjoOXhy1Sp1eGK2CPETW+kjh60yZHSo0toM5P+jq3yRSArsy95 ewAVdR4i4dRPgcXooQ3Mo8XKMpKn9PgCnwjbQjXt2rdBWnCNMZ6xsUJGzVERh2uBhRSD +ksQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Ue0o29Gh; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id rs22si899408ejb.751.2020.08.20.03.37.53; Thu, 20 Aug 2020 03:37:53 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=Ue0o29Gh; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731900AbgHTKhv (ORCPT + 15 others); Thu, 20 Aug 2020 06:37:51 -0400 Received: from mail.kernel.org ([198.145.29.99]:39982 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729431AbgHTKSD (ORCPT ); Thu, 20 Aug 2020 06:18:03 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C25872075E; Thu, 20 Aug 2020 10:18:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918683; bh=ysS3LGq+470SGw6FYTetlB33DoPN5s8hyLYUhLe+03M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ue0o29GhUEi+Q58BNHYkWZQorx1BilbieEr+s42tIZwgslRxN3kuUa/IpU19oE+W3 BB6b8f1xo4TbwkZQILYvF+Ml4gQQG+Fw+VIP4ch6oSfF8KCKiXVtgI3+j2A0JGXSIp urFRiOiKlRqYL6wk5+PYENOZ7qNeRDGOY1PcK6X4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Grygorii Strashko , Linus Torvalds Subject: [PATCH 4.4 028/149] ARM: percpu.h: fix build error Date: Thu, 20 Aug 2020 11:21:45 +0200 Message-Id: <20200820092127.086482863@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Grygorii Strashko commit aa54ea903abb02303bf55855fb51e3fcee135d70 upstream. Fix build error for the case: defined(CONFIG_SMP) && !defined(CONFIG_CPU_V6) config: keystone_defconfig CC arch/arm/kernel/signal.o In file included from ../include/linux/random.h:14, from ../arch/arm/kernel/signal.c:8: ../arch/arm/include/asm/percpu.h: In function ‘__my_cpu_offset’: ../arch/arm/include/asm/percpu.h:29:34: error: ‘current_stack_pointer’ undeclared (first use in this function); did you mean ‘user_stack_pointer’? : "Q" (*(const unsigned long *)current_stack_pointer)); ^~~~~~~~~~~~~~~~~~~~~ user_stack_pointer Fixes: f227e3ec3b5c ("random32: update the net random state on interrupt and activity") Signed-off-by: Grygorii Strashko Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- arch/arm/include/asm/percpu.h | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/arm/include/asm/percpu.h +++ b/arch/arm/include/asm/percpu.h @@ -16,6 +16,8 @@ #ifndef _ASM_ARM_PERCPU_H_ #define _ASM_ARM_PERCPU_H_ +#include + /* * Same as asm-generic/percpu.h, except that we store the per cpu offset * in the TPIDRPRW. TPIDRPRW only exists on V6K and V7 From patchwork Thu Aug 20 09:21:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265641 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A3D2C433E5 for ; Thu, 20 Aug 2020 10:39:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E3AB020639 for ; Thu, 20 Aug 2020 10:39:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919976; bh=kDdwbS0exRe8DN8NFeJJvNMhH9H4vGfMaNa4HNDdiIg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=E6HZVX+vlldZJGd9pPlR81IYe/XZFWuZDnBE+UJF+lgSp3uGelzSd5WExxdHWIwQZ Pa0i4Flsk8MEcgJQXokxaMQCgv1A7hPEIm8FxMHTma6RzYV1/Q+lH5gapuvjb095yb n+x1+ocDVV3Ar+Lr+Uo/Cq4yJYNxSHnvmvHSh2Oc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731833AbgHTKjd (ORCPT ); Thu, 20 Aug 2020 06:39:33 -0400 Received: from mail.kernel.org ([198.145.29.99]:40070 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729150AbgHTKSG (ORCPT ); Thu, 20 Aug 2020 06:18:06 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1EDB12078D; Thu, 20 Aug 2020 10:18:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918685; bh=kDdwbS0exRe8DN8NFeJJvNMhH9H4vGfMaNa4HNDdiIg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JUOOGsL8eqQ23F1bvQHKB6LSAUobUb0ZxBZSn3yZLRoPZvsHXOtTyW88NLR2Gs92G obzTmliXQhgwG7p2F/T5u9LwIwOWEmnWN0k2X26lEcfRX08zG3UX3/Iw3zC1wgPyL9 /Bd0B1vIwspYALJzqAV+F9/lACT6GSwKlLaLD6Gc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?q?Daniel_D=C3=ADaz?= , Kees Cook , Marc Zyngier , Stephen Rothwell , Willy Tarreau , Linus Torvalds Subject: [PATCH 4.4 029/149] random: fix circular include dependency on arm64 after addition of percpu.h Date: Thu, 20 Aug 2020 11:21:46 +0200 Message-Id: <20200820092127.135521257@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Willy Tarreau commit 1c9df907da83812e4f33b59d3d142c864d9da57f upstream. Daniel Díaz and Kees Cook independently reported that commit f227e3ec3b5c ("random32: update the net random state on interrupt and activity") broke arm64 due to a circular dependency on include files since the addition of percpu.h in random.h. The correct fix would definitely be to move all the prandom32 stuff out of random.h but for backporting, a smaller solution is preferred. This one replaces linux/percpu.h with asm/percpu.h, and this fixes the problem on x86_64, arm64, arm, and mips. Note that moving percpu.h around didn't change anything and that removing it entirely broke differently. When backporting, such options might still be considered if this patch fails to help. [ It turns out that an alternate fix seems to be to just remove the troublesome remove from the arm64 that causes the circular dependency. But we might as well do the whole belt-and-suspenders thing, and minimize inclusion in too. Either will fix the problem, and both are good changes. - Linus ] Reported-by: Daniel Díaz Reported-by: Kees Cook Tested-by: Marc Zyngier Fixes: f227e3ec3b5c Cc: Stephen Rothwell Signed-off-by: Willy Tarreau Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- include/linux/random.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/linux/random.h +++ b/include/linux/random.h @@ -8,7 +8,7 @@ #include #include -#include +#include #include From patchwork Thu Aug 20 09:21:49 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265645 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6733C433DF for ; Thu, 20 Aug 2020 10:37:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 849C320738 for ; Thu, 20 Aug 2020 10:37:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919869; bh=rfMiASGSx58XJPh1zF0sigUURaSiA2gayp+U4ZjW1ek=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ocuTkbK99409qOSvak2THxMapHdboTaCq9/BJOZqbTjiRmqAs0bVPuTyQhg8/sZ+q njTQUeTsEP2OF2Y4Cw3L3SgTJ/3lB7C+WN6jJl+/1HjK/uHcw7fJbzVnpEsj5ZylYH jSZL8wuubBxdy8507v6Y9RcH16f/kx+vD+XoNe5w= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731894AbgHTKho (ORCPT ); Thu, 20 Aug 2020 06:37:44 -0400 Received: from mail.kernel.org ([198.145.29.99]:40394 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730217AbgHTKSQ (ORCPT ); Thu, 20 Aug 2020 06:18:16 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A700620855; Thu, 20 Aug 2020 10:18:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918693; bh=rfMiASGSx58XJPh1zF0sigUURaSiA2gayp+U4ZjW1ek=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ScNhGSwA46j951oHd9m+BWz4p+QO+2jImOWvaA2pNRb+D6m1Lgg4l9BIdOTkA199W uHJq8m6Y8MOfN4/xaML56tIZFyzILKMfAoRIrHwzfrMk1G8t/QTeOMSlN5UPEDEX5O SP94MvXTAe1CYpar0wGNsrFSnGxxgPeHuL5tiHmw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jan Kara , Wang Long , Jiang Ying Subject: [PATCH 4.4 032/149] ext4: fix direct I/O read error Date: Thu, 20 Aug 2020 11:21:49 +0200 Message-Id: <20200820092127.280183140@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jiang Ying This patch is used to fix ext4 direct I/O read error when the read size is not aligned with block size. Then, I will use a test to explain the error. (1) Make a file that is not aligned with block size: $dd if=/dev/zero of=./test.jar bs=1000 count=3 (2) I wrote a source file named "direct_io_read_file.c" as following: #include #include #include #include #include #include #include #define BUF_SIZE 1024 int main() { int fd; int ret; unsigned char *buf; ret = posix_memalign((void **)&buf, 512, BUF_SIZE); if (ret) { perror("posix_memalign failed"); exit(1); } fd = open("./test.jar", O_RDONLY | O_DIRECT, 0755); if (fd < 0){ perror("open ./test.jar failed"); exit(1); } do { ret = read(fd, buf, BUF_SIZE); printf("ret=%d\n",ret); if (ret < 0) { perror("write test.jar failed"); } } while (ret > 0); free(buf); close(fd); } (3) Compile the source file: $gcc direct_io_read_file.c -D_GNU_SOURCE (4) Run the test program: $./a.out The result is as following: ret=1024 ret=1024 ret=952 ret=-1 write test.jar failed: Invalid argument. I have tested this program on XFS filesystem, XFS does not have this problem, because XFS use iomap_dio_rw() to do direct I/O read. And the comparing between read offset and file size is done in iomap_dio_rw(), the code is as following: if (pos < size) { retval = filemap_write_and_wait_range(mapping, pos, pos + iov_length(iov, nr_segs) - 1); if (!retval) { retval = mapping->a_ops->direct_IO(READ, iocb, iov, pos, nr_segs); } ... } ...only when "pos < size", direct I/O can be done, or 0 will be return. I have tested the fix patch on Ext4, it is up to the mustard of EINVAL in man2(read) as following: #include ssize_t read(int fd, void *buf, size_t count); EINVAL fd is attached to an object which is unsuitable for reading; or the file was opened with the O_DIRECT flag, and either the address specified in buf, the value specified in count, or the current file offset is not suitably aligned. So I think this patch can be applied to fix ext4 direct I/O error. However Ext4 introduces direct I/O read using iomap infrastructure on kernel 5.5, the patch is commit ("ext4: introduce direct I/O read using iomap infrastructure"), then Ext4 will be the same as XFS, they all use iomap_dio_rw() to do direct I/O read. So this problem does not exist on kernel 5.5 for Ext4. >From above description, we can see this problem exists on all the kernel versions between kernel 3.14 and kernel 5.4. It will cause the Applications to fail to read. For example, when the search service downloads a new full index file, the search engine is loading the previous index file and is processing the search request, it can not use buffer io that may squeeze the previous index file in use from pagecache, so the serch service must use direct I/O read. Please apply this patch on these kernel versions, or please use the method on kernel 5.5 to fix this problem. Fixes: 9fe55eea7e4b ("Fix race when checking i_size on direct i/o read") Reviewed-by: Jan Kara Reviewed-by: Wang Long Signed-off-by: Jiang Ying Signed-off-by: Greg Kroah-Hartman --- fs/ext4/inode.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3353,6 +3353,13 @@ static ssize_t ext4_direct_IO(struct kio size_t count = iov_iter_count(iter); ssize_t ret; + if (iov_iter_rw(iter) == READ) { + loff_t size = i_size_read(inode); + + if (offset >= size) + return 0; + } + #ifdef CONFIG_EXT4_FS_ENCRYPTION if (ext4_encrypted_inode(inode) && S_ISREG(inode->i_mode)) return 0; From patchwork Thu Aug 20 09:21:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265646 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7E50C433E1 for ; Thu, 20 Aug 2020 10:37:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9FEF320738 for ; Thu, 20 Aug 2020 10:37:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919864; bh=068LKMYQZjA+IESANMRSpu0RwUD813OMYqEHLN141CQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=2mnl1v6+SzBlGKow0OzPy+6XkgcMW5dtxB9ZMvehnXXvW7H9kqAYdicIy5S9I3U25 qt3h0RsLpP1rnnP9o9ZxllbbHxYU1yjKHI5PCZCEPjMJbTBkWTIB+kGjAH7J2VHYu3 qqQQnCrevOhQ80bokIVzA/QDpsVQMMv3XNTHfAk4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731356AbgHTKhm (ORCPT ); Thu, 20 Aug 2020 06:37:42 -0400 Received: from mail.kernel.org ([198.145.29.99]:40218 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731110AbgHTKST (ORCPT ); Thu, 20 Aug 2020 06:18:19 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 271922067C; Thu, 20 Aug 2020 10:18:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918698; bh=068LKMYQZjA+IESANMRSpu0RwUD813OMYqEHLN141CQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1LNWNcNV/0OkaprXQHbyszSCPUm4EqLk8PBcCbNRRNkGifWURQRdSPmLIJs8+VlwO CEGgs6csiYavsyTl2yEPnPpDDn9usgt+FqKNlYJaXvbkufrDrIgBYmZqi7v563cJiW 7rym8+xqp19XEcThBqPSFT+CyfDGmnu6KsrBAxJU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Erik Ekman , Johan Hovold Subject: [PATCH 4.4 033/149] USB: serial: qcserial: add EM7305 QDL product ID Date: Thu, 20 Aug 2020 11:21:50 +0200 Message-Id: <20200820092127.330861408@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Erik Ekman commit d2a4309c1ab6df424b2239fe2920d6f26f808d17 upstream. When running qmi-firmware-update on the Sierra Wireless EM7305 in a Toshiba laptop, it changed product ID to 0x9062 when entering QDL mode: usb 2-4: new high-speed USB device number 78 using xhci_hcd usb 2-4: New USB device found, idVendor=1199, idProduct=9062, bcdDevice= 0.00 usb 2-4: New USB device strings: Mfr=1, Product=2, SerialNumber=0 usb 2-4: Product: EM7305 usb 2-4: Manufacturer: Sierra Wireless, Incorporated The upgrade could complete after running # echo 1199 9062 > /sys/bus/usb-serial/drivers/qcserial/new_id qcserial 2-4:1.0: Qualcomm USB modem converter detected usb 2-4: Qualcomm USB modem converter now attached to ttyUSB0 Signed-off-by: Erik Ekman Link: https://lore.kernel.org/r/20200717185118.3640219-1-erik@kryo.se Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/qcserial.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/serial/qcserial.c +++ b/drivers/usb/serial/qcserial.c @@ -159,6 +159,7 @@ static const struct usb_device_id id_tab {DEVICE_SWI(0x1199, 0x9056)}, /* Sierra Wireless Modem */ {DEVICE_SWI(0x1199, 0x9060)}, /* Sierra Wireless Modem */ {DEVICE_SWI(0x1199, 0x9061)}, /* Sierra Wireless Modem */ + {DEVICE_SWI(0x1199, 0x9062)}, /* Sierra Wireless EM7305 QDL */ {DEVICE_SWI(0x1199, 0x9063)}, /* Sierra Wireless EM7305 */ {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx */ {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx */ From patchwork Thu Aug 20 09:21:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265709 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EF3DC433E3 for ; Thu, 20 Aug 2020 10:18:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 05CB020658 for ; Thu, 20 Aug 2020 10:18:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918729; bh=YKOLualWO9C4qYdvL7Xb+bTQPwiEtuBFqCinjF8SZNY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=FCsaOamcOuGO58OwYfQpj3sEokgPJz6lG/Z9tAn9Npc4FOjzRpUlj7cZqZhUnLRnY S+wmMtUm5rwzudZIsOpkQgdoAOjjZibqT2rq+MLCdVCi2dXJTJBRLJzVC9O4yaPMWa 12yOKCkgDEzndpTaYDBm8ZCCSNZ3+cZjHVlblrYI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731397AbgHTKSr (ORCPT ); Thu, 20 Aug 2020 06:18:47 -0400 Received: from mail.kernel.org ([198.145.29.99]:40230 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731154AbgHTKSV (ORCPT ); Thu, 20 Aug 2020 06:18:21 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7B83020738; Thu, 20 Aug 2020 10:18:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918701; bh=YKOLualWO9C4qYdvL7Xb+bTQPwiEtuBFqCinjF8SZNY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G9NX+Q4tlYUjiMqHrOx7wD3E4roQlKmRVimUDi6Fm/SHhyHQjJurGmYCfzisHHTec fcBoB3+O8YW149q1AhbtzoGMqDbjB9eh5Dru1EGtW/CYNW3b4p8NTo6MCR+p0tpOPc djcbIcFMr3mXhwa1oBD55DrVssUf3ljCus5EUwOA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+1a54a94bd32716796edd@syzkaller.appspotmail.com, syzbot+9d2abfef257f3e2d4713@syzkaller.appspotmail.com, Hillf Danton , Takashi Iwai Subject: [PATCH 4.4 034/149] ALSA: seq: oss: Serialize ioctls Date: Thu, 20 Aug 2020 11:21:51 +0200 Message-Id: <20200820092127.381677453@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Takashi Iwai commit 80982c7e834e5d4e325b6ce33757012ecafdf0bb upstream. Some ioctls via OSS sequencer API may race and lead to UAF when the port create and delete are performed concurrently, as spotted by a couple of syzkaller cases. This patch is an attempt to address it by serializing the ioctls with the existing register_mutex. Basically OSS sequencer API is an obsoleted interface and was designed without much consideration of the concurrency. There are very few applications with it, and the concurrent performance isn't asked, hence this "big hammer" approach should be good enough. Reported-by: syzbot+1a54a94bd32716796edd@syzkaller.appspotmail.com Reported-by: syzbot+9d2abfef257f3e2d4713@syzkaller.appspotmail.com Suggested-by: Hillf Danton Cc: Link: https://lore.kernel.org/r/20200804185815.2453-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/core/seq/oss/seq_oss.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/sound/core/seq/oss/seq_oss.c +++ b/sound/core/seq/oss/seq_oss.c @@ -180,10 +180,16 @@ static long odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { struct seq_oss_devinfo *dp; + long rc; + dp = file->private_data; if (snd_BUG_ON(!dp)) return -ENXIO; - return snd_seq_oss_ioctl(dp, cmd, arg); + + mutex_lock(®ister_mutex); + rc = snd_seq_oss_ioctl(dp, cmd, arg); + mutex_unlock(®ister_mutex); + return rc; } #ifdef CONFIG_COMPAT From patchwork Thu Aug 20 09:21:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265665 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F1E8C433E3 for ; Thu, 20 Aug 2020 10:32:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4BC3B20658 for ; Thu, 20 Aug 2020 10:32:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919533; bh=Gg+kEkswDRxTKOBGrIllN4zRgEO19H9gT8252jAy1aY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=TG1zWMLBz8ZIxRv+/OZ6b9xLB2rhGvr1a5LXrq8wQzGiBK1YCpdRXhyV70DA2p+c2 VXy8pOTrIKTX/v3kE8AfQnFuNqDWZY5AM8OXcoa5M/mOMMZJN81+dzh2vJ/9zqGipw mCx5jFeCaqOd6RC9VwM5bCof3dFlg6bzwnZIRQ0s= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730413AbgHTKUU (ORCPT ); Thu, 20 Aug 2020 06:20:20 -0400 Received: from mail.kernel.org ([198.145.29.99]:44960 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731348AbgHTKUN (ORCPT ); Thu, 20 Aug 2020 06:20:13 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 36916206DA; Thu, 20 Aug 2020 10:20:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918812; bh=Gg+kEkswDRxTKOBGrIllN4zRgEO19H9gT8252jAy1aY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VRIQW/5wfyGfyi3Jg4qa9gKm1186ftY4RGGBqHFop82xp+WzzRcWgIQGR8CG8PVMw nJ9SJrz456m23LxVy0o5B/3b4hO3aaPEeA5PE8QhSQ3GWy9bhOzb3zZVJmdJk7fYV7 jp/fotQS9R5sHPOkt6L2eOJTjarE+dTgIO4cJvH0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peilin Ye , Marcel Holtmann Subject: [PATCH 4.4 036/149] Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_evt() Date: Thu, 20 Aug 2020 11:21:53 +0200 Message-Id: <20200820092127.482844716@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Peilin Ye commit 75bbd2ea50ba1c5d9da878a17e92eac02fe0fd3a upstream. Check `num_rsp` before using it as for-loop counter. Cc: stable@vger.kernel.org Signed-off-by: Peilin Ye Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman --- net/bluetooth/hci_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -2094,7 +2094,7 @@ static void hci_inquiry_result_evt(struc BT_DBG("%s num_rsp %d", hdev->name, num_rsp); - if (!num_rsp) + if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1) return; if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) From patchwork Thu Aug 20 09:21:54 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265649 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83EF8C433E5 for ; Thu, 20 Aug 2020 10:36:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5762A20639 for ; Thu, 20 Aug 2020 10:36:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919810; bh=4peBHAYlOQ63puwQEQftqYkPLmmiFl9Ugq+yWwYaFkU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=askBrM1jn18IL+JEfrH+O0Xy/5opLolVr05Cj4GML52B9cCz1rDgoav74+UXa+epY 8NwxzyGmBb/CZnP+i4T7gLfd1Q74JFaXJCUH2cc1erC9TP2/JjruOZOCvoPjBgY1NI YGtACvEhWvU4X0+4mz2kCBHx/GzDWUt5nZULYvOE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731115AbgHTKfq (ORCPT ); Thu, 20 Aug 2020 06:35:46 -0400 Received: from mail.kernel.org ([198.145.29.99]:41158 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731396AbgHTKSp (ORCPT ); Thu, 20 Aug 2020 06:18:45 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 41E83206DA; Thu, 20 Aug 2020 10:18:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918725; bh=4peBHAYlOQ63puwQEQftqYkPLmmiFl9Ugq+yWwYaFkU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZP1ABg34S/4VHZy3lFAiz9uEWznsH5wwS5hlXhnA8K1ZmSlRwZ6DE9/i9/rBnQv02 djxpOA3Z2EZVDQHuoBhNSi5ZNbVtiSMXZW4knL2DgYOrZIPuvadUZv4QK5uJbiTj1j bS+lwkh9A/efqXUvNqz5erKRYqrreflH7HtpzaEI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peilin Ye , Marcel Holtmann Subject: [PATCH 4.4 037/149] Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt() Date: Thu, 20 Aug 2020 11:21:54 +0200 Message-Id: <20200820092127.531963469@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Peilin Ye commit 629b49c848ee71244203934347bd7730b0ddee8d upstream. Check `num_rsp` before using it as for-loop counter. Add `unlock` label. Cc: stable@vger.kernel.org Signed-off-by: Peilin Ye Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman --- net/bluetooth/hci_event.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -3609,6 +3609,9 @@ static void hci_inquiry_result_with_rssi struct inquiry_info_with_rssi_and_pscan_mode *info; info = (void *) (skb->data + 1); + if (skb->len < num_rsp * sizeof(*info) + 1) + goto unlock; + for (; num_rsp; num_rsp--, info++) { u32 flags; @@ -3630,6 +3633,9 @@ static void hci_inquiry_result_with_rssi } else { struct inquiry_info_with_rssi *info = (void *) (skb->data + 1); + if (skb->len < num_rsp * sizeof(*info) + 1) + goto unlock; + for (; num_rsp; num_rsp--, info++) { u32 flags; @@ -3650,6 +3656,7 @@ static void hci_inquiry_result_with_rssi } } +unlock: hci_dev_unlock(hdev); } From patchwork Thu Aug 20 09:21:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265655 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1780C433E1 for ; Thu, 20 Aug 2020 10:34:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B00B520658 for ; Thu, 20 Aug 2020 10:34:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919680; bh=MrYrebokHTAUJmrvRr3qLac/OCL5dZ4RwhVvxtvnVnA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=uZF8fDV51jXMCVPQrlCTVs+6q5LEmcI9IgRhR4GeTdCdfDow9oUs3I3U6jE2iqQqJ BAYlTHs/cc62MP7/Jou7riZdT+em3SD4bJgD6z/lUtUtd7GD6bWA14PkSLK3KFxSJD M+wSObScve902qug8ktuZpqEC1Zb/0Hxz7gzI5QA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731667AbgHTKej (ORCPT ); Thu, 20 Aug 2020 06:34:39 -0400 Received: from mail.kernel.org ([198.145.29.99]:42660 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731370AbgHTKTS (ORCPT ); Thu, 20 Aug 2020 06:19:18 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2444320738; Thu, 20 Aug 2020 10:19:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918757; bh=MrYrebokHTAUJmrvRr3qLac/OCL5dZ4RwhVvxtvnVnA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LvrTkDVp3HPD3Zbvc7AzJd+dA0fpIm1izaL843avU9fAXnqaW61qG4jjpiDyTujj3 NnkQXjBPDH2UvEBFHkgNW9LCyoIuUXP6W7+YZU0+RV5hqp3QGfeoWB4jYBvTaFPT+/ Du9aCW3O36XropRTl1qd7qvW1oOb8QE7d33/c6Zg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?b?5byg5LqR5rW3?= , Yang Yingliang , Kyungtae Kim , linux-fbdev@vger.kernel.org, Linus Torvalds , Solar Designer , "Srivatsa S. Bhat" , Anthony Liguori , Bartlomiej Zolnierkiewicz , Jiri Slaby Subject: [PATCH 4.4 038/149] vgacon: Fix for missing check in scrollback handling Date: Thu, 20 Aug 2020 11:21:55 +0200 Message-Id: <20200820092127.580348981@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Yunhai Zhang commit ebfdfeeae8c01fcb2b3b74ffaf03876e20835d2d upstream. vgacon_scrollback_update() always leaves enbough room in the scrollback buffer for the next call, but if the console size changed that room might not actually be enough, and so we need to re-check. The check should be in the loop since vgacon_scrollback_cur->tail is updated in the loop and count may be more than 1 when triggered by CSI M, as Jiri's PoC: #include #include #include #include #include #include #include int main(int argc, char** argv) { int fd = open("/dev/tty1", O_RDWR); unsigned short size[3] = {25, 200, 0}; ioctl(fd, 0x5609, size); // VT_RESIZE write(fd, "\e[1;1H", 6); for (int i = 0; i < 30; i++) write(fd, "\e[10M", 5); } It leads to various crashes as vgacon_scrollback_update writes out of the buffer: BUG: unable to handle page fault for address: ffffc900001752a0 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page RIP: 0010:mutex_unlock+0x13/0x30 ... Call Trace: n_tty_write+0x1a0/0x4d0 tty_write+0x1a0/0x2e0 Or to KASAN reports: BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed This fixes CVE-2020-14331. Reported-by: 张云海 Reported-by: Yang Yingliang Reported-by: Kyungtae Kim Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback) Cc: stable@vger.kernel.org Cc: linux-fbdev@vger.kernel.org Cc: Linus Torvalds Cc: Solar Designer Cc: "Srivatsa S. Bhat" Cc: Anthony Liguori Cc: Yang Yingliang Cc: Bartlomiej Zolnierkiewicz Cc: Jiri Slaby Signed-off-by: Yunhai Zhang Link: https://lore.kernel.org/r/9fb43895-ca91-9b07-ebfd-808cf854ca95@nsfocus.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/video/console/vgacon.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/video/console/vgacon.c +++ b/drivers/video/console/vgacon.c @@ -220,6 +220,10 @@ static void vgacon_scrollback_update(str p = (void *) (c->vc_origin + t * c->vc_size_row); while (count--) { + if ((vgacon_scrollback_tail + c->vc_size_row) > + vgacon_scrollback_size) + vgacon_scrollback_tail = 0; + scr_memcpyw(vgacon_scrollback + vgacon_scrollback_tail, p, c->vc_size_row); vgacon_scrollback_cnt++; From patchwork Thu Aug 20 09:21:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265661 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C767BC433DF for ; Thu, 20 Aug 2020 10:32:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9440120658 for ; Thu, 20 Aug 2020 10:32:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919568; bh=GrXqHisVAEBfsmqbEkU2lfCyTUGM/JkarYuagrRTCc8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=NyxI8w6ypjOmhqU9UW+fIVuA9VlkyqHoZeJd5DLSvkQ1RcNbuER2SMb5P+Ubg6q50 2WCpiyEMMq4MHqfUmsORt0sVpUS0CkqXlnvHXkAYhgMU4oQeJ4tBtqAUrWCh8lNz2z nS/BL7bDpo2sL89psV2lkWBcpoEE8GaYSmaICY8Y= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731872AbgHTKcm (ORCPT ); Thu, 20 Aug 2020 06:32:42 -0400 Received: from mail.kernel.org ([198.145.29.99]:44384 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731326AbgHTKT4 (ORCPT ); Thu, 20 Aug 2020 06:19:56 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id BB01E2067C; Thu, 20 Aug 2020 10:19:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918795; bh=GrXqHisVAEBfsmqbEkU2lfCyTUGM/JkarYuagrRTCc8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L5psh+jiONlkrdCVVFmShkF1pxhL89GoitcIFdxs/KRkYoZg3paTgFbPBid2fquFM c/9HT7DrTQ4QAneVz98ZfTeWC90cdLxv3hZ1QI+wG673ZS77pwweR9hmCsMFFx8bam sttqUXxUYWX9nOH25n6/x1auLcj5ql+2QSXIupdY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+e6f77e16ff68b2434a2c@syzkaller.appspotmail.com, Christoph Hellwig , Dominique Martinet , Sasha Levin Subject: [PATCH 4.4 040/149] net/9p: validate fds in p9_fd_open Date: Thu, 20 Aug 2020 11:21:57 +0200 Message-Id: <20200820092127.675555741@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Christoph Hellwig [ Upstream commit a39c46067c845a8a2d7144836e9468b7f072343e ] p9_fd_open just fgets file descriptors passed in from userspace, but doesn't verify that they are valid for read or writing. This gets cought down in the VFS when actually attempting a read or write, but a new warning added in linux-next upsets syzcaller. Fix this by just verifying the fds early on. Link: http://lkml.kernel.org/r/20200710085722.435850-1-hch@lst.de Reported-by: syzbot+e6f77e16ff68b2434a2c@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig [Dominique: amend goto as per Doug Nazar's review] Signed-off-by: Dominique Martinet Signed-off-by: Sasha Levin --- net/9p/trans_fd.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index 2f68ffda3715b..eab058f93ec97 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -793,20 +793,28 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd) return -ENOMEM; ts->rd = fget(rfd); + if (!ts->rd) + goto out_free_ts; + if (!(ts->rd->f_mode & FMODE_READ)) + goto out_put_rd; ts->wr = fget(wfd); - if (!ts->rd || !ts->wr) { - if (ts->rd) - fput(ts->rd); - if (ts->wr) - fput(ts->wr); - kfree(ts); - return -EIO; - } + if (!ts->wr) + goto out_put_rd; + if (!(ts->wr->f_mode & FMODE_WRITE)) + goto out_put_wr; client->trans = ts; client->status = Connected; return 0; + +out_put_wr: + fput(ts->wr); +out_put_rd: + fput(ts->rd); +out_free_ts: + kfree(ts); + return -EIO; } static int p9_socket_open(struct p9_client *client, struct socket *csocket) From patchwork Thu Aug 20 09:21:58 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265663 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9FC0C433E3 for ; Thu, 20 Aug 2020 10:32:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B2C3E20658 for ; Thu, 20 Aug 2020 10:32:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919545; bh=KEAipvMjfEorrai6eNDNy7y7VZLzrF8oFi2wdwB+n6c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=zULFqr8P22XxEwvsVbMps0zs+MqCPi87N38BvOQYrzRy27TzQ+cBS3j4rz3BMq+FO JJchigooEvEX5FcEotYigY5Qn20Nyes/pdu8cS1h81zji7lqDJu55OcJQtO71rvWSn CzQ1BZvT3EQm+7NgfcIWH1nKBKntHjXhWTiaUapM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731327AbgHTKUH (ORCPT ); Thu, 20 Aug 2020 06:20:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:44498 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728740AbgHTKUE (ORCPT ); Thu, 20 Aug 2020 06:20:04 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 49435206DA; Thu, 20 Aug 2020 10:19:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918798; bh=KEAipvMjfEorrai6eNDNy7y7VZLzrF8oFi2wdwB+n6c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RTUwy/gRBlqe9JtWTyVPOxCihFDNO8TIKzRZSRAJHfXHxdI25+L1/y0aDP3fS0Evm ghIRx8jdqQqr79+wycXYxH0MDAZ3I081LEYJPItpgJ5YXXUrSdYtR2qb2v5xR1Uza7 I4R2HbmF+ZWpnWD6YPTkrw7JZIXMQUQGFNLPnTN8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ben Skeggs , Sasha Levin Subject: [PATCH 4.4 041/149] drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason Date: Thu, 20 Aug 2020 11:21:58 +0200 Message-Id: <20200820092127.725934128@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Ben Skeggs [ Upstream commit 498595abf5bd51f0ae074cec565d888778ea558f ] Stale pointer was tripping up the unload path. Signed-off-by: Ben Skeggs Signed-off-by: Sasha Levin --- drivers/gpu/drm/nouveau/nouveau_fbcon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c index 343476d157266..edb3a23ded5d5 100644 --- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c +++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c @@ -566,6 +566,7 @@ fini: drm_fb_helper_fini(&fbcon->helper); free: kfree(fbcon); + drm->fbcon = NULL; return ret; } From patchwork Thu Aug 20 09:22:01 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265662 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A9B8FC433E1 for ; Thu, 20 Aug 2020 10:32:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7711522B4E for ; Thu, 20 Aug 2020 10:32:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919556; bh=qiSuuWBMSyShVnhW2u6bdkeMmDZ6T2EMNDEsJ/IiqMA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=b0x07gIrGWaQmDahtlCnzF9zJZ665wKcgfkBRRhO052y/Os/oXRr162w22Sj0AKb/ sSDjfmDmP8/ewTnRj07YbGNwZudlT80feadzHzYwew26ej3MS0ryN8KhxTrFiuFBe5 IdI9/VbD1c25F/J2t65fW0ghk+ZQ8uSs5kLGindM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728578AbgHTKcZ (ORCPT ); Thu, 20 Aug 2020 06:32:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:44754 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731324AbgHTKUI (ORCPT ); Thu, 20 Aug 2020 06:20:08 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 77B642067C; Thu, 20 Aug 2020 10:20:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918807; bh=qiSuuWBMSyShVnhW2u6bdkeMmDZ6T2EMNDEsJ/IiqMA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pxEPkQQ7Z08KIopF095eQGfWE4NyPcAKz11z+6PTABC/QymRd0JQqB/M/ENmmeltn +93f0JHvOU3toV8Ba9CJlF8bQTxoYNFEJoYeuTseMDvV2k/aohlm/bl51eHeUYKKdw 5kChiiRNzcc7iHX7CgwQQyXYmlQHzaxRe7W5V24o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xin Xiong , Xiyu Yang , Xin Tan , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 044/149] atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent Date: Thu, 20 Aug 2020 11:22:01 +0200 Message-Id: <20200820092127.872137487@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Xin Xiong [ Upstream commit 51875dad43b44241b46a569493f1e4bfa0386d86 ] atmtcp_remove_persistent() invokes atm_dev_lookup(), which returns a reference of atm_dev with increased refcount or NULL if fails. The refcount leaks issues occur in two error handling paths. If dev_data->persist is zero or PRIV(dev)->vcc isn't NULL, the function returns 0 without decreasing the refcount kept by a local variable, resulting in refcount leaks. Fix the issue by adding atm_dev_put() before returning 0 both when dev_data->persist is zero or PRIV(dev)->vcc isn't NULL. Signed-off-by: Xin Xiong Signed-off-by: Xiyu Yang Signed-off-by: Xin Tan Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/atm/atmtcp.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c index 480fa6ffbc090..04fca6db273ef 100644 --- a/drivers/atm/atmtcp.c +++ b/drivers/atm/atmtcp.c @@ -432,9 +432,15 @@ static int atmtcp_remove_persistent(int itf) return -EMEDIUMTYPE; } dev_data = PRIV(dev); - if (!dev_data->persist) return 0; + if (!dev_data->persist) { + atm_dev_put(dev); + return 0; + } dev_data->persist = 0; - if (PRIV(dev)->vcc) return 0; + if (PRIV(dev)->vcc) { + atm_dev_put(dev); + return 0; + } kfree(dev_data); atm_dev_put(dev); atm_dev_deregister(dev); From patchwork Thu Aug 20 09:22:04 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265708 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2178DC433DF for ; Thu, 20 Aug 2020 10:19:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EC246206DA for ; Thu, 20 Aug 2020 10:18:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918740; bh=i20cTE8zZsa2S8I21mR46fM0KH4ljoFs0YmBjUWK0kc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=2JmOMNxRw57eysVFTLZ+Y1yTGCLfR+RMiVneH8iKq31fsgTPg9GXdCyb1QMZWlcQo 7j3ErEflYwdeNnA0NIxqq1FefiyhgJbg2b9P2ZOFneCCTUjBpNyF9vCKCT2+suXLlb /oxKYRCXTPvQeTf7Jns4uelUVMGVs0Oalt/POJRk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731424AbgHTKS6 (ORCPT ); Thu, 20 Aug 2020 06:18:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:41828 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731418AbgHTKSz (ORCPT ); Thu, 20 Aug 2020 06:18:55 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 533C92067C; Thu, 20 Aug 2020 10:18:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918734; bh=i20cTE8zZsa2S8I21mR46fM0KH4ljoFs0YmBjUWK0kc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=r6X6zdWmeMqaa6aYWkr5qi3HLOI1zUurYE9MZadWxMUCLUzmsqzLnvHJhVrOFi5n2 3B+ndDDflQ10HDiqeaOk88vTCur48TKImplSMBJuN64RzaDLufkRfowNKDx1EI2/nr WIvLItkAYXNyqp1OCcwGioJX4P8wiPiA545jCgNE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ido Schimmel , Jiri Pirko , "David S. Miller" Subject: [PATCH 4.4 047/149] ipv4: Silence suspicious RCU usage warning Date: Thu, 20 Aug 2020 11:22:04 +0200 Message-Id: <20200820092128.011909266@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Ido Schimmel [ Upstream commit 83f3522860f702748143e022f1a546547314c715 ] fib_trie_unmerge() is called with RTNL held, but not from an RCU read-side critical section. This leads to the following warning [1] when the FIB alias list in a leaf is traversed with hlist_for_each_entry_rcu(). Since the function is always called with RTNL held and since modification of the list is protected by RTNL, simply use hlist_for_each_entry() and silence the warning. [1] WARNING: suspicious RCU usage 5.8.0-rc4-custom-01520-gc1f937f3f83b #30 Not tainted ----------------------------- net/ipv4/fib_trie.c:1867 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by ip/164: #0: ffffffff85a27850 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x49a/0xbd0 stack backtrace: CPU: 0 PID: 164 Comm: ip Not tainted 5.8.0-rc4-custom-01520-gc1f937f3f83b #30 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.fc32 04/01/2014 Call Trace: dump_stack+0x100/0x184 lockdep_rcu_suspicious+0x153/0x15d fib_trie_unmerge+0x608/0xdb0 fib_unmerge+0x44/0x360 fib4_rule_configure+0xc8/0xad0 fib_nl_newrule+0x37a/0x1dd0 rtnetlink_rcv_msg+0x4f7/0xbd0 netlink_rcv_skb+0x17a/0x480 rtnetlink_rcv+0x22/0x30 netlink_unicast+0x5ae/0x890 netlink_sendmsg+0x98a/0xf40 ____sys_sendmsg+0x879/0xa00 ___sys_sendmsg+0x122/0x190 __sys_sendmsg+0x103/0x1d0 __x64_sys_sendmsg+0x7d/0xb0 do_syscall_64+0x54/0xa0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fc80a234e97 Code: Bad RIP value. RSP: 002b:00007ffef8b66798 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc80a234e97 RDX: 0000000000000000 RSI: 00007ffef8b66800 RDI: 0000000000000003 RBP: 000000005f141b1c R08: 0000000000000001 R09: 0000000000000000 R10: 00007fc80a2a8ac0 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000000 R14: 00007ffef8b67008 R15: 0000556fccb10020 Fixes: 0ddcf43d5d4a ("ipv4: FIB Local/MAIN table collapse") Signed-off-by: Ido Schimmel Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/fib_trie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv4/fib_trie.c +++ b/net/ipv4/fib_trie.c @@ -1696,7 +1696,7 @@ struct fib_table *fib_trie_unmerge(struc while ((l = leaf_walk_rcu(&tp, key)) != NULL) { struct key_vector *local_l = NULL, *local_tp; - hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) { + hlist_for_each_entry(fa, &l->leaf, fa_list) { struct fib_alias *new_fa; if (local_tb->tb_id != fa->tb_id) From patchwork Thu Aug 20 09:22:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265651 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03856C433E1 for ; Thu, 20 Aug 2020 10:35:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CC5BB20639 for ; Thu, 20 Aug 2020 10:35:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919736; bh=QPfgkXAnfs8QNNM41LgdhFQ5pN1N0syzwJkAzKKiL5E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=iTeiBmNZoDj/NS1r0qrRiJMC8ac8EEgcINeoSr6Vl1NcqfLGCl278IRLHR+5BCmG3 RmnqEC0tFDAzJW0PCWWc6csxcO86aJpsRlpK36JCcuSDiiQAuSGjye5X7sBFaNSxwM lD2mi6g+h4bDVzBCa8CdZ5XiC8yOVDf5JyqrZQbc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730558AbgHTKfe (ORCPT ); Thu, 20 Aug 2020 06:35:34 -0400 Received: from mail.kernel.org ([198.145.29.99]:42002 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731432AbgHTKTA (ORCPT ); Thu, 20 Aug 2020 06:19:00 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 666E120658; Thu, 20 Aug 2020 10:18:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918739; bh=QPfgkXAnfs8QNNM41LgdhFQ5pN1N0syzwJkAzKKiL5E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wHDQ+CxyucABp/tGd+asYFREzJ0UbCMOlRzIBsXq2qhdBCFE7XmQ2nMnGL82MiZ8R /NMJyR16RFcBT7EtKB29a66Fo3DbEJHATyfLiU8bmBhfs8euS55dYl0n1w0BQxjw4E xNSaTr8XZb3y/O3bzuMqmNgN8QDHIA7NyPXRIAK8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangbin Liu , Guillaume Nault , "David S. Miller" Subject: [PATCH 4.4 049/149] Revert "vxlan: fix tos value before xmit" Date: Thu, 20 Aug 2020 11:22:06 +0200 Message-Id: <20200820092128.114037102@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Hangbin Liu [ Upstream commit a0dced17ad9dc08b1b25e0065b54c97a318e6e8b ] This reverts commit 71130f29979c7c7956b040673e6b9d5643003176. In commit 71130f29979c ("vxlan: fix tos value before xmit") we want to make sure the tos value are filtered by RT_TOS() based on RFC1349. 0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ | PRECEDENCE | TOS | MBZ | +-----+-----+-----+-----+-----+-----+-----+-----+ But RFC1349 has been obsoleted by RFC2474. The new DSCP field defined like 0 1 2 3 4 5 6 7 +-----+-----+-----+-----+-----+-----+-----+-----+ | DS FIELD, DSCP | ECN FIELD | +-----+-----+-----+-----+-----+-----+-----+-----+ So with IPTOS_TOS_MASK 0x1E RT_TOS(tos) ((tos)&IPTOS_TOS_MASK) the first 3 bits DSCP info will get lost. To take all the DSCP info in xmit, we should revert the patch and just push all tos bits to ip_tunnel_ecn_encap(), which will handling ECN field later. Fixes: 71130f29979c ("vxlan: fix tos value before xmit") Signed-off-by: Hangbin Liu Acked-by: Guillaume Nault Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/vxlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c @@ -2070,7 +2070,7 @@ static void vxlan_xmit_one(struct sk_buf return; } - tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb); + tos = ip_tunnel_ecn_encap(tos, old_iph, skb); ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); err = vxlan_xmit_skb(rt, sk, skb, fl4.saddr, dst->sin.sin_addr.s_addr, tos, ttl, df, From patchwork Thu Aug 20 09:22:08 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265652 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D143C433E1 for ; Thu, 20 Aug 2020 10:35:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3B26E20738 for ; Thu, 20 Aug 2020 10:35:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919711; bh=He8D27RUgtVkrpdDKqvL1ZvbxJaLrXCDhhWsBSygfEE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=CBQT74lxHE7jBfgiDtRyjnQpwrqYgcdFtmN7Z2ukYwxOdIYrRNN18/wzi/jVjESPz UFgEsGCgOGFcnKOpzgigNjMoM7PiG8w6yQ1zHDRcOJ4IUSGt9b2WLXJJzLQ8y8cOuS 1u8Qwyb444GVEI/VZSX8nubY7OTVoix9jmjniRXc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731161AbgHTKfJ (ORCPT ); Thu, 20 Aug 2020 06:35:09 -0400 Received: from mail.kernel.org ([198.145.29.99]:42200 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731343AbgHTKTF (ORCPT ); Thu, 20 Aug 2020 06:19:05 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E73EA20658; Thu, 20 Aug 2020 10:19:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918745; bh=He8D27RUgtVkrpdDKqvL1ZvbxJaLrXCDhhWsBSygfEE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RIXhx60Lg6FBQcvyXQFlkXWqT+WaHQnU8ICDqiNCLS/xhA6MoQXbU48hGmEiOU7Z1 n3EJyiuoHYYH89w/cRH8gVrMfs85ReSiHYxmvBdCOx+0NYAGg0EQbsirSF8loEgCtg ROlun66XvAvRFkjnRZJrBGUJBQCT6dlg/+x5o7t0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rustam Kovhaev , "David S. Miller" , syzbot+67b2bd0e34f952d0321e@syzkaller.appspotmail.com Subject: [PATCH 4.4 051/149] usb: hso: check for return value in hso_serial_common_create() Date: Thu, 20 Aug 2020 11:22:08 +0200 Message-Id: <20200820092128.201332561@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Rustam Kovhaev [ Upstream commit e911e99a0770f760377c263bc7bac1b1593c6147 ] in case of an error tty_register_device_attr() returns ERR_PTR(), add IS_ERR() check Reported-and-tested-by: syzbot+67b2bd0e34f952d0321e@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=67b2bd0e34f952d0321e Signed-off-by: Rustam Kovhaev Reviewed-by: Greg Kroah-Hartman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/usb/hso.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -2280,12 +2280,14 @@ static int hso_serial_common_create(stru minor = get_free_serial_index(); if (minor < 0) - goto exit; + goto exit2; /* register our minor number */ serial->parent->dev = tty_port_register_device_attr(&serial->port, tty_drv, minor, &serial->parent->interface->dev, serial->parent, hso_serial_dev_groups); + if (IS_ERR(serial->parent->dev)) + goto exit2; dev = serial->parent->dev; /* fill in specific data for later use */ @@ -2335,6 +2337,7 @@ static int hso_serial_common_create(stru return 0; exit: hso_serial_tty_unregister(serial); +exit2: hso_serial_common_free(serial); return -1; } From patchwork Thu Aug 20 09:22:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 248019 Delivered-To: patch@linaro.org Received: by 2002:a05:6e02:522:0:0:0:0 with SMTP id h2csp1228047ils; Thu, 20 Aug 2020 03:34:56 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzMi2C7XsLbqu1iicLtpIcuQBU4gVNFYogNElPJ1lMb8KxiEUE+Y5nVcKWhgOZ6mL23/a6E X-Received: by 2002:a05:6402:3088:: with SMTP id de8mr2232750edb.88.1597919696111; Thu, 20 Aug 2020 03:34:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1597919696; cv=none; d=google.com; s=arc-20160816; b=Maq2OMU1qdnnFP9xWLQe52kOwtx+UtBoRVgMFL9t/och6W3DzyjKuid6a9X88uFJBW CafEfEqkhJ5yvw0pnTD9sZ872Logktlu2IurIAjQqaf6gt+fnr9q64bmpgmKOtUQ6RgY QIWVhDXLDjzGBN66WUX7nD2i8nQ09WfeHajJR9PuU6ouNuA7/OzCAIch7nJEICfiNdh9 vt2Tw+Su4N/FgH5Tel4Y26c6j7huHL0YDM2BFCfq/0kFOaCn2Tat4kYUxjLO2PZ19ubJ 3AZLAbmOaYv1CAQxYKVx3ykyrXHh4xr/h/eXCn3/xO6JFmGLlEsliKwF8sGd/q/j8+/A 3QhQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=KaQ6ZTrO/FUnLy7qjC9P06ENi9ZaHlJC9PeivI/4ie0=; b=cnb3PcJrNjumopipReShfrTrGTrs67er7p1JQVFVs4yPo9rOXJrwUlVLy1bW+VJQfB MVrR/SlXU0BrBNS84xVUYCt0JAaFStLy8Au1Svlqg5Pvsw40i6OftlpWnun1ersNhVut 6kvrmOlw15n5UVk6FwUOH78FSLGRgsHH2/fyokZwlMHTdfbEBoGMRvMHTSiJkXEn4Csw wIK7fj1He3/j4447aC0hjjFWt/RrUKP5v9Gq1OYMblsRy3wfhhzaj4hlxKSW2a8wSAy9 bYDQesMaauuGtclsF/dmdMyPH5x0BGZBoNGH7w2itPXK5xMVxaDAR8efdGtexKdh+5Ov j+gA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="Y7m/U16T"; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id b20si302378ejq.631.2020.08.20.03.34.55; Thu, 20 Aug 2020 03:34:56 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b="Y7m/U16T"; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729216AbgHTKTQ (ORCPT + 15 others); Thu, 20 Aug 2020 06:19:16 -0400 Received: from mail.kernel.org ([198.145.29.99]:42492 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731366AbgHTKTN (ORCPT ); Thu, 20 Aug 2020 06:19:13 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 50DF12067C; Thu, 20 Aug 2020 10:19:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918752; bh=0dL8pYVd9qMBr7zVzJoGqGXN8Z9c9tLEAYuKy1M5Sao=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y7m/U16TdyGLKiUpZ6bivOW1Jasf+OXXJmjyiY2zTUtozMHohQt4ELOWS60wc+nFh 84FckLpFG5r4EuhlQlDajcAHjjctx/vYPHDIAhS5DQ9HMOVemvZizVWHL2q3zcmNjr NZtiM4I686bXnZtTFlA9HRqMADUeBauZOIGEKgZE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ingo Molnar , Miguel Ojeda , Tim Murray , Simon MacMullen , Greg Hackmann , Nick Desaulniers , "Steven Rostedt (VMware)" Subject: [PATCH 4.4 054/149] tracepoint: Mark __tracepoint_strings __used Date: Thu, 20 Aug 2020 11:22:11 +0200 Message-Id: <20200820092128.347118822@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Nick Desaulniers commit f3751ad0116fb6881f2c3c957d66a9327f69cefb upstream. __tracepoint_string's have their string data stored in .rodata, and an address to that data stored in the "__tracepoint_str" section. Functions that refer to those strings refer to the symbol of the address. Compiler optimization can replace those address references with references directly to the string data. If the address doesn't appear to have other uses, then it appears dead to the compiler and is removed. This can break the /tracing/printk_formats sysfs node which iterates the addresses stored in the "__tracepoint_str" section. Like other strings stored in custom sections in this header, mark these __used to inform the compiler that there are other non-obvious users of the address, so they should still be emitted. Link: https://lkml.kernel.org/r/20200730224555.2142154-2-ndesaulniers@google.com Cc: Ingo Molnar Cc: Miguel Ojeda Cc: stable@vger.kernel.org Fixes: 102c9323c35a8 ("tracing: Add __tracepoint_string() to export string pointers") Reported-by: Tim Murray Reported-by: Simon MacMullen Suggested-by: Greg Hackmann Signed-off-by: Nick Desaulniers Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Greg Kroah-Hartman --- include/linux/tracepoint.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/linux/tracepoint.h +++ b/include/linux/tracepoint.h @@ -328,7 +328,7 @@ extern void syscall_unregfunc(void); static const char *___tp_str __tracepoint_string = str; \ ___tp_str; \ }) -#define __tracepoint_string __attribute__((section("__tracepoint_str"))) +#define __tracepoint_string __attribute__((section("__tracepoint_str"), used)) #else /* * tracepoint_string() is used to save the string address for userspace From patchwork Thu Aug 20 09:22:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265653 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F85DC433E3 for ; Thu, 20 Aug 2020 10:34:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id F253F20855 for ; Thu, 20 Aug 2020 10:34:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919696; bh=RbLioRtwqIYvPCQRBQHY8oawWlkPDVdj5GuzGLh/pYI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=oIxsaaiMBpvJwriWyEA9MCIsR/Cpe/on1WA5Tzy8PRASYbbmcMjDYInXV6yhbMvlr OQksuSBgpxRgpMa1mW48oZ/Rs6lHlCgyljXk4IqCxfo0BBb/4X1cb/UaIoYqCc+kCC 4qFBSZvkgH/C3Pz0FYF5J+X8WI0J3btgVm+BFzJE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729958AbgHTKTS (ORCPT ); Thu, 20 Aug 2020 06:19:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:42568 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731369AbgHTKTQ (ORCPT ); Thu, 20 Aug 2020 06:19:16 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D681820658; Thu, 20 Aug 2020 10:19:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918755; bh=RbLioRtwqIYvPCQRBQHY8oawWlkPDVdj5GuzGLh/pYI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wvr0vQpKed6GbDOCCLDQeOsfZSLoPJr8ZFXbVCBhQ2nEuWONiOwvO2ufo5qkI9dZn h++3nA1xOXTYEKYA95m037Y9Wd4WCDqESbkLBQKK7Hu1Ea2q6Ir0h4L6G110JabfsV Je/orPVtzWEQnJg/Z2kq5MLt0Ob5U/hMOEE3+DGc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Dexuan Cui , Sasha Levin Subject: [PATCH 4.4 055/149] udp: drop corrupt packets earlier to avoid data corruption Date: Thu, 20 Aug 2020 11:22:12 +0200 Message-Id: <20200820092128.392955595@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dexuan Cui The v4.4 stable kernel lacks this bugfix: commit 327868212381 ("make skb_copy_datagram_msg() et.al. preserve ->msg_iter on error"). As a result, the v4.4 kernel can deliver corrupt data to the application when a corrupt UDP packet is closely followed by a valid UDP packet: the same invocation of the recvmsg() syscall can deliver the corrupt packet's UDP payload to the application with the UDP payload length and the "from IP/Port" of the valid packet. Details: For a UDP packet longer than 76 bytes (see the v5.8-rc6 kernel's include/linux/skbuff.h:3951), Linux delays the UDP checksum verification until the application invokes the syscall recvmsg(). In the recvmsg() syscall handler, while Linux is copying the UDP payload to the application's memory, it calculates the UDP checksum. If the calculated checksum doesn't match the received checksum, Linux drops the corrupt UDP packet, and then starts to process the next packet (if any), and if the next packet is valid (i.e. the checksum is correct), Linux will copy the valid UDP packet's payload to the application's receiver buffer. The bug is: before Linux starts to copy the valid UDP packet, the data structure used to track how many more bytes should be copied to the application memory is not reset to what it was when the application just entered the kernel by the syscall! Consequently, only a small portion or none of the valid packet's payload is copied to the application's receive buffer, and later when the application exits from the kernel, actually most of the application's receive buffer contains the payload of the corrupt packet while recvmsg() returns the length of the UDP payload of the valid packet. For the mainline kernel, the bug was fixed in commit 327868212381, but unluckily the bugfix is only backported to v4.9+. It turns out backporting 327868212381 to v4.4 means that some supporting patches must be backported first, so the overall changes seem too big, so the alternative is performs the csum validation earlier and drops the corrupt packets earlier. Signed-off-by: Eric Dumazet Signed-off-by: Dexuan Cui Acked-by: Eric Dumazet Signed-off-by: Sasha Levin --- net/ipv4/udp.c | 3 +-- net/ipv6/udp.c | 6 ++---- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 5464fd2102302..0d9f9d6251245 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1589,8 +1589,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) } } - if (rcu_access_pointer(sk->sk_filter) && - udp_lib_checksum_complete(skb)) + if (udp_lib_checksum_complete(skb)) goto csum_error; if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) { diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 79c583004575a..be570cd7c9aed 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -686,10 +686,8 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) } } - if (rcu_access_pointer(sk->sk_filter)) { - if (udp_lib_checksum_complete(skb)) - goto csum_error; - } + if (udp_lib_checksum_complete(skb)) + goto csum_error; if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) { UDP6_INC_STATS_BH(sock_net(sk), From patchwork Thu Aug 20 09:22:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265656 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90FCEC433E3 for ; Thu, 20 Aug 2020 10:34:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 70F6B20738 for ; Thu, 20 Aug 2020 10:34:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919665; bh=o9Sn3xaHKCAzMTdqGvBWLQH5M6n1P9EPHhFgTTMgUTA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=JQ26fBZg/9HEcZyKcxYxNniZa7XhrGIOiZo1Ioa6ZwRlU9Kmr8JuvQaldMBpTYo99 IgBFCsTjgj3uVFBW7B/E8qejk7RrM99A0b3C+eqKUwSYUS7shlECpBLOMA5bNLnSrp fy7v9j+aU37wKOUUMOD/fDfyrujNwTeliqVFiD8I= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727106AbgHTKeL (ORCPT ); Thu, 20 Aug 2020 06:34:11 -0400 Received: from mail.kernel.org ([198.145.29.99]:43162 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731434AbgHTKT2 (ORCPT ); Thu, 20 Aug 2020 06:19:28 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8D40A2078D; Thu, 20 Aug 2020 10:19:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918768; bh=o9Sn3xaHKCAzMTdqGvBWLQH5M6n1P9EPHhFgTTMgUTA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g+dx2cVdmP0NAdChKATb74Xq9S5B7w+O7wSdSVYKc4xX5OhpTRIZWpaQQbgCT08DH PCSIT4m0qrqsCUC+XWTTRPjVQJ89aqGsWRjIZ5IhcEck2iYAwW+eJm6b/L4PqvA5j3 6wa/h3Shi9pArvrY2bmZw9VaKCrbanQBFikFR/5Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Finn Thain , Stan Johnson , Joshua Thompson , Geert Uytterhoeven , Sasha Levin Subject: [PATCH 4.4 059/149] m68k: mac: Fix IOP status/control register writes Date: Thu, 20 Aug 2020 11:22:16 +0200 Message-Id: <20200820092128.592711684@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Finn Thain [ Upstream commit 931fc82a6aaf4e2e4a5490addaa6a090d78c24a7 ] When writing values to the IOP status/control register make sure those values do not have any extraneous bits that will clear interrupt flags. To place the SCC IOP into bypass mode would be desirable but this is not achieved by writing IOP_DMAINACTIVE | IOP_RUN | IOP_AUTOINC | IOP_BYPASS to the control register. Drop this ineffective register write. Remove the flawed and unused iop_bypass() function. Make use of the unused iop_stop() function. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Finn Thain Tested-by: Stan Johnson Cc: Joshua Thompson Link: https://lore.kernel.org/r/09bcb7359a1719a18b551ee515da3c4c3cf709e6.1590880333.git.fthain@telegraphics.com.au Signed-off-by: Geert Uytterhoeven Signed-off-by: Sasha Levin --- arch/m68k/mac/iop.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c index c89ed66908f91..358ca965cf824 100644 --- a/arch/m68k/mac/iop.c +++ b/arch/m68k/mac/iop.c @@ -173,7 +173,7 @@ static __inline__ void iop_writeb(volatile struct mac_iop *iop, __u16 addr, __u8 static __inline__ void iop_stop(volatile struct mac_iop *iop) { - iop->status_ctrl &= ~IOP_RUN; + iop->status_ctrl = IOP_AUTOINC; } static __inline__ void iop_start(volatile struct mac_iop *iop) @@ -181,14 +181,9 @@ static __inline__ void iop_start(volatile struct mac_iop *iop) iop->status_ctrl = IOP_RUN | IOP_AUTOINC; } -static __inline__ void iop_bypass(volatile struct mac_iop *iop) -{ - iop->status_ctrl |= IOP_BYPASS; -} - static __inline__ void iop_interrupt(volatile struct mac_iop *iop) { - iop->status_ctrl |= IOP_IRQ; + iop->status_ctrl = IOP_IRQ | IOP_RUN | IOP_AUTOINC; } static int iop_alive(volatile struct mac_iop *iop) @@ -239,7 +234,6 @@ void __init iop_preinit(void) } else { iop_base[IOP_NUM_SCC] = (struct mac_iop *) SCC_IOP_BASE_QUADRA; } - iop_base[IOP_NUM_SCC]->status_ctrl = 0x87; iop_scc_present = 1; } else { iop_base[IOP_NUM_SCC] = NULL; @@ -251,7 +245,7 @@ void __init iop_preinit(void) } else { iop_base[IOP_NUM_ISM] = (struct mac_iop *) ISM_IOP_BASE_QUADRA; } - iop_base[IOP_NUM_ISM]->status_ctrl = 0; + iop_stop(iop_base[IOP_NUM_ISM]); iop_ism_present = 1; } else { iop_base[IOP_NUM_ISM] = NULL; From patchwork Thu Aug 20 09:22:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265657 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27835C433E1 for ; Thu, 20 Aug 2020 10:34:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 032CC22BEF for ; Thu, 20 Aug 2020 10:34:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919650; bh=7Z67yiuQegVjWrCGGCo7BKtRbYxNROfYlA/TcJ0SUjw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=WCRgCfRy2v05yIEZjv2wtev1JXEtUKadk0/Ho8JtQ5WV0IwxGWwH7qmJhYXGhsTU3 Fk/Ud3TzaOnATGK3xAjrR0hieYXu21maVaxVB2fDdZX8OonALhpt7vo1w+2NqLCfDV lYk0Eg7mVkz9WnrALp6cSqw0Ko/LTPdODe2T7VYQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730664AbgHTKeF (ORCPT ); Thu, 20 Aug 2020 06:34:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:43270 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731438AbgHTKTa (ORCPT ); Thu, 20 Aug 2020 06:19:30 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 12FBE2067C; Thu, 20 Aug 2020 10:19:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918770; bh=7Z67yiuQegVjWrCGGCo7BKtRbYxNROfYlA/TcJ0SUjw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iOzSExO0ZV0KCLYYcs+jczZXQ1plL/yH9JBgVYHf+tksu6l8TWM2PB/Ghu1+fDwsy zfdXKQHiKkDzlzs5476g0hDYS++kXADPFEWbnabXVDn1QjmFx2uzeo5Mvgnz2rzU1n PWM0A0oJ6BAOByn4dUJph3DIRUkrGCC1KmmJB06Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, yu kuai , Alexandre Belloni , Sasha Levin Subject: [PATCH 4.4 060/149] ARM: at91: pm: add missing put_device() call in at91_pm_sram_init() Date: Thu, 20 Aug 2020 11:22:17 +0200 Message-Id: <20200820092128.640860493@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: yu kuai [ Upstream commit f87a4f022c44e5b87e842a9f3e644fba87e8385f ] if of_find_device_by_node() succeed, at91_pm_sram_init() doesn't have a corresponding put_device(). Thus add a jump target to fix the exception handling for this function implementation. Fixes: d2e467905596 ("ARM: at91: pm: use the mmio-sram pool to access SRAM") Signed-off-by: yu kuai Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20200604123301.3905837-1-yukuai3@huawei.com Signed-off-by: Sasha Levin --- arch/arm/mach-at91/pm.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c index 84eefbc2b4f93..5923f2ca510be 100644 --- a/arch/arm/mach-at91/pm.c +++ b/arch/arm/mach-at91/pm.c @@ -393,13 +393,13 @@ static void __init at91_pm_sram_init(void) sram_pool = gen_pool_get(&pdev->dev, NULL); if (!sram_pool) { pr_warn("%s: sram pool unavailable!\n", __func__); - return; + goto out_put_device; } sram_base = gen_pool_alloc(sram_pool, at91_pm_suspend_in_sram_sz); if (!sram_base) { pr_warn("%s: unable to alloc sram!\n", __func__); - return; + goto out_put_device; } sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_base); @@ -407,12 +407,17 @@ static void __init at91_pm_sram_init(void) at91_pm_suspend_in_sram_sz, false); if (!at91_suspend_sram_fn) { pr_warn("SRAM: Could not map\n"); - return; + goto out_put_device; } /* Copy the pm suspend handler to SRAM */ at91_suspend_sram_fn = fncpy(at91_suspend_sram_fn, &at91_pm_suspend_in_sram, at91_pm_suspend_in_sram_sz); + return; + +out_put_device: + put_device(&pdev->dev); + return; } static void __init at91_pm_init(void) From patchwork Thu Aug 20 09:22:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265658 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2D49C433E3 for ; Thu, 20 Aug 2020 10:33:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B269620658 for ; Thu, 20 Aug 2020 10:33:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919636; bh=/gOzTMPZIOTgJFu167RPmJPiUuZ4b9Oq/6VRU/ZXW68=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=lcUJNfFvsVY88wA8fmr5x9dxzbw5CjXm1k6CT1dcTC95RUfAQLKS5gkuxJ2+bEqP7 KDRatzFBqODTyQm1DoiG5tReGinRJ5g2VkEvOSR9X1rU5ZnSUS7nbvlDddyUzZwcht 2x6C9iC87eDhqGF4RcZuaX1pzJxJtY4fQiT8qfbA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731082AbgHTKd4 (ORCPT ); Thu, 20 Aug 2020 06:33:56 -0400 Received: from mail.kernel.org ([198.145.29.99]:43470 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731449AbgHTKTg (ORCPT ); Thu, 20 Aug 2020 06:19:36 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7628C2067C; Thu, 20 Aug 2020 10:19:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918776; bh=/gOzTMPZIOTgJFu167RPmJPiUuZ4b9Oq/6VRU/ZXW68=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AYzN2/WcSNQnhryNynt66/diSt3HMNR1YVYEARcaQEKJoZp13AAMUBO0DtEP+uz+d YP1uEmE4z9xQMAesAw7+98qvDVs9pW3HDWPRsaWNRe6JBx3OdPi69FaoGgPK1ljsaR XWwWQuY0fxpbV8D46Y734275tY0d+CQgSX4fA0gw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tomi Valkeinen , Jyri Sarha , Sam Ravnborg , Sasha Levin Subject: [PATCH 4.4 062/149] drm/tilcdc: fix leak & null ref in panel_connector_get_modes Date: Thu, 20 Aug 2020 11:22:19 +0200 Message-Id: <20200820092128.741390964@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tomi Valkeinen [ Upstream commit 3f9c1c872cc97875ddc8d63bc9fe6ee13652b933 ] If videomode_from_timings() returns true, the mode allocated with drm_mode_create will be leaked. Also, the return value of drm_mode_create() is never checked, and thus could cause NULL deref. Fix these two issues. Signed-off-by: Tomi Valkeinen Link: https://patchwork.freedesktop.org/patch/msgid/20200429104234.18910-1-tomi.valkeinen@ti.com Reviewed-by: Jyri Sarha Acked-by: Sam Ravnborg Signed-off-by: Sasha Levin --- drivers/gpu/drm/tilcdc/tilcdc_panel.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c index 0af8bed7ce1ee..08d8f608be632 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c @@ -177,12 +177,16 @@ static int panel_connector_get_modes(struct drm_connector *connector) int i; for (i = 0; i < timings->num_timings; i++) { - struct drm_display_mode *mode = drm_mode_create(dev); + struct drm_display_mode *mode; struct videomode vm; if (videomode_from_timings(timings, &vm, i)) break; + mode = drm_mode_create(dev); + if (!mode) + break; + drm_display_mode_from_videomode(&vm, mode); mode->type = DRM_MODE_TYPE_DRIVER; From patchwork Thu Aug 20 09:22:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265659 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 73CA9C433DF for ; Thu, 20 Aug 2020 10:33:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 42A7820738 for ; Thu, 20 Aug 2020 10:33:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919596; bh=2R3z984rFOdN8uqAPoe8cJ/10YD+Q32bNKUVBayTgo8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=oR2ocklUGIvOiNKcO6bNItd0Ez91emPLbnzi8m+Ah0XlXbMQO1bbOEVdchWXMoiJi i9aDyyjgGou8B7kGo7qisYtLNaEx6Qi/whPL0eChVhdNB8aJA0GcSnyRt3t/qS1ntH CjIp+gkkQ01sk1vZvWSm/3WcWvBBMqBpS32G0u7U= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731457AbgHTKdN (ORCPT ); Thu, 20 Aug 2020 06:33:13 -0400 Received: from mail.kernel.org ([198.145.29.99]:43586 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731416AbgHTKTj (ORCPT ); Thu, 20 Aug 2020 06:19:39 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CFE07206DA; Thu, 20 Aug 2020 10:19:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918778; bh=2R3z984rFOdN8uqAPoe8cJ/10YD+Q32bNKUVBayTgo8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YJUE2w4lRrHc2CYsYxNz+IaplJevHnO2fcyck3CDq6VQe5gMvcnSQMNDS9F0tyj9e W93EpmR5tKP7BwoynK3ozFYMT4DK624Lafpa/qi+FEJz3KnkZZTusflpmjE6BZdMHP h1HeVUzfF7ygys+5ZNifoMqmjt8aQaq4MkuFwmLk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+96414aa0033c363d8458@syzkaller.appspotmail.com, Lihong Kou , Marcel Holtmann , Sasha Levin Subject: [PATCH 4.4 063/149] Bluetooth: add a mutex lock to avoid UAF in do_enale_set Date: Thu, 20 Aug 2020 11:22:20 +0200 Message-Id: <20200820092128.793137454@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lihong Kou [ Upstream commit f9c70bdc279b191da8d60777c627702c06e4a37d ] In the case we set or free the global value listen_chan in different threads, we can encounter the UAF problems because the method is not protected by any lock, add one to avoid this bug. BUG: KASAN: use-after-free in l2cap_chan_close+0x48/0x990 net/bluetooth/l2cap_core.c:730 Read of size 8 at addr ffff888096950000 by task kworker/1:102/2868 CPU: 1 PID: 2868 Comm: kworker/1:102 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events do_enable_set Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fb/0x318 lib/dump_stack.c:118 print_address_description+0x74/0x5c0 mm/kasan/report.c:374 __kasan_report+0x149/0x1c0 mm/kasan/report.c:506 kasan_report+0x26/0x50 mm/kasan/common.c:641 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 l2cap_chan_close+0x48/0x990 net/bluetooth/l2cap_core.c:730 do_enable_set+0x660/0x900 net/bluetooth/6lowpan.c:1074 process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264 worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410 kthread+0x332/0x350 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 2870: save_stack mm/kasan/common.c:72 [inline] set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc+0x118/0x1c0 mm/kasan/common.c:515 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529 kmem_cache_alloc_trace+0x221/0x2f0 mm/slab.c:3551 kmalloc include/linux/slab.h:555 [inline] kzalloc include/linux/slab.h:669 [inline] l2cap_chan_create+0x50/0x320 net/bluetooth/l2cap_core.c:446 chan_create net/bluetooth/6lowpan.c:640 [inline] bt_6lowpan_listen net/bluetooth/6lowpan.c:959 [inline] do_enable_set+0x6a4/0x900 net/bluetooth/6lowpan.c:1078 process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264 worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410 kthread+0x332/0x350 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 2870: save_stack mm/kasan/common.c:72 [inline] set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:337 [inline] __kasan_slab_free+0x12e/0x1e0 mm/kasan/common.c:476 kasan_slab_free+0xe/0x10 mm/kasan/common.c:485 __cache_free mm/slab.c:3426 [inline] kfree+0x10d/0x220 mm/slab.c:3757 l2cap_chan_destroy net/bluetooth/l2cap_core.c:484 [inline] kref_put include/linux/kref.h:65 [inline] l2cap_chan_put+0x170/0x190 net/bluetooth/l2cap_core.c:498 do_enable_set+0x66c/0x900 net/bluetooth/6lowpan.c:1075 process_one_work+0x7f5/0x10f0 kernel/workqueue.c:2264 worker_thread+0xbbc/0x1630 kernel/workqueue.c:2410 kthread+0x332/0x350 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff888096950000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 0 bytes inside of 2048-byte region [ffff888096950000, ffff888096950800) The buggy address belongs to the page: page:ffffea00025a5400 refcount:1 mapcount:0 mapping:ffff8880aa400e00 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea00027d1548 ffffea0002397808 ffff8880aa400e00 raw: 0000000000000000 ffff888096950000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809694ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88809694ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888096950000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888096950080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888096950100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Reported-by: syzbot+96414aa0033c363d8458@syzkaller.appspotmail.com Signed-off-by: Lihong Kou Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin --- net/bluetooth/6lowpan.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c index 4cd6b8d811ffa..11602902884ba 100644 --- a/net/bluetooth/6lowpan.c +++ b/net/bluetooth/6lowpan.c @@ -57,6 +57,7 @@ static bool enable_6lowpan; /* We are listening incoming connections via this channel */ static struct l2cap_chan *listen_chan; +static DEFINE_MUTEX(set_lock); struct lowpan_peer { struct list_head list; @@ -1195,12 +1196,14 @@ static void do_enable_set(struct work_struct *work) enable_6lowpan = set_enable->flag; + mutex_lock(&set_lock); if (listen_chan) { l2cap_chan_close(listen_chan, 0); l2cap_chan_put(listen_chan); } listen_chan = bt_6lowpan_listen(); + mutex_unlock(&set_lock); kfree(set_enable); } @@ -1252,11 +1255,13 @@ static ssize_t lowpan_control_write(struct file *fp, if (ret == -EINVAL) return ret; + mutex_lock(&set_lock); if (listen_chan) { l2cap_chan_close(listen_chan, 0); l2cap_chan_put(listen_chan); listen_chan = NULL; } + mutex_unlock(&set_lock); if (conn) { struct lowpan_peer *peer; From patchwork Thu Aug 20 09:22:23 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265660 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16304C433E1 for ; Thu, 20 Aug 2020 10:33:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CFC4520658 for ; Thu, 20 Aug 2020 10:33:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919592; bh=6XdUHVcTHv4Q3XUDPQswzH/xyKNtLCKSI1GvwszQ5Fc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=PRniho2WRwGosWrclba7yTL1RC0wNom5+AgY4rngWchGHTPuRptvHsqFisOWXGIxb DSiAkwQgQ0IIDn30Qk6Bxyy/3QhtsLG8sPWcJkLXvtWcBJ2i97gT/U/oT7YX4H+3XY ZGYibWLTzToYmLLlFImTythbSmnUkuc/ftV20f4c= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731587AbgHTKc6 (ORCPT ); Thu, 20 Aug 2020 06:32:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:44106 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731457AbgHTKTu (ORCPT ); Thu, 20 Aug 2020 06:19:50 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0169B2067C; Thu, 20 Aug 2020 10:19:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918789; bh=6XdUHVcTHv4Q3XUDPQswzH/xyKNtLCKSI1GvwszQ5Fc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GOtwcwFPcWC0olisKkra5qwZHkjc6i5NTGyn2S5PtPTKjka6ZMz2OtslooqPC/OSE se49cwXuZgT/dQrWhUWMQ8jYVUdbSsR8ys5ngKB97ASFpqG01fnsjwLc+CVnYgAXN5 AOMSKXk3dF4DuLe5nOI6q7tbcCBzrCT/tqGCFb5w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Evgeny Novikov , Jani Nikula , Mike Rapoport , Daniel Vetter , Andrew Morton , Bartlomiej Zolnierkiewicz , Sasha Levin Subject: [PATCH 4.4 066/149] video: fbdev: neofb: fix memory leak in neo_scan_monitor() Date: Thu, 20 Aug 2020 11:22:23 +0200 Message-Id: <20200820092128.936586439@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Evgeny Novikov [ Upstream commit edcb3895a751c762a18d25c8d9846ce9759ed7e1 ] neofb_probe() calls neo_scan_monitor() that can successfully allocate a memory for info->monspecs.modedb and proceed to case 0x03. There it does not free the memory and returns -1. neofb_probe() goes to label err_scan_monitor, thus, it does not free this memory through calling fb_destroy_modedb() as well. We can not go to label err_init_hw since neo_scan_monitor() can fail during memory allocation. So, the patch frees the memory directly for case 0x03. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Evgeny Novikov Cc: Jani Nikula Cc: Mike Rapoport Cc: Daniel Vetter Cc: Andrew Morton Signed-off-by: Bartlomiej Zolnierkiewicz Link: https://patchwork.freedesktop.org/patch/msgid/20200630195451.18675-1-novikov@ispras.ru Signed-off-by: Sasha Levin --- drivers/video/fbdev/neofb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/neofb.c b/drivers/video/fbdev/neofb.c index db023a97d1eae..e243254a57214 100644 --- a/drivers/video/fbdev/neofb.c +++ b/drivers/video/fbdev/neofb.c @@ -1820,6 +1820,7 @@ static int neo_scan_monitor(struct fb_info *info) #else printk(KERN_ERR "neofb: Only 640x480, 800x600/480 and 1024x768 panels are currently supported\n"); + kfree(info->monspecs.modedb); return -1; #endif default: From patchwork Thu Aug 20 09:22:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265700 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5E55C433DF for ; Thu, 20 Aug 2020 10:21:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BA83820658 for ; Thu, 20 Aug 2020 10:21:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918907; bh=tUvYHjtllxbZQA4qI9CH65ubKgchGIjpKsJigpM5qm0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=1mT8D1IODYvn542XI5ANbup18dI7g5F8QraB4zf3TrOH36QZNd7UDNTCeU8ZBBhSU v9GGosHbwTh1DtBmjITOKGjYZS6jKz07zkc0mFu9tAygUNdvbwEhCXtDdW49MaXfcz RcN8xc8MhrMrMKUCj53giD04IWrlpJEmnCBy12kA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731152AbgHTKVq (ORCPT ); Thu, 20 Aug 2020 06:21:46 -0400 Received: from mail.kernel.org ([198.145.29.99]:48584 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731567AbgHTKVp (ORCPT ); Thu, 20 Aug 2020 06:21:45 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 13B9A20658; Thu, 20 Aug 2020 10:21:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918904; bh=tUvYHjtllxbZQA4qI9CH65ubKgchGIjpKsJigpM5qm0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kTKVtLZjKUlcMMnU7nWeICrqH+ZmPpWTp142HG2/wGkwn/J/n4JhcwNjfeiutCpVX u4PEnfA/jZBOlh/HDVHBnHNPhX97lIjtkwcrx6KkQjSAzaFdB/TAiM2LFcn+O/i3O3 yiEeG3vk4C4rokbwZeGWS81cuyUshs/+CGz1g3w0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Tretter , Jani Nikula , Emil Velikov , Sasha Levin Subject: [PATCH 4.4 068/149] drm/debugfs: fix plain echo to connector "force" attribute Date: Thu, 20 Aug 2020 11:22:25 +0200 Message-Id: <20200820092129.031478447@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Michael Tretter [ Upstream commit c704b17071c4dc571dca3af4e4151dac51de081a ] Using plain echo to set the "force" connector attribute fails with -EINVAL, because echo appends a newline to the output. Replace strcmp with sysfs_streq to also accept strings that end with a newline. v2: use sysfs_streq instead of stripping trailing whitespace Signed-off-by: Michael Tretter Reviewed-by: Jani Nikula Signed-off-by: Emil Velikov Link: https://patchwork.freedesktop.org/patch/msgid/20170817104307.17124-1-m.tretter@pengutronix.de Signed-off-by: Sasha Levin --- drivers/gpu/drm/drm_debugfs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c index 3bcf8e6a85b35..5b0fdcd0b63fd 100644 --- a/drivers/gpu/drm/drm_debugfs.c +++ b/drivers/gpu/drm/drm_debugfs.c @@ -290,13 +290,13 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf, buf[len] = '\0'; - if (!strcmp(buf, "on")) + if (sysfs_streq(buf, "on")) connector->force = DRM_FORCE_ON; - else if (!strcmp(buf, "digital")) + else if (sysfs_streq(buf, "digital")) connector->force = DRM_FORCE_ON_DIGITAL; - else if (!strcmp(buf, "off")) + else if (sysfs_streq(buf, "off")) connector->force = DRM_FORCE_OFF; - else if (!strcmp(buf, "unspecified")) + else if (sysfs_streq(buf, "unspecified")) connector->force = DRM_FORCE_UNSPECIFIED; else return -EINVAL; From patchwork Thu Aug 20 09:22:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265664 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1BB1C433E1 for ; Thu, 20 Aug 2020 10:32:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id AB2AF20658 for ; Thu, 20 Aug 2020 10:32:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919544; bh=De2zk7qjFmsbhkJJUIbIDk8nhAWIFH4lcx20Cc9CYWk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=NwBZBgqLqqf1437g5SCDUbM8Kza+uuQlwS8W/lQ/2FI4/6VjDWpcAydiibrM2q9e/ UipWC9YvM4/2r9dI3P0OYCkW9qmH/yGx5yOMQmLn9JZl3X6rV5fA32dWTjWq+dH5YJ fFYfV/nYTt7ATid+uj8FQBGwHWJFRspjI4pEjHO8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730927AbgHTKcR (ORCPT ); Thu, 20 Aug 2020 06:32:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:45042 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728578AbgHTKUP (ORCPT ); Thu, 20 Aug 2020 06:20:15 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DC5CF2067C; Thu, 20 Aug 2020 10:20:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918815; bh=De2zk7qjFmsbhkJJUIbIDk8nhAWIFH4lcx20Cc9CYWk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I+C/v0X57C5kxIoS4TT8c4mCYUijyQIskFCqEG04ihOujka7Wceq4C63IpierEoMe CQVlAcMuNIOGjTd2YmqGn3dRO1dRqBdkfb45xRcHYK55EFNtLE8RH42YJv54y8JLey 3OIxZgIivXWAsF0nS9PRgbU/+FJNaiMKZjr4jdHc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrew Morton , linux-mm@kvack.org, Shakeel Butt , "Joel Fernandes (Google)" , "Paul E. McKenney" , Sasha Levin Subject: [PATCH 4.4 069/149] mm/mmap.c: Add cond_resched() for exit_mmap() CPU stalls Date: Thu, 20 Aug 2020 11:22:26 +0200 Message-Id: <20200820092129.076571262@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Paul E. McKenney [ Upstream commit 0a3b3c253a1eb2c7fe7f34086d46660c909abeb3 ] A large process running on a heavily loaded system can encounter the following RCU CPU stall warning: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 3-....: (20998 ticks this GP) idle=4ea/1/0x4000000000000002 softirq=556558/556558 fqs=5190 (t=21013 jiffies g=1005461 q=132576) NMI backtrace for cpu 3 CPU: 3 PID: 501900 Comm: aio-free-ring-w Kdump: loaded Not tainted 5.2.9-108_fbk12_rc3_3858_gb83b75af7909 #1 Hardware name: Wiwynn HoneyBadger/PantherPlus, BIOS HBM6.71 02/03/2016 Call Trace: dump_stack+0x46/0x60 nmi_cpu_backtrace.cold.3+0x13/0x50 ? lapic_can_unplug_cpu.cold.27+0x34/0x34 nmi_trigger_cpumask_backtrace+0xba/0xca rcu_dump_cpu_stacks+0x99/0xc7 rcu_sched_clock_irq.cold.87+0x1aa/0x397 ? tick_sched_do_timer+0x60/0x60 update_process_times+0x28/0x60 tick_sched_timer+0x37/0x70 __hrtimer_run_queues+0xfe/0x270 hrtimer_interrupt+0xf4/0x210 smp_apic_timer_interrupt+0x5e/0x120 apic_timer_interrupt+0xf/0x20 RIP: 0010:kmem_cache_free+0x223/0x300 Code: 88 00 00 00 0f 85 ca 00 00 00 41 8b 55 18 31 f6 f7 da 41 f6 45 0a 02 40 0f 94 c6 83 c6 05 9c 41 5e fa e8 a0 a7 01 00 41 56 9d <49> 8b 47 08 a8 03 0f 85 87 00 00 00 65 48 ff 08 e9 3d fe ff ff 65 RSP: 0018:ffffc9000e8e3da8 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13 RAX: 0000000000020000 RBX: ffff88861b9de960 RCX: 0000000000000030 RDX: fffffffffffe41e8 RSI: 000060777fe3a100 RDI: 000000000001be18 RBP: ffffea00186e7780 R08: ffffffffffffffff R09: ffffffffffffffff R10: ffff88861b9dea28 R11: ffff88887ffde000 R12: ffffffff81230a1f R13: ffff888854684dc0 R14: 0000000000000206 R15: ffff8888547dbc00 ? remove_vma+0x4f/0x60 remove_vma+0x4f/0x60 exit_mmap+0xd6/0x160 mmput+0x4a/0x110 do_exit+0x278/0xae0 ? syscall_trace_enter+0x1d3/0x2b0 ? handle_mm_fault+0xaa/0x1c0 do_group_exit+0x3a/0xa0 __x64_sys_exit_group+0x14/0x20 do_syscall_64+0x42/0x100 entry_SYSCALL_64_after_hwframe+0x44/0xa9 And on a PREEMPT=n kernel, the "while (vma)" loop in exit_mmap() can run for a very long time given a large process. This commit therefore adds a cond_resched() to this loop, providing RCU any needed quiescent states. Cc: Andrew Morton Cc: Reviewed-by: Shakeel Butt Reviewed-by: Joel Fernandes (Google) Signed-off-by: Paul E. McKenney Signed-off-by: Sasha Levin --- mm/mmap.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/mmap.c b/mm/mmap.c index a24e424770012..135cccce41f88 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2954,6 +2954,7 @@ void exit_mmap(struct mm_struct *mm) if (vma->vm_flags & VM_ACCOUNT) nr_accounted += vma_pages(vma); vma = remove_vma(vma); + cond_resched(); } vm_unacct_memory(nr_accounted); } From patchwork Thu Aug 20 09:22:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265673 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B9E5C433E3 for ; Thu, 20 Aug 2020 10:28:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D70B920658 for ; Thu, 20 Aug 2020 10:28:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919336; bh=e67Q7fUocfvXwkXO46xKXeEDHFgqw3oy/4IMdy9WuyI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=quiw73u/4YcHzj6jVkL/yTZReiDsQJ7WJsjeHEv5AL9MBkJwynscjZ3k7CdVa+r/q DvhnDmyas4FALaZWxYtYW3al6XXY5Ia73RHlrtFQWTjY1zEV6sMdHHitkfz8QZVWZd wA9sDq4NHKtR7+85YgYoysiagxYcfO38bF8K1yKc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731665AbgHTK24 (ORCPT ); Thu, 20 Aug 2020 06:28:56 -0400 Received: from mail.kernel.org ([198.145.29.99]:47948 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731354AbgHTKV1 (ORCPT ); Thu, 20 Aug 2020 06:21:27 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EBB7420738; Thu, 20 Aug 2020 10:21:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918887; bh=e67Q7fUocfvXwkXO46xKXeEDHFgqw3oy/4IMdy9WuyI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Iv5dekVPIYFBikdTdmK5KrucP7onT1tcTZ9Tdi5FoNQ3Gs2YPLqrEf8UKrT/FdRwj QRrVPz4YB3PPYHOeCL05aprG3NfYHdDI9zwDmF9HMuJv0M4Nuz8AWoRxUnc5+ODVwR Fw6c9YQG4qVSkXCBw/vIMO1SHFTTZSHgZCRFRm68= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Evgeny Novikov , Felipe Balbi , Sasha Levin Subject: [PATCH 4.4 072/149] usb: gadget: net2280: fix memory leak on probe error handling paths Date: Thu, 20 Aug 2020 11:22:29 +0200 Message-Id: <20200820092129.220631931@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Evgeny Novikov [ Upstream commit 2468c877da428ebfd701142c4cdfefcfb7d4c00e ] Driver does not release memory for device on error handling paths in net2280_probe() when gadget_release() is not registered yet. The patch fixes the bug like in other similar drivers. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Evgeny Novikov Signed-off-by: Felipe Balbi Signed-off-by: Sasha Levin --- drivers/usb/gadget/udc/net2280.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c index 3a8d056a5d16b..48dd0da21e2b4 100644 --- a/drivers/usb/gadget/udc/net2280.c +++ b/drivers/usb/gadget/udc/net2280.c @@ -3712,8 +3712,10 @@ static int net2280_probe(struct pci_dev *pdev, const struct pci_device_id *id) return 0; done: - if (dev) + if (dev) { net2280_remove(pdev); + kfree(dev); + } return retval; } From patchwork Thu Aug 20 09:22:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265701 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0708FC433DF for ; Thu, 20 Aug 2020 10:21:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D4AFC20658 for ; Thu, 20 Aug 2020 10:21:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918897; bh=dFDUeVvVdY8Fs9I9C6hZNkObUoIHi4TQ5HEz4oU+ZtI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=OYOGYmP+Lffy4rwPzxKczaBLFRPsfFhbsq9OdRB6O4YcSpFBFH22bJRjC8N8mEju3 Pn0O4mJiiMS4q5PMwiHyUViaLx2xgM9g5+C9dbvUHWpszZovN/FpzXnAG5gay9mfy4 rYkMttcokupSR5iU0/4flBcn6N/nYhhFZ7X7V0GM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731550AbgHTKVf (ORCPT ); Thu, 20 Aug 2020 06:21:35 -0400 Received: from mail.kernel.org ([198.145.29.99]:48068 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731542AbgHTKVb (ORCPT ); Thu, 20 Aug 2020 06:21:31 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5C8BF2072D; Thu, 20 Aug 2020 10:21:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918889; bh=dFDUeVvVdY8Fs9I9C6hZNkObUoIHi4TQ5HEz4oU+ZtI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Zk0lpkvWT0YJBqpNBWTF7s50o9m5wKITbuwEE9Hi0Pv5bfO0wW69mWF2oAwyVQV1t 25J9gvLPgtNlpqYQ273KG2POcMm13ljzDZIqjj1nlJaWzvet6cyGFvsyaiz0ltLDJr j0mPtKEqfw+I3ItYta/suPUpGIysH9xp+GHqYutc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sasi Kumar , Al Cooper , Florian Fainelli , Felipe Balbi , Sasha Levin Subject: [PATCH 4.4 073/149] bdc: Fix bug causing crash after multiple disconnects Date: Thu, 20 Aug 2020 11:22:30 +0200 Message-Id: <20200820092129.269882909@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Sasi Kumar [ Upstream commit a95bdfd22076497288868c028619bc5995f5cc7f ] Multiple connects/disconnects can cause a crash on the second disconnect. The driver had a problem where it would try to send endpoint commands after it was disconnected which is not allowed by the hardware. The fix is to only allow the endpoint commands when the endpoint is connected. This will also fix issues that showed up when using configfs to create gadgets. Signed-off-by: Sasi Kumar Signed-off-by: Al Cooper Acked-by: Florian Fainelli Signed-off-by: Felipe Balbi Signed-off-by: Sasha Levin --- drivers/usb/gadget/udc/bdc/bdc_core.c | 4 ++++ drivers/usb/gadget/udc/bdc/bdc_ep.c | 16 ++++++++++------ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c index e9bd8d4abca00..f09a74d79c9eb 100644 --- a/drivers/usb/gadget/udc/bdc/bdc_core.c +++ b/drivers/usb/gadget/udc/bdc/bdc_core.c @@ -286,6 +286,7 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit) * in that case reinit is passed as 1 */ if (reinit) { + int i; /* Enable interrupts */ temp = bdc_readl(bdc->regs, BDC_BDCSC); temp |= BDC_GIE; @@ -295,6 +296,9 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit) /* Initialize SRR to 0 */ memset(bdc->srr.sr_bds, 0, NUM_SR_ENTRIES * sizeof(struct bdc_bd)); + /* clear ep flags to avoid post disconnect stops/deconfigs */ + for (i = 1; i < bdc->num_eps; ++i) + bdc->bdc_ep_array[i]->flags = 0; } else { /* One time initiaization only */ /* Enable status report function pointers */ diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c index 3a65272fbed86..9f5f18891ba85 100644 --- a/drivers/usb/gadget/udc/bdc/bdc_ep.c +++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c @@ -621,7 +621,6 @@ int bdc_ep_enable(struct bdc_ep *ep) } bdc_dbg_bd_list(bdc, ep); /* only for ep0: config ep is called for ep0 from connect event */ - ep->flags |= BDC_EP_ENABLED; if (ep->ep_num == 1) return ret; @@ -767,10 +766,13 @@ static int ep_dequeue(struct bdc_ep *ep, struct bdc_req *req) __func__, ep->name, start_bdi, end_bdi); dev_dbg(bdc->dev, "ep_dequeue ep=%p ep->desc=%p\n", ep, (void *)ep->usb_ep.desc); - /* Stop the ep to see where the HW is ? */ - ret = bdc_stop_ep(bdc, ep->ep_num); - /* if there is an issue with stopping ep, then no need to go further */ - if (ret) + /* if still connected, stop the ep to see where the HW is ? */ + if (!(bdc_readl(bdc->regs, BDC_USPC) & BDC_PST_MASK)) { + ret = bdc_stop_ep(bdc, ep->ep_num); + /* if there is an issue, then no need to go further */ + if (ret) + return 0; + } else return 0; /* @@ -1921,7 +1923,9 @@ static int bdc_gadget_ep_disable(struct usb_ep *_ep) __func__, ep->name, ep->flags); if (!(ep->flags & BDC_EP_ENABLED)) { - dev_warn(bdc->dev, "%s is already disabled\n", ep->name); + if (bdc->gadget.speed != USB_SPEED_UNKNOWN) + dev_warn(bdc->dev, "%s is already disabled\n", + ep->name); return 0; } spin_lock_irqsave(&bdc->lock, flags); From patchwork Thu Aug 20 09:22:32 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265674 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03E14C433E1 for ; Thu, 20 Aug 2020 10:28:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D4C2F20658 for ; Thu, 20 Aug 2020 10:28:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919326; bh=HC8oHq7fJG1RBCuzDFQfpZGuk2RXpAtpBuCpvgHUtvc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=FAcFbDNA6HWRoFMhRDYfR7Cg7FhEwLMmzXnzpkD3MMlkyX/uAHTwDB1ta4uYE9yk9 O/MGnzThj87GkPx373guJWoy8S0Khj1M0G4wJ9Am7Ro0qmjpvxWtY8uc9ZRoJtiYul MJKZNIqNUnx4v7fcpxTPoP7EwvDLLS0LskNzEqHg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730779AbgHTK2p (ORCPT ); Thu, 20 Aug 2020 06:28:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:48290 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731552AbgHTKVg (ORCPT ); Thu, 20 Aug 2020 06:21:36 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5D1B220658; Thu, 20 Aug 2020 10:21:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918895; bh=HC8oHq7fJG1RBCuzDFQfpZGuk2RXpAtpBuCpvgHUtvc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NmY1w3GGTYsOn2mKV5cMIHeVSwdCntlnE0wWKnCeVAKVO74IE70w03S+NPPPh0WXH 3kGpyMoDI132i+YIAgJFDJdecdQIGQJJZjUjDwYMr8ommRcPHFSBvJx8WaHfUCfPk6 dX27OE2Rfs/CVwPzakFXWPUB52Bqe+RGtmXrpZkk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Coly Li , Hannes Reinecke , Jens Axboe , Sasha Levin Subject: [PATCH 4.4 075/149] bcache: fix super block seq numbers comparision in register_cache_set() Date: Thu, 20 Aug 2020 11:22:32 +0200 Message-Id: <20200820092129.362763793@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Coly Li [ Upstream commit 117f636ea695270fe492d0c0c9dfadc7a662af47 ] In register_cache_set(), c is pointer to struct cache_set, and ca is pointer to struct cache, if ca->sb.seq > c->sb.seq, it means this registering cache has up to date version and other members, the in- memory version and other members should be updated to the newer value. But current implementation makes a cache set only has a single cache device, so the above assumption works well except for a special case. The execption is when a cache device new created and both ca->sb.seq and c->sb.seq are 0, because the super block is never flushed out yet. In the location for the following if() check, 2156 if (ca->sb.seq > c->sb.seq) { 2157 c->sb.version = ca->sb.version; 2158 memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16); 2159 c->sb.flags = ca->sb.flags; 2160 c->sb.seq = ca->sb.seq; 2161 pr_debug("set version = %llu\n", c->sb.version); 2162 } c->sb.version is not initialized yet and valued 0. When ca->sb.seq is 0, the if() check will fail (because both values are 0), and the cache set version, set_uuid, flags and seq won't be updated. The above problem is hiden for current code, because the bucket size is compatible among different super block version. And the next time when running cache set again, ca->sb.seq will be larger than 0 and cache set super block version will be updated properly. But if the large bucket feature is enabled, sb->bucket_size is the low 16bits of the bucket size. For a power of 2 value, when the actual bucket size exceeds 16bit width, sb->bucket_size will always be 0. Then read_super_common() will fail because the if() check to is_power_of_2(sb->bucket_size) is false. This is how the long time hidden bug is triggered. This patch modifies the if() check to the following way, 2156 if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) { Then cache set's version, set_uuid, flags and seq will always be updated corectly including for a new created cache device. Signed-off-by: Coly Li Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin --- drivers/md/bcache/super.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index df8f1e69077f6..23ffd4469dabb 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1778,7 +1778,14 @@ static const char *register_cache_set(struct cache *ca) sysfs_create_link(&c->kobj, &ca->kobj, buf)) goto err; - if (ca->sb.seq > c->sb.seq) { + /* + * A special case is both ca->sb.seq and c->sb.seq are 0, + * such condition happens on a new created cache device whose + * super block is never flushed yet. In this case c->sb.version + * and other members should be updated too, otherwise we will + * have a mistaken super block version in cache set. + */ + if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) { c->sb.version = ca->sb.version; memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16); c->sb.flags = ca->sb.flags; From patchwork Thu Aug 20 09:22:37 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265706 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9731C433DF for ; Thu, 20 Aug 2020 10:20:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 89E7A2072D for ; Thu, 20 Aug 2020 10:20:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918832; bh=LlUgNbk1YjcZULzOtahIsEpUg1DS5mkIOYr/0JVGRNU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=mmKLFFdlmjZnS7UQplLm1R3H1WejsmMg1yL5nb3sUnf6DveIsPk+nJW6rWwC/hPaC IYzjEaRRH1AGXUGzpZOvMp98XnkUxrarmW4loT65okx6zofWShqFut1RopQwROG9F/ BmGdD8qfLL7oAZS9X3yXGSx5xgsrCsnvFI+vYGB8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731472AbgHTKUa (ORCPT ); Thu, 20 Aug 2020 06:20:30 -0400 Received: from mail.kernel.org ([198.145.29.99]:45042 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731465AbgHTKUZ (ORCPT ); Thu, 20 Aug 2020 06:20:25 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2C93F20885; Thu, 20 Aug 2020 10:20:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918823; bh=LlUgNbk1YjcZULzOtahIsEpUg1DS5mkIOYr/0JVGRNU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I+ukEV/JSlAE2ARcJRUTvDY1944VdL3z6FEM8gmXv4bvKH0faiFmMVQOMY4gBWUw7 nnZA9nQC3OQhl0DNZtVcHdbNGqrQMwRPB4bD+2PtDDetpJ9eilwFKFXQu4c23jJoks yepwQ05YJqFbgBUzHxsyP8gVd1lPSZAGClhcTHYo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tomasz Duszynski , Matt Ranostay , Jonathan Cameron , Sasha Levin Subject: [PATCH 4.4 080/149] iio: improve IIO_CONCENTRATION channel type description Date: Thu, 20 Aug 2020 11:22:37 +0200 Message-Id: <20200820092129.601055548@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tomasz Duszynski [ Upstream commit df16c33a4028159d1ba8a7061c9fa950b58d1a61 ] IIO_CONCENTRATION together with INFO_RAW specifier is used for reporting raw concentrations of pollutants. Raw value should be meaningless before being properly scaled. Because of that description shouldn't mention raw value unit whatsoever. Fix this by rephrasing existing description so it follows conventions used throughout IIO ABI docs. Fixes: 8ff6b3bc94930 ("iio: chemical: Add IIO_CONCENTRATION channel type") Signed-off-by: Tomasz Duszynski Acked-by: Matt Ranostay Signed-off-by: Jonathan Cameron Signed-off-by: Sasha Levin --- Documentation/ABI/testing/sysfs-bus-iio | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio index 0439c2aaf7419..f20c783cb5c03 100644 --- a/Documentation/ABI/testing/sysfs-bus-iio +++ b/Documentation/ABI/testing/sysfs-bus-iio @@ -1470,7 +1470,8 @@ What: /sys/bus/iio/devices/iio:deviceX/in_concentrationX_voc_raw KernelVersion: 4.3 Contact: linux-iio@vger.kernel.org Description: - Raw (unscaled no offset etc.) percentage reading of a substance. + Raw (unscaled no offset etc.) reading of a substance. Units + after application of scale and offset are percents. What: /sys/bus/iio/devices/iio:deviceX/in_resistance_raw What: /sys/bus/iio/devices/iio:deviceX/in_resistanceX_raw From patchwork Thu Aug 20 09:22:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 248017 Delivered-To: patch@linaro.org Received: by 2002:a05:6e02:522:0:0:0:0 with SMTP id h2csp1219755ils; Thu, 20 Aug 2020 03:20:37 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzpbKlaBwwFXUUYBtsBKuc8HmiqjIaoeSVSe4Txh4dzqlaHXDACnpZ1M+A+OF/P0XJn9F9h X-Received: by 2002:a17:906:8587:: with SMTP id v7mr929148ejx.268.1597918837485; Thu, 20 Aug 2020 03:20:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1597918837; cv=none; d=google.com; s=arc-20160816; b=H8a1kwsKC35LOeoT9q04vWdssF7O6a6steEQ8Lkvva9dM/Fco0ESKUPCekigxywqqt Z0pP44eNGgcYI/iA8L8R1+CxsjYuQAyow5FZFwMyKq9p912/a1e0BlVW0Q72Jx5V8OWa W7iadf+3EMfQsk0Ju+npDYsTWIlbr1msz5Z71Y3cg8yLeLL5GyekZxi0VH4mW/igUsY5 wiJFUMYdeZz7Og1+DVLohL6EEqHahAw5uP/f4KUZ7Z5qspLwlafKFyAvh0zVxO6TsUgT /q+All2hFV5NraLqfB60OphRGiQu3VgRcFqeiyd1mKKXBeWRmaIMaJNfNmG5ji0dxJRP +bDQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=BY4jMNrWB1HFixfudmJ6QhqKuvocFJ6So1J2aEsWoOM=; b=giey7MFy2bveFJg+8yNBCY5EQSW7W5b5XjlNc5jSs6iSpsgEMTgsWxAv9WED50vGvu N/Yyx6oWyzyhkx+1irsPIDdi/VBUjdQTBYx+6REH9IxZo2Yvsxq1oD+0VMxdJ+IcVHPx sG/jUSJXTDMB/V838l8uoEIjlzcgNdGD1aZelAWRKk+whGeVXSJB+IP3GykG2uN15tAj nT8CEkK3OXENRadxGRvJIgo9TKEX4ULJLq/XEP1SWu37leXr6wUqqNoLrxBfcZotwOYf HRipKyX0FiskOcss/5nNIcNzBKb65WgZOqig9mXuAbcRhd/OyOK9IlwL9tCT/B3bQwWV Pd0g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=rI6r8Rbp; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id p22si1175171eds.169.2020.08.20.03.20.37; Thu, 20 Aug 2020 03:20:37 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=rI6r8Rbp; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731462AbgHTKUc (ORCPT + 15 others); Thu, 20 Aug 2020 06:20:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:45290 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731468AbgHTKU0 (ORCPT ); Thu, 20 Aug 2020 06:20:26 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B64962067C; Thu, 20 Aug 2020 10:20:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918826; bh=xm8dGOL3MbBbXctBckHxO53cRD7TlCl9qAdlABiPdy0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rI6r8Rbphy8JBZDuOi8+frtXrvaERauhdhlz0Ihi0i81eHZRJGBDlFpy/zS3Lkxxx YRpOyek2+WDf5trRyspo/i5nC0iKBvB9lQqMwHEE5fweiiScsioY4/AGjYcem9heAv S9WFLMArNFkoRsqr3ICIDQTNEUIpYygXf51lGiZg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arnd Bergmann , Pavel Machek , Sasha Levin Subject: [PATCH 4.4 081/149] leds: lm355x: avoid enum conversion warning Date: Thu, 20 Aug 2020 11:22:38 +0200 Message-Id: <20200820092129.649983396@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Arnd Bergmann [ Upstream commit 985b1f596f9ed56f42b8c2280005f943e1434c06 ] clang points out that doing arithmetic between diffent enums is usually a mistake: drivers/leds/leds-lm355x.c:167:28: warning: bitwise operation between different enumeration types ('enum lm355x_tx2' and 'enum lm355x_ntc') [-Wenum-enum-conversion] reg_val = pdata->pin_tx2 | pdata->ntc_pin; ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~ drivers/leds/leds-lm355x.c:178:28: warning: bitwise operation between different enumeration types ('enum lm355x_tx2' and 'enum lm355x_ntc') [-Wenum-enum-conversion] reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode; ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~ In this driver, it is intentional, so add a cast to hide the false-positive warning. It appears to be the only instance of this warning at the moment. Fixes: b98d13c72592 ("leds: Add new LED driver for lm355x chips") Signed-off-by: Arnd Bergmann Signed-off-by: Pavel Machek Signed-off-by: Sasha Levin --- drivers/leds/leds-lm355x.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) -- 2.25.1 diff --git a/drivers/leds/leds-lm355x.c b/drivers/leds/leds-lm355x.c index 48872997d6b4b..533b255c27cd6 100644 --- a/drivers/leds/leds-lm355x.c +++ b/drivers/leds/leds-lm355x.c @@ -177,18 +177,19 @@ static int lm355x_chip_init(struct lm355x_chip_data *chip) /* input and output pins configuration */ switch (chip->type) { case CHIP_LM3554: - reg_val = pdata->pin_tx2 | pdata->ntc_pin; + reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin; ret = regmap_update_bits(chip->regmap, 0xE0, 0x28, reg_val); if (ret < 0) goto out; - reg_val = pdata->pass_mode; + reg_val = (u32)pdata->pass_mode; ret = regmap_update_bits(chip->regmap, 0xA0, 0x04, reg_val); if (ret < 0) goto out; break; case CHIP_LM3556: - reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode; + reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin | + (u32)pdata->pass_mode; ret = regmap_update_bits(chip->regmap, 0x0A, 0xC4, reg_val); if (ret < 0) goto out; From patchwork Thu Aug 20 09:22:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265666 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E728DC433E1 for ; Thu, 20 Aug 2020 10:32:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C62A32075E for ; Thu, 20 Aug 2020 10:32:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919521; bh=6FhLavvRW1IYPm5muXfh+oDJE0gjyK0gs84mcs6Ez/U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ZxIx3BgSRpqg/lGjKEyffXNk33VFdT3rEyM7xzrmcU5pDozRMOz/wV9/IumVivrbJ 9fdq8vC8MAqWoLQ56j+h/liJ00/3rTyO9g6lvMAzfl5CcNM2mNxk1v7540LQ8kdDFK /HpL5lQ46oryd6mg9gCQyL1R5VdPmvIv5Bf1pyTY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729392AbgHTKb7 (ORCPT ); Thu, 20 Aug 2020 06:31:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:45042 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729685AbgHTKUa (ORCPT ); Thu, 20 Aug 2020 06:20:30 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3BE4020658; Thu, 20 Aug 2020 10:20:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918828; bh=6FhLavvRW1IYPm5muXfh+oDJE0gjyK0gs84mcs6Ez/U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jhR3Y+V9s8JHLYG4MmVqzOSwn5oDqHqpfuIG+z99vcxbzP836PV4WLNzNYyOv/7yI /kSkZ+oEd4fHrPU3G2LM/FGAu4w6ODFc+ZXUSn9K1GOR3EWXZTWN2xk3fUMCY1SdVk NRRj6hxacFLZtpwpdlOzlZzJaI2V4TBvfPZ2ROTg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chuhong Yuan , Laurent Pinchart , Sakari Ailus , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.4 082/149] media: omap3isp: Add missed v4l2_ctrl_handler_free() for preview_init_entities() Date: Thu, 20 Aug 2020 11:22:39 +0200 Message-Id: <20200820092129.694754829@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Chuhong Yuan [ Upstream commit dc7690a73017e1236202022e26a6aa133f239c8c ] preview_init_entities() does not call v4l2_ctrl_handler_free() when it fails. Add the missed function to fix it. Fixes: de1135d44f4f ("[media] omap3isp: CCDC, preview engine and resizer") Signed-off-by: Chuhong Yuan Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/platform/omap3isp/isppreview.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c index c9e8845de1b1d..c3336a2cbe145 100644 --- a/drivers/media/platform/omap3isp/isppreview.c +++ b/drivers/media/platform/omap3isp/isppreview.c @@ -2285,7 +2285,7 @@ static int preview_init_entities(struct isp_prev_device *prev) me->ops = &preview_media_ops; ret = media_entity_init(me, PREV_PADS_NUM, pads, 0); if (ret < 0) - return ret; + goto error_handler_free; preview_init_formats(sd, NULL); @@ -2331,6 +2331,8 @@ static int preview_init_entities(struct isp_prev_device *prev) omap3isp_video_cleanup(&prev->video_in); error_video_in: media_entity_cleanup(&prev->subdev.entity); +error_handler_free: + v4l2_ctrl_handler_free(&prev->ctrls); return ret; } From patchwork Thu Aug 20 09:22:40 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265705 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6954C433DF for ; Thu, 20 Aug 2020 10:20:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9C6FA20658 for ; Thu, 20 Aug 2020 10:20:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918839; bh=WLyA88J8T3spRMLusXNJPpUS4D63ON4Do1QvNlJ1D3Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=EiqGyvbsOLpEu580iZGNNYdZ2ND9dWCkuCbCjfQPceytwn6q9quolKDAIWIU+4qoW TgNEc9/3D1xywTHnPQq/F1VMsqidV81oSMEwBL2En56JTzbb95xt1u+DPPJLpbeg9i sdAo8Cd7QMtmDcn3uM1EPUhEp/cPeU7/dNtP5wFQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731233AbgHTKUc (ORCPT ); Thu, 20 Aug 2020 06:20:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:45290 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730384AbgHTKUb (ORCPT ); Thu, 20 Aug 2020 06:20:31 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C49BF2067C; Thu, 20 Aug 2020 10:20:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918831; bh=WLyA88J8T3spRMLusXNJPpUS4D63ON4Do1QvNlJ1D3Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=l4KM/oaI8ZmhPDX6k3lSqxUNzIX94AO605lRe9nzjsLftdB/UPKk9pxp//brOnr3V SVNPxTr3mBCd/SJUmG90ZVP8Eao11xu7zazftkThvWHNtHSsfswAZ0exsHdvDx4q/s Fk6Vwr4sBk54E0S8QPcL6h7czWXyaEz9BLkgjUqk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Russell King , Christophe JAILLET , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.4 083/149] scsi: cumana_2: Fix different dev_id between request_irq() and free_irq() Date: Thu, 20 Aug 2020 11:22:40 +0200 Message-Id: <20200820092129.744289920@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Christophe JAILLET [ Upstream commit 040ab9c4fd0070cd5fa71ba3a7b95b8470db9b4d ] The dev_id used in request_irq() and free_irq() should match. Use 'info' in both cases. Link: https://lore.kernel.org/r/20200625204730.943520-1-christophe.jaillet@wanadoo.fr Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Acked-by: Russell King Signed-off-by: Christophe JAILLET Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/arm/cumana_2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c index faa1bee07c8ac..0c83a155ceebc 100644 --- a/drivers/scsi/arm/cumana_2.c +++ b/drivers/scsi/arm/cumana_2.c @@ -454,7 +454,7 @@ static int cumanascsi2_probe(struct expansion_card *ec, if (info->info.scsi.dma != NO_DMA) free_dma(info->info.scsi.dma); - free_irq(ec->irq, host); + free_irq(ec->irq, info); out_release: fas216_release(host); From patchwork Thu Aug 20 09:22:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265667 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2C8EC433E1 for ; Thu, 20 Aug 2020 10:31:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A572420738 for ; Thu, 20 Aug 2020 10:31:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919518; bh=BH4EgUBXqCSKKBSJ4WJk4gUi3wBwFwK4qnMhCc55oyM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=oLmmvR2wib6Di+tAt05qGnPYlNHxqAHJQRwJik4epP1/2q8xe5yMSa8nxN9wNKOsK 3ALhcvSJ5dKhUaHjoqqvRvIahFbsOyzOMBdLCI2+mQUIz+pQahd4xr/E4Cxf/a4LNE cks2R80AdJD7zie2vpFPuBfbxEcFpNoN19j5xrWo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730896AbgHTKbj (ORCPT ); Thu, 20 Aug 2020 06:31:39 -0400 Received: from mail.kernel.org ([198.145.29.99]:45830 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731301AbgHTKUf (ORCPT ); Thu, 20 Aug 2020 06:20:35 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A15EE2067C; Thu, 20 Aug 2020 10:20:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918834; bh=BH4EgUBXqCSKKBSJ4WJk4gUi3wBwFwK4qnMhCc55oyM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qvMrzIZ9zxwGYOB1IqlzKsMStkhIK16FfmEnRi2c902tVgHz/IPUuA/WDJ/qFZ/WC N0m14MkVctQVxahdVOcPOUSpFCK7fLMOt9f0VVNvyoSM97tAfl7p/iFvS7wFKvUY3p IjQnHIwRPjqKP0zkDzpeJwnZnVVtYbO4U5aK1Pn0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wang Hai , Andrew Donnellan , Frederic Barrat , Sasha Levin Subject: [PATCH 4.4 084/149] cxl: Fix kobject memleak Date: Thu, 20 Aug 2020 11:22:41 +0200 Message-Id: <20200820092129.791728489@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Wang Hai [ Upstream commit 85c5cbeba8f4fb28e6b9bfb3e467718385f78f76 ] Currently the error return path from kobject_init_and_add() is not followed by a call to kobject_put() - which means we are leaking the kobject. Fix it by adding a call to kobject_put() in the error path of kobject_init_and_add(). Fixes: b087e6190ddc ("cxl: Export optional AFU configuration record in sysfs") Reported-by: Hulk Robot Signed-off-by: Wang Hai Acked-by: Andrew Donnellan Acked-by: Frederic Barrat Link: https://lore.kernel.org/r/20200602120733.5943-1-wanghai38@huawei.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/misc/cxl/sysfs.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) --- a/drivers/misc/cxl/sysfs.c +++ b/drivers/misc/cxl/sysfs.c @@ -539,7 +539,7 @@ static struct afu_config_record *cxl_sys rc = kobject_init_and_add(&cr->kobj, &afu_config_record_type, &afu->dev.kobj, "cr%i", cr->cr); if (rc) - goto err; + goto err1; rc = sysfs_create_bin_file(&cr->kobj, &cr->config_attr); if (rc) @@ -555,9 +555,6 @@ err2: err1: kobject_put(&cr->kobj); return ERR_PTR(rc); -err: - kfree(cr); - return ERR_PTR(rc); } void cxl_sysfs_afu_remove(struct cxl_afu *afu) From patchwork Thu Aug 20 09:22:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265704 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C575CC433E1 for ; Thu, 20 Aug 2020 10:20:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8C10F20658 for ; Thu, 20 Aug 2020 10:20:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918845; bh=+Ap2wQZ5CvXjKST15Vs/LrwEjznqAVZjmrVx/SdkBzk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=TAHcB5mwoms6VupAda51Pu5OLjs5c7fvSqASeclaqKC38R19Gsw8IooHBfa3/zwOJ vayq/VsLTtMpomjII0HsLsIgiAI0Mmg803BLW8cv3SZRG4p0RjqYiu/wAW4FTRJBk6 DZOnuaQMghv6N07aTOdk9dMGfMkIvvIQUXH4fgag= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729344AbgHTKUo (ORCPT ); Thu, 20 Aug 2020 06:20:44 -0400 Received: from mail.kernel.org ([198.145.29.99]:46140 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728040AbgHTKUn (ORCPT ); Thu, 20 Aug 2020 06:20:43 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id F31C720658; Thu, 20 Aug 2020 10:20:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918842; bh=+Ap2wQZ5CvXjKST15Vs/LrwEjznqAVZjmrVx/SdkBzk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=reAYrC1KF5ZMYbw0JPbhDHx9CA6WJ/VomuQBccamckSaYSkw7hw2htUTR6EywSDS6 w2ttvZACdpDPyybj4MfDnUwDMwmXOHGvGdyTo9Gn9i9khhi5PlBk1j9zT4k1pnBNJU gX468lvKdADn9dLT2zFh7ryWpG3niMswsYCVi3mM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.4 087/149] scsi: eesox: Fix different dev_id between request_irq() and free_irq() Date: Thu, 20 Aug 2020 11:22:44 +0200 Message-Id: <20200820092129.940896936@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Christophe JAILLET [ Upstream commit 86f2da1112ccf744ad9068b1d5d9843faf8ddee6 ] The dev_id used in request_irq() and free_irq() should match. Use 'info' in both cases. Link: https://lore.kernel.org/r/20200626040553.944352-1-christophe.jaillet@wanadoo.fr Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Christophe JAILLET Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/arm/eesox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/arm/eesox.c b/drivers/scsi/arm/eesox.c index a8ad6880dd914..cf01442d91363 100644 --- a/drivers/scsi/arm/eesox.c +++ b/drivers/scsi/arm/eesox.c @@ -575,7 +575,7 @@ static int eesoxscsi_probe(struct expansion_card *ec, const struct ecard_id *id) if (info->info.scsi.dma != NO_DMA) free_dma(info->info.scsi.dma); - free_irq(ec->irq, host); + free_irq(ec->irq, info); out_remove: fas216_remove(host); From patchwork Thu Aug 20 09:22:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265668 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4DC7C433DF for ; Thu, 20 Aug 2020 10:31:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 851E52075E for ; Thu, 20 Aug 2020 10:31:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919477; bh=VsjZbyDoFnSpuIJdUWlBT69iwFkVIb5It172DSCdcZ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=rJdpSiSdhZZrj+TLLlz7JFfjDTAM4YG7E7q2myU/3gp5iasRhkmF+1OlWgeCk8l5J VaUhhqwrgw7XymCO3Q0DwByiVebC0RnKHTDEOB5izn0xVJZTfJcj9pKgnOofVIExB1 siASp+WHGjGPhB4tcIonvnQSFovzaWL6Lbnkfx8E= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730962AbgHTKbP (ORCPT ); Thu, 20 Aug 2020 06:31:15 -0400 Received: from mail.kernel.org ([198.145.29.99]:46446 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730281AbgHTKUt (ORCPT ); Thu, 20 Aug 2020 06:20:49 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 288F82076E; Thu, 20 Aug 2020 10:20:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918848; bh=VsjZbyDoFnSpuIJdUWlBT69iwFkVIb5It172DSCdcZ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=f8WRoOwi6ix0rw3eJvsnpnuO2HLcnXK+xOnw2mjFxWkIKS/4fTGDiTb3IRukZzIzm grx8woxPTjpWYp1u27SpTc+CNskLY3U6vxHlS0HKShdNkSyW4VNhn+Xlk+cyYxBI3U 4ku/H7KaIVj6DH4Moo+v1DecK2T1g7Qgsmfvtp0Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.4 088/149] media: firewire: Using uninitialized values in node_probe() Date: Thu, 20 Aug 2020 11:22:45 +0200 Message-Id: <20200820092129.989276439@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dan Carpenter [ Upstream commit 2505a210fc126599013aec2be741df20aaacc490 ] If fw_csr_string() returns -ENOENT, then "name" is uninitialized. So then the "strlen(model_names[i]) <= name_len" is true because strlen() is unsigned and -ENOENT is type promoted to a very high positive value. Then the "strncmp(name, model_names[i], name_len)" uses uninitialized data because "name" is uninitialized. Fixes: 92374e886c75 ("[media] firedtv: drop obsolete backend abstraction") Signed-off-by: Dan Carpenter Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/firewire/firedtv-fw.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c index 247f0e7cb5f7f..5d634706a7eaa 100644 --- a/drivers/media/firewire/firedtv-fw.c +++ b/drivers/media/firewire/firedtv-fw.c @@ -271,6 +271,8 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id) name_len = fw_csr_string(unit->directory, CSR_MODEL, name, sizeof(name)); + if (name_len < 0) + return name_len; for (i = ARRAY_SIZE(model_names); --i; ) if (strlen(model_names[i]) <= name_len && strncmp(name, model_names[i], name_len) == 0) From patchwork Thu Aug 20 09:22:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265703 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CFA1AC433DF for ; Thu, 20 Aug 2020 10:21:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A57582075E for ; Thu, 20 Aug 2020 10:21:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918861; bh=G28ve71zjd6PmMq9nLFalJ5EoHPctVPUwTcnmlLeZg4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=cz1G5m8P45T4SN+V3rGiaXb/RcdyZowGWFskMo0C9TB3r6b0JboKXmcdCCFF/ksfX 0SNL1W465d27C7wVr9XEY8uW/pZP42AOQnIQuQtzgqLqFDcx1pTRQ9PoKZfDHV8stJ +LAztRYi6fdsqdKEQNYmu+XVPtsZIL89RH8Qi1Xw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731513AbgHTKU7 (ORCPT ); Thu, 20 Aug 2020 06:20:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:46796 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731519AbgHTKU6 (ORCPT ); Thu, 20 Aug 2020 06:20:58 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2C5482078B; Thu, 20 Aug 2020 10:20:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918857; bh=G28ve71zjd6PmMq9nLFalJ5EoHPctVPUwTcnmlLeZg4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QJunXsP4/4LEFERTPAGrwuNRH1u8Nqb03VCzK91hbjN75u3OGYdUqoL0Wa5KalHZx y1yksBjOH03FgC4lkg1i1rw48dHZldLl0zfcHlzCL2Rs70qGxcMCCg3M0dJ1gHQoq7 l5FAVJ5j+jf6PofOqmQzvGwot+j1awvzMErhUL/8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Ganapathi Bhat , Kalle Valo , Sasha Levin Subject: [PATCH 4.4 091/149] mwifiex: Prevent memory corruption handling keys Date: Thu, 20 Aug 2020 11:22:48 +0200 Message-Id: <20200820092130.135063750@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dan Carpenter [ Upstream commit e18696786548244914f36ec3c46ac99c53df99c3 ] The length of the key comes from the network and it's a 16 bit number. It needs to be capped to prevent a buffer overflow. Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by: Dan Carpenter Acked-by: Ganapathi Bhat Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200708115857.GA13729@mwanda Signed-off-by: Sasha Levin --- drivers/net/wireless/mwifiex/sta_cmdresp.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c index 9ac7aa2431b41..9e3853c8a22da 100644 --- a/drivers/net/wireless/mwifiex/sta_cmdresp.c +++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c @@ -592,6 +592,11 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, { struct host_cmd_ds_802_11_key_material *key = &resp->params.key_material; + int len; + + len = le16_to_cpu(key->key_param_set.key_len); + if (len > sizeof(key->key_param_set.key)) + return -EINVAL; if (le16_to_cpu(key->action) == HostCmd_ACT_GEN_SET) { if ((le16_to_cpu(key->key_param_set.key_info) & KEY_MCAST)) { @@ -605,9 +610,8 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, memset(priv->aes_key.key_param_set.key, 0, sizeof(key->key_param_set.key)); - priv->aes_key.key_param_set.key_len = key->key_param_set.key_len; - memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, - le16_to_cpu(priv->aes_key.key_param_set.key_len)); + priv->aes_key.key_param_set.key_len = cpu_to_le16(len); + memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, len); return 0; } @@ -622,9 +626,14 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, struct host_cmd_ds_command *resp) { struct host_cmd_ds_802_11_key_material_v2 *key_v2; - __le16 len; + int len; key_v2 = &resp->params.key_material_v2; + + len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len); + if (len > WLAN_KEY_LEN_CCMP) + return -EINVAL; + if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) { if ((le16_to_cpu(key_v2->key_param_set.key_info) & KEY_MCAST)) { mwifiex_dbg(priv->adapter, INFO, "info: key: GTK is set\n"); @@ -640,10 +649,9 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0, WLAN_KEY_LEN_CCMP); priv->aes_key_v2.key_param_set.key_params.aes.key_len = - key_v2->key_param_set.key_params.aes.key_len; - len = priv->aes_key_v2.key_param_set.key_params.aes.key_len; + cpu_to_le16(len); memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key, - key_v2->key_param_set.key_params.aes.key, le16_to_cpu(len)); + key_v2->key_param_set.key_params.aes.key, len); return 0; } From patchwork Thu Aug 20 09:22:49 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265670 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6BA13C433DF for ; Thu, 20 Aug 2020 10:29:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3B92020658 for ; Thu, 20 Aug 2020 10:29:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919396; bh=kWs4muxCzOiLp83mocfcq5fC24GhCoVS5HOY531HJDs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=PuuY5ncZOIJb/0Ro8Y19UogWJe55cnTIgucR3lCFJfk8zGQDP3j16wz+FWxvRTEgJ mhaFNwQnBikycfRSvU6d0uDOQI4egkF9+2dmiWh46Ja+yapKn/Ylw3gv1hqhnIQKTG 62rPSmG1Zg3dgoJe3+sgzS8EeNBxFBkjQvpHRvEo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731524AbgHTKVB (ORCPT ); Thu, 20 Aug 2020 06:21:01 -0400 Received: from mail.kernel.org ([198.145.29.99]:46926 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731522AbgHTKVA (ORCPT ); Thu, 20 Aug 2020 06:21:00 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B476A20738; Thu, 20 Aug 2020 10:20:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918860; bh=kWs4muxCzOiLp83mocfcq5fC24GhCoVS5HOY531HJDs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DcJHbRyXxHmMUZOHVV4/n2cAlQ9ZOnX8t0vllrSuWah1SBIvv+jqusleda0Sq5Qpg 8M4MM/C7SQ0GokueOkvyTNSntSGpeJaAvhnFbcO5bd048IXL6Xf0HXwW7+xrPLr5HO nS/pUWJrJSxb+iNoNUFmB+HgDD//h4NFM4BJflN0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Milton Miller , Anton Blanchard , Michael Ellerman , Sasha Levin Subject: [PATCH 4.4 092/149] powerpc/vdso: Fix vdso cpu truncation Date: Thu, 20 Aug 2020 11:22:49 +0200 Message-Id: <20200820092130.180810916@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Milton Miller [ Upstream commit a9f675f950a07d5c1dbcbb97aabac56f5ed085e3 ] The code in vdso_cpu_init that exposes the cpu and numa node to userspace via SPRG_VDSO incorrctly masks the cpu to 12 bits. This means that any kernel running on a box with more than 4096 threads (NR_CPUS advertises a limit of of 8192 cpus) would expose userspace to two cpu contexts running at the same time with the same cpu number. Note: I'm not aware of any distro shipping a kernel with support for more than 4096 threads today, nor of any system image that currently exceeds 4096 threads. Found via code browsing. Fixes: 18ad51dd342a7eb09dbcd059d0b451b616d4dafc ("powerpc: Add VDSO version of getcpu") Signed-off-by: Milton Miller Signed-off-by: Anton Blanchard Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200715233704.1352257-1-anton@ozlabs.org Signed-off-by: Sasha Levin --- arch/powerpc/kernel/vdso.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c index b457bfa284360..05c17429e5442 100644 --- a/arch/powerpc/kernel/vdso.c +++ b/arch/powerpc/kernel/vdso.c @@ -702,7 +702,7 @@ int vdso_getcpu_init(void) node = cpu_to_node(cpu); WARN_ON_ONCE(node > 0xffff); - val = (cpu & 0xfff) | ((node & 0xffff) << 16); + val = (cpu & 0xffff) | ((node & 0xffff) << 16); mtspr(SPRN_SPRG_VDSO_WRITE, val); get_paca()->sprg_vdso = val; From patchwork Thu Aug 20 09:22:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265702 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8056C433DF for ; Thu, 20 Aug 2020 10:21:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9B6BD20738 for ; Thu, 20 Aug 2020 10:21:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918882; bh=8t5d5q+dhyRF4P3VO6JxwXQOT6FGg6hABo4iNnLHrOo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Qm3BODIWsJIVsVMSNuInEbDCNG7Luyc3UzplMbyRbA2srLnUTGugma2oEcRNLV3Ae Qoqo9OxxcNSzswMh7gElM7jXohH44yPi9tyxELWn9DcmbIDELgp5Y2UahFrI1iqqlp /FwMSsM8DHTh7jroo4/nl+J8A1AhnjC/OVgf7le4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728905AbgHTKVN (ORCPT ); Thu, 20 Aug 2020 06:21:13 -0400 Received: from mail.kernel.org ([198.145.29.99]:47056 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731400AbgHTKVE (ORCPT ); Thu, 20 Aug 2020 06:21:04 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1264E2072D; Thu, 20 Aug 2020 10:21:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918863; bh=8t5d5q+dhyRF4P3VO6JxwXQOT6FGg6hABo4iNnLHrOo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yF7tjc7Ot8xQn29xuvYu4pmg6Te33m8kxfl8140PAMvam++lsbs1dl9bAd/F1R7kO jdlKkd9dv4OlrIb0lM3V6bYwtpd5noibDDjHBT5yDJUwfeG5m2yOHu9Im9Uo2lunES 9HjK+FVVo6Nl+XUSGghOnV88MiAENS/DlJPzacfM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiongfeng Wang , Bjorn Helgaas , Sasha Levin Subject: [PATCH 4.4 093/149] PCI/ASPM: Add missing newline in sysfs policy Date: Thu, 20 Aug 2020 11:22:50 +0200 Message-Id: <20200820092130.232690962@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Xiongfeng Wang [ Upstream commit 3167e3d340c092fd47924bc4d23117a3074ef9a9 ] When I cat ASPM parameter 'policy' by sysfs, it displays as follows. Add a newline for easy reading. Other sysfs attributes already include a newline. [root@localhost ~]# cat /sys/module/pcie_aspm/parameters/policy [default] performance powersave powersupersave [root@localhost ~]# Fixes: 7d715a6c1ae5 ("PCI: add PCI Express ASPM support") Link: https://lore.kernel.org/r/1594972765-10404-1-git-send-email-wangxiongfeng2@huawei.com Signed-off-by: Xiongfeng Wang Signed-off-by: Bjorn Helgaas Signed-off-by: Sasha Levin --- drivers/pci/pcie/aspm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c index 966b6947e5656..a098f8324afd0 100644 --- a/drivers/pci/pcie/aspm.c +++ b/drivers/pci/pcie/aspm.c @@ -807,6 +807,7 @@ static int pcie_aspm_get_policy(char *buffer, struct kernel_param *kp) cnt += sprintf(buffer + cnt, "[%s] ", policy_str[i]); else cnt += sprintf(buffer + cnt, "%s ", policy_str[i]); + cnt += sprintf(buffer + cnt, "\n"); return cnt; } From patchwork Thu Aug 20 09:22:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 248018 Delivered-To: patch@linaro.org Received: by 2002:a05:6e02:522:0:0:0:0 with SMTP id h2csp1220170ils; Thu, 20 Aug 2020 03:21:20 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzyQ/aWimr0FNaNzRsyE7/a5BaDNBgS2FRQ7sQb8VTs5wddTtwghcCfpt/88dOci99nfLB8 X-Received: by 2002:a17:906:a284:: with SMTP id i4mr2620180ejz.490.1597918880054; Thu, 20 Aug 2020 03:21:20 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1597918880; cv=none; d=google.com; s=arc-20160816; b=AEKyYNBknKhvGap5tmdnLYWt/XkoTiACCOO7QjWkXPc+/ex7ySd/Eyh8xVAr1k4H+Y Mx9z/84DpfeqepwFljdPe6HEZi0ULvL0/Lea99aPFqru4ytNApqR6xOgsu4BVe4ehFpd eHo2tjSCcVgnCMhCuTxDIBTWmix1Q4dRxLrBrEwAD+DBATiuP6HWk7hV9sBtizroJd/D 2EJvpOvXkZYUqXp5RlJg3qrk/G4JdrWz72+jgvx9Cnoh/7FcPkQwjYeKXJsj8Q/WQY5J MLmbnTJWOIpgWrkfB0+k60HcNWRX4FKt/rr0TFCGNewnBBfq5qdxx/qhH1BMpk0e7wXh vaIg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=27BlARBQQwXVscYwY+DtPzhxCQxoTR0F0e5rXveJ2mI=; b=AL9ZNxDxKxc3BlP7XvSmnrbwWX0jVdZGVCo8aN4hwFtmBG1xzG1seDos6VxEoF+I+U NPyOQiPjYXKdrmV5JtPVYejtDdRqJmMh86GUrMV8qsXMp9GClUTbshIVUmHDudRyTCaI Zv6m6VqDJXal2dkVv9oFPHiKjFJ9bmyqdV3PdG4/qn2E8NpYS7lT7jzTOaVNwfO//WBX cTrtH/aGAfLKlYrf6qLOvfWXBpMSumjLkQNNTIOHf/mvF5PqB7lKPYgoxlAeoS6k5cco xoh6qJ4b6MzzoB2NMzOVrKRSxKT4MmgRO4P3siGxhTt4odESa1Cj2plNWjWoYjHeZ0t9 LkKw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=yvNAoiZ8; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id g18si1066777eds.389.2020.08.20.03.21.19; Thu, 20 Aug 2020 03:21:20 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=yvNAoiZ8; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730473AbgHTKVM (ORCPT + 15 others); Thu, 20 Aug 2020 06:21:12 -0400 Received: from mail.kernel.org ([198.145.29.99]:47138 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731529AbgHTKVH (ORCPT ); Thu, 20 Aug 2020 06:21:07 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id BEB5B20738; Thu, 20 Aug 2020 10:21:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918866; bh=EHuWEAqef+MFu2ZDsYXQpvGQaTZJwqP5kF7KV4YBlUM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yvNAoiZ8s/JJPLiTJQvxHnPh/QdRPTuWC94gi6MmqXprV1kihJ6F5zf8G+e9eLzFn Hf+iyQ7NE9G0KxGwMxq3osgSvm9BJA3Y0cEdm9Zj9QgSYbmQ0GSI6cVXi24gcuGHIQ uldn+CfNoauKo2ZaEtyIrBVJoD87NdWtDV4jCMRU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Minas Harutyunyan , Marek Szyprowski , Felipe Balbi , Sasha Levin Subject: [PATCH 4.4 094/149] usb: dwc2: Fix error path in gadget registration Date: Thu, 20 Aug 2020 11:22:51 +0200 Message-Id: <20200820092130.275835519@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Marek Szyprowski [ Upstream commit 33a06f1300a79cfd461cea0268f05e969d4f34ec ] When gadget registration fails, one should not call usb_del_gadget_udc(). Ensure this by setting gadget->udc to NULL. Also in case of a failure there is no need to disable low-level hardware, so return immiedetly instead of jumping to error_init label. This fixes the following kernel NULL ptr dereference on gadget failure (can be easily triggered with g_mass_storage without any module parameters): dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter besl=1 dwc2 12480000.hsotg: dwc2_check_params: Invalid parameter g_np_tx_fifo_size=1024 dwc2 12480000.hsotg: EPs: 16, dedicated fifos, 7808 entries in SPRAM Mass Storage Function, version: 2009/09/11 LUN: removable file: (no medium) no file given for LUN0 g_mass_storage 12480000.hsotg: failed to start g_mass_storage: -22 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000104 pgd = (ptrval) [00000104] *pgd=00000000 Internal error: Oops: 805 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.8.0-rc5 #3133 Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events deferred_probe_work_func PC is at usb_del_gadget_udc+0x38/0xc4 LR is at __mutex_lock+0x31c/0xb18 ... Process kworker/0:1 (pid: 12, stack limit = 0x(ptrval)) Stack: (0xef121db0 to 0xef122000) ... [] (usb_del_gadget_udc) from [] (dwc2_hsotg_remove+0x10/0x20) [] (dwc2_hsotg_remove) from [] (dwc2_driver_probe+0x57c/0x69c) [] (dwc2_driver_probe) from [] (platform_drv_probe+0x6c/0xa4) [] (platform_drv_probe) from [] (really_probe+0x200/0x48c) [] (really_probe) from [] (driver_probe_device+0x78/0x1fc) [] (driver_probe_device) from [] (bus_for_each_drv+0x74/0xb8) [] (bus_for_each_drv) from [] (__device_attach+0xd4/0x16c) [] (__device_attach) from [] (bus_probe_device+0x88/0x90) [] (bus_probe_device) from [] (deferred_probe_work_func+0x3c/0xd0) [] (deferred_probe_work_func) from [] (process_one_work+0x234/0x7dc) [] (process_one_work) from [] (worker_thread+0x44/0x51c) [] (worker_thread) from [] (kthread+0x158/0x1a0) [] (kthread) from [] (ret_from_fork+0x14/0x20) Exception stack(0xef121fb0 to 0xef121ff8) ... ---[ end trace 9724c2fc7cc9c982 ]--- While fixing this also fix the double call to dwc2_lowlevel_hw_disable() if dr_mode is set to USB_DR_MODE_PERIPHERAL. In such case low-level hardware is already disabled before calling usb_add_gadget_udc(). That function correctly preserves low-level hardware state, there is no need for the second unconditional dwc2_lowlevel_hw_disable() call. Fixes: 207324a321a8 ("usb: dwc2: Postponed gadget registration to the udc class driver") Acked-by: Minas Harutyunyan Signed-off-by: Marek Szyprowski Signed-off-by: Felipe Balbi Signed-off-by: Sasha Levin --- drivers/usb/dwc2/platform.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1 diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c index 5e554b1d5a8f9..d9fafd6a7927f 100644 --- a/drivers/usb/dwc2/platform.c +++ b/drivers/usb/dwc2/platform.c @@ -458,6 +458,7 @@ static int dwc2_driver_probe(struct platform_device *dev) if (hsotg->gadget_enabled) { retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget); if (retval) { + hsotg->gadget.udc = NULL; dwc2_hsotg_remove(hsotg); goto error; } @@ -466,7 +467,8 @@ static int dwc2_driver_probe(struct platform_device *dev) return 0; error: - dwc2_lowlevel_hw_disable(hsotg); + if (hsotg->dr_mode != USB_DR_MODE_PERIPHERAL) + dwc2_lowlevel_hw_disable(hsotg); return retval; } From patchwork Thu Aug 20 09:22:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265669 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 284E3C433E1 for ; Thu, 20 Aug 2020 10:30:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 02BA02072D for ; Thu, 20 Aug 2020 10:30:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919401; bh=HrDPvE7Q066fLsktKOZxwx3cPJ26Ip3k+jJSfLa+A4w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Mz3uONifsrzq+FoU9KP2qA4eShbUTxc9sqh3iIPzSaldWkcZuaB2/S0UC3cpfDID1 6dnPI2vTx5IuiqmXKKUBFOC4ghjvi9qNBqlZqtLSqZhnnrwB1gAXNO83uTOBU3Ceew n9Wccha8pncuSPKwddEdFOd4scbz2WmFc6BXEC3g= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730574AbgHTK34 (ORCPT ); Thu, 20 Aug 2020 06:29:56 -0400 Received: from mail.kernel.org ([198.145.29.99]:47266 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731187AbgHTKVK (ORCPT ); Thu, 20 Aug 2020 06:21:10 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B65D12072D; Thu, 20 Aug 2020 10:21:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918869; bh=HrDPvE7Q066fLsktKOZxwx3cPJ26Ip3k+jJSfLa+A4w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=l6gQxQiF/26bmQE4knCwycc3Cr/tUb+oV90Vi2i3OdeXuxN6F/NwEiigFp+kl/K+D ICdG74kCIx/h2kSoiK7IA+fUfBqzIeKjZmapoIru8tkCfAFT85egGEZ47k9NqvbEzi ch5ZTUWg3uRFtTNbdlcEu03ywXcjw7iTnSEMA4iA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paul Mackerras , Finn Thain , "Martin K. Petersen" , Sasha Levin , Stan Johnson Subject: [PATCH 4.4 095/149] scsi: mesh: Fix panic after host or bus reset Date: Thu, 20 Aug 2020 11:22:52 +0200 Message-Id: <20200820092130.319348248@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Finn Thain [ Upstream commit edd7dd2292ab9c3628b65c4d04514c3068ad54f6 ] Booting Linux with a Conner CP3200 drive attached to the MESH SCSI bus results in EH measures and a panic: [ 25.499838] mesh: configured for synchronous 5 MB/s [ 25.787154] mesh: performing initial bus reset... [ 29.867115] scsi host0: MESH [ 29.929527] mesh: target 0 synchronous at 3.6 MB/s [ 29.998763] scsi 0:0:0:0: Direct-Access CONNER CP3200-200mb-3.5 4040 PQ: 0 ANSI: 1 CCS [ 31.989975] sd 0:0:0:0: [sda] 415872 512-byte logical blocks: (213 MB/203 MiB) [ 32.070975] sd 0:0:0:0: [sda] Write Protect is off [ 32.137197] sd 0:0:0:0: [sda] Mode Sense: 5b 00 00 08 [ 32.209661] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA [ 32.332708] sda: [mac] sda1 sda2 sda3 [ 32.417733] sd 0:0:0:0: [sda] Attached SCSI disk ... snip ... [ 76.687067] mesh_abort((ptrval)) [ 76.743606] mesh: state at (ptrval), regs at (ptrval), dma at (ptrval) [ 76.810798] ct=6000 seq=86 bs=4017 fc= 0 exc= 0 err= 0 im= 7 int= 0 sp=85 [ 76.880720] dma stat=84e0 cmdptr=1f73d000 [ 76.941387] phase=4 msgphase=0 conn_tgt=0 data_ptr=24576 [ 77.005567] dma_st=1 dma_ct=0 n_msgout=0 [ 77.065456] target 0: req=(ptrval) goes_out=0 saved_ptr=0 [ 77.130512] mesh_abort((ptrval)) [ 77.187670] mesh: state at (ptrval), regs at (ptrval), dma at (ptrval) [ 77.255594] ct=6000 seq=86 bs=4017 fc= 0 exc= 0 err= 0 im= 7 int= 0 sp=85 [ 77.325778] dma stat=84e0 cmdptr=1f73d000 [ 77.387239] phase=4 msgphase=0 conn_tgt=0 data_ptr=24576 [ 77.453665] dma_st=1 dma_ct=0 n_msgout=0 [ 77.515900] target 0: req=(ptrval) goes_out=0 saved_ptr=0 [ 77.582902] mesh_host_reset [ 88.187083] Kernel panic - not syncing: mesh: double DMA start ! [ 88.254510] CPU: 0 PID: 358 Comm: scsi_eh_0 Not tainted 5.6.13-pmac #1 [ 88.323302] Call Trace: [ 88.378854] [e16ddc58] [c0027080] panic+0x13c/0x308 (unreliable) [ 88.446221] [e16ddcb8] [c02b2478] mesh_start.part.12+0x130/0x414 [ 88.513298] [e16ddcf8] [c02b2fc8] mesh_queue+0x54/0x70 [ 88.577097] [e16ddd18] [c02a1848] scsi_send_eh_cmnd+0x374/0x384 [ 88.643476] [e16dddc8] [c02a1938] scsi_eh_tur+0x5c/0xb8 [ 88.707878] [e16dddf8] [c02a1ab8] scsi_eh_test_devices+0x124/0x178 [ 88.775663] [e16dde28] [c02a2094] scsi_eh_ready_devs+0x588/0x8a8 [ 88.843124] [e16dde98] [c02a31d8] scsi_error_handler+0x344/0x520 [ 88.910697] [e16ddf08] [c00409c8] kthread+0xe4/0xe8 [ 88.975166] [e16ddf38] [c000f234] ret_from_kernel_thread+0x14/0x1c [ 89.044112] Rebooting in 180 seconds.. In theory, a panic can happen after a bus or host reset with dma_started flag set. Fix this by halting the DMA before reinitializing the host. Don't assume that ms->current_req is set when halt_dma() is invoked as it may not hold for bus or host reset. BTW, this particular Conner drive can be made to work by inhibiting disconnect/reselect with 'mesh.resel_targets=0'. Link: https://lore.kernel.org/r/3952bc691e150a7128b29120999b6092071b039a.1595460351.git.fthain@telegraphics.com.au Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: Paul Mackerras Reported-and-tested-by: Stan Johnson Signed-off-by: Finn Thain Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/scsi/mesh.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c index 555367f002282..18ed4b44bc513 100644 --- a/drivers/scsi/mesh.c +++ b/drivers/scsi/mesh.c @@ -1044,6 +1044,8 @@ static void handle_error(struct mesh_state *ms) while ((in_8(&mr->bus_status1) & BS1_RST) != 0) udelay(1); printk("done\n"); + if (ms->dma_started) + halt_dma(ms); handle_reset(ms); /* request_q is empty, no point in mesh_start() */ return; @@ -1356,7 +1358,8 @@ static void halt_dma(struct mesh_state *ms) ms->conn_tgt, ms->data_ptr, scsi_bufflen(cmd), ms->tgts[ms->conn_tgt].data_goes_out); } - scsi_dma_unmap(cmd); + if (cmd) + scsi_dma_unmap(cmd); ms->dma_started = 0; } @@ -1711,6 +1714,9 @@ static int mesh_host_reset(struct scsi_cmnd *cmd) spin_lock_irqsave(ms->host->host_lock, flags); + if (ms->dma_started) + halt_dma(ms); + /* Reset the controller & dbdma channel */ out_le32(&md->control, (RUN|PAUSE|FLUSH|WAKE) << 16); /* stop dma */ out_8(&mr->exception, 0xff); /* clear all exception bits */ From patchwork Thu Aug 20 09:22:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265671 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A84C3C433DF for ; Thu, 20 Aug 2020 10:29:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7BB0F20658 for ; Thu, 20 Aug 2020 10:29:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919388; bh=bauSevcKeg4mYS85bMxFfZEB+Fpsv6jNmDuyFK76HhU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=IrnvF2gxHhVxMjkY9HWS86v5b8k40MdbwD60wkjw47sNeShwu1SDdNtvIZOVsFoEJ k1x0+iYmrcvXuFkghYoDOzlMXiIqSq+XglFbjLsyHuFCi8+49bSvCeIYjZF/ZKaB69 VGO50GcmBLa6i4Hv7rfoMBzA4/QdPEL6Scl9L9g8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731495AbgHTK3Q (ORCPT ); Thu, 20 Aug 2020 06:29:16 -0400 Received: from mail.kernel.org ([198.145.29.99]:47352 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731512AbgHTKVL (ORCPT ); Thu, 20 Aug 2020 06:21:11 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 03E8520738; Thu, 20 Aug 2020 10:21:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918871; bh=bauSevcKeg4mYS85bMxFfZEB+Fpsv6jNmDuyFK76HhU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tLV5srljC54wQTzP0ZLO4syS1oqq3bmdc8KibMI0bGnOokG89115pPhfe+h2QSOss axac4Kou0+0yQ6NlBr/Z5NORa1DdUWQw0KgY1jxxwoR77K/r770W2Gsh9bpj4Vl/Hd WYALc29a3YSehQlJSpGfN18hSuZhJL2DKMobeJfI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+a22c6092d003d6fe1122@syzkaller.appspotmail.com, Dan Carpenter , Casey Schaufler , Sasha Levin Subject: [PATCH 4.4 096/149] Smack: fix another vsscanf out of bounds Date: Thu, 20 Aug 2020 11:22:53 +0200 Message-Id: <20200820092130.368312346@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dan Carpenter [ Upstream commit a6bd4f6d9b07452b0b19842044a6c3ea384b0b88 ] This is similar to commit 84e99e58e8d1 ("Smack: slab-out-of-bounds in vsscanf") where we added a bounds check on "rule". Reported-by: syzbot+a22c6092d003d6fe1122@syzkaller.appspotmail.com Fixes: f7112e6c9abf ("Smack: allow for significantly longer Smack labels v4") Signed-off-by: Dan Carpenter Signed-off-by: Casey Schaufler Signed-off-by: Sasha Levin --- security/smack/smackfs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c index bd4d0f5a79aa3..2e2ef3a525ecb 100644 --- a/security/smack/smackfs.c +++ b/security/smack/smackfs.c @@ -939,6 +939,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, for (i = 0; i < catlen; i++) { rule += SMK_DIGITLEN; + if (rule > data + count) { + rc = -EOVERFLOW; + goto out; + } ret = sscanf(rule, "%u", &cat); if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM) goto out; From patchwork Thu Aug 20 09:22:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265672 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 680F9C433E3 for ; Thu, 20 Aug 2020 10:29:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 465C520658 for ; Thu, 20 Aug 2020 10:29:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919356; bh=lzkdhGteIHo8AwsJQRu9trsCU87OtNrMqlRTr1Hhc/A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=tPAPCCWKsI6/blnISSe4s7fQrfKdqPsypfBgwW8E7pLFOgiMow/m+MprHC1Cg5Lop ljaAIeSwUFi+NnUREG0ff//uYXOfZhEqTaeUMJa3oElXYZouWc9tjD38/lS0AgVrBA zR3J+LV2N4WTqW8QOP3vG5q3Af7AiPXyQJZx4Hv4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728909AbgHTK3P (ORCPT ); Thu, 20 Aug 2020 06:29:15 -0400 Received: from mail.kernel.org ([198.145.29.99]:47644 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731273AbgHTKVS (ORCPT ); Thu, 20 Aug 2020 06:21:18 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DDCE22078D; Thu, 20 Aug 2020 10:21:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918878; bh=lzkdhGteIHo8AwsJQRu9trsCU87OtNrMqlRTr1Hhc/A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jmtgJRIGfu/Dyl9mP/+xLua8Z272D6yS/3pjipPV6/TWGm1WcxDrSQnn0Fl+jnW67 wJ2VONhmmydes6ydGg4uHg87MQGBYrcALytB0vPRi+Xmoz8SKyPcItQt7T57TA6IgY uCcmmkn5ylhzLbfugm+gciWOkymUwP7hg4u46bak= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Rix , Sebastian Reichel , Sasha Levin Subject: [PATCH 4.4 098/149] power: supply: check if calc_soc succeeded in pm860x_init_battery Date: Thu, 20 Aug 2020 11:22:55 +0200 Message-Id: <20200820092130.461949698@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tom Rix [ Upstream commit ccf193dee1f0fff55b556928591f7818bac1b3b1 ] clang static analysis flags this error 88pm860x_battery.c:522:19: warning: Assigned value is garbage or undefined [core.uninitialized.Assign] info->start_soc = soc; ^ ~~~ soc is set by calling calc_soc. But calc_soc can return without setting soc. So check the return status and bail similarly to other checks in pm860x_init_battery and initialize soc to silence the warning. Fixes: a830d28b48bf ("power_supply: Enable battery-charger for 88pm860x") Signed-off-by: Tom Rix Signed-off-by: Sebastian Reichel Signed-off-by: Sasha Levin --- drivers/power/88pm860x_battery.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/power/88pm860x_battery.c b/drivers/power/88pm860x_battery.c index 63c57dc82ac1d..4eda5065b5bbc 100644 --- a/drivers/power/88pm860x_battery.c +++ b/drivers/power/88pm860x_battery.c @@ -436,7 +436,7 @@ static void pm860x_init_battery(struct pm860x_battery_info *info) int ret; int data; int bat_remove; - int soc; + int soc = 0; /* measure enable on GPADC1 */ data = MEAS1_GP1; @@ -499,7 +499,9 @@ static void pm860x_init_battery(struct pm860x_battery_info *info) } mutex_unlock(&info->lock); - calc_soc(info, OCV_MODE_ACTIVE, &soc); + ret = calc_soc(info, OCV_MODE_ACTIVE, &soc); + if (ret < 0) + goto out; data = pm860x_reg_read(info->i2c, PM8607_POWER_UP_LOG); bat_remove = data & BAT_WU_LOG; From patchwork Thu Aug 20 09:23:04 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265683 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90002C433DF for ; Thu, 20 Aug 2020 10:26:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 61DED20738 for ; Thu, 20 Aug 2020 10:26:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919205; bh=B7ux/Zar9QOX1U4UMuNZ5OZh9VvIW5IXpQ6OL3ZjA3g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=IDR9PBIUvBIMvBvyvdbbQ2cCqxsmwPKvizTS4iyjdGfJr2oeVvA+H2ffFs8/Q56kd 4koLtW5v42CSuuB/2haQJF9ZXJx0vyjvPL8MZVaZQb4TC1nZj4uH3paa45mwis2Ky7 /9Cm7UtrAZiNnA+hYjGSdov6j1ioSgMw2TPin6IY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730753AbgHTK0g (ORCPT ); Thu, 20 Aug 2020 06:26:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:51508 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731724AbgHTKWy (ORCPT ); Thu, 20 Aug 2020 06:22:54 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B9E2D20738; Thu, 20 Aug 2020 10:22:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918974; bh=B7ux/Zar9QOX1U4UMuNZ5OZh9VvIW5IXpQ6OL3ZjA3g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t0bLNb8vdCavVAOHC7YncYo15HZNQX8AAIxY68RwnJS01vNx7eN449QgQr0KwSuTQ q3UT+PDK2nZ8bnj+3hfkZlZMbOhlNTfctVcjOLeGC77gUGTur3mfycNPN4un6HdUCJ aYqmrTQlVZ4QsAoG0odJ0Tfv1p4rSp0z3jqs0vcI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mirko Dietrich , Takashi Iwai Subject: [PATCH 4.4 107/149] ALSA: usb-audio: Creative USB X-Fi Pro SB1095 volume knob support Date: Thu, 20 Aug 2020 11:23:04 +0200 Message-Id: <20200820092130.889220771@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mirko Dietrich commit fec9008828cde0076aae595ac031bfcf49d335a4 upstream. Adds an entry for Creative USB X-Fi to the rc_config array in mixer_quirks.c to allow use of volume knob on the device. Adds support for newer X-Fi Pro card, known as "Model No. SB1095" with USB ID "041e:3263" Signed-off-by: Mirko Dietrich Cc: Link: https://lore.kernel.org/r/20200806124850.20334-1-buzz@l4m1.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/usb/mixer_quirks.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/usb/mixer_quirks.c +++ b/sound/usb/mixer_quirks.c @@ -195,6 +195,7 @@ static const struct rc_config { { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */ { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ + { USB_ID(0x041e, 0x3263), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */ }; From patchwork Thu Aug 20 09:23:05 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265684 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 824FBC433DF for ; Thu, 20 Aug 2020 10:26:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6118E20738 for ; Thu, 20 Aug 2020 10:26:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919196; bh=mWsxCKDF2jQl76QZS+o3janKb4+GWIAq68VFC1YnKXw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=lQbX/1oTJX7hd1Sj683QNN13EAbRb/s+MvDtXjvqglBroqYLiRATPRgvqeLi9wDGj ynw6g7L2MeM6euBSaz/O4nSGDNCXWgcdfSoqGnr8HnWKLhJb8uGXyNnkuRcwlbWzaD 05RjTpTmm8ozfCXk0r3YyqwJwWdNMrABDO93EVkQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731738AbgHTK00 (ORCPT ); Thu, 20 Aug 2020 06:26:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:51616 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731728AbgHTKW5 (ORCPT ); Thu, 20 Aug 2020 06:22:57 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3653620658; Thu, 20 Aug 2020 10:22:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918976; bh=mWsxCKDF2jQl76QZS+o3janKb4+GWIAq68VFC1YnKXw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mhiFdoTnRNvtIhrcQR3yT8q4zYoY6hl3BUlCj5eI5CJkxcoM9O+09B3DjfVkcpHZt DTnmlwtuZutr/sA8/y64IXuMr/21n5otOVufA0QIwVTsmcc7gL8ACyv9Xwq/1BwRHN YZv0IRawoUzDLo1IMt/7Va7M7bQ+uv2BUMcfdvMI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hector Martin , Takashi Iwai Subject: [PATCH 4.4 108/149] ALSA: usb-audio: fix overeager device match for MacroSilicon MS2109 Date: Thu, 20 Aug 2020 11:23:05 +0200 Message-Id: <20200820092130.933918316@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Hector Martin commit 14a720dc1f5332f3bdf30a23a3bc549e81be974c upstream. Matching by device matches all interfaces, which breaks the video/HID portions of the device depending on module load order. Fixes: e337bf19f6af ("ALSA: usb-audio: add quirk for MacroSilicon MS2109") Cc: stable@vger.kernel.org Signed-off-by: Hector Martin Link: https://lore.kernel.org/r/20200810045319.128745-1-marcan@marcan.st Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/usb/quirks-table.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/sound/usb/quirks-table.h +++ b/sound/usb/quirks-table.h @@ -3335,7 +3335,13 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge * with. */ { - USB_DEVICE(0x534d, 0x2109), + .match_flags = USB_DEVICE_ID_MATCH_DEVICE | + USB_DEVICE_ID_MATCH_INT_CLASS | + USB_DEVICE_ID_MATCH_INT_SUBCLASS, + .idVendor = 0x534d, + .idProduct = 0x2109, + .bInterfaceClass = USB_CLASS_AUDIO, + .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { .vendor_name = "MacroSilicon", .product_name = "MS2109", From patchwork Thu Aug 20 09:23:07 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265694 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5AA91C433E1 for ; Thu, 20 Aug 2020 10:23:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 38C3B20738 for ; Thu, 20 Aug 2020 10:23:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918993; bh=aRNM/QvLP7AZINdZC5idJtcj65hyzVPARATvkmqPsX0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ALY1B5vpOT02KtoHNivjjVpYwIGDRUji6by79agC5dgUbapdYL2g2iJqFNQepcKx1 fYfVP5HsOiWcMGHkn5pZR/Jiwtfz42vRGzaq/FflWMhM8jP5YHH/S/m/sORAtMTTAx GojWHBYXNfaPJNl60g3Lsr5m7jlAbRDpOleUSlV0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731701AbgHTKXL (ORCPT ); Thu, 20 Aug 2020 06:23:11 -0400 Received: from mail.kernel.org ([198.145.29.99]:51842 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731737AbgHTKXC (ORCPT ); Thu, 20 Aug 2020 06:23:02 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 768B120738; Thu, 20 Aug 2020 10:23:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918981; bh=aRNM/QvLP7AZINdZC5idJtcj65hyzVPARATvkmqPsX0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MSM+gupY5srgyxBQFmhgIf987Ewlm2/q3QpIsRI2UXAQnvcOdRI56T3yar3eiwinJ YD5MDn4q8Y9BW6uNXl5wLp5QHBJfxW43MqbTpDuihglXKnJjxuBn8Ym8i4JckkVuNv 4V1pCdMA+5Nir5l97u9Boh3G+am+I8uj73UTCAEk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Rix , Herbert Xu Subject: [PATCH 4.4 110/149] crypto: qat - fix double free in qat_uclo_create_batch_init_list Date: Thu, 20 Aug 2020 11:23:07 +0200 Message-Id: <20200820092131.029109716@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tom Rix commit c06c76602e03bde24ee69a2022a829127e504202 upstream. clang static analysis flags this error qat_uclo.c:297:3: warning: Attempt to free released memory [unix.Malloc] kfree(*init_tab_base); ^~~~~~~~~~~~~~~~~~~~~ When input *init_tab_base is null, the function allocates memory for the head of the list. When there is problem allocating other list elements the list is unwound and freed. Then a check is made if the list head was allocated and is also freed. Keeping track of the what may need to be freed is the variable 'tail_old'. The unwinding/freeing block is while (tail_old) { mem_init = tail_old->next; kfree(tail_old); tail_old = mem_init; } The problem is that the first element of tail_old is also what was allocated for the list head init_header = kzalloc(sizeof(*init_header), GFP_KERNEL); ... *init_tab_base = init_header; flag = 1; } tail_old = init_header; So *init_tab_base/init_header are freed twice. There is another problem. When the input *init_tab_base is non null the tail_old is calculated by traveling down the list to first non null entry. tail_old = init_header; while (tail_old->next) tail_old = tail_old->next; When the unwinding free happens, the last entry of the input list will be freed. So the freeing needs a general changed. If locally allocated the first element of tail_old is freed, else it is skipped. As a bit of cleanup, reset *init_tab_base if it came in as null. Fixes: b4b7e67c917f ("crypto: qat - Intel(R) QAT ucode part of fw loader") Cc: Signed-off-by: Tom Rix Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman --- drivers/crypto/qat/qat_common/qat_uclo.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/drivers/crypto/qat/qat_common/qat_uclo.c +++ b/drivers/crypto/qat/qat_common/qat_uclo.c @@ -307,13 +307,18 @@ static int qat_uclo_create_batch_init_li } return 0; out_err: + /* Do not free the list head unless we allocated it. */ + tail_old = tail_old->next; + if (flag) { + kfree(*init_tab_base); + *init_tab_base = NULL; + } + while (tail_old) { mem_init = tail_old->next; kfree(tail_old); tail_old = mem_init; } - if (flag) - kfree(*init_tab_base); return -ENOMEM; } From patchwork Thu Aug 20 09:23:09 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265676 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38E4DC433E4 for ; Thu, 20 Aug 2020 10:28:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 13E2422BF5 for ; Thu, 20 Aug 2020 10:28:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919305; bh=0rtzdLSxiMmDnqYJoiUoOiCfmLifAV7D4NzdX9nGwlY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=MJQ9eR1KUW3VN7sEO3dNZwf8jhWGPsyJx/FP5o5Q86aiQ7bKCj+yca6tNhkWLstcc fzPQe37uVHipAFmO8kbVZgsKjimIpjEcoga0j/dxrQoF9InuxUjRg/Uz5m7E3pbHEp 74RIY/L28C9vCznV7wT8blzrA/IwClG4xv79RosY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731861AbgHTK2Y (ORCPT ); Thu, 20 Aug 2020 06:28:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:48864 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731571AbgHTKVw (ORCPT ); Thu, 20 Aug 2020 06:21:52 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 341B52072D; Thu, 20 Aug 2020 10:21:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918911; bh=0rtzdLSxiMmDnqYJoiUoOiCfmLifAV7D4NzdX9nGwlY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ouAcxzg+46XckqPwYxOYLLR3Q1x3IjcFxeMUIHZf1aVJPD70iXiHlhp2ydkN5p4Qh VFxnEIMRARIsE5iAfIf0hUdS384/yPOxnIYqqaPwQyRVlM7NZasejgadEmVg5a/Mbz mEn1RTffGPCGtWT6+E4sb+lwKJ06ROZjudo4UcrQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+a9ac3de1b5de5fb10efc@syzkaller.appspotmail.com, syzbot+df958cf5688a96ad3287@syzkaller.appspotmail.com, Eric Biggers , Andrew Morton , Alexander Viro , Qiujun Huang , Linus Torvalds Subject: [PATCH 4.4 112/149] fs/minix: dont allow getting deleted inodes Date: Thu, 20 Aug 2020 11:23:09 +0200 Message-Id: <20200820092131.123806189@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Biggers commit facb03dddec04e4aac1bb2139accdceb04deb1f3 upstream. If an inode has no links, we need to mark it bad rather than allowing it to be accessed. This avoids WARNINGs in inc_nlink() and drop_nlink() when doing directory operations on a fuzzed filesystem. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+a9ac3de1b5de5fb10efc@syzkaller.appspotmail.com Reported-by: syzbot+df958cf5688a96ad3287@syzkaller.appspotmail.com Signed-off-by: Eric Biggers Signed-off-by: Andrew Morton Cc: Alexander Viro Cc: Qiujun Huang Cc: Link: http://lkml.kernel.org/r/20200628060846.682158-3-ebiggers@kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/minix/inode.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) --- a/fs/minix/inode.c +++ b/fs/minix/inode.c @@ -472,6 +472,13 @@ static struct inode *V1_minix_iget(struc iget_failed(inode); return ERR_PTR(-EIO); } + if (raw_inode->i_nlinks == 0) { + printk("MINIX-fs: deleted inode referenced: %lu\n", + inode->i_ino); + brelse(bh); + iget_failed(inode); + return ERR_PTR(-ESTALE); + } inode->i_mode = raw_inode->i_mode; i_uid_write(inode, raw_inode->i_uid); i_gid_write(inode, raw_inode->i_gid); @@ -505,6 +512,13 @@ static struct inode *V2_minix_iget(struc iget_failed(inode); return ERR_PTR(-EIO); } + if (raw_inode->i_nlinks == 0) { + printk("MINIX-fs: deleted inode referenced: %lu\n", + inode->i_ino); + brelse(bh); + iget_failed(inode); + return ERR_PTR(-ESTALE); + } inode->i_mode = raw_inode->i_mode; i_uid_write(inode, raw_inode->i_uid); i_gid_write(inode, raw_inode->i_gid); From patchwork Thu Aug 20 09:23:10 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265675 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 98898C433E1 for ; Thu, 20 Aug 2020 10:28:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7921322B43 for ; Thu, 20 Aug 2020 10:28:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919317; bh=0vbpsik9GH1sOS6luzvN5FmPVmEen3xws3Rpjd3rdO4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=IkfkPSy1wd/UX1AeLSoVNMEu8DzScROgFuo+h3Gy8SxOl0ZkD3k1COfRd9srWeX74 VWKRyfBqycfvubEhIYa9pssxmoCpMbEBGhAwHwPP6e4dKvJruT14v8OSmKy0cxBoAc R/Am9OPNA7fuI2hxU2er2Azgewm3ebOOQKDaiOng= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731608AbgHTK2Y (ORCPT ); Thu, 20 Aug 2020 06:28:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:48934 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731572AbgHTKVy (ORCPT ); Thu, 20 Aug 2020 06:21:54 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 610D420738; Thu, 20 Aug 2020 10:21:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918913; bh=0vbpsik9GH1sOS6luzvN5FmPVmEen3xws3Rpjd3rdO4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tJrsJctUmOoYyRelw5RorCkMRhhuUoLujLsuie+zDNHWjHz5KqDkTze8qEw/t/r2J C/4Gj/TIsC0bn36AdXuQBgA2PCH3RYHwEIAudjYyBX8FBGb5lTFydWBy8913eJ5C04 tTb3lFvD5O21QNlRcXJGkSPbKeVPLdvk9WtSGU8I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+c7d9ec7a1a7272dd71b3@syzkaller.appspotmail.com, syzbot+3b7b03a0c28948054fb5@syzkaller.appspotmail.com, syzbot+6e056ee473568865f3e6@syzkaller.appspotmail.com, Eric Biggers , Andrew Morton , Alexander Viro , Qiujun Huang , Linus Torvalds Subject: [PATCH 4.4 113/149] fs/minix: reject too-large maximum file size Date: Thu, 20 Aug 2020 11:23:10 +0200 Message-Id: <20200820092131.171897020@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Biggers commit 270ef41094e9fa95273f288d7d785313ceab2ff3 upstream. If the minix filesystem tries to map a very large logical block number to its on-disk location, block_to_path() can return offsets that are too large, causing out-of-bounds memory accesses when accessing indirect index blocks. This should be prevented by the check against the maximum file size, but this doesn't work because the maximum file size is read directly from the on-disk superblock and isn't validated itself. Fix this by validating the maximum file size at mount time. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+c7d9ec7a1a7272dd71b3@syzkaller.appspotmail.com Reported-by: syzbot+3b7b03a0c28948054fb5@syzkaller.appspotmail.com Reported-by: syzbot+6e056ee473568865f3e6@syzkaller.appspotmail.com Signed-off-by: Eric Biggers Signed-off-by: Andrew Morton Cc: Alexander Viro Cc: Qiujun Huang Cc: Link: http://lkml.kernel.org/r/20200628060846.682158-4-ebiggers@kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/minix/inode.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) --- a/fs/minix/inode.c +++ b/fs/minix/inode.c @@ -155,6 +155,23 @@ static int minix_remount (struct super_b return 0; } +static bool minix_check_superblock(struct minix_sb_info *sbi) +{ + if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) + return false; + + /* + * s_max_size must not exceed the block mapping limitation. This check + * is only needed for V1 filesystems, since V2/V3 support an extra level + * of indirect blocks which places the limit well above U32_MAX. + */ + if (sbi->s_version == MINIX_V1 && + sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE) + return false; + + return true; +} + static int minix_fill_super(struct super_block *s, void *data, int silent) { struct buffer_head *bh; @@ -233,11 +250,12 @@ static int minix_fill_super(struct super } else goto out_no_fs; + if (!minix_check_superblock(sbi)) + goto out_illegal_sb; + /* * Allocate the buffer map to keep the superblock small. */ - if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) - goto out_illegal_sb; i = (sbi->s_imap_blocks + sbi->s_zmap_blocks) * sizeof(bh); map = kzalloc(i, GFP_KERNEL); if (!map) From patchwork Thu Aug 20 09:23:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265677 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 379F7C433E1 for ; Thu, 20 Aug 2020 10:28:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1533220658 for ; Thu, 20 Aug 2020 10:28:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919299; bh=OE314dlREHwftamZAUJHXC4kUWq7DSSXV5toaxDKDP4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=1gktVaAOuCe+9iKA3chstzPvpTk4XC71pPTuXNXyXMrObYXPjstpGa+WC6WXOvZ3l 60ymzwfAKMIIod+YvoAhNUjd1FJrpfVz1xMNeFkxMCahV+3rOU4lSavJbx3BWZMue7 HwLEGPT/cP3PvD9SXhEDWb5Vq9fPjo4kBADcFW2E= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731508AbgHTK2R (ORCPT ); Thu, 20 Aug 2020 06:28:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:49046 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731576AbgHTKV5 (ORCPT ); Thu, 20 Aug 2020 06:21:57 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4DC6A20658; Thu, 20 Aug 2020 10:21:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918916; bh=OE314dlREHwftamZAUJHXC4kUWq7DSSXV5toaxDKDP4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QxwFEKHz5XJvu1hO6H4j8573oAyv7bvOqxxMiUlXOvSrY0T0cTur6/osmzA3+sP6q sev3AdViADScViq02zNeRqIXyW1OA91T/uEWQhWZmqhFqsg3uk9pxIH+aYZonjzr8b iNpnY05i9uKy8gg+r38n58ePqjWgbuzstbH19dcE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hector Martin , Takashi Iwai Subject: [PATCH 4.4 114/149] ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109 Date: Thu, 20 Aug 2020 11:23:11 +0200 Message-Id: <20200820092131.220609205@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Hector Martin commit 1b7ecc241a67ad6b584e071bd791a54e0cd5f097 upstream. Further investigation of the L-R swap problem on the MS2109 reveals that the problem isn't that the channels are swapped, but rather that they are swapped and also out of phase by one sample. In other words, the issue is actually that the very first frame that comes from the hardware is a half-frame containing only the right channel, and after that everything becomes offset. So introduce a new quirk field to drop the very first 2 bytes that come in after the format is configured and a capture stream starts. This puts the channels in phase and in the correct order. Cc: stable@vger.kernel.org Signed-off-by: Hector Martin Link: https://lore.kernel.org/r/20200810082400.225858-1-marcan@marcan.st Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/usb/card.h | 1 + sound/usb/pcm.c | 6 ++++++ sound/usb/quirks.c | 3 +++ sound/usb/stream.c | 1 + 4 files changed, 11 insertions(+) --- a/sound/usb/card.h +++ b/sound/usb/card.h @@ -125,6 +125,7 @@ struct snd_usb_substream { unsigned int tx_length_quirk:1; /* add length specifier to transfers */ unsigned int fmt_type; /* USB audio format type (1-3) */ unsigned int pkt_offset_adj; /* Bytes to drop from beginning of packets (for non-compliant devices) */ + unsigned int stream_offset_adj; /* Bytes to drop from beginning of stream (for non-compliant devices) */ unsigned int running: 1; /* running status */ --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -1302,6 +1302,12 @@ static void retire_capture_urb(struct sn // continue; } bytes = urb->iso_frame_desc[i].actual_length; + if (subs->stream_offset_adj > 0) { + unsigned int adj = min(subs->stream_offset_adj, bytes); + cp += adj; + bytes -= adj; + subs->stream_offset_adj -= adj; + } frames = bytes / stride; if (!subs->txfr_quirk) bytes = frames * stride; --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -1122,6 +1122,9 @@ void snd_usb_set_format_quirk(struct snd case USB_ID(0x041e, 0x3f19): /* E-Mu 0204 USB */ set_format_emu_quirk(subs, fmt); break; + case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */ + subs->stream_offset_adj = 2; + break; } } --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -95,6 +95,7 @@ static void snd_usb_init_substream(struc subs->tx_length_quirk = as->chip->tx_length_quirk; subs->speed = snd_usb_get_speed(subs->dev); subs->pkt_offset_adj = 0; + subs->stream_offset_adj = 0; snd_usb_set_pcm_ops(as->pcm, stream); From patchwork Thu Aug 20 09:23:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265699 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD3EEC433E1 for ; Thu, 20 Aug 2020 10:22:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8B5BC2072D for ; Thu, 20 Aug 2020 10:22:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918929; bh=dmuw/duFBzbPQYSIBOiWV0yYjkq2jDV+QOtdQeCfB+s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=l/CmeGlQSNrqt3PzO6OfDw/TnIF42LXEji0w6MDWVq2DADQqRcgoKlmiV4+HBuWxt LqN5paIo/4cd1z1AncEVySnlrdAGCqSeBfCygD7EMFXBtuSDKCaVRtrcIv15ovQBC8 rBJKusKfAr3rSxnxOv2H4bpsBY5Er6KZaKvG7ocE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731593AbgHTKWI (ORCPT ); Thu, 20 Aug 2020 06:22:08 -0400 Received: from mail.kernel.org ([198.145.29.99]:49278 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731586AbgHTKWD (ORCPT ); Thu, 20 Aug 2020 06:22:03 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3FD5F20658; Thu, 20 Aug 2020 10:22:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918922; bh=dmuw/duFBzbPQYSIBOiWV0yYjkq2jDV+QOtdQeCfB+s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=l8IQyOqK2b5voiMkj3bv3b3I1wMYE157pI7f8OwG65o9GhDzrsGdTJRDJL8nGOL8S g+TatQcI7fBYQiI0hw1ZfhQ/2qXk1NxdLtUhxhWy0+Bc30fs8YgRA+y2lFAeeKdYum xl74C6uX+FB6WdpvqEouSGZ3xmEVH5T+hSjvQYDw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sven Schnelle , Helge Deller Subject: [PATCH 4.4 116/149] parisc: mask out enable and reserved bits from sba imask Date: Thu, 20 Aug 2020 11:23:13 +0200 Message-Id: <20200820092131.317296232@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Sven Schnelle commit 5b24993c21cbf2de11aff077a48c5cb0505a0450 upstream. When using kexec the SBA IOMMU IBASE might still have the RE bit set. This triggers a WARN_ON when trying to write back the IBASE register later, and it also makes some mask calculations fail. Cc: Signed-off-by: Sven Schnelle Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman --- drivers/parisc/sba_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/parisc/sba_iommu.c +++ b/drivers/parisc/sba_iommu.c @@ -1277,7 +1277,7 @@ sba_ioc_init_pluto(struct parisc_device ** (one that doesn't overlap memory or LMMIO space) in the ** IBASE and IMASK registers. */ - ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE); + ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE) & ~0x1fffffULL; iova_space_size = ~(READ_REG(ioc->ioc_hpa + IOC_IMASK) & 0xFFFFFFFFUL) + 1; if ((ioc->ibase < 0xfed00000UL) && ((ioc->ibase + iova_space_size) > 0xfee00000UL)) { From patchwork Thu Aug 20 09:23:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265678 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD6CDC433E3 for ; Thu, 20 Aug 2020 10:27:54 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B237A20658 for ; Thu, 20 Aug 2020 10:27:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919274; bh=YBhuNgEYpgNDbtRXg8Vtp8+E5sDwJguPGeeJEgMwyMY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=1CQ9o26JjQoL1wj6QuMQ5QUDwg50lOWuX4gWl3qHdDlNOsNy2TMNw35RKlhlsrT30 iSordvovhu1TEFS2dw5j9IDmEYGiIHHvBh62Ic/I4J6wtsnecFIHVU5ZQ5cc23sE/k rxaHRy3YQTDvEZuEdCwxOcPl1r/u7OaPy4sm98LY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731740AbgHTK1w (ORCPT ); Thu, 20 Aug 2020 06:27:52 -0400 Received: from mail.kernel.org ([198.145.29.99]:49596 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731604AbgHTKWK (ORCPT ); Thu, 20 Aug 2020 06:22:10 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D54842072D; Thu, 20 Aug 2020 10:22:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918930; bh=YBhuNgEYpgNDbtRXg8Vtp8+E5sDwJguPGeeJEgMwyMY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LzqsfZQ5RKOkiC3emViDPISZfDMAqHoQepcDxJBvtUgMQ2V+wHFcTiNFN/ZDrlTde h3gyUOBLOcCSupHHHgHFg3rCpO3Fqxf6npd8SxRO0Lzav2/0nczT5EZWvm+11UVloq RhoOrOdHWFPgJ2/KRyMJY3fksEiQnLF/Ai8Vi6jg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?q?Roger_Pau_Monn=C3=A9?= , Juergen Gross Subject: [PATCH 4.4 119/149] xen/balloon: make the balloon wait interruptible Date: Thu, 20 Aug 2020 11:23:16 +0200 Message-Id: <20200820092131.463240018@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Roger Pau Monne commit 88a479ff6ef8af7f07e11593d58befc644244ff7 upstream. So it can be killed, or else processes can get hung indefinitely waiting for balloon pages. Signed-off-by: Roger Pau Monné Reviewed-by: Juergen Gross Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200727091342.52325-3-roger.pau@citrix.com Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman --- drivers/xen/balloon.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/xen/balloon.c +++ b/drivers/xen/balloon.c @@ -623,11 +623,13 @@ static int add_ballooned_pages(int nr_pa if (xen_hotplug_unpopulated) { st = reserve_additional_memory(); if (st != BP_ECANCELED) { + int rc; + mutex_unlock(&balloon_mutex); - wait_event(balloon_wq, + rc = wait_event_interruptible(balloon_wq, !list_empty(&ballooned_pages)); mutex_lock(&balloon_mutex); - return 0; + return rc ? -ENOMEM : 0; } } From patchwork Thu Aug 20 09:23:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265698 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 313C3C433E3 for ; Thu, 20 Aug 2020 10:22:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0102A20738 for ; Thu, 20 Aug 2020 10:22:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918937; bh=Ihlg5gtctDVm2xDUIMMHWVH+lViW3wLRwTsxbd0cDkk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ItYdJi0KOnPn39oubcMyUP1BDREdMpyXBHH7LPyjb7SEJTfBBMWfGu332YrostOSB nz01ytguXWcCfC9ERA69b9hzspSaoM8bMFcJbFIW0HX88d8yzI/49BaRLDvDHYDohb QTKwMV+NWmH17aD5A9EtA84jSpLEpQpAvyPb7Wwg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728948AbgHTKWP (ORCPT ); Thu, 20 Aug 2020 06:22:15 -0400 Received: from mail.kernel.org ([198.145.29.99]:49698 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731608AbgHTKWN (ORCPT ); Thu, 20 Aug 2020 06:22:13 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2B0F620658; Thu, 20 Aug 2020 10:22:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918932; bh=Ihlg5gtctDVm2xDUIMMHWVH+lViW3wLRwTsxbd0cDkk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S5EPJ0Cp6TfPcm4PrCYZbRs33XyRhg1rOryN/M1vmyM+QhWPPLI05KyEwWvb7zpf0 ET5vSs2BW4WaHZcBQ/M26WJO6N5uDFjNeKnnzylY05rDfhV9kJH1Ep604gPiv49Art nbtHikPxIA/p/f1BI9yiL1P1SU4K/1Go3WgUN31w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vasily Averin , "Rafael J. Wysocki" Subject: [PATCH 4.4 120/149] PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context() Date: Thu, 20 Aug 2020 11:23:17 +0200 Message-Id: <20200820092131.511561023@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Rafael J. Wysocki commit dae68d7fd4930315389117e9da35b763f12238f9 upstream. If context is not NULL in acpiphp_grab_context(), but the is_going_away flag is set for the device's parent, the reference counter of the context needs to be decremented before returning NULL or the context will never be freed, so make that happen. Fixes: edf5bf34d408 ("ACPI / dock: Use callback pointers from devices' ACPI hotplug contexts") Reported-by: Vasily Averin Cc: 3.15+ # 3.15+ Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman --- drivers/pci/hotplug/acpiphp_glue.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) --- a/drivers/pci/hotplug/acpiphp_glue.c +++ b/drivers/pci/hotplug/acpiphp_glue.c @@ -136,13 +136,21 @@ static struct acpiphp_context *acpiphp_g struct acpiphp_context *context; acpi_lock_hp_context(); + context = acpiphp_get_context(adev); - if (!context || context->func.parent->is_going_away) { - acpi_unlock_hp_context(); - return NULL; + if (!context) + goto unlock; + + if (context->func.parent->is_going_away) { + acpiphp_put_context(context); + context = NULL; + goto unlock; } + get_bridge(context->func.parent); acpiphp_put_context(context); + +unlock: acpi_unlock_hp_context(); return context; } From patchwork Thu Aug 20 09:23:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265680 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36EC3C433DF for ; Thu, 20 Aug 2020 10:27:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1237120658 for ; Thu, 20 Aug 2020 10:27:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919269; bh=pPVcXf/aBgvM1oGI0qVpK319Q+boiR2vN4KW4yK3AMM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=pMDJrfUnHEoo6kTTUeSPjsIA9BDjD14FKNhvPKVJr74LpLv/ZQpBU9EVrsNfnuTlr PDiI3sFqlFvLWISyrq2X7+n8aCxprlbHBjJWQ+t58oYELwIwrnl6O/Zpzi4Kjk7BRX IPueg9bLm/+6KOC91QXZPjYyLkBO6qKhTRCubBJs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731586AbgHTKWT (ORCPT ); Thu, 20 Aug 2020 06:22:19 -0400 Received: from mail.kernel.org ([198.145.29.99]:49920 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731611AbgHTKWR (ORCPT ); Thu, 20 Aug 2020 06:22:17 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B54E620658; Thu, 20 Aug 2020 10:22:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918937; bh=pPVcXf/aBgvM1oGI0qVpK319Q+boiR2vN4KW4yK3AMM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RK19ZZBdFW2xEHbkDu4ih6lE5RCF4XLhH/7DXOq8YRsUPXKf/RohORFQgwqK5AfEq +IlMzAD1AIOkQtPUdF9YuSFDdSn56YD2zO4e6q7ILVTVW4vJXlH9GdJhK4pfn9Xm3m tsM0qA3GSiXRjVTK4qYQUdQw+0+UerQjmj3WHu68= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , David Sterba Subject: [PATCH 4.4 121/149] btrfs: only search for left_info if there is no right_info in try_merge_free_space Date: Thu, 20 Aug 2020 11:23:18 +0200 Message-Id: <20200820092131.560846881@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Josef Bacik commit bf53d4687b8f3f6b752f091eb85f62369a515dfd upstream. In try_to_merge_free_space we attempt to find entries to the left and right of the entry we are adding to see if they can be merged. We search for an entry past our current info (saved into right_info), and then if right_info exists and it has a rb_prev() we save the rb_prev() into left_info. However there's a slight problem in the case that we have a right_info, but no entry previous to that entry. At that point we will search for an entry just before the info we're attempting to insert. This will simply find right_info again, and assign it to left_info, making them both the same pointer. Now if right_info _can_ be merged with the range we're inserting, we'll add it to the info and free right_info. However further down we'll access left_info, which was right_info, and thus get a use-after-free. Fix this by only searching for the left entry if we don't find a right entry at all. The CVE referenced had a specially crafted file system that could trigger this use-after-free. However with the tree checker improvements we no longer trigger the conditions for the UAF. But the original conditions still apply, hence this fix. Reference: CVE-2019-19448 Fixes: 963030817060 ("Btrfs: use hybrid extents+bitmap rb tree for free space") CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Josef Bacik Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/free-space-cache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/fs/btrfs/free-space-cache.c +++ b/fs/btrfs/free-space-cache.c @@ -2158,7 +2158,7 @@ out: static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl, struct btrfs_free_space *info, bool update_stat) { - struct btrfs_free_space *left_info; + struct btrfs_free_space *left_info = NULL; struct btrfs_free_space *right_info; bool merged = false; u64 offset = info->offset; @@ -2173,7 +2173,7 @@ static bool try_merge_free_space(struct if (right_info && rb_prev(&right_info->offset_index)) left_info = rb_entry(rb_prev(&right_info->offset_index), struct btrfs_free_space, offset_index); - else + else if (!right_info) left_info = tree_search_offset(ctl, offset - 1, 0, 0); if (right_info && !right_info->bitmap) { From patchwork Thu Aug 20 09:23:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265697 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25392C433E1 for ; Thu, 20 Aug 2020 10:22:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C03E12072D for ; Thu, 20 Aug 2020 10:22:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918948; bh=cbIUHUAy15ZMG23ss4Ojdz/v2oaFYsFFVeJlaOtQSGg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=TrbjWFgRn+msW1MPJ6jkPHbfLJ7KO1fX5q6vgWgXhQ5T0VTKChNasuNCo7Md4GMqD N5j5XZ68StvO6Q58bZw43pGOEpp86BFdHH7gJfPgj0rKpviANWfs8HKqCTB5wLGj/o OXnlqVYOSrOaYtSJhL8X7FRcqmgCGCkvNGulEQfk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731306AbgHTKWZ (ORCPT ); Thu, 20 Aug 2020 06:22:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:50038 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731598AbgHTKWV (ORCPT ); Thu, 20 Aug 2020 06:22:21 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AB6992072D; Thu, 20 Aug 2020 10:22:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918940; bh=cbIUHUAy15ZMG23ss4Ojdz/v2oaFYsFFVeJlaOtQSGg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bx6veKjCM2pANBb4ocDbeUyxXaCj0imCwXUauvjHamTjJh3Ersw0aXDfC0WzVp8Tz VXzaL1zpnm9zgrlfzeOCP1N2/9BZZNGTfEGL/L5Ggc+JuZREUFNX48Oi4UmbxnhG7Y /0GYIOyk98s7VCnMP6I3LW1WnA9jEW8Pop2stodg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johannes Thumshirn , Filipe Manana , David Sterba Subject: [PATCH 4.4 122/149] btrfs: fix memory leaks after failure to lookup checksums during inode logging Date: Thu, 20 Aug 2020 11:23:19 +0200 Message-Id: <20200820092131.610169547@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Filipe Manana commit 4f26433e9b3eb7a55ed70d8f882ae9cd48ba448b upstream. While logging an inode, at copy_items(), if we fail to lookup the checksums for an extent we release the destination path, free the ins_data array and then return immediately. However a previous iteration of the for loop may have added checksums to the ordered_sums list, in which case we leak the memory used by them. So fix this by making sure we iterate the ordered_sums list and free all its checksums before returning. Fixes: 3650860b90cc2a ("Btrfs: remove almost all of the BUG()'s from tree-log.c") CC: stable@vger.kernel.org # 4.4+ Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman --- fs/btrfs/tree-log.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -3733,11 +3733,8 @@ static noinline int copy_items(struct bt log->fs_info->csum_root, ds + cs, ds + cs + cl - 1, &ordered_sums, 0); - if (ret) { - btrfs_release_path(dst_path); - kfree(ins_data); - return ret; - } + if (ret) + break; } } } @@ -3750,7 +3747,6 @@ static noinline int copy_items(struct bt * we have to do this after the loop above to avoid changing the * log tree while trying to change the log tree. */ - ret = 0; while (!list_empty(&ordered_sums)) { struct btrfs_ordered_sum *sums = list_entry(ordered_sums.next, struct btrfs_ordered_sum, From patchwork Thu Aug 20 09:23:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265679 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4038C433E4 for ; Thu, 20 Aug 2020 10:27:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7BDDD20658 for ; Thu, 20 Aug 2020 10:27:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919271; bh=UQ9bBscGua1StUs2Lns9LflTuLYe5Z2moAJYhe5l1Wc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=NnpiEsRkf58yl+SBUnXvr+RpkJu/enopbrKMKmkVpHH7f0uhn5sPNtq7gkMcAfpGb ACHWBvnMNt1vVR0igr8ugzT2t9AugJBpjVEErk9cxjr5040M32PIQucN30BwlB0ztp DK1MLP2OCaAHlD42wsqMKQXT820AcEKlH6K25bSY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731855AbgHTK1t (ORCPT ); Thu, 20 Aug 2020 06:27:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:50174 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731592AbgHTKWX (ORCPT ); Thu, 20 Aug 2020 06:22:23 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 02D5D20658; Thu, 20 Aug 2020 10:22:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918942; bh=UQ9bBscGua1StUs2Lns9LflTuLYe5Z2moAJYhe5l1Wc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dsmaZKvpnhUN8f+QzF2v2nX/c+sy1i4l/kSsH6Z/ZDTvstqHEy03c9F/rp5yeBBgS nLMcoKT+OMKi/DMOMfEu1E6y75ByPNGh+ZOjh5w3LCdbhQJohDrDQE3WetpY95o9X1 FyldJkF62X2QsnPAjVaIM23z1I6LrjKtafvdGb8c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stephen Rothwell , Michael Ellerman Subject: [PATCH 4.4 123/149] powerpc: Fix circular dependency between percpu.h and mmu.h Date: Thu, 20 Aug 2020 11:23:20 +0200 Message-Id: <20200820092131.658741805@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Michael Ellerman commit 0c83b277ada72b585e6a3e52b067669df15bcedb upstream. Recently random.h started including percpu.h (see commit f227e3ec3b5c ("random32: update the net random state on interrupt and activity")), which broke corenet64_smp_defconfig: In file included from /linux/arch/powerpc/include/asm/paca.h:18, from /linux/arch/powerpc/include/asm/percpu.h:13, from /linux/include/linux/random.h:14, from /linux/lib/uuid.c:14: /linux/arch/powerpc/include/asm/mmu.h:139:22: error: unknown type name 'next_tlbcam_idx' 139 | DECLARE_PER_CPU(int, next_tlbcam_idx); This is due to a circular header dependency: asm/mmu.h includes asm/percpu.h, which includes asm/paca.h, which includes asm/mmu.h Which means DECLARE_PER_CPU() isn't defined when mmu.h needs it. We can fix it by moving the include of paca.h below the include of asm-generic/percpu.h. This moves the include of paca.h out of the #ifdef __powerpc64__, but that is OK because paca.h is almost entirely inside #ifdef CONFIG_PPC64 anyway. It also moves the include of paca.h out of the #ifdef CONFIG_SMP, which could possibly break something, but seems to have no ill effects. Fixes: f227e3ec3b5c ("random32: update the net random state on interrupt and activity") Cc: stable@vger.kernel.org # v5.8 Reported-by: Stephen Rothwell Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200804130558.292328-1-mpe@ellerman.id.au Signed-off-by: Greg Kroah-Hartman --- arch/powerpc/include/asm/percpu.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/powerpc/include/asm/percpu.h +++ b/arch/powerpc/include/asm/percpu.h @@ -9,8 +9,6 @@ #ifdef CONFIG_SMP -#include - #define __my_cpu_offset local_paca->data_offset #endif /* CONFIG_SMP */ @@ -18,4 +16,6 @@ #include +#include + #endif /* _ASM_POWERPC_PERCPU_H_ */ From patchwork Thu Aug 20 09:23:24 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265696 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D646EC433E1 for ; Thu, 20 Aug 2020 10:22:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B796320738 for ; Thu, 20 Aug 2020 10:22:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918963; bh=Jox495f5CvfbuLnsYvkh7USH1EMND/H2HV1yt6Qf69U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=P2xqU3lyBhD0pICOcTniSIIvhOtcKjuWDWgOihAmg7hUR5YBAP2lWkFy6JYOdpTOh hUUdb5p3Zd+z0V85s5OI0Eia72rUCDkab0Rlo69u+ZC2hzNtIWdZt1mbY49pKiNwQt doxjRSurBn2vM4cyNKPL9+OW+K7ymy4HeUTwynAc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731710AbgHTKWm (ORCPT ); Thu, 20 Aug 2020 06:22:42 -0400 Received: from mail.kernel.org ([198.145.29.99]:50584 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731634AbgHTKWd (ORCPT ); Thu, 20 Aug 2020 06:22:33 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0653320658; Thu, 20 Aug 2020 10:22:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918952; bh=Jox495f5CvfbuLnsYvkh7USH1EMND/H2HV1yt6Qf69U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oBR3CBCbQYjq0McFIu1+vQ/KLOLdjms21/2NIY5/rQ8/GaySjvypyEGQ/wP9+Pj+c 7yG2cLxXQ0SKRbZFnj0/Vif1HWbtCD6KQbasbH5HDls8rAUMgrZ4mURlzPQkufpf0w lFAarzC5/vTNnByAku3jCGn6xrHmn1X6iOQiHHoE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Coly Li , Jens Axboe Subject: [PATCH 4.4 127/149] bcache: allocate meta data pages as compound pages Date: Thu, 20 Aug 2020 11:23:24 +0200 Message-Id: <20200820092131.855998593@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Coly Li commit 5fe48867856367142d91a82f2cbf7a57a24cbb70 upstream. There are some meta data of bcache are allocated by multiple pages, and they are used as bio bv_page for I/Os to the cache device. for example cache_set->uuids, cache->disk_buckets, journal_write->data, bset_tree->data. For such meta data memory, all the allocated pages should be treated as a single memory block. Then the memory management and underlying I/O code can treat them more clearly. This patch adds __GFP_COMP flag to all the location allocating >0 order pages for the above mentioned meta data. Then their pages are treated as compound pages now. Signed-off-by: Coly Li Cc: stable@vger.kernel.org Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- drivers/md/bcache/bset.c | 2 +- drivers/md/bcache/btree.c | 2 +- drivers/md/bcache/journal.c | 4 ++-- drivers/md/bcache/super.c | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) --- a/drivers/md/bcache/bset.c +++ b/drivers/md/bcache/bset.c @@ -317,7 +317,7 @@ int bch_btree_keys_alloc(struct btree_ke b->page_order = page_order; - t->data = (void *) __get_free_pages(gfp, b->page_order); + t->data = (void *) __get_free_pages(__GFP_COMP|gfp, b->page_order); if (!t->data) goto err; --- a/drivers/md/bcache/btree.c +++ b/drivers/md/bcache/btree.c @@ -795,7 +795,7 @@ int bch_btree_cache_alloc(struct cache_s mutex_init(&c->verify_lock); c->verify_ondisk = (void *) - __get_free_pages(GFP_KERNEL, ilog2(bucket_pages(c))); + __get_free_pages(GFP_KERNEL|__GFP_COMP, ilog2(bucket_pages(c))); c->verify_data = mca_bucket_alloc(c, &ZERO_KEY, GFP_KERNEL); --- a/drivers/md/bcache/journal.c +++ b/drivers/md/bcache/journal.c @@ -838,8 +838,8 @@ int bch_journal_alloc(struct cache_set * j->w[1].c = c; if (!(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) || - !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)) || - !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS))) + !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS)) || + !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS))) return -ENOMEM; return 0; --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1469,7 +1469,7 @@ void bch_cache_set_unregister(struct cac } #define alloc_bucket_pages(gfp, c) \ - ((void *) __get_free_pages(__GFP_ZERO|gfp, ilog2(bucket_pages(c)))) + ((void *) __get_free_pages(__GFP_ZERO|__GFP_COMP|gfp, ilog2(bucket_pages(c)))) struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) { From patchwork Thu Aug 20 09:23:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265681 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97E45C433E1 for ; Thu, 20 Aug 2020 10:27:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6D39E20658 for ; Thu, 20 Aug 2020 10:27:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919224; bh=peVkpFOhZGuRw9SB7/KqhBJFgfeMdu5lbq25QTO9714=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Ti2gaU08gNnGwSH4LN9ESFCLuIF05Aem/WD/Rjn6qR68uLW8oj6Oi/+vFKGhfKZ1+ UtxaW81EHrDN3IBYQCx0ItDuNoxfUYdByCNw/E5LvbdfpivkKL1+9tdknonWssWpvx ZBFG3JJMbYENuUY/XEHAg1PXlPNnomA43O5885ck= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730011AbgHTK1D (ORCPT ); Thu, 20 Aug 2020 06:27:03 -0400 Received: from mail.kernel.org ([198.145.29.99]:50664 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731677AbgHTKWf (ORCPT ); Thu, 20 Aug 2020 06:22:35 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 46BB520658; Thu, 20 Aug 2020 10:22:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918954; bh=peVkpFOhZGuRw9SB7/KqhBJFgfeMdu5lbq25QTO9714=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=K+k6iEPcYyiNWFXbUhGJRRaRV0GtOnPk8OQxKhqh8+iqYohQgkr6GqLIQ4JyU3qE+ 3vF/wtwydbbiqXUGtWoUCoFPPNcKEMrJ2xJOoUO4J6lligmYkjz+PXIqsE4AOHYOSV 4pCgpnsp/VjHArUjitfaegrxLQznebxd+fuHTOQk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ben Greear , Johannes Berg Subject: [PATCH 4.4 128/149] mac80211: fix misplaced while instead of if Date: Thu, 20 Aug 2020 11:23:25 +0200 Message-Id: <20200820092131.904271328@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johannes Berg commit 5981fe5b0529ba25d95f37d7faa434183ad618c5 upstream. This never was intended to be a 'while' loop, it should've just been an 'if' instead of 'while'. Fix this. I noticed this while applying another patch from Ben that intended to fix a busy loop at this spot. Cc: stable@vger.kernel.org Fixes: b16798f5b907 ("mac80211: mark station unauthorized before key removal") Reported-by: Ben Greear Link: https://lore.kernel.org/r/20200803110209.253009ae41ff.I3522aad099392b31d5cf2dcca34cbac7e5832dde@changeid Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/mac80211/sta_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -906,7 +906,7 @@ static void __sta_info_destroy_part2(str might_sleep(); lockdep_assert_held(&local->sta_mtx); - while (sta->sta_state == IEEE80211_STA_AUTHORIZED) { + if (sta->sta_state == IEEE80211_STA_AUTHORIZED) { ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC); WARN_ON_ONCE(ret); } From patchwork Thu Aug 20 09:23:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265682 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0CDEAC433E1 for ; Thu, 20 Aug 2020 10:26:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D35D420658 for ; Thu, 20 Aug 2020 10:26:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919212; bh=QUoNohSZzZE+A+fmQFXcvxAZINKoPwBfvLRlvwP++60=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=WBU+QMnWdH9Hd8W88nXEW0h+D9I65YUHp/aJhLy/NATN/IrYfFzjpxtCewO2A9WLL Xlhd2Y/3UbcsSuaMTpQKnKvY5HnNBWLwbpgv6wBinSLNsEUqohFqEbv3xlcOoA7qzC fu73l0tGo56qFsqzpA8I7EpuQBfcG5L115nKd/Ws= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729490AbgHTKWn (ORCPT ); Thu, 20 Aug 2020 06:22:43 -0400 Received: from mail.kernel.org ([198.145.29.99]:50778 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731700AbgHTKWi (ORCPT ); Thu, 20 Aug 2020 06:22:38 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1F3EA20658; Thu, 20 Aug 2020 10:22:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918957; bh=QUoNohSZzZE+A+fmQFXcvxAZINKoPwBfvLRlvwP++60=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1+OW0D50KmnyDQ6ZVZPmPhneDBnUwBMU3G2LSKZm30r+r8oRUCH9qdhyT2XYV57nS WSsugygejwz7rzYy8sdk5U98bG04FoK0Y/eaL/nj1o45QdeSSC3r41pJyouUaJaUqU Xg4JEp7P08x//akMloI9jUf0Z0H+U+lD/vBtrr/0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Huacai Chen , Thomas Bogendoerfer Subject: [PATCH 4.4 129/149] MIPS: CPU#0 is not hotpluggable Date: Thu, 20 Aug 2020 11:23:26 +0200 Message-Id: <20200820092131.952737640@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Huacai Chen commit 9cce844abf07b683cff5f0273977d5f8d0af94c7 upstream. Now CPU#0 is not hotpluggable on MIPS, so prevent to create /sys/devices /system/cpu/cpu0/online which confuses some user-space tools. Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen Signed-off-by: Thomas Bogendoerfer Signed-off-by: Greg Kroah-Hartman --- arch/mips/kernel/topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/mips/kernel/topology.c +++ b/arch/mips/kernel/topology.c @@ -19,7 +19,7 @@ static int __init topology_init(void) for_each_present_cpu(i) { struct cpu *c = &per_cpu(cpu_devices, i); - c->hotpluggable = 1; + c->hotpluggable = !!i; ret = register_cpu(c, i); if (ret) printk(KERN_WARNING "topology_init: register_cpu %d " From patchwork Thu Aug 20 09:23:28 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265695 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA8E6C433E3 for ; Thu, 20 Aug 2020 10:22:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A08762173E for ; Thu, 20 Aug 2020 10:22:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918969; bh=7mNdEbVqYb/OiS51REFvYk6wutZQVjUnedpnmRsen8E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=UwAUZ7icN+pgGu/J+fBN9GVgA6zPpJCSf+I4xMC7a/WeaFj9YkbC2lG7Q4HDi+wkl 6LKZck+vU2K8C0qfR6MzPXBQjghYgcV9WgHJ/1LpVk8YdglrfzYw8JqN3dV/8HA0W6 tXaPNXLrHGhIBL9QTtZa7sO8AO6oKLwEQ8vsyr5c= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731473AbgHTKWs (ORCPT ); Thu, 20 Aug 2020 06:22:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:51086 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731106AbgHTKWp (ORCPT ); Thu, 20 Aug 2020 06:22:45 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id CF3CF20885; Thu, 20 Aug 2020 10:22:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918964; bh=7mNdEbVqYb/OiS51REFvYk6wutZQVjUnedpnmRsen8E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2WiiTADNkKKixAeBE+INwfDiiFa41UDssJWX14onVwLb1e9lzBvVWOT25IXQsq9UU TNHJJl9E89i06RuOWvmVJzv5rxbqFKnt8OtO/1GdOcl45K7AW9F2fwyk4w6dq8UbCC /hAYhES+9wG/ro9ronCwTYEEqYVmjoK79IpIOFaQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Junxiao Bi , Andrew Morton , Joseph Qi , Gang He , Mark Fasheh , Joel Becker , Changwei Ge , Jun Piao , Linus Torvalds Subject: [PATCH 4.4 131/149] ocfs2: change slot number type s16 to u16 Date: Thu, 20 Aug 2020 11:23:28 +0200 Message-Id: <20200820092132.049586653@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Junxiao Bi commit 38d51b2dd171ad973afc1f5faab825ed05a2d5e9 upstream. Dan Carpenter reported the following static checker warning. fs/ocfs2/super.c:1269 ocfs2_parse_options() warn: '(-1)' 65535 can't fit into 32767 'mopt->slot' fs/ocfs2/suballoc.c:859 ocfs2_init_inode_steal_slot() warn: '(-1)' 65535 can't fit into 32767 'osb->s_inode_steal_slot' fs/ocfs2/suballoc.c:867 ocfs2_init_meta_steal_slot() warn: '(-1)' 65535 can't fit into 32767 'osb->s_meta_steal_slot' That's because OCFS2_INVALID_SLOT is (u16)-1. Slot number in ocfs2 can be never negative, so change s16 to u16. Fixes: 9277f8334ffc ("ocfs2: fix value of OCFS2_INVALID_SLOT") Reported-by: Dan Carpenter Signed-off-by: Junxiao Bi Signed-off-by: Andrew Morton Reviewed-by: Joseph Qi Reviewed-by: Gang He Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Link: http://lkml.kernel.org/r/20200627001259.19757-1-junxiao.bi@oracle.com Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/ocfs2/ocfs2.h | 4 ++-- fs/ocfs2/suballoc.c | 4 ++-- fs/ocfs2/super.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) --- a/fs/ocfs2/ocfs2.h +++ b/fs/ocfs2/ocfs2.h @@ -337,8 +337,8 @@ struct ocfs2_super spinlock_t osb_lock; u32 s_next_generation; unsigned long osb_flags; - s16 s_inode_steal_slot; - s16 s_meta_steal_slot; + u16 s_inode_steal_slot; + u16 s_meta_steal_slot; atomic_t s_num_inodes_stolen; atomic_t s_num_meta_stolen; --- a/fs/ocfs2/suballoc.c +++ b/fs/ocfs2/suballoc.c @@ -895,9 +895,9 @@ static void __ocfs2_set_steal_slot(struc { spin_lock(&osb->osb_lock); if (type == INODE_ALLOC_SYSTEM_INODE) - osb->s_inode_steal_slot = slot; + osb->s_inode_steal_slot = (u16)slot; else if (type == EXTENT_ALLOC_SYSTEM_INODE) - osb->s_meta_steal_slot = slot; + osb->s_meta_steal_slot = (u16)slot; spin_unlock(&osb->osb_lock); } --- a/fs/ocfs2/super.c +++ b/fs/ocfs2/super.c @@ -96,7 +96,7 @@ struct mount_options unsigned long commit_interval; unsigned long mount_opt; unsigned int atime_quantum; - signed short slot; + unsigned short slot; int localalloc_opt; unsigned int resv_level; int dir_resv_level; @@ -1372,7 +1372,7 @@ static int ocfs2_parse_options(struct su goto bail; } if (option) - mopt->slot = (s16)option; + mopt->slot = (u16)option; break; case Opt_commit: option = 0; From patchwork Thu Aug 20 09:23:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265691 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A174C433DF for ; Thu, 20 Aug 2020 10:24:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DE61520738 for ; Thu, 20 Aug 2020 10:24:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919057; bh=BbVjOawr2HPM457F4RYi76yZJrjyaGdSN/XIGqZ/k9Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=g0TG9i5IigyfB1D5xtKAiTL7ODkG0GMNgoEGeq7N7rDfEnioh28+e+mNX/lAKRsCW /I6tjtFbx/mLKV71P4CFTJl2+Uq6DiROEB+R992QzIbumqafbGjgzYFDcixMin2LjL l8gxLa/nYRpm7gT/UVX1MaZOC/y+7//iVo8qx1l8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731781AbgHTKXs (ORCPT ); Thu, 20 Aug 2020 06:23:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:53706 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731776AbgHTKXq (ORCPT ); Thu, 20 Aug 2020 06:23:46 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3532420738; Thu, 20 Aug 2020 10:23:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919025; bh=BbVjOawr2HPM457F4RYi76yZJrjyaGdSN/XIGqZ/k9Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tOQHGzl/7ABWCT3XZtfo7OElG2+11cL2pn0E921shugLC0bf22N0ubWUDADGtVceS 1fIigubXEsyCLta1vuXP3Cc1xDtnEkZiJozQFBFtGUkiSPb8TNGPfME9q/noA/fDkQ JCWjD/0c8TO4v2Jz8+YRp5y/6pZkbNUL8Dh1WNvE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Anton Blanchard , Michael Ellerman Subject: [PATCH 4.4 133/149] pseries: Fix 64 bit logical memory block panic Date: Thu, 20 Aug 2020 11:23:30 +0200 Message-Id: <20200820092132.146054417@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Anton Blanchard commit 89c140bbaeee7a55ed0360a88f294ead2b95201b upstream. Booting with a 4GB LMB size causes us to panic: qemu-system-ppc64: OS terminated: OS panic: Memory block size not suitable: 0x0 Fix pseries_memory_block_size() to handle 64 bit LMBs. Cc: stable@vger.kernel.org Signed-off-by: Anton Blanchard Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200715000820.1255764-1-anton@ozlabs.org Signed-off-by: Greg Kroah-Hartman --- arch/powerpc/platforms/pseries/hotplug-memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/powerpc/platforms/pseries/hotplug-memory.c +++ b/arch/powerpc/platforms/pseries/hotplug-memory.c @@ -29,7 +29,7 @@ static bool rtas_hp_event; unsigned long pseries_memory_block_size(void) { struct device_node *np; - unsigned int memblock_size = MIN_MEMORY_BLOCK_SIZE; + u64 memblock_size = MIN_MEMORY_BLOCK_SIZE; struct resource r; np = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory"); From patchwork Thu Aug 20 09:23:31 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265685 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A416C433E4 for ; Thu, 20 Aug 2020 10:26:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 18D8D2173E for ; Thu, 20 Aug 2020 10:26:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919185; bh=hixA20xvTdZKt1cgfekH/mKHjoOFti/JKv/G0nEaHcE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=SpLuk/kiE23fHPQReECR7qNsgg+8y07uuoDdyZAw0rX5CU3vWUBmfK54ujB3MnRrY qXW0ciugV+IK2gW6Uok/Y4m6NqL1UjqIpSqyUXAl5J8pMK4vXUGo322WCh8xS5EbI7 4/I8kz3aB2zdZjp9EWw/L8sw8Kc+RFj4PKd1Ao4o= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729928AbgHTK0S (ORCPT ); Thu, 20 Aug 2020 06:26:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:51842 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731686AbgHTKXI (ORCPT ); Thu, 20 Aug 2020 06:23:08 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 01CA220738; Thu, 20 Aug 2020 10:23:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918986; bh=hixA20xvTdZKt1cgfekH/mKHjoOFti/JKv/G0nEaHcE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hed65pBbiLOhdN7eT86y5ymYsTURnyM34EL7vpKJIoum58WU45/h/3IAfMCUaa04p 0hhyFajHPSuPkiQ/mrN/tK7TfHslW8n+xi+yats6TfJ59j/xqwWKySVdaMZV2pvEGz COZD47L50CqziALtjIJmHMxM72Gvip3QsjC5gtSg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Sasha Levin Subject: [PATCH 4.4 134/149] USB: serial: ftdi_sio: make process-packet buffer unsigned Date: Thu, 20 Aug 2020 11:23:31 +0200 Message-Id: <20200820092132.186524629@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johan Hovold [ Upstream commit ab4cc4ef6724ea588e835fc1e764c4b4407a70b7 ] Use an unsigned type for the process-packet buffer argument and give it a more apt name. Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold Signed-off-by: Sasha Levin --- drivers/usb/serial/ftdi_sio.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c index 8388f88ce6356..4b9404f99c010 100644 --- a/drivers/usb/serial/ftdi_sio.c +++ b/drivers/usb/serial/ftdi_sio.c @@ -2051,12 +2051,12 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port, #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE) static int ftdi_process_packet(struct usb_serial_port *port, - struct ftdi_private *priv, char *packet, int len) + struct ftdi_private *priv, unsigned char *buf, int len) { + unsigned char status; + unsigned char *ch; int i; - char status; char flag; - char *ch; if (len < 2) { dev_dbg(&port->dev, "malformed packet\n"); @@ -2066,7 +2066,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, /* Compare new line status to the old one, signal if different/ N.B. packet may be processed more than once, but differences are only processed once. */ - status = packet[0] & FTDI_STATUS_B0_MASK; + status = buf[0] & FTDI_STATUS_B0_MASK; if (status != priv->prev_status) { char diff_status = status ^ priv->prev_status; @@ -2092,7 +2092,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, } /* save if the transmitter is empty or not */ - if (packet[1] & FTDI_RS_TEMT) + if (buf[1] & FTDI_RS_TEMT) priv->transmit_empty = 1; else priv->transmit_empty = 0; @@ -2106,29 +2106,29 @@ static int ftdi_process_packet(struct usb_serial_port *port, * data payload to avoid over-reporting. */ flag = TTY_NORMAL; - if (packet[1] & FTDI_RS_ERR_MASK) { + if (buf[1] & FTDI_RS_ERR_MASK) { /* Break takes precedence over parity, which takes precedence * over framing errors */ - if (packet[1] & FTDI_RS_BI) { + if (buf[1] & FTDI_RS_BI) { flag = TTY_BREAK; port->icount.brk++; usb_serial_handle_break(port); - } else if (packet[1] & FTDI_RS_PE) { + } else if (buf[1] & FTDI_RS_PE) { flag = TTY_PARITY; port->icount.parity++; - } else if (packet[1] & FTDI_RS_FE) { + } else if (buf[1] & FTDI_RS_FE) { flag = TTY_FRAME; port->icount.frame++; } /* Overrun is special, not associated with a char */ - if (packet[1] & FTDI_RS_OE) { + if (buf[1] & FTDI_RS_OE) { port->icount.overrun++; tty_insert_flip_char(&port->port, 0, TTY_OVERRUN); } } port->icount.rx += len; - ch = packet + 2; + ch = buf + 2; if (port->port.console && port->sysrq) { for (i = 0; i < len; i++, ch++) { From patchwork Thu Aug 20 09:23:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265689 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3018CC433DF for ; Thu, 20 Aug 2020 10:24:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 01E3D20738 for ; Thu, 20 Aug 2020 10:24:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919074; bh=GAyyTAB9P2F13Pz/jDbI5tiLoSlilL3+aFk5A9smYEY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=UFxTLI0UwgJrpqyDw7kWnBpBBJZbQcSvL49t0Pe167qOwmxUwiRN5WS66enl1/1u+ 3PwufBu1AA3/kVlp5XuYuXj6qyaZ5QsmU41JOCneCGn10Xa0tpR4O4K/QpDZB6iVAT Xj2Tetj+JlP6nmHFgO6Q31K2SE0VxdEAayHdOjMU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729925AbgHTKY3 (ORCPT ); Thu, 20 Aug 2020 06:24:29 -0400 Received: from mail.kernel.org ([198.145.29.99]:53292 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731759AbgHTKXf (ORCPT ); Thu, 20 Aug 2020 06:23:35 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AE63C2072D; Thu, 20 Aug 2020 10:23:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919015; bh=GAyyTAB9P2F13Pz/jDbI5tiLoSlilL3+aFk5A9smYEY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CiZmcSkig/6kR3AdEHBZpmLDA/NWyG+w+AVmDLX5FuIwt1L5hSQFmlFhnjCfWNajt PmwZVGbCuvN/ZBC/SEfxk08kqJkd5bMAsFCRsYMYh5gAJ0spG6FJcwW1ePeEHkxNPN YowcgnHxsucZrIRYev0dEbFC89FZyN9NZaVdq4FI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wolfram Sang , Wolfram Sang , Sasha Levin Subject: [PATCH 4.4 139/149] i2c: rcar: slave: only send STOP event when we have been addressed Date: Thu, 20 Aug 2020 11:23:36 +0200 Message-Id: <20200820092132.426968365@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Wolfram Sang [ Upstream commit 314139f9f0abdba61ed9a8463bbcb0bf900ac5a2 ] When the SSR interrupt is activated, it will detect every STOP condition on the bus, not only the ones after we have been addressed. So, enable this interrupt only after we have been addressed, and disable it otherwise. Fixes: de20d1857dd6 ("i2c: rcar: add slave support") Signed-off-by: Wolfram Sang Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin --- drivers/i2c/busses/i2c-rcar.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c index dfe1a53ce4ad3..ddfb08a3e6c20 100644 --- a/drivers/i2c/busses/i2c-rcar.c +++ b/drivers/i2c/busses/i2c-rcar.c @@ -386,13 +386,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR); } - rcar_i2c_write(priv, ICSSR, ~SAR & 0xff); + /* Clear SSR, too, because of old STOPs to other clients than us */ + rcar_i2c_write(priv, ICSSR, ~(SAR | SSR) & 0xff); } /* master sent stop */ if (ssr_filtered & SSR) { i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); - rcar_i2c_write(priv, ICSIER, SAR | SSR); + rcar_i2c_write(priv, ICSIER, SAR); rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); } @@ -541,7 +542,7 @@ static int rcar_reg_slave(struct i2c_client *slave) priv->slave = slave; rcar_i2c_write(priv, ICSAR, slave->addr); rcar_i2c_write(priv, ICSSR, 0); - rcar_i2c_write(priv, ICSIER, SAR | SSR); + rcar_i2c_write(priv, ICSIER, SAR); rcar_i2c_write(priv, ICSCR, SIE | SDBS); return 0; From patchwork Thu Aug 20 09:23:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265690 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47025C433E1 for ; Thu, 20 Aug 2020 10:24:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1875120738 for ; Thu, 20 Aug 2020 10:24:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919064; bh=sX5hb72mhQcxV5Y/NcLs73/WvcsHj26ueUFDCkJLfW4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Jyqaf30VK5fJrN5/wM6+J0iy8QEJUB9Ci8wBhu91EnFl6FAPdI65Qy6B49dPjTRML gBLsnDbBK7vw29iJPjRjLTAgvQIlm2UlnwfUhXH9H8VW9bzcgGxc4EE1saZWVLYYKy JvB9AuLRfYSHS0uRcQ4NFDhi7/t6Tz1DZiu0w+Ag= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730287AbgHTKYW (ORCPT ); Thu, 20 Aug 2020 06:24:22 -0400 Received: from mail.kernel.org ([198.145.29.99]:53610 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731771AbgHTKXn (ORCPT ); Thu, 20 Aug 2020 06:23:43 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AD3BB2072D; Thu, 20 Aug 2020 10:23:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919023; bh=sX5hb72mhQcxV5Y/NcLs73/WvcsHj26ueUFDCkJLfW4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MNOzyNMiGvfdMsrcrE5KPjXCpKmsA0GQw1vY/Vyz+QwCimiDC6rJsq/SD2icrdGyz 0PXdvo0f0QOnpvcDAw4MqKaVf5b3BFF1koSCKLjM86rXWQIAjMQ39AVXAJOUnJ/jc2 fhc0Wak/M6ulHFx6RuV4H1LmgYcbp+41wegytesk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Roland Scheidegger , Sasha Levin Subject: [PATCH 4.4 142/149] drm/vmwgfx: Fix two list_for_each loop exit tests Date: Thu, 20 Aug 2020 11:23:39 +0200 Message-Id: <20200820092132.573386609@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dan Carpenter [ Upstream commit 4437c1152ce0e57ab8f401aa696ea6291cc07ab1 ] These if statements are supposed to be true if we ended the list_for_each_entry() loops without hitting a break statement but they don't work. In the first loop, we increment "i" after the "if (i == unit)" condition so we don't necessarily know that "i" is not equal to unit at the end of the loop. In the second loop we exit when mode is not pointing to a valid drm_display_mode struct so it doesn't make sense to check "mode->type". Fixes: a278724aa23c ("drm/vmwgfx: Implement fbdev on kms v2") Signed-off-by: Dan Carpenter Reviewed-by: Roland Scheidegger Signed-off-by: Roland Scheidegger Signed-off-by: Sasha Levin --- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c index 9b97f70fbb3df..0b7427d474feb 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c @@ -2086,7 +2086,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, ++i; } - if (i != unit) { + if (&con->head == &dev_priv->dev->mode_config.connector_list) { DRM_ERROR("Could not find initial display unit.\n"); return -EINVAL; } @@ -2108,13 +2108,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, break; } - if (mode->type & DRM_MODE_TYPE_PREFERRED) - *p_mode = mode; - else { + if (&mode->head == &con->modes) { WARN_ONCE(true, "Could not find initial preferred mode.\n"); *p_mode = list_first_entry(&con->modes, struct drm_display_mode, head); + } else { + *p_mode = mode; } return 0; From patchwork Thu Aug 20 09:23:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265686 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09650C433E1 for ; Thu, 20 Aug 2020 10:26:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C8A6D20738 for ; Thu, 20 Aug 2020 10:26:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919168; bh=Q437UooYHqyuMB4DoGJE8zfj50ppfsPBzBkZQm11MSQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Xp5EFWezdk2vRde28kG46d7ME/hfQU+FV0c+2rjnCjcXMIOXcc1wSWMuAtsduatpF oSvjpfuYzlZ3AdIW/D1LVrS2QQ4wRg6frG58MMOiZs3fdDn6bZUxIsQw+P/bItiyaD 466X4NFEJWoxgb7pMC5Pm/ILABqoaOrowgQfv7R0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729999AbgHTK0F (ORCPT ); Thu, 20 Aug 2020 06:26:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:51912 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729943AbgHTKXL (ORCPT ); Thu, 20 Aug 2020 06:23:11 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 812392078D; Thu, 20 Aug 2020 10:23:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918991; bh=Q437UooYHqyuMB4DoGJE8zfj50ppfsPBzBkZQm11MSQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yVbonfzJCS0CQiVD9QDqEPsBzjc86TQSRYGLP8C5cnYbJXMheAT1YV9ndY91cHaf9 RqTvYbA9xU3yHezMxGIqYbzEOSQ70gcD/3E8WGjLMkd6fVgW2z8DRdEw7GCfIH4403 qh9Ek6XPc7i8VSMKnqvz9CPRArDOTJ/YMBArqkWY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Colin Ian King , Andrew Morton , Evgeniy Dushistov , Alexey Dobriyan , Linus Torvalds , Sasha Levin Subject: [PATCH 4.4 144/149] fs/ufs: avoid potential u32 multiplication overflow Date: Thu, 20 Aug 2020 11:23:41 +0200 Message-Id: <20200820092132.670640680@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Colin Ian King [ Upstream commit 88b2e9b06381551b707d980627ad0591191f7a2d ] The 64 bit ino is being compared to the product of two u32 values, however, the multiplication is being performed using a 32 bit multiply so there is a potential of an overflow. To be fully safe, cast uspi->s_ncg to a u64 to ensure a 64 bit multiplication occurs to avoid any chance of overflow. Fixes: f3e2a520f5fb ("ufs: NFS support") Signed-off-by: Colin Ian King Signed-off-by: Andrew Morton Cc: Evgeniy Dushistov Cc: Alexey Dobriyan Link: http://lkml.kernel.org/r/20200715170355.1081713-1-colin.king@canonical.com Addresses-Coverity: ("Unintentional integer overflow") Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- fs/ufs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/ufs/super.c b/fs/ufs/super.c index 10f364490833e..be68b48de1cc6 100644 --- a/fs/ufs/super.c +++ b/fs/ufs/super.c @@ -99,7 +99,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 gene struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi; struct inode *inode; - if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg) + if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg) return ERR_PTR(-ESTALE); inode = ufs_iget(sb, ino); From patchwork Thu Aug 20 09:23:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265687 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2DC8C433E1 for ; Thu, 20 Aug 2020 10:26:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8298B2075E for ; Thu, 20 Aug 2020 10:26:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919163; bh=nMJTkO6cj4TOvD4sJ8BX0pSnppY8qiNUN3ChP8pnEHI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=mWrKiLf7ra74NlmbygiqhohpiDlWOmC6unzwadCMTrm7mpLTbnpB1hUlquCHGEjdW NRgEf5GMk4mZ4q9Rmuj4exh86CvzRIqYjPvjpDMMy/jhTnV2eiugecNiJ7S4oVhb2y 0wANSEYAFJEvrH/L3QfjYaaTLXI3sZhXawKGj918= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731466AbgHTKZ5 (ORCPT ); Thu, 20 Aug 2020 06:25:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:52270 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731703AbgHTKXO (ORCPT ); Thu, 20 Aug 2020 06:23:14 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E72FF20658; Thu, 20 Aug 2020 10:23:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918993; bh=nMJTkO6cj4TOvD4sJ8BX0pSnppY8qiNUN3ChP8pnEHI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EsUaY7NJF5K03NTD8oNatrHDByu8MWygQnxJnq1RA+lAdiu93ptuNGfqAZnUur8pX ve+yYe0JeBvbVZFrkuBmpWjpiTXZamjilC2CTPi80YgPdwhPeXE/brFr9wP+Rs4+do aoEd1eUQs0JlhyZVylKv38pRyhVsq/r6jSX+sR5A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Shevchenko , Lee Jones , Sasha Levin Subject: [PATCH 4.4 145/149] mfd: dln2: Run event handler loop under spinlock Date: Thu, 20 Aug 2020 11:23:42 +0200 Message-Id: <20200820092132.719012294@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Andy Shevchenko [ Upstream commit 3d858942250820b9adc35f963a257481d6d4c81d ] The event handler loop must be run with interrupts disabled. Otherwise we will have a warning: [ 1970.785649] irq 31 handler lineevent_irq_handler+0x0/0x20 enabled interrupts [ 1970.792739] WARNING: CPU: 0 PID: 0 at kernel/irq/handle.c:159 __handle_irq_event_percpu+0x162/0x170 [ 1970.860732] RIP: 0010:__handle_irq_event_percpu+0x162/0x170 ... [ 1970.946994] Call Trace: [ 1970.949446] [ 1970.951471] handle_irq_event_percpu+0x2c/0x80 [ 1970.955921] handle_irq_event+0x23/0x43 [ 1970.959766] handle_simple_irq+0x57/0x70 [ 1970.963695] generic_handle_irq+0x42/0x50 [ 1970.967717] dln2_rx+0xc1/0x210 [dln2] [ 1970.971479] ? usb_hcd_unmap_urb_for_dma+0xa6/0x1c0 [ 1970.976362] __usb_hcd_giveback_urb+0x77/0xe0 [ 1970.980727] usb_giveback_urb_bh+0x8e/0xe0 [ 1970.984837] tasklet_action_common.isra.0+0x4a/0xe0 ... Recently xHCI driver switched to tasklets in the commit 36dc01657b49 ("usb: host: xhci: Support running urb giveback in tasklet context"). The handle_irq_event_* functions are expected to be called with interrupts disabled and they rightfully complain here because we run in tasklet context with interrupts enabled. Use a event spinlock to protect event handler from being interrupted. Note, that there are only two users of this GPIO and ADC drivers and both of them are using generic_handle_irq() which makes above happen. Fixes: 338a12814297 ("mfd: Add support for Diolan DLN-2 devices") Signed-off-by: Andy Shevchenko Signed-off-by: Lee Jones Signed-off-by: Sasha Levin --- drivers/mfd/dln2.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c index 672831d5ee32e..97a69cd6f1278 100644 --- a/drivers/mfd/dln2.c +++ b/drivers/mfd/dln2.c @@ -294,7 +294,11 @@ static void dln2_rx(struct urb *urb) len = urb->actual_length - sizeof(struct dln2_header); if (handle == DLN2_HANDLE_EVENT) { + unsigned long flags; + + spin_lock_irqsave(&dln2->event_cb_lock, flags); dln2_run_event_callbacks(dln2, id, echo, data, len); + spin_unlock_irqrestore(&dln2->event_cb_lock, flags); } else { /* URB will be re-submitted in _dln2_transfer (free_rx_slot) */ if (dln2_transfer_complete(dln2, urb, handle, echo)) From patchwork Thu Aug 20 09:23:44 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265693 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F2F6C433E1 for ; Thu, 20 Aug 2020 10:23:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D11EF22B43 for ; Thu, 20 Aug 2020 10:23:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919001; bh=Mlre0NfdZn5TVHGLM/JcqLK5nl+zozSKCg2mXww6fb8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=h4dcQ1dUSAV/RhvuFY4grrnZvX7zNfD1QgGo6NEdHPzp8Jeeo7avMf7jv9XihW7RT GDgS6nq6CxzcgA8dBN9lFg+FuWrY/wAtwdR++se7fnZV8EZZ/BHTCSV06+K8OfdXYk xWiLMU1rAXDsgvJYuI9nJL49WmYzh7GnduFt/biU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731737AbgHTKXV (ORCPT ); Thu, 20 Aug 2020 06:23:21 -0400 Received: from mail.kernel.org ([198.145.29.99]:52482 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730535AbgHTKXT (ORCPT ); Thu, 20 Aug 2020 06:23:19 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7464A20658; Thu, 20 Aug 2020 10:23:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597918997; bh=Mlre0NfdZn5TVHGLM/JcqLK5nl+zozSKCg2mXww6fb8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Tm3H42sWctg2E8VKcs45DkIIeYKHG1AoooMKVq042kANfPtzldsJhTBQd/5lG3ZBO jISowNeewz6LrAR+iH1T4gwqp8hE9L3PRu7uG8oUqWJSQbnRvl0iYgBZzya5I1BDEK MoMrhunJQ3wXG5iC2mqcavvbDSI4kdCcQ38fbJ9U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Geert Uytterhoeven , Rich Felker , Sasha Levin Subject: [PATCH 4.4 147/149] sh: landisk: Add missing initialization of sh_io_port_base Date: Thu, 20 Aug 2020 11:23:44 +0200 Message-Id: <20200820092132.812251168@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Geert Uytterhoeven [ Upstream commit 0c64a0dce51faa9c706fdf1f957d6f19878f4b81 ] The Landisk setup code maps the CF IDE area using ioremap_prot(), and passes the resulting virtual addresses to the pata_platform driver, disguising them as I/O port addresses. Hence the pata_platform driver translates them again using ioport_map(). As CONFIG_GENERIC_IOMAP=n, and CONFIG_HAS_IOPORT_MAP=y, the SuperH-specific mapping code in arch/sh/kernel/ioport.c translates I/O port addresses to virtual addresses by adding sh_io_port_base, which defaults to -1, thus breaking the assumption of an identity mapping. Fix this by setting sh_io_port_base to zero. Fixes: 37b7a97884ba64bf ("sh: machvec IO death.") Signed-off-by: Geert Uytterhoeven Signed-off-by: Rich Felker Signed-off-by: Sasha Levin --- arch/sh/boards/mach-landisk/setup.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/sh/boards/mach-landisk/setup.c b/arch/sh/boards/mach-landisk/setup.c index f1147caebacf0..af69fb7fef7c7 100644 --- a/arch/sh/boards/mach-landisk/setup.c +++ b/arch/sh/boards/mach-landisk/setup.c @@ -85,6 +85,9 @@ device_initcall(landisk_devices_setup); static void __init landisk_setup(char **cmdline_p) { + /* I/O port identity mapping */ + __set_io_port_base(0); + /* LED ON */ __raw_writeb(__raw_readb(PA_LED) | 0x03, PA_LED); From patchwork Thu Aug 20 09:23:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265688 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, UNWANTED_LANGUAGE_BODY, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DE8E6C433DF for ; Thu, 20 Aug 2020 10:24:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B122420658 for ; Thu, 20 Aug 2020 10:24:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919077; bh=k640J9cqOEVPJ1orsTEWIBrNMF4F3K4Xs6YwxMvaSG8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=LUSB62p2DdSVc9w+EqViyXTWomKKD+luFc8LJsaPOyXZXEvQeeSz0Ev1tGJ0IK9OH 2apYYjS6+gYgn8m9Q/YDSJnwhMm7stIvtDomFIW0toWfGK6ftXaIQ82nb2+8sLPl4Y InvOW/cCVxDF3AZOTGVrfAZtQeuyvcl8sSDJP3q8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731771AbgHTKYg (ORCPT ); Thu, 20 Aug 2020 06:24:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:52612 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731486AbgHTKXU (ORCPT ); Thu, 20 Aug 2020 06:23:20 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B070F20738; Thu, 20 Aug 2020 10:23:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919000; bh=k640J9cqOEVPJ1orsTEWIBrNMF4F3K4Xs6YwxMvaSG8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bsXpnlolmMp0//sImXd6UVql5O+VnUZCwCtsVMxarmOPeRhRPvPscmIvUqHjR3tEo vEwC3wRyvX4PRQJ8HgLGrCTuaDws4UUg/IFxoxhaYupuuD+B2jYxN3TcTzGOHF7ZiV ODHzUvLLa4M5icy9LYOfejiFXOTzJJSdNl8//bg4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Denis Efremov , Alex Deucher Subject: [PATCH 4.4 148/149] drm/radeon: fix fb_div check in ni_init_smc_spll_table() Date: Thu, 20 Aug 2020 11:23:45 +0200 Message-Id: <20200820092132.860036377@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Denis Efremov commit f29aa08852e1953e461f2d47ab13c34e14bc08b3 upstream. clk_s is checked twice in a row in ni_init_smc_spll_table(). fb_div should be checked instead. Fixes: 69e0b57a91ad ("drm/radeon/kms: add dpm support for cayman (v5)") Cc: stable@vger.kernel.org Signed-off-by: Denis Efremov Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/radeon/ni_dpm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/radeon/ni_dpm.c +++ b/drivers/gpu/drm/radeon/ni_dpm.c @@ -2125,7 +2125,7 @@ static int ni_init_smc_spll_table(struct if (p_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_PDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_PDIV_SHIFT)) ret = -EINVAL; - if (clk_s & ~(SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_CLKS_SHIFT)) + if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT)) ret = -EINVAL; if (fb_div & ~(SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_MASK >> SMC_NISLANDS_SPLL_DIV_TABLE_FBDIV_SHIFT)) From patchwork Thu Aug 20 09:23:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 265692 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B31C3C433DF for ; Thu, 20 Aug 2020 10:23:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 93EB420738 for ; Thu, 20 Aug 2020 10:23:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919014; bh=pLmtuxM2gLsgL9D/mBLQ9ugUl0WP6V1Qc0XaJ/eY1Ek=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Zrj7+QrUueoH8d/whRY6CEZsLFgCmIaTsziXMMpKnK4zm5cb3ot8SJIY5ewGM1vza jRY280dnuE0XRv8Qhybc71w6OjymfTWLCX4KYE24p6CfEX8FBFu3LnePeFDWb7TdbN td+Fz6FUEHXqD1f0ImZUAY1+HmYVfzRnRVbhhHNQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731753AbgHTKXd (ORCPT ); Thu, 20 Aug 2020 06:23:33 -0400 Received: from mail.kernel.org ([198.145.29.99]:52764 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731742AbgHTKXX (ORCPT ); Thu, 20 Aug 2020 06:23:23 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EEADA20658; Thu, 20 Aug 2020 10:23:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1597919002; bh=pLmtuxM2gLsgL9D/mBLQ9ugUl0WP6V1Qc0XaJ/eY1Ek=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RvbUMv6KqL7HqiePIdWOJtxkwdkypzdecfgaWpQ2gP0j60AZGEboDTPWkrecPB1qu j7rqz2Ps8IpeQ6WFldDyClgAHusR2CtXXQVB4q2GxaNZxCXhg+2XpF8eGytyseKoi7 X1Nw3vu+tyOfyuoP+BBJ+17SPzWSOUxj/tfh9VL8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrey Konovalov , Steffen Klassert , Cong Wang , "David S. Miller" , Alessio Balsini Subject: [PATCH 4.4 149/149] ipv6: check skb->protocol before lookup for nexthop Date: Thu, 20 Aug 2020 11:23:46 +0200 Message-Id: <20200820092132.902693609@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200820092125.688850368@linuxfoundation.org> References: <20200820092125.688850368@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: WANG Cong commit 199ab00f3cdb6f154ea93fa76fd80192861a821d upstream. Andrey reported a out-of-bound access in ip6_tnl_xmit(), this is because we use an ipv4 dst in ip6_tnl_xmit() and cast an IPv4 neigh key as an IPv6 address: neigh = dst_neigh_lookup(skb_dst(skb), &ipv6_hdr(skb)->daddr); if (!neigh) goto tx_err_link_failure; addr6 = (struct in6_addr *)&neigh->primary_key; // <=== HERE addr_type = ipv6_addr_type(addr6); if (addr_type == IPV6_ADDR_ANY) addr6 = &ipv6_hdr(skb)->daddr; memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); Also the network header of the skb at this point should be still IPv4 for 4in6 tunnels, we shold not just use it as IPv6 header. This patch fixes it by checking if skb->protocol is ETH_P_IPV6: if it is, we are safe to do the nexthop lookup using skb_dst() and ipv6_hdr(skb)->daddr; if not (aka IPv4), we have no clue about which dest address we can pick here, we have to rely on callers to fill it from tunnel config, so just fall to ip6_route_output() to make the decision. Fixes: ea3dc9601bda ("ip6_tunnel: Add support for wildcard tunnel endpoints.") Reported-by: Andrey Konovalov Tested-by: Andrey Konovalov Cc: Steffen Klassert Signed-off-by: Cong Wang Signed-off-by: David S. Miller Signed-off-by: Alessio Balsini Signed-off-by: Greg Kroah-Hartman --- net/ipv6/ip6_tunnel.c | 42 ++++++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 20 deletions(-) --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -972,26 +972,28 @@ static int ip6_tnl_xmit2(struct sk_buff /* NBMA tunnel */ if (ipv6_addr_any(&t->parms.raddr)) { - struct in6_addr *addr6; - struct neighbour *neigh; - int addr_type; - - if (!skb_dst(skb)) - goto tx_err_link_failure; - - neigh = dst_neigh_lookup(skb_dst(skb), - &ipv6_hdr(skb)->daddr); - if (!neigh) - goto tx_err_link_failure; - - addr6 = (struct in6_addr *)&neigh->primary_key; - addr_type = ipv6_addr_type(addr6); - - if (addr_type == IPV6_ADDR_ANY) - addr6 = &ipv6_hdr(skb)->daddr; - - memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); - neigh_release(neigh); + if (skb->protocol == htons(ETH_P_IPV6)) { + struct in6_addr *addr6; + struct neighbour *neigh; + int addr_type; + + if (!skb_dst(skb)) + goto tx_err_link_failure; + + neigh = dst_neigh_lookup(skb_dst(skb), + &ipv6_hdr(skb)->daddr); + if (!neigh) + goto tx_err_link_failure; + + addr6 = (struct in6_addr *)&neigh->primary_key; + addr_type = ipv6_addr_type(addr6); + + if (addr_type == IPV6_ADDR_ANY) + addr6 = &ipv6_hdr(skb)->daddr; + + memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); + neigh_release(neigh); + } } else if (!fl6->flowi6_mark) dst = dst_cache_get(&t->dst_cache);