From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39379C433FE for ; Mon, 27 Dec 2021 15:27:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231365AbhL0P1T (ORCPT ); Mon, 27 Dec 2021 10:27:19 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:33000 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229766AbhL0P1S (ORCPT ); Mon, 27 Dec 2021 10:27:18 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 528B4B80E5A; Mon, 27 Dec 2021 15:27:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50A40C36AE7; Mon, 27 Dec 2021 15:27:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618835; bh=g+mYXq11j25ES1bHtzki/5/VL4JW5Or8P1GOPjw/bdg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SmuVvJ1dCZXFZ1B6SBHO+Jzcen1k/m4SoNMIuEPHhx+Ku81RoVlkfpogX/L9eY66P T8yLZsFLA3zbQ8AzdqgZevyXSgAIR5SKXLLV8yLMSxl+9vCSPMCU/+YZsDTR3ZUNZb pRyFetPR+DpaRCooR7D5hzcq8Wp92zdwfpNRAqEc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Greg Jesionowski , Jakub Kicinski Subject: [PATCH 4.4 01/17] net: usb: lan78xx: add Allied Telesis AT29M2-AF Date: Mon, 27 Dec 2021 16:26:56 +0100 Message-Id: <20211227151316.011845986@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Greg Jesionowski commit ef8a0f6eab1ca5d1a75c242c5c7b9d386735fa0a upstream. This adds the vendor and product IDs for the AT29M2-AF which is a lan7801-based device. Signed-off-by: Greg Jesionowski Link: https://lore.kernel.org/r/20211214221027.305784-1-jesionowskigreg@gma= il.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/usb/lan78xx.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/net/usb/lan78xx.c +++ b/drivers/net/usb/lan78xx.c @@ -66,6 +66,8 @@ #define LAN7850_USB_PRODUCT_ID (0x7850) #define LAN78XX_EEPROM_MAGIC (0x78A5) #define LAN78XX_OTP_MAGIC (0x78F3) +#define AT29M2AF_USB_VENDOR_ID (0x07C9) +#define AT29M2AF_USB_PRODUCT_ID (0x0012) =20 #define MII_READ 1 #define MII_WRITE 0 @@ -3334,6 +3336,10 @@ static const struct usb_device_id produc /* LAN7850 USB Gigabit Ethernet Device */ USB_DEVICE(LAN78XX_USB_VENDOR_ID, LAN7850_USB_PRODUCT_ID), }, + { + /* ATM2-AF USB Gigabit Ethernet Device */ + USB_DEVICE(AT29M2AF_USB_VENDOR_ID, AT29M2AF_USB_PRODUCT_ID), + }, {}, }; MODULE_DEVICE_TABLE(usb, products); From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03F94C433F5 for ; Mon, 27 Dec 2021 15:28:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237421AbhL0P17 (ORCPT ); Mon, 27 Dec 2021 10:27:59 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:33322 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237430AbhL0P1s (ORCPT ); Mon, 27 Dec 2021 10:27:48 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A519AB810C6; Mon, 27 Dec 2021 15:27:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ED8EFC36AE7; Mon, 27 Dec 2021 15:27:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618866; bh=46G8+zgxD0jlr1KeHOqfzGbXsWRpUgiY26Gk7jkVp9Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ze4F7/01HtCJu2RozL/fSpGTfjgs8zBKICFiSvF9JsjlbBWDTjlfzLDwQz8PFP+iP hPYq0TGPAqyqsK7W8ml9Jjp60RWpcWpaS/3haKlCqtKH9CzACV3XEdZdndjT12MSqb 4HyqQdm3LVppd5YqiLLymiBmFAmAomqWwYtnEzlc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jimmy Assarsson , Marc Kleine-Budde Subject: [PATCH 4.4 02/17] can: kvaser_usb: get CAN clock frequency from device Date: Mon, 27 Dec 2021 16:26:57 +0100 Message-Id: <20211227151316.042083723@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jimmy Assarsson commit fb12797ab1fef480ad8a32a30984844444eeb00d upstream. The CAN clock frequency is used when calculating the CAN bittiming parameters. When wrong clock frequency is used, the device may end up with wrong bittiming parameters, depending on user requested bittiming parameters. To avoid this, get the CAN clock frequency from the device. Various existing Kvaser Leaf products use different CAN clocks. Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devic= es") Link: https://lore.kernel.org/all/20211208152122.250852-2-extja@kvaser.com Cc: stable@vger.kernel.org Signed-off-by: Jimmy Assarsson Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/can/usb/kvaser_usb.c | 41 ++++++++++++++++++++++++++++++++++= ----- 1 file changed, 36 insertions(+), 5 deletions(-) --- a/drivers/net/can/usb/kvaser_usb.c +++ b/drivers/net/can/usb/kvaser_usb.c @@ -31,7 +31,10 @@ #define USB_SEND_TIMEOUT 1000 /* msecs */ #define USB_RECV_TIMEOUT 1000 /* msecs */ #define RX_BUFFER_SIZE 3072 -#define CAN_USB_CLOCK 8000000 +#define KVASER_USB_CAN_CLOCK_8MHZ 8000000 +#define KVASER_USB_CAN_CLOCK_16MHZ 16000000 +#define KVASER_USB_CAN_CLOCK_24MHZ 24000000 +#define KVASER_USB_CAN_CLOCK_32MHZ 32000000 #define MAX_NET_DEVICES 3 #define MAX_USBCAN_NET_DEVICES 2 =20 @@ -139,6 +142,12 @@ static inline bool kvaser_is_usbcan(cons #define CMD_LEAF_USB_THROTTLE 77 #define CMD_LEAF_LOG_MESSAGE 106 =20 +/* Leaf frequency options */ +#define KVASER_USB_LEAF_SWOPTION_FREQ_MASK 0x60 +#define KVASER_USB_LEAF_SWOPTION_FREQ_16_MHZ_CLK 0 +#define KVASER_USB_LEAF_SWOPTION_FREQ_32_MHZ_CLK BIT(5) +#define KVASER_USB_LEAF_SWOPTION_FREQ_24_MHZ_CLK BIT(6) + /* error factors */ #define M16C_EF_ACKE BIT(0) #define M16C_EF_CRCE BIT(1) @@ -469,6 +478,8 @@ struct kvaser_usb { bool rxinitdone; void *rxbuf[MAX_RX_URBS]; dma_addr_t rxbuf_dma[MAX_RX_URBS]; + + struct can_clock clock; }; =20 struct kvaser_usb_net_priv { @@ -646,6 +657,27 @@ static int kvaser_usb_send_simple_msg(co return rc; } =20 +static void kvaser_usb_get_software_info_leaf(struct kvaser_usb *dev, + const struct leaf_msg_softinfo *softinfo) +{ + u32 sw_options =3D le32_to_cpu(softinfo->sw_options); + + dev->fw_version =3D le32_to_cpu(softinfo->fw_version); + dev->max_tx_urbs =3D le16_to_cpu(softinfo->max_outstanding_tx); + + switch (sw_options & KVASER_USB_LEAF_SWOPTION_FREQ_MASK) { + case KVASER_USB_LEAF_SWOPTION_FREQ_16_MHZ_CLK: + dev->clock.freq =3D KVASER_USB_CAN_CLOCK_16MHZ; + break; + case KVASER_USB_LEAF_SWOPTION_FREQ_24_MHZ_CLK: + dev->clock.freq =3D KVASER_USB_CAN_CLOCK_24MHZ; + break; + case KVASER_USB_LEAF_SWOPTION_FREQ_32_MHZ_CLK: + dev->clock.freq =3D KVASER_USB_CAN_CLOCK_32MHZ; + break; + } +} + static int kvaser_usb_get_software_info(struct kvaser_usb *dev) { struct kvaser_msg msg; @@ -661,14 +693,13 @@ static int kvaser_usb_get_software_info( =20 switch (dev->family) { case KVASER_LEAF: - dev->fw_version =3D le32_to_cpu(msg.u.leaf.softinfo.fw_version); - dev->max_tx_urbs =3D - le16_to_cpu(msg.u.leaf.softinfo.max_outstanding_tx); + kvaser_usb_get_software_info_leaf(dev, &msg.u.leaf.softinfo); break; case KVASER_USBCAN: dev->fw_version =3D le32_to_cpu(msg.u.usbcan.softinfo.fw_version); dev->max_tx_urbs =3D le16_to_cpu(msg.u.usbcan.softinfo.max_outstanding_tx); + dev->clock.freq =3D KVASER_USB_CAN_CLOCK_8MHZ; break; } =20 @@ -1925,7 +1956,7 @@ static int kvaser_usb_init_one(struct us kvaser_usb_reset_tx_urb_contexts(priv); =20 priv->can.state =3D CAN_STATE_STOPPED; - priv->can.clock.freq =3D CAN_USB_CLOCK; + priv->can.clock.freq =3D dev->clock.freq; priv->can.bittiming_const =3D &kvaser_usb_bittiming_const; priv->can.do_set_bittiming =3D kvaser_usb_set_bittiming; priv->can.do_set_mode =3D kvaser_usb_set_mode; From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A9607C433F5 for ; Mon, 27 Dec 2021 15:28:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237509AbhL0P2H (ORCPT ); Mon, 27 Dec 2021 10:28:07 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:33360 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237419AbhL0P1v (ORCPT ); Mon, 27 Dec 2021 10:27:51 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7207BB810A3; Mon, 27 Dec 2021 15:27:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BB2C3C36AE7; Mon, 27 Dec 2021 15:27:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618869; bh=zQ8vvOoixBGGLwwy+ukLE3ZLYdW2CEhpCp6iJpG+xGk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EJqEjhh3cYGzruP8W8ceScH522p8AH9tRskiq4CiB6TpOCwmsM/EvAugAv/0kZqkD 2BQTJ5OWCYU4w5MpWk9tFCQ0AMCWcjJ5BYdu7lT5XBm5+scE4r3obVDpKU/xc5dhAP jVyviTdHiFgJRHuBdOiJbrxPAlPH6xDogccAghBQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Benjamin Tissoires Subject: [PATCH 4.4 03/17] HID: holtek: fix mouse probing Date: Mon, 27 Dec 2021 16:26:58 +0100 Message-Id: <20211227151316.074347706@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Benjamin Tissoires commit 93a2207c254ca102ebbdae47b00f19bbfbfa7ecd upstream. An overlook from the previous commit: we don't even parse or start the device, meaning that the device is not presented to user space. Fixes: 93020953d0fa ("HID: check for valid USB device for many HID drivers") Cc: stable@vger.kernel.org Link: https://bugs.archlinux.org/task/73048 Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D215341 Link: https://lore.kernel.org/r/e4efbf13-bd8d-0370-629b-6c80c0044b15@leemhu= is.info/ Signed-off-by: Benjamin Tissoires Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/hid/hid-holtek-mouse.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) --- a/drivers/hid/hid-holtek-mouse.c +++ b/drivers/hid/hid-holtek-mouse.c @@ -68,8 +68,23 @@ static __u8 *holtek_mouse_report_fixup(s static int holtek_mouse_probe(struct hid_device *hdev, const struct hid_device_id *id) { + int ret; + if (!hid_is_usb(hdev)) return -EINVAL; + + ret =3D hid_parse(hdev); + if (ret) { + hid_err(hdev, "hid parse failed: %d\n", ret); + return ret; + } + + ret =3D hid_hw_start(hdev, HID_CONNECT_DEFAULT); + if (ret) { + hid_err(hdev, "hw start failed: %d\n", ret); + return ret; + } + return 0; } =20 From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76E11C433FE for ; Mon, 27 Dec 2021 15:28:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234022AbhL0P2F (ORCPT ); Mon, 27 Dec 2021 10:28:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34156 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237448AbhL0P1x (ORCPT ); Mon, 27 Dec 2021 10:27:53 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 185A7C06175A; Mon, 27 Dec 2021 07:27:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AC1CA610AB; Mon, 27 Dec 2021 15:27:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91B0CC36AED; Mon, 27 Dec 2021 15:27:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618872; bh=ix8imNCcD1Wunb0dhYB2I7HHFk4LgeZ2sejso5qcCoc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DivYT146q/NRfQkWdpzcViiyLHlznemzWwa8r1wpbVXCIOwCeIKSssYivTnwwrXNP k5iO0tpu0OShK5dKqQ4esc1s3fu68sf6vqsgsrEq6thkESuwbK67hgpXDj1lwt1U6S 4tgJVkAvdOC8824foH4y8uXNJymJAc3oVcE8tQTw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= , Mike Marciniszyn , Jason Gunthorpe , Sasha Levin Subject: [PATCH 4.4 04/17] IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() Date: Mon, 27 Dec 2021 16:26:59 +0100 Message-Id: <20211227151316.105228906@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jos=C3=A9 Exp=C3=B3sito [ Upstream commit bee90911e0138c76ee67458ac0d58b38a3190f65 ] The wrong goto label was used for the error case and missed cleanup of the pkt allocation. Fixes: d39bf40e55e6 ("IB/qib: Protect from buffer overflow in struct qib_us= er_sdma_pkt fields") Link: https://lore.kernel.org/r/20211208175238.29983-1-jose.exposito89@gmai= l.com Addresses-Coverity-ID: 1493352 ("Resource leak") Signed-off-by: Jos=C3=A9 Exp=C3=B3sito Acked-by: Mike Marciniszyn Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/infiniband/hw/qib/qib_user_sdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband= /hw/qib/qib_user_sdma.c index 0dc15f95e7626..2d0b992579d6f 100644 --- a/drivers/infiniband/hw/qib/qib_user_sdma.c +++ b/drivers/infiniband/hw/qib/qib_user_sdma.c @@ -946,7 +946,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_de= vdata *dd, &addrlimit) || addrlimit > type_max(typeof(pkt->addrlimit))) { ret =3D -EINVAL; - goto free_pbc; + goto free_pkt; } pkt->addrlimit =3D addrlimit; =20 --=20 2.34.1 From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D225C433EF for ; Mon, 27 Dec 2021 15:28:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237393AbhL0P2J (ORCPT ); Mon, 27 Dec 2021 10:28:09 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:33430 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237466AbhL0P15 (ORCPT ); Mon, 27 Dec 2021 10:27:57 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2DDA6B810B9; Mon, 27 Dec 2021 15:27:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 60F21C36AEA; Mon, 27 Dec 2021 15:27:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618875; bh=NyeSG5tkne6j0YV86AG73j25lKYHz9GCKymuBln7Plg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tPfylEtUk3xBbEAkIV4JIMcvLMinTK6JrAwxvkK1GpmL3JX1cuQoWmY1kuiSo/rnF UJtJNp0c9nMlLGeNbg3Te2rUrRi34/3UBK0BP88VnB3sm1CCNheiD+QvxLcshev96o mTsx7VEEU33kUhuGnMUBbZscvVW+U4LlS7TDtr9E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 05/17] qlcnic: potential dereference null pointer of rx_queue->page_ring Date: Mon, 27 Dec 2021 16:27:00 +0100 Message-Id: <20211227151316.137168583@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 60ec7fcfe76892a1479afab51ff17a4281923156 ] The return value of kcalloc() needs to be checked. To avoid dereference of null pointer in case of the failure of alloc. Therefore, it might be better to change the return type of qlcnic_sriov_alloc_vlans() and return -ENOMEM when alloc fails and return 0 the others. Also, qlcnic_sriov_set_guest_vlan_mode() and __qlcnic_pci_sriov_enable() should deal with the return value of qlcnic_sriov_alloc_vlans(). Fixes: 154d0c810c53 ("qlcnic: VLAN enhancement for 84XX adapters") Signed-off-by: Jiasheng Jiang Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h | 2 +- .../net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 12 +++++++++--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c | 4 +++- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/ne= t/ethernet/qlogic/qlcnic/qlcnic_sriov.h index 017d8c2c8285a..aab2db76d9edc 100644 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h @@ -201,7 +201,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapte= r *, struct qlcnic_info *, u16); int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *, u16, u8); void qlcnic_sriov_free_vlans(struct qlcnic_adapter *); -void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *); +int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *); bool qlcnic_sriov_check_any_vlan(struct qlcnic_vf_info *); void qlcnic_sriov_del_vlan_id(struct qlcnic_sriov *, struct qlcnic_vf_info *, u16); diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/dri= vers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c index ffa6885acfc8f..03e24fcf87a8e 100644 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c @@ -427,7 +427,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcn= ic_adapter *adapter, struct qlcnic_cmd_args *cmd) { struct qlcnic_sriov *sriov =3D adapter->ahw->sriov; - int i, num_vlans; + int i, num_vlans, ret; u16 *vlans; =20 if (sriov->allowed_vlans) @@ -438,7 +438,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcn= ic_adapter *adapter, dev_info(&adapter->pdev->dev, "Number of allowed Guest VLANs =3D %d\n", sriov->num_allowed_vlans); =20 - qlcnic_sriov_alloc_vlans(adapter); + ret =3D qlcnic_sriov_alloc_vlans(adapter); + if (ret) + return ret; =20 if (!sriov->any_vlan) return 0; @@ -2147,7 +2149,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapt= er *adapter) return err; } =20 -void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) +int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) { struct qlcnic_sriov *sriov =3D adapter->ahw->sriov; struct qlcnic_vf_info *vf; @@ -2157,7 +2159,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter = *adapter) vf =3D &sriov->vf_info[i]; vf->sriov_vlans =3D kcalloc(sriov->num_allowed_vlans, sizeof(*vf->sriov_vlans), GFP_KERNEL); + if (!vf->sriov_vlans) + return -ENOMEM; } + + return 0; } =20 void qlcnic_sriov_free_vlans(struct qlcnic_adapter *adapter) diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers= /net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c index afd687e5e7790..238a0e58342fa 100644 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c @@ -598,7 +598,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adap= ter *adapter, if (err) goto del_flr_queue; =20 - qlcnic_sriov_alloc_vlans(adapter); + err =3D qlcnic_sriov_alloc_vlans(adapter); + if (err) + goto del_flr_queue; =20 return err; =20 --=20 2.34.1 From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D898CC433EF for ; Mon, 27 Dec 2021 15:28:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237553AbhL0P2S (ORCPT ); Mon, 27 Dec 2021 10:28:18 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:33448 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237409AbhL0P2A (ORCPT ); Mon, 27 Dec 2021 10:28:00 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 24EA9B810C6; Mon, 27 Dec 2021 15:27:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6A2E8C36AEA; Mon, 27 Dec 2021 15:27:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618878; bh=8UMRyUA6ttWAqpCUWPPK75Wdkxi/bJHKjseXvGNSKH8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PtQ5/OzIC7cnz0CQ4r60umTeF2LjZVVivEq2JWjhHWZZcW4uzDKHvI4xlBn+XTWmH bbNtH0dR3MiI6ZHvXofscgNomfDAGfFFzew5boJtX8rM/yvQAxv1UdJ/fYujRPaKN2 gyilINYNniIx/sn8B7e5ixao1HxJhv4ybcPh1z6g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Fernando Fernandez Mancera , Jay Vosburgh , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.4 06/17] bonding: fix ad_actor_system option setting to default Date: Mon, 27 Dec 2021 16:27:01 +0100 Message-Id: <20211227151316.166037116@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Fernando Fernandez Mancera [ Upstream commit 1c15b05baea71a5ff98235783e3e4ad227760876 ] When 802.3ad bond mode is configured the ad_actor_system option is set to "00:00:00:00:00:00". But when trying to set the all-zeroes MAC as actors' system address it was failing with EINVAL. An all-zeroes ethernet address is valid, only multicast addresses are not valid values. Fixes: 171a42c38c6e ("bonding: add netlink support for sys prio, actor sys = mac, and port key") Signed-off-by: Fernando Fernandez Mancera Acked-by: Jay Vosburgh Link: https://lore.kernel.org/r/20211221111345.2462-1-ffmancera@riseup.net Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- Documentation/networking/bonding.txt | 11 ++++++----- drivers/net/bonding/bond_options.c | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/Documentation/networking/bonding.txt b/Documentation/networkin= g/bonding.txt index 334b49ef02d13..5a6e70483cedf 100644 --- a/Documentation/networking/bonding.txt +++ b/Documentation/networking/bonding.txt @@ -191,11 +191,12 @@ ad_actor_sys_prio ad_actor_system =20 In an AD system, this specifies the mac-address for the actor in - protocol packet exchanges (LACPDUs). The value cannot be NULL or - multicast. It is preferred to have the local-admin bit set for this - mac but driver does not enforce it. If the value is not given then - system defaults to using the masters' mac address as actors' system - address. + protocol packet exchanges (LACPDUs). The value cannot be a multicast + address. If the all-zeroes MAC is specified, bonding will internally + use the MAC of the bond itself. It is preferred to have the + local-admin bit set for this mac but driver does not enforce it. If + the value is not given then system defaults to using the masters' + mac address as actors' system address. =20 This parameter has effect only in 802.3ad mode and is available through SysFs interface. diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_= options.c index 1022e80aaf974..1d95a83d2baeb 100644 --- a/drivers/net/bonding/bond_options.c +++ b/drivers/net/bonding/bond_options.c @@ -1407,7 +1407,7 @@ static int bond_option_ad_actor_system_set(struct bon= ding *bond, mac =3D (u8 *)&newval->value; } =20 - if (!is_valid_ether_addr(mac)) + if (is_multicast_ether_addr(mac)) goto err; =20 netdev_info(bond->dev, "Setting ad_actor_system to %pM\n", mac); --=20 2.34.1 From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5A8CC433F5 for ; Mon, 27 Dec 2021 15:28:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237493AbhL0P2X (ORCPT ); Mon, 27 Dec 2021 10:28:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34214 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237488AbhL0P2D (ORCPT ); Mon, 27 Dec 2021 10:28:03 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 49AB3C061763; Mon, 27 Dec 2021 07:28:03 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 07BC0B810C5; Mon, 27 Dec 2021 15:28:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3B2A7C36AE7; Mon, 27 Dec 2021 15:28:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618880; bh=hdeJkat0FxT8WtqRxftLDRJxVjnS3MQEf/hrPFEJfkk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PvyNQBjIXb2nY15O5W66M88O5HB1HaIqp6htf5Y+4o775VxrDCJxTc3tQW+s1YyY3 W4JAVkMBJIZq/jHm/+Ne3swoyZl+2TZjaw3z69dClYEryneQA41UqvQfENmEzSuDwM 3jl68AXuzWDtEh9JrToU/wL8mrE7qHAf4IT66xUA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 07/17] drivers: net: smc911x: Check for error irq Date: Mon, 27 Dec 2021 16:27:02 +0100 Message-Id: <20211227151316.197140352@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit cb93b3e11d405f20a405a07482d01147ef4934a3 ] Because platform_get_irq() could fail and return error irq. Therefore, it might be better to check it if order to avoid the use of error irq. Fixes: ae150435b59e ("smsc: Move the SMC (SMSC) drivers") Signed-off-by: Jiasheng Jiang Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/ethernet/smsc/smc911x.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/sms= c/smc911x.c index 0be9c74238fd4..092267d8a86df 100644 --- a/drivers/net/ethernet/smsc/smc911x.c +++ b/drivers/net/ethernet/smsc/smc911x.c @@ -2057,6 +2057,11 @@ static int smc911x_drv_probe(struct platform_device = *pdev) =20 ndev->dma =3D (unsigned char)-1; ndev->irq =3D platform_get_irq(pdev, 0); + if (ndev->irq < 0) { + ret =3D ndev->irq; + goto release_both; + } + lp =3D netdev_priv(ndev); lp->netdev =3D ndev; #ifdef SMC_DYNAMIC_BUS_CONFIG --=20 2.34.1 From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 982C6C433EF for ; Mon, 27 Dec 2021 15:28:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237438AbhL0P2b (ORCPT ); Mon, 27 Dec 2021 10:28:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34184 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237519AbhL0P2I (ORCPT ); Mon, 27 Dec 2021 10:28:08 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8427CC061785; Mon, 27 Dec 2021 07:28:04 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 24F0D610A6; Mon, 27 Dec 2021 15:28:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09C2CC36AE7; Mon, 27 Dec 2021 15:28:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618883; bh=f45YGFRX5tN5GEBjYjc6+NKbnIxYdfemSHMEgTGcYpI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AYWMHBTh4p4ZZftyx4dXQvYz7Q0FF8Mxtq7U2Mv8FdP6Zdbu2mRqIcVGt4VOFhprw W331aUnJjMftYhWJRJTWQYoMjepGeE8xpRqsszkGdlLwkL5zaix95sKJ0UW8aC1aME 3ioO31BB/MoWx0HhK/RFuUTJbEvNb6SIdFhQQEas= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guenter Roeck , Sasha Levin Subject: [PATCH 4.4 08/17] hwmon: (lm90) Fix usage of CONFIG2 register in detect function Date: Mon, 27 Dec 2021 16:27:03 +0100 Message-Id: <20211227151316.227866654@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Guenter Roeck [ Upstream commit fce15c45d3fbd9fc1feaaf3210d8e3f8b33dfd3a ] The detect function had a comment "Make compiler happy" when id did not read the second configuration register. As it turns out, the code was checking the contents of this register for manufacturer ID 0xA1 (NXP Semiconductor/Philips), but never actually read the register. So it wasn't surprising that the compiler complained, and it indeed had a point. Fix the code to read the register contents for manufacturer ID 0xa1. At the same time, the code was reading the register for manufacturer ID 0x41 (Analog Devices), but it was not using the results. In effect it was just checking if reading the register returned an error. That doesn't really add much if any value, so stop doing that. Fixes: f90be42fb383 ("hwmon: (lm90) Refactor reading of config2 register") Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/hwmon/lm90.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c index c9ff08dbe10ce..420f341272621 100644 --- a/drivers/hwmon/lm90.c +++ b/drivers/hwmon/lm90.c @@ -1209,12 +1209,11 @@ static int lm90_detect(struct i2c_client *client, if (man_id < 0 || chip_id < 0 || config1 < 0 || convrate < 0) return -ENODEV; =20 - if (man_id =3D=3D 0x01 || man_id =3D=3D 0x5C || man_id =3D=3D 0x41) { + if (man_id =3D=3D 0x01 || man_id =3D=3D 0x5C || man_id =3D=3D 0xA1) { config2 =3D i2c_smbus_read_byte_data(client, LM90_REG_R_CONFIG2); if (config2 < 0) return -ENODEV; - } else - config2 =3D 0; /* Make compiler happy */ + } =20 if ((address =3D=3D 0x4C || address =3D=3D 0x4D) && man_id =3D=3D 0x01) { /* National Semiconductor */ --=20 2.34.1 From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7BE09C433F5 for ; Mon, 27 Dec 2021 15:28:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237448AbhL0P20 (ORCPT ); Mon, 27 Dec 2021 10:28:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34186 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237469AbhL0P2J (ORCPT ); Mon, 27 Dec 2021 10:28:09 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D0E0DC06175D; Mon, 27 Dec 2021 07:28:08 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 90E3CB810A2; Mon, 27 Dec 2021 15:28:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D902BC36AE7; Mon, 27 Dec 2021 15:28:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618886; bh=eyAmaDD1JXqATBeZS1M1Z9XqejQePk2SYXuoUol7srg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ph5n+I7abPBL2SKHMOTsAdRdCvxAKFy3S0/hLJyh4V7yfWGjUAFLQfbXMs9FAzhWN HScS4+tbA6g4b3NvotL+q2onJ+k1wEHXoSx6h3nBsRi958WRreoYOT0kcC7/veqHKS LDONrO997tNGTrkqb2mEtJWQ2F9Iml6NR+3XiPfg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiaoke Wang , Takashi Iwai Subject: [PATCH 4.4 09/17] ALSA: jack: Check the return value of kstrdup() Date: Mon, 27 Dec 2021 16:27:04 +0100 Message-Id: <20211227151316.260151757@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiaoke Wang commit c01c1db1dc632edafb0dff32d40daf4f9c1a4e19 upstream. kstrdup() can return NULL, it is better to check the return value of it. Signed-off-by: Xiaoke Wang Cc: Link: https://lore.kernel.org/r/tencent_094816F3522E0DC704056C789352EBBF060= 6@qq.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- sound/core/jack.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -227,6 +227,10 @@ int snd_jack_new(struct snd_card *card, return -ENOMEM; =20 jack->id =3D kstrdup(id, GFP_KERNEL); + if (jack->id =3D=3D NULL) { + kfree(jack); + return -ENOMEM; + } =20 /* don't creat input device for phantom jack */ if (!phantom_jack) { From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9E1E0C433FE for ; Mon, 27 Dec 2021 15:27:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237339AbhL0P11 (ORCPT ); Mon, 27 Dec 2021 10:27:27 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:58370 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229766AbhL0P1Y (ORCPT ); Mon, 27 Dec 2021 10:27:24 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 69F7A610A6; Mon, 27 Dec 2021 15:27:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4716FC36AEA; Mon, 27 Dec 2021 15:27:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618843; bh=8NcTJMBUM/PsY5EIjirWHljvPxiDrnTC/nH+pvVWWS0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uthGl2Lqe1iGROJO5xA6mGVVJL0Fli1S793CdwqssTBLaZ5VdLP4YJddq8W2I+adb vIZW/XAoEkhH72FU3EMrHUGvo6h/DWwRNQDeBr1YCyFlBA+ZhJ9Cs+ucb5KwmR3n5X 4E3HV4yGkRlpy13MORPCg0XTWWtZg/UsRogyE3/M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Colin Ian King , Takashi Iwai Subject: [PATCH 4.4 10/17] ALSA: drivers: opl3: Fix incorrect use of vp->state Date: Mon, 27 Dec 2021 16:27:05 +0100 Message-Id: <20211227151316.289841320@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Colin Ian King commit 2dee54b289fbc810669a1b2b8a0887fa1c9a14d7 upstream. Static analysis with scan-build has found an assignment to vp2 that is never used. It seems that the check on vp->state > 0 should be actually on vp2->state instead. Fix this. This dates back to 2002, I found the offending commit from the git history git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git, commit 91e39521bbf6 ("[PATCH] ALSA patch for 2.5.4") Signed-off-by: Colin Ian King Cc: Link: https://lore.kernel.org/r/20211212172025.470367-1-colin.i.king@gmail.= com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- sound/drivers/opl3/opl3_midi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/drivers/opl3/opl3_midi.c +++ b/sound/drivers/opl3/opl3_midi.c @@ -415,7 +415,7 @@ void snd_opl3_note_on(void *p, int note, } if (instr_4op) { vp2 =3D &opl3->voices[voice + 3]; - if (vp->state > 0) { + if (vp2->state > 0) { opl3_reg =3D reg_side | (OPL3_REG_KEYON_BLOCK + voice_offset + 3); reg_val =3D vp->keyon_reg & ~OPL3_KEYON_BIT; From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C05EC433EF for ; Mon, 27 Dec 2021 15:27:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237368AbhL0P1b (ORCPT ); Mon, 27 Dec 2021 10:27:31 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:33104 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229766AbhL0P13 (ORCPT ); Mon, 27 Dec 2021 10:27:29 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1AEEEB810A3; Mon, 27 Dec 2021 15:27:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 63E18C36AE7; Mon, 27 Dec 2021 15:27:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618846; bh=IndcEZFZh204TAhuC+Q64nDGbhAvtu7XbJQQHfyup+A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2BOP/amKmg2u1Utkj67bc3YY2YyEjFyAbdh1j7kk2LzoxD3RG9gk98XXVk9s4EslT V1aHaYKWKI5Mep2yqRfGC6KbNYd9EtvHZzhh+0vCJrWsAJrEaupQuKdN7A3CfXzrnP bxec99o/6zD7b3rcF00xCauESwOC3W0z7vM0B+EI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ard Biesheuvel , "Russell King (Oracle)" Subject: [PATCH 4.4 11/17] ARM: 9169/1: entry: fix Thumb2 bug in iWMMXt exception handling Date: Mon, 27 Dec 2021 16:27:06 +0100 Message-Id: <20211227151316.318845451@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ard Biesheuvel commit 8536a5ef886005bc443c2da9b842d69fd3d7647f upstream. The Thumb2 version of the FP exception handling entry code treats the register holding the CP number (R8) differently, resulting in the iWMMXT CP number check to be incorrect. Fix this by unifying the ARM and Thumb2 code paths, and switch the order of the additions of the TI_USED_CP offset and the shifted CP index. Cc: Fixes: b86040a59feb ("Thumb-2: Implementation of the unified start-up and e= xceptions code") Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (Oracle) Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/arm/kernel/entry-armv.S | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) --- a/arch/arm/kernel/entry-armv.S +++ b/arch/arm/kernel/entry-armv.S @@ -625,11 +625,9 @@ call_fpe: tstne r0, #0x04000000 @ bit 26 set on both ARM and Thumb-2 reteq lr and r8, r0, #0x00000f00 @ mask out CP number - THUMB( lsr r8, r8, #8 ) mov r7, #1 - add r6, r10, #TI_USED_CP - ARM( strb r7, [r6, r8, lsr #8] ) @ set appropriate used_cp[] - THUMB( strb r7, [r6, r8] ) @ set appropriate used_cp[] + add r6, r10, r8, lsr #8 @ add used_cp[] array offset first + strb r7, [r6, #TI_USED_CP] @ set appropriate used_cp[] #ifdef CONFIG_IWMMXT @ Test if we need to give access to iWMMXt coprocessors ldr r5, [r10, #TI_FLAGS] @@ -638,7 +636,7 @@ call_fpe: bcs iwmmxt_task_enable #endif ARM( add pc, pc, r8, lsr #6 ) - THUMB( lsl r8, r8, #2 ) + THUMB( lsr r8, r8, #6 ) THUMB( add pc, r8 ) nop =20 From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1BA1C433EF for ; Mon, 27 Dec 2021 15:27:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237374AbhL0P1f (ORCPT ); Mon, 27 Dec 2021 10:27:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34054 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237377AbhL0P1c (ORCPT ); Mon, 27 Dec 2021 10:27:32 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1E688C06173E; Mon, 27 Dec 2021 07:27:32 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D8F41B810A3; Mon, 27 Dec 2021 15:27:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A36FC36AFC; Mon, 27 Dec 2021 15:27:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618849; bh=lxj0CGnaQWsdrpP+ym0cjNUD1Q9ZWMmAFxZGfZWd1/4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AZU79SCaAAErcyL3XJjB+XBBxU4dseioz5c5PvS4Lsq93aZ/IHtGX7LXjsaCirRQI okJI1qxDciPro2BGBrAhjz2CoFvk74dWshQcrz//RMzaBC+CXm0RqJ/p7e9JcwpCpS 6GEnZ/tyJxCniKjVglKa4jpSDA+bzmHfLRbvrrVs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , "xen-devel@lists.xenproject.org, Juergen Gross" , Juergen Gross Subject: [PATCH 4.4 12/17] xen/blkfront: fix bug in backported patch Date: Mon, 27 Dec 2021 16:27:07 +0100 Message-Id: <20211227151316.349920128@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Juergen Gross The backport of commit 8f5a695d99000fc ("xen/blkfront: don't take local copy of a request from the ring page") to stable 4.4 kernel introduced a bug when adding the needed blkif_ring_get_request() function, as info->ring.req_prod_pvt was incremented twice now. Fix that be deleting the now superfluous increments after calling that function. Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/block/xen-blkfront.c | 4 ---- 1 file changed, 4 deletions(-) --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -493,8 +493,6 @@ static int blkif_queue_discard_req(struc else ring_req->u.discard.flag =3D 0; =20 - info->ring.req_prod_pvt++; - /* Copy the request to the ring page. */ *final_ring_req =3D *ring_req; info->shadow[id].inflight =3D true; @@ -711,8 +709,6 @@ static int blkif_queue_rw_req(struct req if (setup.segments) kunmap_atomic(setup.segments); =20 - info->ring.req_prod_pvt++; - /* Copy request(s) to the ring page. */ *final_ring_req =3D *ring_req; info->shadow[id].inflight =3D true; From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E193EC433F5 for ; Mon, 27 Dec 2021 15:27:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237362AbhL0P1j (ORCPT ); Mon, 27 Dec 2021 10:27:39 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:33176 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237355AbhL0P1e (ORCPT ); Mon, 27 Dec 2021 10:27:34 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A5A7AB810A3; Mon, 27 Dec 2021 15:27:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D496CC36AEA; Mon, 27 Dec 2021 15:27:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618852; bh=l2ifCmZoGS4NZlmlQo+CvDkin/Bq48uyPKwmNDM8yhI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mz5VVB9nyuefsgkGFvLnY5hl2v+D/h7IRvj8Ccy1KHFcUBLheFbs/7dyC0SGEf5n7 Smpq2gxO/i0P6zP74jV5FvpvfmMTxWr1B/3rL0h0io58TkPLp7vpr3SvPw1PyvNwr7 7Q8tgL6QO34s72CVjFF/KjJF094M17I5Y1iHlI8E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Samuel=20=C4=8Cavoj?= , Dmitry Torokhov Subject: [PATCH 4.4 13/17] Input: i8042 - enable deferred probe quirk for ASUS UM325UA Date: Mon, 27 Dec 2021 16:27:08 +0100 Message-Id: <20211227151316.380867257@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Samuel =C4=8Cavoj commit 44ee250aeeabb28b52a10397ac17ffb8bfe94839 upstream. The ASUS UM325UA suffers from the same issue as the ASUS UX425UA, which is a very similar laptop. The i8042 device is not usable immediately after boot and fails to initialize, requiring a deferred retry. Enable the deferred probe quirk for the UM325UA. BugLink: https://bugzilla.suse.com/show_bug.cgi?id=3D1190256 Signed-off-by: Samuel =C4=8Cavoj Link: https://lore.kernel.org/r/20211204015615.232948-1-samuel@cavoj.net Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/input/serio/i8042-x86ia64io.h +++ b/drivers/input/serio/i8042-x86ia64io.h @@ -1025,6 +1025,13 @@ static const struct dmi_system_id __init DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"), }, }, + { + /* ASUS ZenBook UM325UA */ + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "ZenBook UX325UA_UM325UA"), + }, + }, { } }; =20 From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3850BC4332F for ; Mon, 27 Dec 2021 15:27:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237359AbhL0P1o (ORCPT ); Mon, 27 Dec 2021 10:27:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34054 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237390AbhL0P1h (ORCPT ); Mon, 27 Dec 2021 10:27:37 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 803CFC061757; Mon, 27 Dec 2021 07:27:37 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4786CB80E5A; Mon, 27 Dec 2021 15:27:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9D64AC36AE7; Mon, 27 Dec 2021 15:27:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618855; bh=Vz8vVtXcbEHvRmf7CfHIDvEoOvMdq+KaI3CLJ0RSZik=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hsW3uf7H5k+pguuD4yKlvuL57o5+qqkRoJXWlWxcHsnD/dysNhvr8bHDgRGS5mcvb Ocfl5KKEpSWxIPmgJBjQ/m0xLBrSi687fWF0atSWNe45jbURxOUy9XZTLgrwQRow1J zV2rLoo/fy4y8t60wvQ89WCWYhqL2T1pxxYgI2+8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hanjie Wu , Lin Ma , "David S. Miller" Subject: [PATCH 4.4 14/17] ax25: NPD bug when detaching AX25 device Date: Mon, 27 Dec 2021 16:27:09 +0100 Message-Id: <20211227151316.412393469@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lin Ma commit 1ade48d0c27d5da1ccf4b583d8c5fc8b534a3ac8 upstream. The existing cleanup routine implementation is not well synchronized with the syscall routine. When a device is detaching, below race could occur. static int ax25_sendmsg(...) { ... lock_sock() ax25 =3D sk_to_ax25(sk); if (ax25->ax25_dev =3D=3D NULL) // CHECK ... ax25_queue_xmit(skb, ax25->ax25_dev->dev); // USE ... } static void ax25_kill_by_device(...) { ... if (s->ax25_dev =3D=3D ax25_dev) { s->ax25_dev =3D NULL; ... } Other syscall functions like ax25_getsockopt, ax25_getname, ax25_info_show also suffer from similar races. To fix them, this patch introduce lock_sock() into ax25_kill_by_device in order to guarantee that the nullify action in cleanup routine cannot proceed when another socket request is pending. Signed-off-by: Hanjie Wu Signed-off-by: Lin Ma Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/ax25/af_ax25.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -88,8 +88,10 @@ static void ax25_kill_by_device(struct n again: ax25_for_each(s, &ax25_list) { if (s->ax25_dev =3D=3D ax25_dev) { - s->ax25_dev =3D NULL; spin_unlock_bh(&ax25_list_lock); + lock_sock(s->sk); + s->ax25_dev =3D NULL; + release_sock(s->sk); ax25_disconnect(s, ENETUNREACH); spin_lock_bh(&ax25_list_lock); =20 From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85987C433EF for ; Mon, 27 Dec 2021 15:27:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237426AbhL0P1q (ORCPT ); Mon, 27 Dec 2021 10:27:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34060 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237370AbhL0P1i (ORCPT ); Mon, 27 Dec 2021 10:27:38 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0196C06173E; Mon, 27 Dec 2021 07:27:38 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 519EB6110F; Mon, 27 Dec 2021 15:27:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3BC1FC36AE7; Mon, 27 Dec 2021 15:27:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618857; bh=GDM88T6z+CoFM2O6zfeOAhu/7fGz0E1fKDui1Cy9nuc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QaCqpVlPmmy8gl1DxrZgi3vvd94GeaG6OS8rkBIi1+dAo86RNHPAq7vEjm3RPKPPn vBDp5jHxt1exH+FBOfxSBSSSOZumwZ5CH7BnZUIeB74UUd/5By5WpHGAtC3AHGq21Z inZat9mq0Hz8eIqGvTw7r9XZL92KXguUfFPuxJ6o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Ma , "David S. Miller" Subject: [PATCH 4.4 15/17] hamradio: defer ax25 kfree after unregister_netdev Date: Mon, 27 Dec 2021 16:27:10 +0100 Message-Id: <20211227151316.443220940@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lin Ma commit 3e0588c291d6ce225f2b891753ca41d45ba42469 upstream. There is a possible race condition (use-after-free) like below (USE) | (FREE) ax25_sendmsg | ax25_queue_xmit | dev_queue_xmit | __dev_queue_xmit | __dev_xmit_skb | sch_direct_xmit | ... xmit_one | netdev_start_xmit | tty_ldisc_kill __netdev_start_xmit | mkiss_close ax_xmit | kfree ax_encaps | | Even though there are two synchronization primitives before the kfree: 1. wait_for_completion(&ax->dead). This can prevent the race with routines from mkiss_ioctl. However, it cannot stop the routine coming from upper layer, i.e., the ax25_sendmsg. 2. netif_stop_queue(ax->dev). It seems that this line of code aims to halt the transmit queue but it fails to stop the routine that already being xmit. This patch reorder the kfree after the unregister_netdev to avoid the possible UAF as the unregister_netdev() is well synchronized and won't return if there is a running routine. Signed-off-by: Lin Ma Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/hamradio/mkiss.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/drivers/net/hamradio/mkiss.c +++ b/drivers/net/hamradio/mkiss.c @@ -803,13 +803,14 @@ static void mkiss_close(struct tty_struc */ netif_stop_queue(ax->dev); =20 - /* Free all AX25 frame buffers. */ - kfree(ax->rbuff); - kfree(ax->xbuff); - ax->tty =3D NULL; =20 unregister_netdev(ax->dev); + + /* Free all AX25 frame buffers after unreg. */ + kfree(ax->rbuff); + kfree(ax->xbuff); + free_netdev(ax->dev); } =20 From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF294C433F5 for ; Mon, 27 Dec 2021 15:27:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237444AbhL0P1x (ORCPT ); Mon, 27 Dec 2021 10:27:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34102 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237382AbhL0P1m (ORCPT ); Mon, 27 Dec 2021 10:27:42 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E5168C06175F; Mon, 27 Dec 2021 07:27:41 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 84A56610A7; Mon, 27 Dec 2021 15:27:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 52E0AC36AE7; Mon, 27 Dec 2021 15:27:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618860; bh=asfYmqaiXY7RYN1v5stNBAhjj5bzCu1/M33g/7Og6SU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xkz1up/yVOg6ZhHyOnMlrg3uaqlAHBaoS8ojzB88+RZroYSK7CP5Ut+iZyRms1bg2 Lko5qiCUxvonsdQWic5SQFWheEvGAZIHlgRocwajgcAjt4yN2EIfMjC/24wmJQJ33H EA5TiXgTGPRnrT/NMbVQ12IF5AcmgBOpecd7IwSQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Ma , "David S. Miller" Subject: [PATCH 4.4 16/17] hamradio: improve the incomplete fix to avoid NPD Date: Mon, 27 Dec 2021 16:27:11 +0100 Message-Id: <20211227151316.473350347@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lin Ma commit b2f37aead1b82a770c48b5d583f35ec22aabb61e upstream. The previous commit 3e0588c291d6 ("hamradio: defer ax25 kfree after unregister_netdev") reorder the kfree operations and unregister_netdev operation to prevent UAF. This commit improves the previous one by also deferring the nullify of the ax->tty pointer. Otherwise, a NULL pointer dereference bug occurs. Partial of the stack trace is shown below. BUG: kernel NULL pointer dereference, address: 0000000000000538 RIP: 0010:ax_xmit+0x1f9/0x400 ... Call Trace: dev_hard_start_xmit+0xec/0x320 sch_direct_xmit+0xea/0x240 __qdisc_run+0x166/0x5c0 __dev_queue_xmit+0x2c7/0xaf0 ax25_std_establish_data_link+0x59/0x60 ax25_connect+0x3a0/0x500 ? security_socket_connect+0x2b/0x40 __sys_connect+0x96/0xc0 ? __hrtimer_init+0xc0/0xc0 ? common_nsleep+0x2e/0x50 ? switch_fpu_return+0x139/0x1a0 __x64_sys_connect+0x11/0x20 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The crash point is shown as below static void ax_encaps(...) { ... set_bit(TTY_DO_WRITE_WAKEUP, &ax->tty->flags); // ax->tty =3D NULL! ... } By placing the nullify action after the unregister_netdev, the ax->tty pointer won't be assigned as NULL net_device framework layer is well synchronized. Signed-off-by: Lin Ma Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/hamradio/mkiss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/hamradio/mkiss.c +++ b/drivers/net/hamradio/mkiss.c @@ -803,14 +803,14 @@ static void mkiss_close(struct tty_struc */ netif_stop_queue(ax->dev); =20 - ax->tty =3D NULL; - unregister_netdev(ax->dev); =20 /* Free all AX25 frame buffers after unreg. */ kfree(ax->rbuff); kfree(ax->xbuff); =20 + ax->tty =3D NULL; + free_netdev(ax->dev); } =20 From nobody Thu Jul 2 12:33:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CB8BCC433EF for ; Mon, 27 Dec 2021 15:27:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237356AbhL0P1v (ORCPT ); Mon, 27 Dec 2021 10:27:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34054 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237360AbhL0P1o (ORCPT ); Mon, 27 Dec 2021 10:27:44 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A6E4DC06173E; Mon, 27 Dec 2021 07:27:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 455946104C; Mon, 27 Dec 2021 15:27:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D92BC36AEA; Mon, 27 Dec 2021 15:27:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1640618863; bh=yWohFuXPuhpKh3GBtSuwSt43iyD9kB/bkSGBFhSDcY0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D+ZeY2vAWDtcUjq81fU0MA6OFrEnkc86vYxwcmZOAI19f9EDFw71Qol6RHcx9W5ww iQCgkc51ZV+4y0/EvlFP6QlhkylvbKXRktRYjf65EB0rrOTuFh2Ci/+EfaU4JXSCwa rILOrb3GkUmbBe8vZpBLA4HXbuUNn8iEehG70I1U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+2dc91e7fc3dea88b1e8a@syzkaller.appspotmail.com, =?UTF-8?q?R=C3=A9mi=20Denis-Courmont?= , "David S. Miller" Subject: [PATCH 4.4 17/17] phonet/pep: refuse to enable an unbound pipe Date: Mon, 27 Dec 2021 16:27:12 +0100 Message-Id: <20211227151316.503111560@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211227151315.962187770@linuxfoundation.org> References: <20211227151315.962187770@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: R=C3=A9mi Denis-Courmont commit 75a2f31520095600f650597c0ac41f48b5ba0068 upstream. This ioctl() implicitly assumed that the socket was already bound to a valid local socket name, i.e. Phonet object. If the socket was not bound, two separate problems would occur: 1) We'd send an pipe enablement request with an invalid source object. 2) Later socket calls could BUG on the socket unexpectedly being connected yet not bound to a valid object. Reported-by: syzbot+2dc91e7fc3dea88b1e8a@syzkaller.appspotmail.com Signed-off-by: R=C3=A9mi Denis-Courmont Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/phonet/pep.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -956,6 +956,8 @@ static int pep_ioctl(struct sock *sk, in ret =3D -EBUSY; else if (sk->sk_state =3D=3D TCP_ESTABLISHED) ret =3D -EISCONN; + else if (!pn->pn_sk.sobject) + ret =3D -EADDRNOTAVAIL; else ret =3D pep_sock_enable(sk, NULL, 0); release_sock(sk);