From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16A6EC433EF for ; Mon, 10 Jan 2022 07:33:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240140AbiAJHc4 (ORCPT ); Mon, 10 Jan 2022 02:32:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48524 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240127AbiAJH2b (ORCPT ); Mon, 10 Jan 2022 02:28:31 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8428BC028BED; Sun, 9 Jan 2022 23:26:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 44374B81216; Mon, 10 Jan 2022 07:26:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8E9E9C36AE9; Mon, 10 Jan 2022 07:26:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799611; bh=NuKUQB0gWOdiObICUzL0v8caEKtF50JBpnSDLvALOdw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cu+MHLEL0zsYBusik3wuUu9u1sU/AJKZOk9kVFxdjvBALc6SC9DlpC+uVJjYylemS vb7vgIRE54S/AMHwt708OBhLUT+uT32hkNwytIQz3emXrQBjS4Z74VRjuNi6by5CCS zEcxzselUyEWYiW2S4l8ImZmo08dmCDp2D94Ycb8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Naveen N. Rao" , Steven Rostedt Subject: [PATCH 4.19 01/21] tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() Date: Mon, 10 Jan 2022 08:23:02 +0100 Message-Id: <20220110071814.015920375@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Naveen N. Rao commit 823e670f7ed616d0ce993075c8afe0217885f79d upstream. With the new osnoise tracer, we are seeing the below splat: Kernel attempted to read user page (c7d880000) - exploit attempt? (uid:= 0) BUG: Unable to handle kernel data access on read at 0xc7d880000 Faulting instruction address: 0xc0000000002ffa10 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=3D64K MMU=3DRadix SMP NR_CPUS=3D2048 NUMA pSeries ... NIP [c0000000002ffa10] __trace_array_vprintk.part.0+0x70/0x2f0 LR [c0000000002ff9fc] __trace_array_vprintk.part.0+0x5c/0x2f0 Call Trace: [c0000008bdd73b80] [c0000000001c49cc] put_prev_task_fair+0x3c/0x60 (unr= eliable) [c0000008bdd73be0] [c000000000301430] trace_array_printk_buf+0x70/0x90 [c0000008bdd73c00] [c0000000003178b0] trace_sched_switch_callback+0x250= /0x290 [c0000008bdd73c90] [c000000000e70d60] __schedule+0x410/0x710 [c0000008bdd73d40] [c000000000e710c0] schedule+0x60/0x130 [c0000008bdd73d70] [c000000000030614] interrupt_exit_user_prepare_main+= 0x264/0x270 [c0000008bdd73de0] [c000000000030a70] syscall_exit_prepare+0x150/0x180 [c0000008bdd73e10] [c00000000000c174] system_call_vectored_common+0xf4/= 0x278 osnoise tracer on ppc64le is triggering osnoise_taint() for negative duration in get_int_safe_duration() called from trace_sched_switch_callback()->thread_exit(). The problem though is that the check for a valid trace_percpu_buffer is incorrect in get_trace_buf(). The check is being done after calculating the pointer for the current cpu, rather than on the main percpu pointer. Fix the check to be against trace_percpu_buffer. Link: https://lkml.kernel.org/r/a920e4272e0b0635cf20c444707cbce1b2c8973d.16= 40255304.git.naveen.n.rao@linux.vnet.ibm.com Cc: stable@vger.kernel.org Fixes: e2ace001176dc9 ("tracing: Choose static tp_printk buffer by explicit= nesting count") Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -2822,7 +2822,7 @@ static char *get_trace_buf(void) { struct trace_buffer_struct *buffer =3D this_cpu_ptr(trace_percpu_buffer); =20 - if (!buffer || buffer->nesting >=3D 4) + if (!trace_percpu_buffer || buffer->nesting >=3D 4) return NULL; =20 buffer->nesting++; From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 548EBC433FE for ; Mon, 10 Jan 2022 07:32:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239933AbiAJHcR (ORCPT ); Mon, 10 Jan 2022 02:32:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48532 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240133AbiAJH2c (ORCPT ); Mon, 10 Jan 2022 02:28:32 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DCF21C028BEE; Sun, 9 Jan 2022 23:26:54 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7D8B3611B9; Mon, 10 Jan 2022 07:26:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6097FC36AE9; Mon, 10 Jan 2022 07:26:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799613; bh=S9W/8WK5YYTdkSikU45bTJwgwBshs9fphhTu09tAU8w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mIAozLQChIpb2hVYO6J/skzJiIaPvwzi9AqnHdBrZFdopHwvabYMcrTdEmOFfxWpY TPTxN+O5il8Hl89t+Mm01ijP9X6ys8wIzEzx765PgMZjHJegSH+bkRYVTSgxHS8DbH vmF7rJboq/rlIjENeCKelmdvQZN0ELag0RQ6ZUCg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , "Naveen N. Rao" , Steven Rostedt Subject: [PATCH 4.19 02/21] tracing: Tag trace_percpu_buffer as a percpu pointer Date: Mon, 10 Jan 2022 08:23:03 +0100 Message-Id: <20220110071814.047265306@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Naveen N. Rao commit f28439db470cca8b6b082239314e9fd10bd39034 upstream. Tag trace_percpu_buffer as a percpu pointer to resolve warnings reported by sparse: /linux/kernel/trace/trace.c:3218:46: warning: incorrect type in initializ= er (different address spaces) /linux/kernel/trace/trace.c:3218:46: expected void const [noderef] __p= ercpu *__vpp_verify /linux/kernel/trace/trace.c:3218:46: got struct trace_buffer_struct * /linux/kernel/trace/trace.c:3234:9: warning: incorrect type in initialize= r (different address spaces) /linux/kernel/trace/trace.c:3234:9: expected void const [noderef] __pe= rcpu *__vpp_verify /linux/kernel/trace/trace.c:3234:9: got int * Link: https://lkml.kernel.org/r/ebabd3f23101d89cb75671b68b6f819f5edc830b.16= 40255304.git.naveen.n.rao@linux.vnet.ibm.com Cc: stable@vger.kernel.org Reported-by: kernel test robot Fixes: 07d777fe8c398 ("tracing: Add percpu buffers for trace_printk()") Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/trace/trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -2812,7 +2812,7 @@ struct trace_buffer_struct { char buffer[4][TRACE_BUF_SIZE]; }; =20 -static struct trace_buffer_struct *trace_percpu_buffer; +static struct trace_buffer_struct __percpu *trace_percpu_buffer; =20 /* * Thise allows for lockless recording. If we're nested too deeply, then @@ -2841,7 +2841,7 @@ static void put_trace_buf(void) =20 static int alloc_percpu_trace_buffer(void) { - struct trace_buffer_struct *buffers; + struct trace_buffer_struct __percpu *buffers; =20 buffers =3D alloc_percpu(struct trace_buffer_struct); if (WARN(!buffers, "Could not allocate percpu trace_printk buffer")) From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 802D0C43219 for ; Mon, 10 Jan 2022 07:32:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240814AbiAJHcd (ORCPT ); Mon, 10 Jan 2022 02:32:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48092 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240138AbiAJH2e (ORCPT ); Mon, 10 Jan 2022 02:28:34 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 284C3C028BF0; Sun, 9 Jan 2022 23:26:59 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DD32EB81217; Mon, 10 Jan 2022 07:26:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31C7CC36AED; Mon, 10 Jan 2022 07:26:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799616; bh=/2XA2yRPFvZVFujVFXUxQ5ZTUit5MDCy/tTJQ6XuUTI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QFJkTge8Tx0IWiUmQONMhHEGQ8R2ZtSyw0013tu/pOw4w9punbNEXWJzFq3zLudai p3MbkUUVWZbFAySMDnOLshpO3/xniRRNSXVJzJPVUiO9OLBCcG4x/rixD/t67hb9f/ nzBG9KzF9EMRJqsEG2DaHFQe5t/oUZyp/WJV3Nzo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Potapenko , Alexander Aring , Pavel Skripkin , Stefan Schmidt Subject: [PATCH 4.19 03/21] ieee802154: atusb: fix uninit value in atusb_set_extended_addr Date: Mon, 10 Jan 2022 08:23:04 +0100 Message-Id: <20220110071814.075884924@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin commit 754e4382354f7908923a1949d8dc8d05f82f09cb upstream. Alexander reported a use of uninitialized value in atusb_set_extended_addr(), that is caused by reading 0 bytes via usb_control_msg(). Fix it by validating if the number of bytes transferred is actually correct, since usb_control_msg() may read less bytes, than was requested by caller. Fail log: BUG: KASAN: uninit-cmp in ieee802154_is_valid_extended_unicast_addr include= /linux/ieee802154.h:310 [inline] BUG: KASAN: uninit-cmp in atusb_set_extended_addr drivers/net/ieee802154/at= usb.c:1000 [inline] BUG: KASAN: uninit-cmp in atusb_probe.cold+0x29f/0x14db drivers/net/ieee802= 154/atusb.c:1056 Uninit value used in comparison: 311daa649a2003bd stack handle: 000000009a2= 003bd ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [= inline] atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline] atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056 usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396 Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver") Reported-by: Alexander Potapenko Acked-by: Alexander Aring Signed-off-by: Pavel Skripkin Link: https://lore.kernel.org/r/20220104182806.7188-1-paskripkin@gmail.com Signed-off-by: Stefan Schmidt Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ieee802154/atusb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/drivers/net/ieee802154/atusb.c +++ b/drivers/net/ieee802154/atusb.c @@ -96,7 +96,9 @@ static int atusb_control_msg(struct atus =20 ret =3D usb_control_msg(usb_dev, pipe, request, requesttype, value, index, data, size, timeout); - if (ret < 0) { + if (ret < size) { + ret =3D ret < 0 ? ret : -ENODATA; + atusb->err =3D ret; dev_err(&usb_dev->dev, "%s: req 0x%02x val 0x%x idx 0x%x, error %d\n", @@ -864,9 +866,9 @@ static int atusb_get_and_show_build(stru if (!build) return -ENOMEM; =20 - ret =3D atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0), - ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0, - build, ATUSB_BUILD_SIZE, 1000); + /* We cannot call atusb_control_msg() here, since this request may read v= arious length data */ + ret =3D usb_control_msg(atusb->usb_dev, usb_rcvctrlpipe(usb_dev, 0), ATUS= B_BUILD, + ATUSB_REQ_FROM_DEV, 0, 0, build, ATUSB_BUILD_SIZE, 1000); if (ret >=3D 0) { build[ret] =3D 0; dev_info(&usb_dev->dev, "Firmware: build %s\n", build); From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 73CB8C433EF for ; Mon, 10 Jan 2022 07:32:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240826AbiAJHcj (ORCPT ); Mon, 10 Jan 2022 02:32:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48538 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239704AbiAJH2e (ORCPT ); Mon, 10 Jan 2022 02:28:34 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 67183C028BF1; Sun, 9 Jan 2022 23:27:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 06016611AA; Mon, 10 Jan 2022 07:27:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 14DB8C36AED; Mon, 10 Jan 2022 07:26:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799619; bh=Z+zCmTEq1nUUaLCcSgs4oup25kLMn11yeAWlNCsjOKs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dMtObgYK6XBh9pkJu1vqzj2qjBmVKic2uIDnt9AlUu9vXHgDUhgnhgQWON37Re4cr m0TjOKULY7XHe5scSBfzCSpcJUqapOShWxiIn3IQxuRXK5PtE1CIxZNgM8CM3slZhs A1D2P6x+pKO4w7pCbnFVu/JtW2VcmPlDaQXtFw08= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+6d532fa8f9463da290bc@syzkaller.appspotmail.com, Leon Romanovsky , Jason Gunthorpe Subject: [PATCH 4.19 04/21] RDMA/core: Dont infoleak GRH fields Date: Mon, 10 Jan 2022 08:23:05 +0100 Message-Id: <20220110071814.109088776@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Leon Romanovsky commit b35a0f4dd544eaa6162b6d2f13a2557a121ae5fd upstream. If dst->is_global field is not set, the GRH fields are not cleared and the following infoleak is reported. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instru= mented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:209 [inline] ucma_init_qp_attr+0x8c7/0xb10 drivers/infiniband/core/ucma.c:1242 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 vfs_write+0x8ce/0x2030 fs/read_write.c:588 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline] __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Local variable resp created at: ucma_init_qp_attr+0xa4/0xb10 drivers/infiniband/core/ucma.c:1214 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 Bytes 40-59 of 144 are uninitialized Memory access of size 144 starts at ffff888167523b00 Data copied to user address 0000000020000100 CPU: 1 PID: 25910 Comm: syz-executor.1 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D Fixes: 4ba66093bdc6 ("IB/core: Check for global flag when using ah_attr") Link: https://lore.kernel.org/r/0e9dd51f93410b7b2f4f5562f52befc878b71afa.16= 41298868.git.leonro@nvidia.com Reported-by: syzbot+6d532fa8f9463da290bc@syzkaller.appspotmail.com Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/infiniband/core/uverbs_marshall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/infiniband/core/uverbs_marshall.c +++ b/drivers/infiniband/core/uverbs_marshall.c @@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_d struct rdma_ah_attr *src =3D ah_attr; struct rdma_ah_attr conv_ah; =20 - memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved)); + memset(&dst->grh, 0, sizeof(dst->grh)); =20 if ((ah_attr->type =3D=3D RDMA_AH_ATTR_TYPE_OPA) && (rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) && From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 06D74C433F5 for ; Mon, 10 Jan 2022 07:30:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240291AbiAJHab (ORCPT ); Mon, 10 Jan 2022 02:30:31 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:35794 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239438AbiAJH1D (ORCPT ); Mon, 10 Jan 2022 02:27:03 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DB9146112C; Mon, 10 Jan 2022 07:27:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0768C36AED; Mon, 10 Jan 2022 07:27:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799622; bh=ABb9HQYoH/NUN601GUG7xf/rxAOJub+ZNfbG40KpJXk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m6u1AikpcHJmspOV/eIgmnCJ+eLDf1si/Hsp5IMum5yPijTsRY61M4rxIL6mGIWQh O5DB0yJEgqCK+PCk4rNB8MzPrOh246DB1NIXQOk5bQLe8bofz8tAQPvupOb4oLK4yL NMd3FCCiWaEsZrgYk1lujIIbRcmTpnzK/RiCHQOY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Rix , Nick Desaulniers , Johannes Berg Subject: [PATCH 4.19 05/21] mac80211: initialize variable have_higher_than_11mbit Date: Mon, 10 Jan 2022 08:23:06 +0100 Message-Id: <20220110071814.142173470@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tom Rix commit 68a18ad71378a56858141c4449e02a30c829763e upstream. Clang static analysis reports this warnings mlme.c:5332:7: warning: Branch condition evaluates to a garbage value have_higher_than_11mbit) ^~~~~~~~~~~~~~~~~~~~~~~ have_higher_than_11mbit is only set to true some of the time in ieee80211_get_rates() but is checked all of the time. So have_higher_than_11mbit needs to be initialized to false. Fixes: 5d6a1b069b7f ("mac80211: set basic rates earlier") Signed-off-by: Tom Rix Reviewed-by: Nick Desaulniers Link: https://lore.kernel.org/r/20211223162848.3243702-1-trix@redhat.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/mac80211/mlme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -4788,7 +4788,7 @@ static int ieee80211_prep_connection(str */ if (new_sta) { u32 rates =3D 0, basic_rates =3D 0; - bool have_higher_than_11mbit; + bool have_higher_than_11mbit =3D false; int min_rate =3D INT_MAX, min_rate_index =3D -1; const struct cfg80211_bss_ies *ies; int shift =3D ieee80211_vif_get_shift(&sdata->vif); From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DEBEEC433FE for ; Mon, 10 Jan 2022 07:30:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240391AbiAJHac (ORCPT ); Mon, 10 Jan 2022 02:30:32 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57438 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239833AbiAJH1H (ORCPT ); Mon, 10 Jan 2022 02:27:07 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 50D2BB81217; Mon, 10 Jan 2022 07:27:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A7CF3C36AEF; Mon, 10 Jan 2022 07:27:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799625; bh=mkXWUYHYcAWyV4yUkbifdSUenPDZTze4XHens75Notc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=moFTAQosLaHfkfnIcFQtZVwjGDJj+Ows2wwygKL90q7yHkEQS2v3fa7d5UYETY/aZ rx1Mbs5ObtNP/YKrS7tfwloltLFZCj19HXaCfDfuAggu1bhO9w9/aTpDGhGKGoZyZF 2CMpjwUM6pz0eI9Mw2Pe3nw52BcsCrpOCDXRoEOw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Di Zhu , Rui Zhang , Gurucharan G , Tony Nguyen Subject: [PATCH 4.19 06/21] i40e: fix use-after-free in i40e_sync_filters_subtask() Date: Mon, 10 Jan 2022 08:23:07 +0100 Message-Id: <20220110071814.172190135@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Di Zhu commit 3116f59c12bd24c513194cd3acb3ec1f7d468954 upstream. Using ifconfig command to delete the ipv6 address will cause the i40e network card driver to delete its internal mac_filter and i40e_service_task kernel thread will concurrently access the mac_filter. These two processes are not protected by lock so causing the following use-after-free problems. print_address_description+0x70/0x360 ? vprintk_func+0x5e/0xf0 kasan_report+0x1b2/0x330 i40e_sync_vsi_filters+0x4f0/0x1850 [i40e] i40e_sync_filters_subtask+0xe3/0x130 [i40e] i40e_service_task+0x195/0x24c0 [i40e] process_one_work+0x3f5/0x7d0 worker_thread+0x61/0x6c0 ? process_one_work+0x7d0/0x7d0 kthread+0x1c3/0x1f0 ? kthread_park+0xc0/0xc0 ret_from_fork+0x35/0x40 Allocated by task 2279810: kasan_kmalloc+0xa0/0xd0 kmem_cache_alloc_trace+0xf3/0x1e0 i40e_add_filter+0x127/0x2b0 [i40e] i40e_add_mac_filter+0x156/0x190 [i40e] i40e_addr_sync+0x2d/0x40 [i40e] __hw_addr_sync_dev+0x154/0x210 i40e_set_rx_mode+0x6d/0xf0 [i40e] __dev_set_rx_mode+0xfb/0x1f0 __dev_mc_add+0x6c/0x90 igmp6_group_added+0x214/0x230 __ipv6_dev_mc_inc+0x338/0x4f0 addrconf_join_solict.part.7+0xa2/0xd0 addrconf_dad_work+0x500/0x980 process_one_work+0x3f5/0x7d0 worker_thread+0x61/0x6c0 kthread+0x1c3/0x1f0 ret_from_fork+0x35/0x40 Freed by task 2547073: __kasan_slab_free+0x130/0x180 kfree+0x90/0x1b0 __i40e_del_filter+0xa3/0xf0 [i40e] i40e_del_mac_filter+0xf3/0x130 [i40e] i40e_addr_unsync+0x85/0xa0 [i40e] __hw_addr_sync_dev+0x9d/0x210 i40e_set_rx_mode+0x6d/0xf0 [i40e] __dev_set_rx_mode+0xfb/0x1f0 __dev_mc_del+0x69/0x80 igmp6_group_dropped+0x279/0x510 __ipv6_dev_mc_dec+0x174/0x220 addrconf_leave_solict.part.8+0xa2/0xd0 __ipv6_ifa_notify+0x4cd/0x570 ipv6_ifa_notify+0x58/0x80 ipv6_del_addr+0x259/0x4a0 inet6_addr_del+0x188/0x260 addrconf_del_ifaddr+0xcc/0x130 inet6_ioctl+0x152/0x190 sock_do_ioctl+0xd8/0x2b0 sock_ioctl+0x2e5/0x4c0 do_vfs_ioctl+0x14e/0xa80 ksys_ioctl+0x7c/0xa0 __x64_sys_ioctl+0x42/0x50 do_syscall_64+0x98/0x2c0 entry_SYSCALL_64_after_hwframe+0x65/0xca Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Di Zhu Signed-off-by: Rui Zhang Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/i40e/i40e_main.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -96,6 +96,24 @@ MODULE_VERSION(DRV_VERSION); =20 static struct workqueue_struct *i40e_wq; =20 +static void netdev_hw_addr_refcnt(struct i40e_mac_filter *f, + struct net_device *netdev, int delta) +{ + struct netdev_hw_addr *ha; + + if (!f || !netdev) + return; + + netdev_for_each_mc_addr(ha, netdev) { + if (ether_addr_equal(ha->addr, f->macaddr)) { + ha->refcount +=3D delta; + if (ha->refcount <=3D 0) + ha->refcount =3D 1; + break; + } + } +} + /** * i40e_allocate_dma_mem_d - OS specific memory alloc for shared code * @hw: pointer to the HW structure @@ -2005,6 +2023,7 @@ static void i40e_undo_add_filter_entries hlist_for_each_entry_safe(new, h, from, hlist) { /* We can simply free the wrapper structure */ hlist_del(&new->hlist); + netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); kfree(new); } } @@ -2341,6 +2360,10 @@ int i40e_sync_vsi_filters(struct i40e_vs &tmp_add_list, &tmp_del_list, vlan_filters); + + hlist_for_each_entry(new, &tmp_add_list, hlist) + netdev_hw_addr_refcnt(new->f, vsi->netdev, 1); + if (retval) goto err_no_memory_locked; =20 @@ -2473,6 +2496,7 @@ int i40e_sync_vsi_filters(struct i40e_vs if (new->f->state =3D=3D I40E_FILTER_NEW) new->f->state =3D new->state; hlist_del(&new->hlist); + netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); kfree(new); } spin_unlock_bh(&vsi->mac_filter_hash_lock); From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76452C433F5 for ; Mon, 10 Jan 2022 07:31:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240640AbiAJHbm (ORCPT ); Mon, 10 Jan 2022 02:31:42 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:56762 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239953AbiAJH1w (ORCPT ); Mon, 10 Jan 2022 02:27:52 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 733FEB811FE; Mon, 10 Jan 2022 07:27:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BE656C36AE9; Mon, 10 Jan 2022 07:27:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799670; bh=vwVLkT9oZoIFYDF6wngo1lVtVkuhqY7Jt4xqzl+k4/U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zCwxx+5byTMi5A5fY3NLY0y3AGoS/BMCzpeXhTnqUJp+IqCSZEV6IPbWSCmlo2iVs Ac5vjFmHn1iDxRENtftAaHIrfEf6+JOUjPQeqIIT699ZSHKDnDeKOCXeVFwt4GYjb0 J+exAKjXc4lxyCb/GCHSqmDhz6YZTisUTOJH/XkI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukasz Cieplicki , Jedrzej Jagielski , Gurucharan G , Tony Nguyen Subject: [PATCH 4.19 07/21] i40e: Fix incorrect netdevs real number of RX/TX queues Date: Mon, 10 Jan 2022 08:23:08 +0100 Message-Id: <20220110071814.202321497@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jedrzej Jagielski commit e738451d78b2f8a9635d66c6a87f304b4d965f7a upstream. There was a wrong queues representation in sysfs during driver's reinitialization in case of online cpus number is less than combined queues. It was caused by stopped NetworkManager, which is responsible for calling vsi_open function during driver's initialization. In specific situation (ex. 12 cpus online) there were 16 queues in /sys/class/net//queues. In case of modifying queues with value higher, than number of online cpus, then it caused write errors and other errors. Add updating of sysfs's queues representation during driver initialization. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Lukasz Cieplicki Signed-off-by: Jedrzej Jagielski Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/i40e/i40e_main.c | 32 +++++++++++++++++++++--= ----- 1 file changed, 25 insertions(+), 7 deletions(-) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -7741,6 +7741,27 @@ int i40e_open(struct net_device *netdev) } =20 /** + * i40e_netif_set_realnum_tx_rx_queues - Update number of tx/rx queues + * @vsi: vsi structure + * + * This updates netdev's number of tx/rx queues + * + * Returns status of setting tx/rx queues + **/ +static int i40e_netif_set_realnum_tx_rx_queues(struct i40e_vsi *vsi) +{ + int ret; + + ret =3D netif_set_real_num_rx_queues(vsi->netdev, + vsi->num_queue_pairs); + if (ret) + return ret; + + return netif_set_real_num_tx_queues(vsi->netdev, + vsi->num_queue_pairs); +} + +/** * i40e_vsi_open - * @vsi: the VSI to open * @@ -7776,13 +7797,7 @@ int i40e_vsi_open(struct i40e_vsi *vsi) goto err_setup_rx; =20 /* Notify the stack of the actual queue counts. */ - err =3D netif_set_real_num_tx_queues(vsi->netdev, - vsi->num_queue_pairs); - if (err) - goto err_set_queues; - - err =3D netif_set_real_num_rx_queues(vsi->netdev, - vsi->num_queue_pairs); + err =3D i40e_netif_set_realnum_tx_rx_queues(vsi); if (err) goto err_set_queues; =20 @@ -12811,6 +12826,9 @@ struct i40e_vsi *i40e_vsi_setup(struct i ret =3D i40e_config_netdev(vsi); if (ret) goto err_netdev; + ret =3D i40e_netif_set_realnum_tx_rx_queues(vsi); + if (ret) + goto err_netdev; ret =3D register_netdev(vsi->netdev); if (ret) goto err_netdev; From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48EEAC433EF for ; Mon, 10 Jan 2022 07:36:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240850AbiAJHgZ (ORCPT ); Mon, 10 Jan 2022 02:36:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49310 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240355AbiAJH3z (ORCPT ); Mon, 10 Jan 2022 02:29:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CAF8AC028BFA; Sun, 9 Jan 2022 23:27:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8178CB81161; Mon, 10 Jan 2022 07:27:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F24F0C36AE9; Mon, 10 Jan 2022 07:27:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799630; bh=SpT8iyIODNYO93lTTSNKXblLyQcmyZA84JzizvJXAyA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0obQkCDJvVfALmWNJNFcC30JXtc48AuSYuONLo/dqH3z6yKJXkPWG0H5mCCIfc+gm Ygc6dl5ebAdk4u4UCjsp0eb4ybhyRaKLe0aScdkXnO0W7Ey1kaNPVd03Yrzjqi6l79 q4TZ7aXQP4SVSdMbZQvCXN7U0ErwssXbGdgCqWQU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Nicolas Dichtel , "David S. Miller" Subject: [PATCH 4.19 08/21] ipv6: Check attribute length for RTA_GATEWAY in multipath route Date: Mon, 10 Jan 2022 08:23:09 +0100 Message-Id: <20220110071814.232226952@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 4619bcf91399f00a40885100fb61d594d8454033 upstream. Commit referenced in the Fixes tag used nla_memcpy for RTA_GATEWAY as does the current nla_get_in6_addr. nla_memcpy protects against accessing memory greater than what is in the attribute, but there is no check requiring the attribute to have an IPv6 address. Add it. Fixes: 51ebd3181572 ("ipv6: add support of equal cost multipath (ECMP)") Signed-off-by: David Ahern Cc: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/route.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -4413,6 +4413,19 @@ static void ip6_route_mpath_notify(struc inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags); } =20 +static int fib6_gw_from_attr(struct in6_addr *gw, struct nlattr *nla, + struct netlink_ext_ack *extack) +{ + if (nla_len(nla) < sizeof(*gw)) { + NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_GATEWAY"); + return -EINVAL; + } + + *gw =3D nla_get_in6_addr(nla); + + return 0; +} + static int ip6_route_multipath_add(struct fib6_config *cfg, struct netlink_ext_ack *extack) { @@ -4453,7 +4466,13 @@ static int ip6_route_multipath_add(struc =20 nla =3D nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - r_cfg.fc_gateway =3D nla_get_in6_addr(nla); + int ret; + + ret =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + extack); + if (ret) + return ret; + r_cfg.fc_flags |=3D RTF_GATEWAY; } r_cfg.fc_encap =3D nla_find(attrs, attrlen, RTA_ENCAP); From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4269FC433F5 for ; Mon, 10 Jan 2022 07:43:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241115AbiAJHn1 (ORCPT ); Mon, 10 Jan 2022 02:43:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48964 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239605AbiAJHa2 (ORCPT ); Mon, 10 Jan 2022 02:30:28 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 210C9C028BA0; Sun, 9 Jan 2022 23:27:30 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DA660B811E3; Mon, 10 Jan 2022 07:27:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09599C36AED; Mon, 10 Jan 2022 07:27:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799647; bh=uiMEUjdZimBbJEhSfJ/Lz/p9wha31d+FjQnysRrddXA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=feNq3h9EXfSyzSMCZXWjW/J8sh5Og0/EZYgQoj248Ms9Nj3CzU7CzsZwPrU/NKqrS luaNtQTsXWBQbsD3R2gOa9KknCViJCkAgjxPgw/yCL+s+0+uzbyqHck/rjMjNC7r3f MoY+N8KiSXu1RL6vrZRf+rlK4N3WvySycDk+2aKA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Roopa Prabhu , "David S. Miller" Subject: [PATCH 4.19 09/21] ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route Date: Mon, 10 Jan 2022 08:23:10 +0100 Message-Id: <20220110071814.264105239@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 1ff15a710a862db1101b97810af14aedc835a86a upstream. Make sure RTA_GATEWAY for IPv6 multipath route has enough bytes to hold an IPv6 address. Fixes: 6b9ea5a64ed5 ("ipv6: fix multipath route replace error recovery") Signed-off-by: David Ahern Cc: Roopa Prabhu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/route.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -4606,7 +4606,11 @@ static int ip6_route_multipath_del(struc =20 nla =3D nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - nla_memcpy(&r_cfg.fc_gateway, nla, 16); + err =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + extack); + if (err) + return err; + r_cfg.fc_flags |=3D RTF_GATEWAY; } } From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CA39C433EF for ; Mon, 10 Jan 2022 07:41:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242450AbiAJHkp (ORCPT ); Mon, 10 Jan 2022 02:40:45 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49454 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240044AbiAJHaa (ORCPT ); Mon, 10 Jan 2022 02:30:30 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 64891C028BA2; Sun, 9 Jan 2022 23:27:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 058D3611AD; Mon, 10 Jan 2022 07:27:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DBEFFC36AED; Mon, 10 Jan 2022 07:27:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799650; bh=AYGIfW94MQBnAGeV9cDSaBI/rEOKwJdLO5F0GReZ6KA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nGiuBvn5GewwGZrxRLtzxaqQlVZ89vbJ7TYt8wV7NmecTZPJbIFmtQ3xu3ZVOalW4 xREh4K+fCKAPAv4dnzyQuKSW19LmxYkt7qDaiNMWFae/4FeltKmhp5Y/Q/EUItsJ5k e0b9x1PKx3SvvrYKJ63HhsuD9Lh+kFhskFYsPRog= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , "David S. Miller" Subject: [PATCH 4.19 10/21] sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc Date: Mon, 10 Jan 2022 08:23:11 +0100 Message-Id: <20220110071814.294402969@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 7d18a07897d07495ee140dd319b0e9265c0f68ba upstream. tx_queue_len can be set to ~0U, we need to be more careful about overflows. __fls(0) is undefined, as this report shows: UBSAN: shift-out-of-bounds in net/sched/sch_qfq.c:1430:24 shift exponent 51770272 is too large for 32-bit type 'int' CPU: 0 PID: 25574 Comm: syz-executor.0 Not tainted 5.16.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x201/0x2d8 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x494/0x530 lib/ubsan.c:330 qfq_init_qdisc+0x43f/0x450 net/sched/sch_qfq.c:1430 qdisc_create+0x895/0x1430 net/sched/sch_api.c:1253 tc_modify_qdisc+0x9d9/0x1e20 net/sched/sch_api.c:1660 rtnetlink_rcv_msg+0x934/0xe60 net/core/rtnetlink.c:5571 netlink_rcv_skb+0x200/0x470 net/netlink/af_netlink.c:2496 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x814/0x9f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0xaea/0xe60 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] ____sys_sendmsg+0x5b9/0x910 net/socket.c:2409 ___sys_sendmsg net/socket.c:2463 [inline] __sys_sendmsg+0x280/0x370 net/socket.c:2492 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cos= t") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/sched/sch_qfq.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -1430,10 +1430,8 @@ static int qfq_init_qdisc(struct Qdisc * if (err < 0) return err; =20 - if (qdisc_dev(sch)->tx_queue_len + 1 > QFQ_MAX_AGG_CLASSES) - max_classes =3D QFQ_MAX_AGG_CLASSES; - else - max_classes =3D qdisc_dev(sch)->tx_queue_len + 1; + max_classes =3D min_t(u64, (u64)qdisc_dev(sch)->tx_queue_len + 1, + QFQ_MAX_AGG_CLASSES); /* max_cl_shift =3D floor(log_2(max_classes)) */ max_cl_shift =3D __fls(max_classes); q->max_agg_classes =3D 1< X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2A75C433FE for ; Mon, 10 Jan 2022 07:31:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239621AbiAJHbC (ORCPT ); Mon, 10 Jan 2022 02:31:02 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57688 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239896AbiAJH1g (ORCPT ); Mon, 10 Jan 2022 02:27:36 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 87868B8120C; Mon, 10 Jan 2022 07:27:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BAA01C36AE9; Mon, 10 Jan 2022 07:27:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799653; bh=/275k3NQs3rCN7zLFL6qyXr2y6x2wVhE8XDWgRNAVbg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G+j90eIaq4+DmYIqSxn1c+njhSIyyBws7DuWi7SxbotgVelp6GwXMc+aK/VuG6mIG V4a4NDgfmBMhgw7j0t2u8drXj8RioHmRSjDZ5f7INWGlbQ0Ux/qgG9tJrtBEER/3Jd DNjb/lshUjT0dyQTLQmcZPFhRgXsT7rLYaH38d4o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kirill Tkhai , "Darrick J. Wong" , "Darrick J. Wong" , Dave Chinner , Eric Sandeen Subject: [PATCH 4.19 11/21] xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate Date: Mon, 10 Jan 2022 08:23:12 +0100 Message-Id: <20220110071814.327260155@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Darrick J. Wong commit 983d8e60f50806f90534cc5373d0ce867e5aaf79 upstream. The old ALLOCSP/FREESP ioctls in XFS can be used to preallocate space at the end of files, just like fallocate and RESVSP. Make the behavior consistent with the other ioctls. Reported-by: Kirill Tkhai Signed-off-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Eric Sandeen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/xfs/xfs_ioctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/xfs/xfs_ioctl.c +++ b/fs/xfs/xfs_ioctl.c @@ -701,7 +701,8 @@ xfs_ioc_space( flags |=3D XFS_PREALLOC_CLEAR; if (bf->l_start > XFS_ISIZE(ip)) { error =3D xfs_alloc_file_space(ip, XFS_ISIZE(ip), - bf->l_start - XFS_ISIZE(ip), 0); + bf->l_start - XFS_ISIZE(ip), + XFS_BMAPI_PREALLOC); if (error) goto out_unlock; } From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2D986C433F5 for ; Mon, 10 Jan 2022 07:30:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240123AbiAJHat (ORCPT ); Mon, 10 Jan 2022 02:30:49 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57708 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239914AbiAJH1i (ORCPT ); Mon, 10 Jan 2022 02:27:38 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 78EBFB81161; Mon, 10 Jan 2022 07:27:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8AB01C36AED; Mon, 10 Jan 2022 07:27:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799656; bh=a9p79g42KhbUvyCMpi2BJr/IlPBqIBQRHTMRjlExEGQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uXBMWomMOH7cnMp3aPOP9MYDJa2bsND++nbGBvt86RQcPrlx8XS4v1L9echlNEQ+8 9yBmYbzz5QxHZDX4JGCICe4xWioSTntsYraFSzXoHGkjc9DxLls+RW2DBa+Bv+3qD/ gYGNDsae30N/mfTOJro6Na7rHJZI/TF4rb7r48VY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor , Nick Desaulniers , Sebastian Reichel Subject: [PATCH 4.19 12/21] power: reset: ltc2952: Fix use of floating point literals Date: Mon, 10 Jan 2022 08:23:13 +0100 Message-Id: <20220110071814.357374599@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nathan Chancellor commit 644106cdb89844be2496b21175b7c0c2e0fab381 upstream. A new commit in LLVM causes an error on the use of 'long double' when '-mno-x87' is used, which the kernel does through an alias, '-mno-80387' (see the LLVM commit below for more details around why it does this). drivers/power/reset/ltc2952-poweroff.c:162:28: error: expression requires = 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not = support it data->wde_interval =3D 300L * 1E6L; ^ drivers/power/reset/ltc2952-poweroff.c:162:21: error: expression requires = 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not = support it data->wde_interval =3D 300L * 1E6L; ^ drivers/power/reset/ltc2952-poweroff.c:163:41: error: expression requires = 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not = support it data->trigger_delay =3D ktime_set(2, 500L*1E6L); ^ 3 errors generated. This happens due to the use of a 'long double' literal. The 'E6' part of '1E6L' causes the literal to be a 'double' then the 'L' suffix promotes it to 'long double'. There is no visible reason for floating point values in this driver, as the values are only assigned to integer types. Use NSEC_PER_MSEC, which is the same integer value as '1E6L', to avoid changing functionality but fix the error. Fixes: 6647156c00cc ("power: reset: add LTC2952 poweroff driver") Link: https://github.com/ClangBuiltLinux/linux/issues/1497 Link: https://github.com/llvm/llvm-project/commit/a8083d42b1c346e21623a1d36= d1f0cadd7801d83 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/power/reset/ltc2952-poweroff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/power/reset/ltc2952-poweroff.c +++ b/drivers/power/reset/ltc2952-poweroff.c @@ -170,8 +170,8 @@ static void ltc2952_poweroff_kill(void) =20 static void ltc2952_poweroff_default(struct ltc2952_poweroff *data) { - data->wde_interval =3D 300L * 1E6L; - data->trigger_delay =3D ktime_set(2, 500L*1E6L); + data->wde_interval =3D 300L * NSEC_PER_MSEC; + data->trigger_delay =3D ktime_set(2, 500L * NSEC_PER_MSEC); =20 hrtimer_init(&data->timer_trigger, CLOCK_MONOTONIC, HRTIMER_MODE_REL); data->timer_trigger.function =3D ltc2952_poweroff_timer_trigger; From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 91064C433F5 for ; Mon, 10 Jan 2022 07:30:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240113AbiAJHax (ORCPT ); Mon, 10 Jan 2022 02:30:53 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:37416 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239916AbiAJH1j (ORCPT ); Mon, 10 Jan 2022 02:27:39 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 82B11611AD; Mon, 10 Jan 2022 07:27:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 61D9BC36AE9; Mon, 10 Jan 2022 07:27:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799658; bh=Nuuso2AXaPE/UBn6/+PB07a/l0ILU5dmO7RdO8QyR9k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Pf22R8cDbNe6z7DjMqvt4OdiSdvdBs7+f3QFWjduik+rHAB7jVqaLIxBzo7xbnNUv 0+k77mzmpDw3g0GOA67wPx50BdwmmWVT6IlvJfJP32Nr+nIvPp4p0mp+dwCwA8Ne0v 9PGNqdWj4suAAWvIkVuBjMg4sH7qBPW/lmTyaXAg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thomas Toye , "David S. Miller" Subject: [PATCH 4.19 13/21] rndis_host: support Hytera digital radios Date: Mon, 10 Jan 2022 08:23:14 +0100 Message-Id: <20220110071814.388736120@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thomas Toye commit 29262e1f773b4b6a43711120be564c57fca07cfb upstream. Hytera makes a range of digital (DMR) radios. These radios can be programmed to a allow a computer to control them over Ethernet over USB, either using NCM or RNDIS. This commit adds support for RNDIS for Hytera radios. I tested with a Hytera PD785 and a Hytera MD785G. When these radios are programmed to set up a Radio to PC Network using RNDIS, an USB interface will be added with class 2 (Communications), subclass 2 (Abstract Modem Control) and an interface protocol of 255 ("vendor specific" - lsusb even hints "MSFT RNDIS?"). This patch is similar to the solution of this StackOverflow user, but that only works for the Hytera MD785: https://stackoverflow.com/a/53550858 To use the "Radio to PC Network" functionality of Hytera DMR radios, the radios need to be programmed correctly in CPS (Hytera's Customer Programming Software). "Forward to PC" should be checked in "Network" (under "General Setting" in "Conventional") and the "USB Network Communication Protocol" should be set to RNDIS. Signed-off-by: Thomas Toye Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/usb/rndis_host.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/net/usb/rndis_host.c +++ b/drivers/net/usb/rndis_host.c @@ -621,6 +621,11 @@ static const struct usb_device_id produc USB_CLASS_COMM, 2 /* ACM */, 0x0ff), .driver_info =3D (unsigned long) &rndis_poll_status_info, }, { + /* Hytera Communications DMR radios' "Radio to PC Network" */ + USB_VENDOR_AND_INTERFACE_INFO(0x238b, + USB_CLASS_COMM, 2 /* ACM */, 0x0ff), + .driver_info =3D (unsigned long)&rndis_info, +}, { /* RNDIS is MSFT's un-official variant of CDC ACM */ USB_INTERFACE_INFO(USB_CLASS_COMM, 2 /* ACM */, 0x0ff), .driver_info =3D (unsigned long) &rndis_info, From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7BEAC433FE for ; Mon, 10 Jan 2022 07:37:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240514AbiAJHhG (ORCPT ); Mon, 10 Jan 2022 02:37:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48272 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240053AbiAJHaa (ORCPT ); Mon, 10 Jan 2022 02:30:30 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4BA35C028BB1; Sun, 9 Jan 2022 23:27:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 130B8B81208; Mon, 10 Jan 2022 07:27:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3883DC36AED; Mon, 10 Jan 2022 07:27:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799661; bh=h+RDHigZyBNMfYVop5KsSMfjlhHiJUgj+VK3fo/isNQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kxMjcEawDjEL0oaRtz4zrp8ayTIYrRaXZ194iiVO7ubhTuezDv9B3qkQflw3D0OyO TqI6BKtQYRQO6XBwtPjhOjhsN5km9rc9auzpfFpHB9959HWs1NFQV6CgPnxmtuLGK9 18VQW5GmchpDgq4pt05xhTZb/EG9wae9ZKBXygSM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangyu Hua , Jakub Kicinski , Aayush Agarwal Subject: [PATCH 4.19 14/21] phonet: refcount leak in pep_sock_accep Date: Mon, 10 Jan 2022 08:23:15 +0100 Message-Id: <20220110071814.418213848@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua commit bcd0f93353326954817a4f9fa55ec57fb38acbb0 upstream. sock_hold(sk) is invoked in pep_sock_accept(), but __sock_put(sk) is not invoked in subsequent failure branches(pep_accept_conn() !=3D 0). Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20211209082839.33985-1-hbh25y@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Aayush Agarwal Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/phonet/pep.c | 1 + 1 file changed, 1 insertion(+) --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -881,6 +881,7 @@ static struct sock *pep_sock_accept(stru =20 err =3D pep_accept_conn(newsk, skb); if (err) { + __sock_put(sk); sock_put(newsk); newsk =3D NULL; goto drop; From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC757C433F5 for ; Mon, 10 Jan 2022 07:43:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239960AbiAJHnR (ORCPT ); Mon, 10 Jan 2022 02:43:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49462 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240058AbiAJHaa (ORCPT ); Mon, 10 Jan 2022 02:30:30 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 25A23C028BB7; Sun, 9 Jan 2022 23:27:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E2B63B81205; Mon, 10 Jan 2022 07:27:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1B44BC36AE9; Mon, 10 Jan 2022 07:27:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799664; bh=ldemisgRMwXP+iN87RvpgDewWLe8tBYlf7SosR+KaLA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AUXaAhxkUqVUytXfA64Y7N8UU7cTCgrEnmuwenvUu0HL0xe9Gt8Exw1uBkmfMmYZB JjcB+BNdqOcfF6BqijQc32E6kfAmz6yZ9ZhZKbHDLwej7lufpBtbEtggjvSnxZiyVf OhpcK0FpDrqNt+G0Ukm81T5jvJ549+hWe2dJgapI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Nicolas Dichtel , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.19 15/21] ipv6: Continue processing multipath route even if gateway attribute is invalid Date: Mon, 10 Jan 2022 08:23:16 +0100 Message-Id: <20220110071814.448271281@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern [ Upstream commit e30a845b0376eb51c9c94f56bbd53b2e08ba822f ] ip6_route_multipath_del loop continues processing the multipath attribute even if delete of a nexthop path fails. For consistency, do the same if the gateway attribute is invalid. Fixes: 1ff15a710a86 ("ipv6: Check attribute length for RTA_GATEWAY when del= eting multipath route") Signed-off-by: David Ahern Acked-by: Nicolas Dichtel Link: https://lore.kernel.org/r/20220103171911.94739-1-dsahern@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/route.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 1bc81be07ccda..8a437c20eeccd 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -4608,8 +4608,10 @@ static int ip6_route_multipath_del(struct fib6_confi= g *cfg, if (nla) { err =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, extack); - if (err) - return err; + if (err) { + last_err =3D err; + goto next_rtnh; + } =20 r_cfg.fc_flags |=3D RTF_GATEWAY; } @@ -4618,6 +4620,7 @@ static int ip6_route_multipath_del(struct fib6_config= *cfg, if (err) last_err =3D err; =20 +next_rtnh: rtnh =3D rtnh_next(rtnh, &remaining); } =20 --=20 2.34.1 From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09CAFC433EF for ; Mon, 10 Jan 2022 07:43:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240602AbiAJHnH (ORCPT ); Mon, 10 Jan 2022 02:43:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48992 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240068AbiAJHaa (ORCPT ); Mon, 10 Jan 2022 02:30:30 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EDE3CC028BB8; Sun, 9 Jan 2022 23:27:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 98D80B811FE; Mon, 10 Jan 2022 07:27:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E3E9FC36AE9; Mon, 10 Jan 2022 07:27:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799667; bh=ZITSXJpqyzXFFGqs6E0wZpm/00mLeMXlZhAJ7ccawaA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=n0IKrJU8FiYWBIIl2b7AMoXjTXhpA3rHprcPMyHDsSoQWIl/Tgsok0S/YsYUZkhB9 EmXPUG0nN2UB/rhnw8kPq4MnYczEn4eeVq2N5LZDq5jYro0/MvwVMlQ5LBlk75LdDV OrJVS6t4+cYLYSYNeDD9i7wf5QdqstywApa0JKro= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Nicolas Dichtel , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.19 16/21] ipv6: Do cleanup if attribute validation fails in multipath route Date: Mon, 10 Jan 2022 08:23:17 +0100 Message-Id: <20220110071814.479947128@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern [ Upstream commit 95bdba23b5b4aa75fe3e6c84335e638641c707bb ] As Nicolas noted, if gateway validation fails walking the multipath attribute the code should jump to the cleanup to free previously allocated memory. Fixes: 1ff15a710a86 ("ipv6: Check attribute length for RTA_GATEWAY when del= eting multipath route") Signed-off-by: David Ahern Acked-by: Nicolas Dichtel Link: https://lore.kernel.org/r/20220103170555.94638-1-dsahern@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/route.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 8a437c20eeccd..7e3ab23fc995c 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -4466,12 +4466,10 @@ static int ip6_route_multipath_add(struct fib6_conf= ig *cfg, =20 nla =3D nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - int ret; - - ret =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + err =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, extack); - if (ret) - return ret; + if (err) + goto cleanup; =20 r_cfg.fc_flags |=3D RTF_GATEWAY; } --=20 2.34.1 From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC53FC4332F for ; Mon, 10 Jan 2022 07:30:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240451AbiAJHai (ORCPT ); Mon, 10 Jan 2022 02:30:38 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:35846 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239452AbiAJH1O (ORCPT ); Mon, 10 Jan 2022 02:27:14 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B0312611BB; Mon, 10 Jan 2022 07:27:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 95C4BC36AED; Mon, 10 Jan 2022 07:27:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799633; bh=3/dwJjTOfy7aBth/bsOx6Zpwo8PENZBu+h2VbuE/B4A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=s8SwMlrsnkZ5f444YPYPNlBc/tUgpE7gOM4HDSg0910c+0OscQ8t2QBb9+k72mT+X FGrBdMxMj53pGgC4FqaWUha+Z+4F5ik7mz58lAD44js2+yO9ZNpBe4xpIa7miJrz1O +jWanKYa0GsrSnZvhAJA9pvYuMduU3kVjoFwntwM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chunfeng Yun , Sasha Levin Subject: [PATCH 4.19 17/21] usb: mtu3: fix interval value for intr and isoc Date: Mon, 10 Jan 2022 08:23:18 +0100 Message-Id: <20220110071814.517246143@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chunfeng Yun [ Upstream commit e3d4621c22f90c33321ae6a6baab60cdb8e5a77c ] Use the Interval value from isoc/intr endpoint descriptor, no need minus one. The original code doesn't cause transfer error for normal cases, but it may have side effect with respond time of ERDY or tPingTimeout. Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20211218095749.6250-1-chunfeng.yun@mediatek= .com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/mtu3/mtu3_gadget.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c index 07a6ee8db6123..9f0c949820bf7 100644 --- a/drivers/usb/mtu3/mtu3_gadget.c +++ b/drivers/usb/mtu3/mtu3_gadget.c @@ -82,7 +82,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { interval =3D desc->bInterval; - interval =3D clamp_val(interval, 1, 16) - 1; + interval =3D clamp_val(interval, 1, 16); if (usb_endpoint_xfer_isoc(desc) && comp_desc) mult =3D comp_desc->bmAttributes; } @@ -94,7 +94,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) if (usb_endpoint_xfer_isoc(desc) || usb_endpoint_xfer_int(desc)) { interval =3D desc->bInterval; - interval =3D clamp_val(interval, 1, 16) - 1; + interval =3D clamp_val(interval, 1, 16); mult =3D usb_endpoint_maxp_mult(desc) - 1; } break; --=20 2.34.1 From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9EA9C433EF for ; Mon, 10 Jan 2022 07:31:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240493AbiAJHbF (ORCPT ); Mon, 10 Jan 2022 02:31:05 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:37100 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239858AbiAJH1Q (ORCPT ); Mon, 10 Jan 2022 02:27:16 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 80410611E8; Mon, 10 Jan 2022 07:27:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6101FC36AE9; Mon, 10 Jan 2022 07:27:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799635; bh=t/vg6+0MCYCqR0tDpocT+m087pz0IO+yyRzP8Wf4DPc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GFLMHLgcLlvHBz9ochAVzwsJpi4EI1WyaBDF0EbYZfzDIR6P1T8/337S0z6TbF0BW b+VYFgf5lkLj7U7kFOhRrUoux0KZLF5cPvHeSMKAIPSDqUUYsQsfAChRiQYTvIJzgZ dKDCY1LdBwMwfYiNumOdwIxOEmuHqg22967REClA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lu Tixiong , Mike Christie , Lee Duncan , Lixiaokeng , Linfeilong , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.19 18/21] scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() Date: Mon, 10 Jan 2022 08:23:19 +0100 Message-Id: <20220110071814.547553024@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lixiaokeng [ Upstream commit 1b8d0300a3e9f216ae4901bab886db7299899ec6 ] |- iscsi_if_destroy_conn |-dev_attr_show |-iscsi_conn_teardown |-spin_lock_bh |-iscsi_sw_tcp_conn_get_param |-kfree(conn->persistent_address) |-iscsi_conn_get_param |-kfree(conn->local_ipaddr) =3D=3D>|-read persistent_address =3D=3D>|-read local_ipaddr |-spin_unlock_bh When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a UAF may be triggered. Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei= .com Reported-by: Lu Tixiong Reviewed-by: Mike Christie Reviewed-by: Lee Duncan Signed-off-by: Lixiaokeng Signed-off-by: Linfeilong Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/libiscsi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index 5607fe8541c3a..cb314e3a0fc7a 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -2986,6 +2986,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_c= onn) { struct iscsi_conn *conn =3D cls_conn->dd_data; struct iscsi_session *session =3D conn->session; + char *tmp_persistent_address =3D conn->persistent_address; + char *tmp_local_ipaddr =3D conn->local_ipaddr; =20 del_timer_sync(&conn->transport_timer); =20 @@ -3007,8 +3009,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_c= onn) spin_lock_bh(&session->frwd_lock); free_pages((unsigned long) conn->data, get_order(ISCSI_DEF_MAX_RECV_SEG_LEN)); - kfree(conn->persistent_address); - kfree(conn->local_ipaddr); /* regular RX path uses back_lock */ spin_lock_bh(&session->back_lock); kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task, @@ -3020,6 +3020,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_c= onn) mutex_unlock(&session->eh_mutex); =20 iscsi_destroy_conn(cls_conn); + kfree(tmp_persistent_address); + kfree(tmp_local_ipaddr); } EXPORT_SYMBOL_GPL(iscsi_conn_teardown); =20 --=20 2.34.1 From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E98C5C433F5 for ; Mon, 10 Jan 2022 07:30:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239262AbiAJHap (ORCPT ); Mon, 10 Jan 2022 02:30:45 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:37136 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239863AbiAJH1T (ORCPT ); Mon, 10 Jan 2022 02:27:19 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 46D57611BF; Mon, 10 Jan 2022 07:27:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31122C36AED; Mon, 10 Jan 2022 07:27:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799638; bh=G91amtRbf+ax2WZaKcF1yc1l7QMc+kVlaF0CSrpbbzM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t0dI80NZmPhahUvUj8ZuPehkC/qicEvypMwnZiFtFNEZ8rAAorSrHwkHqznqM0kbd mtOxuP2TIJSMwaKA3L5NJmVRcU7kCnsCDhOm4PfSiEyx0In1uAminXrsggenfc5MZC sXQ6akaLf8ePBWyNp5PnSkM535wHryarHB4UvUtE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, William Zhao , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 19/21] ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate Date: Mon, 10 Jan 2022 08:23:20 +0100 Message-Id: <20220110071814.578740736@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: William Zhao [ Upstream commit c1833c3964d5bd8c163bd4e01736a38bc473cb8a ] The "__ip6_tnl_parm" struct was left uninitialized causing an invalid load of random data when the "__ip6_tnl_parm" struct was used elsewhere. As an example, in the function "ip6_tnl_xmit_ctl()", it tries to access the "collect_md" member. With "__ip6_tnl_parm" being uninitialized and containing random data, the UBSAN detected that "collect_md" held a non-boolean value. The UBSAN issue is as follows: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D UBSAN: invalid-load in net/ipv6/ip6_tunnel.c:1025:14 load of value 30 is not a valid value for type '_Bool' CPU: 1 PID: 228 Comm: kworker/1:3 Not tainted 5.16.0-rc4+ #8 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: dump_stack_lvl+0x44/0x57 ubsan_epilogue+0x5/0x40 __ubsan_handle_load_invalid_value+0x66/0x70 ? __cpuhp_setup_state+0x1d3/0x210 ip6_tnl_xmit_ctl.cold.52+0x2c/0x6f [ip6_tunnel] vti6_tnl_xmit+0x79c/0x1e96 [ip6_vti] ? lock_is_held_type+0xd9/0x130 ? vti6_rcv+0x100/0x100 [ip6_vti] ? lock_is_held_type+0xd9/0x130 ? rcu_read_lock_bh_held+0xc0/0xc0 ? lock_acquired+0x262/0xb10 dev_hard_start_xmit+0x1e6/0x820 __dev_queue_xmit+0x2079/0x3340 ? mark_lock.part.52+0xf7/0x1050 ? netdev_core_pick_tx+0x290/0x290 ? kvm_clock_read+0x14/0x30 ? kvm_sched_clock_read+0x5/0x10 ? sched_clock_cpu+0x15/0x200 ? find_held_lock+0x3a/0x1c0 ? lock_release+0x42f/0xc90 ? lock_downgrade+0x6b0/0x6b0 ? mark_held_locks+0xb7/0x120 ? neigh_connected_output+0x31f/0x470 ? lockdep_hardirqs_on+0x79/0x100 ? neigh_connected_output+0x31f/0x470 ? ip6_finish_output2+0x9b0/0x1d90 ? rcu_read_lock_bh_held+0x62/0xc0 ? ip6_finish_output2+0x9b0/0x1d90 ip6_finish_output2+0x9b0/0x1d90 ? ip6_append_data+0x330/0x330 ? ip6_mtu+0x166/0x370 ? __ip6_finish_output+0x1ad/0xfb0 ? nf_hook_slow+0xa6/0x170 ip6_output+0x1fb/0x710 ? nf_hook.constprop.32+0x317/0x430 ? ip6_finish_output+0x180/0x180 ? __ip6_finish_output+0xfb0/0xfb0 ? lock_is_held_type+0xd9/0x130 ndisc_send_skb+0xb33/0x1590 ? __sk_mem_raise_allocated+0x11cf/0x1560 ? dst_output+0x4a0/0x4a0 ? ndisc_send_rs+0x432/0x610 addrconf_dad_completed+0x30c/0xbb0 ? addrconf_rs_timer+0x650/0x650 ? addrconf_dad_work+0x73c/0x10e0 addrconf_dad_work+0x73c/0x10e0 ? addrconf_dad_completed+0xbb0/0xbb0 ? rcu_read_lock_sched_held+0xaf/0xe0 ? rcu_read_lock_bh_held+0xc0/0xc0 process_one_work+0x97b/0x1740 ? pwq_dec_nr_in_flight+0x270/0x270 worker_thread+0x87/0xbf0 ? process_one_work+0x1740/0x1740 kthread+0x3ac/0x490 ? set_kthread_struct+0x100/0x100 ret_from_fork+0x22/0x30 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The solution is to initialize "__ip6_tnl_parm" struct to zeros in the "vti6_siocdevprivate()" function. Signed-off-by: William Zhao Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/ip6_vti.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c index 290badfe70e06..866ce815625e5 100644 --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -799,6 +799,8 @@ vti6_ioctl(struct net_device *dev, struct ifreq *ifr, i= nt cmd) struct net *net =3D dev_net(dev); struct vti6_net *ip6n =3D net_generic(net, vti6_net_id); =20 + memset(&p1, 0, sizeof(p1)); + switch (cmd) { case SIOCGETTUNNEL: if (dev =3D=3D ip6n->fb_tnl_dev) { --=20 2.34.1 From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB2F2C433F5 for ; Mon, 10 Jan 2022 07:30:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239708AbiAJHal (ORCPT ); Mon, 10 Jan 2022 02:30:41 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:37184 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239497AbiAJH1W (ORCPT ); Mon, 10 Jan 2022 02:27:22 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 15B5F611B9; Mon, 10 Jan 2022 07:27:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1622C36AE9; Mon, 10 Jan 2022 07:27:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799641; bh=oW7SX6sqfjaQ3jE8DPtXe+hyra05TsoG2/m6gHOLZjA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iP1j7RxoIX74QFZJjDHLzTifF3Sc6PL2jk65+Q9CZqVhGSjTK+G8DkBd01fZx2bR9 UJ+z188vqBThYXUWZqbY87iOUnSlhkIhvMXd4XZQbU+wWlLYBH5CQNJHx6+jhc+06O zkdcNr1Sy0gDCBC6r5vm703qFs2Up5VqhsYI6lpI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, yangxingwu , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 20/21] net: udp: fix alignment problem in udp4_seq_show() Date: Mon, 10 Jan 2022 08:23:21 +0100 Message-Id: <20220110071814.615293887@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: yangxingwu [ Upstream commit 6c25449e1a32c594d743df8e8258e8ef870b6a77 ] $ cat /pro/net/udp before: sl local_address rem_address st tx_queue rx_queue tr tm->when 26050: 0100007F:0035 00000000:0000 07 00000000:00000000 00:00000000 26320: 0100007F:0143 00000000:0000 07 00000000:00000000 00:00000000 27135: 00000000:8472 00000000:0000 07 00000000:00000000 00:00000000 after: sl local_address rem_address st tx_queue rx_queue tr tm->when 26050: 0100007F:0035 00000000:0000 07 00000000:00000000 00:00000000 26320: 0100007F:0143 00000000:0000 07 00000000:00000000 00:00000000 27135: 00000000:8472 00000000:0000 07 00000000:00000000 00:00000000 Signed-off-by: yangxingwu Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/udp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index fce32f3e42b54..b7acb6afdbce6 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -2845,7 +2845,7 @@ int udp4_seq_show(struct seq_file *seq, void *v) { seq_setwidth(seq, 127); if (v =3D=3D SEQ_START_TOKEN) - seq_puts(seq, " sl local_address rem_address st tx_queue " + seq_puts(seq, " sl local_address rem_address st tx_queue " "rx_queue tr tm->when retrnsmt uid timeout " "inode ref pointer drops"); else { --=20 2.34.1 From nobody Wed Jul 1 23:24:02 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D170BC433FE for ; Mon, 10 Jan 2022 07:31:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240477AbiAJHa7 (ORCPT ); Mon, 10 Jan 2022 02:30:59 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:37212 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239512AbiAJH10 (ORCPT ); Mon, 10 Jan 2022 02:27:26 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 52FA5611C4; Mon, 10 Jan 2022 07:27:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 316A8C36AED; Mon, 10 Jan 2022 07:27:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799644; bh=Ryn0r3NAKNZ9E1Jqj6JP6t4Ph3g8R6NUFHrMJ/x8N4I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ORcWM63Hb6LeUdrj8q1tbEJZg4GDfhZjavzEnfRS8GAIleYMScbsE6ukuMZ5OtN4g x/Ttor9dTn35ATVHrXvPsL96rxGKha/crISAB4ADz2Ly5vEGiPTWP21W43xnTnreep SNlS2yflkY8yDyO1o2//6uBdrgA6W3ez/Ce8i9sk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, wolfgang huang , k2ci , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 21/21] mISDN: change function names to avoid conflicts Date: Mon, 10 Jan 2022 08:23:22 +0100 Message-Id: <20220110071814.646530840@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071813.967414697@linuxfoundation.org> References: <20220110071813.967414697@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: wolfgang huang [ Upstream commit 8b5fdfc57cc2471179d1c51081424ded833c16c8 ] As we build for mips, we meet following error. l1_init error with multiple definition. Some architecture devices usually marked with l1, l2, lxx as the start-up phase. so we change the mISDN function names, align with Isdnl2_xxx. mips-linux-gnu-ld: drivers/isdn/mISDN/layer1.o: in function `l1_init': (.text+0x890): multiple definition of `l1_init'; \ arch/mips/kernel/bmips_5xxx_init.o:(.text+0xf0): first defined here make[1]: *** [home/mips/kernel-build/linux/Makefile:1161: vmlinux] Error 1 Signed-off-by: wolfgang huang Reported-by: k2ci Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/isdn/mISDN/core.c | 6 +++--- drivers/isdn/mISDN/core.h | 4 ++-- drivers/isdn/mISDN/layer1.c | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c index faf505462a4f5..f5a06a6fb297f 100644 --- a/drivers/isdn/mISDN/core.c +++ b/drivers/isdn/mISDN/core.c @@ -390,7 +390,7 @@ mISDNInit(void) err =3D mISDN_inittimer(&debug); if (err) goto error2; - err =3D l1_init(&debug); + err =3D Isdnl1_Init(&debug); if (err) goto error3; err =3D Isdnl2_Init(&debug); @@ -404,7 +404,7 @@ mISDNInit(void) error5: Isdnl2_cleanup(); error4: - l1_cleanup(); + Isdnl1_cleanup(); error3: mISDN_timer_cleanup(); error2: @@ -417,7 +417,7 @@ static void mISDN_cleanup(void) { misdn_sock_cleanup(); Isdnl2_cleanup(); - l1_cleanup(); + Isdnl1_cleanup(); mISDN_timer_cleanup(); class_unregister(&mISDN_class); =20 diff --git a/drivers/isdn/mISDN/core.h b/drivers/isdn/mISDN/core.h index 52695bb81ee7a..3c039b6ade2e1 100644 --- a/drivers/isdn/mISDN/core.h +++ b/drivers/isdn/mISDN/core.h @@ -69,8 +69,8 @@ struct Bprotocol *get_Bprotocol4id(u_int); extern int mISDN_inittimer(u_int *); extern void mISDN_timer_cleanup(void); =20 -extern int l1_init(u_int *); -extern void l1_cleanup(void); +extern int Isdnl1_Init(u_int *); +extern void Isdnl1_cleanup(void); extern int Isdnl2_Init(u_int *); extern void Isdnl2_cleanup(void); =20 diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c index 3192b0eb39445..284d3a9c7df7d 100644 --- a/drivers/isdn/mISDN/layer1.c +++ b/drivers/isdn/mISDN/layer1.c @@ -407,7 +407,7 @@ create_l1(struct dchannel *dch, dchannel_l1callback *dc= b) { EXPORT_SYMBOL(create_l1); =20 int -l1_init(u_int *deb) +Isdnl1_Init(u_int *deb) { debug =3D deb; l1fsm_s.state_count =3D L1S_STATE_COUNT; @@ -418,7 +418,7 @@ l1_init(u_int *deb) } =20 void -l1_cleanup(void) +Isdnl1_cleanup(void) { mISDN_FsmFree(&l1fsm_s); } --=20 2.34.1