From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2904FC433EF for ; Mon, 10 Jan 2022 07:34:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240644AbiAJHeR (ORCPT ); Mon, 10 Jan 2022 02:34:17 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:38798 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240238AbiAJH3c (ORCPT ); Mon, 10 Jan 2022 02:29:32 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 607AA611B7; Mon, 10 Jan 2022 07:29:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43978C36AE9; Mon, 10 Jan 2022 07:29:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799771; bh=C3+AgHOGPU/JduDV9eThrDNKId/d6U1n4jEsZ2VuWJI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bCd6g9REulTuB5NyjytX/3iyEOzjBJK1bYspdDUam1PhNrrkehRyGZaq+R8pvRgfI egkv6Bs/Kej4eEBKqiRzDjpZnYe3v8ZBalOBgp+FWOE9baN2ejI9IY+s3BK07e0giX oybqnISVMClTVk6ICTxtkws63K3a4NEMk6Owhk/Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yi Zhuang , Chao Yu , Jaegeuk Kim Subject: [PATCH 5.10 01/43] f2fs: quota: fix potential deadlock Date: Mon, 10 Jan 2022 08:22:58 +0100 Message-Id: <20220110071817.386947432@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chao Yu commit a5c0042200b28fff3bde6fa128ddeaef97990f8d upstream. As Yi Zhuang reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=3D214299 There is potential deadlock during quota data flush as below: Thread A: Thread B: f2fs_dquot_acquire down_read(&sbi->quota_sem) f2fs_write_checkpoint block_operations f2fs_look_all down_write(&sbi->cp_rwsem) f2fs_quota_write f2fs_write_begin __do_map_lock f2fs_lock_op down_read(&sbi->cp_rwsem) __need_flush_qutoa down_write(&sbi->quota_sem) This patch changes block_operations() to use trylock, if it fails, it means there is potential quota data updater, in this condition, let's flush quota data first and then trylock again to check dirty status of quota data. The side effect is: in heavy race condition (e.g. multi quota data upaters vs quota data flusher), it may decrease the probability of synchronizing quota data successfully in checkpoint() due to limited retry time of quota flush. Reported-by: Yi Zhuang Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/f2fs/checkpoint.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/f2fs/checkpoint.c +++ b/fs/f2fs/checkpoint.c @@ -1147,7 +1147,8 @@ static bool __need_flush_quota(struct f2 if (!is_journalled_quota(sbi)) return false; =20 - down_write(&sbi->quota_sem); + if (!down_write_trylock(&sbi->quota_sem)) + return true; if (is_sbi_flag_set(sbi, SBI_QUOTA_SKIP_FLUSH)) { ret =3D false; } else if (is_sbi_flag_set(sbi, SBI_QUOTA_NEED_REPAIR)) { From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0573FC433FE for ; Mon, 10 Jan 2022 07:42:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240417AbiAJHlO (ORCPT ); Mon, 10 Jan 2022 02:41:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49908 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240945AbiAJHea (ORCPT ); Mon, 10 Jan 2022 02:34:30 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BF34EC025393; Sun, 9 Jan 2022 23:29:49 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5D4E1611BB; Mon, 10 Jan 2022 07:29:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E354C36AED; Mon, 10 Jan 2022 07:29:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799788; bh=amkLwSEaFB8ELixfHTAcmT95x8/YFpi2ur/98Fmnou8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UbtnyqRQws2EL4w7fjHK8pyzCAyTbvhCcIQOXSNPXSN2Y0zCMX9SyYCqfG1kgDKsg dJg4OklPG4d/lrk6X3PDbFyvkqBPIFmJGCtOE41obp9f8S3EOZi7Zc3pXcNMNwxei9 rmWGPkXSWkue+8o4dxHurZOpmiIdKN3Nm9cku0C0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shuah Khan , Naresh Kamboju Subject: [PATCH 5.10 02/43] selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv() Date: Mon, 10 Jan 2022 08:22:59 +0100 Message-Id: <20220110071817.417485930@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Shuah Khan commit dd40f44eabe1e122c6852fabb298aac05b083fce upstream. Fix the following [-Wstringop-overread] by passing in the variable instead of the value. test_vsyscall.c: In function =E2=80=98test_process_vm_readv=E2=80=99: test_vsyscall.c:500:22: warning: =E2=80=98__builtin_memcmp_eq=E2=80=99 spec= ified bound 4096 exceeds source size 0 [-Wstringop-overread] 500 | if (!memcmp(buf, (const void *)0xffffffffff600000, = 4096)) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~= ~~~~~ Signed-off-by: Shuah Khan Cc: Naresh Kamboju Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- tools/testing/selftests/x86/test_vsyscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/tools/testing/selftests/x86/test_vsyscall.c +++ b/tools/testing/selftests/x86/test_vsyscall.c @@ -497,7 +497,7 @@ static int test_process_vm_readv(void) } =20 if (vsyscall_map_r) { - if (!memcmp(buf, (const void *)0xffffffffff600000, 4096)) { + if (!memcmp(buf, remote.iov_base, sizeof(buf))) { printf("[OK]\tIt worked and read correct data\n"); } else { printf("[FAIL]\tIt worked but returned incorrect data\n"); From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF2E9C4332F for ; Mon, 10 Jan 2022 07:36:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241117AbiAJHes (ORCPT ); Mon, 10 Jan 2022 02:34:48 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:38958 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240287AbiAJH3w (ORCPT ); Mon, 10 Jan 2022 02:29:52 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2DEC1611B9; Mon, 10 Jan 2022 07:29:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12F78C36AED; Mon, 10 Jan 2022 07:29:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799791; bh=GqWQxPWk02utLlyyVmTZ6EM+cy42VaDZDb+7b6voeU0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BYRjVrbKrwN6bdNU+Xx9fSAhWxnJIwIhFKa88Q5OjDX9wgkd5dcqNcc001rzER7mf dzbdYFLC6LS5auNO4wMCO3vWfprCPcJDG2WMeyHD+DUibbrPoIe43fq7SVFLPNw3TG r4LOan3zb8QbdMwSeh3tyYetzCR6xzhI1xlgJFyA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Naveen N. Rao" , Steven Rostedt Subject: [PATCH 5.10 03/43] tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() Date: Mon, 10 Jan 2022 08:23:00 +0100 Message-Id: <20220110071817.449633154@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Naveen N. Rao commit 823e670f7ed616d0ce993075c8afe0217885f79d upstream. With the new osnoise tracer, we are seeing the below splat: Kernel attempted to read user page (c7d880000) - exploit attempt? (uid:= 0) BUG: Unable to handle kernel data access on read at 0xc7d880000 Faulting instruction address: 0xc0000000002ffa10 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=3D64K MMU=3DRadix SMP NR_CPUS=3D2048 NUMA pSeries ... NIP [c0000000002ffa10] __trace_array_vprintk.part.0+0x70/0x2f0 LR [c0000000002ff9fc] __trace_array_vprintk.part.0+0x5c/0x2f0 Call Trace: [c0000008bdd73b80] [c0000000001c49cc] put_prev_task_fair+0x3c/0x60 (unr= eliable) [c0000008bdd73be0] [c000000000301430] trace_array_printk_buf+0x70/0x90 [c0000008bdd73c00] [c0000000003178b0] trace_sched_switch_callback+0x250= /0x290 [c0000008bdd73c90] [c000000000e70d60] __schedule+0x410/0x710 [c0000008bdd73d40] [c000000000e710c0] schedule+0x60/0x130 [c0000008bdd73d70] [c000000000030614] interrupt_exit_user_prepare_main+= 0x264/0x270 [c0000008bdd73de0] [c000000000030a70] syscall_exit_prepare+0x150/0x180 [c0000008bdd73e10] [c00000000000c174] system_call_vectored_common+0xf4/= 0x278 osnoise tracer on ppc64le is triggering osnoise_taint() for negative duration in get_int_safe_duration() called from trace_sched_switch_callback()->thread_exit(). The problem though is that the check for a valid trace_percpu_buffer is incorrect in get_trace_buf(). The check is being done after calculating the pointer for the current cpu, rather than on the main percpu pointer. Fix the check to be against trace_percpu_buffer. Link: https://lkml.kernel.org/r/a920e4272e0b0635cf20c444707cbce1b2c8973d.16= 40255304.git.naveen.n.rao@linux.vnet.ibm.com Cc: stable@vger.kernel.org Fixes: e2ace001176dc9 ("tracing: Choose static tp_printk buffer by explicit= nesting count") Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -3144,7 +3144,7 @@ static char *get_trace_buf(void) { struct trace_buffer_struct *buffer =3D this_cpu_ptr(trace_percpu_buffer); =20 - if (!buffer || buffer->nesting >=3D 4) + if (!trace_percpu_buffer || buffer->nesting >=3D 4) return NULL; =20 buffer->nesting++; From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EB6FC433EF for ; Mon, 10 Jan 2022 07:36:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240503AbiAJHgR (ORCPT ); Mon, 10 Jan 2022 02:36:17 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:56806 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240360AbiAJH34 (ORCPT ); Mon, 10 Jan 2022 02:29:56 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 93FA1B81202; Mon, 10 Jan 2022 07:29:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D9FB5C36AE9; Mon, 10 Jan 2022 07:29:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799794; bh=IsNMZc8RKQRSTDpyDsA1lnZ9piQv3Yrxyp9sRVEBJlk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1nrJhzfmzjbtD/bT14DnXuV/3JjOQtStMJH2J3r5p19uzFPN2Gas/+2JfYAA72Tgc 4m4Rc5W/AZ/cFhO0nuGo+5ClHEgxvuk/Uf1qkdzaF12yJ/BNbSDDT7XjproFnZsbJ8 Kd5ziiUHRQ30eHusinSQmF0yS2ksvvTaS4jVg8R8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , "Naveen N. Rao" , Steven Rostedt Subject: [PATCH 5.10 04/43] tracing: Tag trace_percpu_buffer as a percpu pointer Date: Mon, 10 Jan 2022 08:23:01 +0100 Message-Id: <20220110071817.479474258@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Naveen N. Rao commit f28439db470cca8b6b082239314e9fd10bd39034 upstream. Tag trace_percpu_buffer as a percpu pointer to resolve warnings reported by sparse: /linux/kernel/trace/trace.c:3218:46: warning: incorrect type in initializ= er (different address spaces) /linux/kernel/trace/trace.c:3218:46: expected void const [noderef] __p= ercpu *__vpp_verify /linux/kernel/trace/trace.c:3218:46: got struct trace_buffer_struct * /linux/kernel/trace/trace.c:3234:9: warning: incorrect type in initialize= r (different address spaces) /linux/kernel/trace/trace.c:3234:9: expected void const [noderef] __pe= rcpu *__vpp_verify /linux/kernel/trace/trace.c:3234:9: got int * Link: https://lkml.kernel.org/r/ebabd3f23101d89cb75671b68b6f819f5edc830b.16= 40255304.git.naveen.n.rao@linux.vnet.ibm.com Cc: stable@vger.kernel.org Reported-by: kernel test robot Fixes: 07d777fe8c398 ("tracing: Add percpu buffers for trace_printk()") Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/trace/trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -3134,7 +3134,7 @@ struct trace_buffer_struct { char buffer[4][TRACE_BUF_SIZE]; }; =20 -static struct trace_buffer_struct *trace_percpu_buffer; +static struct trace_buffer_struct __percpu *trace_percpu_buffer; =20 /* * Thise allows for lockless recording. If we're nested too deeply, then @@ -3163,7 +3163,7 @@ static void put_trace_buf(void) =20 static int alloc_percpu_trace_buffer(void) { - struct trace_buffer_struct *buffers; + struct trace_buffer_struct __percpu *buffers; =20 if (trace_percpu_buffer) return 0; From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E06ACC433FE for ; Mon, 10 Jan 2022 07:36:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240813AbiAJHgU (ORCPT ); Mon, 10 Jan 2022 02:36:20 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:38994 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232519AbiAJH36 (ORCPT ); Mon, 10 Jan 2022 02:29:58 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C16B5611C1; Mon, 10 Jan 2022 07:29:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A7A6CC36B00; Mon, 10 Jan 2022 07:29:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799797; bh=W1D9UO82cgAo6aiHdohcnepskgBlIB9uzCRajtDZ34M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oooZBsjSt1A5i3wnwEgvKotNTRZKupxA5p+PaHjUdAyFth5jLAPS5UbcxUBd1yw1/ pnkeNk8qLwc+z+ArRzufhTkL236jvwo5N6wEsojcYlsqYXt8uToHB/WtyPLhnK8Hw/ /WMj0FND2iue4rI6w1WJiPlFFwCUMwljz16QEIEw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Potapenko , Alexander Aring , Pavel Skripkin , Stefan Schmidt Subject: [PATCH 5.10 05/43] ieee802154: atusb: fix uninit value in atusb_set_extended_addr Date: Mon, 10 Jan 2022 08:23:02 +0100 Message-Id: <20220110071817.521262640@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin commit 754e4382354f7908923a1949d8dc8d05f82f09cb upstream. Alexander reported a use of uninitialized value in atusb_set_extended_addr(), that is caused by reading 0 bytes via usb_control_msg(). Fix it by validating if the number of bytes transferred is actually correct, since usb_control_msg() may read less bytes, than was requested by caller. Fail log: BUG: KASAN: uninit-cmp in ieee802154_is_valid_extended_unicast_addr include= /linux/ieee802154.h:310 [inline] BUG: KASAN: uninit-cmp in atusb_set_extended_addr drivers/net/ieee802154/at= usb.c:1000 [inline] BUG: KASAN: uninit-cmp in atusb_probe.cold+0x29f/0x14db drivers/net/ieee802= 154/atusb.c:1056 Uninit value used in comparison: 311daa649a2003bd stack handle: 000000009a2= 003bd ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [= inline] atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline] atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056 usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396 Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver") Reported-by: Alexander Potapenko Acked-by: Alexander Aring Signed-off-by: Pavel Skripkin Link: https://lore.kernel.org/r/20220104182806.7188-1-paskripkin@gmail.com Signed-off-by: Stefan Schmidt Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ieee802154/atusb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/drivers/net/ieee802154/atusb.c +++ b/drivers/net/ieee802154/atusb.c @@ -93,7 +93,9 @@ static int atusb_control_msg(struct atus =20 ret =3D usb_control_msg(usb_dev, pipe, request, requesttype, value, index, data, size, timeout); - if (ret < 0) { + if (ret < size) { + ret =3D ret < 0 ? ret : -ENODATA; + atusb->err =3D ret; dev_err(&usb_dev->dev, "%s: req 0x%02x val 0x%x idx 0x%x, error %d\n", @@ -861,9 +863,9 @@ static int atusb_get_and_show_build(stru if (!build) return -ENOMEM; =20 - ret =3D atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0), - ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0, - build, ATUSB_BUILD_SIZE, 1000); + /* We cannot call atusb_control_msg() here, since this request may read v= arious length data */ + ret =3D usb_control_msg(atusb->usb_dev, usb_rcvctrlpipe(usb_dev, 0), ATUS= B_BUILD, + ATUSB_REQ_FROM_DEV, 0, 0, build, ATUSB_BUILD_SIZE, 1000); if (ret >=3D 0) { build[ret] =3D 0; dev_info(&usb_dev->dev, "Firmware: build %s\n", build); From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B65BAC433F5 for ; Mon, 10 Jan 2022 07:44:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241421AbiAJHoN (ORCPT ); Mon, 10 Jan 2022 02:44:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49462 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240959AbiAJHeb (ORCPT ); Mon, 10 Jan 2022 02:34:31 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A1983C025398; Sun, 9 Jan 2022 23:30:02 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5E162B81161; Mon, 10 Jan 2022 07:30:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 85905C36AED; Mon, 10 Jan 2022 07:29:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799800; bh=0FUZhdHdVFKJrJzvgVA+DV9XJpaKZoIrD4J9MFjxH2A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EburqUk/+dGbOzU2gEbZgsmhLvcW3taC/xXafQ10eJNoLyHZdJiE+/o295OAzTl2O DgQkJJtm8P0KtW4bZzBgMxSYtuDFSyiILVus91uGTV4NsckQD+p/AIlcCBYEYdkTnA dXtKoIyLlt3U4aP0zv4FU8ci9MNGdclinGojGWvA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Grzegorz Szczurek , Mateusz Palczewski , Paul M Stillwell Jr , Aleksandr Loktionov , Tony Brelinski , Tony Nguyen Subject: [PATCH 5.10 06/43] i40e: Fix to not show opcode msg on unsuccessful VF MAC change Date: Mon, 10 Jan 2022 08:23:03 +0100 Message-Id: <20220110071817.559412877@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mateusz Palczewski commit 01cbf50877e602e2376af89e4a51c30bc574c618 upstream. Hide i40e opcode information sent during response to VF in case when untrusted VF tried to change MAC on the VF interface. This is implemented by adding an additional parameter 'hide' to the response sent to VF function that hides the display of error information, but forwards the error code to VF. Previously it was not possible to send response with some error code to VF without displaying opcode information. Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface") Signed-off-by: Grzegorz Szczurek Signed-off-by: Mateusz Palczewski Reviewed-by: Paul M Stillwell Jr Reviewed-by: Aleksandr Loktionov Tested-by: Tony Brelinski Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 40 ++++++++++++++++= ----- 1 file changed, 32 insertions(+), 8 deletions(-) --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c @@ -1824,17 +1824,19 @@ sriov_configure_out: /***********************virtual channel routines******************/ =20 /** - * i40e_vc_send_msg_to_vf + * i40e_vc_send_msg_to_vf_ex * @vf: pointer to the VF info * @v_opcode: virtual channel opcode * @v_retval: virtual channel return value * @msg: pointer to the msg buffer * @msglen: msg length + * @is_quiet: true for not printing unsuccessful return values, false othe= rwise * * send msg to VF **/ -static int i40e_vc_send_msg_to_vf(struct i40e_vf *vf, u32 v_opcode, - u32 v_retval, u8 *msg, u16 msglen) +static int i40e_vc_send_msg_to_vf_ex(struct i40e_vf *vf, u32 v_opcode, + u32 v_retval, u8 *msg, u16 msglen, + bool is_quiet) { struct i40e_pf *pf; struct i40e_hw *hw; @@ -1850,7 +1852,7 @@ static int i40e_vc_send_msg_to_vf(struct abs_vf_id =3D vf->vf_id + hw->func_caps.vf_base_id; =20 /* single place to detect unsuccessful return values */ - if (v_retval) { + if (v_retval && !is_quiet) { vf->num_invalid_msgs++; dev_info(&pf->pdev->dev, "VF %d failed opcode %d, retval: %d\n", vf->vf_id, v_opcode, v_retval); @@ -1881,6 +1883,23 @@ static int i40e_vc_send_msg_to_vf(struct } =20 /** + * i40e_vc_send_msg_to_vf + * @vf: pointer to the VF info + * @v_opcode: virtual channel opcode + * @v_retval: virtual channel return value + * @msg: pointer to the msg buffer + * @msglen: msg length + * + * send msg to VF + **/ +static int i40e_vc_send_msg_to_vf(struct i40e_vf *vf, u32 v_opcode, + u32 v_retval, u8 *msg, u16 msglen) +{ + return i40e_vc_send_msg_to_vf_ex(vf, v_opcode, v_retval, + msg, msglen, false); +} + +/** * i40e_vc_send_resp_to_vf * @vf: pointer to the VF info * @opcode: operation code @@ -2641,6 +2660,7 @@ error_param: * i40e_check_vf_permission * @vf: pointer to the VF info * @al: MAC address list from virtchnl + * @is_quiet: set true for printing msg without opcode info, false otherwi= se * * Check that the given list of MAC addresses is allowed. Will return -EPE= RM * if any address in the list is not valid. Checks the following condition= s: @@ -2655,13 +2675,15 @@ error_param: * addresses might not be accurate. **/ static inline int i40e_check_vf_permission(struct i40e_vf *vf, - struct virtchnl_ether_addr_list *al) + struct virtchnl_ether_addr_list *al, + bool *is_quiet) { struct i40e_pf *pf =3D vf->pf; struct i40e_vsi *vsi =3D pf->vsi[vf->lan_vsi_idx]; int mac2add_cnt =3D 0; int i; =20 + *is_quiet =3D false; for (i =3D 0; i < al->num_elements; i++) { struct i40e_mac_filter *f; u8 *addr =3D al->list[i].addr; @@ -2685,6 +2707,7 @@ static inline int i40e_check_vf_permissi !ether_addr_equal(addr, vf->default_lan_addr.addr)) { dev_err(&pf->pdev->dev, "VF attempting to override administratively set MAC address, bring dow= n and up the VF interface to resume normal operation\n"); + *is_quiet =3D true; return -EPERM; } =20 @@ -2721,6 +2744,7 @@ static int i40e_vc_add_mac_addr_msg(stru (struct virtchnl_ether_addr_list *)msg; struct i40e_pf *pf =3D vf->pf; struct i40e_vsi *vsi =3D NULL; + bool is_quiet =3D false; i40e_status ret =3D 0; int i; =20 @@ -2737,7 +2761,7 @@ static int i40e_vc_add_mac_addr_msg(stru */ spin_lock_bh(&vsi->mac_filter_hash_lock); =20 - ret =3D i40e_check_vf_permission(vf, al); + ret =3D i40e_check_vf_permission(vf, al, &is_quiet); if (ret) { spin_unlock_bh(&vsi->mac_filter_hash_lock); goto error_param; @@ -2775,8 +2799,8 @@ static int i40e_vc_add_mac_addr_msg(stru =20 error_param: /* send the response to the VF */ - return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_ADD_ETH_ADDR, - ret); + return i40e_vc_send_msg_to_vf_ex(vf, VIRTCHNL_OP_ADD_ETH_ADDR, + ret, NULL, 0, is_quiet); } =20 /** From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AB0ECC433F5 for ; Mon, 10 Jan 2022 07:44:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240566AbiAJHoT (ORCPT ); Mon, 10 Jan 2022 02:44:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49924 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240961AbiAJHeb (ORCPT ); Mon, 10 Jan 2022 02:34:31 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6944FC0253A0; Sun, 9 Jan 2022 23:30:04 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 11792B811F5; Mon, 10 Jan 2022 07:30:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E531C36AED; Mon, 10 Jan 2022 07:30:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799802; bh=uBdHps0ZrJgucE7hAVqdKjWVMwERvWHx5aEmtElClyY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OmkyspVHy+3Dk1yCNH8cykrVUcSy+/06YEG7ae1AbFTypKxTgbe5DenZ7f7/Jjy7K zgfPVga054VWgYGHNiKheqIcwC/B44ZvmVGnfJKWYBIJHYkiPOtWYhO0RNYVo2eA9w fvlBS3KiN6vF4ihX/1Hvl2/CP4qgjJMrinC0Q1H4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ashwin Vijayavel , Karen Sornek , Konrad Jankowski , Tony Nguyen Subject: [PATCH 5.10 07/43] iavf: Fix limit of total number of queues to active queues of VF Date: Mon, 10 Jan 2022 08:23:04 +0100 Message-Id: <20220110071817.599617504@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Karen Sornek commit b712941c8085e638bb92456e866ed3de4404e3d5 upstream. In the absence of this validation, if the user requests to configure queues more than the enabled queues, it results in sending the requested number of queues to the kernel stack (due to the asynchronous nature of VF response), in which case the stack might pick a queue to transmit that is not enabled and result in Tx hang. Fix this bug by limiting the total number of queues allocated for VF to active queues of VF. Fixes: d5b33d024496 ("i40evf: add ndo_setup_tc callback to i40evf") Signed-off-by: Ashwin Vijayavel Signed-off-by: Karen Sornek Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/iavf/iavf_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/intel/iavf/iavf_main.c +++ b/drivers/net/ethernet/intel/iavf/iavf_main.c @@ -2598,8 +2598,11 @@ static int iavf_validate_ch_config(struc total_max_rate +=3D tx_rate; num_qps +=3D mqprio_qopt->qopt.count[i]; } - if (num_qps > IAVF_MAX_REQ_QUEUES) + if (num_qps > adapter->num_active_queues) { + dev_err(&adapter->pdev->dev, + "Cannot support requested number of queues\n"); return -EINVAL; + } =20 ret =3D iavf_validate_tx_bandwidth(adapter, total_max_rate); return ret; From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93E20C433EF for ; Mon, 10 Jan 2022 07:44:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243032AbiAJHoa (ORCPT ); Mon, 10 Jan 2022 02:44:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50434 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240992AbiAJHeb (ORCPT ); Mon, 10 Jan 2022 02:34:31 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D3EDC0253B2; Sun, 9 Jan 2022 23:30:08 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 04D84B811F5; Mon, 10 Jan 2022 07:30:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2E6F9C36AE9; Mon, 10 Jan 2022 07:30:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799805; bh=Z+zCmTEq1nUUaLCcSgs4oup25kLMn11yeAWlNCsjOKs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FtHKTV8Ixjf4foW3h352WTx8pd3hrECx/4+7C7tSUCq90D9UF5sHvRCLe3F3Ycya+ IgpBt0WFRTLh7Wv0sPNFltkNPHHZ0co3sYw75i7mG50VeshQ+6s8GopzTiDD9llqJq NZeqRuQCl8Rtkp3YE84Guoh2cbPqJo8rEr5YD2ks= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+6d532fa8f9463da290bc@syzkaller.appspotmail.com, Leon Romanovsky , Jason Gunthorpe Subject: [PATCH 5.10 08/43] RDMA/core: Dont infoleak GRH fields Date: Mon, 10 Jan 2022 08:23:05 +0100 Message-Id: <20220110071817.631453319@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Leon Romanovsky commit b35a0f4dd544eaa6162b6d2f13a2557a121ae5fd upstream. If dst->is_global field is not set, the GRH fields are not cleared and the following infoleak is reported. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instru= mented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:209 [inline] ucma_init_qp_attr+0x8c7/0xb10 drivers/infiniband/core/ucma.c:1242 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 vfs_write+0x8ce/0x2030 fs/read_write.c:588 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline] __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Local variable resp created at: ucma_init_qp_attr+0xa4/0xb10 drivers/infiniband/core/ucma.c:1214 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 Bytes 40-59 of 144 are uninitialized Memory access of size 144 starts at ffff888167523b00 Data copied to user address 0000000020000100 CPU: 1 PID: 25910 Comm: syz-executor.1 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D Fixes: 4ba66093bdc6 ("IB/core: Check for global flag when using ah_attr") Link: https://lore.kernel.org/r/0e9dd51f93410b7b2f4f5562f52befc878b71afa.16= 41298868.git.leonro@nvidia.com Reported-by: syzbot+6d532fa8f9463da290bc@syzkaller.appspotmail.com Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/infiniband/core/uverbs_marshall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/infiniband/core/uverbs_marshall.c +++ b/drivers/infiniband/core/uverbs_marshall.c @@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_d struct rdma_ah_attr *src =3D ah_attr; struct rdma_ah_attr conv_ah; =20 - memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved)); + memset(&dst->grh, 0, sizeof(dst->grh)); =20 if ((ah_attr->type =3D=3D RDMA_AH_ATTR_TYPE_OPA) && (rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) && From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5AFCC433FE for ; Mon, 10 Jan 2022 07:41:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240957AbiAJHlS (ORCPT ); Mon, 10 Jan 2022 02:41:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50438 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240994AbiAJHeb (ORCPT ); Mon, 10 Jan 2022 02:34:31 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 03C72C0253B4; Sun, 9 Jan 2022 23:30:10 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A31A7B811F5; Mon, 10 Jan 2022 07:30:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0E53C36AE9; Mon, 10 Jan 2022 07:30:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799808; bh=lcHfSChScLvyGOU8GsHzTVoEVeZZVhOFXm8cepE1HTo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xm0bVeDVer+osjw9s9+od5vF4/9ybwm/SQlP4Yx20Hivyc8boEeaKXcPYN4UA3jxx J5MdrTLKW4oGaoGWXbvJITcjAd56Jyktb4mEJqsDMP5uhbPRvDuyCACCGUj0cBjK2W MbvVjGJvP8xKugFkSe5tpYI3++WzA2DeEkGz/NzA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Christoph Hellwig , "David S. Miller" Subject: [PATCH 5.10 09/43] netrom: fix copying in user data in nr_setsockopt Date: Mon, 10 Jan 2022 08:23:06 +0100 Message-Id: <20220110071817.669190550@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christoph Hellwig commit 3087a6f36ee028ec095c04a8531d7d33899b7fed upstream. This code used to copy in an unsigned long worth of data before the sockptr_t conversion, so restore that. Fixes: a7b75c5a8c41 ("net: pass a sockptr_t into ->setsockopt") Reported-by: Dan Carpenter Signed-off-by: Christoph Hellwig Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -306,7 +306,7 @@ static int nr_setsockopt(struct socket * if (optlen < sizeof(unsigned int)) return -EINVAL; =20 - if (copy_from_sockptr(&opt, optval, sizeof(unsigned int))) + if (copy_from_sockptr(&opt, optval, sizeof(unsigned long))) return -EFAULT; =20 switch (optname) { From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE21FC433FE for ; Mon, 10 Jan 2022 07:34:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240613AbiAJHe0 (ORCPT ); Mon, 10 Jan 2022 02:34:26 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:58822 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239513AbiAJH3h (ORCPT ); Mon, 10 Jan 2022 02:29:37 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C41EEB81216; Mon, 10 Jan 2022 07:29:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18050C36AEF; Mon, 10 Jan 2022 07:29:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799774; bh=WLcjkDH0MA5Ws7HBfmZfW8Pr+NSz5/fPbxZShZIadus=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nXGf3x5mPaYoN+dbHPDpxhA6cBMirmFURxtEb1rJb653ty8hKstu3fM/2aEmDXJmz R+Ly4+6WPdQXUV/aI4ARbj8zg8nGQToCm84aecdDKOFghY2R3KMuqlOXmAh4M/jje0 sbqXr+0G+uYURcSDXY+IILbJc0dBc+uStB3Wb2Yg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Leon Romanovsky , Jason Gunthorpe Subject: [PATCH 5.10 10/43] RDMA/uverbs: Check for null return of kmalloc_array Date: Mon, 10 Jan 2022 08:23:07 +0100 Message-Id: <20220110071817.700558031@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang commit 7694a7de22c53a312ea98960fcafc6ec62046531 upstream. Because of the possible failure of the allocation, data might be NULL pointer and will cause the dereference of the NULL pointer later. Therefore, it might be better to check it and return -ENOMEM. Fixes: 6884c6c4bd09 ("RDMA/verbs: Store the write/write_ex uapi entry point= s in the uverbs_api") Link: https://lore.kernel.org/r/20211231093315.1917667-1-jiasheng@iscas.ac.= cn Signed-off-by: Jiasheng Jiang Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/infiniband/core/uverbs_uapi.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/infiniband/core/uverbs_uapi.c +++ b/drivers/infiniband/core/uverbs_uapi.c @@ -450,6 +450,9 @@ static int uapi_finalize(struct uverbs_a uapi->num_write_ex =3D max_write_ex + 1; data =3D kmalloc_array(uapi->num_write + uapi->num_write_ex, sizeof(*uapi->write_methods), GFP_KERNEL); + if (!data) + return -ENOMEM; + for (i =3D 0; i !=3D uapi->num_write + uapi->num_write_ex; i++) data[i] =3D &uapi->notsupp_method; uapi->write_methods =3D data; From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6106C433F5 for ; Mon, 10 Jan 2022 07:42:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239645AbiAJHlM (ORCPT ); Mon, 10 Jan 2022 02:41:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50400 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240574AbiAJHea (ORCPT ); Mon, 10 Jan 2022 02:34:30 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 72B0DC0253FE; Sun, 9 Jan 2022 23:29:38 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 10E39611B9; Mon, 10 Jan 2022 07:29:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E87FEC36AE9; Mon, 10 Jan 2022 07:29:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799777; bh=JYszoI4w8EG/f+eoMv21Wl7Zb0swvHUpwQCPoozk21E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pXO+l76xOIk9fmPgQX5eQzvwB7Ez82CvvJBujGMyGY+QBk+aGgYFM5Ho11nQQQtoV rp3R0YWVS+FXF+U7BCyurPRlQmDZLTWrPYwE2RfWCh+Mg3sjGCVdHfnFjMfvMbcShb Jm8z8t00lm+ozhuvkgfPAzKAKKrIyDdcvpcxgjqI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Rix , Nick Desaulniers , Johannes Berg Subject: [PATCH 5.10 11/43] mac80211: initialize variable have_higher_than_11mbit Date: Mon, 10 Jan 2022 08:23:08 +0100 Message-Id: <20220110071817.734448998@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tom Rix commit 68a18ad71378a56858141c4449e02a30c829763e upstream. Clang static analysis reports this warnings mlme.c:5332:7: warning: Branch condition evaluates to a garbage value have_higher_than_11mbit) ^~~~~~~~~~~~~~~~~~~~~~~ have_higher_than_11mbit is only set to true some of the time in ieee80211_get_rates() but is checked all of the time. So have_higher_than_11mbit needs to be initialized to false. Fixes: 5d6a1b069b7f ("mac80211: set basic rates earlier") Signed-off-by: Tom Rix Reviewed-by: Nick Desaulniers Link: https://lore.kernel.org/r/20211223162848.3243702-1-trix@redhat.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/mac80211/mlme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -5194,7 +5194,7 @@ static int ieee80211_prep_connection(str */ if (new_sta) { u32 rates =3D 0, basic_rates =3D 0; - bool have_higher_than_11mbit; + bool have_higher_than_11mbit =3D false; int min_rate =3D INT_MAX, min_rate_index =3D -1; const struct cfg80211_bss_ies *ies; int shift =3D ieee80211_vif_get_shift(&sdata->vif); From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC1E0C433F5 for ; Mon, 10 Jan 2022 07:36:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240723AbiAJHeb (ORCPT ); Mon, 10 Jan 2022 02:34:31 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:37416 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240247AbiAJH3m (ORCPT ); Mon, 10 Jan 2022 02:29:42 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E4506611A3; Mon, 10 Jan 2022 07:29:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CBB7FC36AE9; Mon, 10 Jan 2022 07:29:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799780; bh=ozMljWCXRk0xRH33Ws1uj19s4rejF6ZOu7s6mtdRefk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Xp2CWE5X7KQQW7Ertyp44hXIsU1Sv/iWwUyRX73Oo9Vxk1amVep9tJXHBLtO6yoba mZJ9sUTqEuGwlL33CidC75ah4yioozuJGPcBKz3aqBlstWj4ikrkPegyFlLCwn4O3O 8ra4TqxtHnz2M6W6lDX1CdOSjteyWMr9PU80Fq+8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Martin Habets , Jiasheng Jiang , Jakub Kicinski Subject: [PATCH 5.10 12/43] sfc: The RX page_ring is optional Date: Mon, 10 Jan 2022 08:23:09 +0100 Message-Id: <20220110071817.765763199@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Martin Habets commit 1d5a474240407c38ca8c7484a656ee39f585399c upstream. The RX page_ring is an optional feature that improves performance. When allocation fails the driver can still function, but possibly with a lower bandwidth. Guard against dereferencing a NULL page_ring. Fixes: 2768935a4660 ("sfc: reuse pages to avoid DMA mapping/unmapping costs= ") Signed-off-by: Martin Habets Reported-by: Jiasheng Jiang Link: https://lore.kernel.org/r/164111288276.5798.10330502993729113868.stgi= t@palantir17.mph.net Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/sfc/falcon/rx.c | 5 +++++ drivers/net/ethernet/sfc/rx_common.c | 5 +++++ 2 files changed, 10 insertions(+) --- a/drivers/net/ethernet/sfc/falcon/rx.c +++ b/drivers/net/ethernet/sfc/falcon/rx.c @@ -110,6 +110,8 @@ static struct page *ef4_reuse_page(struc struct ef4_rx_page_state *state; unsigned index; =20 + if (unlikely(!rx_queue->page_ring)) + return NULL; index =3D rx_queue->page_remove & rx_queue->page_ptr_mask; page =3D rx_queue->page_ring[index]; if (page =3D=3D NULL) @@ -293,6 +295,9 @@ static void ef4_recycle_rx_pages(struct { struct ef4_rx_queue *rx_queue =3D ef4_channel_get_rx_queue(channel); =20 + if (unlikely(!rx_queue->page_ring)) + return; + do { ef4_recycle_rx_page(channel, rx_buf); rx_buf =3D ef4_rx_buf_next(rx_queue, rx_buf); --- a/drivers/net/ethernet/sfc/rx_common.c +++ b/drivers/net/ethernet/sfc/rx_common.c @@ -45,6 +45,8 @@ static struct page *efx_reuse_page(struc unsigned int index; struct page *page; =20 + if (unlikely(!rx_queue->page_ring)) + return NULL; index =3D rx_queue->page_remove & rx_queue->page_ptr_mask; page =3D rx_queue->page_ring[index]; if (page =3D=3D NULL) @@ -114,6 +116,9 @@ void efx_recycle_rx_pages(struct efx_cha { struct efx_rx_queue *rx_queue =3D efx_channel_get_rx_queue(channel); =20 + if (unlikely(!rx_queue->page_ring)) + return; + do { efx_recycle_rx_page(channel, rx_buf); rx_buf =3D efx_rx_buf_next(rx_queue, rx_buf); From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DBE5CC3525C for ; Mon, 10 Jan 2022 07:41:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241517AbiAJHlC (ORCPT ); Mon, 10 Jan 2022 02:41:02 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49454 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240214AbiAJHea (ORCPT ); Mon, 10 Jan 2022 02:34:30 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2B035C025387; Sun, 9 Jan 2022 23:29:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BDFC4611AD; Mon, 10 Jan 2022 07:29:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A28A2C36AE9; Mon, 10 Jan 2022 07:29:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799783; bh=o9rqqkHNAbCNVFaIJMkH0g3wqyJu2+N95VGuBiK3u8Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xKPxNdbn+PM8n+ROUe+4JsFMxbM3AqjdPLNDkV+JQS3RZnK2NdMiiEqvA8R2h/NVo kUKJ2Re1fologHVpiv8fUfQl6der5prIH+Q5O0tcP9yT4Ub2/qsufXujzfZ54Gsw62 fhhDxAVhx+8BByDr7r2U0rt/ON3xtzZs8Uov+sCE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Di Zhu , Rui Zhang , Gurucharan G , Tony Nguyen Subject: [PATCH 5.10 13/43] i40e: fix use-after-free in i40e_sync_filters_subtask() Date: Mon, 10 Jan 2022 08:23:10 +0100 Message-Id: <20220110071817.797885233@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Di Zhu commit 3116f59c12bd24c513194cd3acb3ec1f7d468954 upstream. Using ifconfig command to delete the ipv6 address will cause the i40e network card driver to delete its internal mac_filter and i40e_service_task kernel thread will concurrently access the mac_filter. These two processes are not protected by lock so causing the following use-after-free problems. print_address_description+0x70/0x360 ? vprintk_func+0x5e/0xf0 kasan_report+0x1b2/0x330 i40e_sync_vsi_filters+0x4f0/0x1850 [i40e] i40e_sync_filters_subtask+0xe3/0x130 [i40e] i40e_service_task+0x195/0x24c0 [i40e] process_one_work+0x3f5/0x7d0 worker_thread+0x61/0x6c0 ? process_one_work+0x7d0/0x7d0 kthread+0x1c3/0x1f0 ? kthread_park+0xc0/0xc0 ret_from_fork+0x35/0x40 Allocated by task 2279810: kasan_kmalloc+0xa0/0xd0 kmem_cache_alloc_trace+0xf3/0x1e0 i40e_add_filter+0x127/0x2b0 [i40e] i40e_add_mac_filter+0x156/0x190 [i40e] i40e_addr_sync+0x2d/0x40 [i40e] __hw_addr_sync_dev+0x154/0x210 i40e_set_rx_mode+0x6d/0xf0 [i40e] __dev_set_rx_mode+0xfb/0x1f0 __dev_mc_add+0x6c/0x90 igmp6_group_added+0x214/0x230 __ipv6_dev_mc_inc+0x338/0x4f0 addrconf_join_solict.part.7+0xa2/0xd0 addrconf_dad_work+0x500/0x980 process_one_work+0x3f5/0x7d0 worker_thread+0x61/0x6c0 kthread+0x1c3/0x1f0 ret_from_fork+0x35/0x40 Freed by task 2547073: __kasan_slab_free+0x130/0x180 kfree+0x90/0x1b0 __i40e_del_filter+0xa3/0xf0 [i40e] i40e_del_mac_filter+0xf3/0x130 [i40e] i40e_addr_unsync+0x85/0xa0 [i40e] __hw_addr_sync_dev+0x9d/0x210 i40e_set_rx_mode+0x6d/0xf0 [i40e] __dev_set_rx_mode+0xfb/0x1f0 __dev_mc_del+0x69/0x80 igmp6_group_dropped+0x279/0x510 __ipv6_dev_mc_dec+0x174/0x220 addrconf_leave_solict.part.8+0xa2/0xd0 __ipv6_ifa_notify+0x4cd/0x570 ipv6_ifa_notify+0x58/0x80 ipv6_del_addr+0x259/0x4a0 inet6_addr_del+0x188/0x260 addrconf_del_ifaddr+0xcc/0x130 inet6_ioctl+0x152/0x190 sock_do_ioctl+0xd8/0x2b0 sock_ioctl+0x2e5/0x4c0 do_vfs_ioctl+0x14e/0xa80 ksys_ioctl+0x7c/0xa0 __x64_sys_ioctl+0x42/0x50 do_syscall_64+0x98/0x2c0 entry_SYSCALL_64_after_hwframe+0x65/0xca Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Di Zhu Signed-off-by: Rui Zhang Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/i40e/i40e_main.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -98,6 +98,24 @@ MODULE_LICENSE("GPL v2"); =20 static struct workqueue_struct *i40e_wq; =20 +static void netdev_hw_addr_refcnt(struct i40e_mac_filter *f, + struct net_device *netdev, int delta) +{ + struct netdev_hw_addr *ha; + + if (!f || !netdev) + return; + + netdev_for_each_mc_addr(ha, netdev) { + if (ether_addr_equal(ha->addr, f->macaddr)) { + ha->refcount +=3D delta; + if (ha->refcount <=3D 0) + ha->refcount =3D 1; + break; + } + } +} + /** * i40e_allocate_dma_mem_d - OS specific memory alloc for shared code * @hw: pointer to the HW structure @@ -2035,6 +2053,7 @@ static void i40e_undo_add_filter_entries hlist_for_each_entry_safe(new, h, from, hlist) { /* We can simply free the wrapper structure */ hlist_del(&new->hlist); + netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); kfree(new); } } @@ -2382,6 +2401,10 @@ int i40e_sync_vsi_filters(struct i40e_vs &tmp_add_list, &tmp_del_list, vlan_filters); + + hlist_for_each_entry(new, &tmp_add_list, hlist) + netdev_hw_addr_refcnt(new->f, vsi->netdev, 1); + if (retval) goto err_no_memory_locked; =20 @@ -2514,6 +2537,7 @@ int i40e_sync_vsi_filters(struct i40e_vs if (new->f->state =3D=3D I40E_FILTER_NEW) new->f->state =3D new->state; hlist_del(&new->hlist); + netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); kfree(new); } spin_unlock_bh(&vsi->mac_filter_hash_lock); From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA6A4C433EF for ; Mon, 10 Jan 2022 07:36:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241079AbiAJHel (ORCPT ); Mon, 10 Jan 2022 02:34:41 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:38908 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240274AbiAJH3r (ORCPT ); Mon, 10 Jan 2022 02:29:47 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8A7F4611B6; Mon, 10 Jan 2022 07:29:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 70D00C36AE9; Mon, 10 Jan 2022 07:29:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799786; bh=pRaENRlRFEDP/WHMvW5FiYnPh5Euy4mEOHWYmBFTZ1M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=adePLct6yebrUDz6L+bFQpQpB8mz99KzJWzE2mUfiozEnDKFCWzQ7Faz+HQ/voHxU 3BHev4uWrk1dA98vxM6cMLWuD3zfKgUvXY+M6Df1WrvI0/5okrSUfT4eMy2ST5b8t7 UOVbPfnMwpVgnkKvzNMYu+S98HsEYSxdK71zcMR8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mateusz Palczewski , Gurucharan G , Tony Nguyen Subject: [PATCH 5.10 14/43] i40e: Fix for displaying message regarding NVM version Date: Mon, 10 Jan 2022 08:23:11 +0100 Message-Id: <20220110071817.827523691@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mateusz Palczewski commit 40feded8a247f95957a0de9abd100085fb320a2f upstream. When loading the i40e driver, it prints a message like: 'The driver for the device detected a newer version of the NVM image v1.x than expected v1.y. Please install the most recent version of the network driver.' This is misleading as the driver is working as expected. Fix that by removing the second part of message and changing it from dev_info to dev_dbg. Fixes: 4fb29bddb57f ("i40e: The driver now prints the API version in error = message") Signed-off-by: Mateusz Palczewski Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -14987,8 +14987,8 @@ static int i40e_probe(struct pci_dev *pd =20 if (hw->aq.api_maj_ver =3D=3D I40E_FW_API_VERSION_MAJOR && hw->aq.api_min_ver > I40E_FW_MINOR_VERSION(hw)) - dev_info(&pdev->dev, - "The driver for the device detected a newer version of the NVM image v= %u.%u than expected v%u.%u. Please install the most recent version of the n= etwork driver.\n", + dev_dbg(&pdev->dev, + "The driver for the device detected a newer version of the NVM image v%= u.%u than v%u.%u.\n", hw->aq.api_maj_ver, hw->aq.api_min_ver, I40E_FW_API_VERSION_MAJOR, From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9206EC433F5 for ; Mon, 10 Jan 2022 07:38:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240547AbiAJHiN (ORCPT ); Mon, 10 Jan 2022 02:38:13 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:38798 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240604AbiAJHbf (ORCPT ); Mon, 10 Jan 2022 02:31:35 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AB0BB60B63; Mon, 10 Jan 2022 07:31:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 92A7BC36AED; Mon, 10 Jan 2022 07:31:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799894; bh=P1oPJQi72S+id//DCwOvy9Y0UmJY2fU1Yn/2BHi5B4g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uAQdIChRukaHRjsL+b0KhmYWfIvFZxz+iXJnynyhtOxAtEo7JwviNL7eXmhbace2A D7lxhcWl5NKFR8ssOKWKQPyaFfb9QWuhDbQKywx7dw/rO2GrQebhc0H0EUqXeWFchu FO9WaeZeCPBGk0FhV2Vzo5h0kqtl39DKYxwcvKTo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukasz Cieplicki , Jedrzej Jagielski , Gurucharan G , Tony Nguyen Subject: [PATCH 5.10 15/43] i40e: Fix incorrect netdevs real number of RX/TX queues Date: Mon, 10 Jan 2022 08:23:12 +0100 Message-Id: <20220110071817.865559537@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jedrzej Jagielski commit e738451d78b2f8a9635d66c6a87f304b4d965f7a upstream. There was a wrong queues representation in sysfs during driver's reinitialization in case of online cpus number is less than combined queues. It was caused by stopped NetworkManager, which is responsible for calling vsi_open function during driver's initialization. In specific situation (ex. 12 cpus online) there were 16 queues in /sys/class/net//queues. In case of modifying queues with value higher, than number of online cpus, then it caused write errors and other errors. Add updating of sysfs's queues representation during driver initialization. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Lukasz Cieplicki Signed-off-by: Jedrzej Jagielski Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/i40e/i40e_main.c | 32 +++++++++++++++++++++--= ----- 1 file changed, 25 insertions(+), 7 deletions(-) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -8382,6 +8382,27 @@ int i40e_open(struct net_device *netdev) } =20 /** + * i40e_netif_set_realnum_tx_rx_queues - Update number of tx/rx queues + * @vsi: vsi structure + * + * This updates netdev's number of tx/rx queues + * + * Returns status of setting tx/rx queues + **/ +static int i40e_netif_set_realnum_tx_rx_queues(struct i40e_vsi *vsi) +{ + int ret; + + ret =3D netif_set_real_num_rx_queues(vsi->netdev, + vsi->num_queue_pairs); + if (ret) + return ret; + + return netif_set_real_num_tx_queues(vsi->netdev, + vsi->num_queue_pairs); +} + +/** * i40e_vsi_open - * @vsi: the VSI to open * @@ -8417,13 +8438,7 @@ int i40e_vsi_open(struct i40e_vsi *vsi) goto err_setup_rx; =20 /* Notify the stack of the actual queue counts. */ - err =3D netif_set_real_num_tx_queues(vsi->netdev, - vsi->num_queue_pairs); - if (err) - goto err_set_queues; - - err =3D netif_set_real_num_rx_queues(vsi->netdev, - vsi->num_queue_pairs); + err =3D i40e_netif_set_realnum_tx_rx_queues(vsi); if (err) goto err_set_queues; =20 @@ -13712,6 +13727,9 @@ struct i40e_vsi *i40e_vsi_setup(struct i ret =3D i40e_config_netdev(vsi); if (ret) goto err_netdev; + ret =3D i40e_netif_set_realnum_tx_rx_queues(vsi); + if (ret) + goto err_netdev; ret =3D register_netdev(vsi->netdev); if (ret) goto err_netdev; From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6481EC43217 for ; Mon, 10 Jan 2022 07:36:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240546AbiAJHgk (ORCPT ); Mon, 10 Jan 2022 02:36:40 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:59168 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239951AbiAJHaQ (ORCPT ); Mon, 10 Jan 2022 02:30:16 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3693AB8120F; Mon, 10 Jan 2022 07:30:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7B6E6C36AED; Mon, 10 Jan 2022 07:30:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799814; bh=1RZ0kPZl9KxI1zgPVbZnXcBRIz2Lcdn7bViV5huftKM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sR2zWVG5fiwjnoLbIWAigwbYsZ1cVw12CmrSqSvAfZlfWtjiHehkaeUM2vy2h2pcx dVj+Kyttx0thH3OFYFwtQCG7be/6x2PvMd2OKg3NDBJcNdEw7ma7W4SibTUGMD5s2K vMOgp8hMgzvVp8wgx48tvTgzjVH2pAtntyIPUJr0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Jiri Olsa , Steven Rostedt Subject: [PATCH 5.10 16/43] ftrace/samples: Add missing prototypes direct functions Date: Mon, 10 Jan 2022 08:23:13 +0100 Message-Id: <20220110071817.898213966@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiri Olsa commit 0daf5cb217a9ca8ae91b8f966ddae322699fb71d upstream. There's another compilation fail (first here [1]) reported by kernel test robot for W=3D1 clang build: >> samples/ftrace/ftrace-direct-multi-modify.c:7:6: warning: no previous prototype for function 'my_direct_func1' [-Wmissing-prototypes] void my_direct_func1(unsigned long ip) Direct functions in ftrace direct sample modules need to have prototypes defined. They are already global in order to be visible for the inline assembly, so there's no problem. The kernel test robot reported just error for ftrace-direct-multi-modify, but I got same errors also for the rest of the modules touched by this patc= h. [1] 67d4f6e3bf5d ftrace/samples: Add missing prototype for my_direct_func Link: https://lkml.kernel.org/r/20211219135317.212430-1-jolsa@kernel.org Reported-by: kernel test robot Fixes: e1067a07cfbc ("ftrace/samples: Add module to test multi direct modif= y interface") Fixes: ae0cc3b7e7f5 ("ftrace/samples: Add a sample module that implements m= odify_ftrace_direct()") Fixes: 156473a0ff4f ("ftrace: Add another example of register_ftrace_direct= () use case") Fixes: b06457c83af6 ("ftrace: Add sample module that uses register_ftrace_d= irect()") Signed-off-by: Jiri Olsa Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- samples/ftrace/ftrace-direct-modify.c | 3 +++ samples/ftrace/ftrace-direct-too.c | 3 +++ samples/ftrace/ftrace-direct.c | 2 ++ 3 files changed, 8 insertions(+) --- a/samples/ftrace/ftrace-direct-modify.c +++ b/samples/ftrace/ftrace-direct-modify.c @@ -3,6 +3,9 @@ #include #include =20 +extern void my_direct_func1(void); +extern void my_direct_func2(void); + void my_direct_func1(void) { trace_printk("my direct func1\n"); --- a/samples/ftrace/ftrace-direct-too.c +++ b/samples/ftrace/ftrace-direct-too.c @@ -4,6 +4,9 @@ #include /* for handle_mm_fault() */ #include =20 +extern void my_direct_func(struct vm_area_struct *vma, + unsigned long address, unsigned int flags); + void my_direct_func(struct vm_area_struct *vma, unsigned long address, unsigned int flags) { --- a/samples/ftrace/ftrace-direct.c +++ b/samples/ftrace/ftrace-direct.c @@ -4,6 +4,8 @@ #include /* for wake_up_process() */ #include =20 +extern void my_direct_func(struct task_struct *p); + void my_direct_func(struct task_struct *p) { trace_printk("waking up %s-%d\n", p->comm, p->pid); From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A0A02C433FE for ; Mon, 10 Jan 2022 07:41:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240524AbiAJHls (ORCPT ); Mon, 10 Jan 2022 02:41:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50386 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241428AbiAJHfr (ORCPT ); Mon, 10 Jan 2022 02:35:47 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7D251C034008; Sun, 9 Jan 2022 23:30:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 47DB2B81219; Mon, 10 Jan 2022 07:30:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F94AC36AE9; Mon, 10 Jan 2022 07:30:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799845; bh=bOhQIlelHmocyKnG+J9cBmRX+vsXjphmZVb/GZGImSg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gQqg/xZuwD0VMDiUgDgHEZPL8yq/R4rnc6OtyqF1MT2WNUNFNEIarw9mlLXTUSU5W M+SRwrjyZDZg2Q7YaibObubYb6OTiiOJNGxnAXJYegsm1Iq48hqWKv6RZcLRA7YQjn /LdWaRNwKkwZHpgqYHCyeUco45ovMQXkykTs5jUo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com, David Ahern , Thomas Graf , "David S. Miller" Subject: [PATCH 5.10 17/43] ipv4: Check attribute length for RTA_GATEWAY in multipath route Date: Mon, 10 Jan 2022 08:23:14 +0100 Message-Id: <20220110071817.931116602@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 7a3429bace0e08d94c39245631ea6bc109dafa49 upstream. syzbot reported uninit-value: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KMSAN: uninit-value in fib_get_nhs+0xac4/0x1f80 net/ipv4/fib_semantics.c:708 fib_get_nhs+0xac4/0x1f80 net/ipv4/fib_semantics.c:708 fib_create_info+0x2411/0x4870 net/ipv4/fib_semantics.c:1453 fib_table_insert+0x45c/0x3a10 net/ipv4/fib_trie.c:1224 inet_rtm_newroute+0x289/0x420 net/ipv4/fib_frontend.c:886 Add helper to validate RTA_GATEWAY length before using the attribute. Fixes: 4e902c57417c ("[IPv4]: FIB configuration using struct fib_config") Reported-by: syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com Signed-off-by: David Ahern Cc: Thomas Graf Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/fib_semantics.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -663,6 +663,19 @@ static int fib_count_nexthops(struct rtn return nhs; } =20 +static int fib_gw_from_attr(__be32 *gw, struct nlattr *nla, + struct netlink_ext_ack *extack) +{ + if (nla_len(nla) < sizeof(*gw)) { + NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_GATEWAY"); + return -EINVAL; + } + + *gw =3D nla_get_in_addr(nla); + + return 0; +} + /* only called when fib_nh is integrated into fib_info */ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, int remaining, struct fib_config *cfg, @@ -705,7 +718,11 @@ static int fib_get_nhs(struct fib_info * return -EINVAL; } if (nla) { - fib_cfg.fc_gw4 =3D nla_get_in_addr(nla); + ret =3D fib_gw_from_attr(&fib_cfg.fc_gw4, nla, + extack); + if (ret) + goto errout; + if (fib_cfg.fc_gw4) fib_cfg.fc_gw_family =3D AF_INET; } else if (nlav) { @@ -903,6 +920,7 @@ int fib_nh_match(struct net *net, struct attrlen =3D rtnh_attrlen(rtnh); if (attrlen > 0) { struct nlattr *nla, *nlav, *attrs =3D rtnh_attrs(rtnh); + int err; =20 nla =3D nla_find(attrs, attrlen, RTA_GATEWAY); nlav =3D nla_find(attrs, attrlen, RTA_VIA); @@ -913,12 +931,17 @@ int fib_nh_match(struct net *net, struct } =20 if (nla) { + __be32 gw; + + err =3D fib_gw_from_attr(&gw, nla, extack); + if (err) + return err; + if (nh->fib_nh_gw_family !=3D AF_INET || - nla_get_in_addr(nla) !=3D nh->fib_nh_gw4) + gw !=3D nh->fib_nh_gw4) return 1; } else if (nlav) { struct fib_config cfg2; - int err; =20 err =3D fib_gw_from_via(&cfg2, nlav, extack); if (err) From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35979C433FE for ; Mon, 10 Jan 2022 07:37:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241132AbiAJHho (ORCPT ); Mon, 10 Jan 2022 02:37:44 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:59896 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240538AbiAJHbQ (ORCPT ); Mon, 10 Jan 2022 02:31:16 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A3811B8121B; Mon, 10 Jan 2022 07:31:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CDAD1C36AEF; Mon, 10 Jan 2022 07:31:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799873; bh=KWTkfDLKwRKWe9cotlQ3Ptw1gM17doE7xlV7QAXh4Tw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D4KMhrfRsKg6eEeBEGaTCB11lnCVK07J2dX3/3pIjf83X1T4/RPBYZpBQygi09vcz dvb5E8Tjij4DSKR+KYpn5zs+aViUktp+uc3d7dTE9aomXUcgJ1AwmNXYCX+7grMamM cI1lp6rSzCPwwi83xnENZeZmPbcstFT5YPv0THfA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , "David S. Miller" Subject: [PATCH 5.10 18/43] ipv4: Check attribute length for RTA_FLOW in multipath route Date: Mon, 10 Jan 2022 08:23:15 +0100 Message-Id: <20220110071817.965925830@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 664b9c4b7392ce723b013201843264bf95481ce5 upstream. Make sure RTA_FLOW is at least 4B before using. Fixes: 4e902c57417c ("[IPv4]: FIB configuration using struct fib_config") Signed-off-by: David Ahern Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/fib_semantics.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -732,8 +732,13 @@ static int fib_get_nhs(struct fib_info * } =20 nla =3D nla_find(attrs, attrlen, RTA_FLOW); - if (nla) + if (nla) { + if (nla_len(nla) < sizeof(u32)) { + NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW"); + return -EINVAL; + } fib_cfg.fc_flow =3D nla_get_u32(nla); + } =20 fib_cfg.fc_encap =3D nla_find(attrs, attrlen, RTA_ENCAP); nla =3D nla_find(attrs, attrlen, RTA_ENCAP_TYPE); @@ -964,8 +969,14 @@ int fib_nh_match(struct net *net, struct =20 #ifdef CONFIG_IP_ROUTE_CLASSID nla =3D nla_find(attrs, attrlen, RTA_FLOW); - if (nla && nla_get_u32(nla) !=3D nh->nh_tclassid) - return 1; + if (nla) { + if (nla_len(nla) < sizeof(u32)) { + NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW"); + return -EINVAL; + } + if (nla_get_u32(nla) !=3D nh->nh_tclassid) + return 1; + } #endif } =20 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 656A4C433F5 for ; Mon, 10 Jan 2022 07:46:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243292AbiAJHpI (ORCPT ); Mon, 10 Jan 2022 02:45:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50770 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241545AbiAJHf4 (ORCPT ); Mon, 10 Jan 2022 02:35:56 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2837FC025267; Sun, 9 Jan 2022 23:31:17 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BCEBB60B63; Mon, 10 Jan 2022 07:31:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A04F9C36AE9; Mon, 10 Jan 2022 07:31:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799876; bh=ig92hey2Onqg/E9ZxomRHc1ckmA+ocL+WBV8lkyX5DM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qHgQdm2vKx2og2ca04u8dcQlvsSCqcdZ8hHyQ1jRniwQ1NL8LQUDe2Gb8IXc67+OO KFD+ghd/RFoh5uz6Ia5b7l81q7898zepkoA2D3qUPgYLHMkUBR4iOEfRaYK+dK9VX2 F/JfBp36CNXv6doXYOvGpSyPaQ+tokbfGVzcmzVg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Nicolas Dichtel , "David S. Miller" Subject: [PATCH 5.10 19/43] ipv6: Check attribute length for RTA_GATEWAY in multipath route Date: Mon, 10 Jan 2022 08:23:16 +0100 Message-Id: <20220110071817.997363901@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 4619bcf91399f00a40885100fb61d594d8454033 upstream. Commit referenced in the Fixes tag used nla_memcpy for RTA_GATEWAY as does the current nla_get_in6_addr. nla_memcpy protects against accessing memory greater than what is in the attribute, but there is no check requiring the attribute to have an IPv6 address. Add it. Fixes: 51ebd3181572 ("ipv6: add support of equal cost multipath (ECMP)") Signed-off-by: David Ahern Cc: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/route.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5113,6 +5113,19 @@ out: return should_notify; } =20 +static int fib6_gw_from_attr(struct in6_addr *gw, struct nlattr *nla, + struct netlink_ext_ack *extack) +{ + if (nla_len(nla) < sizeof(*gw)) { + NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_GATEWAY"); + return -EINVAL; + } + + *gw =3D nla_get_in6_addr(nla); + + return 0; +} + static int ip6_route_multipath_add(struct fib6_config *cfg, struct netlink_ext_ack *extack) { @@ -5153,7 +5166,13 @@ static int ip6_route_multipath_add(struc =20 nla =3D nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - r_cfg.fc_gateway =3D nla_get_in6_addr(nla); + int ret; + + ret =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + extack); + if (ret) + return ret; + r_cfg.fc_flags |=3D RTF_GATEWAY; } r_cfg.fc_encap =3D nla_find(attrs, attrlen, RTA_ENCAP); From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E952CC433EF for ; Mon, 10 Jan 2022 07:46:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243347AbiAJHpO (ORCPT ); Mon, 10 Jan 2022 02:45:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50206 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241680AbiAJHgD (ORCPT ); Mon, 10 Jan 2022 02:36:03 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EEC94C02526E; Sun, 9 Jan 2022 23:31:19 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8FFA960B03; Mon, 10 Jan 2022 07:31:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 761B7C36AE9; Mon, 10 Jan 2022 07:31:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799879; bh=t7Z2+dfN4OfS200aJliZHc8nz+GbnPFmXESIXqKvsrk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zNszAUl/+TyHXBVn4UiIYvq2cVCA8yvoQUU5fEfr7Y8VBiGSgd3SaQQSzHwmBswF9 XBxBQ3wgnee8kk2NKxy6Hhk1mE4y3WY6EJOQ40w9dXVt6r03AUtvZgodR1t2OOHIHI zAZ6tnhGo1YaQV1/Km1FIUouUbvDE/qSZO7WjF4E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Roopa Prabhu , "David S. Miller" Subject: [PATCH 5.10 20/43] ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route Date: Mon, 10 Jan 2022 08:23:17 +0100 Message-Id: <20220110071818.027417725@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 1ff15a710a862db1101b97810af14aedc835a86a upstream. Make sure RTA_GATEWAY for IPv6 multipath route has enough bytes to hold an IPv6 address. Fixes: 6b9ea5a64ed5 ("ipv6: fix multipath route replace error recovery") Signed-off-by: David Ahern Cc: Roopa Prabhu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/route.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5342,7 +5342,11 @@ static int ip6_route_multipath_del(struc =20 nla =3D nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - nla_memcpy(&r_cfg.fc_gateway, nla, 16); + err =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + extack); + if (err) + return err; + r_cfg.fc_flags |=3D RTF_GATEWAY; } } From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 72BD0C433EF for ; Mon, 10 Jan 2022 07:38:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241596AbiAJHiD (ORCPT ); Mon, 10 Jan 2022 02:38:03 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:59994 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240190AbiAJHbY (ORCPT ); Mon, 10 Jan 2022 02:31:24 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0B4A9B811F9; Mon, 10 Jan 2022 07:31:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 52DD9C36AED; Mon, 10 Jan 2022 07:31:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799881; bh=2pfskG3xd5gnNddhXGV28wFIlf1Cv6P6HIl4FJpN97A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FGbSk1YSWT39mUISuj79MvU1DLxrCGw5ako5It5VO7H5N29MKvO5efydt/bTJjoGu uVP8sbL9p0G6MtBdB6QSEFE++ZWsExiLjwAxMRhio1l/gpZnn9OmEGyQpdHkd1SPpU 7zKOqewURKQA4bJRzC3kJMJQLlToo3jQR8DUEkvc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , "David S. Miller" Subject: [PATCH 5.10 21/43] lwtunnel: Validate RTA_ENCAP_TYPE attribute length Date: Mon, 10 Jan 2022 08:23:18 +0100 Message-Id: <20220110071818.057582556@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 8bda81a4d400cf8a72e554012f0d8c45e07a3904 upstream. lwtunnel_valid_encap_type_attr is used to validate encap attributes within a multipath route. Add length validation checking to the type. lwtunnel_valid_encap_type_attr is called converting attributes to fib{6,}_config struct which means it is used before fib_get_nhs, ip6_route_multipath_add, and ip6_route_multipath_del - other locations that use rtnh_ok and then nla_get_u16 on RTA_ENCAP_TYPE attribute. Fixes: 9ed59592e3e3 ("lwtunnel: fix autoload of lwt modules") Signed-off-by: David Ahern Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/core/lwtunnel.c | 4 ++++ net/ipv4/fib_semantics.c | 3 +++ net/ipv6/route.c | 4 ++++ 3 files changed, 11 insertions(+) --- a/net/core/lwtunnel.c +++ b/net/core/lwtunnel.c @@ -192,6 +192,10 @@ int lwtunnel_valid_encap_type_attr(struc nla_entype =3D nla_find(attrs, attrlen, RTA_ENCAP_TYPE); =20 if (nla_entype) { + if (nla_len(nla_entype) < sizeof(u16)) { + NL_SET_ERR_MSG(extack, "Invalid RTA_ENCAP_TYPE"); + return -EINVAL; + } encap_type =3D nla_get_u16(nla_entype); =20 if (lwtunnel_valid_encap_type(encap_type, --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -741,6 +741,9 @@ static int fib_get_nhs(struct fib_info * } =20 fib_cfg.fc_encap =3D nla_find(attrs, attrlen, RTA_ENCAP); + /* RTA_ENCAP_TYPE length checked in + * lwtunnel_valid_encap_type_attr + */ nla =3D nla_find(attrs, attrlen, RTA_ENCAP_TYPE); if (nla) fib_cfg.fc_encap_type =3D nla_get_u16(nla); --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5176,6 +5176,10 @@ static int ip6_route_multipath_add(struc r_cfg.fc_flags |=3D RTF_GATEWAY; } r_cfg.fc_encap =3D nla_find(attrs, attrlen, RTA_ENCAP); + + /* RTA_ENCAP_TYPE length checked in + * lwtunnel_valid_encap_type_attr + */ nla =3D nla_find(attrs, attrlen, RTA_ENCAP_TYPE); if (nla) r_cfg.fc_encap_type =3D nla_get_u16(nla); From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 044E1C433EF for ; Mon, 10 Jan 2022 07:38:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241613AbiAJHiF (ORCPT ); Mon, 10 Jan 2022 02:38:05 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:58728 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240563AbiAJHb0 (ORCPT ); Mon, 10 Jan 2022 02:31:26 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DC3A7B81161; Mon, 10 Jan 2022 07:31:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2DB4CC36AED; Mon, 10 Jan 2022 07:31:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799884; bh=juyG7wIek7e2lL5Btww5qkya4KtE0VKhzueh0Rce5OU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zQDPCalW9xg7wxZe7GGRUSTmt0ZHrL80ZDR0HhG0u6DXbw39/mphhCnFwn1BfcjXf XqGB453yBqt1yfIRfghmoQyRxZaCvkfssgjTmDNoBkZlIp7KOehpIPSVdvWfZzySUj qoP6m69OGf5bKL+nt+ceQPx6ZnAMqX4/mhej/OUU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Linus=20L=C3=BCssing?= , Sven Eckelmann , Simon Wunderlich Subject: [PATCH 5.10 22/43] batman-adv: mcast: dont send link-local multicast to mcast routers Date: Mon, 10 Jan 2022 08:23:19 +0100 Message-Id: <20220110071818.092635692@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Linus L=C3=BCssing commit 938f2e0b57ffe8a6df71e1e177b2978b1b33fe5e upstream. The addition of routable multicast TX handling introduced a bug/regression for packets with a link-local multicast destination: These packets would be sent to all batman-adv nodes with a multicast router and to all batman-adv nodes with an old version without multicast router detection. This even disregards the batman-adv multicast fanout setting, which can potentially lead to an unwanted, high number of unicast transmissions or even congestion. Fixing this by avoiding to send link-local multicast packets to nodes in the multicast router list. Fixes: 11d458c1cb9b ("batman-adv: mcast: apply optimizations for routable p= ackets, too") Signed-off-by: Linus L=C3=BCssing Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/batman-adv/multicast.c | 15 ++++++++++----- net/batman-adv/multicast.h | 10 ++++++---- net/batman-adv/soft-interface.c | 7 +++++-- 3 files changed, 21 insertions(+), 11 deletions(-) --- a/net/batman-adv/multicast.c +++ b/net/batman-adv/multicast.c @@ -1373,6 +1373,7 @@ batadv_mcast_forw_rtr_node_get(struct ba * @bat_priv: the bat priv with all the soft interface information * @skb: The multicast packet to check * @orig: an originator to be set to forward the skb to + * @is_routable: stores whether the destination is routable * * Return: the forwarding mode as enum batadv_forw_mode and in case of * BATADV_FORW_SINGLE set the orig to the single originator the skb @@ -1380,17 +1381,16 @@ batadv_mcast_forw_rtr_node_get(struct ba */ enum batadv_forw_mode batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, - struct batadv_orig_node **orig) + struct batadv_orig_node **orig, int *is_routable) { int ret, tt_count, ip_count, unsnoop_count, total_count; bool is_unsnoopable =3D false; unsigned int mcast_fanout; struct ethhdr *ethhdr; - int is_routable =3D 0; int rtr_count =3D 0; =20 ret =3D batadv_mcast_forw_mode_check(bat_priv, skb, &is_unsnoopable, - &is_routable); + is_routable); if (ret =3D=3D -ENOMEM) return BATADV_FORW_NONE; else if (ret < 0) @@ -1403,7 +1403,7 @@ batadv_mcast_forw_mode(struct batadv_pri ip_count =3D batadv_mcast_forw_want_all_ip_count(bat_priv, ethhdr); unsnoop_count =3D !is_unsnoopable ? 0 : atomic_read(&bat_priv->mcast.num_want_all_unsnoopables); - rtr_count =3D batadv_mcast_forw_rtr_count(bat_priv, is_routable); + rtr_count =3D batadv_mcast_forw_rtr_count(bat_priv, *is_routable); =20 total_count =3D tt_count + ip_count + unsnoop_count + rtr_count; =20 @@ -1723,6 +1723,7 @@ batadv_mcast_forw_want_rtr(struct batadv * @bat_priv: the bat priv with all the soft interface information * @skb: the multicast packet to transmit * @vid: the vlan identifier + * @is_routable: stores whether the destination is routable * * Sends copies of a frame with multicast destination to any node that sig= naled * interest in it, that is either via the translation table or the accordi= ng @@ -1735,7 +1736,7 @@ batadv_mcast_forw_want_rtr(struct batadv * is neither IPv4 nor IPv6. NET_XMIT_SUCCESS otherwise. */ int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *s= kb, - unsigned short vid) + unsigned short vid, int is_routable) { int ret; =20 @@ -1751,12 +1752,16 @@ int batadv_mcast_forw_send(struct batadv return ret; } =20 + if (!is_routable) + goto skip_mc_router; + ret =3D batadv_mcast_forw_want_rtr(bat_priv, skb, vid); if (ret !=3D NET_XMIT_SUCCESS) { kfree_skb(skb); return ret; } =20 +skip_mc_router: consume_skb(skb); return ret; } --- a/net/batman-adv/multicast.h +++ b/net/batman-adv/multicast.h @@ -44,7 +44,8 @@ enum batadv_forw_mode { =20 enum batadv_forw_mode batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, - struct batadv_orig_node **mcast_single_orig); + struct batadv_orig_node **mcast_single_orig, + int *is_routable); =20 int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, struct sk_buff *skb, @@ -52,7 +53,7 @@ int batadv_mcast_forw_send_orig(struct b struct batadv_orig_node *orig_node); =20 int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *s= kb, - unsigned short vid); + unsigned short vid, int is_routable); =20 void batadv_mcast_init(struct batadv_priv *bat_priv); =20 @@ -71,7 +72,8 @@ void batadv_mcast_purge_orig(struct bata =20 static inline enum batadv_forw_mode batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, - struct batadv_orig_node **mcast_single_orig) + struct batadv_orig_node **mcast_single_orig, + int *is_routable) { return BATADV_FORW_ALL; } @@ -88,7 +90,7 @@ batadv_mcast_forw_send_orig(struct batad =20 static inline int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb, - unsigned short vid) + unsigned short vid, int is_routable) { kfree_skb(skb); return NET_XMIT_DROP; --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c @@ -200,6 +200,7 @@ static netdev_tx_t batadv_interface_tx(s int gw_mode; enum batadv_forw_mode forw_mode =3D BATADV_FORW_SINGLE; struct batadv_orig_node *mcast_single_orig =3D NULL; + int mcast_is_routable =3D 0; int network_offset =3D ETH_HLEN; __be16 proto; =20 @@ -302,7 +303,8 @@ static netdev_tx_t batadv_interface_tx(s send: if (do_bcast && !is_broadcast_ether_addr(ethhdr->h_dest)) { forw_mode =3D batadv_mcast_forw_mode(bat_priv, skb, - &mcast_single_orig); + &mcast_single_orig, + &mcast_is_routable); if (forw_mode =3D=3D BATADV_FORW_NONE) goto dropped; =20 @@ -367,7 +369,8 @@ send: ret =3D batadv_mcast_forw_send_orig(bat_priv, skb, vid, mcast_single_orig); } else if (forw_mode =3D=3D BATADV_FORW_SOME) { - ret =3D batadv_mcast_forw_send(bat_priv, skb, vid); + ret =3D batadv_mcast_forw_send(bat_priv, skb, vid, + mcast_is_routable); } else { if (batadv_dat_snoop_outgoing_arp_request(bat_priv, skb)) From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D59B6C433EF for ; Mon, 10 Jan 2022 07:46:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243366AbiAJHpP (ORCPT ); Mon, 10 Jan 2022 02:45:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50712 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241740AbiAJHgG (ORCPT ); Mon, 10 Jan 2022 02:36:06 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D4D9BC025275; Sun, 9 Jan 2022 23:31:29 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9FBB0B81204; Mon, 10 Jan 2022 07:31:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC39EC36AED; Mon, 10 Jan 2022 07:31:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799887; bh=hL96LzpfoO4m5GZoFJEaCllaxcBAZKgk4otdKobchbs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CtaaPmeJEVaf8fGlies6eTVbOjb1MIaE61hp0Jq1TXjHciohTB37vd1Kg4YVq8WTg checZt+HwVRYHzzPqUudUwEiJSfnhDvvxzQh7Qtn1kwGZq0EB0TmGEMOx8cgnzfogz t900G5ONCNzoDLBK6i7zP/zeiui6/Q9Uqr9UCEng= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , "David S. Miller" Subject: [PATCH 5.10 23/43] sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc Date: Mon, 10 Jan 2022 08:23:20 +0100 Message-Id: <20220110071818.131805409@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 7d18a07897d07495ee140dd319b0e9265c0f68ba upstream. tx_queue_len can be set to ~0U, we need to be more careful about overflows. __fls(0) is undefined, as this report shows: UBSAN: shift-out-of-bounds in net/sched/sch_qfq.c:1430:24 shift exponent 51770272 is too large for 32-bit type 'int' CPU: 0 PID: 25574 Comm: syz-executor.0 Not tainted 5.16.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x201/0x2d8 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x494/0x530 lib/ubsan.c:330 qfq_init_qdisc+0x43f/0x450 net/sched/sch_qfq.c:1430 qdisc_create+0x895/0x1430 net/sched/sch_api.c:1253 tc_modify_qdisc+0x9d9/0x1e20 net/sched/sch_api.c:1660 rtnetlink_rcv_msg+0x934/0xe60 net/core/rtnetlink.c:5571 netlink_rcv_skb+0x200/0x470 net/netlink/af_netlink.c:2496 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x814/0x9f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0xaea/0xe60 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] ____sys_sendmsg+0x5b9/0x910 net/socket.c:2409 ___sys_sendmsg net/socket.c:2463 [inline] __sys_sendmsg+0x280/0x370 net/socket.c:2492 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cos= t") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/sched/sch_qfq.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -1421,10 +1421,8 @@ static int qfq_init_qdisc(struct Qdisc * if (err < 0) return err; =20 - if (qdisc_dev(sch)->tx_queue_len + 1 > QFQ_MAX_AGG_CLASSES) - max_classes =3D QFQ_MAX_AGG_CLASSES; - else - max_classes =3D qdisc_dev(sch)->tx_queue_len + 1; + max_classes =3D min_t(u64, (u64)qdisc_dev(sch)->tx_queue_len + 1, + QFQ_MAX_AGG_CLASSES); /* max_cl_shift =3D floor(log_2(max_classes)) */ max_cl_shift =3D __fls(max_classes); q->max_agg_classes =3D 1< X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61CA1C433FE for ; Mon, 10 Jan 2022 07:38:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241236AbiAJHiM (ORCPT ); Mon, 10 Jan 2022 02:38:12 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:38784 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240579AbiAJHbc (ORCPT ); Mon, 10 Jan 2022 02:31:32 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D423C60B03; Mon, 10 Jan 2022 07:31:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BCC33C36AED; Mon, 10 Jan 2022 07:31:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799891; bh=PICXan5aO9ZTZWSwAepK2dzuaViXH9cshhkWx5vPSQc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lERKGCgv33AcerL3to3Wb9ubvpDjPdh2vrQhnnxnUWuEyXuB0UMmTxaNjRAF0/3td SpQChz2FbdDDMmvRqifsu5F6bmmzAEtLYMNawG1Zlo8GLoX/m5IpSKgPnnBDgw7NvV d9etUXWW9+AplJvyWVjoL+9irkflPF0wFhSt+Lfs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shay Agroskin , Arthur Kiyanovski , "David S. Miller" Subject: [PATCH 5.10 24/43] net: ena: Fix undefined state when tx request id is out of bounds Date: Mon, 10 Jan 2022 08:23:21 +0100 Message-Id: <20220110071818.164367439@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arthur Kiyanovski commit c255a34e02efb1393d23ffb205ba1a11320aeffb upstream. ena_com_tx_comp_req_id_get() checks the req_id of a received completion, and if it is out of bounds returns -EINVAL. This is a sign that something is wrong with the device and it needs to be reset. The current code does not reset the device in this case, which leaves the driver in an undefined state, where this completion is not properly handled. This commit adds a call to handle_invalid_req_id() in ena_clean_tx_irq() and ena_clean_xdp_irq() which resets the device to fix the issue. This commit also removes unnecessary request id checks from validate_tx_req_id() and validate_xdp_req_id(). This check is unneeded because it was already performed in ena_com_tx_comp_req_id_get(), which is called right before these functions. Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") Signed-off-by: Shay Agroskin Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/amazon/ena/ena_netdev.c | 34 +++++++++++++++-------= ----- 1 file changed, 20 insertions(+), 14 deletions(-) --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -1199,26 +1199,22 @@ static int handle_invalid_req_id(struct =20 static int validate_tx_req_id(struct ena_ring *tx_ring, u16 req_id) { - struct ena_tx_buffer *tx_info =3D NULL; + struct ena_tx_buffer *tx_info; =20 - if (likely(req_id < tx_ring->ring_size)) { - tx_info =3D &tx_ring->tx_buffer_info[req_id]; - if (likely(tx_info->skb)) - return 0; - } + tx_info =3D &tx_ring->tx_buffer_info[req_id]; + if (likely(tx_info->skb)) + return 0; =20 return handle_invalid_req_id(tx_ring, req_id, tx_info, false); } =20 static int validate_xdp_req_id(struct ena_ring *xdp_ring, u16 req_id) { - struct ena_tx_buffer *tx_info =3D NULL; + struct ena_tx_buffer *tx_info; =20 - if (likely(req_id < xdp_ring->ring_size)) { - tx_info =3D &xdp_ring->tx_buffer_info[req_id]; - if (likely(tx_info->xdpf)) - return 0; - } + tx_info =3D &xdp_ring->tx_buffer_info[req_id]; + if (likely(tx_info->xdpf)) + return 0; =20 return handle_invalid_req_id(xdp_ring, req_id, tx_info, true); } @@ -1243,9 +1239,14 @@ static int ena_clean_tx_irq(struct ena_r =20 rc =3D ena_com_tx_comp_req_id_get(tx_ring->ena_com_io_cq, &req_id); - if (rc) + if (rc) { + if (unlikely(rc =3D=3D -EINVAL)) + handle_invalid_req_id(tx_ring, req_id, NULL, + false); break; + } =20 + /* validate that the request id points to a valid skb */ rc =3D validate_tx_req_id(tx_ring, req_id); if (rc) break; @@ -1801,9 +1802,14 @@ static int ena_clean_xdp_irq(struct ena_ =20 rc =3D ena_com_tx_comp_req_id_get(xdp_ring->ena_com_io_cq, &req_id); - if (rc) + if (rc) { + if (unlikely(rc =3D=3D -EINVAL)) + handle_invalid_req_id(xdp_ring, req_id, NULL, + true); break; + } =20 + /* validate that the request id points to a valid xdp_frame */ rc =3D validate_xdp_req_id(xdp_ring, req_id); if (rc) break; From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1BFF0C433EF for ; Mon, 10 Jan 2022 07:41:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230055AbiAJHlV (ORCPT ); Mon, 10 Jan 2022 02:41:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49938 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240991AbiAJHeb (ORCPT ); Mon, 10 Jan 2022 02:34:31 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF190C0253BA; Sun, 9 Jan 2022 23:30:17 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6DB86611CE; Mon, 10 Jan 2022 07:30:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 54D2FC36AED; Mon, 10 Jan 2022 07:30:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799816; bh=3dspLntcUy2ueE+BT3e4HrJZXKrmVmN8PqhoofAlJkA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ML+EJA95DcR8kTwla1pN1ahKJt7hWTZRtZmplNvlHs2S0brN/1gXxlsNHWOjVOiAn /bMiUuSgHTAHJSJ6mKmyFNg/kTkDomxxnndq2eZOJsLzJw+Izkm+1RsFQ26S4kN87X goBzTfSZU0VEvOtGoM8RF3Nn6gBYHO18iuu7vXqs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shay Agroskin , Arthur Kiyanovski , "David S. Miller" Subject: [PATCH 5.10 25/43] net: ena: Fix error handling when calculating max IO queues number Date: Mon, 10 Jan 2022 08:23:22 +0100 Message-Id: <20220110071818.195583561@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arthur Kiyanovski commit 5055dc0348b8b7c168e3296044bccd724e1ae6cd upstream. The role of ena_calc_max_io_queue_num() is to return the number of queues supported by the device, which means the return value should be >=3D0. The function that calls ena_calc_max_io_queue_num(), checks the return value. If it is 0, it means the device reported it supports 0 IO queues. This case is considered an error and is handled by the calling function accordingly. However the current implementation of ena_calc_max_io_queue_num() is wrong, since when it detects the device supports 0 IO queues, it returns -EFAULT. In such a case the calling function doesn't detect the error, and therefore doesn't handle it. This commit changes ena_calc_max_io_queue_num() to return 0 in case the device reported it supports 0 queues, allowing the calling function to properly handle the error case. Fixes: 736ce3f414cc ("net: ena: make ethtool -l show correct max number of = queues") Signed-off-by: Shay Agroskin Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/amazon/ena/ena_netdev.c | 4 ---- 1 file changed, 4 deletions(-) --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -3927,10 +3927,6 @@ static u32 ena_calc_max_io_queue_num(str max_num_io_queues =3D min_t(u32, max_num_io_queues, io_tx_cq_num); /* 1 IRQ for for mgmnt and 1 IRQs for each IO direction */ max_num_io_queues =3D min_t(u32, max_num_io_queues, pci_msix_vec_count(pd= ev) - 1); - if (unlikely(!max_num_io_queues)) { - dev_err(&pdev->dev, "The device doesn't have io queues\n"); - return -EFAULT; - } =20 return max_num_io_queues; } From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6FF3BC433EF for ; Mon, 10 Jan 2022 07:41:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240678AbiAJHl0 (ORCPT ); Mon, 10 Jan 2022 02:41:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241022AbiAJHec (ORCPT ); Mon, 10 Jan 2022 02:34:32 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AA54DC025246; Sun, 9 Jan 2022 23:30:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4B25B611E2; Mon, 10 Jan 2022 07:30:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 30349C36AE9; Mon, 10 Jan 2022 07:30:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799819; bh=2KlE26ZJLolX3C57NOq5F8IXmQohsH+1VYKtkYusRfk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2W+qcuduYfIf14j9Hr9Lyl1r/w45Fzo/OrpuufpetDbNnQjna8WmeB11kkx/CzFO1 2Wnop2iryJ4IRIPjkdrPqjDDx37UMR0ErP+3VgEqKqDhFzWbBd25FKh8+WUJHFRlc+ 6R4djoDlLvFcTNFkMUkLTpl2x2eimGgSlB0imyp4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kirill Tkhai , "Darrick J. Wong" , "Darrick J. Wong" , Dave Chinner , Eric Sandeen Subject: [PATCH 5.10 26/43] xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate Date: Mon, 10 Jan 2022 08:23:23 +0100 Message-Id: <20220110071818.227285059@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Darrick J. Wong commit 983d8e60f50806f90534cc5373d0ce867e5aaf79 upstream. The old ALLOCSP/FREESP ioctls in XFS can be used to preallocate space at the end of files, just like fallocate and RESVSP. Make the behavior consistent with the other ioctls. Reported-by: Kirill Tkhai Signed-off-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Eric Sandeen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/xfs/xfs_ioctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/xfs/xfs_ioctl.c +++ b/fs/xfs/xfs_ioctl.c @@ -686,7 +686,8 @@ xfs_ioc_space( =20 if (bf->l_start > XFS_ISIZE(ip)) { error =3D xfs_alloc_file_space(ip, XFS_ISIZE(ip), - bf->l_start - XFS_ISIZE(ip), 0); + bf->l_start - XFS_ISIZE(ip), + XFS_BMAPI_PREALLOC); if (error) goto out_unlock; } From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A911C433EF for ; Mon, 10 Jan 2022 07:43:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241277AbiAJHni (ORCPT ); Mon, 10 Jan 2022 02:43:38 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:59278 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239995AbiAJHa2 (ORCPT ); Mon, 10 Jan 2022 02:30:28 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B2208B811FE; Mon, 10 Jan 2022 07:30:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 098FEC36AED; Mon, 10 Jan 2022 07:30:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799822; bh=tEkYWwadlxmsxg6ZaSbG9c94MNse80UX241m1dtluq8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h3Sn8FFes0+W6MPllJ6i+nlmi9fFzIDWtn+HWBwzWpi7y3lEtD4yvvdu4Bn0lAvNf vOfrgEyaxTqB43twV7rDO0ma9HPCx9xfjR7IRu9M8NALiVlKf3FEhjvKbDC/weX0oG Ir/feLaThYGjA97VnS8xrpbjMZuH6FbNGpIzjxOg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chunyan Zhang , Baolin Wang , Linus Walleij , Sebastian Reichel Subject: [PATCH 5.10 27/43] power: supply: core: Break capacity loop Date: Mon, 10 Jan 2022 08:23:24 +0100 Message-Id: <20220110071818.259990777@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Walleij commit 51c7b6a0398f54b9120795796a4cff4fc9634f7d upstream. We should not go on looking for more capacity tables after we realize we have looked at the last one in power_supply_find_ocv2cap_table(). Fixes: 3afb50d7125b ("power: supply: core: Add some helpers to use the batt= ery OCV capacity table") Cc: Chunyan Zhang Cc: Baolin Wang Signed-off-by: Linus Walleij Reviewed-by: Baolin Wang Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/power/supply/power_supply_core.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/power/supply/power_supply_core.c +++ b/drivers/power/supply/power_supply_core.c @@ -834,6 +834,10 @@ power_supply_find_ocv2cap_table(struct p return NULL; =20 for (i =3D 0; i < POWER_SUPPLY_OCV_TEMP_MAX; i++) { + /* Out of capacity tables */ + if (!info->ocv_table[i]) + break; + temp_diff =3D abs(info->ocv_temp[i] - temp); =20 if (temp_diff < best_temp_diff) { From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56ABCC433F5 for ; Mon, 10 Jan 2022 07:36:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239914AbiAJHgn (ORCPT ); Mon, 10 Jan 2022 02:36:43 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:39458 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239582AbiAJHa2 (ORCPT ); Mon, 10 Jan 2022 02:30:28 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EB723611DA; Mon, 10 Jan 2022 07:30:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CED47C36AE9; Mon, 10 Jan 2022 07:30:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799825; bh=AWkoo0UJSVGidasizP+wqQC4M68bJulON4pKMzqYRps=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1z/4HvDNAzar3qn2zazSWwPdlBWifx7Lcs7gzBEG1AdeJt1Yr5Zsru6BR61PFJdin pr414xUjfByy8gqCuwPvbb0vQLVyJyKeIlGX57EMcX8kgUOcMqwFm/3aK5sYugUbSJ e6yq124WZb1Zgn6lgtN3o0/rIn4PU78s+9RCbhWw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor , Nick Desaulniers , Sebastian Reichel Subject: [PATCH 5.10 28/43] power: reset: ltc2952: Fix use of floating point literals Date: Mon, 10 Jan 2022 08:23:25 +0100 Message-Id: <20220110071818.293128380@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nathan Chancellor commit 644106cdb89844be2496b21175b7c0c2e0fab381 upstream. A new commit in LLVM causes an error on the use of 'long double' when '-mno-x87' is used, which the kernel does through an alias, '-mno-80387' (see the LLVM commit below for more details around why it does this). drivers/power/reset/ltc2952-poweroff.c:162:28: error: expression requires = 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not = support it data->wde_interval =3D 300L * 1E6L; ^ drivers/power/reset/ltc2952-poweroff.c:162:21: error: expression requires = 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not = support it data->wde_interval =3D 300L * 1E6L; ^ drivers/power/reset/ltc2952-poweroff.c:163:41: error: expression requires = 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not = support it data->trigger_delay =3D ktime_set(2, 500L*1E6L); ^ 3 errors generated. This happens due to the use of a 'long double' literal. The 'E6' part of '1E6L' causes the literal to be a 'double' then the 'L' suffix promotes it to 'long double'. There is no visible reason for floating point values in this driver, as the values are only assigned to integer types. Use NSEC_PER_MSEC, which is the same integer value as '1E6L', to avoid changing functionality but fix the error. Fixes: 6647156c00cc ("power: reset: add LTC2952 poweroff driver") Link: https://github.com/ClangBuiltLinux/linux/issues/1497 Link: https://github.com/llvm/llvm-project/commit/a8083d42b1c346e21623a1d36= d1f0cadd7801d83 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/power/reset/ltc2952-poweroff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/power/reset/ltc2952-poweroff.c +++ b/drivers/power/reset/ltc2952-poweroff.c @@ -159,8 +159,8 @@ static void ltc2952_poweroff_kill(void) =20 static void ltc2952_poweroff_default(struct ltc2952_poweroff *data) { - data->wde_interval =3D 300L * 1E6L; - data->trigger_delay =3D ktime_set(2, 500L*1E6L); + data->wde_interval =3D 300L * NSEC_PER_MSEC; + data->trigger_delay =3D ktime_set(2, 500L * NSEC_PER_MSEC); =20 hrtimer_init(&data->timer_trigger, CLOCK_MONOTONIC, HRTIMER_MODE_REL); data->timer_trigger.function =3D ltc2952_poweroff_timer_trigger; From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E0D5C433EF for ; Mon, 10 Jan 2022 07:36:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240045AbiAJHgp (ORCPT ); Mon, 10 Jan 2022 02:36:45 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:38028 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240010AbiAJHaa (ORCPT ); Mon, 10 Jan 2022 02:30:30 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BBF71611E0; Mon, 10 Jan 2022 07:30:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3AD0C36AED; Mon, 10 Jan 2022 07:30:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799828; bh=1PC9Oavmy3rDsCgNb2kVCXK643NTyi/TUNXya1Ck5Og=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QDWgWAq5nEONvnqZnBT8nImY224Zwa5ERje7KakYtPgnlHpx0LYX3cuOCEjmaukfv tfAjPp5YPVYhKGcsqpekmP+8p2uy+Li11qoxnTSEzHBcg/6KW2Dh0QG2HY1QIleH79 ZBt0dGjO7oZZWt10bBxHBIp4QZq+pPebucMsQ4pw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thomas Toye , "David S. Miller" Subject: [PATCH 5.10 29/43] rndis_host: support Hytera digital radios Date: Mon, 10 Jan 2022 08:23:26 +0100 Message-Id: <20220110071818.325434123@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thomas Toye commit 29262e1f773b4b6a43711120be564c57fca07cfb upstream. Hytera makes a range of digital (DMR) radios. These radios can be programmed to a allow a computer to control them over Ethernet over USB, either using NCM or RNDIS. This commit adds support for RNDIS for Hytera radios. I tested with a Hytera PD785 and a Hytera MD785G. When these radios are programmed to set up a Radio to PC Network using RNDIS, an USB interface will be added with class 2 (Communications), subclass 2 (Abstract Modem Control) and an interface protocol of 255 ("vendor specific" - lsusb even hints "MSFT RNDIS?"). This patch is similar to the solution of this StackOverflow user, but that only works for the Hytera MD785: https://stackoverflow.com/a/53550858 To use the "Radio to PC Network" functionality of Hytera DMR radios, the radios need to be programmed correctly in CPS (Hytera's Customer Programming Software). "Forward to PC" should be checked in "Network" (under "General Setting" in "Conventional") and the "USB Network Communication Protocol" should be set to RNDIS. Signed-off-by: Thomas Toye Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/usb/rndis_host.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/net/usb/rndis_host.c +++ b/drivers/net/usb/rndis_host.c @@ -609,6 +609,11 @@ static const struct usb_device_id produc USB_CLASS_COMM, 2 /* ACM */, 0x0ff), .driver_info =3D (unsigned long) &rndis_poll_status_info, }, { + /* Hytera Communications DMR radios' "Radio to PC Network" */ + USB_VENDOR_AND_INTERFACE_INFO(0x238b, + USB_CLASS_COMM, 2 /* ACM */, 0x0ff), + .driver_info =3D (unsigned long)&rndis_info, +}, { /* RNDIS is MSFT's un-official variant of CDC ACM */ USB_INTERFACE_INFO(USB_CLASS_COMM, 2 /* ACM */, 0x0ff), .driver_info =3D (unsigned long) &rndis_info, From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6CBB7C433F5 for ; Mon, 10 Jan 2022 07:42:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241149AbiAJHm1 (ORCPT ); Mon, 10 Jan 2022 02:42:27 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:36500 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240341AbiAJHac (ORCPT ); Mon, 10 Jan 2022 02:30:32 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 94639611EC; Mon, 10 Jan 2022 07:30:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 78928C36AFF; Mon, 10 Jan 2022 07:30:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799831; bh=3Ickka+6v+gJYj2pcGsavEYdwSot3ss+0+8d/9R7JoQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nFTfKCCSgg9k2MbP38pnfsdq047G6yLJe5enh3IGBOt9YA/ngVbv3q0YkvL3R1ms+ UHcPa8Io2LnaX1oMSTEgJK+T0v0vL6ek0piw/b/L+jI/ZDL7erlO5yHbMk/aDdGOH+ 0ah7L2n9b2DEhlfJTVsvjo1uHGEhSi8/gdLpKL6o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangyu Hua , Jakub Kicinski , Aayush Agarwal Subject: [PATCH 5.10 30/43] phonet: refcount leak in pep_sock_accep Date: Mon, 10 Jan 2022 08:23:27 +0100 Message-Id: <20220110071818.355783033@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua commit bcd0f93353326954817a4f9fa55ec57fb38acbb0 upstream. sock_hold(sk) is invoked in pep_sock_accept(), but __sock_put(sk) is not invoked in subsequent failure branches(pep_accept_conn() !=3D 0). Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20211209082839.33985-1-hbh25y@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Aayush Agarwal Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/phonet/pep.c | 1 + 1 file changed, 1 insertion(+) --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -868,6 +868,7 @@ static struct sock *pep_sock_accept(stru =20 err =3D pep_accept_conn(newsk, skb); if (err) { + __sock_put(sk); sock_put(newsk); newsk =3D NULL; goto drop; From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59144C433EF for ; Mon, 10 Jan 2022 07:37:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241118AbiAJHhR (ORCPT ); Mon, 10 Jan 2022 02:37:17 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:39592 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240414AbiAJHae (ORCPT ); Mon, 10 Jan 2022 02:30:34 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 61D3F611C4; Mon, 10 Jan 2022 07:30:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 49B24C36AE9; Mon, 10 Jan 2022 07:30:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799833; bh=o+k6N9U2JrIm38Mm1wYeA64g57JqPN9hKHTLzztN/EA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tNKXHhi4NQDqP2OtrsbfAcGTOwg8O1E2f01iXN/HKL1hkhgQFT5dVm/RgSKovuCnI rL2+RDoCC3TX+Hzpt8YDJ+1+/td9XTEG6vSLhCO+vYhPcE5l7j5xmpPdzWVO60Gn4x 1stmTd7UR3Hq3mOzvPbz2KHVnQU5+050Rm82PEGY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yauhen Kharuzhy , Hans de Goede , Sebastian Reichel Subject: [PATCH 5.10 31/43] power: bq25890: Enable continuous conversion for ADC at charging Date: Mon, 10 Jan 2022 08:23:28 +0100 Message-Id: <20220110071818.393356915@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yauhen Kharuzhy commit 80211be1b9dec04cc2805d3d81e2091ecac289a1 upstream. Instead of one shot run of ADC at beginning of charging, run continuous conversion to ensure that all charging-related values are monitored properly (input voltage, input current, themperature etc.). Signed-off-by: Yauhen Kharuzhy Reviewed-by: Hans de Goede Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/power/supply/bq25890_charger.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/power/supply/bq25890_charger.c +++ b/drivers/power/supply/bq25890_charger.c @@ -581,12 +581,12 @@ static irqreturn_t __bq25890_handle_irq( =20 if (!new_state.online && bq->state.online) { /* power removed */ /* disable ADC */ - ret =3D bq25890_field_write(bq, F_CONV_START, 0); + ret =3D bq25890_field_write(bq, F_CONV_RATE, 0); if (ret < 0) goto error; } else if (new_state.online && !bq->state.online) { /* power inserted */ /* enable ADC, to have control of charge current/voltage */ - ret =3D bq25890_field_write(bq, F_CONV_START, 1); + ret =3D bq25890_field_write(bq, F_CONV_RATE, 1); if (ret < 0) goto error; } From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B97FC43219 for ; Mon, 10 Jan 2022 07:41:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242375AbiAJHkl (ORCPT ); Mon, 10 Jan 2022 02:40:41 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:39622 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240434AbiAJHai (ORCPT ); Mon, 10 Jan 2022 02:30:38 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2EEBB611C9; Mon, 10 Jan 2022 07:30:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17261C36AED; Mon, 10 Jan 2022 07:30:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799836; bh=8Bou99Z7xhHI5qHP4UwA5lGGapaDt39P3HoIrMHgDa8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=a9hlQrX7CnhVpZ9uE7P8cBQp/9ZTnQaKIGXVNmPA6HGPrtfkoCs13ZWa0YeXIhBfi qLiap6sVwqxJHBFHqFa4E7zZUWehUiqibzUO4f9E5bEvugWvsFvNp1pKzhwDVL87Pl fNAujFzvIi2nS6HX33awbw4WMi+gxs8HHdyRpJOI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Nicolas Dichtel , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.10 32/43] ipv6: Continue processing multipath route even if gateway attribute is invalid Date: Mon, 10 Jan 2022 08:23:29 +0100 Message-Id: <20220110071818.435920649@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern [ Upstream commit e30a845b0376eb51c9c94f56bbd53b2e08ba822f ] ip6_route_multipath_del loop continues processing the multipath attribute even if delete of a nexthop path fails. For consistency, do the same if the gateway attribute is invalid. Fixes: 1ff15a710a86 ("ipv6: Check attribute length for RTA_GATEWAY when del= eting multipath route") Signed-off-by: David Ahern Acked-by: Nicolas Dichtel Link: https://lore.kernel.org/r/20220103171911.94739-1-dsahern@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/route.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 7d10a4488b85d..230d4af44a300 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5348,8 +5348,10 @@ static int ip6_route_multipath_del(struct fib6_confi= g *cfg, if (nla) { err =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, extack); - if (err) - return err; + if (err) { + last_err =3D err; + goto next_rtnh; + } =20 r_cfg.fc_flags |=3D RTF_GATEWAY; } @@ -5358,6 +5360,7 @@ static int ip6_route_multipath_del(struct fib6_config= *cfg, if (err) last_err =3D err; =20 +next_rtnh: rtnh =3D rtnh_next(rtnh, &remaining); } =20 --=20 2.34.1 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46FA4C4332F for ; Mon, 10 Jan 2022 07:37:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240947AbiAJHh1 (ORCPT ); Mon, 10 Jan 2022 02:37:27 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:59502 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240147AbiAJHal (ORCPT ); Mon, 10 Jan 2022 02:30:41 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AF21FB8120C; Mon, 10 Jan 2022 07:30:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DA93DC36AE9; Mon, 10 Jan 2022 07:30:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799839; bh=/eoywV47atge0N5TmparPQvnwiOjWOT2D+p/neBdS/o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HzsThz+QGLZS2hRK7VQ0jljeSP6qXDN/upecyMzkgvtZ4gXB/ymvcHeVaNzgg6GTT Uh+w6Ot3Qcuk2JGESUkATgMRgzlFYoD8IXN/Iy45+K6XD8ZOVw7w0QvjWYu1L6iADT 8wNfa3fOsfZ1028CUExskrRdbZJYWzmN+Zn6brhQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Nicolas Dichtel , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.10 33/43] ipv6: Do cleanup if attribute validation fails in multipath route Date: Mon, 10 Jan 2022 08:23:30 +0100 Message-Id: <20220110071818.467553628@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern [ Upstream commit 95bdba23b5b4aa75fe3e6c84335e638641c707bb ] As Nicolas noted, if gateway validation fails walking the multipath attribute the code should jump to the cleanup to free previously allocated memory. Fixes: 1ff15a710a86 ("ipv6: Check attribute length for RTA_GATEWAY when del= eting multipath route") Signed-off-by: David Ahern Acked-by: Nicolas Dichtel Link: https://lore.kernel.org/r/20220103170555.94638-1-dsahern@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/route.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 230d4af44a300..654bf4ca61260 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5166,12 +5166,10 @@ static int ip6_route_multipath_add(struct fib6_conf= ig *cfg, =20 nla =3D nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - int ret; - - ret =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + err =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, extack); - if (ret) - return ret; + if (err) + goto cleanup; =20 r_cfg.fc_flags |=3D RTF_GATEWAY; } --=20 2.34.1 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 92528C433F5 for ; Mon, 10 Jan 2022 07:37:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240989AbiAJHhb (ORCPT ); Mon, 10 Jan 2022 02:37:31 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:39764 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239437AbiAJHan (ORCPT ); Mon, 10 Jan 2022 02:30:43 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D5AEB611D3; Mon, 10 Jan 2022 07:30:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B9B7EC36AED; Mon, 10 Jan 2022 07:30:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799842; bh=3Kq81HcSQasASCNb5NFstY6j6bWs7/XfjGJJgHndI0Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WKFYXEuvkML+vBpE0m57JIpfYMMbFok7A3slvWkb1yREQcXBiICSXiDjDUCo/1Y/G 1EgZVF688lRL5gOTt9JxxlpIb13M0vD6IaaKGavA79krLDMHAdvG/snS7bN0QLjfqP 08MHctWNoR/GNFT7Dw1xg9QxI/pyrgceVFkTBGDs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chunfeng Yun , Sasha Levin Subject: [PATCH 5.10 34/43] usb: mtu3: fix interval value for intr and isoc Date: Mon, 10 Jan 2022 08:23:31 +0100 Message-Id: <20220110071818.499255035@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chunfeng Yun [ Upstream commit e3d4621c22f90c33321ae6a6baab60cdb8e5a77c ] Use the Interval value from isoc/intr endpoint descriptor, no need minus one. The original code doesn't cause transfer error for normal cases, but it may have side effect with respond time of ERDY or tPingTimeout. Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20211218095749.6250-1-chunfeng.yun@mediatek= .com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/usb/mtu3/mtu3_gadget.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c index a3e1105c5c662..b7a6363f387aa 100644 --- a/drivers/usb/mtu3/mtu3_gadget.c +++ b/drivers/usb/mtu3/mtu3_gadget.c @@ -77,7 +77,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { interval =3D desc->bInterval; - interval =3D clamp_val(interval, 1, 16) - 1; + interval =3D clamp_val(interval, 1, 16); if (usb_endpoint_xfer_isoc(desc) && comp_desc) mult =3D comp_desc->bmAttributes; } @@ -89,7 +89,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) if (usb_endpoint_xfer_isoc(desc) || usb_endpoint_xfer_int(desc)) { interval =3D desc->bInterval; - interval =3D clamp_val(interval, 1, 16) - 1; + interval =3D clamp_val(interval, 1, 16); mult =3D usb_endpoint_maxp_mult(desc) - 1; } break; --=20 2.34.1 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A36FC2BA80 for ; Mon, 10 Jan 2022 07:41:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242350AbiAJHkk (ORCPT ); Mon, 10 Jan 2022 02:40:40 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:58326 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240134AbiAJHaw (ORCPT ); Mon, 10 Jan 2022 02:30:52 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 363DCB81219; Mon, 10 Jan 2022 07:30:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6063AC36AFB; Mon, 10 Jan 2022 07:30:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799847; bh=31yQ4M//QHOHNxcA+8askJI836thsVQc74Z6+Lo2RIA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gTobP+B3xV8UhqzB2ytIFwXGLPyYPbwn1vu8UVFVoH5wwI/mMndgoBoO+UuTtiQ40 jMuOEF91XH754kWdjLrdRPRytQo+af1yXWOO/kbppuN0Bu4SW/lnlZ0BJKnhWHOS3m uUAPE+1EsyQvvmmpdDO/nChvAVEpzorziuz56zhc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lu Tixiong , Mike Christie , Lee Duncan , Lixiaokeng , Linfeilong , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 35/43] scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() Date: Mon, 10 Jan 2022 08:23:32 +0100 Message-Id: <20220110071818.531046233@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lixiaokeng [ Upstream commit 1b8d0300a3e9f216ae4901bab886db7299899ec6 ] |- iscsi_if_destroy_conn |-dev_attr_show |-iscsi_conn_teardown |-spin_lock_bh |-iscsi_sw_tcp_conn_get_param |-kfree(conn->persistent_address) |-iscsi_conn_get_param |-kfree(conn->local_ipaddr) =3D=3D>|-read persistent_address =3D=3D>|-read local_ipaddr |-spin_unlock_bh When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a UAF may be triggered. Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei= .com Reported-by: Lu Tixiong Reviewed-by: Mike Christie Reviewed-by: Lee Duncan Signed-off-by: Lixiaokeng Signed-off-by: Linfeilong Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/libiscsi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index 30d27b6706746..d4e66c595eb87 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -2950,6 +2950,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_c= onn) { struct iscsi_conn *conn =3D cls_conn->dd_data; struct iscsi_session *session =3D conn->session; + char *tmp_persistent_address =3D conn->persistent_address; + char *tmp_local_ipaddr =3D conn->local_ipaddr; =20 del_timer_sync(&conn->transport_timer); =20 @@ -2971,8 +2973,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_c= onn) spin_lock_bh(&session->frwd_lock); free_pages((unsigned long) conn->data, get_order(ISCSI_DEF_MAX_RECV_SEG_LEN)); - kfree(conn->persistent_address); - kfree(conn->local_ipaddr); /* regular RX path uses back_lock */ spin_lock_bh(&session->back_lock); kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task, @@ -2984,6 +2984,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_c= onn) mutex_unlock(&session->eh_mutex); =20 iscsi_destroy_conn(cls_conn); + kfree(tmp_persistent_address); + kfree(tmp_local_ipaddr); } EXPORT_SYMBOL_GPL(iscsi_conn_teardown); =20 --=20 2.34.1 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81113C433F5 for ; Mon, 10 Jan 2022 07:41:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241088AbiAJHl4 (ORCPT ); Mon, 10 Jan 2022 02:41:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49910 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241454AbiAJHft (ORCPT ); Mon, 10 Jan 2022 02:35:49 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B46E9C028BD7; Sun, 9 Jan 2022 23:30:51 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5644C611E2; Mon, 10 Jan 2022 07:30:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 35332C36AED; Mon, 10 Jan 2022 07:30:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799850; bh=Ch0NtGZEkIqSBrM14f5tjhJhGFMmjni0sdxWta+UxUc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X5zrcKh5WTci+sXFCbbMOmMio/OhrTrqaSwuIk7PL0J8gZko35H8BffQWlcYoNu0b hH6eSLOh1m3FiUugpCAN8bodJGIGRrVKFVHzKiJruPUHMQpYgbtED05ZlY9wP3Rs59 CYneWVcao7Z2pDDuuvk3AwZjat2ey2LSSftvr/mE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, William Zhao , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 36/43] ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate Date: Mon, 10 Jan 2022 08:23:33 +0100 Message-Id: <20220110071818.563774600@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: William Zhao [ Upstream commit c1833c3964d5bd8c163bd4e01736a38bc473cb8a ] The "__ip6_tnl_parm" struct was left uninitialized causing an invalid load of random data when the "__ip6_tnl_parm" struct was used elsewhere. As an example, in the function "ip6_tnl_xmit_ctl()", it tries to access the "collect_md" member. With "__ip6_tnl_parm" being uninitialized and containing random data, the UBSAN detected that "collect_md" held a non-boolean value. The UBSAN issue is as follows: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D UBSAN: invalid-load in net/ipv6/ip6_tunnel.c:1025:14 load of value 30 is not a valid value for type '_Bool' CPU: 1 PID: 228 Comm: kworker/1:3 Not tainted 5.16.0-rc4+ #8 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: dump_stack_lvl+0x44/0x57 ubsan_epilogue+0x5/0x40 __ubsan_handle_load_invalid_value+0x66/0x70 ? __cpuhp_setup_state+0x1d3/0x210 ip6_tnl_xmit_ctl.cold.52+0x2c/0x6f [ip6_tunnel] vti6_tnl_xmit+0x79c/0x1e96 [ip6_vti] ? lock_is_held_type+0xd9/0x130 ? vti6_rcv+0x100/0x100 [ip6_vti] ? lock_is_held_type+0xd9/0x130 ? rcu_read_lock_bh_held+0xc0/0xc0 ? lock_acquired+0x262/0xb10 dev_hard_start_xmit+0x1e6/0x820 __dev_queue_xmit+0x2079/0x3340 ? mark_lock.part.52+0xf7/0x1050 ? netdev_core_pick_tx+0x290/0x290 ? kvm_clock_read+0x14/0x30 ? kvm_sched_clock_read+0x5/0x10 ? sched_clock_cpu+0x15/0x200 ? find_held_lock+0x3a/0x1c0 ? lock_release+0x42f/0xc90 ? lock_downgrade+0x6b0/0x6b0 ? mark_held_locks+0xb7/0x120 ? neigh_connected_output+0x31f/0x470 ? lockdep_hardirqs_on+0x79/0x100 ? neigh_connected_output+0x31f/0x470 ? ip6_finish_output2+0x9b0/0x1d90 ? rcu_read_lock_bh_held+0x62/0xc0 ? ip6_finish_output2+0x9b0/0x1d90 ip6_finish_output2+0x9b0/0x1d90 ? ip6_append_data+0x330/0x330 ? ip6_mtu+0x166/0x370 ? __ip6_finish_output+0x1ad/0xfb0 ? nf_hook_slow+0xa6/0x170 ip6_output+0x1fb/0x710 ? nf_hook.constprop.32+0x317/0x430 ? ip6_finish_output+0x180/0x180 ? __ip6_finish_output+0xfb0/0xfb0 ? lock_is_held_type+0xd9/0x130 ndisc_send_skb+0xb33/0x1590 ? __sk_mem_raise_allocated+0x11cf/0x1560 ? dst_output+0x4a0/0x4a0 ? ndisc_send_rs+0x432/0x610 addrconf_dad_completed+0x30c/0xbb0 ? addrconf_rs_timer+0x650/0x650 ? addrconf_dad_work+0x73c/0x10e0 addrconf_dad_work+0x73c/0x10e0 ? addrconf_dad_completed+0xbb0/0xbb0 ? rcu_read_lock_sched_held+0xaf/0xe0 ? rcu_read_lock_bh_held+0xc0/0xc0 process_one_work+0x97b/0x1740 ? pwq_dec_nr_in_flight+0x270/0x270 worker_thread+0x87/0xbf0 ? process_one_work+0x1740/0x1740 kthread+0x3ac/0x490 ? set_kthread_struct+0x100/0x100 ret_from_fork+0x22/0x30 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The solution is to initialize "__ip6_tnl_parm" struct to zeros in the "vti6_siocdevprivate()" function. Signed-off-by: William Zhao Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/ip6_vti.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c index 23aeeb46f99fc..99f2dc802e366 100644 --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -804,6 +804,8 @@ vti6_ioctl(struct net_device *dev, struct ifreq *ifr, i= nt cmd) struct net *net =3D dev_net(dev); struct vti6_net *ip6n =3D net_generic(net, vti6_net_id); =20 + memset(&p1, 0, sizeof(p1)); + switch (cmd) { case SIOCGETTUNNEL: if (dev =3D=3D ip6n->fb_tnl_dev) { --=20 2.34.1 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66353C4321E for ; Mon, 10 Jan 2022 07:37:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241415AbiAJHhj (ORCPT ); Mon, 10 Jan 2022 02:37:39 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:59634 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240101AbiAJHa5 (ORCPT ); Mon, 10 Jan 2022 02:30:57 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B6775B811E3; Mon, 10 Jan 2022 07:30:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0D698C36AE9; Mon, 10 Jan 2022 07:30:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799853; bh=JnLfpKarmaeJnfgtZqGxuI+wJOGE1vIwrpQ8HcTQ8Zs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=V4RrvqrHlgyS/5isuTulnuyUTBJzRRLCdoBjzglsAJCqVOE45n1o7PCY6+KW/yf9G mlerRYacuDMjbg1Auf1pplyXQx2/wF7we7PeyA5mdod2TS06l1+KS/xwEod50BAEaP uMTa8Gcyrc8oLduK8+EDy9wzWdgUWpSmV6EDV9vo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, yangxingwu , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 37/43] net: udp: fix alignment problem in udp4_seq_show() Date: Mon, 10 Jan 2022 08:23:34 +0100 Message-Id: <20220110071818.595913164@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: yangxingwu [ Upstream commit 6c25449e1a32c594d743df8e8258e8ef870b6a77 ] $ cat /pro/net/udp before: sl local_address rem_address st tx_queue rx_queue tr tm->when 26050: 0100007F:0035 00000000:0000 07 00000000:00000000 00:00000000 26320: 0100007F:0143 00000000:0000 07 00000000:00000000 00:00000000 27135: 00000000:8472 00000000:0000 07 00000000:00000000 00:00000000 after: sl local_address rem_address st tx_queue rx_queue tr tm->when 26050: 0100007F:0035 00000000:0000 07 00000000:00000000 00:00000000 26320: 0100007F:0143 00000000:0000 07 00000000:00000000 00:00000000 27135: 00000000:8472 00000000:0000 07 00000000:00000000 00:00000000 Signed-off-by: yangxingwu Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/udp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 86ed2afbee302..ef2068a60d4ad 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -3006,7 +3006,7 @@ int udp4_seq_show(struct seq_file *seq, void *v) { seq_setwidth(seq, 127); if (v =3D=3D SEQ_START_TOKEN) - seq_puts(seq, " sl local_address rem_address st tx_queue " + seq_puts(seq, " sl local_address rem_address st tx_queue " "rx_queue tr tm->when retrnsmt uid timeout " "inode ref pointer drops"); else { --=20 2.34.1 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 142DFC433FE for ; Mon, 10 Jan 2022 07:42:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240474AbiAJHmK (ORCPT ); Mon, 10 Jan 2022 02:42:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50416 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241488AbiAJHfw (ORCPT ); Mon, 10 Jan 2022 02:35:52 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5CF57C028BE8; Sun, 9 Jan 2022 23:30:57 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F3EEA60B03; Mon, 10 Jan 2022 07:30:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DDA80C36AE9; Mon, 10 Jan 2022 07:30:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799856; bh=rQWPm9cXJfuksOaoRvd/2G82SysMisSSSu3E4i638IY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cvBvtDJ0/dw2rINOlz+3YiPoeIuDIRWaQ7axTU8HqSZLFTZYTUcNonKFBXaIflljv LgxQIqqlGzJtfpQRbwAnfSzm7e7oEkt9YmILAKC3AVgnSXDWYK4M6jnoCXK8M+rQfi wjiDG43EQM7OYPc/lS7LuYQHkr58rnWen36JIOBA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zekun Shen , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 38/43] atlantic: Fix buff_ring OOB in aq_ring_rx_clean Date: Mon, 10 Jan 2022 08:23:35 +0100 Message-Id: <20220110071818.634747403@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit 5f50153288452e10b6edd69ec9112c49442b054a ] The function obtain the next buffer without boundary check. We should return with I/O error code. The bug is found by fuzzing and the crash report is attached. It is an OOB bug although reported as use-after-free. [ 4.804724] BUG: KASAN: use-after-free in aq_ring_rx_clean+0x1e88/0x2730= [atlantic] [ 4.805661] Read of size 4 at addr ffff888034fe93a8 by task ksoftirqd/0/9 [ 4.806505] [ 4.806703] CPU: 0 PID: 9 Comm: ksoftirqd/0 Tainted: G W = 5.6.0 #34 [ 4.809030] Call Trace: [ 4.809343] dump_stack+0x76/0xa0 [ 4.809755] print_address_description.constprop.0+0x16/0x200 [ 4.810455] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic] [ 4.811234] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic] [ 4.813183] __kasan_report.cold+0x37/0x7c [ 4.813715] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic] [ 4.814393] kasan_report+0xe/0x20 [ 4.814837] aq_ring_rx_clean+0x1e88/0x2730 [atlantic] [ 4.815499] ? hw_atl_b0_hw_ring_rx_receive+0x9a5/0xb90 [atlantic] [ 4.816290] aq_vec_poll+0x179/0x5d0 [atlantic] [ 4.816870] ? _GLOBAL__sub_I_65535_1_aq_pci_func_init+0x20/0x20 [atlant= ic] [ 4.817746] ? __next_timer_interrupt+0xba/0xf0 [ 4.818322] net_rx_action+0x363/0xbd0 [ 4.818803] ? call_timer_fn+0x240/0x240 [ 4.819302] ? __switch_to_asm+0x40/0x70 [ 4.819809] ? napi_busy_loop+0x520/0x520 [ 4.820324] __do_softirq+0x18c/0x634 [ 4.820797] ? takeover_tasklets+0x5f0/0x5f0 [ 4.821343] run_ksoftirqd+0x15/0x20 [ 4.821804] smpboot_thread_fn+0x2f1/0x6b0 [ 4.822331] ? smpboot_unregister_percpu_thread+0x160/0x160 [ 4.823041] ? __kthread_parkme+0x80/0x100 [ 4.823571] ? smpboot_unregister_percpu_thread+0x160/0x160 [ 4.824301] kthread+0x2b5/0x3b0 [ 4.824723] ? kthread_create_on_node+0xd0/0xd0 [ 4.825304] ret_from_fork+0x35/0x40 Signed-off-by: Zekun Shen Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net= /ethernet/aquantia/atlantic/aq_ring.c index 24122ccda614c..72f8751784c31 100644 --- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c @@ -365,6 +365,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self, if (!buff->is_eop) { buff_ =3D buff; do { + if (buff_->next >=3D self->size) { + err =3D -EIO; + goto err_exit; + } next_ =3D buff_->next, buff_ =3D &self->buff_ring[next_]; is_rsc_completed =3D @@ -388,6 +392,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self, (buff->is_lro && buff->is_cso_err)) { buff_ =3D buff; do { + if (buff_->next >=3D self->size) { + err =3D -EIO; + goto err_exit; + } next_ =3D buff_->next, buff_ =3D &self->buff_ring[next_]; =20 --=20 2.34.1 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D938C433FE for ; Mon, 10 Jan 2022 07:42:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241706AbiAJHmD (ORCPT ); Mon, 10 Jan 2022 02:42:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49934 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241492AbiAJHfw (ORCPT ); Mon, 10 Jan 2022 02:35:52 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 376BCC028BEC; Sun, 9 Jan 2022 23:31:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CC15D60B61; Mon, 10 Jan 2022 07:30:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B1529C36AF4; Mon, 10 Jan 2022 07:30:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799859; bh=/gdLnShWLpQP/o/mRaKeBqi4pXaE52yQZMGAJPcUVUY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qc0zMKUpJgXNe2vf7+O0j8LRp9L3mTYc3AAlRVcNKB4xvqeP9FG1ni08Az3JyMX8B zK5LN0zkJiNz8nqwOTWLQNS7AUILCMh4ewSw5KS0Ms7zxqzrbB5schwNJ+Ypn0UmjM BeJP1iSKoRuadILi90uL5IrH5CUieRPkzBoidPLw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, wolfgang huang , k2ci , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 39/43] mISDN: change function names to avoid conflicts Date: Mon, 10 Jan 2022 08:23:36 +0100 Message-Id: <20220110071818.670208955@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: wolfgang huang [ Upstream commit 8b5fdfc57cc2471179d1c51081424ded833c16c8 ] As we build for mips, we meet following error. l1_init error with multiple definition. Some architecture devices usually marked with l1, l2, lxx as the start-up phase. so we change the mISDN function names, align with Isdnl2_xxx. mips-linux-gnu-ld: drivers/isdn/mISDN/layer1.o: in function `l1_init': (.text+0x890): multiple definition of `l1_init'; \ arch/mips/kernel/bmips_5xxx_init.o:(.text+0xf0): first defined here make[1]: *** [home/mips/kernel-build/linux/Makefile:1161: vmlinux] Error 1 Signed-off-by: wolfgang huang Reported-by: k2ci Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/isdn/mISDN/core.c | 6 +++--- drivers/isdn/mISDN/core.h | 4 ++-- drivers/isdn/mISDN/layer1.c | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c index 55891e4204460..a41b4b2645941 100644 --- a/drivers/isdn/mISDN/core.c +++ b/drivers/isdn/mISDN/core.c @@ -381,7 +381,7 @@ mISDNInit(void) err =3D mISDN_inittimer(&debug); if (err) goto error2; - err =3D l1_init(&debug); + err =3D Isdnl1_Init(&debug); if (err) goto error3; err =3D Isdnl2_Init(&debug); @@ -395,7 +395,7 @@ mISDNInit(void) error5: Isdnl2_cleanup(); error4: - l1_cleanup(); + Isdnl1_cleanup(); error3: mISDN_timer_cleanup(); error2: @@ -408,7 +408,7 @@ static void mISDN_cleanup(void) { misdn_sock_cleanup(); Isdnl2_cleanup(); - l1_cleanup(); + Isdnl1_cleanup(); mISDN_timer_cleanup(); class_unregister(&mISDN_class); =20 diff --git a/drivers/isdn/mISDN/core.h b/drivers/isdn/mISDN/core.h index 23b44d3033279..42599f49c189d 100644 --- a/drivers/isdn/mISDN/core.h +++ b/drivers/isdn/mISDN/core.h @@ -60,8 +60,8 @@ struct Bprotocol *get_Bprotocol4id(u_int); extern int mISDN_inittimer(u_int *); extern void mISDN_timer_cleanup(void); =20 -extern int l1_init(u_int *); -extern void l1_cleanup(void); +extern int Isdnl1_Init(u_int *); +extern void Isdnl1_cleanup(void); extern int Isdnl2_Init(u_int *); extern void Isdnl2_cleanup(void); =20 diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c index 98a3bc6c17009..7b31c25a550e3 100644 --- a/drivers/isdn/mISDN/layer1.c +++ b/drivers/isdn/mISDN/layer1.c @@ -398,7 +398,7 @@ create_l1(struct dchannel *dch, dchannel_l1callback *dc= b) { EXPORT_SYMBOL(create_l1); =20 int -l1_init(u_int *deb) +Isdnl1_Init(u_int *deb) { debug =3D deb; l1fsm_s.state_count =3D L1S_STATE_COUNT; @@ -409,7 +409,7 @@ l1_init(u_int *deb) } =20 void -l1_cleanup(void) +Isdnl1_cleanup(void) { mISDN_FsmFree(&l1fsm_s); } --=20 2.34.1 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2692C433F5 for ; Mon, 10 Jan 2022 07:38:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241314AbiAJHh5 (ORCPT ); Mon, 10 Jan 2022 02:37:57 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:59722 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239770AbiAJHbE (ORCPT ); Mon, 10 Jan 2022 02:31:04 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 33878B8121A; Mon, 10 Jan 2022 07:31:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F3F2C36AED; Mon, 10 Jan 2022 07:31:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799862; bh=VFsMEDFi2et/sw+n4+sEQCpcZOafJvKtFXe8OymcemI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ffgk2llh5OLsqb+RpmajVWvgdNZNt8Eu8VU4raaQG9rGNKPCxfDoAcE1K+rEJxo+Y FqOmP18cbxv5tMZbNVefdBOKn8HACu4befET8TE2+jcNBk0+UTFf/h/6GRFL/LbQ9g 5rm/R8Fd6v4AeWw/YL8Qq01ASIOsT2s9wMh9InG4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Wheeler , Anthony Koo , Rodrigo Siqueira , Derek Lai , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 40/43] drm/amd/display: Added power down for DCN10 Date: Mon, 10 Jan 2022 08:23:37 +0100 Message-Id: <20220110071818.701348709@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lai, Derek [ Upstream commit d97e631af2db84c8c9d63abf68d487d0bb559e4c ] [Why] The change of setting a timer callback on boot for 10 seconds is still working, just lacked power down for DCN10. [How] Added power down for DCN10. Tested-by: Daniel Wheeler Reviewed-by: Anthony Koo Acked-by: Rodrigo Siqueira Signed-off-by: Derek Lai Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c b/drivers/gp= u/drm/amd/display/dc/dcn10/dcn10_init.c index b24c8ae8b1ece..7e228c181b298 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c @@ -77,6 +77,7 @@ static const struct hw_sequencer_funcs dcn10_funcs =3D { .get_clock =3D dcn10_get_clock, .get_vupdate_offset_from_vsync =3D dcn10_get_vupdate_offset_from_vsync, .calc_vupdate_position =3D dcn10_calc_vupdate_position, + .power_down =3D dce110_power_down, .set_backlight_level =3D dce110_set_backlight_level, .set_abm_immediate_disable =3D dce110_set_abm_immediate_disable, .set_pipe =3D dce110_set_pipe, --=20 2.34.1 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9216EC433FE for ; Mon, 10 Jan 2022 07:37:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241172AbiAJHhx (ORCPT ); Mon, 10 Jan 2022 02:37:53 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:40088 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240501AbiAJHbI (ORCPT ); Mon, 10 Jan 2022 02:31:08 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 68B6160B29; Mon, 10 Jan 2022 07:31:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 505AAC36AE9; Mon, 10 Jan 2022 07:31:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799864; bh=l7CVo2z3VIAukLP5OI+M20kymgqAuMyHZpmtDAElU0w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ITR7U1HdFl+gtQhKd8055obIh1qWM3q7wa9asiV/8yfBXZDKSPrTnWjyXue8Wchr2 YooMILUMqCoD6sw1JsPYFwyGhVpeb7NM6FcXX7L/X/li5nyvcrJPGAjjz4xluc2ZYg T/WxgwDKQ5u0EhplIbxSV9OyDKQANgc3objob9XE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tamir Duberstein , Willem de Bruijn , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.10 41/43] ipv6: raw: check passed optlen before reading Date: Mon, 10 Jan 2022 08:23:38 +0100 Message-Id: <20220110071818.731814848@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tamir Duberstein [ Upstream commit fb7bc9204095090731430c8921f9e629740c110a ] Add a check that the user-provided option is at least as long as the number of bytes we intend to read. Before this patch we would blindly read sizeof(int) bytes even in cases where the user passed optlen Signed-off-by: Willem de Bruijn Link: https://lore.kernel.org/r/20211229200947.2862255-1-willemdebruijn.ker= nel@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/raw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index 00f133a55ef7c..38349054e361e 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c @@ -1020,6 +1020,9 @@ static int do_rawv6_setsockopt(struct sock *sk, int l= evel, int optname, struct raw6_sock *rp =3D raw6_sk(sk); int val; =20 + if (optlen < sizeof(val)) + return -EINVAL; + if (copy_from_sockptr(&val, optval, sizeof(val))) return -EFAULT; =20 --=20 2.34.1 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7161C4332F for ; Mon, 10 Jan 2022 07:46:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243248AbiAJHpE (ORCPT ); Mon, 10 Jan 2022 02:45:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50752 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241510AbiAJHfy (ORCPT ); Mon, 10 Jan 2022 02:35:54 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 19356C028BF4; Sun, 9 Jan 2022 23:31:10 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CF6E1B81205; Mon, 10 Jan 2022 07:31:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 26C78C36AED; Mon, 10 Jan 2022 07:31:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799867; bh=nbDOWtRTOobu4zr4WWANoM0fHIMn9fEz4m8CnbDXrd0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Bm3z1sMCYEyK1dg3ebfn2KbvWlEx2611EseJW+eyg627WF8m/rvZT/BxkN2VWFBnj BX2/j7eJ08FZw8PAfXXgePnf25rHhxdukBw5hR0tjC1t5XB+mVOUn8j/ADuZ0Fnpjb YMU9S0UHHSHVhTIULW9hO5hqRGJzhsvG4GgH1P8Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stefan Wahren , Florian Fainelli , Jan Kiszka , Phil Elwell , Linus Walleij , Olof Johansson , Sasha Levin Subject: [PATCH 5.10 42/43] ARM: dts: gpio-ranges property is now required Date: Mon, 10 Jan 2022 08:23:39 +0100 Message-Id: <20220110071818.764625175@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Phil Elwell [ Upstream commit c8013355ead68dce152cf426686f8a5f80d88b40 ] Since [1], added in 5.7, the absence of a gpio-ranges property has prevented GPIOs from being restored to inputs when released. Add those properties for BCM283x and BCM2711 devices. [1] commit 2ab73c6d8323 ("gpio: Support GPIO controllers without pin-ranges") Link: https://lore.kernel.org/r/20220104170247.956760-1-linus.walleij@linar= o.org Fixes: 2ab73c6d8323 ("gpio: Support GPIO controllers without pin-ranges") Fixes: 266423e60ea1 ("pinctrl: bcm2835: Change init order for gpio hogs") Reported-by: Stefan Wahren Reported-by: Florian Fainelli Reported-by: Jan Kiszka Signed-off-by: Phil Elwell Acked-by: Florian Fainelli Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20211206092237.4105895-3-phil@raspberrypi.c= om Signed-off-by: Linus Walleij Acked-by: Florian Fainelli Signed-off-by: Olof Johansson Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/bcm2711.dtsi | 2 ++ arch/arm/boot/dts/bcm283x.dtsi | 2 ++ 2 files changed, 4 insertions(+) diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi index 4ade854bdcdaf..55ec83bde5a61 100644 --- a/arch/arm/boot/dts/bcm2711.dtsi +++ b/arch/arm/boot/dts/bcm2711.dtsi @@ -555,6 +555,8 @@ , ; =20 + gpio-ranges =3D <&gpio 0 0 58>; + gpclk0_gpio49: gpclk0_gpio49 { pin-gpclk { pins =3D "gpio49"; diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi index 0f3be55201a5b..ffdf7c4fba465 100644 --- a/arch/arm/boot/dts/bcm283x.dtsi +++ b/arch/arm/boot/dts/bcm283x.dtsi @@ -126,6 +126,8 @@ interrupt-controller; #interrupt-cells =3D <2>; =20 + gpio-ranges =3D <&gpio 0 0 54>; + /* Defines common pin muxing groups * * While each pin can have its mux selected --=20 2.34.1 From nobody Tue Jun 30 21:18:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 970F4C433FE for ; Mon, 10 Jan 2022 07:46:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243217AbiAJHo6 (ORCPT ); Mon, 10 Jan 2022 02:44:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50440 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241511AbiAJHfy (ORCPT ); Mon, 10 Jan 2022 02:35:54 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2FEFBC028BF6; Sun, 9 Jan 2022 23:31:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C9476B81161; Mon, 10 Jan 2022 07:31:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 027FFC36AED; Mon, 10 Jan 2022 07:31:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799870; bh=QGV9ybegpgxeb4XkMaOZjZs9eMIf49iusznKtxoQzC8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tMSyJ16aGyQLKgeufj9I8QcRBwgOcMwd0yQqwP48qebYRCtau2wL8528CqwUJRagK zrmfcputES+QOv3y42c2zAdZw2JxD0JYNQlbqYXeMphVsrBEnqSgeepzdNE3RpIy/5 vjRgJHwl4SOAMWl0Mh74rPFJrvD/LnvLxd2q/98I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Walleij , Nikita Travkin , Dmitry Torokhov Subject: [PATCH 5.10 43/43] Input: zinitix - make sure the IRQ is allocated before it gets enabled Date: Mon, 10 Jan 2022 08:23:40 +0100 Message-Id: <20220110071818.798892318@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071817.337619922@linuxfoundation.org> References: <20220110071817.337619922@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nikita Travkin commit cf73ed894ee939d6706d65e0cd186e4a64e3af6d upstream. Since irq request is the last thing in the driver probe, it happens later than the input device registration. This means that there is a small time window where if the open method is called the driver will attempt to enable not yet available irq. Fix that by moving the irq request before the input device registration. Reviewed-by: Linus Walleij Fixes: 26822652c85e ("Input: add zinitix touchscreen driver") Signed-off-by: Nikita Travkin Link: https://lore.kernel.org/r/20220106072840.36851-2-nikita@trvn.ru Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/input/touchscreen/zinitix.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) --- a/drivers/input/touchscreen/zinitix.c +++ b/drivers/input/touchscreen/zinitix.c @@ -488,6 +488,15 @@ static int zinitix_ts_probe(struct i2c_c return error; } =20 + error =3D devm_request_threaded_irq(&client->dev, client->irq, + NULL, zinitix_ts_irq_handler, + IRQF_ONESHOT, + client->name, bt541); + if (error) { + dev_err(&client->dev, "Failed to request IRQ: %d\n", error); + return error; + } + error =3D zinitix_init_input_dev(bt541); if (error) { dev_err(&client->dev, @@ -514,13 +523,6 @@ static int zinitix_ts_probe(struct i2c_c } =20 irq_set_status_flags(client->irq, IRQ_NOAUTOEN); - error =3D devm_request_threaded_irq(&client->dev, client->irq, - NULL, zinitix_ts_irq_handler, - IRQF_ONESHOT, client->name, bt541); - if (error) { - dev_err(&client->dev, "Failed to request IRQ: %d\n", error); - return error; - } =20 return 0; }