From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9ACDC433F5 for ; Mon, 10 Jan 2022 07:47:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241931AbiAJHq6 (ORCPT ); Mon, 10 Jan 2022 02:46:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49916 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240407AbiAJHgR (ORCPT ); Mon, 10 Jan 2022 02:36:17 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5EEB1C028BFA; Sun, 9 Jan 2022 23:31:39 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1F0ABB81204; Mon, 10 Jan 2022 07:31:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 638DEC36AE9; Mon, 10 Jan 2022 07:31:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799896; bh=lh3yShjx/46d/M0GAxDLwzAg5b4SKTEqcxr8exdbcr4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=c4GFM0af7is7ryBngzeOVwQJnGgGEz9qwARo5TfW08ulHl6ItmbQOM7Db2LmonZo1 alq6WgfVzulZvPRFrIuWuzbMVSLdcFWCbfrT96pYvDIRzph4frdahv6P7319LjcaBg cevMhsLZsDNY1IV6nn2fka/PcleDlkjAyjKzQkUo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Howells , Dominique Martinet , Jeffrey E Altman Subject: [PATCH 5.15 01/72] fscache_cookie_enabled: check cookie is valid before accessing it Date: Mon, 10 Jan 2022 08:22:38 +0100 Message-Id: <20220110071821.549570773@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dominique Martinet commit 0dc54bd4d6e03be1f0b678c4297170b79f1a44ab upstream. fscache_cookie_enabled() could be called on NULL cookies and cause a null pointer dereference when accessing cookie flags: just make sure the cookie is valid first Suggested-by: David Howells Acked-by: David Howells Signed-off-by: Dominique Martinet Cc: Jeffrey E Altman Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- include/linux/fscache.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/linux/fscache.h +++ b/include/linux/fscache.h @@ -167,7 +167,7 @@ struct fscache_cookie { =20 static inline bool fscache_cookie_enabled(struct fscache_cookie *cookie) { - return test_bit(FSCACHE_COOKIE_ENABLED, &cookie->flags); + return fscache_cookie_valid(cookie) && test_bit(FSCACHE_COOKIE_ENABLED, &= cookie->flags); } =20 /* From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CEEC1C433F5 for ; Mon, 10 Jan 2022 07:38:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240650AbiAJHi4 (ORCPT ); Mon, 10 Jan 2022 02:38:56 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:60428 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239596AbiAJHcL (ORCPT ); Mon, 10 Jan 2022 02:32:11 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 58828B81212; Mon, 10 Jan 2022 07:32:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D285C36AF2; Mon, 10 Jan 2022 07:32:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799929; bh=amkLwSEaFB8ELixfHTAcmT95x8/YFpi2ur/98Fmnou8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CSp5CLipA5jXkm6/bfzx13a5Z086+UvXwpwPIJ0y5XYe9ZRpiA2ApRBcr0oHRjUds 4x8OJR0DBd8QKedyo2IvtUqzSgAsk3HRPAibpg5pfU9kPbW70LfJmnMhPn7qJo7Vfn JWmEDBGaBZmbLFGwrsDrtxBZV48MLB5yMUa3lmAw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shuah Khan , Naresh Kamboju Subject: [PATCH 5.15 02/72] selftests: x86: fix [-Wstringop-overread] warn in test_process_vm_readv() Date: Mon, 10 Jan 2022 08:22:39 +0100 Message-Id: <20220110071821.589550032@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Shuah Khan commit dd40f44eabe1e122c6852fabb298aac05b083fce upstream. Fix the following [-Wstringop-overread] by passing in the variable instead of the value. test_vsyscall.c: In function =E2=80=98test_process_vm_readv=E2=80=99: test_vsyscall.c:500:22: warning: =E2=80=98__builtin_memcmp_eq=E2=80=99 spec= ified bound 4096 exceeds source size 0 [-Wstringop-overread] 500 | if (!memcmp(buf, (const void *)0xffffffffff600000, = 4096)) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~= ~~~~~ Signed-off-by: Shuah Khan Cc: Naresh Kamboju Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- tools/testing/selftests/x86/test_vsyscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/tools/testing/selftests/x86/test_vsyscall.c +++ b/tools/testing/selftests/x86/test_vsyscall.c @@ -497,7 +497,7 @@ static int test_process_vm_readv(void) } =20 if (vsyscall_map_r) { - if (!memcmp(buf, (const void *)0xffffffffff600000, 4096)) { + if (!memcmp(buf, remote.iov_base, sizeof(buf))) { printf("[OK]\tIt worked and read correct data\n"); } else { printf("[FAIL]\tIt worked but returned incorrect data\n"); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B015C433FE for ; Mon, 10 Jan 2022 07:41:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241911AbiAJHj4 (ORCPT ); Mon, 10 Jan 2022 02:39:56 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41338 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240827AbiAJHcl (ORCPT ); Mon, 10 Jan 2022 02:32:41 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AE0AD60A27; Mon, 10 Jan 2022 07:32:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9ACEFC36AEF; Mon, 10 Jan 2022 07:32:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799960; bh=aItdWZrYQ4r+MQbQWHdR8JhXYZtvsRP3CHcnG7SXWWY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F6rqczgriKv9xbKqNuffh0BXZGaoOdcW5OwW0OCYX02yWNNsf3hxpWG7hz+8T5gKD JJtzX6P82nIIzlbIYB/0iwXfOo2Xa6S6V4+JZu1JN/LAwJ41cFTlXziveVP4awYwY2 ZZUNPvasAXiJixac3rapvonlTXZwJFCaZf1zvbXk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Naveen N. Rao" , Steven Rostedt Subject: [PATCH 5.15 03/72] tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() Date: Mon, 10 Jan 2022 08:22:40 +0100 Message-Id: <20220110071821.622058073@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Naveen N. Rao commit 823e670f7ed616d0ce993075c8afe0217885f79d upstream. With the new osnoise tracer, we are seeing the below splat: Kernel attempted to read user page (c7d880000) - exploit attempt? (uid:= 0) BUG: Unable to handle kernel data access on read at 0xc7d880000 Faulting instruction address: 0xc0000000002ffa10 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=3D64K MMU=3DRadix SMP NR_CPUS=3D2048 NUMA pSeries ... NIP [c0000000002ffa10] __trace_array_vprintk.part.0+0x70/0x2f0 LR [c0000000002ff9fc] __trace_array_vprintk.part.0+0x5c/0x2f0 Call Trace: [c0000008bdd73b80] [c0000000001c49cc] put_prev_task_fair+0x3c/0x60 (unr= eliable) [c0000008bdd73be0] [c000000000301430] trace_array_printk_buf+0x70/0x90 [c0000008bdd73c00] [c0000000003178b0] trace_sched_switch_callback+0x250= /0x290 [c0000008bdd73c90] [c000000000e70d60] __schedule+0x410/0x710 [c0000008bdd73d40] [c000000000e710c0] schedule+0x60/0x130 [c0000008bdd73d70] [c000000000030614] interrupt_exit_user_prepare_main+= 0x264/0x270 [c0000008bdd73de0] [c000000000030a70] syscall_exit_prepare+0x150/0x180 [c0000008bdd73e10] [c00000000000c174] system_call_vectored_common+0xf4/= 0x278 osnoise tracer on ppc64le is triggering osnoise_taint() for negative duration in get_int_safe_duration() called from trace_sched_switch_callback()->thread_exit(). The problem though is that the check for a valid trace_percpu_buffer is incorrect in get_trace_buf(). The check is being done after calculating the pointer for the current cpu, rather than on the main percpu pointer. Fix the check to be against trace_percpu_buffer. Link: https://lkml.kernel.org/r/a920e4272e0b0635cf20c444707cbce1b2c8973d.16= 40255304.git.naveen.n.rao@linux.vnet.ibm.com Cc: stable@vger.kernel.org Fixes: e2ace001176dc9 ("tracing: Choose static tp_printk buffer by explicit= nesting count") Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -3241,7 +3241,7 @@ static char *get_trace_buf(void) { struct trace_buffer_struct *buffer =3D this_cpu_ptr(trace_percpu_buffer); =20 - if (!buffer || buffer->nesting >=3D 4) + if (!trace_percpu_buffer || buffer->nesting >=3D 4) return NULL; =20 buffer->nesting++; From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57C91C4332F for ; Mon, 10 Jan 2022 07:41:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241930AbiAJHj5 (ORCPT ); Mon, 10 Jan 2022 02:39:57 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41478 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239681AbiAJHcw (ORCPT ); Mon, 10 Jan 2022 02:32:52 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6B76A611A3; Mon, 10 Jan 2022 07:32:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 49FD2C36AE9; Mon, 10 Jan 2022 07:32:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799971; bh=aGCz36vNGwIQ60C4D02oEUjhaOn9ARIbmrSMX9g914k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xZWwKIbHCNcTPI3Wexg383Ju4O2BSJ+7FOhi4EHe8UJsbH7DxRgqtsaV8dfl2YzXa JD21Vk8tHdZg1U1PTZjEaxD75gvI4tc0XTebwNwQhQ5DlPXb6QUKpfhV6ZSTxLAUeK aa2uSuQASKd+qxog1MvVBX4VWSQ99gGeUObFdnA8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , "Naveen N. Rao" , Steven Rostedt Subject: [PATCH 5.15 04/72] tracing: Tag trace_percpu_buffer as a percpu pointer Date: Mon, 10 Jan 2022 08:22:41 +0100 Message-Id: <20220110071821.658453846@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Naveen N. Rao commit f28439db470cca8b6b082239314e9fd10bd39034 upstream. Tag trace_percpu_buffer as a percpu pointer to resolve warnings reported by sparse: /linux/kernel/trace/trace.c:3218:46: warning: incorrect type in initializ= er (different address spaces) /linux/kernel/trace/trace.c:3218:46: expected void const [noderef] __p= ercpu *__vpp_verify /linux/kernel/trace/trace.c:3218:46: got struct trace_buffer_struct * /linux/kernel/trace/trace.c:3234:9: warning: incorrect type in initialize= r (different address spaces) /linux/kernel/trace/trace.c:3234:9: expected void const [noderef] __pe= rcpu *__vpp_verify /linux/kernel/trace/trace.c:3234:9: got int * Link: https://lkml.kernel.org/r/ebabd3f23101d89cb75671b68b6f819f5edc830b.16= 40255304.git.naveen.n.rao@linux.vnet.ibm.com Cc: stable@vger.kernel.org Reported-by: kernel test robot Fixes: 07d777fe8c398 ("tracing: Add percpu buffers for trace_printk()") Signed-off-by: Naveen N. Rao Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- kernel/trace/trace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -3231,7 +3231,7 @@ struct trace_buffer_struct { char buffer[4][TRACE_BUF_SIZE]; }; =20 -static struct trace_buffer_struct *trace_percpu_buffer; +static struct trace_buffer_struct __percpu *trace_percpu_buffer; =20 /* * This allows for lockless recording. If we're nested too deeply, then @@ -3260,7 +3260,7 @@ static void put_trace_buf(void) =20 static int alloc_percpu_trace_buffer(void) { - struct trace_buffer_struct *buffers; + struct trace_buffer_struct __percpu *buffers; =20 if (trace_percpu_buffer) return 0; From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D834C433EF for ; Mon, 10 Jan 2022 07:41:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241990AbiAJHkH (ORCPT ); Mon, 10 Jan 2022 02:40:07 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:60910 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239640AbiAJHc5 (ORCPT ); Mon, 10 Jan 2022 02:32:57 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E28F2B81204; Mon, 10 Jan 2022 07:32:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1F5D1C36AE9; Mon, 10 Jan 2022 07:32:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799974; bh=9P1dIeqwCnSv4LDOwZYrLDkkin9SJBgZd7H6EHhP9hc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Zrgf6psjfNoLYEI+NL1bOuQPV+rUX1ibYeqIyHKz4mYLfAh4FwNQapnSv8+N9PUPT 78ep22UcL4ae8hRAnerfVEuLUfQ9KrBK6YFZ+Ncb90QM/ZmxQC0cHLMA31+lrflmjU Uc9UCA1Lvwp+/qjoYQIn+BI2it/vd/JJXLgPdTxU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maor Gottlieb , Leon Romanovsky , Jason Gunthorpe Subject: [PATCH 5.15 05/72] Revert "RDMA/mlx5: Fix releasing unallocated memory in dereg MR flow" Date: Mon, 10 Jan 2022 08:22:42 +0100 Message-Id: <20220110071821.695096216@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maor Gottlieb commit 4163cb3d1980383220ad7043002b930995dcba33 upstream. This patch is not the full fix and still causes to call traces during mlx5_ib_dereg_mr(). This reverts commit f0ae4afe3d35e67db042c58a52909e06262b740f. Fixes: f0ae4afe3d35 ("RDMA/mlx5: Fix releasing unallocated memory in dereg = MR flow") Link: https://lore.kernel.org/r/20211222101312.1358616-1-maorg@nvidia.com Signed-off-by: Maor Gottlieb Acked-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/infiniband/hw/mlx5/mlx5_ib.h | 6 +++--- drivers/infiniband/hw/mlx5/mr.c | 28 +++++++++++++++------------- 2 files changed, 18 insertions(+), 16 deletions(-) --- a/drivers/infiniband/hw/mlx5/mlx5_ib.h +++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h @@ -641,6 +641,7 @@ struct mlx5_ib_mr { =20 /* User MR data */ struct mlx5_cache_ent *cache_ent; + struct ib_umem *umem; =20 /* This is zero'd when the MR is allocated */ union { @@ -652,7 +653,7 @@ struct mlx5_ib_mr { struct list_head list; }; =20 - /* Used only by kernel MRs */ + /* Used only by kernel MRs (umem =3D=3D NULL) */ struct { void *descs; void *descs_alloc; @@ -674,9 +675,8 @@ struct mlx5_ib_mr { int data_length; }; =20 - /* Used only by User MRs */ + /* Used only by User MRs (umem !=3D NULL) */ struct { - struct ib_umem *umem; unsigned int page_shift; /* Current access_flags */ int access_flags; --- a/drivers/infiniband/hw/mlx5/mr.c +++ b/drivers/infiniband/hw/mlx5/mr.c @@ -1911,18 +1911,19 @@ err: return ret; } =20 -static void mlx5_free_priv_descs(struct mlx5_ib_mr *mr) +static void +mlx5_free_priv_descs(struct mlx5_ib_mr *mr) { - struct mlx5_ib_dev *dev =3D to_mdev(mr->ibmr.device); - int size =3D mr->max_descs * mr->desc_size; - - if (!mr->descs) - return; - - dma_unmap_single(&dev->mdev->pdev->dev, mr->desc_map, size, - DMA_TO_DEVICE); - kfree(mr->descs_alloc); - mr->descs =3D NULL; + if (!mr->umem && mr->descs) { + struct ib_device *device =3D mr->ibmr.device; + int size =3D mr->max_descs * mr->desc_size; + struct mlx5_ib_dev *dev =3D to_mdev(device); + + dma_unmap_single(&dev->mdev->pdev->dev, mr->desc_map, size, + DMA_TO_DEVICE); + kfree(mr->descs_alloc); + mr->descs =3D NULL; + } } =20 int mlx5_ib_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata) @@ -1998,8 +1999,7 @@ int mlx5_ib_dereg_mr(struct ib_mr *ibmr, if (mr->cache_ent) { mlx5_mr_cache_free(dev, mr); } else { - if (!udata) - mlx5_free_priv_descs(mr); + mlx5_free_priv_descs(mr); kfree(mr); } return 0; @@ -2086,6 +2086,7 @@ static struct mlx5_ib_mr *mlx5_ib_alloc_ if (err) goto err_free_in; =20 + mr->umem =3D NULL; kfree(in); =20 return mr; @@ -2212,6 +2213,7 @@ static struct ib_mr *__mlx5_ib_alloc_mr( } =20 mr->ibmr.device =3D pd->device; + mr->umem =3D NULL; =20 switch (mr_type) { case IB_MR_TYPE_MEM_REG: From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B56F2C4332F for ; Mon, 10 Jan 2022 07:41:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242055AbiAJHkN (ORCPT ); Mon, 10 Jan 2022 02:40:13 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:59634 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240299AbiAJHdB (ORCPT ); Mon, 10 Jan 2022 02:33:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9ECB3B811FE; Mon, 10 Jan 2022 07:32:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E84A7C36AE9; Mon, 10 Jan 2022 07:32:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799977; bh=W1D9UO82cgAo6aiHdohcnepskgBlIB9uzCRajtDZ34M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TyC9RLE8lLy2+C0JoN1Mp8uXL5LATcIdYAwDMAvm0AjSe9L4Plck5fUALk2qITTyN roFBfBUvUH9UHOCNjXdIFn/sEADZm9NhHmc784YG88cyyEc85olrPavLHd2+f02nw6 1ibiM3RkpZanuYqvgJGQFMiPTLIN6wdk/rFKCv9Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Potapenko , Alexander Aring , Pavel Skripkin , Stefan Schmidt Subject: [PATCH 5.15 06/72] ieee802154: atusb: fix uninit value in atusb_set_extended_addr Date: Mon, 10 Jan 2022 08:22:43 +0100 Message-Id: <20220110071821.727892953@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin commit 754e4382354f7908923a1949d8dc8d05f82f09cb upstream. Alexander reported a use of uninitialized value in atusb_set_extended_addr(), that is caused by reading 0 bytes via usb_control_msg(). Fix it by validating if the number of bytes transferred is actually correct, since usb_control_msg() may read less bytes, than was requested by caller. Fail log: BUG: KASAN: uninit-cmp in ieee802154_is_valid_extended_unicast_addr include= /linux/ieee802154.h:310 [inline] BUG: KASAN: uninit-cmp in atusb_set_extended_addr drivers/net/ieee802154/at= usb.c:1000 [inline] BUG: KASAN: uninit-cmp in atusb_probe.cold+0x29f/0x14db drivers/net/ieee802= 154/atusb.c:1056 Uninit value used in comparison: 311daa649a2003bd stack handle: 000000009a2= 003bd ieee802154_is_valid_extended_unicast_addr include/linux/ieee802154.h:310 [= inline] atusb_set_extended_addr drivers/net/ieee802154/atusb.c:1000 [inline] atusb_probe.cold+0x29f/0x14db drivers/net/ieee802154/atusb.c:1056 usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396 Fixes: 7490b008d123 ("ieee802154: add support for atusb transceiver") Reported-by: Alexander Potapenko Acked-by: Alexander Aring Signed-off-by: Pavel Skripkin Link: https://lore.kernel.org/r/20220104182806.7188-1-paskripkin@gmail.com Signed-off-by: Stefan Schmidt Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ieee802154/atusb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/drivers/net/ieee802154/atusb.c +++ b/drivers/net/ieee802154/atusb.c @@ -93,7 +93,9 @@ static int atusb_control_msg(struct atus =20 ret =3D usb_control_msg(usb_dev, pipe, request, requesttype, value, index, data, size, timeout); - if (ret < 0) { + if (ret < size) { + ret =3D ret < 0 ? ret : -ENODATA; + atusb->err =3D ret; dev_err(&usb_dev->dev, "%s: req 0x%02x val 0x%x idx 0x%x, error %d\n", @@ -861,9 +863,9 @@ static int atusb_get_and_show_build(stru if (!build) return -ENOMEM; =20 - ret =3D atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0), - ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0, - build, ATUSB_BUILD_SIZE, 1000); + /* We cannot call atusb_control_msg() here, since this request may read v= arious length data */ + ret =3D usb_control_msg(atusb->usb_dev, usb_rcvctrlpipe(usb_dev, 0), ATUS= B_BUILD, + ATUSB_REQ_FROM_DEV, 0, 0, build, ATUSB_BUILD_SIZE, 1000); if (ret >=3D 0) { build[ret] =3D 0; dev_info(&usb_dev->dev, "Firmware: build %s\n", build); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4243AC433EF for ; Mon, 10 Jan 2022 07:46:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243573AbiAJHpp (ORCPT ); Mon, 10 Jan 2022 02:45:45 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50426 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240277AbiAJHiU (ORCPT ); Mon, 10 Jan 2022 02:38:20 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D9BE9C09B058; Sun, 9 Jan 2022 23:33:02 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 95FDAB811E3; Mon, 10 Jan 2022 07:33:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF6C3C36AED; Mon, 10 Jan 2022 07:32:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799980; bh=lDfrkpNjtoMRFV8osMw3gxZTOWP/QrK56n6S9WjjuXM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KOEpGawdBmLLzyjjoQVAfPQCkfGOy3qdSnLnQzKE3w8RmuglDRfiTMZEw++ubTtC7 joGFXpebYpv7iR/bfZjL/IdWsLTU/5u8p5oKGkS3O+UhIKV4D89+H9eneK2EqcHEzP ypzgysbN1hvKbhN9I/55IY1YdsoMm2CO+HOdUIhE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Grzegorz Szczurek , Mateusz Palczewski , Paul M Stillwell Jr , Aleksandr Loktionov , Tony Brelinski , Tony Nguyen Subject: [PATCH 5.15 07/72] i40e: Fix to not show opcode msg on unsuccessful VF MAC change Date: Mon, 10 Jan 2022 08:22:44 +0100 Message-Id: <20220110071821.758970107@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mateusz Palczewski commit 01cbf50877e602e2376af89e4a51c30bc574c618 upstream. Hide i40e opcode information sent during response to VF in case when untrusted VF tried to change MAC on the VF interface. This is implemented by adding an additional parameter 'hide' to the response sent to VF function that hides the display of error information, but forwards the error code to VF. Previously it was not possible to send response with some error code to VF without displaying opcode information. Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface") Signed-off-by: Grzegorz Szczurek Signed-off-by: Mateusz Palczewski Reviewed-by: Paul M Stillwell Jr Reviewed-by: Aleksandr Loktionov Tested-by: Tony Brelinski Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 40 ++++++++++++++++= ----- 1 file changed, 32 insertions(+), 8 deletions(-) --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c @@ -1877,17 +1877,19 @@ sriov_configure_out: /***********************virtual channel routines******************/ =20 /** - * i40e_vc_send_msg_to_vf + * i40e_vc_send_msg_to_vf_ex * @vf: pointer to the VF info * @v_opcode: virtual channel opcode * @v_retval: virtual channel return value * @msg: pointer to the msg buffer * @msglen: msg length + * @is_quiet: true for not printing unsuccessful return values, false othe= rwise * * send msg to VF **/ -static int i40e_vc_send_msg_to_vf(struct i40e_vf *vf, u32 v_opcode, - u32 v_retval, u8 *msg, u16 msglen) +static int i40e_vc_send_msg_to_vf_ex(struct i40e_vf *vf, u32 v_opcode, + u32 v_retval, u8 *msg, u16 msglen, + bool is_quiet) { struct i40e_pf *pf; struct i40e_hw *hw; @@ -1903,7 +1905,7 @@ static int i40e_vc_send_msg_to_vf(struct abs_vf_id =3D vf->vf_id + hw->func_caps.vf_base_id; =20 /* single place to detect unsuccessful return values */ - if (v_retval) { + if (v_retval && !is_quiet) { vf->num_invalid_msgs++; dev_info(&pf->pdev->dev, "VF %d failed opcode %d, retval: %d\n", vf->vf_id, v_opcode, v_retval); @@ -1934,6 +1936,23 @@ static int i40e_vc_send_msg_to_vf(struct } =20 /** + * i40e_vc_send_msg_to_vf + * @vf: pointer to the VF info + * @v_opcode: virtual channel opcode + * @v_retval: virtual channel return value + * @msg: pointer to the msg buffer + * @msglen: msg length + * + * send msg to VF + **/ +static int i40e_vc_send_msg_to_vf(struct i40e_vf *vf, u32 v_opcode, + u32 v_retval, u8 *msg, u16 msglen) +{ + return i40e_vc_send_msg_to_vf_ex(vf, v_opcode, v_retval, + msg, msglen, false); +} + +/** * i40e_vc_send_resp_to_vf * @vf: pointer to the VF info * @opcode: operation code @@ -2695,6 +2714,7 @@ error_param: * i40e_check_vf_permission * @vf: pointer to the VF info * @al: MAC address list from virtchnl + * @is_quiet: set true for printing msg without opcode info, false otherwi= se * * Check that the given list of MAC addresses is allowed. Will return -EPE= RM * if any address in the list is not valid. Checks the following condition= s: @@ -2709,13 +2729,15 @@ error_param: * addresses might not be accurate. **/ static inline int i40e_check_vf_permission(struct i40e_vf *vf, - struct virtchnl_ether_addr_list *al) + struct virtchnl_ether_addr_list *al, + bool *is_quiet) { struct i40e_pf *pf =3D vf->pf; struct i40e_vsi *vsi =3D pf->vsi[vf->lan_vsi_idx]; int mac2add_cnt =3D 0; int i; =20 + *is_quiet =3D false; for (i =3D 0; i < al->num_elements; i++) { struct i40e_mac_filter *f; u8 *addr =3D al->list[i].addr; @@ -2739,6 +2761,7 @@ static inline int i40e_check_vf_permissi !ether_addr_equal(addr, vf->default_lan_addr.addr)) { dev_err(&pf->pdev->dev, "VF attempting to override administratively set MAC address, bring dow= n and up the VF interface to resume normal operation\n"); + *is_quiet =3D true; return -EPERM; } =20 @@ -2775,6 +2798,7 @@ static int i40e_vc_add_mac_addr_msg(stru (struct virtchnl_ether_addr_list *)msg; struct i40e_pf *pf =3D vf->pf; struct i40e_vsi *vsi =3D NULL; + bool is_quiet =3D false; i40e_status ret =3D 0; int i; =20 @@ -2791,7 +2815,7 @@ static int i40e_vc_add_mac_addr_msg(stru */ spin_lock_bh(&vsi->mac_filter_hash_lock); =20 - ret =3D i40e_check_vf_permission(vf, al); + ret =3D i40e_check_vf_permission(vf, al, &is_quiet); if (ret) { spin_unlock_bh(&vsi->mac_filter_hash_lock); goto error_param; @@ -2829,8 +2853,8 @@ static int i40e_vc_add_mac_addr_msg(stru =20 error_param: /* send the response to the VF */ - return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_ADD_ETH_ADDR, - ret); + return i40e_vc_send_msg_to_vf_ex(vf, VIRTCHNL_OP_ADD_ETH_ADDR, + ret, NULL, 0, is_quiet); } =20 /** From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB1D2C4167B for ; Mon, 10 Jan 2022 07:41:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242125AbiAJHkP (ORCPT ); Mon, 10 Jan 2022 02:40:15 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41618 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240870AbiAJHdE (ORCPT ); Mon, 10 Jan 2022 02:33:04 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B88E160F81; Mon, 10 Jan 2022 07:33:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9F81FC36AED; Mon, 10 Jan 2022 07:33:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799983; bh=tR1ZCEsYQm4fvpxkqSSPTZVCnW2ChIeMjEFgxVTo3YE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m9O4qFHbNPPpMwvaPj+EjXo1T+jPJO4wzmBWRAoBjwvQzVLPzU4MCbAPZpOrEgfX7 lKyufhmANdsr5mLiNpi3WQVGs4a9WMuPj+IEnp8gOZDJmg+EhJ+U5YWuas82sejA7e oKv0nl6OhrsFrhZuJkdzgCU5jxxr20n0lCEHAJwc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ashwin Vijayavel , Karen Sornek , Konrad Jankowski , Tony Nguyen Subject: [PATCH 5.15 08/72] iavf: Fix limit of total number of queues to active queues of VF Date: Mon, 10 Jan 2022 08:22:45 +0100 Message-Id: <20220110071821.797177803@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Karen Sornek commit b712941c8085e638bb92456e866ed3de4404e3d5 upstream. In the absence of this validation, if the user requests to configure queues more than the enabled queues, it results in sending the requested number of queues to the kernel stack (due to the asynchronous nature of VF response), in which case the stack might pick a queue to transmit that is not enabled and result in Tx hang. Fix this bug by limiting the total number of queues allocated for VF to active queues of VF. Fixes: d5b33d024496 ("i40evf: add ndo_setup_tc callback to i40evf") Signed-off-by: Ashwin Vijayavel Signed-off-by: Karen Sornek Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/intel/iavf/iavf_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/intel/iavf/iavf_main.c +++ b/drivers/net/ethernet/intel/iavf/iavf_main.c @@ -2652,8 +2652,11 @@ static int iavf_validate_ch_config(struc total_max_rate +=3D tx_rate; num_qps +=3D mqprio_qopt->qopt.count[i]; } - if (num_qps > IAVF_MAX_REQ_QUEUES) + if (num_qps > adapter->num_active_queues) { + dev_err(&adapter->pdev->dev, + "Cannot support requested number of queues\n"); return -EINVAL; + } =20 ret =3D iavf_validate_tx_bandwidth(adapter, total_max_rate); return ret; From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19749C43219 for ; Mon, 10 Jan 2022 07:46:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243900AbiAJHqB (ORCPT ); Mon, 10 Jan 2022 02:46:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50424 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239953AbiAJHiX (ORCPT ); Mon, 10 Jan 2022 02:38:23 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CECA2C0258C7; Sun, 9 Jan 2022 23:33:08 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9A232B81211; Mon, 10 Jan 2022 07:33:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7473AC36AED; Mon, 10 Jan 2022 07:33:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799986; bh=Z+zCmTEq1nUUaLCcSgs4oup25kLMn11yeAWlNCsjOKs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NfPYZO5eG7Tfk//1odlRR//PZKF+UJuTKQpgdFZ3jegq6Mz+j+IEQ5swXi7Ek9p39 vxMEMGW05r95pKW7wyK+tkCQxzQdHxTQENAuKasFHX+w0UZu0mshUecUM/Bl5aZ+/K kd3LjLVKGyt96HllolBLOXkTlB1ydP4jNxDH7I9g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+6d532fa8f9463da290bc@syzkaller.appspotmail.com, Leon Romanovsky , Jason Gunthorpe Subject: [PATCH 5.15 09/72] RDMA/core: Dont infoleak GRH fields Date: Mon, 10 Jan 2022 08:22:46 +0100 Message-Id: <20220110071821.834606636@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Leon Romanovsky commit b35a0f4dd544eaa6162b6d2f13a2557a121ae5fd upstream. If dst->is_global field is not set, the GRH fields are not cleared and the following infoleak is reported. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instru= mented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:209 [inline] ucma_init_qp_attr+0x8c7/0xb10 drivers/infiniband/core/ucma.c:1242 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 vfs_write+0x8ce/0x2030 fs/read_write.c:588 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline] __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Local variable resp created at: ucma_init_qp_attr+0xa4/0xb10 drivers/infiniband/core/ucma.c:1214 ucma_write+0x637/0x6c0 drivers/infiniband/core/ucma.c:1732 Bytes 40-59 of 144 are uninitialized Memory access of size 144 starts at ffff888167523b00 Data copied to user address 0000000020000100 CPU: 1 PID: 25910 Comm: syz-executor.1 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D Fixes: 4ba66093bdc6 ("IB/core: Check for global flag when using ah_attr") Link: https://lore.kernel.org/r/0e9dd51f93410b7b2f4f5562f52befc878b71afa.16= 41298868.git.leonro@nvidia.com Reported-by: syzbot+6d532fa8f9463da290bc@syzkaller.appspotmail.com Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/infiniband/core/uverbs_marshall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/infiniband/core/uverbs_marshall.c +++ b/drivers/infiniband/core/uverbs_marshall.c @@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_d struct rdma_ah_attr *src =3D ah_attr; struct rdma_ah_attr conv_ah; =20 - memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved)); + memset(&dst->grh, 0, sizeof(dst->grh)); =20 if ((ah_attr->type =3D=3D RDMA_AH_ATTR_TYPE_OPA) && (rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) && From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2D045C4707E for ; Mon, 10 Jan 2022 07:46:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243987AbiAJHqE (ORCPT ); Mon, 10 Jan 2022 02:46:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50412 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240429AbiAJHgR (ORCPT ); Mon, 10 Jan 2022 02:36:17 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6030DC025187; Sun, 9 Jan 2022 23:31:42 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 19F52B81212; Mon, 10 Jan 2022 07:31:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3BDFCC36AE9; Mon, 10 Jan 2022 07:31:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799899; bh=LWMxIqdPLrruG753ovFKYiDSZqY2xr4yMtOUiZIOR7I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VnWqmGdCVvGFn2fy86yIOnIbw8F5POvos80LzpG84PpryhjomdA2vFAemuPJuQ+Qd ypP1/aES55nQe824OKmloCxkBZQ9vLFLrhypUF1sJ3XC5fbW6gpyGDz12rkXzTH7FF k8gLGh9l7oQtvZrT5pKzdN5Lcf0eu+ylklJqGyrA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Aaron Ma , Jakub Kicinski Subject: [PATCH 5.15 10/72] Revert "net: usb: r8152: Add MAC passthrough support for more Lenovo Docks" Date: Mon, 10 Jan 2022 08:22:47 +0100 Message-Id: <20220110071821.868066147@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Aaron Ma commit 00fcf8c7dd564c44448ff6a39728d2ca0c8efbd8 upstream. This reverts commit f77b83b5bbab53d2be339184838b19ed2c62c0a5. This change breaks multiple usb to ethernet dongles attached on Lenovo USB hub. Fixes: f77b83b5bbab ("net: usb: r8152: Add MAC passthrough support for more= Lenovo Docks") Signed-off-by: Aaron Ma Link: https://lore.kernel.org/r/20220105155102.8557-1-aaron.ma@canonical.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/usb/r8152.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/drivers/net/usb/r8152.c +++ b/drivers/net/usb/r8152.c @@ -9638,9 +9638,12 @@ static int rtl8152_probe(struct usb_inte netdev->hw_features &=3D ~NETIF_F_RXCSUM; } =20 - if (udev->parent && - le16_to_cpu(udev->parent->descriptor.idVendor) =3D=3D VENDOR_ID_LENOVO)= { - tp->lenovo_macpassthru =3D 1; + if (le16_to_cpu(udev->descriptor.idVendor) =3D=3D VENDOR_ID_LENOVO) { + switch (le16_to_cpu(udev->descriptor.idProduct)) { + case DEVICE_ID_THINKPAD_THUNDERBOLT3_DOCK_GEN2: + case DEVICE_ID_THINKPAD_USB_C_DOCK_GEN2: + tp->lenovo_macpassthru =3D 1; + } } =20 if (le16_to_cpu(udev->descriptor.bcdDevice) =3D=3D 0x3011 && udev->serial= && From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78600C433FE for ; Mon, 10 Jan 2022 07:38:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240369AbiAJHiZ (ORCPT ); Mon, 10 Jan 2022 02:38:25 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:40590 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233849AbiAJHbn (ORCPT ); Mon, 10 Jan 2022 02:31:43 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 267E360B9F; Mon, 10 Jan 2022 07:31:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0956DC36AEF; Mon, 10 Jan 2022 07:31:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799902; bh=lcHfSChScLvyGOU8GsHzTVoEVeZZVhOFXm8cepE1HTo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BM0rmaF/mdPSM3kmb9dnLnogb1jsxnnsHkxCrE1WD9ec6hLm9V2Ja1+SZ+pmBzW6C tbfZ5Wbs7NhwVQk7oOGUqJPB7zMqG2n1XleTD3iA6+jPvkGvfjsNw2zsMvn+fXKUvn rKSr2uiswp9acKkJJR7hE0Az54HjefQM2xhCnRIs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Christoph Hellwig , "David S. Miller" Subject: [PATCH 5.15 11/72] netrom: fix copying in user data in nr_setsockopt Date: Mon, 10 Jan 2022 08:22:48 +0100 Message-Id: <20220110071821.925775387@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christoph Hellwig commit 3087a6f36ee028ec095c04a8531d7d33899b7fed upstream. This code used to copy in an unsigned long worth of data before the sockptr_t conversion, so restore that. Fixes: a7b75c5a8c41 ("net: pass a sockptr_t into ->setsockopt") Reported-by: Dan Carpenter Signed-off-by: Christoph Hellwig Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/netrom/af_netrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -306,7 +306,7 @@ static int nr_setsockopt(struct socket * if (optlen < sizeof(unsigned int)) return -EINVAL; =20 - if (copy_from_sockptr(&opt, optval, sizeof(unsigned int))) + if (copy_from_sockptr(&opt, optval, sizeof(unsigned long))) return -EFAULT; =20 switch (optname) { From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2705DC4167B for ; Mon, 10 Jan 2022 07:46:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243384AbiAJHpQ (ORCPT ); Mon, 10 Jan 2022 02:45:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50422 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240541AbiAJHgS (ORCPT ); Mon, 10 Jan 2022 02:36:18 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5CB29C02518D; Sun, 9 Jan 2022 23:31:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F1B8860B6E; Mon, 10 Jan 2022 07:31:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2144C36AF4; Mon, 10 Jan 2022 07:31:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799905; bh=X2wDFP56moBYtbS6wX69NSgzas0ikE8pK/yrZsQ/Dx8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YBkTsNyBnOuKj7z6BCMv9/652maxM8LOsCV9qBIISAdr7qN6jiOP5lKd2GF6zq1sF EKuNs9AYOc2zEIJFMLvpNFhD1IaQHoxAge2bfNcJfhs43WB1cql7nPiZ8jiTLE1MaR dURGz38MT8eQiFwchanZk/LVAfVMKe3VyLwL0VxI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Leon Romanovsky , Jason Gunthorpe Subject: [PATCH 5.15 12/72] RDMA/uverbs: Check for null return of kmalloc_array Date: Mon, 10 Jan 2022 08:22:49 +0100 Message-Id: <20220110071821.964439878@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang commit 7694a7de22c53a312ea98960fcafc6ec62046531 upstream. Because of the possible failure of the allocation, data might be NULL pointer and will cause the dereference of the NULL pointer later. Therefore, it might be better to check it and return -ENOMEM. Fixes: 6884c6c4bd09 ("RDMA/verbs: Store the write/write_ex uapi entry point= s in the uverbs_api") Link: https://lore.kernel.org/r/20211231093315.1917667-1-jiasheng@iscas.ac.= cn Signed-off-by: Jiasheng Jiang Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/infiniband/core/uverbs_uapi.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/infiniband/core/uverbs_uapi.c +++ b/drivers/infiniband/core/uverbs_uapi.c @@ -447,6 +447,9 @@ static int uapi_finalize(struct uverbs_a uapi->num_write_ex =3D max_write_ex + 1; data =3D kmalloc_array(uapi->num_write + uapi->num_write_ex, sizeof(*uapi->write_methods), GFP_KERNEL); + if (!data) + return -ENOMEM; + for (i =3D 0; i !=3D uapi->num_write + uapi->num_write_ex; i++) data[i] =3D &uapi->notsupp_method; uapi->write_methods =3D data; From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 347EFC433F5 for ; Mon, 10 Jan 2022 07:38:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240645AbiAJHix (ORCPT ); Mon, 10 Jan 2022 02:38:53 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:60286 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232553AbiAJHbv (ORCPT ); Mon, 10 Jan 2022 02:31:51 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8234FB811F5; Mon, 10 Jan 2022 07:31:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA410C36AEF; Mon, 10 Jan 2022 07:31:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799909; bh=khURfKpZ4jnfWxYaCKjSklf5rGn3G4A+XcYST7Hp+K8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YG8W8rlq6nTmtR8wl5HpSk9nVwtKuaLdX0Zm1jIQ2/wA34XKXt/Zv/KW4iY6klv3C ZWuSgAHf49V9PdI3jELt3a6F3cHounAGmz/aEKpkjzCBcAU/5IJ4Ri+e6nog8abv9b E+RORAN3rMLtrVeiEnnVyCW/wc9CrnFXL+19Z+MQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Rix , Nick Desaulniers , Johannes Berg Subject: [PATCH 5.15 13/72] mac80211: initialize variable have_higher_than_11mbit Date: Mon, 10 Jan 2022 08:22:50 +0100 Message-Id: <20220110071821.996398773@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tom Rix commit 68a18ad71378a56858141c4449e02a30c829763e upstream. Clang static analysis reports this warnings mlme.c:5332:7: warning: Branch condition evaluates to a garbage value have_higher_than_11mbit) ^~~~~~~~~~~~~~~~~~~~~~~ have_higher_than_11mbit is only set to true some of the time in ieee80211_get_rates() but is checked all of the time. So have_higher_than_11mbit needs to be initialized to false. Fixes: 5d6a1b069b7f ("mac80211: set basic rates earlier") Signed-off-by: Tom Rix Reviewed-by: Nick Desaulniers Link: https://lore.kernel.org/r/20211223162848.3243702-1-trix@redhat.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/mac80211/mlme.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/mac80211/mlme.c +++ b/net/mac80211/mlme.c @@ -5216,7 +5216,7 @@ static int ieee80211_prep_connection(str */ if (new_sta) { u32 rates =3D 0, basic_rates =3D 0; - bool have_higher_than_11mbit; + bool have_higher_than_11mbit =3D false; int min_rate =3D INT_MAX, min_rate_index =3D -1; const struct cfg80211_bss_ies *ies; int shift =3D ieee80211_vif_get_shift(&sdata->vif); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B2B5C41535 for ; Mon, 10 Jan 2022 07:46:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243512AbiAJHpb (ORCPT ); Mon, 10 Jan 2022 02:45:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49938 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240070AbiAJHgf (ORCPT ); Mon, 10 Jan 2022 02:36:35 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7B446C025199; Sun, 9 Jan 2022 23:31:54 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 43083B81212; Mon, 10 Jan 2022 07:31:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7A1CDC36AF2; Mon, 10 Jan 2022 07:31:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799912; bh=2k/6zHTlSJyLhafIXsLPvR0mZUFZztGOtN4ewpcDgbM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xC/WfnyC0gVAn5oXYs/Zzys8VidFksGhxTT5nwfQaOmzKLa/RpFqs4Vg07Tio3LPI BdA/0N8+9zb0Pi1ggn74VBrv+2cyTFRO5l+A6keXNKZ6QDGMrYoW3Pk/R+MF1d7gFs IM3WDvxcGYi+46ZNweHsk8xfSB02miv2TGzKDlck= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Johannes Berg , syzbot+860268315ba86ea6b96b@syzkaller.appspotmail.com Subject: [PATCH 5.15 14/72] mac80211: mesh: embedd mesh_paths and mpp_paths into ieee80211_if_mesh Date: Mon, 10 Jan 2022 08:22:51 +0100 Message-Id: <20220110071822.031709816@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin commit 8b5cb7e41d9d77ffca036b0239177de123394a55 upstream. Syzbot hit NULL deref in rhashtable_free_and_destroy(). The problem was in mesh_paths and mpp_paths being NULL. mesh_pathtbl_init() could fail in case of memory allocation failure, but nobody cared, since ieee80211_mesh_init_sdata() returns void. It led to leaving 2 pointers as NULL. Syzbot has found null deref on exit path, but it could happen anywhere else, because code assumes these pointers are valid. Since all ieee80211_*_setup_sdata functions are void and do not fail, let's embedd mesh_paths and mpp_paths into parent struct to avoid adding error handling on higher levels and follow the pattern of others setup_sdata functions Fixes: 60854fd94573 ("mac80211: mesh: convert path table to rhashtable") Reported-and-tested-by: syzbot+860268315ba86ea6b96b@syzkaller.appspotmail.c= om Signed-off-by: Pavel Skripkin Link: https://lore.kernel.org/r/20211230195547.23977-1-paskripkin@gmail.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/mac80211/ieee80211_i.h | 24 ++++++++++- net/mac80211/mesh.h | 22 ---------- net/mac80211/mesh_pathtbl.c | 91 +++++++++++++++------------------------= ----- 3 files changed, 55 insertions(+), 82 deletions(-) --- a/net/mac80211/ieee80211_i.h +++ b/net/mac80211/ieee80211_i.h @@ -648,6 +648,26 @@ struct mesh_csa_settings { struct cfg80211_csa_settings settings; }; =20 +/** + * struct mesh_table + * + * @known_gates: list of known mesh gates and their mpaths by the station.= The + * gate's mpath may or may not be resolved and active. + * @gates_lock: protects updates to known_gates + * @rhead: the rhashtable containing struct mesh_paths, keyed by dest addr + * @walk_head: linked list containing all mesh_path objects + * @walk_lock: lock protecting walk_head + * @entries: number of entries in the table + */ +struct mesh_table { + struct hlist_head known_gates; + spinlock_t gates_lock; + struct rhashtable rhead; + struct hlist_head walk_head; + spinlock_t walk_lock; + atomic_t entries; /* Up to MAX_MESH_NEIGHBOURS */ +}; + struct ieee80211_if_mesh { struct timer_list housekeeping_timer; struct timer_list mesh_path_timer; @@ -722,8 +742,8 @@ struct ieee80211_if_mesh { /* offset from skb->data while building IE */ int meshconf_offset; =20 - struct mesh_table *mesh_paths; - struct mesh_table *mpp_paths; /* Store paths for MPP&MAP */ + struct mesh_table mesh_paths; + struct mesh_table mpp_paths; /* Store paths for MPP&MAP */ int mesh_paths_generation; int mpp_paths_generation; }; --- a/net/mac80211/mesh.h +++ b/net/mac80211/mesh.h @@ -127,26 +127,6 @@ struct mesh_path { u32 path_change_count; }; =20 -/** - * struct mesh_table - * - * @known_gates: list of known mesh gates and their mpaths by the station.= The - * gate's mpath may or may not be resolved and active. - * @gates_lock: protects updates to known_gates - * @rhead: the rhashtable containing struct mesh_paths, keyed by dest addr - * @walk_head: linked list containing all mesh_path objects - * @walk_lock: lock protecting walk_head - * @entries: number of entries in the table - */ -struct mesh_table { - struct hlist_head known_gates; - spinlock_t gates_lock; - struct rhashtable rhead; - struct hlist_head walk_head; - spinlock_t walk_lock; - atomic_t entries; /* Up to MAX_MESH_NEIGHBOURS */ -}; - /* Recent multicast cache */ /* RMC_BUCKETS must be a power of 2, maximum 256 */ #define RMC_BUCKETS 256 @@ -308,7 +288,7 @@ int mesh_path_error_tx(struct ieee80211_ void mesh_path_assign_nexthop(struct mesh_path *mpath, struct sta_info *st= a); void mesh_path_flush_pending(struct mesh_path *mpath); void mesh_path_tx_pending(struct mesh_path *mpath); -int mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata); +void mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata); void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata); int mesh_path_del(struct ieee80211_sub_if_data *sdata, const u8 *addr); void mesh_path_timer(struct timer_list *t); --- a/net/mac80211/mesh_pathtbl.c +++ b/net/mac80211/mesh_pathtbl.c @@ -47,32 +47,24 @@ static void mesh_path_rht_free(void *ptr mesh_path_free_rcu(tbl, mpath); } =20 -static struct mesh_table *mesh_table_alloc(void) +static void mesh_table_init(struct mesh_table *tbl) { - struct mesh_table *newtbl; - - newtbl =3D kmalloc(sizeof(struct mesh_table), GFP_ATOMIC); - if (!newtbl) - return NULL; - - INIT_HLIST_HEAD(&newtbl->known_gates); - INIT_HLIST_HEAD(&newtbl->walk_head); - atomic_set(&newtbl->entries, 0); - spin_lock_init(&newtbl->gates_lock); - spin_lock_init(&newtbl->walk_lock); - if (rhashtable_init(&newtbl->rhead, &mesh_rht_params)) { - kfree(newtbl); - return NULL; - } - - return newtbl; + INIT_HLIST_HEAD(&tbl->known_gates); + INIT_HLIST_HEAD(&tbl->walk_head); + atomic_set(&tbl->entries, 0); + spin_lock_init(&tbl->gates_lock); + spin_lock_init(&tbl->walk_lock); + + /* rhashtable_init() may fail only in case of wrong + * mesh_rht_params + */ + WARN_ON(rhashtable_init(&tbl->rhead, &mesh_rht_params)); } =20 static void mesh_table_free(struct mesh_table *tbl) { rhashtable_free_and_destroy(&tbl->rhead, mesh_path_rht_free, tbl); - kfree(tbl); } =20 /** @@ -238,13 +230,13 @@ static struct mesh_path *mpath_lookup(st struct mesh_path * mesh_path_lookup(struct ieee80211_sub_if_data *sdata, const u8 *dst) { - return mpath_lookup(sdata->u.mesh.mesh_paths, dst, sdata); + return mpath_lookup(&sdata->u.mesh.mesh_paths, dst, sdata); } =20 struct mesh_path * mpp_path_lookup(struct ieee80211_sub_if_data *sdata, const u8 *dst) { - return mpath_lookup(sdata->u.mesh.mpp_paths, dst, sdata); + return mpath_lookup(&sdata->u.mesh.mpp_paths, dst, sdata); } =20 static struct mesh_path * @@ -281,7 +273,7 @@ __mesh_path_lookup_by_idx(struct mesh_ta struct mesh_path * mesh_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx) { - return __mesh_path_lookup_by_idx(sdata->u.mesh.mesh_paths, idx); + return __mesh_path_lookup_by_idx(&sdata->u.mesh.mesh_paths, idx); } =20 /** @@ -296,7 +288,7 @@ mesh_path_lookup_by_idx(struct ieee80211 struct mesh_path * mpp_path_lookup_by_idx(struct ieee80211_sub_if_data *sdata, int idx) { - return __mesh_path_lookup_by_idx(sdata->u.mesh.mpp_paths, idx); + return __mesh_path_lookup_by_idx(&sdata->u.mesh.mpp_paths, idx); } =20 /** @@ -309,7 +301,7 @@ int mesh_path_add_gate(struct mesh_path int err; =20 rcu_read_lock(); - tbl =3D mpath->sdata->u.mesh.mesh_paths; + tbl =3D &mpath->sdata->u.mesh.mesh_paths; =20 spin_lock_bh(&mpath->state_lock); if (mpath->is_gate) { @@ -418,7 +410,7 @@ struct mesh_path *mesh_path_add(struct i if (!new_mpath) return ERR_PTR(-ENOMEM); =20 - tbl =3D sdata->u.mesh.mesh_paths; + tbl =3D &sdata->u.mesh.mesh_paths; spin_lock_bh(&tbl->walk_lock); mpath =3D rhashtable_lookup_get_insert_fast(&tbl->rhead, &new_mpath->rhash, @@ -460,7 +452,7 @@ int mpp_path_add(struct ieee80211_sub_if return -ENOMEM; =20 memcpy(new_mpath->mpp, mpp, ETH_ALEN); - tbl =3D sdata->u.mesh.mpp_paths; + tbl =3D &sdata->u.mesh.mpp_paths; =20 spin_lock_bh(&tbl->walk_lock); ret =3D rhashtable_lookup_insert_fast(&tbl->rhead, @@ -489,7 +481,7 @@ int mpp_path_add(struct ieee80211_sub_if void mesh_plink_broken(struct sta_info *sta) { struct ieee80211_sub_if_data *sdata =3D sta->sdata; - struct mesh_table *tbl =3D sdata->u.mesh.mesh_paths; + struct mesh_table *tbl =3D &sdata->u.mesh.mesh_paths; static const u8 bcast[ETH_ALEN] =3D {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; struct mesh_path *mpath; =20 @@ -548,7 +540,7 @@ static void __mesh_path_del(struct mesh_ void mesh_path_flush_by_nexthop(struct sta_info *sta) { struct ieee80211_sub_if_data *sdata =3D sta->sdata; - struct mesh_table *tbl =3D sdata->u.mesh.mesh_paths; + struct mesh_table *tbl =3D &sdata->u.mesh.mesh_paths; struct mesh_path *mpath; struct hlist_node *n; =20 @@ -563,7 +555,7 @@ void mesh_path_flush_by_nexthop(struct s static void mpp_flush_by_proxy(struct ieee80211_sub_if_data *sdata, const u8 *proxy) { - struct mesh_table *tbl =3D sdata->u.mesh.mpp_paths; + struct mesh_table *tbl =3D &sdata->u.mesh.mpp_paths; struct mesh_path *mpath; struct hlist_node *n; =20 @@ -597,8 +589,8 @@ static void table_flush_by_iface(struct */ void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata) { - table_flush_by_iface(sdata->u.mesh.mesh_paths); - table_flush_by_iface(sdata->u.mesh.mpp_paths); + table_flush_by_iface(&sdata->u.mesh.mesh_paths); + table_flush_by_iface(&sdata->u.mesh.mpp_paths); } =20 /** @@ -644,7 +636,7 @@ int mesh_path_del(struct ieee80211_sub_i /* flush relevant mpp entries first */ mpp_flush_by_proxy(sdata, addr); =20 - err =3D table_path_del(sdata->u.mesh.mesh_paths, sdata, addr); + err =3D table_path_del(&sdata->u.mesh.mesh_paths, sdata, addr); sdata->u.mesh.mesh_paths_generation++; return err; } @@ -682,7 +674,7 @@ int mesh_path_send_to_gates(struct mesh_ struct mesh_path *gate; bool copy =3D false; =20 - tbl =3D sdata->u.mesh.mesh_paths; + tbl =3D &sdata->u.mesh.mesh_paths; =20 rcu_read_lock(); hlist_for_each_entry_rcu(gate, &tbl->known_gates, gate_list) { @@ -762,29 +754,10 @@ void mesh_path_fix_nexthop(struct mesh_p mesh_path_tx_pending(mpath); } =20 -int mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata) +void mesh_pathtbl_init(struct ieee80211_sub_if_data *sdata) { - struct mesh_table *tbl_path, *tbl_mpp; - int ret; - - tbl_path =3D mesh_table_alloc(); - if (!tbl_path) - return -ENOMEM; - - tbl_mpp =3D mesh_table_alloc(); - if (!tbl_mpp) { - ret =3D -ENOMEM; - goto free_path; - } - - sdata->u.mesh.mesh_paths =3D tbl_path; - sdata->u.mesh.mpp_paths =3D tbl_mpp; - - return 0; - -free_path: - mesh_table_free(tbl_path); - return ret; + mesh_table_init(&sdata->u.mesh.mesh_paths); + mesh_table_init(&sdata->u.mesh.mpp_paths); } =20 static @@ -806,12 +779,12 @@ void mesh_path_tbl_expire(struct ieee802 =20 void mesh_path_expire(struct ieee80211_sub_if_data *sdata) { - mesh_path_tbl_expire(sdata, sdata->u.mesh.mesh_paths); - mesh_path_tbl_expire(sdata, sdata->u.mesh.mpp_paths); + mesh_path_tbl_expire(sdata, &sdata->u.mesh.mesh_paths); + mesh_path_tbl_expire(sdata, &sdata->u.mesh.mpp_paths); } =20 void mesh_pathtbl_unregister(struct ieee80211_sub_if_data *sdata) { - mesh_table_free(sdata->u.mesh.mesh_paths); - mesh_table_free(sdata->u.mesh.mpp_paths); + mesh_table_free(&sdata->u.mesh.mesh_paths); + mesh_table_free(&sdata->u.mesh.mpp_paths); } From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 719AAC4167D for ; Mon, 10 Jan 2022 07:46:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243469AbiAJHp3 (ORCPT ); Mon, 10 Jan 2022 02:45:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50434 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240330AbiAJHgf (ORCPT ); Mon, 10 Jan 2022 02:36:35 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E8EB4C02519B; Sun, 9 Jan 2022 23:31:55 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6F58E60B64; Mon, 10 Jan 2022 07:31:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 54C3FC36AEF; Mon, 10 Jan 2022 07:31:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799914; bh=ozMljWCXRk0xRH33Ws1uj19s4rejF6ZOu7s6mtdRefk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=P//3iS7FWIkKYEM3bgLJ5zqW3M/vSjQnHj0H+Pz8peYenOEi7Be7uTxCVl4zOECg2 yJM7NsMAW3CQk4buaMaMYWhAv/Z+C9UXK6/CFMkahCFlwgkVr1QXCJaTHRLm7U5k6c 0F8fywyP1s00f93MSDNiMOVCn4hxEB05P3oQro4c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Martin Habets , Jiasheng Jiang , Jakub Kicinski Subject: [PATCH 5.15 15/72] sfc: The RX page_ring is optional Date: Mon, 10 Jan 2022 08:22:52 +0100 Message-Id: <20220110071822.069210729@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Martin Habets commit 1d5a474240407c38ca8c7484a656ee39f585399c upstream. The RX page_ring is an optional feature that improves performance. When allocation fails the driver can still function, but possibly with a lower bandwidth. Guard against dereferencing a NULL page_ring. Fixes: 2768935a4660 ("sfc: reuse pages to avoid DMA mapping/unmapping costs= ") Signed-off-by: Martin Habets Reported-by: Jiasheng Jiang Link: https://lore.kernel.org/r/164111288276.5798.10330502993729113868.stgi= t@palantir17.mph.net Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/sfc/falcon/rx.c | 5 +++++ drivers/net/ethernet/sfc/rx_common.c | 5 +++++ 2 files changed, 10 insertions(+) --- a/drivers/net/ethernet/sfc/falcon/rx.c +++ b/drivers/net/ethernet/sfc/falcon/rx.c @@ -110,6 +110,8 @@ static struct page *ef4_reuse_page(struc struct ef4_rx_page_state *state; unsigned index; =20 + if (unlikely(!rx_queue->page_ring)) + return NULL; index =3D rx_queue->page_remove & rx_queue->page_ptr_mask; page =3D rx_queue->page_ring[index]; if (page =3D=3D NULL) @@ -293,6 +295,9 @@ static void ef4_recycle_rx_pages(struct { struct ef4_rx_queue *rx_queue =3D ef4_channel_get_rx_queue(channel); =20 + if (unlikely(!rx_queue->page_ring)) + return; + do { ef4_recycle_rx_page(channel, rx_buf); rx_buf =3D ef4_rx_buf_next(rx_queue, rx_buf); --- a/drivers/net/ethernet/sfc/rx_common.c +++ b/drivers/net/ethernet/sfc/rx_common.c @@ -45,6 +45,8 @@ static struct page *efx_reuse_page(struc unsigned int index; struct page *page; =20 + if (unlikely(!rx_queue->page_ring)) + return NULL; index =3D rx_queue->page_remove & rx_queue->page_ptr_mask; page =3D rx_queue->page_ring[index]; if (page =3D=3D NULL) @@ -114,6 +116,9 @@ void efx_recycle_rx_pages(struct efx_cha { struct efx_rx_queue *rx_queue =3D efx_channel_get_rx_queue(channel); =20 + if (unlikely(!rx_queue->page_ring)) + return; + do { efx_recycle_rx_page(channel, rx_buf); rx_buf =3D efx_rx_buf_next(rx_queue, rx_buf); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 177D6C433FE for ; Mon, 10 Jan 2022 07:38:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240037AbiAJHik (ORCPT ); Mon, 10 Jan 2022 02:38:40 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:40806 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239567AbiAJHb6 (ORCPT ); Mon, 10 Jan 2022 02:31:58 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 489E960B64; Mon, 10 Jan 2022 07:31:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 26682C36AED; Mon, 10 Jan 2022 07:31:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799917; bh=Z8LE9cYvSp0MC2X9ttEYDImaw6hZ2knRJoXOTpxtb18=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=w2XcrcrHE5gcTWN8tEwBobCxmBNq3ZkwFQzKwT14esOGM0V3o6bX1mxgMmB5djO+p kb6sSh244nF4uFIMjTm+jRe0XGvBWeCg7VX/dLC3abQaliAmOBLesCRD9D+fvTDGB9 IKDKUQrHAeCgHEr/Di840RxDM4o7BUUiSEaimG2k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Di Zhu , Rui Zhang , Gurucharan G , Tony Nguyen Subject: [PATCH 5.15 16/72] i40e: fix use-after-free in i40e_sync_filters_subtask() Date: Mon, 10 Jan 2022 08:22:53 +0100 Message-Id: <20220110071822.110037500@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Di Zhu commit 3116f59c12bd24c513194cd3acb3ec1f7d468954 upstream. Using ifconfig command to delete the ipv6 address will cause the i40e network card driver to delete its internal mac_filter and i40e_service_task kernel thread will concurrently access the mac_filter. These two processes are not protected by lock so causing the following use-after-free problems. print_address_description+0x70/0x360 ? vprintk_func+0x5e/0xf0 kasan_report+0x1b2/0x330 i40e_sync_vsi_filters+0x4f0/0x1850 [i40e] i40e_sync_filters_subtask+0xe3/0x130 [i40e] i40e_service_task+0x195/0x24c0 [i40e] process_one_work+0x3f5/0x7d0 worker_thread+0x61/0x6c0 ? process_one_work+0x7d0/0x7d0 kthread+0x1c3/0x1f0 ? kthread_park+0xc0/0xc0 ret_from_fork+0x35/0x40 Allocated by task 2279810: kasan_kmalloc+0xa0/0xd0 kmem_cache_alloc_trace+0xf3/0x1e0 i40e_add_filter+0x127/0x2b0 [i40e] i40e_add_mac_filter+0x156/0x190 [i40e] i40e_addr_sync+0x2d/0x40 [i40e] __hw_addr_sync_dev+0x154/0x210 i40e_set_rx_mode+0x6d/0xf0 [i40e] __dev_set_rx_mode+0xfb/0x1f0 __dev_mc_add+0x6c/0x90 igmp6_group_added+0x214/0x230 __ipv6_dev_mc_inc+0x338/0x4f0 addrconf_join_solict.part.7+0xa2/0xd0 addrconf_dad_work+0x500/0x980 process_one_work+0x3f5/0x7d0 worker_thread+0x61/0x6c0 kthread+0x1c3/0x1f0 ret_from_fork+0x35/0x40 Freed by task 2547073: __kasan_slab_free+0x130/0x180 kfree+0x90/0x1b0 __i40e_del_filter+0xa3/0xf0 [i40e] i40e_del_mac_filter+0xf3/0x130 [i40e] i40e_addr_unsync+0x85/0xa0 [i40e] __hw_addr_sync_dev+0x9d/0x210 i40e_set_rx_mode+0x6d/0xf0 [i40e] __dev_set_rx_mode+0xfb/0x1f0 __dev_mc_del+0x69/0x80 igmp6_group_dropped+0x279/0x510 __ipv6_dev_mc_dec+0x174/0x220 addrconf_leave_solict.part.8+0xa2/0xd0 __ipv6_ifa_notify+0x4cd/0x570 ipv6_ifa_notify+0x58/0x80 ipv6_del_addr+0x259/0x4a0 inet6_addr_del+0x188/0x260 addrconf_del_ifaddr+0xcc/0x130 inet6_ioctl+0x152/0x190 sock_do_ioctl+0xd8/0x2b0 sock_ioctl+0x2e5/0x4c0 do_vfs_ioctl+0x14e/0xa80 ksys_ioctl+0x7c/0xa0 __x64_sys_ioctl+0x42/0x50 do_syscall_64+0x98/0x2c0 entry_SYSCALL_64_after_hwframe+0x65/0xca Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Di Zhu Signed-off-by: Rui Zhang Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/intel/i40e/i40e_main.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -99,6 +99,24 @@ MODULE_LICENSE("GPL v2"); =20 static struct workqueue_struct *i40e_wq; =20 +static void netdev_hw_addr_refcnt(struct i40e_mac_filter *f, + struct net_device *netdev, int delta) +{ + struct netdev_hw_addr *ha; + + if (!f || !netdev) + return; + + netdev_for_each_mc_addr(ha, netdev) { + if (ether_addr_equal(ha->addr, f->macaddr)) { + ha->refcount +=3D delta; + if (ha->refcount <=3D 0) + ha->refcount =3D 1; + break; + } + } +} + /** * i40e_allocate_dma_mem_d - OS specific memory alloc for shared code * @hw: pointer to the HW structure @@ -2036,6 +2054,7 @@ static void i40e_undo_add_filter_entries hlist_for_each_entry_safe(new, h, from, hlist) { /* We can simply free the wrapper structure */ hlist_del(&new->hlist); + netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); kfree(new); } } @@ -2383,6 +2402,10 @@ int i40e_sync_vsi_filters(struct i40e_vs &tmp_add_list, &tmp_del_list, vlan_filters); + + hlist_for_each_entry(new, &tmp_add_list, hlist) + netdev_hw_addr_refcnt(new->f, vsi->netdev, 1); + if (retval) goto err_no_memory_locked; =20 @@ -2515,6 +2538,7 @@ int i40e_sync_vsi_filters(struct i40e_vs if (new->f->state =3D=3D I40E_FILTER_NEW) new->f->state =3D new->state; hlist_del(&new->hlist); + netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); kfree(new); } spin_unlock_bh(&vsi->mac_filter_hash_lock); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51828C433EF for ; Mon, 10 Jan 2022 07:38:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240616AbiAJHiq (ORCPT ); Mon, 10 Jan 2022 02:38:46 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:40854 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239603AbiAJHcB (ORCPT ); Mon, 10 Jan 2022 02:32:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0F3A360B6E; Mon, 10 Jan 2022 07:32:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E9D51C36AED; Mon, 10 Jan 2022 07:31:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799920; bh=moOesjmgTn5jY8KyRiUjfLd5hmyeELGgVqZBABeSdL4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U27XkX9ytuY7eaQngEM+yE6XeIT506ugrjcBM/+hjTKYPaF03ezZcg7NIUP8PigIN /e7xgH2/mRR03/HYK9M3NlX3iY930vVRI4W2qmCcv+pRP0UVd7DRAJVUDk5MocFskc g9lYsrHzHbuqvYVqHAut4/1M6hLPLuzjpw8u4iFY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mateusz Palczewski , Gurucharan G , Tony Nguyen Subject: [PATCH 5.15 17/72] i40e: Fix for displaying message regarding NVM version Date: Mon, 10 Jan 2022 08:22:54 +0100 Message-Id: <20220110071822.151004120@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mateusz Palczewski commit 40feded8a247f95957a0de9abd100085fb320a2f upstream. When loading the i40e driver, it prints a message like: 'The driver for the device detected a newer version of the NVM image v1.x than expected v1.y. Please install the most recent version of the network driver.' This is misleading as the driver is working as expected. Fix that by removing the second part of message and changing it from dev_info to dev_dbg. Fixes: 4fb29bddb57f ("i40e: The driver now prints the API version in error = message") Signed-off-by: Mateusz Palczewski Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -15475,8 +15475,8 @@ static int i40e_probe(struct pci_dev *pd =20 if (hw->aq.api_maj_ver =3D=3D I40E_FW_API_VERSION_MAJOR && hw->aq.api_min_ver > I40E_FW_MINOR_VERSION(hw)) - dev_info(&pdev->dev, - "The driver for the device detected a newer version of the NVM image v= %u.%u than expected v%u.%u. Please install the most recent version of the n= etwork driver.\n", + dev_dbg(&pdev->dev, + "The driver for the device detected a newer version of the NVM image v%= u.%u than v%u.%u.\n", hw->aq.api_maj_ver, hw->aq.api_min_ver, I40E_FW_API_VERSION_MAJOR, From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51514C4321E for ; Mon, 10 Jan 2022 07:46:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243417AbiAJHpT (ORCPT ); Mon, 10 Jan 2022 02:45:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50758 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240776AbiAJHgg (ORCPT ); Mon, 10 Jan 2022 02:36:36 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3F74C0251A3; Sun, 9 Jan 2022 23:32:05 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 750FFB81202; Mon, 10 Jan 2022 07:32:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BDDF1C36AED; Mon, 10 Jan 2022 07:32:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799923; bh=IgaNca044pcUxKWG04sEz3nqiptzZciBf1nFhrSMZsc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g/a9D3nCo8nAV+wwdZnydYUTFnMurYHP30FB0ngAtveLIuppaosjTuGuVUkWzgdZh I/pNid6wxVNVMDQ9gvG6kHe87hV9EPsQDKNOmklukOvE/RiuYmRJcFx8jlPo6x1mg5 38QBbpDPqTf0B6pfs2dRblpUtBKZPTXAdBVv8Elg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukasz Cieplicki , Jedrzej Jagielski , Gurucharan G , Tony Nguyen Subject: [PATCH 5.15 18/72] i40e: Fix incorrect netdevs real number of RX/TX queues Date: Mon, 10 Jan 2022 08:22:55 +0100 Message-Id: <20220110071822.191025618@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jedrzej Jagielski commit e738451d78b2f8a9635d66c6a87f304b4d965f7a upstream. There was a wrong queues representation in sysfs during driver's reinitialization in case of online cpus number is less than combined queues. It was caused by stopped NetworkManager, which is responsible for calling vsi_open function during driver's initialization. In specific situation (ex. 12 cpus online) there were 16 queues in /sys/class/net//queues. In case of modifying queues with value higher, than number of online cpus, then it caused write errors and other errors. Add updating of sysfs's queues representation during driver initialization. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Lukasz Cieplicki Signed-off-by: Jedrzej Jagielski Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/intel/i40e/i40e_main.c | 32 +++++++++++++++++++++--= ----- 1 file changed, 25 insertions(+), 7 deletions(-) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -8741,6 +8741,27 @@ int i40e_open(struct net_device *netdev) } =20 /** + * i40e_netif_set_realnum_tx_rx_queues - Update number of tx/rx queues + * @vsi: vsi structure + * + * This updates netdev's number of tx/rx queues + * + * Returns status of setting tx/rx queues + **/ +static int i40e_netif_set_realnum_tx_rx_queues(struct i40e_vsi *vsi) +{ + int ret; + + ret =3D netif_set_real_num_rx_queues(vsi->netdev, + vsi->num_queue_pairs); + if (ret) + return ret; + + return netif_set_real_num_tx_queues(vsi->netdev, + vsi->num_queue_pairs); +} + +/** * i40e_vsi_open - * @vsi: the VSI to open * @@ -8776,13 +8797,7 @@ int i40e_vsi_open(struct i40e_vsi *vsi) goto err_setup_rx; =20 /* Notify the stack of the actual queue counts. */ - err =3D netif_set_real_num_tx_queues(vsi->netdev, - vsi->num_queue_pairs); - if (err) - goto err_set_queues; - - err =3D netif_set_real_num_rx_queues(vsi->netdev, - vsi->num_queue_pairs); + err =3D i40e_netif_set_realnum_tx_rx_queues(vsi); if (err) goto err_set_queues; =20 @@ -14175,6 +14190,9 @@ struct i40e_vsi *i40e_vsi_setup(struct i ret =3D i40e_config_netdev(vsi); if (ret) goto err_netdev; + ret =3D i40e_netif_set_realnum_tx_rx_queues(vsi); + if (ret) + goto err_netdev; ret =3D register_netdev(vsi->netdev); if (ret) goto err_netdev; From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E69E1C433FE for ; Mon, 10 Jan 2022 07:46:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243438AbiAJHp1 (ORCPT ); Mon, 10 Jan 2022 02:45:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50762 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240801AbiAJHgg (ORCPT ); Mon, 10 Jan 2022 02:36:36 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B2B9AC0251A7; Sun, 9 Jan 2022 23:32:07 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5AA2AB81212; Mon, 10 Jan 2022 07:32:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9B9FBC36AF2; Mon, 10 Jan 2022 07:32:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799926; bh=1RZ0kPZl9KxI1zgPVbZnXcBRIz2Lcdn7bViV5huftKM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0uVAu2PKZzayeQe30RXBr7nKW0JhyRaZY8R/ZXb6kDraKVDQEoK9jJUNkPqPt5zvv gy2iOPSfUNTfwudbvJ5YbzoeusQTsGQvq3qe8Vw2pBqSHnLNish9fXQ1ODtd+NBIOa 7i2ATuXfZm7BTIk3J9NZKsogKlKoV0/ev4bC4J6I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Jiri Olsa , Steven Rostedt Subject: [PATCH 5.15 19/72] ftrace/samples: Add missing prototypes direct functions Date: Mon, 10 Jan 2022 08:22:56 +0100 Message-Id: <20220110071822.221527797@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiri Olsa commit 0daf5cb217a9ca8ae91b8f966ddae322699fb71d upstream. There's another compilation fail (first here [1]) reported by kernel test robot for W=3D1 clang build: >> samples/ftrace/ftrace-direct-multi-modify.c:7:6: warning: no previous prototype for function 'my_direct_func1' [-Wmissing-prototypes] void my_direct_func1(unsigned long ip) Direct functions in ftrace direct sample modules need to have prototypes defined. They are already global in order to be visible for the inline assembly, so there's no problem. The kernel test robot reported just error for ftrace-direct-multi-modify, but I got same errors also for the rest of the modules touched by this patc= h. [1] 67d4f6e3bf5d ftrace/samples: Add missing prototype for my_direct_func Link: https://lkml.kernel.org/r/20211219135317.212430-1-jolsa@kernel.org Reported-by: kernel test robot Fixes: e1067a07cfbc ("ftrace/samples: Add module to test multi direct modif= y interface") Fixes: ae0cc3b7e7f5 ("ftrace/samples: Add a sample module that implements m= odify_ftrace_direct()") Fixes: 156473a0ff4f ("ftrace: Add another example of register_ftrace_direct= () use case") Fixes: b06457c83af6 ("ftrace: Add sample module that uses register_ftrace_d= irect()") Signed-off-by: Jiri Olsa Signed-off-by: Steven Rostedt Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- samples/ftrace/ftrace-direct-modify.c | 3 +++ samples/ftrace/ftrace-direct-too.c | 3 +++ samples/ftrace/ftrace-direct.c | 2 ++ 3 files changed, 8 insertions(+) --- a/samples/ftrace/ftrace-direct-modify.c +++ b/samples/ftrace/ftrace-direct-modify.c @@ -3,6 +3,9 @@ #include #include =20 +extern void my_direct_func1(void); +extern void my_direct_func2(void); + void my_direct_func1(void) { trace_printk("my direct func1\n"); --- a/samples/ftrace/ftrace-direct-too.c +++ b/samples/ftrace/ftrace-direct-too.c @@ -4,6 +4,9 @@ #include /* for handle_mm_fault() */ #include =20 +extern void my_direct_func(struct vm_area_struct *vma, + unsigned long address, unsigned int flags); + void my_direct_func(struct vm_area_struct *vma, unsigned long address, unsigned int flags) { --- a/samples/ftrace/ftrace-direct.c +++ b/samples/ftrace/ftrace-direct.c @@ -4,6 +4,8 @@ #include /* for wake_up_process() */ #include =20 +extern void my_direct_func(struct task_struct *p); + void my_direct_func(struct task_struct *p) { trace_printk("waking up %s-%d\n", p->comm, p->pid); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4843C433FE for ; Mon, 10 Jan 2022 07:39:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241037AbiAJHjF (ORCPT ); Mon, 10 Jan 2022 02:39:05 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:40974 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239902AbiAJHcN (ORCPT ); Mon, 10 Jan 2022 02:32:13 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6F04F611B7; Mon, 10 Jan 2022 07:32:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 57312C36AED; Mon, 10 Jan 2022 07:32:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799931; bh=VbNmRcpihmGSCFw+x/pGX2jqtKCrQZWhDtyNFbDRR/E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sDx6HtMjy5baJsUiBSp8wtq4YypaHCCnH9Ozf/YgpFUqSyXfBNhblBNgbXkHhANhM JB7NOrSfm18IIxULWLoGEbDsfMPkN36jBR1TUT23hOWQVbm0g4K+O2GT6FtMLvx5XJ 7CF6c+fgzMJpGr1XQyX54Md/IM6fC1VbvSxIKbcc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com, David Ahern , Thomas Graf , "David S. Miller" Subject: [PATCH 5.15 20/72] ipv4: Check attribute length for RTA_GATEWAY in multipath route Date: Mon, 10 Jan 2022 08:22:57 +0100 Message-Id: <20220110071822.260222128@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 7a3429bace0e08d94c39245631ea6bc109dafa49 upstream. syzbot reported uninit-value: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KMSAN: uninit-value in fib_get_nhs+0xac4/0x1f80 net/ipv4/fib_semantics.c:708 fib_get_nhs+0xac4/0x1f80 net/ipv4/fib_semantics.c:708 fib_create_info+0x2411/0x4870 net/ipv4/fib_semantics.c:1453 fib_table_insert+0x45c/0x3a10 net/ipv4/fib_trie.c:1224 inet_rtm_newroute+0x289/0x420 net/ipv4/fib_frontend.c:886 Add helper to validate RTA_GATEWAY length before using the attribute. Fixes: 4e902c57417c ("[IPv4]: FIB configuration using struct fib_config") Reported-by: syzbot+d4b9a2851cc3ce998741@syzkaller.appspotmail.com Signed-off-by: David Ahern Cc: Thomas Graf Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/fib_semantics.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -662,6 +662,19 @@ static int fib_count_nexthops(struct rtn return nhs; } =20 +static int fib_gw_from_attr(__be32 *gw, struct nlattr *nla, + struct netlink_ext_ack *extack) +{ + if (nla_len(nla) < sizeof(*gw)) { + NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_GATEWAY"); + return -EINVAL; + } + + *gw =3D nla_get_in_addr(nla); + + return 0; +} + /* only called when fib_nh is integrated into fib_info */ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, int remaining, struct fib_config *cfg, @@ -704,7 +717,11 @@ static int fib_get_nhs(struct fib_info * return -EINVAL; } if (nla) { - fib_cfg.fc_gw4 =3D nla_get_in_addr(nla); + ret =3D fib_gw_from_attr(&fib_cfg.fc_gw4, nla, + extack); + if (ret) + goto errout; + if (fib_cfg.fc_gw4) fib_cfg.fc_gw_family =3D AF_INET; } else if (nlav) { @@ -902,6 +919,7 @@ int fib_nh_match(struct net *net, struct attrlen =3D rtnh_attrlen(rtnh); if (attrlen > 0) { struct nlattr *nla, *nlav, *attrs =3D rtnh_attrs(rtnh); + int err; =20 nla =3D nla_find(attrs, attrlen, RTA_GATEWAY); nlav =3D nla_find(attrs, attrlen, RTA_VIA); @@ -912,12 +930,17 @@ int fib_nh_match(struct net *net, struct } =20 if (nla) { + __be32 gw; + + err =3D fib_gw_from_attr(&gw, nla, extack); + if (err) + return err; + if (nh->fib_nh_gw_family !=3D AF_INET || - nla_get_in_addr(nla) !=3D nh->fib_nh_gw4) + gw !=3D nh->fib_nh_gw4) return 1; } else if (nlav) { struct fib_config cfg2; - int err; =20 err =3D fib_gw_from_via(&cfg2, nlav, extack); if (err) From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AADCBC433FE for ; Mon, 10 Jan 2022 07:39:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241107AbiAJHjJ (ORCPT ); Mon, 10 Jan 2022 02:39:09 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:40998 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239923AbiAJHcP (ORCPT ); Mon, 10 Jan 2022 02:32:15 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 56B046066C; Mon, 10 Jan 2022 07:32:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D5D3C36AED; Mon, 10 Jan 2022 07:32:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799934; bh=Fg09m/mCPd1Mc5MQ5ehZXYmVp5soqYL9q9NmgVntLis=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=larjxkVmYlvNCePsqmd2myBEYrjMU5Utpih0Jgxi7UcJc5RA5MM8etJMiS96HGA9X kZ7ZM48YRAOBPDBCFqYqPxR41KDtzQDXoIzue2jZf0wmjHyk0Gd6HQmT1fUmuxp2PI 8pfffo3ctPDWYHWYHMw+LI5aTqzjxZBCUMqZrLQY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , "David S. Miller" Subject: [PATCH 5.15 21/72] ipv4: Check attribute length for RTA_FLOW in multipath route Date: Mon, 10 Jan 2022 08:22:58 +0100 Message-Id: <20220110071822.290525529@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 664b9c4b7392ce723b013201843264bf95481ce5 upstream. Make sure RTA_FLOW is at least 4B before using. Fixes: 4e902c57417c ("[IPv4]: FIB configuration using struct fib_config") Signed-off-by: David Ahern Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/fib_semantics.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -731,8 +731,13 @@ static int fib_get_nhs(struct fib_info * } =20 nla =3D nla_find(attrs, attrlen, RTA_FLOW); - if (nla) + if (nla) { + if (nla_len(nla) < sizeof(u32)) { + NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW"); + return -EINVAL; + } fib_cfg.fc_flow =3D nla_get_u32(nla); + } =20 fib_cfg.fc_encap =3D nla_find(attrs, attrlen, RTA_ENCAP); nla =3D nla_find(attrs, attrlen, RTA_ENCAP_TYPE); @@ -963,8 +968,14 @@ int fib_nh_match(struct net *net, struct =20 #ifdef CONFIG_IP_ROUTE_CLASSID nla =3D nla_find(attrs, attrlen, RTA_FLOW); - if (nla && nla_get_u32(nla) !=3D nh->nh_tclassid) - return 1; + if (nla) { + if (nla_len(nla) < sizeof(u32)) { + NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW"); + return -EINVAL; + } + if (nla_get_u32(nla) !=3D nh->nh_tclassid) + return 1; + } #endif } =20 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F97BC433F5 for ; Mon, 10 Jan 2022 07:39:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241267AbiAJHjP (ORCPT ); Mon, 10 Jan 2022 02:39:15 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41016 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239949AbiAJHcS (ORCPT ); Mon, 10 Jan 2022 02:32:18 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2B2FB60C07; Mon, 10 Jan 2022 07:32:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0FF91C36AEF; Mon, 10 Jan 2022 07:32:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799937; bh=d54omvJKXtxsw0qDMGjWdh74hPgtXtK5QlJLBKK81Wk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vMLbCwSuKtlVyobQemOwyXfFSfjiFPUXyXFnh1DWPgIOazoA0RHHybC1/SKQ25uDO kS1SsgOgKxd7TSfK3w/VqlsiUOSf1nM9nD91/GVHNJM9Vc02Sy2LR/wNE/L/rGMIif Q2H/5qGPDXL16flEn/s+z1bJwe94r+/x411JvI7s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Nicolas Dichtel , "David S. Miller" Subject: [PATCH 5.15 22/72] ipv6: Check attribute length for RTA_GATEWAY in multipath route Date: Mon, 10 Jan 2022 08:22:59 +0100 Message-Id: <20220110071822.321331406@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 4619bcf91399f00a40885100fb61d594d8454033 upstream. Commit referenced in the Fixes tag used nla_memcpy for RTA_GATEWAY as does the current nla_get_in6_addr. nla_memcpy protects against accessing memory greater than what is in the attribute, but there is no check requiring the attribute to have an IPv6 address. Add it. Fixes: 51ebd3181572 ("ipv6: add support of equal cost multipath (ECMP)") Signed-off-by: David Ahern Cc: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv6/route.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5224,6 +5224,19 @@ out: return should_notify; } =20 +static int fib6_gw_from_attr(struct in6_addr *gw, struct nlattr *nla, + struct netlink_ext_ack *extack) +{ + if (nla_len(nla) < sizeof(*gw)) { + NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_GATEWAY"); + return -EINVAL; + } + + *gw =3D nla_get_in6_addr(nla); + + return 0; +} + static int ip6_route_multipath_add(struct fib6_config *cfg, struct netlink_ext_ack *extack) { @@ -5264,7 +5277,13 @@ static int ip6_route_multipath_add(struc =20 nla =3D nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - r_cfg.fc_gateway =3D nla_get_in6_addr(nla); + int ret; + + ret =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + extack); + if (ret) + return ret; + r_cfg.fc_flags |=3D RTF_GATEWAY; } r_cfg.fc_encap =3D nla_find(attrs, attrlen, RTA_ENCAP); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0294EC433EF for ; Mon, 10 Jan 2022 07:39:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241551AbiAJHjY (ORCPT ); Mon, 10 Jan 2022 02:39:24 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:60560 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240672AbiAJHcW (ORCPT ); Mon, 10 Jan 2022 02:32:22 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A129FB81208; Mon, 10 Jan 2022 07:32:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D3639C36AED; Mon, 10 Jan 2022 07:32:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799940; bh=IWDSQyEn1gvvs88sj42JoA8oCzbf87RCIuKJS851JSo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Z2ZgngDv9kxyoWDn9XxiCJf9KMFneVfQ4a3aLtoT2Rxl7TSopF00QO/WA5kLNpmJk Ig5+8WKjj4kbfmBUcrGoc2RbkKJNRHda+79BA8404i3rBlR7Tk27ASBh4lmY5pjOHm drxlWwn9CgJldtwTA17lraEI76erkWLRV8tSn/+I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Roopa Prabhu , "David S. Miller" Subject: [PATCH 5.15 23/72] ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route Date: Mon, 10 Jan 2022 08:23:00 +0100 Message-Id: <20220110071822.354269152@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 1ff15a710a862db1101b97810af14aedc835a86a upstream. Make sure RTA_GATEWAY for IPv6 multipath route has enough bytes to hold an IPv6 address. Fixes: 6b9ea5a64ed5 ("ipv6: fix multipath route replace error recovery") Signed-off-by: David Ahern Cc: Roopa Prabhu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv6/route.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5453,7 +5453,11 @@ static int ip6_route_multipath_del(struc =20 nla =3D nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - nla_memcpy(&r_cfg.fc_gateway, nla, 16); + err =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + extack); + if (err) + return err; + r_cfg.fc_flags |=3D RTF_GATEWAY; } } From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7ADB2C433EF for ; Mon, 10 Jan 2022 07:39:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241359AbiAJHjd (ORCPT ); Mon, 10 Jan 2022 02:39:33 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:60580 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240691AbiAJHc0 (ORCPT ); Mon, 10 Jan 2022 02:32:26 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 55900B81202; Mon, 10 Jan 2022 07:32:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9D360C36AED; Mon, 10 Jan 2022 07:32:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799943; bh=cKjPmRM8ypJylgsOOQD2RqjrD5l7FMaIltUJJ/AFrVw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JjaSWbaVOh8i3SpgkFAksBxXayJV+qo03aT7vGLQHW2h1H8eLUBpC8Zs9XpZy3zas WnKMtaciY4WiPoKnfegzQREpkBSLAkwvRKQDHlAW4iZpfP5Afme2gryOF9D6rayOQs BoiewBNOPPVl2+DGduot31OeFY50tmHZ6qQqGaco= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , "David S. Miller" Subject: [PATCH 5.15 24/72] lwtunnel: Validate RTA_ENCAP_TYPE attribute length Date: Mon, 10 Jan 2022 08:23:01 +0100 Message-Id: <20220110071822.385374355@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern commit 8bda81a4d400cf8a72e554012f0d8c45e07a3904 upstream. lwtunnel_valid_encap_type_attr is used to validate encap attributes within a multipath route. Add length validation checking to the type. lwtunnel_valid_encap_type_attr is called converting attributes to fib{6,}_config struct which means it is used before fib_get_nhs, ip6_route_multipath_add, and ip6_route_multipath_del - other locations that use rtnh_ok and then nla_get_u16 on RTA_ENCAP_TYPE attribute. Fixes: 9ed59592e3e3 ("lwtunnel: fix autoload of lwt modules") Signed-off-by: David Ahern Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/core/lwtunnel.c | 4 ++++ net/ipv4/fib_semantics.c | 3 +++ net/ipv6/route.c | 4 ++++ 3 files changed, 11 insertions(+) --- a/net/core/lwtunnel.c +++ b/net/core/lwtunnel.c @@ -197,6 +197,10 @@ int lwtunnel_valid_encap_type_attr(struc nla_entype =3D nla_find(attrs, attrlen, RTA_ENCAP_TYPE); =20 if (nla_entype) { + if (nla_len(nla_entype) < sizeof(u16)) { + NL_SET_ERR_MSG(extack, "Invalid RTA_ENCAP_TYPE"); + return -EINVAL; + } encap_type =3D nla_get_u16(nla_entype); =20 if (lwtunnel_valid_encap_type(encap_type, --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -740,6 +740,9 @@ static int fib_get_nhs(struct fib_info * } =20 fib_cfg.fc_encap =3D nla_find(attrs, attrlen, RTA_ENCAP); + /* RTA_ENCAP_TYPE length checked in + * lwtunnel_valid_encap_type_attr + */ nla =3D nla_find(attrs, attrlen, RTA_ENCAP_TYPE); if (nla) fib_cfg.fc_encap_type =3D nla_get_u16(nla); --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5287,6 +5287,10 @@ static int ip6_route_multipath_add(struc r_cfg.fc_flags |=3D RTF_GATEWAY; } r_cfg.fc_encap =3D nla_find(attrs, attrlen, RTA_ENCAP); + + /* RTA_ENCAP_TYPE length checked in + * lwtunnel_valid_encap_type_attr + */ nla =3D nla_find(attrs, attrlen, RTA_ENCAP_TYPE); if (nla) r_cfg.fc_encap_type =3D nla_get_u16(nla); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0CA82C3525B for ; Mon, 10 Jan 2022 07:46:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243961AbiAJHqD (ORCPT ); Mon, 10 Jan 2022 02:46:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50208 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241463AbiAJHhl (ORCPT ); Mon, 10 Jan 2022 02:37:41 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 79368C028B9B; Sun, 9 Jan 2022 23:32:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 377BDB81204; Mon, 10 Jan 2022 07:32:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 68CFDC36AEF; Mon, 10 Jan 2022 07:32:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799945; bh=8Wk2NLB4bR+9xiQiR7OKCh9kPDKCq8X83GEBI/7BFq4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TcOZftIT/n1ni5Rt+1sGX4mtjQ/WDO1Am60i2n5nVCvn1fxYwLt+D68MUCFOxV5Ku DPMFVXQZTU42AohW6kKOEpOkQLxiUaVKq4F0YVV8aXWaJPtAxZ5WeAT1mtm5VoyqRb dj9eEhplRBorScRnt2mlhsnSX6um5CcPUKPj83MI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jianguo Wu , Jakub Kicinski Subject: [PATCH 5.15 25/72] selftests: net: udpgro_fwd.sh: explicitly checking the available ping feature Date: Mon, 10 Jan 2022 08:23:02 +0100 Message-Id: <20220110071822.418727887@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jianguo Wu commit 5e75d0b215b868337e7a193f28a543ec00e858b1 upstream. As Paolo pointed out, the result of ping IPv6 address depends on the running distro. So explicitly checking the available ping feature, as e.g. do the bareudp.sh self-tests. Fixes: 8b3170e07539 ("selftests: net: using ping6 for IPv6 in udpgro_fwd.sh= ") Signed-off-by: Jianguo Wu Link: https://lore.kernel.org/r/825ee22b-4245-dbf7-d2f7-a230770d6e21@163.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- tools/testing/selftests/net/udpgro_fwd.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/tools/testing/selftests/net/udpgro_fwd.sh +++ b/tools/testing/selftests/net/udpgro_fwd.sh @@ -193,7 +193,8 @@ for family in 4 6; do SUFFIX=3D"64 nodad" VXDEV=3Dvxlan6 IPT=3Dip6tables - PING=3D"ping6" + # Use ping6 on systems where ping doesn't handle IPv6 + ping -w 1 -c 1 ::1 > /dev/null 2>&1 || PING=3D"ping6" fi =20 echo "IPv$family" From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9AA0BC4167E for ; Mon, 10 Jan 2022 07:46:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243529AbiAJHpk (ORCPT ); Mon, 10 Jan 2022 02:45:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51256 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240771AbiAJHiL (ORCPT ); Mon, 10 Jan 2022 02:38:11 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2ABC0C028B9E; Sun, 9 Jan 2022 23:32:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DF091B811FE; Mon, 10 Jan 2022 07:32:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38CD6C36AED; Mon, 10 Jan 2022 07:32:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799948; bh=BYFkaeZVeRf3DcpiRNxRe4CMYuNGnpx0GLf8LTcbRvo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PkZfh8yLyATs3AtanSYAJnTaFpGaJxws+O1x3dMlCF19ob/j7aBOYQkW+GK9lyegY x4gJDVeqXWWadJf0gkdE2B1Z7fRLbECb7u6VaJpe5+r9vzou+VGKRAyHTX90mXF/p+ AtY3SsST6To6Fc+bsjlAQcjBdmPRHcD8ot2SwXuE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xin Long , "David S. Miller" Subject: [PATCH 5.15 26/72] sctp: hold endpoint before calling cb in sctp_transport_lookup_process Date: Mon, 10 Jan 2022 08:23:03 +0100 Message-Id: <20220110071822.454728244@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xin Long commit f9d31c4cf4c11ff10317f038b9c6f7c3bda6cdd4 upstream. The same fix in commit 5ec7d18d1813 ("sctp: use call_rcu to free endpoint") is also needed for dumping one asoc and sock after the lookup. Fixes: 86fdb3448cc1 ("sctp: ensure ep is not destroyed before doing the dum= p") Signed-off-by: Xin Long Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- include/net/sctp/sctp.h | 3 +-- net/sctp/diag.c | 48 ++++++++++++++++++++++---------------------= ----- net/sctp/socket.c | 22 +++++++++++++++------- 3 files changed, 38 insertions(+), 35 deletions(-) --- a/include/net/sctp/sctp.h +++ b/include/net/sctp/sctp.h @@ -112,8 +112,7 @@ struct sctp_transport *sctp_transport_ge struct rhashtable_iter *iter); struct sctp_transport *sctp_transport_get_idx(struct net *net, struct rhashtable_iter *iter, int pos); -int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void = *), - struct net *net, +int sctp_transport_lookup_process(sctp_callback_t cb, struct net *net, const union sctp_addr *laddr, const union sctp_addr *paddr, void *p); int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb= _done, --- a/net/sctp/diag.c +++ b/net/sctp/diag.c @@ -245,48 +245,44 @@ static size_t inet_assoc_attr_size(struc + 64; } =20 -static int sctp_tsp_dump_one(struct sctp_transport *tsp, void *p) +static int sctp_sock_dump_one(struct sctp_endpoint *ep, struct sctp_transp= ort *tsp, void *p) { struct sctp_association *assoc =3D tsp->asoc; - struct sock *sk =3D tsp->asoc->base.sk; struct sctp_comm_param *commp =3D p; - struct sk_buff *in_skb =3D commp->skb; + struct sock *sk =3D ep->base.sk; const struct inet_diag_req_v2 *req =3D commp->r; - const struct nlmsghdr *nlh =3D commp->nlh; - struct net *net =3D sock_net(in_skb->sk); + struct sk_buff *skb =3D commp->skb; struct sk_buff *rep; int err; =20 err =3D sock_diag_check_cookie(sk, req->id.idiag_cookie); if (err) - goto out; + return err; =20 - err =3D -ENOMEM; rep =3D nlmsg_new(inet_assoc_attr_size(assoc), GFP_KERNEL); if (!rep) - goto out; + return -ENOMEM; =20 lock_sock(sk); - if (sk !=3D assoc->base.sk) { - release_sock(sk); - sk =3D assoc->base.sk; - lock_sock(sk); - } - err =3D inet_sctp_diag_fill(sk, assoc, rep, req, - sk_user_ns(NETLINK_CB(in_skb).sk), - NETLINK_CB(in_skb).portid, - nlh->nlmsg_seq, 0, nlh, - commp->net_admin); - release_sock(sk); + if (ep !=3D assoc->ep) { + err =3D -EAGAIN; + goto out; + } + + err =3D inet_sctp_diag_fill(sk, assoc, rep, req, sk_user_ns(NETLINK_CB(sk= b).sk), + NETLINK_CB(skb).portid, commp->nlh->nlmsg_seq, 0, + commp->nlh, commp->net_admin); if (err < 0) { WARN_ON(err =3D=3D -EMSGSIZE); - kfree_skb(rep); goto out; } + release_sock(sk); =20 - err =3D nlmsg_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid); + return nlmsg_unicast(sock_net(skb->sk)->diag_nlsk, rep, NETLINK_CB(skb).p= ortid); =20 out: + release_sock(sk); + kfree_skb(rep); return err; } =20 @@ -429,15 +425,15 @@ static void sctp_diag_get_info(struct so static int sctp_diag_dump_one(struct netlink_callback *cb, const struct inet_diag_req_v2 *req) { - struct sk_buff *in_skb =3D cb->skb; - struct net *net =3D sock_net(in_skb->sk); + struct sk_buff *skb =3D cb->skb; + struct net *net =3D sock_net(skb->sk); const struct nlmsghdr *nlh =3D cb->nlh; union sctp_addr laddr, paddr; struct sctp_comm_param commp =3D { - .skb =3D in_skb, + .skb =3D skb, .r =3D req, .nlh =3D nlh, - .net_admin =3D netlink_net_capable(in_skb, CAP_NET_ADMIN), + .net_admin =3D netlink_net_capable(skb, CAP_NET_ADMIN), }; =20 if (req->sdiag_family =3D=3D AF_INET) { @@ -460,7 +456,7 @@ static int sctp_diag_dump_one(struct net paddr.v6.sin6_family =3D AF_INET6; } =20 - return sctp_transport_lookup_process(sctp_tsp_dump_one, + return sctp_transport_lookup_process(sctp_sock_dump_one, net, &laddr, &paddr, &commp); } =20 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -5317,23 +5317,31 @@ int sctp_for_each_endpoint(int (*cb)(str } EXPORT_SYMBOL_GPL(sctp_for_each_endpoint); =20 -int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void = *), - struct net *net, +int sctp_transport_lookup_process(sctp_callback_t cb, struct net *net, const union sctp_addr *laddr, const union sctp_addr *paddr, void *p) { struct sctp_transport *transport; - int err; + struct sctp_endpoint *ep; + int err =3D -ENOENT; =20 rcu_read_lock(); transport =3D sctp_addrs_lookup_transport(net, laddr, paddr); + if (!transport) { + rcu_read_unlock(); + return err; + } + ep =3D transport->asoc->ep; + if (!sctp_endpoint_hold(ep)) { /* asoc can be peeled off */ + sctp_transport_put(transport); + rcu_read_unlock(); + return err; + } rcu_read_unlock(); - if (!transport) - return -ENOENT; =20 - err =3D cb(transport, p); + err =3D cb(ep, transport, p); + sctp_endpoint_put(ep); sctp_transport_put(transport); - return err; } EXPORT_SYMBOL_GPL(sctp_transport_lookup_process); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9E96C43217 for ; Mon, 10 Jan 2022 07:46:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243807AbiAJHp5 (ORCPT ); Mon, 10 Jan 2022 02:45:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50716 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240516AbiAJHiO (ORCPT ); Mon, 10 Jan 2022 02:38:14 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 28935C028BA0; Sun, 9 Jan 2022 23:32:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DAD01B81213; Mon, 10 Jan 2022 07:32:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17A69C36AEF; Mon, 10 Jan 2022 07:32:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799951; bh=nNIAOO6RzO9SX0QoS1pQgwxA8MrcoAhE3vpM7XWVzE4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=l8kAZIc8mb2K09tCNGgrsNocJEPPLJ7D0BkGRNg5YkadANhDCzCcwax8PXmzm0VyZ /cU/mizXE/W0Dak4EOkuzlz1Nur3vQfbxGoPY6+vM/ln1G6gus1dN/OYkov2kA+LR1 O7kWq3Hv0sCEq0IeQaAocBOUy6KNB0rAPuF34SQI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Linus=20L=C3=BCssing?= , Sven Eckelmann , Simon Wunderlich Subject: [PATCH 5.15 27/72] batman-adv: mcast: dont send link-local multicast to mcast routers Date: Mon, 10 Jan 2022 08:23:04 +0100 Message-Id: <20220110071822.486699749@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Linus L=C3=BCssing commit 938f2e0b57ffe8a6df71e1e177b2978b1b33fe5e upstream. The addition of routable multicast TX handling introduced a bug/regression for packets with a link-local multicast destination: These packets would be sent to all batman-adv nodes with a multicast router and to all batman-adv nodes with an old version without multicast router detection. This even disregards the batman-adv multicast fanout setting, which can potentially lead to an unwanted, high number of unicast transmissions or even congestion. Fixing this by avoiding to send link-local multicast packets to nodes in the multicast router list. Fixes: 11d458c1cb9b ("batman-adv: mcast: apply optimizations for routable p= ackets, too") Signed-off-by: Linus L=C3=BCssing Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/batman-adv/multicast.c | 15 ++++++++++----- net/batman-adv/multicast.h | 10 ++++++---- net/batman-adv/soft-interface.c | 7 +++++-- 3 files changed, 21 insertions(+), 11 deletions(-) --- a/net/batman-adv/multicast.c +++ b/net/batman-adv/multicast.c @@ -1339,6 +1339,7 @@ batadv_mcast_forw_rtr_node_get(struct ba * @bat_priv: the bat priv with all the soft interface information * @skb: The multicast packet to check * @orig: an originator to be set to forward the skb to + * @is_routable: stores whether the destination is routable * * Return: the forwarding mode as enum batadv_forw_mode and in case of * BATADV_FORW_SINGLE set the orig to the single originator the skb @@ -1346,17 +1347,16 @@ batadv_mcast_forw_rtr_node_get(struct ba */ enum batadv_forw_mode batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, - struct batadv_orig_node **orig) + struct batadv_orig_node **orig, int *is_routable) { int ret, tt_count, ip_count, unsnoop_count, total_count; bool is_unsnoopable =3D false; unsigned int mcast_fanout; struct ethhdr *ethhdr; - int is_routable =3D 0; int rtr_count =3D 0; =20 ret =3D batadv_mcast_forw_mode_check(bat_priv, skb, &is_unsnoopable, - &is_routable); + is_routable); if (ret =3D=3D -ENOMEM) return BATADV_FORW_NONE; else if (ret < 0) @@ -1369,7 +1369,7 @@ batadv_mcast_forw_mode(struct batadv_pri ip_count =3D batadv_mcast_forw_want_all_ip_count(bat_priv, ethhdr); unsnoop_count =3D !is_unsnoopable ? 0 : atomic_read(&bat_priv->mcast.num_want_all_unsnoopables); - rtr_count =3D batadv_mcast_forw_rtr_count(bat_priv, is_routable); + rtr_count =3D batadv_mcast_forw_rtr_count(bat_priv, *is_routable); =20 total_count =3D tt_count + ip_count + unsnoop_count + rtr_count; =20 @@ -1689,6 +1689,7 @@ batadv_mcast_forw_want_rtr(struct batadv * @bat_priv: the bat priv with all the soft interface information * @skb: the multicast packet to transmit * @vid: the vlan identifier + * @is_routable: stores whether the destination is routable * * Sends copies of a frame with multicast destination to any node that sig= naled * interest in it, that is either via the translation table or the accordi= ng @@ -1701,7 +1702,7 @@ batadv_mcast_forw_want_rtr(struct batadv * is neither IPv4 nor IPv6. NET_XMIT_SUCCESS otherwise. */ int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *s= kb, - unsigned short vid) + unsigned short vid, int is_routable) { int ret; =20 @@ -1717,12 +1718,16 @@ int batadv_mcast_forw_send(struct batadv return ret; } =20 + if (!is_routable) + goto skip_mc_router; + ret =3D batadv_mcast_forw_want_rtr(bat_priv, skb, vid); if (ret !=3D NET_XMIT_SUCCESS) { kfree_skb(skb); return ret; } =20 +skip_mc_router: consume_skb(skb); return ret; } --- a/net/batman-adv/multicast.h +++ b/net/batman-adv/multicast.h @@ -43,7 +43,8 @@ enum batadv_forw_mode { =20 enum batadv_forw_mode batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, - struct batadv_orig_node **mcast_single_orig); + struct batadv_orig_node **mcast_single_orig, + int *is_routable); =20 int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, struct sk_buff *skb, @@ -51,7 +52,7 @@ int batadv_mcast_forw_send_orig(struct b struct batadv_orig_node *orig_node); =20 int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *s= kb, - unsigned short vid); + unsigned short vid, int is_routable); =20 void batadv_mcast_init(struct batadv_priv *bat_priv); =20 @@ -68,7 +69,8 @@ void batadv_mcast_purge_orig(struct bata =20 static inline enum batadv_forw_mode batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, - struct batadv_orig_node **mcast_single_orig) + struct batadv_orig_node **mcast_single_orig, + int *is_routable) { return BATADV_FORW_ALL; } @@ -85,7 +87,7 @@ batadv_mcast_forw_send_orig(struct batad =20 static inline int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb, - unsigned short vid) + unsigned short vid, int is_routable) { kfree_skb(skb); return NET_XMIT_DROP; --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c @@ -198,6 +198,7 @@ static netdev_tx_t batadv_interface_tx(s int gw_mode; enum batadv_forw_mode forw_mode =3D BATADV_FORW_SINGLE; struct batadv_orig_node *mcast_single_orig =3D NULL; + int mcast_is_routable =3D 0; int network_offset =3D ETH_HLEN; __be16 proto; =20 @@ -300,7 +301,8 @@ static netdev_tx_t batadv_interface_tx(s send: if (do_bcast && !is_broadcast_ether_addr(ethhdr->h_dest)) { forw_mode =3D batadv_mcast_forw_mode(bat_priv, skb, - &mcast_single_orig); + &mcast_single_orig, + &mcast_is_routable); if (forw_mode =3D=3D BATADV_FORW_NONE) goto dropped; =20 @@ -359,7 +361,8 @@ send: ret =3D batadv_mcast_forw_send_orig(bat_priv, skb, vid, mcast_single_orig); } else if (forw_mode =3D=3D BATADV_FORW_SOME) { - ret =3D batadv_mcast_forw_send(bat_priv, skb, vid); + ret =3D batadv_mcast_forw_send(bat_priv, skb, vid, + mcast_is_routable); } else { if (batadv_dat_snoop_outgoing_arp_request(bat_priv, skb)) From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03734C433F5 for ; Mon, 10 Jan 2022 07:46:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243545AbiAJHpn (ORCPT ); Mon, 10 Jan 2022 02:45:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50404 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240572AbiAJHiS (ORCPT ); Mon, 10 Jan 2022 02:38:18 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1EA80C028BA8; Sun, 9 Jan 2022 23:32:36 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AADCFB81204; Mon, 10 Jan 2022 07:32:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EAE43C36AED; Mon, 10 Jan 2022 07:32:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799954; bh=ITblwZ2ADn0VPZZJdOsjLdDtAN52vSlPSF1hbAWXnMk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iqRWYAzBAKM9yXlU7Nr0IWj/UDayTi6QdZMybUw+yvgAx/IzpZ7Fk8qbFzMueJzEf gi0j+NUArSlsisTkEJKairACp1Iqkx6eVKG+4kMZjIKa0FGyKlMROlM+ICdjTNwBe8 p31rpc74oIKB/K5fNleqRdEZj0z8UuMARKNsYuAM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , "David S. Miller" Subject: [PATCH 5.15 28/72] sch_qfq: prevent shift-out-of-bounds in qfq_init_qdisc Date: Mon, 10 Jan 2022 08:23:05 +0100 Message-Id: <20220110071822.517882112@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 7d18a07897d07495ee140dd319b0e9265c0f68ba upstream. tx_queue_len can be set to ~0U, we need to be more careful about overflows. __fls(0) is undefined, as this report shows: UBSAN: shift-out-of-bounds in net/sched/sch_qfq.c:1430:24 shift exponent 51770272 is too large for 32-bit type 'int' CPU: 0 PID: 25574 Comm: syz-executor.0 Not tainted 5.16.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x201/0x2d8 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:151 [inline] __ubsan_handle_shift_out_of_bounds+0x494/0x530 lib/ubsan.c:330 qfq_init_qdisc+0x43f/0x450 net/sched/sch_qfq.c:1430 qdisc_create+0x895/0x1430 net/sched/sch_api.c:1253 tc_modify_qdisc+0x9d9/0x1e20 net/sched/sch_api.c:1660 rtnetlink_rcv_msg+0x934/0xe60 net/core/rtnetlink.c:5571 netlink_rcv_skb+0x200/0x470 net/netlink/af_netlink.c:2496 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x814/0x9f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0xaea/0xe60 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] ____sys_sendmsg+0x5b9/0x910 net/socket.c:2409 ___sys_sendmsg net/socket.c:2463 [inline] __sys_sendmsg+0x280/0x370 net/socket.c:2492 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cos= t") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/sched/sch_qfq.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -1422,10 +1422,8 @@ static int qfq_init_qdisc(struct Qdisc * if (err < 0) return err; =20 - if (qdisc_dev(sch)->tx_queue_len + 1 > QFQ_MAX_AGG_CLASSES) - max_classes =3D QFQ_MAX_AGG_CLASSES; - else - max_classes =3D qdisc_dev(sch)->tx_queue_len + 1; + max_classes =3D min_t(u64, (u64)qdisc_dev(sch)->tx_queue_len + 1, + QFQ_MAX_AGG_CLASSES); /* max_cl_shift =3D floor(log_2(max_classes)) */ max_cl_shift =3D __fls(max_classes); q->max_agg_classes =3D 1< X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6DCB0C433FE for ; Mon, 10 Jan 2022 07:41:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241949AbiAJHj7 (ORCPT ); Mon, 10 Jan 2022 02:39:59 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41322 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240417AbiAJHci (ORCPT ); Mon, 10 Jan 2022 02:32:38 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E47BB61194; Mon, 10 Jan 2022 07:32:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9E2DC36AF2; Mon, 10 Jan 2022 07:32:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799957; bh=VTj9hbcbX3h0WccmXAjf/rErR3CmIOR6BgUiqLg1vK0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LYcyZKp3FRKN/Ymj11XucDDemgQmIhdSsDiwyQh7q4SPB+47H0f8iBdbtPs6GBxLu hDPwNMuhTFpXyR+8ni+9ZQF3UKVsqZnsbliLc7aGrmkPelNxKdZi+y93mRNoWUHYAN MdInJ7s9KMUKvvE0xo/9lS14wDAtsZvzqQf/2p+M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shay Agroskin , Arthur Kiyanovski , "David S. Miller" Subject: [PATCH 5.15 29/72] net: ena: Fix undefined state when tx request id is out of bounds Date: Mon, 10 Jan 2022 08:23:06 +0100 Message-Id: <20220110071822.548262143@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arthur Kiyanovski commit c255a34e02efb1393d23ffb205ba1a11320aeffb upstream. ena_com_tx_comp_req_id_get() checks the req_id of a received completion, and if it is out of bounds returns -EINVAL. This is a sign that something is wrong with the device and it needs to be reset. The current code does not reset the device in this case, which leaves the driver in an undefined state, where this completion is not properly handled. This commit adds a call to handle_invalid_req_id() in ena_clean_tx_irq() and ena_clean_xdp_irq() which resets the device to fix the issue. This commit also removes unnecessary request id checks from validate_tx_req_id() and validate_xdp_req_id(). This check is unneeded because it was already performed in ena_com_tx_comp_req_id_get(), which is called right before these functions. Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") Signed-off-by: Shay Agroskin Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/amazon/ena/ena_netdev.c | 34 +++++++++++++++-------= ----- 1 file changed, 20 insertions(+), 14 deletions(-) --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -1288,26 +1288,22 @@ static int handle_invalid_req_id(struct =20 static int validate_tx_req_id(struct ena_ring *tx_ring, u16 req_id) { - struct ena_tx_buffer *tx_info =3D NULL; + struct ena_tx_buffer *tx_info; =20 - if (likely(req_id < tx_ring->ring_size)) { - tx_info =3D &tx_ring->tx_buffer_info[req_id]; - if (likely(tx_info->skb)) - return 0; - } + tx_info =3D &tx_ring->tx_buffer_info[req_id]; + if (likely(tx_info->skb)) + return 0; =20 return handle_invalid_req_id(tx_ring, req_id, tx_info, false); } =20 static int validate_xdp_req_id(struct ena_ring *xdp_ring, u16 req_id) { - struct ena_tx_buffer *tx_info =3D NULL; + struct ena_tx_buffer *tx_info; =20 - if (likely(req_id < xdp_ring->ring_size)) { - tx_info =3D &xdp_ring->tx_buffer_info[req_id]; - if (likely(tx_info->xdpf)) - return 0; - } + tx_info =3D &xdp_ring->tx_buffer_info[req_id]; + if (likely(tx_info->xdpf)) + return 0; =20 return handle_invalid_req_id(xdp_ring, req_id, tx_info, true); } @@ -1332,9 +1328,14 @@ static int ena_clean_tx_irq(struct ena_r =20 rc =3D ena_com_tx_comp_req_id_get(tx_ring->ena_com_io_cq, &req_id); - if (rc) + if (rc) { + if (unlikely(rc =3D=3D -EINVAL)) + handle_invalid_req_id(tx_ring, req_id, NULL, + false); break; + } =20 + /* validate that the request id points to a valid skb */ rc =3D validate_tx_req_id(tx_ring, req_id); if (rc) break; @@ -1896,9 +1897,14 @@ static int ena_clean_xdp_irq(struct ena_ =20 rc =3D ena_com_tx_comp_req_id_get(xdp_ring->ena_com_io_cq, &req_id); - if (rc) + if (rc) { + if (unlikely(rc =3D=3D -EINVAL)) + handle_invalid_req_id(xdp_ring, req_id, NULL, + true); break; + } =20 + /* validate that the request id points to a valid xdp_frame */ rc =3D validate_xdp_req_id(xdp_ring, req_id); if (rc) break; From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9EAFC4321E for ; Mon, 10 Jan 2022 07:46:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243858AbiAJHp7 (ORCPT ); Mon, 10 Jan 2022 02:45:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51294 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241748AbiAJHiS (ORCPT ); Mon, 10 Jan 2022 02:38:18 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F0FBEC028BB1; Sun, 9 Jan 2022 23:32:45 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B5C6BB81213; Mon, 10 Jan 2022 07:32:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6FAF0C36AED; Mon, 10 Jan 2022 07:32:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799963; bh=5ucqwL7Dxkwj99euF0edW3rqp3iP71cRd2u/ZGk/uBs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Joj5pbsBMUEXkr2g6F/IyqexB9vdYtZsk2oJZUFmBRoZWXlcRF/UnIW8jnce2nvfR OpPyn5uVUj5j75sKuXNEfcLUBm81xgK9568XFc01KpeTO31ayqzVPNJZryBPdUK2aN mRWdsyK4GRdvwfq3owvFNbPGQfUCZ4Qby/fRLrZQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arthur Kiyanovski , "David S. Miller" Subject: [PATCH 5.15 30/72] net: ena: Fix wrong rx request id by resetting device Date: Mon, 10 Jan 2022 08:23:07 +0100 Message-Id: <20220110071822.580753572@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arthur Kiyanovski commit cb3d4f98f0b26eafa0b913ac3716e4714254a747 upstream. A wrong request id received from the device is a sign that something is wrong with it, therefore trigger a device reset. Also add some debug info to the "Page is NULL" print to make it easier to debug. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Ada= pters (ENA)") Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/amazon/ena/ena_netdev.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -1428,6 +1428,7 @@ static struct sk_buff *ena_rx_skb(struct u16 *next_to_clean) { struct ena_rx_buffer *rx_info; + struct ena_adapter *adapter; u16 len, req_id, buf =3D 0; struct sk_buff *skb; void *page_addr; @@ -1440,8 +1441,14 @@ static struct sk_buff *ena_rx_skb(struct rx_info =3D &rx_ring->rx_buffer_info[req_id]; =20 if (unlikely(!rx_info->page)) { - netif_err(rx_ring->adapter, rx_err, rx_ring->netdev, - "Page is NULL\n"); + adapter =3D rx_ring->adapter; + netif_err(adapter, rx_err, rx_ring->netdev, + "Page is NULL. qid %u req_id %u\n", rx_ring->qid, req_id); + ena_increase_stat(&rx_ring->rx_stats.bad_req_id, 1, &rx_ring->syncp); + adapter->reset_reason =3D ENA_REGS_RESET_INV_RX_REQ_ID; + /* Make sure reset reason is set before triggering the reset */ + smp_mb__before_atomic(); + set_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags); return NULL; } =20 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B9A4C433EF for ; Mon, 10 Jan 2022 07:41:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241852AbiAJHju (ORCPT ); Mon, 10 Jan 2022 02:39:50 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41404 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240848AbiAJHcr (ORCPT ); Mon, 10 Jan 2022 02:32:47 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C204B611B6; Mon, 10 Jan 2022 07:32:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A6AE1C36AEF; Mon, 10 Jan 2022 07:32:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799966; bh=Lu4XgzqD4Y66Q0usyFzBvUsYXS/nROphKLCsJuhY/Us=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=n4xt85kW5uLbzGpb9ajCodtMSNYFavvtmYp3kuo5ii3kHiq78v5yTehluZNSkwC2G 9spIkLcsE2WqKXFQiPl4AtDChJJQgP7Px1e8YpbDXnmZcr1mpglfz67noe4g9X4RHW 5UfRUJhBFlR5Kcv77xVE9o28wOT2HMl/DdYUY7PQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shay Agroskin , Arthur Kiyanovski , "David S. Miller" Subject: [PATCH 5.15 31/72] net: ena: Fix error handling when calculating max IO queues number Date: Mon, 10 Jan 2022 08:23:08 +0100 Message-Id: <20220110071822.610624488@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arthur Kiyanovski commit 5055dc0348b8b7c168e3296044bccd724e1ae6cd upstream. The role of ena_calc_max_io_queue_num() is to return the number of queues supported by the device, which means the return value should be >=3D0. The function that calls ena_calc_max_io_queue_num(), checks the return value. If it is 0, it means the device reported it supports 0 IO queues. This case is considered an error and is handled by the calling function accordingly. However the current implementation of ena_calc_max_io_queue_num() is wrong, since when it detects the device supports 0 IO queues, it returns -EFAULT. In such a case the calling function doesn't detect the error, and therefore doesn't handle it. This commit changes ena_calc_max_io_queue_num() to return 0 in case the device reported it supports 0 queues, allowing the calling function to properly handle the error case. Fixes: 736ce3f414cc ("net: ena: make ethtool -l show correct max number of = queues") Signed-off-by: Shay Agroskin Signed-off-by: Arthur Kiyanovski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/amazon/ena/ena_netdev.c | 4 ---- 1 file changed, 4 deletions(-) --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -4026,10 +4026,6 @@ static u32 ena_calc_max_io_queue_num(str max_num_io_queues =3D min_t(u32, max_num_io_queues, io_tx_cq_num); /* 1 IRQ for mgmnt and 1 IRQs for each IO direction */ max_num_io_queues =3D min_t(u32, max_num_io_queues, pci_msix_vec_count(pd= ev) - 1); - if (unlikely(!max_num_io_queues)) { - dev_err(&pdev->dev, "The device doesn't have io queues\n"); - return -EFAULT; - } =20 return max_num_io_queues; } From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4AC7C433F5 for ; Mon, 10 Jan 2022 07:41:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241882AbiAJHjx (ORCPT ); Mon, 10 Jan 2022 02:39:53 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:60872 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240857AbiAJHcv (ORCPT ); Mon, 10 Jan 2022 02:32:51 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 42255B81213; Mon, 10 Jan 2022 07:32:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 73241C36AED; Mon, 10 Jan 2022 07:32:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799969; bh=V3CsWTO+/8vOVLZMCWRNWCH1UqB2p2pJz3ESHO5hvxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UrnsTAKrWkM7rQ/A1c/vibaDl8j7ZM2BiO+8ic2f9b5NUKR0UmADfkjNe3ts8lq+J NJkosHiv43FA+qZw/+lBb2hAf7ZsMEA16VPqAEb7RuCjC2BRBXj3ROxIW+QhgORntG hD3dgajQ72sPOMmZMl4F86t1UL+ipjRW3SEhRZp0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guoqing Jiang , Jens Axboe , Norbert Warmuth , Linus Torvalds , Song Liu Subject: [PATCH 5.15 32/72] md/raid1: fix missing bitmap update w/o WriteMostly devices Date: Mon, 10 Jan 2022 08:23:09 +0100 Message-Id: <20220110071822.642410774@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Song Liu commit 46669e8616c649c71c4cfcd712fd3d107e771380 upstream. commit [1] causes missing bitmap updates when there isn't any WriteMostly devices. Detailed steps to reproduce by Norbert (which somehow didn't make to lore): # setup md10 (raid1) with two drives (1 GByte sparse files) dd if=3D/dev/zero of=3Ddisk1 bs=3D1024k seek=3D1024 count=3D0 dd if=3D/dev/zero of=3Ddisk2 bs=3D1024k seek=3D1024 count=3D0 losetup /dev/loop11 disk1 losetup /dev/loop12 disk2 mdadm --create /dev/md10 --level=3D1 --raid-devices=3D2 /dev/loop11 /dev= /loop12 # add bitmap (aka write-intent log) mdadm /dev/md10 --grow --bitmap=3Dinternal echo check > /sys/block/md10/md/sync_action root:# cat /sys/block/md10/md/mismatch_cnt 0 root:# # remove member drive disk2 (loop12) mdadm /dev/md10 -f loop12 ; mdadm /dev/md10 -r loop12 # modify degraded md device dd if=3D/dev/urandom of=3D/dev/md10 bs=3D512 count=3D1 # no blocks recorded as out of sync on the remaining member disk1/loop11 root:# mdadm -X /dev/loop11 | grep Bitmap Bitmap : 16 bits (chunks), 0 dirty (0.0%) root:# # re-add disk2, nothing synced because of empty bitmap mdadm /dev/md10 --re-add /dev/loop12 # check integrity again echo check > /sys/block/md10/md/sync_action # disk1 and disk2 are no longer in sync, reads return differend data root:# cat /sys/block/md10/md/mismatch_cnt 128 root:# # clean up mdadm -S /dev/md10 losetup -d /dev/loop11 losetup -d /dev/loop12 rm disk1 disk2 Fix this by moving the WriteMostly check to the if condition for alloc_behind_master_bio(). [1] commit fd3b6975e9c1 ("md/raid1: only allocate write behind bio for Writ= eMostly device") Fixes: fd3b6975e9c1 ("md/raid1: only allocate write behind bio for WriteMos= tly device") Cc: stable@vger.kernel.org # v5.12+ Cc: Guoqing Jiang Cc: Jens Axboe Reported-by: Norbert Warmuth Suggested-by: Linus Torvalds Signed-off-by: Song Liu Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/md/raid1.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1496,12 +1496,13 @@ static void raid1_write_request(struct m if (!r1_bio->bios[i]) continue; =20 - if (first_clone && test_bit(WriteMostly, &rdev->flags)) { + if (first_clone) { /* do behind I/O ? * Not if there are too many, or cannot * allocate memory, or a reader on WriteMostly * is waiting for behind writes to flush */ if (bitmap && + test_bit(WriteMostly, &rdev->flags) && (atomic_read(&bitmap->behind_writes) < mddev->bitmap_info.max_write_behind) && !waitqueue_active(&bitmap->behind_wait)) { From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA5C0C433EF for ; Mon, 10 Jan 2022 07:51:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241713AbiAJHvs (ORCPT ); Mon, 10 Jan 2022 02:51:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51636 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241375AbiAJHlp (ORCPT ); Mon, 10 Jan 2022 02:41:45 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 12659C03327B; Sun, 9 Jan 2022 23:34:50 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A3E1760BA2; Mon, 10 Jan 2022 07:34:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F548C36AED; Mon, 10 Jan 2022 07:34:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800089; bh=/fvrGJS9mrvvCg2b3RyZrTxkGZGBKhvnZLQiQQLaMqA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hrjZO+Ax1m+H+1yAEt3jWsRWVf3M4002vQwXf99WsaYPFDRYosl6UghIKLPDJbb96 tbYhauY8BkhbdlVJju9AXGA0FjSNeePR/fdJT9LJpmmoWD/MLGHNUM7Lc0TAXVzc5K rKk4bc4s7rFBN4HoX/z2Wy6invJaNVlfG4sB8rlU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Dan Carpenter , Qiuxu Zhuo , Tony Luck Subject: [PATCH 5.15 33/72] EDAC/i10nm: Release mdev/mbase when failing to detect HBM Date: Mon, 10 Jan 2022 08:23:10 +0100 Message-Id: <20220110071822.674979135@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Qiuxu Zhuo commit c370baa328022cbd46c59c821d1b467a97f047be upstream. On systems without HBM (High Bandwidth Memory) mdev/mbase are not released/unmapped. Add the code to release mdev/mbase when failing to detect HBM. [Tony: re-word commit message] Cc: Fixes: c945088384d0 ("EDAC/i10nm: Add support for high bandwidth memory") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20211224091126.1246-1-qiuxu.zhuo@intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/edac/i10nm_base.c | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/drivers/edac/i10nm_base.c +++ b/drivers/edac/i10nm_base.c @@ -358,6 +358,9 @@ static int i10nm_get_hbm_munits(void) =20 mbase =3D ioremap(base + off, I10NM_HBM_IMC_MMIO_SIZE); if (!mbase) { + pci_dev_put(d->imc[lmc].mdev); + d->imc[lmc].mdev =3D NULL; + i10nm_printk(KERN_ERR, "Failed to ioremap for hbm mc 0x%llx\n", base + off); return -ENOMEM; @@ -368,6 +371,12 @@ static int i10nm_get_hbm_munits(void) =20 mcmtr =3D I10NM_GET_MCMTR(&d->imc[lmc], 0); if (!I10NM_IS_HBM_IMC(mcmtr)) { + iounmap(d->imc[lmc].mbase); + d->imc[lmc].mbase =3D NULL; + d->imc[lmc].hbm_mc =3D false; + pci_dev_put(d->imc[lmc].mdev); + d->imc[lmc].mdev =3D NULL; + i10nm_printk(KERN_ERR, "This isn't an hbm mc!\n"); return -ENODEV; } From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A514FC433F5 for ; Mon, 10 Jan 2022 07:42:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240094AbiAJHmN (ORCPT ); Mon, 10 Jan 2022 02:42:13 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41718 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239828AbiAJHdN (ORCPT ); Mon, 10 Jan 2022 02:33:13 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AF692611C0; Mon, 10 Jan 2022 07:33:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97598C36AED; Mon, 10 Jan 2022 07:33:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799992; bh=twezZ0T1oF934WqErVlqXAgbsR0+9X2fsgYIG7ynZOo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AzhUsT1myRIkUkcDr/S3b+o6IA0JSh91OpzPLA8hFG9GPtb3/UT7b8ol6iUoDRP7n ipE8eNXV6Z4mYh4i7GuReOJX2lBGnNjlOV81tfaIZ7nKIoEm2aZOJjduVX+E7x7dxl G/mlOMgACXWu4zUtwK8NYJI/OxRjkOjCjHF7BVhM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vasant Hegde , Nikunj A Dadhania , Peter Xu , Sean Christopherson , Paolo Bonzini Subject: [PATCH 5.15 34/72] KVM: x86: Check for rmaps allocation Date: Mon, 10 Jan 2022 08:23:11 +0100 Message-Id: <20220110071822.706749841@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nikunj A Dadhania commit fffb5323780786c81ba005f8b8603d4a558aad28 upstream. With TDP MMU being the default now, access to mmu_rmaps_stat debugfs file causes following oops: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 7 PID: 3185 Comm: cat Not tainted 5.16.0-rc4+ #204 RIP: 0010:pte_list_count+0x6/0x40 Call Trace: ? kvm_mmu_rmaps_stat_show+0x15e/0x320 seq_read_iter+0x126/0x4b0 ? aa_file_perm+0x124/0x490 seq_read+0xf5/0x140 full_proxy_read+0x5c/0x80 vfs_read+0x9f/0x1a0 ksys_read+0x67/0xe0 __x64_sys_read+0x19/0x20 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fca6fc13912 Return early when rmaps are not present. Reported-by: Vasant Hegde Tested-by: Vasant Hegde Signed-off-by: Nikunj A Dadhania Reviewed-by: Peter Xu Reviewed-by: Sean Christopherson Message-Id: <20220105040337.4234-1-nikunj@amd.com> Cc: stable@vger.kernel.org Fixes: 3bcd0662d66f ("KVM: X86: Introduce mmu_rmaps_stat per-vm debugfs fil= e") Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- arch/x86/kvm/debugfs.c | 3 +++ 1 file changed, 3 insertions(+) --- a/arch/x86/kvm/debugfs.c +++ b/arch/x86/kvm/debugfs.c @@ -95,6 +95,9 @@ static int kvm_mmu_rmaps_stat_show(struc unsigned int *log[KVM_NR_PAGE_SIZES], *cur; int i, j, k, l, ret; =20 + if (!kvm_memslots_have_rmaps(kvm)) + return 0; + ret =3D -ENOMEM; memset(log, 0, sizeof(log)); for (i =3D 0; i < KVM_NR_PAGE_SIZES; i++) { From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B76FC43219 for ; Mon, 10 Jan 2022 07:46:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240863AbiAJHqy (ORCPT ); Mon, 10 Jan 2022 02:46:54 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50668 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241786AbiAJHjd (ORCPT ); Mon, 10 Jan 2022 02:39:33 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E107BC061201; Sun, 9 Jan 2022 23:33:45 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9E3D0B81161; Mon, 10 Jan 2022 07:33:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA1D4C36AE9; Mon, 10 Jan 2022 07:33:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800023; bh=twpC+smUf9jAn5TvcaZ2WC7cZyABAVOJx4Bm3/TbeUE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QF4i7sCygA67blGkeZuDRu9Zg7+RBX/ZTN2kQquo12waxivjnUU1OPXnPx0ku4THO p29SpmFJBzncAAdRhI6IEuuG0nzpsTL52i3cOT0luzGFuZK2XkWiUcU7NaJQvnXSOl yXP3AT3p6IdEbgcEvsvrjQtNUyPOtaFdgimRasdg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Eric W. Biederman" , Linus Torvalds , =?UTF-8?q?Michal=20Koutn=C3=BD?= , Tejun Heo Subject: [PATCH 5.15 35/72] cgroup: Use open-time credentials for process migraton perm checks Date: Mon, 10 Jan 2022 08:23:12 +0100 Message-Id: <20220110071822.746965588@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tejun Heo commit 1756d7994ad85c2479af6ae5a9750b92324685af upstream. cgroup process migration permission checks are performed at write time as whether a given operation is allowed or not is dependent on the content of the write - the PID. This currently uses current's credentials which is a potential security weakness as it may allow scenarios where a less privileged process tricks a more privileged one into writing into a fd that it created. This patch makes both cgroup2 and cgroup1 process migration interfaces to use the credentials saved at the time of open (file->f_cred) instead of current's. Reported-by: "Eric W. Biederman" Suggested-by: Linus Torvalds Fixes: 187fe84067bd ("cgroup: require write perm on common ancestor when mo= ving processes on the default hierarchy") Reviewed-by: Michal Koutn=C3=BD Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- kernel/cgroup/cgroup-v1.c | 7 ++++--- kernel/cgroup/cgroup.c | 9 ++++++++- 2 files changed, 12 insertions(+), 4 deletions(-) --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -507,10 +507,11 @@ static ssize_t __cgroup1_procs_write(str goto out_unlock; =20 /* - * Even if we're attaching all tasks in the thread group, we only - * need to check permissions on one of them. + * Even if we're attaching all tasks in the thread group, we only need + * to check permissions on one of them. Check permissions using the + * credentials from file open to protect against inherited fd attacks. */ - cred =3D current_cred(); + cred =3D of->file->f_cred; tcred =3D get_task_cred(task); if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && !uid_eq(cred->euid, tcred->uid) && --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -4892,6 +4892,7 @@ static ssize_t __cgroup_procs_write(stru { struct cgroup *src_cgrp, *dst_cgrp; struct task_struct *task; + const struct cred *saved_cred; ssize_t ret; bool locked; =20 @@ -4909,9 +4910,15 @@ static ssize_t __cgroup_procs_write(stru src_cgrp =3D task_cgroup_from_root(task, &cgrp_dfl_root); spin_unlock_irq(&css_set_lock); =20 - /* process and thread migrations follow same delegation rule */ + /* + * Process and thread migrations follow same delegation rule. Check + * permissions using the credentials from file open to protect against + * inherited fd attacks. + */ + saved_cred =3D override_creds(of->file->f_cred); ret =3D cgroup_attach_permissions(src_cgrp, dst_cgrp, of->file->f_path.dentry->d_sb, threadgroup); + revert_creds(saved_cred); if (ret) goto out_finish; =20 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32C18C433EF for ; Mon, 10 Jan 2022 07:44:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242901AbiAJHoC (ORCPT ); Mon, 10 Jan 2022 02:44:02 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42468 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239920AbiAJHeQ (ORCPT ); Mon, 10 Jan 2022 02:34:16 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BC6C6611C5; Mon, 10 Jan 2022 07:34:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A48C5C36AED; Mon, 10 Jan 2022 07:34:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800055; bh=vNuGco9DER8VjRictqFzW5vPwjcsKAXL6CcG9CMtQeQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=O1B2FtExJXQPDttR7MsAyBcdE1cU56Kjg6AYSi4WvwQ1nC/VtVAGm4whY2vXQwldD h3RDkX80W8soE5wXE/frSVwwHrZPUJyxNX6x8eg3vB5wvy6Ie3JX2HEmUPNqwg2SMT 59gymE2u1kDzqrGltAeLIVpPMVEGZTgbLD6Ht1/Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tejun Heo , Linus Torvalds , =?UTF-8?q?Michal=20Koutn=C3=BD?= Subject: [PATCH 5.15 36/72] cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv Date: Mon, 10 Jan 2022 08:23:13 +0100 Message-Id: <20220110071822.780524268@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tejun Heo commit 0d2b5955b36250a9428c832664f2079cbf723bec upstream. of->priv is currently used by each interface file implementation to store private information. This patch collects the current two private data usages into struct cgroup_file_ctx which is allocated and freed by the common path. This allows generic private data which applies to multiple files, which will be used to in the following patch. Note that cgroup_procs iterator is now embedded as procs.iter in the new cgroup_file_ctx so that it doesn't need to be allocated and freed separately. v2: union dropped from cgroup_file_ctx and the procs iterator is embedded in cgroup_file_ctx as suggested by Linus. v3: Michal pointed out that cgroup1's procs pidlist uses of->priv too. Converted. Didn't change to embedded allocation as cgroup1 pidlists get stored for caching. Signed-off-by: Tejun Heo Cc: Linus Torvalds Reviewed-by: Michal Koutn=C3=BD Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- kernel/cgroup/cgroup-internal.h | 17 ++++++++++++ kernel/cgroup/cgroup-v1.c | 26 ++++++++++--------- kernel/cgroup/cgroup.c | 53 +++++++++++++++++++++++++----------= ----- 3 files changed, 65 insertions(+), 31 deletions(-) --- a/kernel/cgroup/cgroup-internal.h +++ b/kernel/cgroup/cgroup-internal.h @@ -65,6 +65,23 @@ static inline struct cgroup_fs_context * return container_of(kfc, struct cgroup_fs_context, kfc); } =20 +struct cgroup_pidlist; + +struct cgroup_file_ctx { + struct { + void *trigger; + } psi; + + struct { + bool started; + struct css_task_iter iter; + } procs; + + struct { + struct cgroup_pidlist *pidlist; + } procs1; +}; + /* * A cgroup can be associated with multiple css_sets as different tasks may * belong to different cgroups on different hierarchies. In the other --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -397,6 +397,7 @@ static void *cgroup_pidlist_start(struct * next pid to display, if any */ struct kernfs_open_file *of =3D s->private; + struct cgroup_file_ctx *ctx =3D of->priv; struct cgroup *cgrp =3D seq_css(s)->cgroup; struct cgroup_pidlist *l; enum cgroup_filetype type =3D seq_cft(s)->private; @@ -406,25 +407,24 @@ static void *cgroup_pidlist_start(struct mutex_lock(&cgrp->pidlist_mutex); =20 /* - * !NULL @of->priv indicates that this isn't the first start() - * after open. If the matching pidlist is around, we can use that. - * Look for it. Note that @of->priv can't be used directly. It - * could already have been destroyed. + * !NULL @ctx->procs1.pidlist indicates that this isn't the first + * start() after open. If the matching pidlist is around, we can use + * that. Look for it. Note that @ctx->procs1.pidlist can't be used + * directly. It could already have been destroyed. */ - if (of->priv) - of->priv =3D cgroup_pidlist_find(cgrp, type); + if (ctx->procs1.pidlist) + ctx->procs1.pidlist =3D cgroup_pidlist_find(cgrp, type); =20 /* * Either this is the first start() after open or the matching * pidlist has been destroyed inbetween. Create a new one. */ - if (!of->priv) { - ret =3D pidlist_array_load(cgrp, type, - (struct cgroup_pidlist **)&of->priv); + if (!ctx->procs1.pidlist) { + ret =3D pidlist_array_load(cgrp, type, &ctx->procs1.pidlist); if (ret) return ERR_PTR(ret); } - l =3D of->priv; + l =3D ctx->procs1.pidlist; =20 if (pid) { int end =3D l->length; @@ -452,7 +452,8 @@ static void *cgroup_pidlist_start(struct static void cgroup_pidlist_stop(struct seq_file *s, void *v) { struct kernfs_open_file *of =3D s->private; - struct cgroup_pidlist *l =3D of->priv; + struct cgroup_file_ctx *ctx =3D of->priv; + struct cgroup_pidlist *l =3D ctx->procs1.pidlist; =20 if (l) mod_delayed_work(cgroup_pidlist_destroy_wq, &l->destroy_dwork, @@ -463,7 +464,8 @@ static void cgroup_pidlist_stop(struct s static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos) { struct kernfs_open_file *of =3D s->private; - struct cgroup_pidlist *l =3D of->priv; + struct cgroup_file_ctx *ctx =3D of->priv; + struct cgroup_pidlist *l =3D ctx->procs1.pidlist; pid_t *p =3D v; pid_t *end =3D l->list + l->length; /* --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -3630,6 +3630,7 @@ static int cgroup_cpu_pressure_show(stru static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *bu= f, size_t nbytes, enum psi_res res) { + struct cgroup_file_ctx *ctx =3D of->priv; struct psi_trigger *new; struct cgroup *cgrp; struct psi_group *psi; @@ -3648,7 +3649,7 @@ static ssize_t cgroup_pressure_write(str return PTR_ERR(new); } =20 - psi_trigger_replace(&of->priv, new); + psi_trigger_replace(&ctx->psi.trigger, new); =20 cgroup_put(cgrp); =20 @@ -3679,12 +3680,16 @@ static ssize_t cgroup_cpu_pressure_write static __poll_t cgroup_pressure_poll(struct kernfs_open_file *of, poll_table *pt) { - return psi_trigger_poll(&of->priv, of->file, pt); + struct cgroup_file_ctx *ctx =3D of->priv; + + return psi_trigger_poll(&ctx->psi.trigger, of->file, pt); } =20 static void cgroup_pressure_release(struct kernfs_open_file *of) { - psi_trigger_replace(&of->priv, NULL); + struct cgroup_file_ctx *ctx =3D of->priv; + + psi_trigger_replace(&ctx->psi.trigger, NULL); } =20 bool cgroup_psi_enabled(void) @@ -3811,18 +3816,31 @@ static ssize_t cgroup_kill_write(struct static int cgroup_file_open(struct kernfs_open_file *of) { struct cftype *cft =3D of_cft(of); + struct cgroup_file_ctx *ctx; + int ret; =20 - if (cft->open) - return cft->open(of); - return 0; + ctx =3D kzalloc(sizeof(*ctx), GFP_KERNEL); + if (!ctx) + return -ENOMEM; + of->priv =3D ctx; + + if (!cft->open) + return 0; + + ret =3D cft->open(of); + if (ret) + kfree(ctx); + return ret; } =20 static void cgroup_file_release(struct kernfs_open_file *of) { struct cftype *cft =3D of_cft(of); + struct cgroup_file_ctx *ctx =3D of->priv; =20 if (cft->release) cft->release(of); + kfree(ctx); } =20 static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, @@ -4751,21 +4769,21 @@ void css_task_iter_end(struct css_task_i =20 static void cgroup_procs_release(struct kernfs_open_file *of) { - if (of->priv) { - css_task_iter_end(of->priv); - kfree(of->priv); - } + struct cgroup_file_ctx *ctx =3D of->priv; + + if (ctx->procs.started) + css_task_iter_end(&ctx->procs.iter); } =20 static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos) { struct kernfs_open_file *of =3D s->private; - struct css_task_iter *it =3D of->priv; + struct cgroup_file_ctx *ctx =3D of->priv; =20 if (pos) (*pos)++; =20 - return css_task_iter_next(it); + return css_task_iter_next(&ctx->procs.iter); } =20 static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, @@ -4773,21 +4791,18 @@ static void *__cgroup_procs_start(struct { struct kernfs_open_file *of =3D s->private; struct cgroup *cgrp =3D seq_css(s)->cgroup; - struct css_task_iter *it =3D of->priv; + struct cgroup_file_ctx *ctx =3D of->priv; + struct css_task_iter *it =3D &ctx->procs.iter; =20 /* * When a seq_file is seeked, it's always traversed sequentially * from position 0, so we can simply keep iterating on !0 *pos. */ - if (!it) { + if (!ctx->procs.started) { if (WARN_ON_ONCE((*pos))) return ERR_PTR(-EINVAL); - - it =3D kzalloc(sizeof(*it), GFP_KERNEL); - if (!it) - return ERR_PTR(-ENOMEM); - of->priv =3D it; css_task_iter_start(&cgrp->self, iter_flags, it); + ctx->procs.started =3D true; } else if (!(*pos)) { css_task_iter_end(it); css_task_iter_start(&cgrp->self, iter_flags, it); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74F2CC433EF for ; Mon, 10 Jan 2022 07:46:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243087AbiAJHon (ORCPT ); Mon, 10 Jan 2022 02:44:43 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42662 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241025AbiAJHee (ORCPT ); Mon, 10 Jan 2022 02:34:34 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A69C460B9F; Mon, 10 Jan 2022 07:34:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8AAA6C36AEF; Mon, 10 Jan 2022 07:34:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800072; bh=s9WQN8wUNGnfjZPGcVHh4RwTYYZ+mwZkmQV+cQnPnbk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bpySV6s57t5NY02fgcVSdQ7nvnG6/VohqEot8wnPB8baOTtO14NqKqS6RaN8blFLF kSqjV4wPjNlWR0koGKzeFIB2PL65T02viEK5njjzFBd6LUMgonPLqL5jRDjZq64BZi PSVezX5Q/r+OT/CxRAgSg89RR6EmIf6oZ/VYR5QU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Eric W. Biederman" , Linus Torvalds , =?UTF-8?q?Michal=20Koutn=C3=BD?= , Oleg Nesterov , syzbot+50f5cf33a284ce738b62@syzkaller.appspotmail.com, Tejun Heo Subject: [PATCH 5.15 37/72] cgroup: Use open-time cgroup namespace for process migration perm checks Date: Mon, 10 Jan 2022 08:23:14 +0100 Message-Id: <20220110071822.811085217@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tejun Heo commit e57457641613fef0d147ede8bd6a3047df588b95 upstream. cgroup process migration permission checks are performed at write time as whether a given operation is allowed or not is dependent on the content of the write - the PID. This currently uses current's cgroup namespace which is a potential security weakness as it may allow scenarios where a less privileged process tricks a more privileged one into writing into a fd that it created. This patch makes cgroup remember the cgroup namespace at the time of open and uses it for migration permission checks instad of current's. Note that this only applies to cgroup2 as cgroup1 doesn't have namespace support. This also fixes a use-after-free bug on cgroupns reported in https://lore.kernel.org/r/00000000000048c15c05d0083397@google.com Note that backporting this fix also requires the preceding patch. Reported-by: "Eric W. Biederman" Suggested-by: Linus Torvalds Cc: Michal Koutn=C3=BD Cc: Oleg Nesterov Reviewed-by: Michal Koutn=C3=BD Reported-by: syzbot+50f5cf33a284ce738b62@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/00000000000048c15c05d0083397@google.com Fixes: 5136f6365ce3 ("cgroup: implement "nsdelegate" mount option") Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- kernel/cgroup/cgroup-internal.h | 2 ++ kernel/cgroup/cgroup.c | 28 +++++++++++++++++++--------- 2 files changed, 21 insertions(+), 9 deletions(-) --- a/kernel/cgroup/cgroup-internal.h +++ b/kernel/cgroup/cgroup-internal.h @@ -68,6 +68,8 @@ static inline struct cgroup_fs_context * struct cgroup_pidlist; =20 struct cgroup_file_ctx { + struct cgroup_namespace *ns; + struct { void *trigger; } psi; --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -3822,14 +3822,19 @@ static int cgroup_file_open(struct kernf ctx =3D kzalloc(sizeof(*ctx), GFP_KERNEL); if (!ctx) return -ENOMEM; + + ctx->ns =3D current->nsproxy->cgroup_ns; + get_cgroup_ns(ctx->ns); of->priv =3D ctx; =20 if (!cft->open) return 0; =20 ret =3D cft->open(of); - if (ret) + if (ret) { + put_cgroup_ns(ctx->ns); kfree(ctx); + } return ret; } =20 @@ -3840,13 +3845,14 @@ static void cgroup_file_release(struct k =20 if (cft->release) cft->release(of); + put_cgroup_ns(ctx->ns); kfree(ctx); } =20 static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, size_t nbytes, loff_t off) { - struct cgroup_namespace *ns =3D current->nsproxy->cgroup_ns; + struct cgroup_file_ctx *ctx =3D of->priv; struct cgroup *cgrp =3D of->kn->parent->priv; struct cftype *cft =3D of_cft(of); struct cgroup_subsys_state *css; @@ -3863,7 +3869,7 @@ static ssize_t cgroup_file_write(struct */ if ((cgrp->root->flags & CGRP_ROOT_NS_DELEGATE) && !(cft->flags & CFTYPE_NS_DELEGATABLE) && - ns !=3D &init_cgroup_ns && ns->root_cset->dfl_cgrp =3D=3D cgrp) + ctx->ns !=3D &init_cgroup_ns && ctx->ns->root_cset->dfl_cgrp =3D=3D c= grp) return -EPERM; =20 if (cft->write) @@ -4853,9 +4859,9 @@ static int cgroup_may_write(const struct =20 static int cgroup_procs_write_permission(struct cgroup *src_cgrp, struct cgroup *dst_cgrp, - struct super_block *sb) + struct super_block *sb, + struct cgroup_namespace *ns) { - struct cgroup_namespace *ns =3D current->nsproxy->cgroup_ns; struct cgroup *com_cgrp =3D src_cgrp; int ret; =20 @@ -4884,11 +4890,12 @@ static int cgroup_procs_write_permission =20 static int cgroup_attach_permissions(struct cgroup *src_cgrp, struct cgroup *dst_cgrp, - struct super_block *sb, bool threadgroup) + struct super_block *sb, bool threadgroup, + struct cgroup_namespace *ns) { int ret =3D 0; =20 - ret =3D cgroup_procs_write_permission(src_cgrp, dst_cgrp, sb); + ret =3D cgroup_procs_write_permission(src_cgrp, dst_cgrp, sb, ns); if (ret) return ret; =20 @@ -4905,6 +4912,7 @@ static int cgroup_attach_permissions(str static ssize_t __cgroup_procs_write(struct kernfs_open_file *of, char *buf, bool threadgroup) { + struct cgroup_file_ctx *ctx =3D of->priv; struct cgroup *src_cgrp, *dst_cgrp; struct task_struct *task; const struct cred *saved_cred; @@ -4932,7 +4940,8 @@ static ssize_t __cgroup_procs_write(stru */ saved_cred =3D override_creds(of->file->f_cred); ret =3D cgroup_attach_permissions(src_cgrp, dst_cgrp, - of->file->f_path.dentry->d_sb, threadgroup); + of->file->f_path.dentry->d_sb, + threadgroup, ctx->ns); revert_creds(saved_cred); if (ret) goto out_finish; @@ -6149,7 +6158,8 @@ static int cgroup_css_set_fork(struct ke goto err; =20 ret =3D cgroup_attach_permissions(cset->dfl_cgrp, dst_cgrp, sb, - !(kargs->flags & CLONE_THREAD)); + !(kargs->flags & CLONE_THREAD), + current->nsproxy->cgroup_ns); if (ret) goto err; =20 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 848D7C433F5 for ; Mon, 10 Jan 2022 07:46:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243164AbiAJHos (ORCPT ); Mon, 10 Jan 2022 02:44:48 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42676 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241051AbiAJHei (ORCPT ); Mon, 10 Jan 2022 02:34:38 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7EC1C60C07; Mon, 10 Jan 2022 07:34:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 61561C36AED; Mon, 10 Jan 2022 07:34:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800074; bh=MCsFaAiWm6my6sUnZa4K4kkGh4YU1t59pdeAwZ6QeJY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=E0s75Qs2/v/hVUtW3oWfUSTWNpTcAPBKbWNEPcP2uPVPOeikv/BMZ3/4JttY+p0JI 4TIz72/4RMIponQ0X1qonkAlVzY7wDsOO3ycUuqRYbsq1ByqQmdNTn5g7YI+9W5vMv y/qQ55ILmE7hQ3Y8WqbRGPsRyKk6eENJVieL307U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Tareque Md.Hanif" , Konstantin Kharlamov , Wolfram Sang Subject: [PATCH 5.15 38/72] Revert "i2c: core: support bus regulator controlling in adapter" Date: Mon, 10 Jan 2022 08:23:15 +0100 Message-Id: <20220110071822.844018002@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wolfram Sang commit a19f75de73c220b4496d2aefb7a605dd032f7c01 upstream. This largely reverts commit 5a7b95fb993ec399c8a685552aa6a8fc995c40bd. It breaks suspend with AMD GPUs, and we couldn't incrementally fix it. So, let's remove the code and go back to the drawing board. We keep the header extension to not break drivers already populating the regulator. We expect to re-add the code handling it soon. Fixes: 5a7b95fb993e ("i2c: core: support bus regulator controlling in adapt= er") Reported-by: "Tareque Md.Hanif" Link: https://lore.kernel.org/r/1295184560.182511.1639075777725@mail.yahoo.= com Reported-by: Konstantin Kharlamov Link: https://lore.kernel.org/r/7143a7147978f4104171072d9f5225d2ce355ec1.ca= mel@yandex.ru BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1850 Tested-by: "Tareque Md.Hanif" Tested-by: Konstantin Kharlamov Signed-off-by: Wolfram Sang Cc: # 5.14+ Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/i2c/i2c-core-base.c | 95 ---------------------------------------= ----- 1 file changed, 95 deletions(-) --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -466,14 +466,12 @@ static int i2c_smbus_host_notify_to_irq( static int i2c_device_probe(struct device *dev) { struct i2c_client *client =3D i2c_verify_client(dev); - struct i2c_adapter *adap; struct i2c_driver *driver; int status; =20 if (!client) return 0; =20 - adap =3D client->adapter; client->irq =3D client->init_irq; =20 if (!client->irq) { @@ -539,14 +537,6 @@ static int i2c_device_probe(struct devic =20 dev_dbg(dev, "probe\n"); =20 - if (adap->bus_regulator) { - status =3D regulator_enable(adap->bus_regulator); - if (status < 0) { - dev_err(&adap->dev, "Failed to enable bus regulator\n"); - goto err_clear_wakeup_irq; - } - } - status =3D of_clk_set_defaults(dev->of_node, false); if (status < 0) goto err_clear_wakeup_irq; @@ -604,10 +594,8 @@ put_sync_adapter: static void i2c_device_remove(struct device *dev) { struct i2c_client *client =3D to_i2c_client(dev); - struct i2c_adapter *adap; struct i2c_driver *driver; =20 - adap =3D client->adapter; driver =3D to_i2c_driver(dev->driver); if (driver->remove) { int status; @@ -622,8 +610,6 @@ static void i2c_device_remove(struct dev devres_release_group(&client->dev, client->devres_group_id); =20 dev_pm_domain_detach(&client->dev, true); - if (!pm_runtime_status_suspended(&client->dev) && adap->bus_regulator) - regulator_disable(adap->bus_regulator); =20 dev_pm_clear_wake_irq(&client->dev); device_init_wakeup(&client->dev, false); @@ -633,86 +619,6 @@ static void i2c_device_remove(struct dev pm_runtime_put(&client->adapter->dev); } =20 -#ifdef CONFIG_PM_SLEEP -static int i2c_resume_early(struct device *dev) -{ - struct i2c_client *client =3D i2c_verify_client(dev); - int err; - - if (!client) - return 0; - - if (pm_runtime_status_suspended(&client->dev) && - client->adapter->bus_regulator) { - err =3D regulator_enable(client->adapter->bus_regulator); - if (err) - return err; - } - - return pm_generic_resume_early(&client->dev); -} - -static int i2c_suspend_late(struct device *dev) -{ - struct i2c_client *client =3D i2c_verify_client(dev); - int err; - - if (!client) - return 0; - - err =3D pm_generic_suspend_late(&client->dev); - if (err) - return err; - - if (!pm_runtime_status_suspended(&client->dev) && - client->adapter->bus_regulator) - return regulator_disable(client->adapter->bus_regulator); - - return 0; -} -#endif - -#ifdef CONFIG_PM -static int i2c_runtime_resume(struct device *dev) -{ - struct i2c_client *client =3D i2c_verify_client(dev); - int err; - - if (!client) - return 0; - - if (client->adapter->bus_regulator) { - err =3D regulator_enable(client->adapter->bus_regulator); - if (err) - return err; - } - - return pm_generic_runtime_resume(&client->dev); -} - -static int i2c_runtime_suspend(struct device *dev) -{ - struct i2c_client *client =3D i2c_verify_client(dev); - int err; - - if (!client) - return 0; - - err =3D pm_generic_runtime_suspend(&client->dev); - if (err) - return err; - - if (client->adapter->bus_regulator) - return regulator_disable(client->adapter->bus_regulator); - return 0; -} -#endif - -static const struct dev_pm_ops i2c_device_pm =3D { - SET_LATE_SYSTEM_SLEEP_PM_OPS(i2c_suspend_late, i2c_resume_early) - SET_RUNTIME_PM_OPS(i2c_runtime_suspend, i2c_runtime_resume, NULL) -}; - static void i2c_device_shutdown(struct device *dev) { struct i2c_client *client =3D i2c_verify_client(dev); @@ -772,7 +678,6 @@ struct bus_type i2c_bus_type =3D { .probe =3D i2c_device_probe, .remove =3D i2c_device_remove, .shutdown =3D i2c_device_shutdown, - .pm =3D &i2c_device_pm, }; EXPORT_SYMBOL_GPL(i2c_bus_type); =20 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 961E5C433F5 for ; Mon, 10 Jan 2022 07:47:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240190AbiAJHrl (ORCPT ); Mon, 10 Jan 2022 02:47:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51422 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242305AbiAJHkh (ORCPT ); Mon, 10 Jan 2022 02:40:37 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4B611C033274; Sun, 9 Jan 2022 23:34:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 083A3B81161; Mon, 10 Jan 2022 07:34:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 37372C36AE9; Mon, 10 Jan 2022 07:34:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800077; bh=/DDFgr2LIbKb0XYJ9YLVEgZM878o3QU3heZunPDRM+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=u/nuHRMaEDhvaNjDJES3TwLhz4FkyMngd9BI9GJQ6AEAU8L0s8hie4wysdolWjWk+ EPKQTdwfOzhSyIHsDuBEVxo6sD+980ZlaAexTOzFsHqb4RZqd49+dY9IJ1IOqgwIn6 hTTMP9t/K75ngDHZU1Nj0XpCfkQeJE3rEdTea69A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maxime Bizon , Chris Packham , Wolfram Sang Subject: [PATCH 5.15 39/72] i2c: mpc: Avoid out of bounds memory access Date: Mon, 10 Jan 2022 08:23:16 +0100 Message-Id: <20220110071822.876278145@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chris Packham commit 72a4a87da8f7bcf868b338615a814b6542f277f3 upstream. When performing an I2C transfer where the last message was a write KASAN would complain: BUG: KASAN: slab-out-of-bounds in mpc_i2c_do_action+0x154/0x630 Read of size 2 at addr c814e310 by task swapper/2/0 CPU: 2 PID: 0 Comm: swapper/2 Tainted: G B 5.16.0-rc8 #1 Call Trace: [e5ee9d50] [c08418e8] dump_stack_lvl+0x4c/0x6c (unreliable) [e5ee9d70] [c02f8a14] print_address_description.constprop.13+0x64/0x3b0 [e5ee9da0] [c02f9030] kasan_report+0x1f0/0x204 [e5ee9de0] [c0c76ee4] mpc_i2c_do_action+0x154/0x630 [e5ee9e30] [c0c782c4] mpc_i2c_isr+0x164/0x240 [e5ee9e60] [c00f3a04] __handle_irq_event_percpu+0xf4/0x3b0 [e5ee9ec0] [c00f3d40] handle_irq_event_percpu+0x80/0x110 [e5ee9f40] [c00f3e48] handle_irq_event+0x78/0xd0 [e5ee9f60] [c00fcfec] handle_fasteoi_irq+0x19c/0x370 [e5ee9fa0] [c00f1d84] generic_handle_irq+0x54/0x80 [e5ee9fc0] [c0006b54] __do_irq+0x64/0x200 [e5ee9ff0] [c0007958] __do_IRQ+0xe8/0x1c0 [c812dd50] [e3eaab20] 0xe3eaab20 [c812dd90] [c0007a4c] do_IRQ+0x1c/0x30 [c812dda0] [c0000c04] ExternalInput+0x144/0x160 --- interrupt: 500 at arch_cpu_idle+0x34/0x60 NIP: c000b684 LR: c000b684 CTR: c0019688 REGS: c812ddb0 TRAP: 0500 Tainted: G B (5.16.0-rc8) MSR: 00029002 CR: 22000488 XER: 20000000 GPR00: c10ef7fc c812de90 c80ff200 c2394718 00000001 00000001 c10e3f90 000= 00003 GPR08: 00000000 c0019688 c2394718 fc7d625b 22000484 00000000 21e17000 c20= 8228c GPR16: e3e99284 00000000 ffffffff c2390000 c001bac0 c2082288 c812df60 c00= 1ba60 GPR24: c23949c0 00000018 00080000 00000004 c80ff200 00000002 c2348ee4 c23= 94718 NIP [c000b684] arch_cpu_idle+0x34/0x60 LR [c000b684] arch_cpu_idle+0x34/0x60 --- interrupt: 500 [c812de90] [c10e3f90] rcu_eqs_enter.isra.60+0xc0/0x110 (unreliable) [c812deb0] [c10ef7fc] default_idle_call+0xbc/0x230 [c812dee0] [c00af0e8] do_idle+0x1c8/0x200 [c812df10] [c00af3c0] cpu_startup_entry+0x20/0x30 [c812df20] [c001e010] start_secondary+0x5d0/0xba0 [c812dff0] [c00028a0] __secondary_start+0x90/0xdc This happened because we would overrun the i2c->msgs array on the final interrupt for the I2C STOP. This didn't happen if the last message was a read because there is no interrupt in that case. Ensure that we only access the current message if we are not processing a I2C STOP condition. Fixes: 1538d82f4647 ("i2c: mpc: Interrupt driven transfer") Reported-by: Maxime Bizon Signed-off-by: Chris Packham Signed-off-by: Wolfram Sang Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/i2c/busses/i2c-mpc.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) --- a/drivers/i2c/busses/i2c-mpc.c +++ b/drivers/i2c/busses/i2c-mpc.c @@ -492,7 +492,7 @@ static void mpc_i2c_finish(struct mpc_i2 =20 static void mpc_i2c_do_action(struct mpc_i2c *i2c) { - struct i2c_msg *msg =3D &i2c->msgs[i2c->curr_msg]; + struct i2c_msg *msg =3D NULL; int dir =3D 0; int recv_len =3D 0; u8 byte; @@ -501,10 +501,13 @@ static void mpc_i2c_do_action(struct mpc =20 i2c->cntl_bits &=3D ~(CCR_RSTA | CCR_MTX | CCR_TXAK); =20 - if (msg->flags & I2C_M_RD) - dir =3D 1; - if (msg->flags & I2C_M_RECV_LEN) - recv_len =3D 1; + if (i2c->action !=3D MPC_I2C_ACTION_STOP) { + msg =3D &i2c->msgs[i2c->curr_msg]; + if (msg->flags & I2C_M_RD) + dir =3D 1; + if (msg->flags & I2C_M_RECV_LEN) + recv_len =3D 1; + } =20 switch (i2c->action) { case MPC_I2C_ACTION_RESTART: @@ -581,7 +584,7 @@ static void mpc_i2c_do_action(struct mpc break; } =20 - if (msg->len =3D=3D i2c->byte_posn) { + if (msg && msg->len =3D=3D i2c->byte_posn) { i2c->curr_msg++; i2c->byte_posn =3D 0; =20 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4F2D7C433EF for ; Mon, 10 Jan 2022 07:48:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240416AbiAJHr5 (ORCPT ); Mon, 10 Jan 2022 02:47:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51512 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242370AbiAJHkl (ORCPT ); Mon, 10 Jan 2022 02:40:41 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 94E6BC033275; Sun, 9 Jan 2022 23:34:41 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 35DE861192; Mon, 10 Jan 2022 07:34:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1AC4CC36AEF; Mon, 10 Jan 2022 07:34:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800080; bh=Zml5vsmKBW934+KJOkwoCv9DpISaKkxpPTFMp2BHLQk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gPC7VmEpGfZbnxNRbZ1sYzcOIw37E/epxXO/PSNE0neDmFqQLHGbfmhsYdI21kRV7 bO6ihlb2X1x8nsV3+m0usbizoRX2LvjuL7+lZ7Q5rlXu2Q++xcndpwH+Y0r4PhlH7M MrGj7kFEMMMenUz1fAhhT609xv0xfsFjsp9gyJMY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kirill Tkhai , "Darrick J. Wong" , "Darrick J. Wong" , Dave Chinner , Eric Sandeen Subject: [PATCH 5.15 40/72] xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate Date: Mon, 10 Jan 2022 08:23:17 +0100 Message-Id: <20220110071822.914334103@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Darrick J. Wong commit 983d8e60f50806f90534cc5373d0ce867e5aaf79 upstream. The old ALLOCSP/FREESP ioctls in XFS can be used to preallocate space at the end of files, just like fallocate and RESVSP. Make the behavior consistent with the other ioctls. Reported-by: Kirill Tkhai Signed-off-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Reviewed-by: Dave Chinner Reviewed-by: Eric Sandeen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- fs/xfs/xfs_ioctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/fs/xfs/xfs_ioctl.c +++ b/fs/xfs/xfs_ioctl.c @@ -687,7 +687,8 @@ xfs_ioc_space( =20 if (bf->l_start > XFS_ISIZE(ip)) { error =3D xfs_alloc_file_space(ip, XFS_ISIZE(ip), - bf->l_start - XFS_ISIZE(ip), 0); + bf->l_start - XFS_ISIZE(ip), + XFS_BMAPI_PREALLOC); if (error) goto out_unlock; } From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE6BAC433F5 for ; Mon, 10 Jan 2022 07:41:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238105AbiAJHlc (ORCPT ); Mon, 10 Jan 2022 02:41:32 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41338 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241095AbiAJHep (ORCPT ); Mon, 10 Jan 2022 02:34:45 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1346A61192; Mon, 10 Jan 2022 07:34:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7ACBC36AED; Mon, 10 Jan 2022 07:34:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800083; bh=zENv4HK7dy6g+eUa3yM2KKt4TG/axtrDyosh4Wfu/bc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=haLgdJpsuYepRWj90RrH32WATPi1ls8+akQoKZpL0yR8csysu4EQ5pus/uyBkJ0z6 h9wF+My/jBRDdaBDnx6RDQo4tQyMcLEkcKOamSGMAnhT3OrahhWZl7ayb39noGgq6i bwqJwqWGA91DkBWOyJJcOIeKbNzjqVfULODaSazo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chunyan Zhang , Baolin Wang , Linus Walleij , Sebastian Reichel Subject: [PATCH 5.15 41/72] power: supply: core: Break capacity loop Date: Mon, 10 Jan 2022 08:23:18 +0100 Message-Id: <20220110071822.952583458@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Walleij commit 51c7b6a0398f54b9120795796a4cff4fc9634f7d upstream. We should not go on looking for more capacity tables after we realize we have looked at the last one in power_supply_find_ocv2cap_table(). Fixes: 3afb50d7125b ("power: supply: core: Add some helpers to use the batt= ery OCV capacity table") Cc: Chunyan Zhang Cc: Baolin Wang Signed-off-by: Linus Walleij Reviewed-by: Baolin Wang Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/power/supply/power_supply_core.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/power/supply/power_supply_core.c +++ b/drivers/power/supply/power_supply_core.c @@ -853,6 +853,10 @@ power_supply_find_ocv2cap_table(struct p return NULL; =20 for (i =3D 0; i < POWER_SUPPLY_OCV_TEMP_MAX; i++) { + /* Out of capacity tables */ + if (!info->ocv_table[i]) + break; + temp_diff =3D abs(info->ocv_temp[i] - temp); =20 if (temp_diff < best_temp_diff) { From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61779C433F5 for ; Mon, 10 Jan 2022 07:52:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241340AbiAJHwA (ORCPT ); Mon, 10 Jan 2022 02:52:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51634 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241344AbiAJHlp (ORCPT ); Mon, 10 Jan 2022 02:41:45 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CFEC3C033278; Sun, 9 Jan 2022 23:34:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8D55EB81201; Mon, 10 Jan 2022 07:34:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BFD9EC36AED; Mon, 10 Jan 2022 07:34:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800086; bh=8wjOwa4D01rmIjZQtarB7Bx2PnNYdpk5SUwRRUGxoMU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QLuVgkGfI1mmczosuCrsnMBIomJ0vYhNhoMyObFEOHWaclMg532kkJW2aiVh6mkFF WEA4aqzimIpEKqWBDHnIsBpNaROEHy8t2QSX6Y5GJt3DFXq6p8XgJu0dnZZhbnfTXf dC4B7p9ABli9QCU6jPDlVOqYV3b+Z4pIBYSqCE2M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor , Nick Desaulniers , Sebastian Reichel Subject: [PATCH 5.15 42/72] power: reset: ltc2952: Fix use of floating point literals Date: Mon, 10 Jan 2022 08:23:19 +0100 Message-Id: <20220110071822.983678521@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nathan Chancellor commit 644106cdb89844be2496b21175b7c0c2e0fab381 upstream. A new commit in LLVM causes an error on the use of 'long double' when '-mno-x87' is used, which the kernel does through an alias, '-mno-80387' (see the LLVM commit below for more details around why it does this). drivers/power/reset/ltc2952-poweroff.c:162:28: error: expression requires = 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not = support it data->wde_interval =3D 300L * 1E6L; ^ drivers/power/reset/ltc2952-poweroff.c:162:21: error: expression requires = 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not = support it data->wde_interval =3D 300L * 1E6L; ^ drivers/power/reset/ltc2952-poweroff.c:163:41: error: expression requires = 'long double' type support, but target 'x86_64-unknown-linux-gnu' does not = support it data->trigger_delay =3D ktime_set(2, 500L*1E6L); ^ 3 errors generated. This happens due to the use of a 'long double' literal. The 'E6' part of '1E6L' causes the literal to be a 'double' then the 'L' suffix promotes it to 'long double'. There is no visible reason for floating point values in this driver, as the values are only assigned to integer types. Use NSEC_PER_MSEC, which is the same integer value as '1E6L', to avoid changing functionality but fix the error. Fixes: 6647156c00cc ("power: reset: add LTC2952 poweroff driver") Link: https://github.com/ClangBuiltLinux/linux/issues/1497 Link: https://github.com/llvm/llvm-project/commit/a8083d42b1c346e21623a1d36= d1f0cadd7801d83 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/power/reset/ltc2952-poweroff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/power/reset/ltc2952-poweroff.c +++ b/drivers/power/reset/ltc2952-poweroff.c @@ -161,8 +161,8 @@ static void ltc2952_poweroff_kill(void) =20 static void ltc2952_poweroff_default(struct ltc2952_poweroff *data) { - data->wde_interval =3D 300L * 1E6L; - data->trigger_delay =3D ktime_set(2, 500L*1E6L); + data->wde_interval =3D 300L * NSEC_PER_MSEC; + data->trigger_delay =3D ktime_set(2, 500L * NSEC_PER_MSEC); =20 hrtimer_init(&data->timer_trigger, CLOCK_MONOTONIC, HRTIMER_MODE_REL); data->timer_trigger.function =3D ltc2952_poweroff_timer_trigger; From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54541C4167D for ; Mon, 10 Jan 2022 07:41:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242217AbiAJHkd (ORCPT ); Mon, 10 Jan 2022 02:40:33 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:33814 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239720AbiAJHdR (ORCPT ); Mon, 10 Jan 2022 02:33:17 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 247E3B81211; Mon, 10 Jan 2022 07:33:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6D028C36AEF; Mon, 10 Jan 2022 07:33:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799995; bh=ZTHZRmQnobjicwLrjjyL8/R91C9QzgP8gTl+50ubP0o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IUKdf59LhuyTMPx/xhRXPbuh9rOViQ2OgGC1gJNI7c8arNhvz5HcHP05Ff8YdSzQt cquEwvo18myWYpnq1ijrbiVRp8GhJkym0piDaYu1DW7N+w0E1hqlLdUfLm62kBzJJd XmMEFMVEirCyAsXJ/ajtKBPJm0TKjSvSH5fK4R8c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Heiner Kallweit , Biju Das , Philipp Zabel Subject: [PATCH 5.15 43/72] reset: renesas: Fix Runtime PM usage Date: Mon, 10 Jan 2022 08:23:20 +0100 Message-Id: <20220110071823.015359869@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Heiner Kallweit commit 92c959bae2e54ba1e2540ba5f813f7752bd76be1 upstream. If pm_runtime_resume_and_get() fails then it returns w/o the RPM usage counter being incremented. In this case call pm_runtime_put() in remove() will result in a usage counter imbalance. Therefore check the return code of pm_runtime_resume_and_get() and bail out in case of error. Fixes: bee08559701f ("reset: renesas: Add RZ/G2L usbphy control driver") Signed-off-by: Heiner Kallweit Reviewed-by: Biju Das Link: https://lore.kernel.org/r/ec24e13f-0530-b091-7a08-864577b9b3be@gmail.= com Signed-off-by: Philipp Zabel Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/reset/reset-rzg2l-usbphy-ctrl.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/reset/reset-rzg2l-usbphy-ctrl.c +++ b/drivers/reset/reset-rzg2l-usbphy-ctrl.c @@ -137,7 +137,12 @@ static int rzg2l_usbphy_ctrl_probe(struc dev_set_drvdata(dev, priv); =20 pm_runtime_enable(&pdev->dev); - pm_runtime_resume_and_get(&pdev->dev); + error =3D pm_runtime_resume_and_get(&pdev->dev); + if (error < 0) { + pm_runtime_disable(&pdev->dev); + reset_control_assert(priv->rstc); + return dev_err_probe(&pdev->dev, error, "pm_runtime_resume_and_get faile= d"); + } =20 /* put pll and phy into reset state */ spin_lock_irqsave(&priv->lock, flags); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E725DC4321E for ; Mon, 10 Jan 2022 07:41:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242315AbiAJHki (ORCPT ); Mon, 10 Jan 2022 02:40:38 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:33842 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239765AbiAJHdU (ORCPT ); Mon, 10 Jan 2022 02:33:20 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F3134B811E3; Mon, 10 Jan 2022 07:33:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4796BC36AE9; Mon, 10 Jan 2022 07:33:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641799997; bh=1PC9Oavmy3rDsCgNb2kVCXK643NTyi/TUNXya1Ck5Og=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rDfubeFC/zHJUcWD+HUN57AOhKUOBHXuEA06hr9fOuMqyTiwO+qcwGT5GvqDkwjsE xwSZPHnk1GSPkdWmqfNUw/qPZ2bYjyLrlslNGgZ4s+ER87Ey2p/ZodCjshp4U1Xbdg Ia9wt9UfDbmlJtw0176TSxPX8rXQc3tpO8X60ZII= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thomas Toye , "David S. Miller" Subject: [PATCH 5.15 44/72] rndis_host: support Hytera digital radios Date: Mon, 10 Jan 2022 08:23:21 +0100 Message-Id: <20220110071823.047094456@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thomas Toye commit 29262e1f773b4b6a43711120be564c57fca07cfb upstream. Hytera makes a range of digital (DMR) radios. These radios can be programmed to a allow a computer to control them over Ethernet over USB, either using NCM or RNDIS. This commit adds support for RNDIS for Hytera radios. I tested with a Hytera PD785 and a Hytera MD785G. When these radios are programmed to set up a Radio to PC Network using RNDIS, an USB interface will be added with class 2 (Communications), subclass 2 (Abstract Modem Control) and an interface protocol of 255 ("vendor specific" - lsusb even hints "MSFT RNDIS?"). This patch is similar to the solution of this StackOverflow user, but that only works for the Hytera MD785: https://stackoverflow.com/a/53550858 To use the "Radio to PC Network" functionality of Hytera DMR radios, the radios need to be programmed correctly in CPS (Hytera's Customer Programming Software). "Forward to PC" should be checked in "Network" (under "General Setting" in "Conventional") and the "USB Network Communication Protocol" should be set to RNDIS. Signed-off-by: Thomas Toye Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/usb/rndis_host.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/net/usb/rndis_host.c +++ b/drivers/net/usb/rndis_host.c @@ -609,6 +609,11 @@ static const struct usb_device_id produc USB_CLASS_COMM, 2 /* ACM */, 0x0ff), .driver_info =3D (unsigned long) &rndis_poll_status_info, }, { + /* Hytera Communications DMR radios' "Radio to PC Network" */ + USB_VENDOR_AND_INTERFACE_INFO(0x238b, + USB_CLASS_COMM, 2 /* ACM */, 0x0ff), + .driver_info =3D (unsigned long)&rndis_info, +}, { /* RNDIS is MSFT's un-official variant of CDC ACM */ USB_INTERFACE_INFO(USB_CLASS_COMM, 2 /* ACM */, 0x0ff), .driver_info =3D (unsigned long) &rndis_info, From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF73AC2BA80 for ; Mon, 10 Jan 2022 07:46:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243639AbiAJHpt (ORCPT ); Mon, 10 Jan 2022 02:45:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50746 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239977AbiAJHio (ORCPT ); Mon, 10 Jan 2022 02:38:44 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9B350C0258D2; Sun, 9 Jan 2022 23:33:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3D05B60BA2; Mon, 10 Jan 2022 07:33:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23443C36AE9; Mon, 10 Jan 2022 07:33:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800000; bh=+jzjg/PzAo7Yfk7QGyIdftfXX9dnjhS3pvZKkENn7Xc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ssewCUj1vLt8xr58l7KE3sGie/50pIZFCSwvbYf8sZuHETvRb6EDRj7qjeAQ0Fa3d systYTqfGF5Npu0dv9n5R3XHi1QeZ4RpQafdYMkjJD9iTs7d2E0EdOe+kx0eH/S+Io 4KyZ46EFb1lifXG9J1aPaFK4RDRP4fDU+IRgz4EU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Steven Lee , Bartosz Golaszewski Subject: [PATCH 5.15 45/72] gpio: gpio-aspeed-sgpio: Fix wrong hwirq base in irq handler Date: Mon, 10 Jan 2022 08:23:22 +0100 Message-Id: <20220110071823.079201751@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Steven Lee commit e5a7431f5a2d6dcff7d516ee9d178a3254b17b87 upstream. Each aspeed sgpio bank has 64 gpio pins(32 input pins and 32 output pins). The hwirq base for each sgpio bank should be multiples of 64 rather than multiples of 32. Signed-off-by: Steven Lee Signed-off-by: Bartosz Golaszewski Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpio/gpio-aspeed-sgpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpio/gpio-aspeed-sgpio.c +++ b/drivers/gpio/gpio-aspeed-sgpio.c @@ -395,7 +395,7 @@ static void aspeed_sgpio_irq_handler(str reg =3D ioread32(bank_reg(data, bank, reg_irq_status)); =20 for_each_set_bit(p, ®, 32) - generic_handle_domain_irq(gc->irq.domain, i * 32 + p * 2); + generic_handle_domain_irq(gc->irq.domain, (i * 32 + p) * 2); } =20 chained_irq_exit(ic, desc); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 145B9C4167B for ; Mon, 10 Jan 2022 07:41:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242332AbiAJHki (ORCPT ); Mon, 10 Jan 2022 02:40:38 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:59994 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239591AbiAJHdZ (ORCPT ); Mon, 10 Jan 2022 02:33:25 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A701EB811F9; Mon, 10 Jan 2022 07:33:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EF2EAC36AED; Mon, 10 Jan 2022 07:33:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800003; bh=+IgOhsZw0AUTYG+Ut03DuxUF55vMspBPcisC+jUTaIk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CRGS0kjh2xaEuaaC4sYARBFtC4KyYi8zT7VeYL3flSgIqDEiwhZqmJFaQ1SifbpYh s55ygUo1TF2PMK/asr6HvKbgZFhWoRqoMn7z6sOXsKBKXoJ7m+KIZKYXZCVrs313d4 aD8z/6w+Ie26wld+nMLL36hxCXybi5zDS7eO1RaE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+cdbd40e0c3ca02cae3b7@syzkaller.appspotmail.com, Haimin Zhang , Jon Maloy , Jakub Kicinski Subject: [PATCH 5.15 46/72] net ticp:fix a kernel-infoleak in __tipc_sendmsg() Date: Mon, 10 Jan 2022 08:23:23 +0100 Message-Id: <20220110071823.111741880@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Haimin Zhang commit d6d86830705f173fca6087a3e67ceaf68db80523 upstream. struct tipc_socket_addr.ref has a 4-byte hole,and __tipc_getname() currently copying it to user space,causing kernel-infoleak. BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instru= mented.h:121 [inline] BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instru= mented.h:121 [inline] lib/usercopy.c:33 BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 = lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/user= copy.c:33 _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:209 [inline] copy_to_user include/linux/uaccess.h:209 [inline] net/socket.c:287 move_addr_to_user+0x3f6/0x600 net/socket.c:287 net/socket.c:287 __sys_getpeername+0x470/0x6b0 net/socket.c:1987 net/socket.c:1987 __do_sys_getpeername net/socket.c:1997 [inline] __se_sys_getpeername net/socket.c:1994 [inline] __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994 __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994 __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c= :82 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c= :82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was stored to memory at: tipc_getname+0x575/0x5e0 net/tipc/socket.c:757 net/tipc/socket.c:757 __sys_getpeername+0x3b3/0x6b0 net/socket.c:1984 net/socket.c:1984 __do_sys_getpeername net/socket.c:1997 [inline] __se_sys_getpeername net/socket.c:1994 [inline] __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994 __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994 __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c= :82 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c= :82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was stored to memory at: msg_set_word net/tipc/msg.h:212 [inline] msg_set_destport net/tipc/msg.h:619 [inline] msg_set_word net/tipc/msg.h:212 [inline] net/tipc/socket.c:1486 msg_set_destport net/tipc/msg.h:619 [inline] net/tipc/socket.c:1486 __tipc_sendmsg+0x44fa/0x5890 net/tipc/socket.c:1486 net/tipc/socket.c:1486 tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] sock_sendmsg_nosec net/socket.c:704 [inline] net/socket.c:2409 sock_sendmsg net/socket.c:724 [inline] net/socket.c:2409 ____sys_sendmsg+0xe11/0x12c0 net/socket.c:2409 net/socket.c:2409 ___sys_sendmsg net/socket.c:2463 [inline] ___sys_sendmsg net/socket.c:2463 [inline] net/socket.c:2492 __sys_sendmsg+0x704/0x840 net/socket.c:2492 net/socket.c:2492 __do_sys_sendmsg net/socket.c:2501 [inline] __se_sys_sendmsg net/socket.c:2499 [inline] __do_sys_sendmsg net/socket.c:2501 [inline] net/socket.c:2499 __se_sys_sendmsg net/socket.c:2499 [inline] net/socket.c:2499 __x64_sys_sendmsg+0xe2/0x120 net/socket.c:2499 net/socket.c:2499 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c= :82 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c= :82 entry_SYSCALL_64_after_hwframe+0x44/0xae Local variable skaddr created at: __tipc_sendmsg+0x2d0/0x5890 net/tipc/socket.c:1419 net/tipc/socket.c:1419 tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402 Bytes 4-7 of 16 are uninitialized Memory access of size 16 starts at ffff888113753e00 Data copied to user address 0000000020000280 Reported-by: syzbot+cdbd40e0c3ca02cae3b7@syzkaller.appspotmail.com Signed-off-by: Haimin Zhang Acked-by: Jon Maloy Link: https://lore.kernel.org/r/1640918123-14547-1-git-send-email-tcs.kerne= l@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/tipc/socket.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -1461,6 +1461,8 @@ static int __tipc_sendmsg(struct socket msg_set_syn(hdr, 1); } =20 + memset(&skaddr, 0, sizeof(skaddr)); + /* Determine destination */ if (atype =3D=3D TIPC_SERVICE_RANGE) { return tipc_sendmcast(sock, ua, m, dlen, timeout); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3988DC4167D for ; Mon, 10 Jan 2022 07:46:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243927AbiAJHqC (ORCPT ); Mon, 10 Jan 2022 02:46:02 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50752 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240378AbiAJHio (ORCPT ); Mon, 10 Jan 2022 02:38:44 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4CD62C0258DB; Sun, 9 Jan 2022 23:33:27 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E290361193; Mon, 10 Jan 2022 07:33:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C86C8C36AED; Mon, 10 Jan 2022 07:33:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800006; bh=3Ickka+6v+gJYj2pcGsavEYdwSot3ss+0+8d/9R7JoQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Uab5ORkOwmpM+QGPgTomoZ8OzNWelrJjYH9k4ehIeGtGZdqwvo5pQjGfldJBJgQfN tFVjeQGq0789z4qXdZ+W6ZvAxtcAlBpk+6VvWRlaV5hphsdSv1AYVlhhFofRTSKdhZ tfzzz2qqCx2Weew8LBAFlLZKHYj+ZlIHW3Z0fYGE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangyu Hua , Jakub Kicinski , Aayush Agarwal Subject: [PATCH 5.15 47/72] phonet: refcount leak in pep_sock_accep Date: Mon, 10 Jan 2022 08:23:24 +0100 Message-Id: <20220110071823.142663066@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua commit bcd0f93353326954817a4f9fa55ec57fb38acbb0 upstream. sock_hold(sk) is invoked in pep_sock_accept(), but __sock_put(sk) is not invoked in subsequent failure branches(pep_accept_conn() !=3D 0). Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20211209082839.33985-1-hbh25y@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Aayush Agarwal Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/phonet/pep.c | 1 + 1 file changed, 1 insertion(+) --- a/net/phonet/pep.c +++ b/net/phonet/pep.c @@ -868,6 +868,7 @@ static struct sock *pep_sock_accept(stru =20 err =3D pep_accept_conn(newsk, skb); if (err) { + __sock_put(sk); sock_put(newsk); newsk =3D NULL; goto drop; From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B263C43217 for ; Mon, 10 Jan 2022 07:42:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241024AbiAJHmc (ORCPT ); Mon, 10 Jan 2022 02:42:32 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:33970 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240186AbiAJHdd (ORCPT ); Mon, 10 Jan 2022 02:33:33 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6B172B8120C; Mon, 10 Jan 2022 07:33:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AD818C36AED; Mon, 10 Jan 2022 07:33:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800009; bh=nV4sVNXe+91kbTnlCc0Bt4RlIYFySXGdtdmIaZEf19Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tn3pmHAqkXKOEtfVHjoKHNz8Ck8J5Cfulpf56ohXbFDLctU2TjJ6yCOkJu0WTSo/Z BsJZo8UKhifKGvE2U6kLV6HjJl4U0SgdacVc91tqlVp6Wp4YbwbAiWQHRbuygNTYsY x6Ustfp6RWiE1/QCGWVVF2qw7KcjFoJWt90upUBQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alex Deucher Subject: [PATCH 5.15 48/72] fbdev: fbmem: add a helper to determine if an aperture is used by a fw fb Date: Mon, 10 Jan 2022 08:23:25 +0100 Message-Id: <20220110071823.172955307@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alex Deucher commit 9a45ac2320d0a6ae01880a30d4b86025fce4061b upstream. Add a function for drivers to check if the a firmware initialized fb is corresponds to their aperture. This allows drivers to check if the device corresponds to what the firmware set up as the display device. Bug: https://bugzilla.kernel.org/show_bug.cgi?id=3D215203 Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1840 Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/video/fbdev/core/fbmem.c | 47 ++++++++++++++++++++++++++++++++++= +++++ include/linux/fb.h | 1=20 2 files changed, 48 insertions(+) --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -1760,6 +1760,53 @@ int remove_conflicting_framebuffers(stru EXPORT_SYMBOL(remove_conflicting_framebuffers); =20 /** + * is_firmware_framebuffer - detect if firmware-configured framebuffer mat= ches + * @a: memory range, users of which are to be checked + * + * This function checks framebuffer devices (initialized by firmware/bootl= oader) + * which use memory range described by @a. If @a matchesm the function ret= urns + * true, otherwise false. + */ +bool is_firmware_framebuffer(struct apertures_struct *a) +{ + bool do_free =3D false; + bool found =3D false; + int i; + + if (!a) { + a =3D alloc_apertures(1); + if (!a) + return false; + + a->ranges[0].base =3D 0; + a->ranges[0].size =3D ~0; + do_free =3D true; + } + + mutex_lock(®istration_lock); + /* check all firmware fbs and kick off if the base addr overlaps */ + for_each_registered_fb(i) { + struct apertures_struct *gen_aper; + + if (!(registered_fb[i]->flags & FBINFO_MISC_FIRMWARE)) + continue; + + gen_aper =3D registered_fb[i]->apertures; + if (fb_do_apertures_overlap(gen_aper, a)) { + found =3D true; + break; + } + } + mutex_unlock(®istration_lock); + + if (do_free) + kfree(a); + + return found; +} +EXPORT_SYMBOL(is_firmware_framebuffer); + +/** * remove_conflicting_pci_framebuffers - remove firmware-configured frameb= uffers for PCI devices * @pdev: PCI device * @name: requesting driver name --- a/include/linux/fb.h +++ b/include/linux/fb.h @@ -610,6 +610,7 @@ extern int remove_conflicting_pci_frameb const char *name); extern int remove_conflicting_framebuffers(struct apertures_struct *a, const char *name, bool primary); +extern bool is_firmware_framebuffer(struct apertures_struct *a); extern int fb_prepare_logo(struct fb_info *fb_info, int rotate); extern int fb_show_logo(struct fb_info *fb_info, int rotate); extern char* fb_get_buffer_offset(struct fb_info *info, struct fb_pixmap *= buf, u32 size); From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4CA39C4167E for ; Mon, 10 Jan 2022 07:41:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242431AbiAJHko (ORCPT ); Mon, 10 Jan 2022 02:40:44 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:41982 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239857AbiAJHdd (ORCPT ); Mon, 10 Jan 2022 02:33:33 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A76E861193; Mon, 10 Jan 2022 07:33:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87390C36AE9; Mon, 10 Jan 2022 07:33:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800012; bh=o6nv9/Tyj/hIo8Msvl8jf2YXPBM04YwucowcgRwdQXo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1WJazGq4GCmg+1uceW+asQWZQF+l2AdjARu4HaZ03477vkdV+2y4FZjY7Tqk9FI9S GWPoFaYsUuo899CY8eF5Bz9YAkSGSo2krcvdu4Xm1L905E3M/Fhhg2hAcfU+kfrRPc As/z1m3coTfQixyxXxgUItPl6a1a0+xJLmIFf0lg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alex Deucher Subject: [PATCH 5.15 49/72] drm/amdgpu: disable runpm if we are the primary adapter Date: Mon, 10 Jan 2022 08:23:26 +0100 Message-Id: <20220110071823.203140239@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alex Deucher commit b95dc06af3e683d6b7ddbbae178b2b2a21ee8b2b upstream. If we are the primary adapter (i.e., the one used by the firwmare framebuffer), disable runtime pm. This fixes a regression caused by commit 55285e21f045 which results in the displays waking up shortly after they go to sleep due to the device coming out of runtime suspend and sending a hotplug uevent. v2: squash in reworked fix from Evan Fixes: 55285e21f045 ("fbdev/efifb: Release PCI device's runtime PM ref duri= ng FB destroy") Bug: https://bugzilla.kernel.org/show_bug.cgi?id=3D215203 Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1840 Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 28 ++++++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 6 ++++++ 3 files changed, 35 insertions(+) --- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h @@ -1069,6 +1069,7 @@ struct amdgpu_device { bool runpm; bool in_runpm; bool has_pr3; + bool is_fw_fb; =20 bool pm_sysfs_en; bool ucode_sysfs_en; --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c @@ -38,6 +38,7 @@ #include #include #include +#include =20 #include "amdgpu.h" #include "amdgpu_irq.h" @@ -1246,6 +1247,26 @@ MODULE_DEVICE_TABLE(pci, pciidlist); =20 static const struct drm_driver amdgpu_kms_driver; =20 +static bool amdgpu_is_fw_framebuffer(resource_size_t base, + resource_size_t size) +{ + bool found =3D false; +#if IS_REACHABLE(CONFIG_FB) + struct apertures_struct *a; + + a =3D alloc_apertures(1); + if (!a) + return false; + + a->ranges[0].base =3D base; + a->ranges[0].size =3D size; + + found =3D is_firmware_framebuffer(a); + kfree(a); +#endif + return found; +} + static int amdgpu_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) { @@ -1254,6 +1275,8 @@ static int amdgpu_pci_probe(struct pci_d unsigned long flags =3D ent->driver_data; int ret, retry =3D 0; bool supports_atomic =3D false; + bool is_fw_fb; + resource_size_t base, size; =20 if (amdgpu_virtual_display || amdgpu_device_asic_has_dc_support(flags & AMD_ASIC_MASK)) @@ -1310,6 +1333,10 @@ static int amdgpu_pci_probe(struct pci_d } #endif =20 + base =3D pci_resource_start(pdev, 0); + size =3D pci_resource_len(pdev, 0); + is_fw_fb =3D amdgpu_is_fw_framebuffer(base, size); + /* Get rid of things like offb */ ret =3D drm_aperture_remove_conflicting_pci_framebuffers(pdev, &amdgpu_km= s_driver); if (ret) @@ -1322,6 +1349,7 @@ static int amdgpu_pci_probe(struct pci_d adev->dev =3D &pdev->dev; adev->pdev =3D pdev; ddev =3D adev_to_drm(adev); + adev->is_fw_fb =3D is_fw_fb; =20 if (!supports_atomic) ddev->driver_features &=3D ~DRIVER_ATOMIC; --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c @@ -206,6 +206,12 @@ int amdgpu_driver_load_kms(struct amdgpu adev->runpm =3D true; break; } + /* XXX: disable runtime pm if we are the primary adapter + * to avoid displays being re-enabled after DPMS. + * This needs to be sorted out and fixed properly. + */ + if (adev->is_fw_fb) + adev->runpm =3D false; if (adev->runpm) dev_info(adev->dev, "Using BACO for runtime pm\n"); } From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23BCEC433F5 for ; Mon, 10 Jan 2022 07:42:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242704AbiAJHmr (ORCPT ); Mon, 10 Jan 2022 02:42:47 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:34018 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240513AbiAJHdk (ORCPT ); Mon, 10 Jan 2022 02:33:40 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3578FB81215; Mon, 10 Jan 2022 07:33:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A622C36AE9; Mon, 10 Jan 2022 07:33:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800014; bh=o+k6N9U2JrIm38Mm1wYeA64g57JqPN9hKHTLzztN/EA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KGRrSGQLJE2XZOAlL8Sy1yWpbM59Ofq8EsE/kWLe8o28VlsCrZFUAiUZWjnxBakYh vPLZAv6rjfSBsZaJrL9liT8kN1HywGzG+H+yeG+5OwDstsgJ6fvr0MKsNPjE+bfpRA NRlIdYl4NaR8oT4SU5d5h5IvMmIzakX/lqOJ6g3w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yauhen Kharuzhy , Hans de Goede , Sebastian Reichel Subject: [PATCH 5.15 50/72] power: bq25890: Enable continuous conversion for ADC at charging Date: Mon, 10 Jan 2022 08:23:27 +0100 Message-Id: <20220110071823.241410554@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yauhen Kharuzhy commit 80211be1b9dec04cc2805d3d81e2091ecac289a1 upstream. Instead of one shot run of ADC at beginning of charging, run continuous conversion to ensure that all charging-related values are monitored properly (input voltage, input current, themperature etc.). Signed-off-by: Yauhen Kharuzhy Reviewed-by: Hans de Goede Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/power/supply/bq25890_charger.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/power/supply/bq25890_charger.c +++ b/drivers/power/supply/bq25890_charger.c @@ -581,12 +581,12 @@ static irqreturn_t __bq25890_handle_irq( =20 if (!new_state.online && bq->state.online) { /* power removed */ /* disable ADC */ - ret =3D bq25890_field_write(bq, F_CONV_START, 0); + ret =3D bq25890_field_write(bq, F_CONV_RATE, 0); if (ret < 0) goto error; } else if (new_state.online && !bq->state.online) { /* power inserted */ /* enable ADC, to have control of charge current/voltage */ - ret =3D bq25890_field_write(bq, F_CONV_START, 1); + ret =3D bq25890_field_write(bq, F_CONV_RATE, 1); if (ret < 0) goto error; } From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B0459C46467 for ; Mon, 10 Jan 2022 07:46:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243600AbiAJHpq (ORCPT ); Mon, 10 Jan 2022 02:45:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51422 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241348AbiAJHio (ORCPT ); Mon, 10 Jan 2022 02:38:44 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0768C0251BB; Sun, 9 Jan 2022 23:33:38 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4B6C761195; Mon, 10 Jan 2022 07:33:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2BE3BC36AE9; Mon, 10 Jan 2022 07:33:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800017; bh=pIy1WMLRL1/hblQa3DF157uiTR8ua4oiky7YY8yMuC0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zQQiIc+iuNJGNHkrohUfPRhQ98jqCzVEVbmtw6IG39Z+/1wtvH252DLB+mCBEvFy9 suzfNT/ykQ494henNkiUSOG0/vIVGd5BprjwAMSTV5SB/HPqhWV4mIBZsijKikUsGX nUl6NR+/RnKLQQmb8su2SnzE4Zf+Nr0uB8gTvo5c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Nicolas Dichtel , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.15 51/72] ipv6: Continue processing multipath route even if gateway attribute is invalid Date: Mon, 10 Jan 2022 08:23:28 +0100 Message-Id: <20220110071823.273440090@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern [ Upstream commit e30a845b0376eb51c9c94f56bbd53b2e08ba822f ] ip6_route_multipath_del loop continues processing the multipath attribute even if delete of a nexthop path fails. For consistency, do the same if the gateway attribute is invalid. Fixes: 1ff15a710a86 ("ipv6: Check attribute length for RTA_GATEWAY when del= eting multipath route") Signed-off-by: David Ahern Acked-by: Nicolas Dichtel Link: https://lore.kernel.org/r/20220103171911.94739-1-dsahern@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv6/route.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index d050e0f5baa46..0eceb0e88976b 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5459,8 +5459,10 @@ static int ip6_route_multipath_del(struct fib6_confi= g *cfg, if (nla) { err =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, extack); - if (err) - return err; + if (err) { + last_err =3D err; + goto next_rtnh; + } =20 r_cfg.fc_flags |=3D RTF_GATEWAY; } @@ -5469,6 +5471,7 @@ static int ip6_route_multipath_del(struct fib6_config= *cfg, if (err) last_err =3D err; =20 +next_rtnh: rtnh =3D rtnh_next(rtnh, &remaining); } =20 --=20 2.34.1 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DEC19C4707A for ; Mon, 10 Jan 2022 07:46:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243737AbiAJHpx (ORCPT ); Mon, 10 Jan 2022 02:45:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50782 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241087AbiAJHjI (ORCPT ); Mon, 10 Jan 2022 02:39:08 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 76DFBC061763; Sun, 9 Jan 2022 23:33:41 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1960F60B62; Mon, 10 Jan 2022 07:33:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 015DEC36AE9; Mon, 10 Jan 2022 07:33:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800020; bh=dZLDfgXpMHsQktAQ1CcOfPtuyA+EHT7IeIuECDDH3lo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qML+ZvnHcc7qPZnvYeq1MCTLUkacUb7kTOCpCThDW5cB3b72nWp9GWMveK52oXkSq odFcVEHsKG7c4EF7KTzp9q9g8mb+1niyIHJTNoHPzbZM6So1kNjF0d4tYIXghIyE6K Pnw5Al5DtwechVU/D5ozl8W5wlK3gy7m0dLtxW9c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Ahern , Nicolas Dichtel , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.15 52/72] ipv6: Do cleanup if attribute validation fails in multipath route Date: Mon, 10 Jan 2022 08:23:29 +0100 Message-Id: <20220110071823.305562333@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Ahern [ Upstream commit 95bdba23b5b4aa75fe3e6c84335e638641c707bb ] As Nicolas noted, if gateway validation fails walking the multipath attribute the code should jump to the cleanup to free previously allocated memory. Fixes: 1ff15a710a86 ("ipv6: Check attribute length for RTA_GATEWAY when del= eting multipath route") Signed-off-by: David Ahern Acked-by: Nicolas Dichtel Link: https://lore.kernel.org/r/20220103170555.94638-1-dsahern@kernel.org Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv6/route.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 0eceb0e88976b..0632382a5427b 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5277,12 +5277,10 @@ static int ip6_route_multipath_add(struct fib6_conf= ig *cfg, =20 nla =3D nla_find(attrs, attrlen, RTA_GATEWAY); if (nla) { - int ret; - - ret =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, + err =3D fib6_gw_from_attr(&r_cfg.fc_gateway, nla, extack); - if (ret) - return ret; + if (err) + goto cleanup; =20 r_cfg.fc_flags |=3D RTF_GATEWAY; } --=20 2.34.1 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C885C433EF for ; Mon, 10 Jan 2022 07:46:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239924AbiAJHq1 (ORCPT ); Mon, 10 Jan 2022 02:46:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51632 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241810AbiAJHjm (ORCPT ); Mon, 10 Jan 2022 02:39:42 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3536C02549D; Sun, 9 Jan 2022 23:33:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5B154B81216; Mon, 10 Jan 2022 07:33:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3CD8C36AED; Mon, 10 Jan 2022 07:33:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800026; bh=zw1NdbOtkyijo7fXN+XvLZTKIYt/6pYw8B0XdMToLBU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hy01yk+N8eZJNkZyRtZ3YTqamMFVT/5EcNfKOiBIgYyMbTR1kGbytAX4E8+0SIP5k lyfLR0Kcmlbcdh9+l4x9zl6kk9FJs7R5/LIZU5Dl8GqspVEnzzr9pxLyMMpge2g26q 6sRlbQJaMuOgZxqvw5AMGGGXpypPJ0NTzsO10JdA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Luiz Sampaio , Miguel Ojeda , Sasha Levin Subject: [PATCH 5.15 53/72] auxdisplay: charlcd: checking for pointer reference before dereferencing Date: Mon, 10 Jan 2022 08:23:30 +0100 Message-Id: <20220110071823.336401449@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Luiz Sampaio [ Upstream commit 4daa9ff89ef27be43c15995412d6aee393a78200 ] Check if the pointer lcd->ops->init_display exists before dereferencing it. If a driver called charlcd_init() without defining the ops, this would return segmentation fault, as happened to me when implementing a charlcd driver. Checking the pointer before dereferencing protects from segmentation fault. Signed-off-by: Luiz Sampaio Signed-off-by: Miguel Ojeda Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/auxdisplay/charlcd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/auxdisplay/charlcd.c b/drivers/auxdisplay/charlcd.c index 304accde365c8..6c010d4efa4ae 100644 --- a/drivers/auxdisplay/charlcd.c +++ b/drivers/auxdisplay/charlcd.c @@ -578,6 +578,9 @@ static int charlcd_init(struct charlcd *lcd) * Since charlcd_init_display() needs to write data, we have to * enable mark the LCD initialized just before. */ + if (WARN_ON(!lcd->ops->init_display)) + return -EINVAL; + ret =3D lcd->ops->init_display(lcd); if (ret) return ret; --=20 2.34.1 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D1E3C3525B for ; Mon, 10 Jan 2022 07:41:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242476AbiAJHks (ORCPT ); Mon, 10 Jan 2022 02:40:48 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:34106 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240195AbiAJHdv (ORCPT ); Mon, 10 Jan 2022 02:33:51 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3320CB81217; Mon, 10 Jan 2022 07:33:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7A5FEC36AED; Mon, 10 Jan 2022 07:33:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800029; bh=o5kFP8oQmTF+hd+jHzzz40Ex04sUdxCwM94ZL0yWrWY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p2MtzxQo5IewBVuBZhVHZQTWJhN9HGLt38Rh7trxgkJOPLyeZX46AJDvdYLTE8Kjd vRSWkMSFDRo7HWSnvH/R69keXoFEQ4zUGnz55rulqfvNBaLJpqI2jsgGhX8G0SH5ay cQyMBfAOKWEchFYbHaqKNxUE7ATMRNdcNhRm5ydw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Christian=20K=C3=B6nig?= , Alex Deucher , Sasha Levin Subject: [PATCH 5.15 54/72] drm/amdgpu: fix dropped backing store handling in amdgpu_dma_buf_move_notify Date: Mon, 10 Jan 2022 08:23:31 +0100 Message-Id: <20220110071823.381194092@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Christian K=C3=B6nig [ Upstream commit fc74881c28d314b10efac016ef49df4ff40b8b97 ] bo->tbo.resource can now be NULL. Signed-off-by: Christian K=C3=B6nig Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1811 Acked-by: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20211210083927.1754-1-c= hristian.koenig@amd.com Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/= amd/amdgpu/amdgpu_dma_buf.c index ae6ab93c868b8..7444484a12bf8 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c @@ -384,7 +384,7 @@ amdgpu_dma_buf_move_notify(struct dma_buf_attachment *a= ttach) struct amdgpu_vm_bo_base *bo_base; int r; =20 - if (bo->tbo.resource->mem_type =3D=3D TTM_PL_SYSTEM) + if (!bo->tbo.resource || bo->tbo.resource->mem_type =3D=3D TTM_PL_SYSTEM) return; =20 r =3D ttm_bo_validate(&bo->tbo, &placement, &ctx); --=20 2.34.1 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F524C433EF for ; Mon, 10 Jan 2022 07:48:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236875AbiAJHsR (ORCPT ); Mon, 10 Jan 2022 02:48:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51724 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241989AbiAJHkH (ORCPT ); Mon, 10 Jan 2022 02:40:07 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D6237C0251BD; Sun, 9 Jan 2022 23:33:52 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 75A5F60B63; Mon, 10 Jan 2022 07:33:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5B1DBC36AE9; Mon, 10 Jan 2022 07:33:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800031; bh=miwMnJgVOnR+9E9/tWDy+mlTU5eoEgWYT3bcqx54edA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sMObtAg1IjmerI1bPycudQJIwTFHLH9aY0on+dc4OBKX6uLmaqNVwEvA5SKI+el7A NZI+ELaW369UhSgWecq161e70oYH9kpgj1RsEak54xF2Fw++6CbXnqgtv7MBE/Uigt S9N0Rr12sGPHG9+AbaDvD8V09Xwe/jEvLAUbnWl8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lijo Lazar , Hawking Zhang , Alex Deucher , Sasha Levin Subject: [PATCH 5.15 55/72] drm/amd/pm: Fix xgmi link control on aldebaran Date: Mon, 10 Jan 2022 08:23:32 +0100 Message-Id: <20220110071823.419565546@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lijo Lazar [ Upstream commit 19e66d512e4182a0461530fa3159638e0f55d97e ] Fix the message argument. 0: Allow power down 1: Disallow power down Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/g= pu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c index 5019903db492a..c9cfeb094750d 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c @@ -1619,7 +1619,7 @@ static int aldebaran_allow_xgmi_power_down(struct smu= _context *smu, bool en) { return smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_GmiPwrDnControl, - en ? 1 : 0, + en ? 0 : 1, NULL); } =20 --=20 2.34.1 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 473AFC433F5 for ; Mon, 10 Jan 2022 07:43:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239825AbiAJHnX (ORCPT ); Mon, 10 Jan 2022 02:43:23 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42278 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239877AbiAJHdz (ORCPT ); Mon, 10 Jan 2022 02:33:55 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 579EA60A7C; Mon, 10 Jan 2022 07:33:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3C718C36AED; Mon, 10 Jan 2022 07:33:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800034; bh=ks0iY5W/D2uOfI02lcMoJnGZiwHirz40hj0r2rGPzEg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F5a/Mt+iXgqlu3Lwz9kfuIdGcmTh2jUaRxM1y/6mc2DX9N1EevIPVvqnwXSOrf8Vo 4xmvqg3e+Ck4RWKIxBA44BTnBHKoRDa5y3LRinmKq8LvKpIDqEv7HQVVRhKWg0gAzc m5q8aE/9BW21Y8zznu1mi4LSFxKYrEGntblaZvxQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chunfeng Yun , Sasha Levin Subject: [PATCH 5.15 56/72] usb: mtu3: fix interval value for intr and isoc Date: Mon, 10 Jan 2022 08:23:33 +0100 Message-Id: <20220110071823.458372636@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chunfeng Yun [ Upstream commit e3d4621c22f90c33321ae6a6baab60cdb8e5a77c ] Use the Interval value from isoc/intr endpoint descriptor, no need minus one. The original code doesn't cause transfer error for normal cases, but it may have side effect with respond time of ERDY or tPingTimeout. Signed-off-by: Chunfeng Yun Link: https://lore.kernel.org/r/20211218095749.6250-1-chunfeng.yun@mediatek= .com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/usb/mtu3/mtu3_gadget.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c index 0b21da4ee1836..9977600616d7e 100644 --- a/drivers/usb/mtu3/mtu3_gadget.c +++ b/drivers/usb/mtu3/mtu3_gadget.c @@ -77,7 +77,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { interval =3D desc->bInterval; - interval =3D clamp_val(interval, 1, 16) - 1; + interval =3D clamp_val(interval, 1, 16); if (usb_endpoint_xfer_isoc(desc) && comp_desc) mult =3D comp_desc->bmAttributes; } @@ -89,7 +89,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) if (usb_endpoint_xfer_isoc(desc) || usb_endpoint_xfer_int(desc)) { interval =3D desc->bInterval; - interval =3D clamp_val(interval, 1, 16) - 1; + interval =3D clamp_val(interval, 1, 16); mult =3D usb_endpoint_maxp_mult(desc) - 1; } break; --=20 2.34.1 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 98880C41535 for ; Mon, 10 Jan 2022 07:46:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240788AbiAJHqe (ORCPT ); Mon, 10 Jan 2022 02:46:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50722 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242045AbiAJHkM (ORCPT ); Mon, 10 Jan 2022 02:40:12 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 92796C022593; Sun, 9 Jan 2022 23:33:58 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 325A660B63; Mon, 10 Jan 2022 07:33:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 166D2C36AE9; Mon, 10 Jan 2022 07:33:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800037; bh=rZiBSD5jjfvjzm16SGoi+rwrP4CW+3Dqtg3dV9jQBCM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TI1hyMSYZPw8SChEgNmTo5mzD7bhHvlE8HzbmEP4d1i8Bgt/hiLg0K7eQJTC/BNne 40DDWamNRKTPd2kDqBSBX8I9Rg2yk/vQbUMfNStSW0K0OLeBgtYr4QKoSNvirbISup ReSNa6/aJWxbnl6Sn3rSwbesylaS2RrMdRoe1kV8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lu Tixiong , Mike Christie , Lee Duncan , Lixiaokeng , Linfeilong , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.15 57/72] scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() Date: Mon, 10 Jan 2022 08:23:34 +0100 Message-Id: <20220110071823.489587869@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lixiaokeng [ Upstream commit 1b8d0300a3e9f216ae4901bab886db7299899ec6 ] |- iscsi_if_destroy_conn |-dev_attr_show |-iscsi_conn_teardown |-spin_lock_bh |-iscsi_sw_tcp_conn_get_param |-kfree(conn->persistent_address) |-iscsi_conn_get_param |-kfree(conn->local_ipaddr) =3D=3D>|-read persistent_address =3D=3D>|-read local_ipaddr |-spin_unlock_bh When iscsi_conn_teardown() and iscsi_conn_get_param() happen in parallel, a UAF may be triggered. Link: https://lore.kernel.org/r/046ec8a0-ce95-d3fc-3235-666a7c65b224@huawei= .com Reported-by: Lu Tixiong Reviewed-by: Mike Christie Reviewed-by: Lee Duncan Signed-off-by: Lixiaokeng Signed-off-by: Linfeilong Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/scsi/libiscsi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index 5bc91d34df634..cbc263ec9d661 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -3101,6 +3101,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_c= onn) { struct iscsi_conn *conn =3D cls_conn->dd_data; struct iscsi_session *session =3D conn->session; + char *tmp_persistent_address =3D conn->persistent_address; + char *tmp_local_ipaddr =3D conn->local_ipaddr; =20 del_timer_sync(&conn->transport_timer); =20 @@ -3122,8 +3124,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_c= onn) spin_lock_bh(&session->frwd_lock); free_pages((unsigned long) conn->data, get_order(ISCSI_DEF_MAX_RECV_SEG_LEN)); - kfree(conn->persistent_address); - kfree(conn->local_ipaddr); /* regular RX path uses back_lock */ spin_lock_bh(&session->back_lock); kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task, @@ -3135,6 +3135,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_c= onn) mutex_unlock(&session->eh_mutex); =20 iscsi_destroy_conn(cls_conn); + kfree(tmp_persistent_address); + kfree(tmp_local_ipaddr); } EXPORT_SYMBOL_GPL(iscsi_conn_teardown); =20 --=20 2.34.1 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A16CC433FE for ; Mon, 10 Jan 2022 07:43:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241383AbiAJHnw (ORCPT ); Mon, 10 Jan 2022 02:43:52 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42320 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240656AbiAJHeB (ORCPT ); Mon, 10 Jan 2022 02:34:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0ECBC60B63; Mon, 10 Jan 2022 07:34:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E9C15C36AED; Mon, 10 Jan 2022 07:33:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800040; bh=W/r+DM4H3sntKk5hryHgWFidQAklF5kpkLJXcnj6abk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MmXFftM8MPQ3S//U6SSgQfg2kTMARHeoN03xo/vjpHuYp8e8B3cfxQDY83VhBVI34 vKI6QTh9GhB9Uf6v2r7xUAepTW+ch8d0c1LQodln+erkIn15DBa9JUqAEmvQ5e2xDV 1+l/X7GnLnsqmpCV7Xkc5mn7qn8nga1rChf/BqUQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, William Zhao , "David S. Miller" , Sasha Levin Subject: [PATCH 5.15 58/72] ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate Date: Mon, 10 Jan 2022 08:23:35 +0100 Message-Id: <20220110071823.528310539@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: William Zhao [ Upstream commit c1833c3964d5bd8c163bd4e01736a38bc473cb8a ] The "__ip6_tnl_parm" struct was left uninitialized causing an invalid load of random data when the "__ip6_tnl_parm" struct was used elsewhere. As an example, in the function "ip6_tnl_xmit_ctl()", it tries to access the "collect_md" member. With "__ip6_tnl_parm" being uninitialized and containing random data, the UBSAN detected that "collect_md" held a non-boolean value. The UBSAN issue is as follows: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D UBSAN: invalid-load in net/ipv6/ip6_tunnel.c:1025:14 load of value 30 is not a valid value for type '_Bool' CPU: 1 PID: 228 Comm: kworker/1:3 Not tainted 5.16.0-rc4+ #8 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: dump_stack_lvl+0x44/0x57 ubsan_epilogue+0x5/0x40 __ubsan_handle_load_invalid_value+0x66/0x70 ? __cpuhp_setup_state+0x1d3/0x210 ip6_tnl_xmit_ctl.cold.52+0x2c/0x6f [ip6_tunnel] vti6_tnl_xmit+0x79c/0x1e96 [ip6_vti] ? lock_is_held_type+0xd9/0x130 ? vti6_rcv+0x100/0x100 [ip6_vti] ? lock_is_held_type+0xd9/0x130 ? rcu_read_lock_bh_held+0xc0/0xc0 ? lock_acquired+0x262/0xb10 dev_hard_start_xmit+0x1e6/0x820 __dev_queue_xmit+0x2079/0x3340 ? mark_lock.part.52+0xf7/0x1050 ? netdev_core_pick_tx+0x290/0x290 ? kvm_clock_read+0x14/0x30 ? kvm_sched_clock_read+0x5/0x10 ? sched_clock_cpu+0x15/0x200 ? find_held_lock+0x3a/0x1c0 ? lock_release+0x42f/0xc90 ? lock_downgrade+0x6b0/0x6b0 ? mark_held_locks+0xb7/0x120 ? neigh_connected_output+0x31f/0x470 ? lockdep_hardirqs_on+0x79/0x100 ? neigh_connected_output+0x31f/0x470 ? ip6_finish_output2+0x9b0/0x1d90 ? rcu_read_lock_bh_held+0x62/0xc0 ? ip6_finish_output2+0x9b0/0x1d90 ip6_finish_output2+0x9b0/0x1d90 ? ip6_append_data+0x330/0x330 ? ip6_mtu+0x166/0x370 ? __ip6_finish_output+0x1ad/0xfb0 ? nf_hook_slow+0xa6/0x170 ip6_output+0x1fb/0x710 ? nf_hook.constprop.32+0x317/0x430 ? ip6_finish_output+0x180/0x180 ? __ip6_finish_output+0xfb0/0xfb0 ? lock_is_held_type+0xd9/0x130 ndisc_send_skb+0xb33/0x1590 ? __sk_mem_raise_allocated+0x11cf/0x1560 ? dst_output+0x4a0/0x4a0 ? ndisc_send_rs+0x432/0x610 addrconf_dad_completed+0x30c/0xbb0 ? addrconf_rs_timer+0x650/0x650 ? addrconf_dad_work+0x73c/0x10e0 addrconf_dad_work+0x73c/0x10e0 ? addrconf_dad_completed+0xbb0/0xbb0 ? rcu_read_lock_sched_held+0xaf/0xe0 ? rcu_read_lock_bh_held+0xc0/0xc0 process_one_work+0x97b/0x1740 ? pwq_dec_nr_in_flight+0x270/0x270 worker_thread+0x87/0xbf0 ? process_one_work+0x1740/0x1740 kthread+0x3ac/0x490 ? set_kthread_struct+0x100/0x100 ret_from_fork+0x22/0x30 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The solution is to initialize "__ip6_tnl_parm" struct to zeros in the "vti6_siocdevprivate()" function. Signed-off-by: William Zhao Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv6/ip6_vti.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c index 1d8e3ffa225d8..42c37ec832f15 100644 --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -808,6 +808,8 @@ vti6_siocdevprivate(struct net_device *dev, struct ifre= q *ifr, void __user *data struct net *net =3D dev_net(dev); struct vti6_net *ip6n =3D net_generic(net, vti6_net_id); =20 + memset(&p1, 0, sizeof(p1)); + switch (cmd) { case SIOCGETTUNNEL: if (dev =3D=3D ip6n->fb_tnl_dev) { --=20 2.34.1 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B1D7C433F5 for ; Mon, 10 Jan 2022 07:47:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242274AbiAJHr0 (ORCPT ); Mon, 10 Jan 2022 02:47:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51284 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242059AbiAJHkN (ORCPT ); Mon, 10 Jan 2022 02:40:13 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BC0A4C022598; Sun, 9 Jan 2022 23:34:05 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7B6B1B81203; Mon, 10 Jan 2022 07:34:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C31BDC36AE9; Mon, 10 Jan 2022 07:34:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800043; bh=0FT26Cem4e3d3QKDR7k5iIQTmQdC4qIdU6Kx73jhFK0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=liFuML+XvSiFMGDcPhxzy0b41mLXIVVdvOq/aprbrOLVRP0JawCIjC3AoKTqRokm0 jDGAaS6PyThwuUKlsQ6b2xYZA2W06ofkg82jrnGA9UelfJdYdj/9YB5Ibz/kgK2MOo 5VzpY3qhHZekhTB6Fo8CvIwpLMo2tbUH9aSiaKqI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, yangxingwu , "David S. Miller" , Sasha Levin Subject: [PATCH 5.15 59/72] net: udp: fix alignment problem in udp4_seq_show() Date: Mon, 10 Jan 2022 08:23:36 +0100 Message-Id: <20220110071823.561254835@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: yangxingwu [ Upstream commit 6c25449e1a32c594d743df8e8258e8ef870b6a77 ] $ cat /pro/net/udp before: sl local_address rem_address st tx_queue rx_queue tr tm->when 26050: 0100007F:0035 00000000:0000 07 00000000:00000000 00:00000000 26320: 0100007F:0143 00000000:0000 07 00000000:00000000 00:00000000 27135: 00000000:8472 00000000:0000 07 00000000:00000000 00:00000000 after: sl local_address rem_address st tx_queue rx_queue tr tm->when 26050: 0100007F:0035 00000000:0000 07 00000000:00000000 00:00000000 26320: 0100007F:0143 00000000:0000 07 00000000:00000000 00:00000000 27135: 00000000:8472 00000000:0000 07 00000000:00000000 00:00000000 Signed-off-by: yangxingwu Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv4/udp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index be07e3d2b77bc..835b9d6e4e686 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -3076,7 +3076,7 @@ int udp4_seq_show(struct seq_file *seq, void *v) { seq_setwidth(seq, 127); if (v =3D=3D SEQ_START_TOKEN) - seq_puts(seq, " sl local_address rem_address st tx_queue " + seq_puts(seq, " sl local_address rem_address st tx_queue " "rx_queue tr tm->when retrnsmt uid timeout " "inode ref pointer drops"); else { --=20 2.34.1 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D1ACC433EF for ; Mon, 10 Jan 2022 07:43:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241529AbiAJHnu (ORCPT ); Mon, 10 Jan 2022 02:43:50 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42364 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239531AbiAJHeH (ORCPT ); Mon, 10 Jan 2022 02:34:07 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B032360B6E; Mon, 10 Jan 2022 07:34:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 98DBFC36AED; Mon, 10 Jan 2022 07:34:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800046; bh=rQWPm9cXJfuksOaoRvd/2G82SysMisSSSu3E4i638IY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RTz4RxcrEA4JhD/nTe5ZoJ7fJxHgYUz5AMesEY//68H3lOxUZGPb3oXtBx5YcOc0z e8PWKLZFFjl7HXuJtXIsNnwPspCkuQa4+8dYDXsbR5q0+6QUfTgYyAZs2NIAw1yx7I ATicgg3njNKriwBW10otqMBfDxIlrRVUUqscgw4s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zekun Shen , "David S. Miller" , Sasha Levin Subject: [PATCH 5.15 60/72] atlantic: Fix buff_ring OOB in aq_ring_rx_clean Date: Mon, 10 Jan 2022 08:23:37 +0100 Message-Id: <20220110071823.591566466@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit 5f50153288452e10b6edd69ec9112c49442b054a ] The function obtain the next buffer without boundary check. We should return with I/O error code. The bug is found by fuzzing and the crash report is attached. It is an OOB bug although reported as use-after-free. [ 4.804724] BUG: KASAN: use-after-free in aq_ring_rx_clean+0x1e88/0x2730= [atlantic] [ 4.805661] Read of size 4 at addr ffff888034fe93a8 by task ksoftirqd/0/9 [ 4.806505] [ 4.806703] CPU: 0 PID: 9 Comm: ksoftirqd/0 Tainted: G W = 5.6.0 #34 [ 4.809030] Call Trace: [ 4.809343] dump_stack+0x76/0xa0 [ 4.809755] print_address_description.constprop.0+0x16/0x200 [ 4.810455] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic] [ 4.811234] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic] [ 4.813183] __kasan_report.cold+0x37/0x7c [ 4.813715] ? aq_ring_rx_clean+0x1e88/0x2730 [atlantic] [ 4.814393] kasan_report+0xe/0x20 [ 4.814837] aq_ring_rx_clean+0x1e88/0x2730 [atlantic] [ 4.815499] ? hw_atl_b0_hw_ring_rx_receive+0x9a5/0xb90 [atlantic] [ 4.816290] aq_vec_poll+0x179/0x5d0 [atlantic] [ 4.816870] ? _GLOBAL__sub_I_65535_1_aq_pci_func_init+0x20/0x20 [atlant= ic] [ 4.817746] ? __next_timer_interrupt+0xba/0xf0 [ 4.818322] net_rx_action+0x363/0xbd0 [ 4.818803] ? call_timer_fn+0x240/0x240 [ 4.819302] ? __switch_to_asm+0x40/0x70 [ 4.819809] ? napi_busy_loop+0x520/0x520 [ 4.820324] __do_softirq+0x18c/0x634 [ 4.820797] ? takeover_tasklets+0x5f0/0x5f0 [ 4.821343] run_ksoftirqd+0x15/0x20 [ 4.821804] smpboot_thread_fn+0x2f1/0x6b0 [ 4.822331] ? smpboot_unregister_percpu_thread+0x160/0x160 [ 4.823041] ? __kthread_parkme+0x80/0x100 [ 4.823571] ? smpboot_unregister_percpu_thread+0x160/0x160 [ 4.824301] kthread+0x2b5/0x3b0 [ 4.824723] ? kthread_create_on_node+0xd0/0xd0 [ 4.825304] ret_from_fork+0x35/0x40 Signed-off-by: Zekun Shen Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net= /ethernet/aquantia/atlantic/aq_ring.c index 24122ccda614c..72f8751784c31 100644 --- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c @@ -365,6 +365,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self, if (!buff->is_eop) { buff_ =3D buff; do { + if (buff_->next >=3D self->size) { + err =3D -EIO; + goto err_exit; + } next_ =3D buff_->next, buff_ =3D &self->buff_ring[next_]; is_rsc_completed =3D @@ -388,6 +392,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self, (buff->is_lro && buff->is_cso_err)) { buff_ =3D buff; do { + if (buff_->next >=3D self->size) { + err =3D -EIO; + goto err_exit; + } next_ =3D buff_->next, buff_ =3D &self->buff_ring[next_]; =20 --=20 2.34.1 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7800CC433F5 for ; Mon, 10 Jan 2022 07:41:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242496AbiAJHkw (ORCPT ); Mon, 10 Jan 2022 02:40:52 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42390 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233961AbiAJHeK (ORCPT ); Mon, 10 Jan 2022 02:34:10 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8736E611A6; Mon, 10 Jan 2022 07:34:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 705BFC36AE9; Mon, 10 Jan 2022 07:34:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800049; bh=Szb9TvzsCywHF4L0vx7zk+gn/LMnbJj7FKMxDHllITc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XprrK7ukLAupxZtACqyIDp0OiXXoocgso9dnACyoq7GY8BX0Dqv+Tj3r+QWuGzodC kgG5hBDEzvz41WHtaes/5aauEFvNQlmB6fNCallslrO/lw8Sm31Ke6mVcQeb3R7kig PPX7Ik8Xm9PUkAo5CUSUe38y7CXzeFARE/gqMGt4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Prike Liang , Evan Quan , Alex Deucher , Sasha Levin Subject: [PATCH 5.15 61/72] drm/amd/pm: skip setting gfx cgpg in the s0ix suspend-resume Date: Mon, 10 Jan 2022 08:23:38 +0100 Message-Id: <20220110071823.621425731@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Prike Liang [ Upstream commit 8c45096c60d6ce6341c374636100ed1b2c1c33a1 ] In the s0ix entry need retain gfx in the gfxoff state,so here need't set gfx cgpg in the S0ix suspend-resume process. Moreover move the S0ix check into SMU12 can simplify the code condition check. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1712 Signed-off-by: Prike Liang Reviewed-by: Evan Quan Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 7 ++----- drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c | 3 ++- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/am= d/pm/swsmu/amdgpu_smu.c index 04863a7971155..30ee8819587e2 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c @@ -1536,9 +1536,7 @@ static int smu_suspend(void *handle) =20 smu->watermarks_bitmap &=3D ~(WATERMARKS_LOADED); =20 - /* skip CGPG when in S0ix */ - if (smu->is_apu && !adev->in_s0ix) - smu_set_gfx_cgpg(&adev->smu, false); + smu_set_gfx_cgpg(&adev->smu, false); =20 return 0; } @@ -1569,8 +1567,7 @@ static int smu_resume(void *handle) return ret; } =20 - if (smu->is_apu) - smu_set_gfx_cgpg(&adev->smu, true); + smu_set_gfx_cgpg(&adev->smu, true); =20 smu->disable_uclk_switch =3D 0; =20 diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c b/drivers/gpu/d= rm/amd/pm/swsmu/smu12/smu_v12_0.c index 43028f2cd28b5..9c91e79c955fb 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c +++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/smu_v12_0.c @@ -120,7 +120,8 @@ int smu_v12_0_powergate_sdma(struct smu_context *smu, b= ool gate) =20 int smu_v12_0_set_gfx_cgpg(struct smu_context *smu, bool enable) { - if (!(smu->adev->pg_flags & AMD_PG_SUPPORT_GFX_PG)) + /* Until now the SMU12 only implemented for Renoir series so here neen't = do APU check. */ + if (!(smu->adev->pg_flags & AMD_PG_SUPPORT_GFX_PG) || smu->adev->in_s0ix) return 0; =20 return smu_cmn_send_smc_msg_with_param(smu, --=20 2.34.1 From nobody Tue Jun 30 21:17:55 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C356BC35263 for ; Mon, 10 Jan 2022 07:41:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242513AbiAJHk4 (ORCPT ); Mon, 10 Jan 2022 02:40:56 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:40974 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239360AbiAJHeN (ORCPT ); Mon, 10 Jan 2022 02:34:13 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F1FC3611B7; Mon, 10 Jan 2022 07:34:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D164EC36AEF; Mon, 10 Jan 2022 07:34:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800052; bh=pU364gwTipAGmNVJZzf1xKh13FbSWd0RN/HkMR0i3PU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mXD/yjH0YaI+/Y++TiFpq9M+/F+bZ0zRf3xD8KWksCU51pfuharhyIUf0Dj/aUGZM 0wdSGkHVoEJCagNF12TBPORvt6iYL39yvoqQ/oHNlomb1Vx9O7I2i+1Is3aBx6TRoL 6AfaDi4SJR0mla5t28DSBwKAUspft5Q18Pof8CIM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Luben Tuikov , Evan Quan , Alex Deucher , Sasha Levin Subject: [PATCH 5.15 62/72] drm/amdgpu: always reset the asic in suspend (v2) Date: Mon, 10 Jan 2022 08:23:39 +0100 Message-Id: <20220110071823.658590687@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alex Deucher [ Upstream commit daf8de0874ab5b74b38a38726fdd3d07ef98a7ee ] If the platform suspend happens to fail and the power rail is not turned off, the GPU will be in an unknown state on resume, so reset the asic so that it will be in a known good state on resume even if the platform suspend failed. v2: handle s0ix Acked-by: Luben Tuikov Acked-by: Evan Quan Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_drv.c index 70e8a86c3a69f..9dfd9d70812cb 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c @@ -1526,7 +1526,10 @@ static int amdgpu_pmops_suspend(struct device *dev) adev->in_s3 =3D true; r =3D amdgpu_device_suspend(drm_dev, true); adev->in_s3 =3D false; - + if (r) + return r; + if (!adev->in_s0ix) + r =3D amdgpu_asic_reset(adev); return r; } =20 --=20 2.34.1 From nobody Tue Jun 30 21:17:56 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B36F4C4167E for ; Mon, 10 Jan 2022 07:46:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241154AbiAJHql (ORCPT ); Mon, 10 Jan 2022 02:46:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51852 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242199AbiAJHkc (ORCPT ); Mon, 10 Jan 2022 02:40:32 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 84D17C0225AD; Sun, 9 Jan 2022 23:34:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4A970B81212; Mon, 10 Jan 2022 07:34:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 760A1C36AE9; Mon, 10 Jan 2022 07:34:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800058; bh=ibkJuuo+6RsBx6kxBDga/mXyaKtd8xHoan+9CR99NQY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aU7lFUtPAToustICwXCQyYz/xYTFXj56XcvNe0QZ4ALP3TRGqKGdlCInyl5n0mRAI aw/Khqz2gw4yP27Xmjdcrq77xpLpugIAlFMWz0T42PY48inP7ixyoHVkacN/s/IzZc 9k6wAB8K9BSWGTTlKoUiQEjcn272asVXrdM8cwbI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Evan Quan , Alex Deucher , Guchun Chen , Lijo Lazar , Sasha Levin Subject: [PATCH 5.15 63/72] drm/amdgpu: put SMU into proper state on runpm suspending for BOCO capable platform Date: Mon, 10 Jan 2022 08:23:40 +0100 Message-Id: <20220110071823.695439426@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Evan Quan [ Upstream commit 7be3be2b027c12e84833b3dc9597d3bb7e4c5464 ] By setting mp1_state as PP_MP1_STATE_UNLOAD, MP1 will do some proper cleanu= ps and put itself into a state ready for PNP. That can workaround some random resu= ming failure observed on BOCO capable platforms. Signed-off-by: Evan Quan Acked-by: Alex Deucher Reviewed-by: Guchun Chen Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_drv.c index 9dfd9d70812cb..41677f99c67b1 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c @@ -1606,12 +1606,27 @@ static int amdgpu_pmops_runtime_suspend(struct devi= ce *dev) if (amdgpu_device_supports_px(drm_dev)) drm_dev->switch_power_state =3D DRM_SWITCH_POWER_CHANGING; =20 + /* + * By setting mp1_state as PP_MP1_STATE_UNLOAD, MP1 will do some + * proper cleanups and put itself into a state ready for PNP. That + * can address some random resuming failure observed on BOCO capable + * platforms. + * TODO: this may be also needed for PX capable platform. + */ + if (amdgpu_device_supports_boco(drm_dev)) + adev->mp1_state =3D PP_MP1_STATE_UNLOAD; + ret =3D amdgpu_device_suspend(drm_dev, false); if (ret) { adev->in_runpm =3D false; + if (amdgpu_device_supports_boco(drm_dev)) + adev->mp1_state =3D PP_MP1_STATE_NONE; return ret; } =20 + if (amdgpu_device_supports_boco(drm_dev)) + adev->mp1_state =3D PP_MP1_STATE_NONE; + if (amdgpu_device_supports_px(drm_dev)) { /* Only need to handle PCI state in the driver for ATPX * PCI core handles it for _PR3. --=20 2.34.1 From nobody Tue Jun 30 21:17:56 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CED58C433F5 for ; Mon, 10 Jan 2022 07:46:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241545AbiAJHqr (ORCPT ); Mon, 10 Jan 2022 02:46:47 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51380 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242213AbiAJHkd (ORCPT ); Mon, 10 Jan 2022 02:40:33 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF820C0225B2; Sun, 9 Jan 2022 23:34:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 643C3611BC; Mon, 10 Jan 2022 07:34:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4D187C36AEF; Mon, 10 Jan 2022 07:34:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800060; bh=/gdLnShWLpQP/o/mRaKeBqi4pXaE52yQZMGAJPcUVUY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tGDNl200n7dH1BBR/h+QN2kkjw7ci6I3ZB9TY65RFfNrxDYonCFdCyAWmgTVxRioD GdS0plDj50Q1iWUSnR3MywJfKQ8X7dHs+Bd1ePSe1t+1Swup+wprV3DTL0iFNVec7q VH0qHZhyzKMatpi1fQkd3bgv2WO9miAqc5JyjVZE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, wolfgang huang , k2ci , "David S. Miller" , Sasha Levin Subject: [PATCH 5.15 64/72] mISDN: change function names to avoid conflicts Date: Mon, 10 Jan 2022 08:23:41 +0100 Message-Id: <20220110071823.733820379@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: wolfgang huang [ Upstream commit 8b5fdfc57cc2471179d1c51081424ded833c16c8 ] As we build for mips, we meet following error. l1_init error with multiple definition. Some architecture devices usually marked with l1, l2, lxx as the start-up phase. so we change the mISDN function names, align with Isdnl2_xxx. mips-linux-gnu-ld: drivers/isdn/mISDN/layer1.o: in function `l1_init': (.text+0x890): multiple definition of `l1_init'; \ arch/mips/kernel/bmips_5xxx_init.o:(.text+0xf0): first defined here make[1]: *** [home/mips/kernel-build/linux/Makefile:1161: vmlinux] Error 1 Signed-off-by: wolfgang huang Reported-by: k2ci Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/isdn/mISDN/core.c | 6 +++--- drivers/isdn/mISDN/core.h | 4 ++-- drivers/isdn/mISDN/layer1.c | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c index 55891e4204460..a41b4b2645941 100644 --- a/drivers/isdn/mISDN/core.c +++ b/drivers/isdn/mISDN/core.c @@ -381,7 +381,7 @@ mISDNInit(void) err =3D mISDN_inittimer(&debug); if (err) goto error2; - err =3D l1_init(&debug); + err =3D Isdnl1_Init(&debug); if (err) goto error3; err =3D Isdnl2_Init(&debug); @@ -395,7 +395,7 @@ mISDNInit(void) error5: Isdnl2_cleanup(); error4: - l1_cleanup(); + Isdnl1_cleanup(); error3: mISDN_timer_cleanup(); error2: @@ -408,7 +408,7 @@ static void mISDN_cleanup(void) { misdn_sock_cleanup(); Isdnl2_cleanup(); - l1_cleanup(); + Isdnl1_cleanup(); mISDN_timer_cleanup(); class_unregister(&mISDN_class); =20 diff --git a/drivers/isdn/mISDN/core.h b/drivers/isdn/mISDN/core.h index 23b44d3033279..42599f49c189d 100644 --- a/drivers/isdn/mISDN/core.h +++ b/drivers/isdn/mISDN/core.h @@ -60,8 +60,8 @@ struct Bprotocol *get_Bprotocol4id(u_int); extern int mISDN_inittimer(u_int *); extern void mISDN_timer_cleanup(void); =20 -extern int l1_init(u_int *); -extern void l1_cleanup(void); +extern int Isdnl1_Init(u_int *); +extern void Isdnl1_cleanup(void); extern int Isdnl2_Init(u_int *); extern void Isdnl2_cleanup(void); =20 diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c index 98a3bc6c17009..7b31c25a550e3 100644 --- a/drivers/isdn/mISDN/layer1.c +++ b/drivers/isdn/mISDN/layer1.c @@ -398,7 +398,7 @@ create_l1(struct dchannel *dch, dchannel_l1callback *dc= b) { EXPORT_SYMBOL(create_l1); =20 int -l1_init(u_int *deb) +Isdnl1_Init(u_int *deb) { debug =3D deb; l1fsm_s.state_count =3D L1S_STATE_COUNT; @@ -409,7 +409,7 @@ l1_init(u_int *deb) } =20 void -l1_cleanup(void) +Isdnl1_cleanup(void) { mISDN_FsmFree(&l1fsm_s); } --=20 2.34.1 From nobody Tue Jun 30 21:17:56 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7D9FC433F5 for ; Mon, 10 Jan 2022 07:47:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242175AbiAJHrT (ORCPT ); Mon, 10 Jan 2022 02:47:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51396 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242233AbiAJHkd (ORCPT ); Mon, 10 Jan 2022 02:40:33 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 87404C0225B9; Sun, 9 Jan 2022 23:34:24 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 29EEA60B03; Mon, 10 Jan 2022 07:34:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1582BC36AE9; Mon, 10 Jan 2022 07:34:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800063; bh=eYFFKT1o1Y/rgN/OYwhhdSde3R2dhRsHpH0/eFJ275s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XwV5xZIJrmydVbgv3355pCyqV0ivHHf87Av9kTt1N6AafrLC9YijrAR0psz7f3B9n CmmjhMYjWDBPbGdPpcYP0EE+C93lAPXIiZvLftV1BEL7igF30Lyv05yUgTpbvPNznB XR0FdTKdw/aA5jzI7qg6zBUcju31n5pPvquIFtCg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Wheeler , Dmytro Laktyushkin , Jun Lei , Rodrigo Siqueira , Charlene Liu , Alex Deucher , Sasha Levin Subject: [PATCH 5.15 65/72] drm/amd/display: fix B0 TMDS deepcolor no dislay issue Date: Mon, 10 Jan 2022 08:23:42 +0100 Message-Id: <20220110071823.767304921@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Charlene Liu [ Upstream commit 2eb82577a16d4c8eb31e4ed520649850bb95b223 ] [why] B0 PHY C map to F, D map to G driver use logic instance, dmub does the remap. Driver still need use the right PHY instance to access right HW. [how] use phyical instance when program PHY register. [note] could move resync_control programming to dmub next. Tested-by: Daniel Wheeler Reviewed-by: Dmytro Laktyushkin Reviewed-by: Jun Lei Acked-by: Rodrigo Siqueira Signed-off-by: Charlene Liu Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- .../drm/amd/display/dc/dcn31/dcn31_resource.c | 25 +++++++++++++-- .../drm/amd/display/dc/dcn31/dcn31_resource.h | 31 +++++++++++++++++++ 2 files changed, 54 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c b/driver= s/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c index 6d8f26dada722..0fe570717ba01 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.c @@ -352,6 +352,14 @@ static const struct dce110_clk_src_regs clk_src_regs[]= =3D { clk_src_regs(3, D), clk_src_regs(4, E) }; +/*pll_id being rempped in dmub, in driver it is logical instance*/ +static const struct dce110_clk_src_regs clk_src_regs_b0[] =3D { + clk_src_regs(0, A), + clk_src_regs(1, B), + clk_src_regs(2, F), + clk_src_regs(3, G), + clk_src_regs(4, E) +}; =20 static const struct dce110_clk_src_shift cs_shift =3D { CS_COMMON_MASK_SH_LIST_DCN2_0(__SHIFT) @@ -2019,14 +2027,27 @@ static bool dcn31_resource_construct( dcn30_clock_source_create(ctx, ctx->dc_bios, CLOCK_SOURCE_COMBO_PHY_PLL1, &clk_src_regs[1], false); - pool->base.clock_sources[DCN31_CLK_SRC_PLL2] =3D + /*move phypllx_pixclk_resync to dmub next*/ + if (dc->ctx->asic_id.hw_internal_rev =3D=3D YELLOW_CARP_B0) { + pool->base.clock_sources[DCN31_CLK_SRC_PLL2] =3D + dcn30_clock_source_create(ctx, ctx->dc_bios, + CLOCK_SOURCE_COMBO_PHY_PLL2, + &clk_src_regs_b0[2], false); + pool->base.clock_sources[DCN31_CLK_SRC_PLL3] =3D + dcn30_clock_source_create(ctx, ctx->dc_bios, + CLOCK_SOURCE_COMBO_PHY_PLL3, + &clk_src_regs_b0[3], false); + } else { + pool->base.clock_sources[DCN31_CLK_SRC_PLL2] =3D dcn30_clock_source_create(ctx, ctx->dc_bios, CLOCK_SOURCE_COMBO_PHY_PLL2, &clk_src_regs[2], false); - pool->base.clock_sources[DCN31_CLK_SRC_PLL3] =3D + pool->base.clock_sources[DCN31_CLK_SRC_PLL3] =3D dcn30_clock_source_create(ctx, ctx->dc_bios, CLOCK_SOURCE_COMBO_PHY_PLL3, &clk_src_regs[3], false); + } + pool->base.clock_sources[DCN31_CLK_SRC_PLL4] =3D dcn30_clock_source_create(ctx, ctx->dc_bios, CLOCK_SOURCE_COMBO_PHY_PLL4, diff --git a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.h b/driver= s/gpu/drm/amd/display/dc/dcn31/dcn31_resource.h index 93571c9769967..cc4bed675588c 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.h +++ b/drivers/gpu/drm/amd/display/dc/dcn31/dcn31_resource.h @@ -39,4 +39,35 @@ struct resource_pool *dcn31_create_resource_pool( const struct dc_init_data *init_data, struct dc *dc); =20 +/*temp: B0 specific before switch to dcn313 headers*/ +#ifndef regPHYPLLF_PIXCLK_RESYNC_CNTL +#define regPHYPLLF_PIXCLK_RESYNC_CNTL 0x007e +#define regPHYPLLF_PIXCLK_RESYNC_CNTL_BASE_IDX 1 +#define regPHYPLLG_PIXCLK_RESYNC_CNTL 0x005f +#define regPHYPLLG_PIXCLK_RESYNC_CNTL_BASE_IDX 1 + +//PHYPLLF_PIXCLK_RESYNC_CNTL +#define PHYPLLF_PIXCLK_RESYNC_CNTL__PHYPLLF_PIXCLK_RESYNC_ENABLE__SHIFT 0x0 +#define PHYPLLF_PIXCLK_RESYNC_CNTL__PHYPLLF_DEEP_COLOR_DTO_ENABLE_STATUS__= SHIFT 0x1 +#define PHYPLLF_PIXCLK_RESYNC_CNTL__PHYPLLF_DCCG_DEEP_COLOR_CNTL__SHIFT 0x4 +#define PHYPLLF_PIXCLK_RESYNC_CNTL__PHYPLLF_PIXCLK_ENABLE__SHIFT 0x8 +#define PHYPLLF_PIXCLK_RESYNC_CNTL__PHYPLLF_PIXCLK_DOUBLE_RATE_ENABLE__SHI= FT 0x9 +#define PHYPLLF_PIXCLK_RESYNC_CNTL__PHYPLLF_PIXCLK_RESYNC_ENABLE_MASK 0x00= 000001L +#define PHYPLLF_PIXCLK_RESYNC_CNTL__PHYPLLF_DEEP_COLOR_DTO_ENABLE_STATUS_M= ASK 0x00000002L +#define PHYPLLF_PIXCLK_RESYNC_CNTL__PHYPLLF_DCCG_DEEP_COLOR_CNTL_MASK 0x00= 000030L +#define PHYPLLF_PIXCLK_RESYNC_CNTL__PHYPLLF_PIXCLK_ENABLE_MASK 0x00000100L +#define PHYPLLF_PIXCLK_RESYNC_CNTL__PHYPLLF_PIXCLK_DOUBLE_RATE_ENABLE_MASK= 0x00000200L + +//PHYPLLG_PIXCLK_RESYNC_CNTL +#define PHYPLLG_PIXCLK_RESYNC_CNTL__PHYPLLG_PIXCLK_RESYNC_ENABLE__SHIFT 0x0 +#define PHYPLLG_PIXCLK_RESYNC_CNTL__PHYPLLG_DEEP_COLOR_DTO_ENABLE_STATUS__= SHIFT 0x1 +#define PHYPLLG_PIXCLK_RESYNC_CNTL__PHYPLLG_DCCG_DEEP_COLOR_CNTL__SHIFT 0x4 +#define PHYPLLG_PIXCLK_RESYNC_CNTL__PHYPLLG_PIXCLK_ENABLE__SHIFT 0x8 +#define PHYPLLG_PIXCLK_RESYNC_CNTL__PHYPLLG_PIXCLK_DOUBLE_RATE_ENABLE__SHI= FT 0x9 +#define PHYPLLG_PIXCLK_RESYNC_CNTL__PHYPLLG_PIXCLK_RESYNC_ENABLE_MASK 0x00= 000001L +#define PHYPLLG_PIXCLK_RESYNC_CNTL__PHYPLLG_DEEP_COLOR_DTO_ENABLE_STATUS_M= ASK 0x00000002L +#define PHYPLLG_PIXCLK_RESYNC_CNTL__PHYPLLG_DCCG_DEEP_COLOR_CNTL_MASK 0x00= 000030L +#define PHYPLLG_PIXCLK_RESYNC_CNTL__PHYPLLG_PIXCLK_ENABLE_MASK 0x00000100L +#define PHYPLLG_PIXCLK_RESYNC_CNTL__PHYPLLG_PIXCLK_DOUBLE_RATE_ENABLE_MASK= 0x00000200L +#endif #endif /* _DCN31_RESOURCE_H_ */ --=20 2.34.1 From nobody Tue Jun 30 21:17:56 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 742F2C433EF for ; Mon, 10 Jan 2022 07:44:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240922AbiAJHoF (ORCPT ); Mon, 10 Jan 2022 02:44:05 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:42584 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240692AbiAJHe1 (ORCPT ); Mon, 10 Jan 2022 02:34:27 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 10C616066C; Mon, 10 Jan 2022 07:34:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DC10EC36AED; Mon, 10 Jan 2022 07:34:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800066; bh=3d/VhBi2lZVpCSYF9b6YMw1VZK8qmealpP+wEmBOY5I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MBbUUfRE5YCLmmJAY9Z3T8nw+GJ5cGx6Q5WA6y4rNFWqCqzgby4EI28ZwuzKyEkGm a1/1PxVSRLxgxeEBmNo0ydQdPLv7Lc2r8VfWzc3+A3IDwgF6JG/mpxfPGswod4tmco DnteCQlNWkaro7mFAfIrWoFTcjGbOz946RWmhtZ8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Wheeler , Anthony Koo , Rodrigo Siqueira , Derek Lai , Alex Deucher , Sasha Levin Subject: [PATCH 5.15 66/72] drm/amd/display: Added power down for DCN10 Date: Mon, 10 Jan 2022 08:23:43 +0100 Message-Id: <20220110071823.798696291@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lai, Derek [ Upstream commit d97e631af2db84c8c9d63abf68d487d0bb559e4c ] [Why] The change of setting a timer callback on boot for 10 seconds is still working, just lacked power down for DCN10. [How] Added power down for DCN10. Tested-by: Daniel Wheeler Reviewed-by: Anthony Koo Acked-by: Rodrigo Siqueira Signed-off-by: Derek Lai Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c b/drivers/gp= u/drm/amd/display/dc/dcn10/dcn10_init.c index 34001a30d449a..10e613ec7d24f 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c @@ -78,6 +78,7 @@ static const struct hw_sequencer_funcs dcn10_funcs =3D { .get_clock =3D dcn10_get_clock, .get_vupdate_offset_from_vsync =3D dcn10_get_vupdate_offset_from_vsync, .calc_vupdate_position =3D dcn10_calc_vupdate_position, + .power_down =3D dce110_power_down, .set_backlight_level =3D dce110_set_backlight_level, .set_abm_immediate_disable =3D dce110_set_abm_immediate_disable, .set_pipe =3D dce110_set_pipe, --=20 2.34.1 From nobody Tue Jun 30 21:17:56 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 995FCC433EF for ; Mon, 10 Jan 2022 07:46:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241186AbiAJHoe (ORCPT ); Mon, 10 Jan 2022 02:44:34 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:34520 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240986AbiAJHeb (ORCPT ); Mon, 10 Jan 2022 02:34:31 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7407EB81208; Mon, 10 Jan 2022 07:34:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B77FAC36AF2; Mon, 10 Jan 2022 07:34:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800069; bh=Y0J8XBrSx5+EYNohAi7G2j5UtwGyHqbFfjrqlSDfVyk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WitVbdO8MSa8tH2lMMpl6L48QdIvg63KHAHyc6n+lOsegcOZgvzmJpWx3xkhBUUqu Zzp1xjOQSgIw4n4s9eOIKnqP0VTlLZDzTRUwyMQ5catBsuMYwNJF/k+v31OPrn76bw pwuqIncxJy8lf8bP+1xpwd1WY9/nGFPZyiqxrtpg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tamir Duberstein , Willem de Bruijn , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.15 67/72] ipv6: raw: check passed optlen before reading Date: Mon, 10 Jan 2022 08:23:44 +0100 Message-Id: <20220110071823.836097125@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tamir Duberstein [ Upstream commit fb7bc9204095090731430c8921f9e629740c110a ] Add a check that the user-provided option is at least as long as the number of bytes we intend to read. Before this patch we would blindly read sizeof(int) bytes even in cases where the user passed optlen Signed-off-by: Willem de Bruijn Link: https://lore.kernel.org/r/20211229200947.2862255-1-willemdebruijn.ker= nel@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- net/ipv6/raw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c index 60f1e4f5be5aa..c51d5ce3711c2 100644 --- a/net/ipv6/raw.c +++ b/net/ipv6/raw.c @@ -1020,6 +1020,9 @@ static int do_rawv6_setsockopt(struct sock *sk, int l= evel, int optname, struct raw6_sock *rp =3D raw6_sk(sk); int val; =20 + if (optlen < sizeof(val)) + return -EINVAL; + if (copy_from_sockptr(&val, optval, sizeof(val))) return -EFAULT; =20 --=20 2.34.1 From nobody Tue Jun 30 21:17:56 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28CC0C433F5 for ; Mon, 10 Jan 2022 07:51:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240244AbiAJHve (ORCPT ); Mon, 10 Jan 2022 02:51:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51738 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241755AbiAJHmK (ORCPT ); Mon, 10 Jan 2022 02:42:10 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6AAE4C029820; Sun, 9 Jan 2022 23:35:05 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2AC04B81161; Mon, 10 Jan 2022 07:35:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 75986C36AE9; Mon, 10 Jan 2022 07:35:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800103; bh=hGZoP9uw3DF1rXbfqgRNRdoKO70l4Df7FXUiLI2e/w4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PDJtod849dW0J2PTWE5/LPv/pXIPPV9Ot9kkfVFp+mH6IqXsnimEdrqNuNgNnYSpV pqn2g7AN4yBSC39fSBtKeRfaAR+PibJad5hG9JpZVCgKci4kZ1Qa2poR/K6pYqJbhs /9Y/lJnNopK2bEKfRWdatRZj3c0Xvohj7ylY/4es= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mike Kravetz , Axel Rasmussen , Peter Xu , Andrea Arcangeli , Mina Almasry , Shuah Khan , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH 5.15 68/72] userfaultfd/selftests: fix hugetlb area allocations Date: Mon, 10 Jan 2022 08:23:45 +0100 Message-Id: <20220110071823.867961281@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Kravetz [ Upstream commit f5c73297181c6b3ad76537bad98eaad6d29b9333 ] Currently, userfaultfd selftest for hugetlb as run from run_vmtests.sh or any environment where there are 'just enough' hugetlb pages will always fail with: testing events (fork, remap, remove): ERROR: UFFDIO_COPY error: -12 (errno=3D12, line=3D616) The ENOMEM error code implies there are not enough hugetlb pages. However, there are free hugetlb pages but they are all reserved. There is a basic problem with the way the test allocates hugetlb pages which has existed since the test was originally written. Due to the way 'cleanup' was done between different phases of the test, this issue was masked until recently. The issue was uncovered by commit 8ba6e8640844 ("userfaultfd/selftests: reinitialize test context in each test"). For the hugetlb test, src and dst areas are allocated as PRIVATE mappings of a hugetlb file. This means that at mmap time, pages are reserved for the src and dst areas. At the start of event testing (and other tests) the src area is populated which results in allocation of huge pages to fill the area and consumption of reserves associated with the area. Then, a child is forked to fault in the dst area. Note that the dst area was allocated in the parent and hence the parent owns the reserves associated with the mapping. The child has normal access to the dst area, but can not use the reserves created/owned by the parent. Thus, if there are no other huge pages available allocation of a page for the dst by the child will fail. Fix by not creating reserves for the dst area. In this way the child can use free (non-reserved) pages. Also, MAP_PRIVATE of a file only makes sense if you are interested in the contents of the file before making a COW copy. The test does not do this. So, just use MAP_ANONYMOUS | MAP_HUGETLB to create an anonymous hugetlb mapping. There is no need to create a hugetlb file in the non-shared case. Link: https://lkml.kernel.org/r/20211217172919.7861-1-mike.kravetz@oracle.c= om Signed-off-by: Mike Kravetz Cc: Axel Rasmussen Cc: Peter Xu Cc: Andrea Arcangeli Cc: Mina Almasry Cc: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- tools/testing/selftests/vm/userfaultfd.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selft= ests/vm/userfaultfd.c index 60aa1a4fc69b6..81690f1737c80 100644 --- a/tools/testing/selftests/vm/userfaultfd.c +++ b/tools/testing/selftests/vm/userfaultfd.c @@ -86,7 +86,7 @@ static bool test_uffdio_minor =3D false; =20 static bool map_shared; static int shm_fd; -static int huge_fd; +static int huge_fd =3D -1; /* only used for hugetlb_shared test */ static char *huge_fd_off0; static unsigned long long *count_verify; static int uffd =3D -1; @@ -222,6 +222,9 @@ static void noop_alias_mapping(__u64 *start, size_t len= , unsigned long offset) =20 static void hugetlb_release_pages(char *rel_area) { + if (huge_fd =3D=3D -1) + return; + if (fallocate(huge_fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, rel_area =3D=3D huge_fd_off0 ? 0 : nr_pages * page_size, nr_pages * page_size)) @@ -234,16 +237,17 @@ static void hugetlb_allocate_area(void **alloc_area) char **alloc_area_alias; =20 *alloc_area =3D mmap(NULL, nr_pages * page_size, PROT_READ | PROT_WRITE, - (map_shared ? MAP_SHARED : MAP_PRIVATE) | - MAP_HUGETLB, - huge_fd, *alloc_area =3D=3D area_src ? 0 : - nr_pages * page_size); + map_shared ? MAP_SHARED : + MAP_PRIVATE | MAP_HUGETLB | + (*alloc_area =3D=3D area_src ? 0 : MAP_NORESERVE), + huge_fd, + *alloc_area =3D=3D area_src ? 0 : nr_pages * page_size); if (*alloc_area =3D=3D MAP_FAILED) err("mmap of hugetlbfs file failed"); =20 if (map_shared) { area_alias =3D mmap(NULL, nr_pages * page_size, PROT_READ | PROT_WRITE, - MAP_SHARED | MAP_HUGETLB, + MAP_SHARED, huge_fd, *alloc_area =3D=3D area_src ? 0 : nr_pages * page_size); if (area_alias =3D=3D MAP_FAILED) --=20 2.34.1 From nobody Tue Jun 30 21:17:56 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3661CC4332F for ; Mon, 10 Jan 2022 07:51:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241624AbiAJHvo (ORCPT ); Mon, 10 Jan 2022 02:51:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51144 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241189AbiAJHlp (ORCPT ); Mon, 10 Jan 2022 02:41:45 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D32B9C03327C; Sun, 9 Jan 2022 23:34:52 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7389D61194; Mon, 10 Jan 2022 07:34:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D799C36AE9; Mon, 10 Jan 2022 07:34:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800091; bh=4QZgQWBFNNkUz/DGWe8QBfWP/rrGC3n4a03vOftxdZY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wi7CcrpPsg5dxWWja17WajFkJ1w0hNyNCKdJMHRH3uf82749fkKKYn8+V8aqa3rFF KnDHf40Djqp4yq0hVf81ha+s1adjcAJOdsEfKE+ZnteYn9PVjj90fjdmPyWb3rFukL yCiyvq73jGAP8+11CJiLNa7Yi67roxmvH/06o+gc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stefan Wahren , Florian Fainelli , Jan Kiszka , Phil Elwell , Linus Walleij , Olof Johansson , Sasha Levin Subject: [PATCH 5.15 69/72] ARM: dts: gpio-ranges property is now required Date: Mon, 10 Jan 2022 08:23:46 +0100 Message-Id: <20220110071823.898925866@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Phil Elwell [ Upstream commit c8013355ead68dce152cf426686f8a5f80d88b40 ] Since [1], added in 5.7, the absence of a gpio-ranges property has prevented GPIOs from being restored to inputs when released. Add those properties for BCM283x and BCM2711 devices. [1] commit 2ab73c6d8323 ("gpio: Support GPIO controllers without pin-ranges") Link: https://lore.kernel.org/r/20220104170247.956760-1-linus.walleij@linar= o.org Fixes: 2ab73c6d8323 ("gpio: Support GPIO controllers without pin-ranges") Fixes: 266423e60ea1 ("pinctrl: bcm2835: Change init order for gpio hogs") Reported-by: Stefan Wahren Reported-by: Florian Fainelli Reported-by: Jan Kiszka Signed-off-by: Phil Elwell Acked-by: Florian Fainelli Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20211206092237.4105895-3-phil@raspberrypi.c= om Signed-off-by: Linus Walleij Acked-by: Florian Fainelli Signed-off-by: Olof Johansson Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- arch/arm/boot/dts/bcm2711.dtsi | 2 ++ arch/arm/boot/dts/bcm283x.dtsi | 2 ++ 2 files changed, 4 insertions(+) diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi index 9e01dbca4a011..dff18fc9a9065 100644 --- a/arch/arm/boot/dts/bcm2711.dtsi +++ b/arch/arm/boot/dts/bcm2711.dtsi @@ -582,6 +582,8 @@ , ; =20 + gpio-ranges =3D <&gpio 0 0 58>; + gpclk0_gpio49: gpclk0_gpio49 { pin-gpclk { pins =3D "gpio49"; diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi index a3e06b6809476..c113661a6668f 100644 --- a/arch/arm/boot/dts/bcm283x.dtsi +++ b/arch/arm/boot/dts/bcm283x.dtsi @@ -126,6 +126,8 @@ interrupt-controller; #interrupt-cells =3D <2>; =20 + gpio-ranges =3D <&gpio 0 0 54>; + /* Defines common pin muxing groups * * While each pin can have its mux selected --=20 2.34.1 From nobody Tue Jun 30 21:17:56 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B8ABC433F5 for ; Mon, 10 Jan 2022 07:48:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241435AbiAJHse (ORCPT ); Mon, 10 Jan 2022 02:48:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51194 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241603AbiAJHlv (ORCPT ); Mon, 10 Jan 2022 02:41:51 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A9E0DC03327E; Sun, 9 Jan 2022 23:34:55 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 47BE161194; Mon, 10 Jan 2022 07:34:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 302E6C36AED; Mon, 10 Jan 2022 07:34:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800094; bh=NZv5gSNC3MtaZrP/A7651LQm0HtR/srezfufRg09D5k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bNVGrboA3ABpYiBgXiAF2ic8K2Uhy6rlEsaN3oZSFvE1ZBIaSljuTR2v4RC2Ry2EE wiAGNEaaAw1xBOB6vAZ4v37uYzr8oINVeCpcuRWIyqF3LgxnisN9fCkSlZeob1OHgz utZT16FF1TcPpzOepxZgxjgpgGhY490rlHmwl4Iw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Walleij , Nikita Travkin , Dmitry Torokhov , Sasha Levin Subject: [PATCH 5.15 70/72] Input: zinitix - make sure the IRQ is allocated before it gets enabled Date: Mon, 10 Jan 2022 08:23:47 +0100 Message-Id: <20220110071823.930427846@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nikita Travkin [ Upstream commit cf73ed894ee939d6706d65e0cd186e4a64e3af6d ] Since irq request is the last thing in the driver probe, it happens later than the input device registration. This means that there is a small time window where if the open method is called the driver will attempt to enable not yet available irq. Fix that by moving the irq request before the input device registration. Reviewed-by: Linus Walleij Fixes: 26822652c85e ("Input: add zinitix touchscreen driver") Signed-off-by: Nikita Travkin Link: https://lore.kernel.org/r/20220106072840.36851-2-nikita@trvn.ru Signed-off-by: Dmitry Torokhov Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/input/touchscreen/zinitix.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/input/touchscreen/zinitix.c b/drivers/input/touchscree= n/zinitix.c index b8d901099378d..1e70b8d2a8d79 100644 --- a/drivers/input/touchscreen/zinitix.c +++ b/drivers/input/touchscreen/zinitix.c @@ -488,6 +488,15 @@ static int zinitix_ts_probe(struct i2c_client *client) return error; } =20 + error =3D devm_request_threaded_irq(&client->dev, client->irq, + NULL, zinitix_ts_irq_handler, + IRQF_ONESHOT | IRQF_NO_AUTOEN, + client->name, bt541); + if (error) { + dev_err(&client->dev, "Failed to request IRQ: %d\n", error); + return error; + } + error =3D zinitix_init_input_dev(bt541); if (error) { dev_err(&client->dev, @@ -513,15 +522,6 @@ static int zinitix_ts_probe(struct i2c_client *client) return -EINVAL; } =20 - error =3D devm_request_threaded_irq(&client->dev, client->irq, - NULL, zinitix_ts_irq_handler, - IRQF_ONESHOT | IRQF_NO_AUTOEN, - client->name, bt541); - if (error) { - dev_err(&client->dev, "Failed to request IRQ: %d\n", error); - return error; - } - return 0; } =20 --=20 2.34.1 From nobody Tue Jun 30 21:17:56 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EDEB1C433F5 for ; Mon, 10 Jan 2022 07:48:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240582AbiAJHsi (ORCPT ); Mon, 10 Jan 2022 02:48:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52192 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240774AbiAJHmF (ORCPT ); Mon, 10 Jan 2022 02:42:05 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1F3EDC03327F; Sun, 9 Jan 2022 23:35:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CFE05B81161; Mon, 10 Jan 2022 07:34:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 047D4C36AE9; Mon, 10 Jan 2022 07:34:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800097; bh=DpE+ZbuBDo/t28HF6sDMgSkYPiIXAr3H/aodqo04HhQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mf+gBc9GXVUVqfckkrAqR1qY4js1q6s3QrGawTJ8nzXhDIrh7NI6lSxndPN0dsmGd SAYuQf5YsY5DXT3EyDeKaiHvxsf0gqN/LGync/wieY1UyT0dqrOvOVA7enOQZrhcFv 8CHiLqQ8DVUNlvPeJuHe355XuAaPR/5Wwl3dajxo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guchun Chen , Andrey Grodzovsky , Christian Koenig , Alex Deucher , Len Brown , Linus Torvalds Subject: [PATCH 5.15 71/72] Revert "drm/amdgpu: stop scheduler when calling hw_fini (v2)" Date: Mon, 10 Jan 2022 08:23:48 +0100 Message-Id: <20220110071823.961031554@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Len Brown commit df5bc0aa7ff6e2e14cb75182b4eda20253c711d4 upstream. This reverts commit f7d6779df642720e22bffd449e683bb8690bd3bf. This bisected regression has impacted suspend-resume stability since 5.15-rc1. It regressed -stable via 5.14.10. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D215315 Fixes: f7d6779df64 ("drm/amdgpu: stop scheduler when calling hw_fini (v2)") Cc: Guchun Chen Cc: Andrey Grodzovsky Cc: Christian Koenig Cc: Alex Deucher Cc: # 5.14+ Signed-off-by: Len Brown Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 8 -------- 1 file changed, 8 deletions(-) --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c @@ -552,9 +552,6 @@ void amdgpu_fence_driver_hw_fini(struct if (!ring || !ring->fence_drv.initialized) continue; =20 - if (!ring->no_scheduler) - drm_sched_stop(&ring->sched, NULL); - /* You can't wait for HW to signal if it's gone */ if (!drm_dev_is_unplugged(&adev->ddev)) r =3D amdgpu_fence_wait_empty(ring); @@ -614,11 +611,6 @@ void amdgpu_fence_driver_hw_init(struct if (!ring || !ring->fence_drv.initialized) continue; =20 - if (!ring->no_scheduler) { - drm_sched_resubmit_jobs(&ring->sched); - drm_sched_start(&ring->sched, true); - } - /* enable the interrupt */ if (ring->fence_drv.irq_src) amdgpu_irq_get(adev, ring->fence_drv.irq_src, From nobody Tue Jun 30 21:17:56 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2DD47C433EF for ; Mon, 10 Jan 2022 07:48:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241487AbiAJHso (ORCPT ); Mon, 10 Jan 2022 02:48:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51724 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240478AbiAJHmH (ORCPT ); Mon, 10 Jan 2022 02:42:07 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5C4D7C02C464; Sun, 9 Jan 2022 23:35:01 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EE27B61195; Mon, 10 Jan 2022 07:35:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1225C36AED; Mon, 10 Jan 2022 07:34:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1641800100; bh=ohg4GoSO1ps3HImiu0Ef5jCTHEStxq1PJauztRyVqmU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=11k3QaaB5+WGfUHT8srCSJWjv1P/Yjyy8mDcDk6t+GEmS16HC6zdTI0YPK5Hfup5/ yEX4CAQtK5DqTmCm8ZI/Ilg4W9o2yiWhMauz48Ky2ovDwWm8vHXlRpgF8nZ5ZZGe0P qd/G+8syeP2cK1BVGQ6ZZqZJijtvDC+WPchRMtfE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Evan Quan , Alex Deucher , Guchun Chen Subject: [PATCH 5.15 72/72] drm/amd/pm: keep the BACO feature enabled for suspend Date: Mon, 10 Jan 2022 08:23:49 +0100 Message-Id: <20220110071823.999586047@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220110071821.500480371@linuxfoundation.org> References: <20220110071821.500480371@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Evan Quan commit eaa090538e8d21801c6d5f94590c3799e6a528b5 upstream. To pair with the workaround which always reset the ASIC in suspend. Otherwise, the reset which relies on BACO will fail. Fixes: daf8de0874ab5b ("drm/amdgpu: always reset the asic in suspend (v2)") Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Reviewed-by: Guchun Chen Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Linux Kernel Functional Testing Tested-by: Rudi Heitbaum Tested-by: Shuah Khan Tested-by: Sudip Mukherjee Tested-by: Zan Aziz --- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c @@ -1386,8 +1386,14 @@ static int smu_disable_dpms(struct smu_c { struct amdgpu_device *adev =3D smu->adev; int ret =3D 0; + /* + * TODO: (adev->in_suspend && !adev->in_s0ix) is added to pair + * the workaround which always reset the asic in suspend. + * It's likely that workaround will be dropped in the future. + * Then the change here should be dropped together. + */ bool use_baco =3D !smu->is_apu && - ((amdgpu_in_reset(adev) && + (((amdgpu_in_reset(adev) || (adev->in_suspend && !adev->in_s0ix)) && (amdgpu_asic_reset_method(adev) =3D=3D AMD_RESET_METHOD_BACO)) || ((adev->in_runpm || adev->in_s4) && amdgpu_asic_supports_baco(adev))); =20