From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18A4EC433F5 for ; Mon, 24 Jan 2022 18:48:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244961AbiAXSsS (ORCPT ); Mon, 24 Jan 2022 13:48:18 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47214 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235540AbiAXSsO (ORCPT ); Mon, 24 Jan 2022 13:48:14 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3FD7B614CF; Mon, 24 Jan 2022 18:48:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D801FC340E5; Mon, 24 Jan 2022 18:48:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050093; bh=xI6llgryZevp/nVf9AEsHltZv4F4p8aDwlzP7X09vS4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oVygVloGnAzJ50vZKwFg/p/1+Wtf2OU11hlNbOhy7vGhuGtFKSnVhCmibaNYH99Dl Mq8FBPZl+fqiTJGKrBV95QEI9CrAGjlRl2BY64RJhbgy24Ly9YoSEJFN2MH+C7KmLI KlZhLH/D/rpf1exvBnmaGY0sEhpORXHQoMPBmbPw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Marcel Holtmann Subject: [PATCH 4.4 001/114] Bluetooth: bfusb: fix division by zero in send path Date: Mon, 24 Jan 2022 19:41:36 +0100 Message-Id: <20220124183927.147715568@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit b5e6fa7a12572c82f1e7f2f51fbb02a322291291 upstream. Add the missing bulk-out endpoint sanity check to probe() to avoid division by zero in bfusb_send_frame() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=3D0")). Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/bluetooth/bfusb.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/bluetooth/bfusb.c +++ b/drivers/bluetooth/bfusb.c @@ -645,6 +645,9 @@ static int bfusb_probe(struct usb_interf data->bulk_out_ep =3D bulk_out_ep->desc.bEndpointAddress; data->bulk_pkt_size =3D le16_to_cpu(bulk_out_ep->desc.wMaxPacketSize); =20 + if (!data->bulk_pkt_size) + goto done; + rwlock_init(&data->lock); =20 data->reassembly =3D NULL; From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4451BC433EF for ; Mon, 24 Jan 2022 18:48:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245311AbiAXSse (ORCPT ); Mon, 24 Jan 2022 13:48:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42506 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245274AbiAXSs0 (ORCPT ); Mon, 24 Jan 2022 13:48:26 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 21AD0C061401; Mon, 24 Jan 2022 10:48:26 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CC497B81214; Mon, 24 Jan 2022 18:48:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DCF10C340E5; Mon, 24 Jan 2022 18:48:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050103; bh=fZdxtjsP9F4pYFdU33TBh0qEMt10NcGpyNRNnIcGzIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BYO9myR5zPG5Cu5rgyXUxcjHLnCqWRsEyQzqB/6QqNHw6rfKnQTFhegEu9cqPSmic AX87rSGE1tHzdvS46VNwjORFE1Vq4AkzCRxsBNA5tIPCaGW+owbUCG8oN/h67XMUdf fXynujkqmlaaJgldocx1zw2Lz6wMOfqYT7FztQMA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan McDowell , Alan Stern Subject: [PATCH 4.4 002/114] USB: core: Fix bug in resuming hubs handling of wakeup requests Date: Mon, 24 Jan 2022 19:41:37 +0100 Message-Id: <20220124183927.176753026@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 0f663729bb4afc92a9986b66131ebd5b8a9254d1 upstream. Bugzilla #213839 reports a 7-port hub that doesn't work properly when devices are plugged into some of the ports; the kernel goes into an unending disconnect/reinitialize loop as shown in the bug report. This "7-port hub" comprises two four-port hubs with one plugged into the other; the failures occur when a device is plugged into one of the downstream hub's ports. (These hubs have other problems too. For example, they bill themselves as USB-2.0 compliant but they only run at full speed.) It turns out that the failures are caused by bugs in both the kernel and the hub. The hub's bug is that it reports a different bmAttributes value in its configuration descriptor following a remote wakeup (0xe0 before, 0xc0 after -- the wakeup-support bit has changed). The kernel's bug is inside the hub driver's resume handler. When hub_activate() sees that one of the hub's downstream ports got a wakeup request from a child device, it notes this fact by setting the corresponding bit in the hub->change_bits variable. But this variable is meant for connection changes, not wakeup events; setting it causes the driver to believe the downstream port has been disconnected and then connected again (in addition to having received a wakeup request). Because of this, the hub driver then tries to check whether the device currently plugged into the downstream port is the same as the device that had been attached there before. Normally this check succeeds and wakeup handling continues with no harm done (which is why the bug remained undetected until now). But with these dodgy hubs, the check fails because the config descriptor has changed. This causes the hub driver to reinitialize the child device, leading to the disconnect/reinitialize loop described in the bug report. The proper way to note reception of a downstream wakeup request is to set a bit in the hub->event_bits variable instead of hub->change_bits. That way the hub driver will realize that something has happened to the port but will not think the port and child device have been disconnected. This patch makes that change. Cc: Tested-by: Jonathan McDowell Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YdCw7nSfWYPKWQoD@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/usb/core/hub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1169,7 +1169,7 @@ static void hub_activate(struct usb_hub */ if (portchange || (hub_is_superspeed(hub->hdev) && port_resumed)) - set_bit(port1, hub->change_bits); + set_bit(port1, hub->event_bits); =20 } else if (udev->persist_enabled) { #ifdef CONFIG_PM From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9ED1CC433FE for ; Mon, 24 Jan 2022 18:48:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245298AbiAXSs3 (ORCPT ); Mon, 24 Jan 2022 13:48:29 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47378 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245261AbiAXSs1 (ORCPT ); Mon, 24 Jan 2022 13:48:27 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 50590614CF; Mon, 24 Jan 2022 18:48:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13C07C340E5; Mon, 24 Jan 2022 18:48:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050106; bh=nMY3jNJlD6R1fXSSHrV1arx8jCTkhdTfQMrJ4L7TSn8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J4di5Kff7FxG3x/j90L8bFKSceSZER39GPFEmm4tmDL6ZVF8CBlj5KVRGb6qhlKgN sAx/mA3lJkDYoZXyKF24XYZ9g1O9X5KvGkSfhsGEpE/j0kllWgENc71gAl/lfM973g Xsye0Zi4GuOS4o3aiSAwiSU2ExeV5bOiipm/TjXA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , syzbot+3ae6a2b06f131ab9849f@syzkaller.appspotmail.com Subject: [PATCH 4.4 003/114] USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status Date: Mon, 24 Jan 2022 19:41:38 +0100 Message-Id: <20220124183927.207781595@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 1d7d4c07932e04355d6e6528d44a2f2c9e354346 upstream. When the USB core code for getting root-hub status reports was originally written, it was assumed that the hub driver would be its only caller. But this isn't true now; user programs can use usbfs to communicate with root hubs and get status reports. When they do this, they may use a transfer_buffer that is smaller than the data returned by the HCD, which will lead to a buffer overflow error when usb_hcd_poll_rh_status() tries to store the status data. This was discovered by syzbot: BUG: KASAN: slab-out-of-bounds in memcpy include/linux/fortify-string.h:225= [inline] BUG: KASAN: slab-out-of-bounds in usb_hcd_poll_rh_status+0x5f4/0x780 driver= s/usb/core/hcd.c:776 Write of size 2 at addr ffff88801da403c0 by task syz-executor133/4062 This patch fixes the bug by reducing the amount of status data if it won't fit in the transfer_buffer. If some data gets discarded then the URB's completion status is set to -EOVERFLOW rather than 0, to let the user know what happened. Reported-and-tested-by: syzbot+3ae6a2b06f131ab9849f@syzkaller.appspotmail.c= om Signed-off-by: Alan Stern Cc: Link: https://lore.kernel.org/r/Yc+3UIQJ2STbxNua@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/usb/core/hcd.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -731,6 +731,7 @@ void usb_hcd_poll_rh_status(struct usb_h { struct urb *urb; int length; + int status; unsigned long flags; char buffer[6]; /* Any root hubs with > 31 ports? */ =20 @@ -748,11 +749,17 @@ void usb_hcd_poll_rh_status(struct usb_h if (urb) { clear_bit(HCD_FLAG_POLL_PENDING, &hcd->flags); hcd->status_urb =3D NULL; + if (urb->transfer_buffer_length >=3D length) { + status =3D 0; + } else { + status =3D -EOVERFLOW; + length =3D urb->transfer_buffer_length; + } urb->actual_length =3D length; memcpy(urb->transfer_buffer, buffer, length); =20 usb_hcd_unlink_urb_from_ep(hcd, urb); - usb_hcd_giveback_urb(hcd, urb, 0); + usb_hcd_giveback_urb(hcd, urb, status); } else { length =3D 0; set_bit(HCD_FLAG_POLL_PENDING, &hcd->flags); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D9F3C433F5 for ; Mon, 24 Jan 2022 18:48:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245322AbiAXSsi (ORCPT ); Mon, 24 Jan 2022 13:48:38 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:49012 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235540AbiAXSsc (ORCPT ); Mon, 24 Jan 2022 13:48:32 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2CCC5B81215; Mon, 24 Jan 2022 18:48:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E6D9C340E5; Mon, 24 Jan 2022 18:48:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050109; bh=+bmhEDGX3R6kR6lLlbmkW2uZJfDH5wEcAdJyMWaPorc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gEQhwT+kJGpELktgfqOg21WC0PGtT4E+LKh41qHVD/8Buw+Z9xsk2UBL61i+FOjwX pEed+BXd3cjRiQEZ2gC8qxA7z6oPB5gW5aqsqTVJK+jwG3jroZD36h2rqQZ4sEA4yc ZaARfg14xP4rLPignRe+U7gBAXBrsRpQsxWMhFgA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Orlando Chamberlain , Aditya Garg , Andy Shevchenko , Lee Jones Subject: [PATCH 4.4 004/114] mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() Date: Mon, 24 Jan 2022 19:41:39 +0100 Message-Id: <20220124183927.236477614@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andy Shevchenko commit c9e143084d1a602f829115612e1ec79df3727c8b upstream. The runtime PM callback may be called as soon as the runtime PM facility is enabled and activated. It means that ->suspend() may be called before we finish probing the device in the ACPI case. Hence, NULL pointer dereference: intel-lpss INT34BA:00: IRQ index 0 not found BUG: kernel NULL pointer dereference, address: 0000000000000030 ... Workqueue: pm pm_runtime_work RIP: 0010:intel_lpss_suspend+0xb/0x40 [intel_lpss] To fix this, first try to register the device and only after that enable runtime PM facility. Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices") Reported-by: Orlando Chamberlain Reported-by: Aditya Garg Signed-off-by: Andy Shevchenko Tested-by: Aditya Garg Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20211101190008.86473-1-andriy.shevchenko@li= nux.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/mfd/intel-lpss-acpi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/mfd/intel-lpss-acpi.c +++ b/drivers/mfd/intel-lpss-acpi.c @@ -53,6 +53,7 @@ static int intel_lpss_acpi_probe(struct { struct intel_lpss_platform_info *info; const struct acpi_device_id *id; + int ret; =20 id =3D acpi_match_device(intel_lpss_acpi_ids, &pdev->dev); if (!id) @@ -66,10 +67,14 @@ static int intel_lpss_acpi_probe(struct info->mem =3D platform_get_resource(pdev, IORESOURCE_MEM, 0); info->irq =3D platform_get_irq(pdev, 0); =20 + ret =3D intel_lpss_probe(&pdev->dev, info); + if (ret) + return ret; + pm_runtime_set_active(&pdev->dev); pm_runtime_enable(&pdev->dev); =20 - return intel_lpss_probe(&pdev->dev, info); + return 0; } =20 static int intel_lpss_acpi_remove(struct platform_device *pdev) From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8A92C433F5 for ; Mon, 24 Jan 2022 18:48:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245305AbiAXSsk (ORCPT ); Mon, 24 Jan 2022 13:48:40 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47472 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245302AbiAXSse (ORCPT ); Mon, 24 Jan 2022 13:48:34 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A7234614D3; Mon, 24 Jan 2022 18:48:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 84374C340E7; Mon, 24 Jan 2022 18:48:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050113; bh=ho7wKvkVIpbD7sEtMiMwC/ysSJIQtTHmgu5Pt2C+TQc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0aHpB3sSBd3xd6U2R/La3n/pkG1gASK/qIj0TwxOZ1K22Nidx17X9exGGo2B6N5Yf Np1uDczdZ1M0OS09/KmIORM9D3b6CVmUTngPbFkNoQ20UppRZYjxh+B4uFbFvSHnjV 3+MEqhTsA5Tt1FcpAUaroSD71hU53msL8O/Z4mOE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Kleine-Budde Subject: [PATCH 4.4 005/114] can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data Date: Mon, 24 Jan 2022 19:41:40 +0100 Message-Id: <20220124183927.268223177@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marc Kleine-Budde commit 4a8737ff068724f509d583fef404d349adba80d6 upstream. The received data contains the channel the received data is associated with. If the channel number is bigger than the actual number of channels assume broken or malicious USB device and shut it down. This fixes the error found by clang: | drivers/net/can/usb/gs_usb.c:386:6: error: variable 'dev' is used | uninitialized whenever 'if' condition= is true | if (hf->channel >=3D GS_MAX_INTF) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ | drivers/net/can/usb/gs_usb.c:474:10: note: uninitialized use occurs here | hf, dev->gs_hf_size, gs_usb_receive_bulk_callba= ck, | ^~~ Link: https://lore.kernel.org/all/20211210091158.408326-1-mkl@pengutronix.de Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices= ") Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/can/usb/gs_usb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -303,7 +303,7 @@ static void gs_usb_receive_bulk_callback =20 /* device reports out of range channel id */ if (hf->channel >=3D GS_MAX_INTF) - goto resubmit_urb; + goto device_detach; =20 dev =3D usbcan->canch[hf->channel]; =20 @@ -388,6 +388,7 @@ static void gs_usb_receive_bulk_callback =20 /* USB failure take down all interfaces */ if (rc =3D=3D -ENODEV) { + device_detach: for (rc =3D 0; rc < GS_MAX_INTF; rc++) { if (usbcan->canch[rc]) netif_device_detach(usbcan->canch[rc]->netdev); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 917F2C433FE for ; Mon, 24 Jan 2022 18:48:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245339AbiAXSsm (ORCPT ); Mon, 24 Jan 2022 13:48:42 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47516 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245301AbiAXSsh (ORCPT ); Mon, 24 Jan 2022 13:48:37 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D1F43614CF; Mon, 24 Jan 2022 18:48:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 94B0FC340E5; Mon, 24 Jan 2022 18:48:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050116; bh=zXZqooNsn6dotO0Osq4gZQFYjp/nmPUV2HQM6evi2vw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TysifGG6tEOtOVAj5GRQHun4Ca9P2CbluWEUnaP6u/HHG5ONumSRErajKrA509cM1 rreOiy3yw8IqxEFCgRO9N97ayZPlV5t4TBbpBZ4gM272e5LxvOED4uVxSM6u+Ty39P ySFgjQzZi+urjWVOOOf5Oglh+UiW2wA+aaG7sbd8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brian Silverman , Marc Kleine-Budde Subject: [PATCH 4.4 006/114] can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} Date: Mon, 24 Jan 2022 19:41:41 +0100 Message-Id: <20220124183927.297779769@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Brian Silverman commit 89d58aebe14a365c25ba6645414afdbf4e41cea4 upstream. No information is deliberately sent in hf->flags in host -> device communications, but the open-source candleLight firmware echoes it back, which can result in the GS_CAN_FLAG_OVERFLOW flag being set and generating spurious ERRORFRAMEs. While there also initialize the reserved member with 0. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices= ") Link: https://lore.kernel.org/all/20220106002952.25883-1-brian.silverman@bl= uerivertech.com Link: https://github.com/candle-usb/candleLight_fw/issues/87 Cc: stable@vger.kernel.org Signed-off-by: Brian Silverman [mkl: initialize the reserved member, too] Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/can/usb/gs_usb.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -491,6 +491,8 @@ static netdev_tx_t gs_can_start_xmit(str =20 hf->echo_id =3D idx; hf->channel =3D dev->channel; + hf->flags =3D 0; + hf->reserved =3D 0; =20 cf =3D (struct can_frame *)skb->data; =20 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B975C433EF for ; Mon, 24 Jan 2022 18:48:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245371AbiAXSsq (ORCPT ); Mon, 24 Jan 2022 13:48:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42590 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245278AbiAXSsk (ORCPT ); Mon, 24 Jan 2022 13:48:40 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 74195C06173D; Mon, 24 Jan 2022 10:48:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0B078614CF; Mon, 24 Jan 2022 18:48:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BCF94C340E5; Mon, 24 Jan 2022 18:48:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050119; bh=uRF9XUPN3tK2QLeoChtYaMbHzw3CLplJcZHjEbZyBPM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OgY/5zG+hkNKRDMTR9MQMeU6G38XDhkS9EJNYea1VeaHxWE90agKLt3Y7MsNKVOGq WQ8v+fCqQ3s6Yx1M6LiT7wIVzBezEOJe8ocWQsF7HRyTnBm25fzoaVcq/KuilRl8cQ 8EWkIFM17PaZIW1AOeVOPRi+4pA8ZySuZHFdf5Xo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nick Desaulniers , Nathan Chancellor , =?UTF-8?q?D=C3=A1vid=20Bolvansk=C3=BD?= , =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= Subject: [PATCH 4.4 007/114] drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() Date: Mon, 24 Jan 2022 19:41:42 +0100 Message-Id: <20220124183927.335717809@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Nathan Chancellor commit 2e70570656adfe1c5d9a29940faa348d5f132199 upstream. A new warning in clang points out a place in this file where a bitwise OR is being used with boolean types: drivers/gpu/drm/i915/intel_pm.c:3066:12: warning: use of bitwise '|' with b= oolean operands [-Wbitwise-instead-of-logical] changed =3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_late= ncy, 12) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~= ~~~~~~~~ This construct is intentional, as it allows every one of the calls to ilk_increase_wm_latency() to occur (instead of short circuiting with logical OR) while still caring about the result of each call. To make this clearer to the compiler, use the '|=3D' operator to assign the result of each ilk_increase_wm_latency() call to changed, which keeps the meaning of the code the same but makes it obvious that every one of these calls is expected to happen. Link: https://github.com/ClangBuiltLinux/linux/issues/1473 Reported-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Suggested-by: D=C3=A1vid Bolvansk=C3=BD Reviewed-by: Nick Desaulniers Signed-off-by: Ville Syrj=C3=A4l=C3=A4 Link: https://patchwork.freedesktop.org/patch/msgid/20211014211916.3550122-= 1-nathan@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/gpu/drm/i915/intel_pm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/gpu/drm/i915/intel_pm.c +++ b/drivers/gpu/drm/i915/intel_pm.c @@ -2245,9 +2245,9 @@ static void snb_wm_latency_quirk(struct * The BIOS provided WM memory latency values are often * inadequate for high resolution displays. Adjust them. */ - changed =3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 1= 2) | - ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, 12) | - ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, 12); + changed =3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 1= 2); + changed |=3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, = 12); + changed |=3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, = 12); =20 if (!changed) return; From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13595C433FE for ; Mon, 24 Jan 2022 18:48:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245345AbiAXSsz (ORCPT ); Mon, 24 Jan 2022 13:48:55 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47614 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245340AbiAXSsn (ORCPT ); Mon, 24 Jan 2022 13:48:43 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3519D61416; Mon, 24 Jan 2022 18:48:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E8271C340E8; Mon, 24 Jan 2022 18:48:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050122; bh=RoT97sJ2p8YHjXNgXCWaVwIVja5oWHhlP6Oms3XYLtM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HsHldEj0/4XpF9J0ZCUguCnL2VKmjoxJbV6H+f+8df84Q1XQ8256GoAYfUBk6suNc KPvcFX9wnH6POzrjCcHoSz+phfbpzbzlTLFQCfpdPJvN10pGfR/lvcu32AJcv5ms+O 3TbKTRyANecChuOnaj7mQ2/J2QzocGDedJP60Isc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Kieran Bingham , Laurent Pinchart , Mauro Carvalho Chehab Subject: [PATCH 4.4 008/114] media: uvcvideo: fix division by zero at stream start Date: Mon, 24 Jan 2022 19:41:43 +0100 Message-Id: <20220124183927.366521160@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 8aa637bf6d70d2fb2ad4d708d8b9dd02b1c095df upstream. Add the missing bulk-endpoint max-packet sanity check to uvc_video_start_transfer() to avoid division by zero in uvc_alloc_urb_buffers() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=3D0")). Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver") Cc: stable@vger.kernel.org # 2.6.26 Signed-off-by: Johan Hovold Reviewed-by: Kieran Bingham Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/usb/uvc/uvc_video.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/media/usb/uvc/uvc_video.c +++ b/drivers/media/usb/uvc/uvc_video.c @@ -1720,6 +1720,10 @@ static int uvc_init_video(struct uvc_str if (ep =3D=3D NULL) return -EIO; =20 + /* Reject broken descriptors. */ + if (usb_endpoint_maxp(&ep->desc) =3D=3D 0) + return -EIO; + ret =3D uvc_init_video_bulk(stream, ep, gfp_flags); } =20 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF403C433F5 for ; Mon, 24 Jan 2022 18:48:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245368AbiAXSs5 (ORCPT ); Mon, 24 Jan 2022 13:48:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42624 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245377AbiAXSsr (ORCPT ); Mon, 24 Jan 2022 13:48:47 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D7E21C06174E; Mon, 24 Jan 2022 10:48:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7774E614D2; Mon, 24 Jan 2022 18:48:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3966FC340E5; Mon, 24 Jan 2022 18:48:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050125; bh=QfarPiVgXBow03SHAwVUG8GJFtXp44kl0h/whqEL1x4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZGurtKgpEPqax5/faVx0wJor8oP8uMZdSJWYxgRdlhgxRLeuRYXxVuK3SZ1MMoKTg Kgcsq7pFqza7TPK0RMIBkW25z54Prf60DH0onifQI2vgn1QW4hCJ4r/wKYb6P+Hc/Y E2uTpO9sNlUjib3wYtfF2QP7hBtNJgoRIByeDv6o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+cce1ee31614c171f5595@syzkaller.appspotmail.com, Larry Finger , Kalle Valo Subject: [PATCH 4.4 009/114] rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled Date: Mon, 24 Jan 2022 19:41:44 +0100 Message-Id: <20220124183927.398997426@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Larry Finger commit 8b144dedb928e4e2f433a328d58f44c3c098d63e upstream. Syzbot reports the following WARNING: [200~raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 1 PID: 1206 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x1d/0x20 kernel/locking/irqflag-debug.c:10 Hardware initialization for the rtl8188cu can run for as long as 350 ms, and the routine may be called with interrupts disabled. To avoid locking the machine for this long, the current routine saves the interrupt flags and enables local interrupts. The problem is that it restores the flags at the end without disabling local interrupts first. This patch fixes commit a53268be0cb9 ("rtlwifi: rtl8192cu: Fix too long disable of IRQs"). Reported-by: syzbot+cce1ee31614c171f5595@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Fixes: a53268be0cb9 ("rtlwifi: rtl8192cu: Fix too long disable of IRQs") Signed-off-by: Larry Finger Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20211215171105.20623-1-Larry.Finger@lwfinge= r.net Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c @@ -1062,6 +1062,7 @@ int rtl92cu_hw_init(struct ieee80211_hw _InitPABias(hw); rtl92c_dm_init(hw); exit: + local_irq_disable(); local_irq_restore(flags); return err; } From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5BC40C433FE for ; Mon, 24 Jan 2022 18:48:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245172AbiAXSsU (ORCPT ); Mon, 24 Jan 2022 13:48:20 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:48868 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235540AbiAXSsT (ORCPT ); Mon, 24 Jan 2022 13:48:19 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 49CCFB8121B; Mon, 24 Jan 2022 18:48:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 51ECAC340E8; Mon, 24 Jan 2022 18:48:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050097; bh=XjFCQMtChNzQu+/wivrPl0tpf7DCbKXansZw5loAbeM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uu5tBXgzZoaOFJsUhecAnczwUjdm5M/Q0GwFLmShqZ0jdvswJCXqmpY8n8/Jdqkb6 8VaO+P/SzWIirECeeD2+FcChsM5LM8hq29hzxJak9jXfgRv44si/Da2d10gLL7g1nI Td+Fo0m+Lf8fNhZQ6j/IWARQJnTUJ8ZVj3Z00Ou0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jann Horn , Jiri Kosina Subject: [PATCH 4.4 010/114] HID: uhid: Fix worker destroying device without any protection Date: Mon, 24 Jan 2022 19:41:45 +0100 Message-Id: <20220124183927.428429200@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jann Horn commit 4ea5763fb79ed89b3bdad455ebf3f33416a81624 upstream. uhid has to run hid_add_device() from workqueue context while allowing parallel use of the userspace API (which is protected with ->devlock). But hid_add_device() can fail. Currently, that is handled by immediately destroying the associated HID device, without using ->devlock - but if there are concurrent requests from userspace, that's wrong and leads to NULL dereferences and/or memory corruption (via use-after-free). Fix it by leaving the HID device as-is in the worker. We can clean it up later, either in the UHID_DESTROY command handler or in the ->release() handler. Cc: stable@vger.kernel.org Fixes: 67f8ecc550b5 ("HID: uhid: fix timeout when probe races with IO") Signed-off-by: Jann Horn Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/hid/uhid.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) --- a/drivers/hid/uhid.c +++ b/drivers/hid/uhid.c @@ -33,11 +33,22 @@ =20 struct uhid_device { struct mutex devlock; + + /* This flag tracks whether the HID device is usable for commands from + * userspace. The flag is already set before hid_add_device(), which + * runs in workqueue context, to allow hid_add_device() to communicate + * with userspace. + * However, if hid_add_device() fails, the flag is cleared without + * holding devlock. + * We guarantee that if @running changes from true to false while you're + * holding @devlock, it's still fine to access @hid. + */ bool running; =20 __u8 *rd_data; uint rd_size; =20 + /* When this is NULL, userspace may use UHID_CREATE/UHID_CREATE2. */ struct hid_device *hid; struct uhid_event input_buf; =20 @@ -68,9 +79,18 @@ static void uhid_device_add_worker(struc if (ret) { hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret); =20 - hid_destroy_device(uhid->hid); - uhid->hid =3D NULL; + /* We used to call hid_destroy_device() here, but that's really + * messy to get right because we have to coordinate with + * concurrent writes from userspace that might be in the middle + * of using uhid->hid. + * Just leave uhid->hid as-is for now, and clean it up when + * userspace tries to close or reinitialize the uhid instance. + * + * However, we do have to clear the ->running flag and do a + * wakeup to make sure userspace knows that the device is gone. + */ uhid->running =3D false; + wake_up_interruptible(&uhid->report_wait); } } =20 @@ -479,7 +499,7 @@ static int uhid_dev_create2(struct uhid_ void *rd_data; int ret; =20 - if (uhid->running) + if (uhid->hid) return -EALREADY; =20 rd_size =3D ev->u.create2.rd_size; @@ -560,7 +580,7 @@ static int uhid_dev_create(struct uhid_d =20 static int uhid_dev_destroy(struct uhid_device *uhid) { - if (!uhid->running) + if (!uhid->hid) return -EINVAL; =20 uhid->running =3D false; @@ -569,6 +589,7 @@ static int uhid_dev_destroy(struct uhid_ cancel_work_sync(&uhid->worker); =20 hid_destroy_device(uhid->hid); + uhid->hid =3D NULL; kfree(uhid->rd_data); =20 return 0; From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 220FFC433F5 for ; Mon, 24 Jan 2022 18:48:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245271AbiAXSsZ (ORCPT ); Mon, 24 Jan 2022 13:48:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42488 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235540AbiAXSsX (ORCPT ); Mon, 24 Jan 2022 13:48:23 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5A359C06173B; Mon, 24 Jan 2022 10:48:23 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7CA8FB8121A; Mon, 24 Jan 2022 18:48:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9B197C340E5; Mon, 24 Jan 2022 18:48:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050100; bh=n0JbKfVUq1IzLFlzhSKwNzRT5+5ToC4oVt76U2YoAJQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rTaT6vYslAMR/8tMzVe4NP6u8588Px2DwAaJzL7AbrK2rcpScSGVD47HGDClcRVPA oDJK6ws6IzhB28kKsWnzAZm7a4ulEwLpY8Mdu5aOJLQYVxDGYG4rzOaprUynAqYhx4 PsvFlVKDILIJ3FI8ldvLdyYMdcGS8d3qWDv2vkrM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , "David S. Miller" , syzbot+7f23bcddf626e0593a39@syzkaller.appspotmail.com Subject: [PATCH 4.4 011/114] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() Date: Mon, 24 Jan 2022 19:41:46 +0100 Message-Id: <20220124183927.460711078@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski commit dded08927ca3c31a5c37f8e7f95fe98770475dd4 upstream. Syzbot detected a NULL pointer dereference of nfc_llcp_sock->dev pointer (which is a 'struct nfc_dev *') with calls to llcp_sock_sendmsg() after a failed llcp_sock_bind(). The message being sent is a SOCK_DGRAM. KASAN report: BUG: KASAN: null-ptr-deref in nfc_alloc_send_skb+0x2d/0xc0 Read of size 4 at addr 00000000000005c8 by task llcp_sock_nfc_a/899 CPU: 5 PID: 899 Comm: llcp_sock_nfc_a Not tainted 5.16.0-rc6-next-2021122= 4-00001-gc6437fbf18b0 #125 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/0= 1/2014 Call Trace: dump_stack_lvl+0x45/0x59 ? nfc_alloc_send_skb+0x2d/0xc0 __kasan_report.cold+0x117/0x11c ? mark_lock+0x480/0x4f0 ? nfc_alloc_send_skb+0x2d/0xc0 kasan_report+0x38/0x50 nfc_alloc_send_skb+0x2d/0xc0 nfc_llcp_send_ui_frame+0x18c/0x2a0 ? nfc_llcp_send_i_frame+0x230/0x230 ? __local_bh_enable_ip+0x86/0xe0 ? llcp_sock_connect+0x470/0x470 ? llcp_sock_connect+0x470/0x470 sock_sendmsg+0x8e/0xa0 ____sys_sendmsg+0x253/0x3f0 ... The issue was visible only with multiple simultaneous calls to bind() and sendmsg(), which resulted in most of the bind() calls to fail. The bind() was failing on checking if there is available WKS/SDP/SAP (respective bit in 'struct nfc_llcp_local' fields). When there was no available WKS/SDP/SAP, the bind returned error but the sendmsg() to such socket was able to trigger mentioned NULL pointer dereference of nfc_llcp_sock->dev. The code looks simply racy and currently it protects several paths against race with checks for (!nfc_llcp_sock->local) which is NULL-ified in error paths of bind(). The llcp_sock_sendmsg() did not have such check but called function nfc_llcp_send_ui_frame() had, although not protected with lock_sock(). Therefore the race could look like (same socket is used all the time): CPU0 CPU1 =3D=3D=3D=3D =3D=3D=3D=3D llcp_sock_bind() - lock_sock() - success - release_sock() - return 0 llcp_sock_sendmsg() - lock_sock() - release_sock() llcp_sock_bind(), same socket - lock_sock() - error - nfc_llcp_send_ui_frame() - if (!llcp_sock->local) - llcp_sock->local =3D NULL - nfc_put_device(dev) - dereference llcp_sock->dev - release_sock() - return -ERRNO The nfc_llcp_send_ui_frame() checked llcp_sock->local outside of the lock, which is racy and ineffective check. Instead, its caller llcp_sock_sendmsg(), should perform the check inside lock_sock(). Reported-and-tested-by: syzbot+7f23bcddf626e0593a39@syzkaller.appspotmail.c= om Fixes: b874dec21d1c ("NFC: Implement LLCP connection less Tx path") Cc: Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- net/nfc/llcp_sock.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -790,6 +790,11 @@ static int llcp_sock_sendmsg(struct sock =20 lock_sock(sk); =20 + if (!llcp_sock->local) { + release_sock(sk); + return -ENODEV; + } + if (sk->sk_type =3D=3D SOCK_DGRAM) { DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr, msg->msg_name); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17997C433EF for ; Mon, 24 Jan 2022 18:52:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245580AbiAXSwL (ORCPT ); Mon, 24 Jan 2022 13:52:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43270 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343598AbiAXSvG (ORCPT ); Mon, 24 Jan 2022 13:51:06 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D62ECC061797; Mon, 24 Jan 2022 10:50:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 93094B810BD; Mon, 24 Jan 2022 18:50:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B3126C340E5; Mon, 24 Jan 2022 18:50:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050242; bh=Z61lJENDMxEpYURPDCUWyB6NKwLICZ+bTHmh4lU0xC4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mm5wWVaFtotYrn1GrH9QTS3Gn3r/gGW8UtZGroTdWIYaUjdaLyvIVvMJeRB9QmOPQ jbG/w5scnhyvpYg5XU2dGffDRWbTcgHqbRQ4Io+Jl94dqZrQiBp1hb540m1qGbs+Jn Z0phDjooTHfzIvs1tjoqeyDXvSAcjtxUK2BwyzQM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Mateusz=20Jo=C5=84czyk?= , Nobuhiro Iwamatsu , Alessandro Zummo , Alexandre Belloni Subject: [PATCH 4.4 012/114] rtc: cmos: take rtc_lock while reading from CMOS Date: Mon, 24 Jan 2022 19:41:47 +0100 Message-Id: <20220124183927.492636970@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mateusz Jo=C5=84czyk commit 454f47ff464325223129b9b5b8d0b61946ec704d upstream. Reading from the CMOS involves writing to the index register and then reading from the data register. Therefore access to the CMOS has to be serialized with rtc_lock. This invocation of CMOS_READ was not serialized, which could cause trouble when other code is accessing CMOS at the same time. Use spin_lock_irq() like the rest of the function. Nothing in kernel modifies the RTC_DM_BINARY bit, so there could be a separate pair of spin_lock_irq() / spin_unlock_irq() before doing the math. Signed-off-by: Mateusz Jo=C5=84czyk Reviewed-by: Nobuhiro Iwamatsu Cc: Alessandro Zummo Cc: Alexandre Belloni Cc: stable@vger.kernel.org Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20211210200131.153887-2-mat.jonczyk@o2.pl Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/rtc/rtc-cmos.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/rtc/rtc-cmos.c +++ b/drivers/rtc/rtc-cmos.c @@ -343,7 +343,10 @@ static int cmos_set_alarm(struct device min =3D t->time.tm_min; sec =3D t->time.tm_sec; =20 + spin_lock_irq(&rtc_lock); rtc_control =3D CMOS_READ(RTC_CONTROL); + spin_unlock_irq(&rtc_lock); + if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) { /* Writing 0xff means "don't care" or "match all". */ mon =3D (mon <=3D 12) ? bin2bcd(mon) : 0xff; From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC10CC433EF for ; Mon, 24 Jan 2022 18:49:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241940AbiAXStZ (ORCPT ); Mon, 24 Jan 2022 13:49:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42660 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245332AbiAXSsz (ORCPT ); Mon, 24 Jan 2022 13:48:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BAE8CC06173D; Mon, 24 Jan 2022 10:48:54 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 83352B8121A; Mon, 24 Jan 2022 18:48:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C8F7C340E5; Mon, 24 Jan 2022 18:48:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050132; bh=LTmjrOQuGbGFxf9tbR9lV6bPJ6MV/ExjurJHeVNmXqM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FWLuMSo+fFKMtT1PByX8SANHrm0i4oPmU9E35J34TzafE1laDUQ8qeC+6uimVEQqo 4MR1P20vMJGbwrlKiG3g19h42u0gDK28BfluKwhIM1KAD3mwc08zx8Zm36y4w9okBI D1nZ5eQBVzDW2TdXj80McgpvgJnpsQinJY7tRYCE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.4 013/114] media: mceusb: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:48 +0100 Message-Id: <20220124183927.523864117@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 16394e998cbb050730536bdf7e89f5a70efbd974 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") Cc: stable@vger.kernel.org # 2.6.36 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/rc/mceusb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/media/rc/mceusb.c +++ b/drivers/media/rc/mceusb.c @@ -1118,7 +1118,7 @@ static void mceusb_gen1_init(struct mceu */ ret =3D usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0), USB_REQ_SET_ADDRESS, USB_TYPE_VENDOR, 0, 0, - data, USB_CTRL_MSG_SZ, HZ * 3); + data, USB_CTRL_MSG_SZ, 3000); dev_dbg(dev, "set address - ret =3D %d", ret); dev_dbg(dev, "set address - data[0] =3D %d, data[1] =3D %d", data[0], data[1]); @@ -1126,20 +1126,20 @@ static void mceusb_gen1_init(struct mceu /* set feature: bit rate 38400 bps */ ret =3D usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), USB_REQ_SET_FEATURE, USB_TYPE_VENDOR, - 0xc04e, 0x0000, NULL, 0, HZ * 3); + 0xc04e, 0x0000, NULL, 0, 3000); =20 dev_dbg(dev, "set feature - ret =3D %d", ret); =20 /* bRequest 4: set char length to 8 bits */ ret =3D usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), 4, USB_TYPE_VENDOR, - 0x0808, 0x0000, NULL, 0, HZ * 3); + 0x0808, 0x0000, NULL, 0, 3000); dev_dbg(dev, "set char length - retB =3D %d", ret); =20 /* bRequest 2: set handshaking to use DTR/DSR */ ret =3D usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), 2, USB_TYPE_VENDOR, - 0x0000, 0x0100, NULL, 0, HZ * 3); + 0x0000, 0x0100, NULL, 0, 3000); dev_dbg(dev, "set handshake - retC =3D %d", ret); =20 /* device resume */ From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8A3CC433EF for ; Mon, 24 Jan 2022 18:50:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232425AbiAXSuZ (ORCPT ); Mon, 24 Jan 2022 13:50:25 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:49550 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245487AbiAXSt3 (ORCPT ); Mon, 24 Jan 2022 13:49:29 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BB6B6B8121A; Mon, 24 Jan 2022 18:49:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D552DC340E8; Mon, 24 Jan 2022 18:49:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050167; bh=MH0E6NCxT8S0JirUSBlxUe9H0Emh2ArelTUEIROEmLs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j/qFVMPpL+T9rEI8FjSFew5b4iyA56JOFoDk56L7JCrfIBqqYB1odrWw/NB3LeCxq zMDhj0Zy2uxmWmYix5IcM2Usi486bk8k3B3z14Xk9Yi2hjbVxAJJdq44Ygg5/C43cl ZoNKitaYmWv8fv6q4AVRRUbrixkbRJdyZ6kbPCto= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.4 014/114] media: em28xx: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:49 +0100 Message-Id: <20220124183927.552845234@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit d9b7e8df3aa9b8c10708aab60e72e79ac08237e4 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: a6c2ba283565 ("[PATCH] v4l: 716: support for em28xx board family") Cc: stable@vger.kernel.org # 2.6.16 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/usb/em28xx/em28xx-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/em28xx/em28xx-core.c +++ b/drivers/media/usb/em28xx/em28xx-core.c @@ -99,7 +99,7 @@ int em28xx_read_reg_req_len(struct em28x mutex_lock(&dev->ctrl_urb_lock); ret =3D usb_control_msg(dev->udev, pipe, req, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x0000, reg, dev->urb_buf, len, HZ); + 0x0000, reg, dev->urb_buf, len, 1000); if (ret < 0) { if (reg_debug) printk(" failed!\n"); @@ -182,7 +182,7 @@ int em28xx_write_regs_req(struct em28xx memcpy(dev->urb_buf, buf, len); ret =3D usb_control_msg(dev->udev, pipe, req, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x0000, reg, dev->urb_buf, len, HZ); + 0x0000, reg, dev->urb_buf, len, 1000); mutex_unlock(&dev->ctrl_urb_lock); =20 if (ret < 0) From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E634DC4332F for ; Mon, 24 Jan 2022 18:51:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245601AbiAXSvN (ORCPT ); Mon, 24 Jan 2022 13:51:13 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:49856 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241926AbiAXSuE (ORCPT ); Mon, 24 Jan 2022 13:50:04 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 536F0B8122D; Mon, 24 Jan 2022 18:50:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A9CA5C36AE9; Mon, 24 Jan 2022 18:50:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050202; bh=t/mC74GPu6DwbDU9BF7P9FlIn07H9tWh/CCjzNBe9Ps=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=s77J02W2fY9wTUhyxpgusjlHVaE+o78AoO9gDij983ggk/Yd6SxMJhU4r8vHWFl+h 4ceIpJTUBlaNDKSuPCFt1Oav/pqf3WfvwAVr9KGyvv6rjhxiA77WIoTEEMQU0cqP4A TeL69D+apKYxe+P+FbRsMHFK0LD85fvZ9s6s8rpc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Kuron , Mauro Carvalho Chehab Subject: [PATCH 4.4 015/114] media: dib0700: fix undefined behavior in tuner shutdown Date: Mon, 24 Jan 2022 19:41:50 +0100 Message-Id: <20220124183927.582488506@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Kuron commit f7b77ebe6d2f49c7747b2d619586d1aa33f9ea91 upstream. This fixes a problem where closing the tuner would leave it in a state where it would not tune to any channel when reopened. This problem was discovered as part of https://github.com/hselasky/webcamd/issues/16. Since adap->id is 0 or 1, this bit-shift overflows, which is undefined behavior. The driver still worked in practice as the overflow would in most environments result in 0, which rendered the line a no-op. When running the driver as part of webcamd however, the overflow could lead to 0xff due to optimizations by the compiler, which would, in the end, improperly shut down the tuner. The bug is a regression introduced in the commit referenced below. The present patch causes identical behavior to before that commit for adap->id equal to 0 or 1. The driver does not contain support for dib0700 devices with more adapters, assuming such even exist. Tests have been performed with the Xbox One Digital TV Tuner on amd64. Not all dib0700 devices are expected to be affected by the regression; this code path is only taken by those with incorrect endpoint numbers. Link: https://lore.kernel.org/linux-media/1d2fc36d94ced6f67c7cc21dcc469d5e5= bdd8201.1632689033.git.mchehab+huawei@kernel.org Cc: stable@vger.kernel.org Fixes: 7757ddda6f4f ("[media] DiB0700: add function to change I2C-speed") Signed-off-by: Michael Kuron Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/usb/dvb-usb/dib0700_core.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/media/usb/dvb-usb/dib0700_core.c +++ b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -583,8 +583,6 @@ int dib0700_streaming_ctrl(struct dvb_us deb_info("the endpoint number (%i) is not correct, use the adapter id in= stead", adap->fe_adap[0].stream.props.endpoint); if (onoff) st->channel_state |=3D 1 << (adap->id); - else - st->channel_state |=3D 1 << ~(adap->id); } else { if (onoff) st->channel_state |=3D 1 << (adap->fe_adap[0].stream.props.endpoint-2); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84A8DC433EF for ; Mon, 24 Jan 2022 18:51:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343700AbiAXSvf (ORCPT ); Mon, 24 Jan 2022 13:51:35 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49164 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245683AbiAXSuY (ORCPT ); Mon, 24 Jan 2022 13:50:24 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8D926614D4; Mon, 24 Jan 2022 18:50:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6417BC340E5; Mon, 24 Jan 2022 18:50:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050224; bh=ZCLq4ueO8BEDL+z2nWwbk/NGy+MQ8q+TZbhlMK+G2fY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iy+++X7Z8lbw9IaJNUxtZDCR6PLOf65x/9Zo4norIPChsV9KZyTD33R5R9Qv86/Ez sw8j8fLw/uDH4ejAKylJtWVXdZofG5CQwmof8yBfEfHhQ6u/b1ABHMuK7Fdzu1DZnK juncWqPL2lEXM6xGBTJzFAP5jSnRE/hRqkUzkpRU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.4 016/114] media: pvrusb2: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:51 +0100 Message-Id: <20220124183927.614206819@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit b82bf9b9dc305d7d3d93eab106d70dbf2171b43e upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Cc: stable@vger.kernel.org # 2.6.18 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c @@ -1488,7 +1488,7 @@ static int pvr2_upload_firmware1(struct for (address =3D 0; address < fwsize; address +=3D 0x800) { memcpy(fw_ptr, fw_entry->data + address, 0x800); ret +=3D usb_control_msg(hdw->usb_dev, pipe, 0xa0, 0x40, address, - 0, fw_ptr, 0x800, HZ); + 0, fw_ptr, 0x800, 1000); } =20 trace_firmware("Upload done, releasing device's CPU"); @@ -1627,7 +1627,7 @@ int pvr2_upload_firmware2(struct pvr2_hd ((u32 *)fw_ptr)[icnt] =3D swab32(((u32 *)fw_ptr)[icnt]); =20 ret |=3D usb_bulk_msg(hdw->usb_dev, pipe, fw_ptr,bcnt, - &actual_length, HZ); + &actual_length, 1000); ret |=3D (actual_length !=3D bcnt); if (ret) break; fw_done +=3D bcnt; @@ -3491,7 +3491,7 @@ void pvr2_hdw_cpufw_set_enabled(struct p 0xa0,0xc0, address,0, hdw->fw_buffer+address, - 0x800,HZ); + 0x800,1000); if (ret < 0) break; } =20 @@ -4017,7 +4017,7 @@ void pvr2_hdw_cpureset_assert(struct pvr /* Write the CPUCS register on the 8051. The lsb of the register is the reset bit; a 1 asserts reset while a 0 clears it. */ pipe =3D usb_sndctrlpipe(hdw->usb_dev, 0); - ret =3D usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,HZ); + ret =3D usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,1000); if (ret < 0) { pvr2_trace(PVR2_TRACE_ERROR_LEGS, "cpureset_assert(%d) error=3D%d",val,ret); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AED22C433EF for ; Mon, 24 Jan 2022 18:51:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343743AbiAXSvl (ORCPT ); Mon, 24 Jan 2022 13:51:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43108 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245399AbiAXSua (ORCPT ); Mon, 24 Jan 2022 13:50:30 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 84A21C06175C; Mon, 24 Jan 2022 10:50:29 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 434FFB81221; Mon, 24 Jan 2022 18:50:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 743A9C340E8; Mon, 24 Jan 2022 18:50:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050227; bh=+JGX5V6bckuGbkPso6Uwk7DIgB1lnA95aSlFuON2aDk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OQJeU4Duomf0w4F0llnz+DqbeK/7wjSugIvDfr6iAWkoZYWOocPn6qlO1eH5RYqxg VUdQ1h0RurDx5V5SL/rPSUioAca6iKYR+1yT8gPiTmbJxSBPAQPFD6nbGtx7dSPTmp gg3i78tQYfmZbdHfaFBF8jWJfxx29dHNQNXtYqvw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.4 017/114] media: stk1160: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:52 +0100 Message-Id: <20220124183927.645730424@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 6aa6e70cdb5b863a57bad61310bf89b6617a5d2d upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: 9cb2173e6ea8 ("[media] media: Add stk1160 new driver (easycap replac= ement)") Cc: stable@vger.kernel.org # 3.7 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/usb/stk1160/stk1160-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/stk1160/stk1160-core.c +++ b/drivers/media/usb/stk1160/stk1160-core.c @@ -76,7 +76,7 @@ int stk1160_read_reg(struct stk1160 *dev return -ENOMEM; ret =3D usb_control_msg(dev->udev, pipe, 0x00, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x00, reg, buf, sizeof(u8), HZ); + 0x00, reg, buf, sizeof(u8), 1000); if (ret < 0) { stk1160_err("read failed on reg 0x%x (%d)\n", reg, ret); @@ -96,7 +96,7 @@ int stk1160_write_reg(struct stk1160 *de =20 ret =3D usb_control_msg(dev->udev, pipe, 0x01, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - value, reg, NULL, 0, HZ); + value, reg, NULL, 0, 1000); if (ret < 0) { stk1160_err("write failed on reg 0x%x (%d)\n", reg, ret); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6569BC433EF for ; Mon, 24 Jan 2022 18:51:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343719AbiAXSvh (ORCPT ); Mon, 24 Jan 2022 13:51:37 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49258 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245386AbiAXSub (ORCPT ); Mon, 24 Jan 2022 13:50:31 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 94A4B614E1; Mon, 24 Jan 2022 18:50:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7C742C340E5; Mon, 24 Jan 2022 18:50:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050230; bh=gTiAsola0UWMwwPm3YlisJWsAT/oMqMZKVdHyRXMZh0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LzrFVwgVwkgdQytjt1k6vbyywv+o4h4vHjtHIn17Z+nqGrFiwjMMcGqt9uXSyoGXi Bwd7B18PV9FS8Y4h6tUIMU2ZiwImDBn6ilBD0/koL1hAs7I9jdXM3p4T4/TBU+JMc2 UiJirk5SU2EuyOxwNNGcUffO0TM0NRDujj2mfgzs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Marc Kleine-Budde Subject: [PATCH 4.4 018/114] can: softing_cs: softingcs_probe(): fix memleak on registration failure Date: Mon, 24 Jan 2022 19:41:53 +0100 Message-Id: <20220124183927.678729716@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit ced4913efb0acc844ed65cc01d091a85d83a2082 upstream. In case device registration fails during probe, the driver state and the embedded platform device structure needs to be freed using platform_device_put() to properly free all resources (e.g. the device name). Fixes: 0a0b7a5f7a04 ("can: add driver for Softing card") Link: https://lore.kernel.org/all/20211222104843.6105-1-johan@kernel.org Cc: stable@vger.kernel.org # 2.6.38 Signed-off-by: Johan Hovold Reviewed-by: Greg Kroah-Hartman Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/can/softing/softing_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/can/softing/softing_cs.c +++ b/drivers/net/can/softing/softing_cs.c @@ -304,7 +304,7 @@ static int softingcs_probe(struct pcmcia return 0; =20 platform_failed: - kfree(dev); + platform_device_put(pdev); mem_failed: pcmcia_bad: pcmcia_failed: From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6CA9DC433EF for ; Mon, 24 Jan 2022 18:51:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343766AbiAXSvo (ORCPT ); Mon, 24 Jan 2022 13:51:44 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49300 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245741AbiAXSue (ORCPT ); Mon, 24 Jan 2022 13:50:34 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B00BA614B8; Mon, 24 Jan 2022 18:50:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 964E3C340E7; Mon, 24 Jan 2022 18:50:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050233; bh=vY09gumFJYAuICoH+Y13Ik7CFxOnZVlQler2X++ILY4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WlzGpqCMAWHRDcc+me/bY1QWCHDagjCnKdurLVjwhTH9fbL5t5YowdFG9LGa97aNg Zw92ixAeuOC3YXlPHQG+GN3jvX1wnx1RUPAt3vkv48vpH3c5bJLpdn6zWGCI+nAKi9 qoZvxX1YleZ9La3Iyw7S6ODkUhXtkwPJ4YHCqYMM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sam Bingner , Yifeng Li , Bjorn Helgaas , =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= Subject: [PATCH 4.4 019/114] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller Date: Mon, 24 Jan 2022 19:41:54 +0100 Message-Id: <20220124183927.712313393@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Yifeng Li commit e445375882883f69018aa669b67cbb37ec873406 upstream. Like other SATA controller chips in the Marvell 88SE91xx series, the Marvell 88SE9125 has the same DMA requester ID hardware bug that prevents it from working under IOMMU. Add it to the list of devices that need the quirk. Without this patch, device initialization fails with DMA errors: ata8: softreset failed (1st FIS failed) DMAR: DRHD: handling fault status reg 2 DMAR: [DMA Write NO_PASID] Request device [03:00.1] fault addr 0xfffc0000= [fault reason 0x02] Present bit in context entry is clear DMAR: DRHD: handling fault status reg 2 DMAR: [DMA Read NO_PASID] Request device [03:00.1] fault addr 0xfffc0000 = [fault reason 0x02] Present bit in context entry is clear After applying the patch, the controller can be successfully initialized: ata8: SATA link up 1.5 Gbps (SStatus 113 SControl 330) ata8.00: ATAPI: PIONEER BD-RW BDR-207M, 1.21, max UDMA/100 ata8.00: configured for UDMA/100 scsi 7:0:0:0: CD-ROM PIONEER BD-RW BDR-207M 1.21 PQ: 0 ANSI= : 5 Link: https://lore.kernel.org/r/YahpKVR+McJVDdkD@work Reported-by: Sam Bingner Tested-by: Sam Bingner Tested-by: Yifeng Li Signed-off-by: Yifeng Li Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Wilczy=C5=84ski Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/pci/quirks.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -3657,6 +3657,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_M quirk_dma_func1_alias); DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123, quirk_dma_func1_alias); +/* https://bugzilla.kernel.org/show_bug.cgi?id=3D42679#c136 */ +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9125, + quirk_dma_func1_alias); DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128, quirk_dma_func1_alias); /* https://bugzilla.kernel.org/show_bug.cgi?id=3D42679#c14 */ From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7AD9DC433EF for ; Mon, 24 Jan 2022 18:51:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245172AbiAXSvx (ORCPT ); Mon, 24 Jan 2022 13:51:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42766 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245344AbiAXSuh (ORCPT ); Mon, 24 Jan 2022 13:50:37 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7432AC061401; Mon, 24 Jan 2022 10:50:37 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 11A4E61502; Mon, 24 Jan 2022 18:50:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E9CCDC340E5; Mon, 24 Jan 2022 18:50:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050236; bh=yDBSgpBW6dgHBL2qjwJh5vA0ZzJY2QqpuiH7rtUVgX0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z4hec8MJns+B6zOTsiGbXgOiOP7MVKEGb9aw/lhtZ4EtkUZSQ53LrYcfJjcAfgVdr bNKw6wG59ftNHEp062T/pJTrPR9khfLUYXLbDWq0w7FNiZhH8v+V9a9DH+mdK0lssw 6jnAp9uCo/TUfGdJ4vj8K+ngPut97XaO1F0u2p20= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wang Hai , Marcel Holtmann , Sasha Levin Subject: [PATCH 4.4 020/114] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails Date: Mon, 24 Jan 2022 19:41:55 +0100 Message-Id: <20220124183927.749639988@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wang Hai [ Upstream commit 2a7ca7459d905febf519163bd9e3eed894de6bb7 ] I got a kernel BUG report when doing fault injection test: Reported-by: Hulk Robot Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:45! ... RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d ... Call Trace: proto_unregister+0x83/0x220 cmtp_cleanup_sockets+0x37/0x40 [cmtp] cmtp_exit+0xe/0x1f [cmtp] do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns success. This will cause a kernel bug when accessing uncreated ctmp related data when the module exits. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Hulk Robot Signed-off-by: Wang Hai Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin --- net/bluetooth/cmtp/core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c index b1757895c4ad2..23bad44bb0850 100644 --- a/net/bluetooth/cmtp/core.c +++ b/net/bluetooth/cmtp/core.c @@ -500,9 +500,7 @@ static int __init cmtp_init(void) { BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION); =20 - cmtp_init_sockets(); - - return 0; + return cmtp_init_sockets(); } =20 static void __exit cmtp_exit(void) --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BA4CC4332F for ; Mon, 24 Jan 2022 18:51:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245501AbiAXSvz (ORCPT ); Mon, 24 Jan 2022 13:51:55 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49418 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236174AbiAXSuk (ORCPT ); Mon, 24 Jan 2022 13:50:40 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E9F5F614C9; Mon, 24 Jan 2022 18:50:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BC23EC340E5; Mon, 24 Jan 2022 18:50:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050239; bh=bXxs5pp4y2DzjUk7vXFOB+RzFrdzy657g1Ih/Gk3cYA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2j4K1PD9kwkxTmCjxqQZ2UShuwWKIpRkNcYUmsQvg1PSM+EfjM+LEaPjz3w3z0yp8 KTcBIrifsFqE0d48KTY9gZ7sIyFJjlfznws+rZ4JH3AbkJtQdzED8D9xaJv3dnzTd4 /sUdoRg8jdBpWyBvUd4pszetauqzCNFuexsGerQc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Marcel Holtmann , Sasha Levin , syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com Subject: [PATCH 4.4 021/114] Bluetooth: stop proccessing malicious adv data Date: Mon, 24 Jan 2022 19:41:56 +0100 Message-Id: <20220124183927.780532909@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin [ Upstream commit 3a56ef719f0b9682afb8a86d64b2399e36faa4e6 ] Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The problem was in missing validaion check. We should check if data is not malicious and we can read next data block. If we won't check ptr validness, code can read a way beyond skb->end and it can cause problems, of course. Fixes: e95beb414168 ("Bluetooth: hci_le_adv_report_evt code refactoring") Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.c= om Signed-off-by: Pavel Skripkin Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- net/bluetooth/hci_event.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 6528ecc3a3bc5..05ccd2bcd9e46 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -4940,7 +4940,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hde= v, struct sk_buff *skb) struct hci_ev_le_advertising_info *ev =3D ptr; s8 rssi; =20 - if (ev->length <=3D HCI_MAX_AD_LENGTH) { + if (ev->length <=3D HCI_MAX_AD_LENGTH && + ev->data + ev->length <=3D skb_tail_pointer(skb)) { rssi =3D ev->data[ev->length]; process_adv_report(hdev, ev->evt_type, &ev->bdaddr, ev->bdaddr_type, NULL, 0, rssi, @@ -4950,6 +4951,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hd= ev, struct sk_buff *skb) } =20 ptr +=3D sizeof(*ev) + ev->length + 1; + + if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) { + bt_dev_err(hdev, "Malicious advertising data. Stopping processing"); + break; + } } =20 hci_dev_unlock(hdev); --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B10AC433EF for ; Mon, 24 Jan 2022 18:49:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241956AbiAXStu (ORCPT ); Mon, 24 Jan 2022 13:49:50 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47814 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245347AbiAXSs4 (ORCPT ); Mon, 24 Jan 2022 13:48:56 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 17389614D2; Mon, 24 Jan 2022 18:48:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D0BC7C340E5; Mon, 24 Jan 2022 18:48:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050135; bh=26YtHU7kqqE3DgJGlBPSWEyd8gKGzX2a6Y5MUgSk8X0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YmDrmxUQYJ6T3auYIM8cTPolyTzQQsJnnpgoSCMgIzztnsiSEU5PS1PPWhn7ICXLL dmSA13z5lZROmWjElZ8xsOfCqTgsDcIKFh2pHVxox8aU+qmZnUoeyqjbfIpVPryeuw xF7De/IcZ/cF7aS0/TpFknsbu2WW0P/eISCmxcv4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengfeng Ye , Thara Gopinath , Herbert Xu , Sasha Levin Subject: [PATCH 4.4 022/114] crypto: qce - fix uaf on qce_ahash_register_one Date: Mon, 24 Jan 2022 19:41:57 +0100 Message-Id: <20220124183927.812284771@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengfeng Ye [ Upstream commit b4cb4d31631912842eb7dce02b4350cbb7562d5e ] Pointer base points to sub field of tmpl, it is dereferenced after tmpl is freed. Fix this by accessing base before free tmpl. Fixes: ec8f5d8f ("crypto: qce - Qualcomm crypto engine driver") Signed-off-by: Chengfeng Ye Acked-by: Thara Gopinath Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/crypto/qce/sha.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c index 0c9973ec80ebd..da2e4c193953a 100644 --- a/drivers/crypto/qce/sha.c +++ b/drivers/crypto/qce/sha.c @@ -539,8 +539,8 @@ static int qce_ahash_register_one(const struct qce_ahas= h_def *def, =20 ret =3D crypto_register_ahash(alg); if (ret) { - kfree(tmpl); dev_err(qce->dev, "%s registration failed\n", base->cra_name); + kfree(tmpl); return ret; } =20 --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40B4FC433EF for ; Mon, 24 Jan 2022 18:49:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245382AbiAXSt4 (ORCPT ); Mon, 24 Jan 2022 13:49:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42588 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245391AbiAXStB (ORCPT ); Mon, 24 Jan 2022 13:49:01 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2CC75C06175A; Mon, 24 Jan 2022 10:49:01 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E8E36B81221; Mon, 24 Jan 2022 18:48:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1FD59C340E5; Mon, 24 Jan 2022 18:48:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050138; bh=E9a2z6EE0+tnBwnlD62xWh25c50ZEbJkBrNw5rjdFOA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=czX4fdPahi0UdTPeErm3eP3+FC0llFP5Loz0NE5wMlZqVKF3whMRzgl5DkONfnqfz pKygdJ5R+w63m1U5D/gcWLPMHr3t1EtBB5fExIryk9//gLbBtVpiJi3DFXhMDV7d2f ESZwqjETJdRGe3ecE+EIwg9M2HR8XM6lykEcDKAM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Richard Genoud , Sasha Levin Subject: [PATCH 4.4 023/114] tty: serial: atmel: Check return code of dmaengine_submit() Date: Mon, 24 Jan 2022 19:41:58 +0100 Message-Id: <20220124183927.841121990@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus [ Upstream commit 1e67bd2b8cb90b66e89562598e9c2046246832d3 ] The tx_submit() method of struct dma_async_tx_descriptor is entitled to do sanity checks and return errors if encountered. It's not the case for the DMA controller drivers that this client is using (at_h/xdmac), because they currently don't do sanity checks and always return a positive cookie at tx_submit() method. In case the controller drivers will implement sanity checks and return errors, print a message so that the client will be informed that something went wrong at tx_submit() level. Fixes: 08f738be88bb ("serial: at91: add tx dma support") Signed-off-by: Tudor Ambarus Acked-by: Richard Genoud Link: https://lore.kernel.org/r/20211125090028.786832-3-tudor.ambarus@micro= chip.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/tty/serial/atmel_serial.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_s= erial.c index 3bd19de7df71b..be15061a14479 100644 --- a/drivers/tty/serial/atmel_serial.c +++ b/drivers/tty/serial/atmel_serial.c @@ -928,6 +928,11 @@ static void atmel_tx_dma(struct uart_port *port) desc->callback =3D atmel_complete_tx_dma; desc->callback_param =3D atmel_port; atmel_port->cookie_tx =3D dmaengine_submit(desc); + if (dma_submit_error(atmel_port->cookie_tx)) { + dev_err(port->dev, "dma_submit_error %d\n", + atmel_port->cookie_tx); + return; + } } =20 if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) @@ -1186,6 +1191,11 @@ static int atmel_prepare_rx_dma(struct uart_port *po= rt) desc->callback_param =3D port; atmel_port->desc_rx =3D desc; atmel_port->cookie_rx =3D dmaengine_submit(desc); + if (dma_submit_error(atmel_port->cookie_rx)) { + dev_err(port->dev, "dma_submit_error %d\n", + atmel_port->cookie_rx); + goto chan_err; + } =20 return 0; =20 --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3623C433FE for ; Mon, 24 Jan 2022 18:49:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245397AbiAXSt6 (ORCPT ); Mon, 24 Jan 2022 13:49:58 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:49342 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245423AbiAXStE (ORCPT ); Mon, 24 Jan 2022 13:49:04 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 23163B81223; Mon, 24 Jan 2022 18:49:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 32120C340E5; Mon, 24 Jan 2022 18:49:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050141; bh=9vaZjvnxBMp4gYkl1f2tAVn1uq9u20HCsga5merISQI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gNESAx5b0TJKvUVQ8ze95qV1eCC+r1WBE3+OH6mocZpl8p29WUWfZsz0LasX8y3ZL 8aanoyb7EzUjS9gk3whpBiLLSdsGpm8O1Gld2WKLWJqMOqx1KX+bKvA0eWAmuK1Hx0 8+uq6Sf+NnzNOut+zxIBW4ygYOIFFRmdljIA37FQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Sasha Levin Subject: [PATCH 4.4 024/114] tty: serial: atmel: Call dma_async_issue_pending() Date: Mon, 24 Jan 2022 19:41:59 +0100 Message-Id: <20220124183927.873185600@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus [ Upstream commit 4f4b9b5895614eb2e2b5f4cab7858f44bd113e1b ] The driver wrongly assummed that tx_submit() will start the transfer, which is not the case, now that the at_xdmac driver is fixed. tx_submit is supposed to push the current transaction descriptor to a pending queue, waiting for issue_pending to be called. issue_pending must start the transfer, not tx_submit. Fixes: 34df42f59a60 ("serial: at91: add rx dma support") Fixes: 08f738be88bb ("serial: at91: add tx dma support") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211125090028.786832-4-tudor.ambarus@micro= chip.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/tty/serial/atmel_serial.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_s= erial.c index be15061a14479..e49493703179d 100644 --- a/drivers/tty/serial/atmel_serial.c +++ b/drivers/tty/serial/atmel_serial.c @@ -933,6 +933,8 @@ static void atmel_tx_dma(struct uart_port *port) atmel_port->cookie_tx); return; } + + dma_async_issue_pending(chan); } =20 if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) @@ -1197,6 +1199,8 @@ static int atmel_prepare_rx_dma(struct uart_port *por= t) goto chan_err; } =20 + dma_async_issue_pending(atmel_port->chan_rx); + return 0; =20 chan_err: --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95268C433F5 for ; Mon, 24 Jan 2022 18:50:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245405AbiAXSuB (ORCPT ); Mon, 24 Jan 2022 13:50:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42718 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245433AbiAXStG (ORCPT ); Mon, 24 Jan 2022 13:49:06 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 03593C06175D; Mon, 24 Jan 2022 10:49:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 93ED8614C9; Mon, 24 Jan 2022 18:49:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 705C2C340E5; Mon, 24 Jan 2022 18:49:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050145; bh=/8CIfs1BhLndgQ07EixkGHqFF9nb6mhgp0v4Up1H69o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=esmCaSukwO/w7vF2wPwhgF56QUwfoIiycpBZI/oiFqWFdwNlGCSKz7TzQd++tsi9O Sa14f7zEF5RG6LQEZb3lHUeMzhahXx8vzvieHHtUw3VtRtM1NU/0SbSDcPgTDUW1og pMwLiTOCkzXykYkM6istTJQMyMWTokAAv4/i8fUo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Florian Westphal , Pablo Neira Ayuso , Sasha Levin , Amish Chana Subject: [PATCH 4.4 025/114] netfilter: bridge: add support for pppoe filtering Date: Mon, 24 Jan 2022 19:42:00 +0100 Message-Id: <20220124183927.901972249@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal [ Upstream commit 28b78ecffea8078d81466b2e01bb5a154509f1ba ] This makes 'bridge-nf-filter-pppoe-tagged' sysctl work for bridged traffic. Looking at the original commit it doesn't appear this ever worked: static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *= *pskb, [..] if (skb->protocol =3D=3D htons(ETH_P_8021Q)) { skb_pull(skb, VLAN_HLEN); skb->network_header +=3D VLAN_HLEN; + } else if (skb->protocol =3D=3D htons(ETH_P_PPP_SES)) { + skb_pull(skb, PPPOE_SES_HLEN); + skb->network_header +=3D PPPOE_SES_HLEN; } [..] NF_HOOK(... POST_ROUTING, ...) ... but the adjusted offsets are never restored. The alternative would be to rip this code out for good, but otoh we'd have to keep this anyway for the vlan handling (which works because vlan tag info is in the skb, not the packet payload). Reported-and-tested-by: Amish Chana Fixes: 516299d2f5b6f97 ("[NETFILTER]: bridge-nf: filter bridged IPv4/IPv6 e= ncapsulated in pppoe traffic") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- net/bridge/br_netfilter_hooks.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hook= s.c index 24eea13035557..f580dbaac5a94 100644 --- a/net/bridge/br_netfilter_hooks.c +++ b/net/bridge/br_netfilter_hooks.c @@ -719,6 +719,9 @@ static int br_nf_dev_queue_xmit(struct net *net, struct= sock *sk, struct sk_buff if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu) mtu =3D nf_bridge->frag_max_size; =20 + nf_bridge_update_protocol(skb); + nf_bridge_push_encap_header(skb); + if (skb_is_gso(skb) || skb->len + mtu_reserved <=3D mtu) { nf_bridge_info_free(skb); return br_dev_queue_push_xmit(net, sk, skb); @@ -736,8 +739,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct= sock *sk, struct sk_buff =20 IPCB(skb)->frag_max_size =3D nf_bridge->frag_max_size; =20 - nf_bridge_update_protocol(skb); - data =3D this_cpu_ptr(&brnf_frag_data_storage); =20 data->vlan_tci =3D skb->vlan_tci; @@ -760,8 +761,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct= sock *sk, struct sk_buff =20 IP6CB(skb)->frag_max_size =3D nf_bridge->frag_max_size; =20 - nf_bridge_update_protocol(skb); - data =3D this_cpu_ptr(&brnf_frag_data_storage); data->encap_size =3D nf_bridge_encap_header_len(skb); data->size =3D ETH_HLEN + data->encap_size; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 91276C433F5 for ; Mon, 24 Jan 2022 18:50:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245463AbiAXSuD (ORCPT ); Mon, 24 Jan 2022 13:50:03 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48028 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245445AbiAXStJ (ORCPT ); Mon, 24 Jan 2022 13:49:09 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A681F61416; Mon, 24 Jan 2022 18:49:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 879D7C340E5; Mon, 24 Jan 2022 18:49:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050148; bh=nzXG+YPKYpSDBotNUNpssP7jwFim1nHCe817EGHiYBU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CqY59x3XoG1aw9nqEt5kHPIA5pyicFZIxhRppTfKRl18x41x0txyb2dby2aONkx8M d0/HzEy7RaEUy/R3PVZZ03Qe+qqUxgrj+Z+rP+kxcjXyN/QiN71+AQBV/Tf+O7hxbP o+uSqZjqrQEUhuVM+pr0qxp7H5AmAc2BtV+xPF5k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Baryshkov , Bjorn Andersson , Sasha Levin Subject: [PATCH 4.4 026/114] arm64: dts: qcom: msm8916: fix MMC controller aliases Date: Mon, 24 Jan 2022 19:42:01 +0100 Message-Id: <20220124183927.932231485@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dmitry Baryshkov [ Upstream commit b0293c19d42f6d6951c2fab9a47fed50baf2c14d ] Change sdhcN aliases to mmcN to make them actually work. Currently the board uses non-standard aliases sdhcN, which do not work, resulting in mmc0 and mmc1 hosts randomly changing indices between boots. Fixes: c4da5a561627 ("arm64: dts: qcom: Add msm8916 sdhci configuration nod= es") Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20211201020559.1611890-1-dmitry.baryshkov@l= inaro.org Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qc= om/msm8916.dtsi index 8d184ff196429..5cac11e6ba4b4 100644 --- a/arch/arm64/boot/dts/qcom/msm8916.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi @@ -25,8 +25,8 @@ #size-cells =3D <2>; =20 aliases { - sdhc1 =3D &sdhc_1; /* SDC1 eMMC slot */ - sdhc2 =3D &sdhc_2; /* SDC2 SD card slot */ + mmc0 =3D &sdhc_1; /* SDC1 eMMC slot */ + mmc1 =3D &sdhc_2; /* SDC2 SD card slot */ }; =20 chosen { }; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C422BC433EF for ; Mon, 24 Jan 2022 18:50:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245542AbiAXSuK (ORCPT ); Mon, 24 Jan 2022 13:50:10 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48050 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241947AbiAXStM (ORCPT ); Mon, 24 Jan 2022 13:49:12 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E3FA1614B8; Mon, 24 Jan 2022 18:49:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ABE00C340E8; Mon, 24 Jan 2022 18:49:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050151; bh=mKsaHxbW+EPBqHsClG9z2i/y3TeiHVuQ+qwJ2i8cO6A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=chdsGUzjQTJ7s/P3PKTR5iuDDZ3vVqIQCVj/SI/Nj1KGNxPXlPUXM4VQGCpxEUsjp WVvCqQu+EPBfi+k3Rjv+pmHFE8BLHXoZ8MjQCvyfUZheJSfDHhnKDYAxnVyCcd3AqU rEW9BjHp9vGgU5lMy36EwNqmSCSX4GcS+DFhrtoo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Alex Deucher , Sasha Levin Subject: [PATCH 4.4 027/114] drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() Date: Mon, 24 Jan 2022 19:42:02 +0100 Message-Id: <20220124183927.960753077@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit b220110e4cd442156f36e1d9b4914bb9e87b0d00 ] In amdgpu_connector_lcd_native_mode(), the return value of drm_mode_duplicate() is assigned to mode, and there is a dereference of it in amdgpu_connector_lcd_native_mode(), which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Fix this bug add a check of mode. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_DRM_AMDGPU=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") Signed-off-by: Zhou Qingyang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/d= rm/amd/amdgpu/amdgpu_connectors.c index e1d4115bd6732..80e3b41294e5f 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c @@ -404,6 +404,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *en= coder) native_mode->vdisplay !=3D 0 && native_mode->clock !=3D 0) { mode =3D drm_mode_duplicate(dev, native_mode); + if (!mode) + return NULL; + mode->type =3D DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; drm_mode_set_name(mode); =20 @@ -418,6 +421,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *en= coder) * simpler. */ mode =3D drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay,= 60, true, false, false); + if (!mode) + return NULL; + mode->type =3D DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode= ->name); } --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 025A0C433F5 for ; Mon, 24 Jan 2022 18:50:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241993AbiAXSuN (ORCPT ); Mon, 24 Jan 2022 13:50:13 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48084 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245338AbiAXStP (ORCPT ); Mon, 24 Jan 2022 13:49:15 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0B3B8614D4; Mon, 24 Jan 2022 18:49:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DBFB2C340E7; Mon, 24 Jan 2022 18:49:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050154; bh=8CILGp+0n4m/Cezz6J+SuLQfJy7791cC2fJIri2wwYI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=paR3fzWBuL2Mvz9hqvdvfpLbr7dp5+eXtlhU0FAbLP0HOCgK/E7s15fBs6SxVRjEY 5VFJcnGKDgfTFBkhGOZ58j/ZpGB+dFcNtua79Ni69/QGPTfNTZDfSbWWLSxHrLcmJC YuXyTP8HBPAp/36ujcgD8o2qK9XPlFxA/OQLxfWk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lino Sanfilippo , Sasha Levin Subject: [PATCH 4.4 028/114] serial: amba-pl011: do not request memory region twice Date: Mon, 24 Jan 2022 19:42:03 +0100 Message-Id: <20220124183927.989945012@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Lino Sanfilippo [ Upstream commit d1180405c7b5c7a1c6bde79d5fc24fe931430737 ] With commit 3873e2d7f63a ("drivers: PL011: refactor pl011_probe()") the function devm_ioremap() called from pl011_setup_port() was replaced with devm_ioremap_resource(). Since this function not only remaps but also requests the ports io memory region it now collides with the .config_port() callback which requests the same region at uart port registration. Since devm_ioremap_resource() already claims the memory successfully, the request in .config_port() fails. Later at uart port deregistration the attempt to release the unclaimed memory also fails. The failure results in a =E2=80=9CTrying to free nonexis= tent resource" warning. Fix these issues by removing the callbacks that implement the redundant memory allocation/release. Also make sure that changing the drivers io memory base address via TIOCSSERIAL is not allowed any more. Fixes: 3873e2d7f63a ("drivers: PL011: refactor pl011_probe()") Signed-off-by: Lino Sanfilippo Link: https://lore.kernel.org/r/20211129174238.8333-1-LinoSanfilippo@gmx.de Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/tty/serial/amba-pl011.c | 27 +++------------------------ 1 file changed, 3 insertions(+), 24 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl01= 1.c index ecace294dc7e6..75932d68a722f 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1944,32 +1944,13 @@ static const char *pl011_type(struct uart_port *por= t) return uap->port.type =3D=3D PORT_AMBA ? uap->type : NULL; } =20 -/* - * Release the memory region(s) being used by 'port' - */ -static void pl011_release_port(struct uart_port *port) -{ - release_mem_region(port->mapbase, SZ_4K); -} - -/* - * Request the memory region(s) being used by 'port' - */ -static int pl011_request_port(struct uart_port *port) -{ - return request_mem_region(port->mapbase, SZ_4K, "uart-pl011") - !=3D NULL ? 0 : -EBUSY; -} - /* * Configure/autoconfigure the port. */ static void pl011_config_port(struct uart_port *port, int flags) { - if (flags & UART_CONFIG_TYPE) { + if (flags & UART_CONFIG_TYPE) port->type =3D PORT_AMBA; - pl011_request_port(port); - } } =20 /* @@ -1984,6 +1965,8 @@ static int pl011_verify_port(struct uart_port *port, = struct serial_struct *ser) ret =3D -EINVAL; if (ser->baud_base < 9600) ret =3D -EINVAL; + if (port->mapbase !=3D (unsigned long) ser->iomem_base) + ret =3D -EINVAL; return ret; } =20 @@ -2001,8 +1984,6 @@ static struct uart_ops amba_pl011_pops =3D { .flush_buffer =3D pl011_dma_flush_buffer, .set_termios =3D pl011_set_termios, .type =3D pl011_type, - .release_port =3D pl011_release_port, - .request_port =3D pl011_request_port, .config_port =3D pl011_config_port, .verify_port =3D pl011_verify_port, #ifdef CONFIG_CONSOLE_POLL @@ -2032,8 +2013,6 @@ static const struct uart_ops sbsa_uart_pops =3D { .shutdown =3D sbsa_uart_shutdown, .set_termios =3D sbsa_uart_set_termios, .type =3D pl011_type, - .release_port =3D pl011_release_port, - .request_port =3D pl011_request_port, .config_port =3D pl011_config_port, .verify_port =3D pl011_verify_port, #ifdef CONFIG_CONSOLE_POLL --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 054F4C4332F for ; Mon, 24 Jan 2022 18:50:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245576AbiAXSuO (ORCPT ); Mon, 24 Jan 2022 13:50:14 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48146 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245348AbiAXStT (ORCPT ); Mon, 24 Jan 2022 13:49:19 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5118E614D7; Mon, 24 Jan 2022 18:49:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13036C340E7; Mon, 24 Jan 2022 18:49:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050157; bh=+WCTDEWi3bIvHe85xv/QXID3bVKL+fBpNepNnRgV0YI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fvyJgbxOl8sY2QYdu5J2f8jmUY1OP05JHN4n6M/p5qmoYCvn00uWvebi6wNRnMgq2 /LJMOQQkhunDu3BjyGo2Tb8RXzKvf/L6gG+oYzaKANzaoMEHXSBqVsRIN7RNBAMbZ8 FRvX5DXAWAYNa3M+nnOczeIwx3rcb41q2eLBO2gU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tasos Sahanidis , Denis Efremov , Jens Axboe , Sasha Levin Subject: [PATCH 4.4 029/114] floppy: Fix hang in watchdog when disk is ejected Date: Mon, 24 Jan 2022 19:42:04 +0100 Message-Id: <20220124183928.019231426@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tasos Sahanidis [ Upstream commit fb48febce7e30baed94dd791e19521abd2c3fd83 ] When the watchdog detects a disk change, it calls cancel_activity(), which in turn tries to cancel the fd_timer delayed work. In the above scenario, fd_timer_fn is set to fd_watchdog(), meaning it is trying to cancel its own work. This results in a hang as cancel_delayed_work_sync() is waiting for the watchdog (itself) to return, which never happens. This can be reproduced relatively consistently by attempting to read a broken floppy, and ejecting it while IO is being attempted and retried. To resolve this, this patch calls cancel_delayed_work() instead, which cancels the work without waiting for the watchdog to return and finish. Before this regression was introduced, the code in this section used del_timer(), and not del_timer_sync() to delete the watchdog timer. Link: https://lore.kernel.org/r/399e486c-6540-db27-76aa-7a271b061f76@tasoss= ah.com Fixes: 070ad7e793dc ("floppy: convert to delayed work and single-thread wq") Signed-off-by: Tasos Sahanidis Signed-off-by: Denis Efremov Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/block/floppy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 40c251ef175db..826ab5f2f6b9f 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -994,7 +994,7 @@ static DECLARE_DELAYED_WORK(fd_timer, fd_timer_workfn); static void cancel_activity(void) { do_floppy =3D NULL; - cancel_delayed_work_sync(&fd_timer); + cancel_delayed_work(&fd_timer); cancel_work_sync(&floppy_work); } =20 --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5D12C433FE for ; Mon, 24 Jan 2022 18:50:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245613AbiAXSuQ (ORCPT ); Mon, 24 Jan 2022 13:50:16 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:49496 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235976AbiAXStX (ORCPT ); Mon, 24 Jan 2022 13:49:23 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 63733B8121D; Mon, 24 Jan 2022 18:49:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E366C340E5; Mon, 24 Jan 2022 18:49:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050161; bh=rH7vXnLsMeqrHjpj2FZxMKF7MTGw1pwYc0KA4eDVaSA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v/S5oguqmVQ5gVKB1idw5OxB4KNeCoi58U3FiilpdqcJv0Y/IlHGA0HPduhAeXDx4 CVWw5C9HQ7wGkAQwwjmj7rRvw1w9E3SZ2aP9vkoTLHcpU+gy3Yvkcwmr6VBi3xnz5o CnOnw2Y3wof4o7ecGrs8Nhjirz8Wy7is1PMKXoBk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.4 030/114] media: dib8000: Fix a memleak in dib8000_init() Date: Mon, 24 Jan 2022 19:42:05 +0100 Message-Id: <20220124183928.048787958@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 8dbdcc7269a83305ee9d677b75064d3530a48ee2 ] In dib8000_init(), the variable fe is not freed or passed out on the failure of dib8000_identify(&state->i2c), which could lead to a memleak. Fix this bug by adding a kfree of fe in the error path. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_DVB_DIB8000=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: 77e2c0f5d471 ("V4L/DVB (12900): DiB8000: added support for DiBcom IS= DB-T/ISDB-Tsb demodulator DiB8000") Signed-off-by: Zhou Qingyang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/dvb-frontends/dib8000.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-fron= tends/dib8000.c index 94c26270fff0e..b8af5a3c707f8 100644 --- a/drivers/media/dvb-frontends/dib8000.c +++ b/drivers/media/dvb-frontends/dib8000.c @@ -4461,8 +4461,10 @@ static struct dvb_frontend *dib8000_init(struct i2c_= adapter *i2c_adap, u8 i2c_ad =20 state->timf_default =3D cfg->pll->timf; =20 - if (dib8000_identify(&state->i2c) =3D=3D 0) + if (dib8000_identify(&state->i2c) =3D=3D 0) { + kfree(fe); goto error; + } =20 dibx000_init_i2c_master(&state->i2c_master, DIB8000, state->i2c.adap, sta= te->i2c.addr); =20 --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5EB17C433EF for ; Mon, 24 Jan 2022 18:50:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245630AbiAXSuR (ORCPT ); Mon, 24 Jan 2022 13:50:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42798 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245479AbiAXStZ (ORCPT ); Mon, 24 Jan 2022 13:49:25 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 25D95C061762; Mon, 24 Jan 2022 10:49:25 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B9450614D5; Mon, 24 Jan 2022 18:49:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97079C340E5; Mon, 24 Jan 2022 18:49:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050164; bh=I5LwytMph0R/5LpJof8AntKK3LVkEsBvnCH9TCu9nQk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nHj1u4zp/KXsd/JMYHPuDE1C1W2C5rfeOIyqu/ypoK4ewfaCyUNgXVVXXIWJT3Uze 5UaSGTVFAW3DI1n/vYRn33DVOl4eeYg963ydZiNC4F5y2Mc//n2lqyxsN5DA+fFaes d1MZgKbc887b9xPRc/wS5ATq+GesoG3J/oUrmGpc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.4 031/114] media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() Date: Mon, 24 Jan 2022 19:42:06 +0100 Message-Id: <20220124183928.081898439@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 0407c49ebe330333478440157c640fffd986f41b ] In mxb_attach(dev, info), saa7146_vv_init() is called to allocate a new memory for dev->vv_data. saa7146_vv_release() will be called on failure of mxb_probe(dev). There is a dereference of dev->vv_data in saa7146_vv_release(), which could lead to a NULL pointer dereference on failure of saa7146_vv_init(). Fix this bug by adding a check of saa7146_vv_init(). This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_VIDEO_MXB=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: 03b1930efd3c ("V4L/DVB: saa7146: fix regression of the av7110/budget= -av driver") Signed-off-by: Zhou Qingyang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/pci/saa7146/mxb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mx= b.c index 868af73c5536a..56691a79ef08f 100644 --- a/drivers/media/pci/saa7146/mxb.c +++ b/drivers/media/pci/saa7146/mxb.c @@ -694,10 +694,16 @@ static struct saa7146_ext_vv vv_data; static int mxb_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio= n_data *info) { struct mxb *mxb; + int ret; =20 DEB_EE("dev:%p\n", dev); =20 - saa7146_vv_init(dev, &vv_data); + ret =3D saa7146_vv_init(dev, &vv_data); + if (ret) { + ERR("Error in saa7146_vv_init()"); + return ret; + } + if (mxb_probe(dev)) { saa7146_vv_release(dev); return -1; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5E759C433EF for ; Mon, 24 Jan 2022 18:51:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343558AbiAXSu6 (ORCPT ); Mon, 24 Jan 2022 13:50:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42590 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245516AbiAXSth (ORCPT ); Mon, 24 Jan 2022 13:49:37 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8A4ECC061768; Mon, 24 Jan 2022 10:49:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 28460614D8; Mon, 24 Jan 2022 18:49:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D69A8C340E5; Mon, 24 Jan 2022 18:49:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050170; bh=5NY77zdV9ozn/+VEAlvfkSk/XENHtvV6igQMct3x6Ls=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ah/ACyyZvfRyePn6l6DX0Y2wQI19zWNaz7yc5r7mh/Q32QnarlmufGmvUfLrYn3+1 S65y3gcQGfd0dtKEEM4/xjFPemksMCgBjPJgPEDufc4V/uDKB4nPh4xC5Jwcg5ZMCo FbGtq5DQaS+TN8oX0amTQFF/EtwDP7N0ByvDlZoQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wang Hai , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.4 032/114] media: msi001: fix possible null-ptr-deref in msi001_probe() Date: Mon, 24 Jan 2022 19:42:07 +0100 Message-Id: <20220124183928.111280323@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wang Hai [ Upstream commit 3d5831a40d3464eea158180eb12cbd81c5edfb6a ] I got a null-ptr-deref report: BUG: kernel NULL pointer dereference, address: 0000000000000060 ... RIP: 0010:v4l2_ctrl_auto_cluster+0x57/0x270 ... Call Trace: msi001_probe+0x13b/0x24b [msi001] spi_probe+0xeb/0x130 ... do_syscall_64+0x35/0xb0 In msi001_probe(), if the creation of control for bandwidth_auto fails, there will be a null-ptr-deref issue when it is used in v4l2_ctrl_auto_cluster(). Check dev->hdl.error before v4l2_ctrl_auto_cluster() to fix this bug. Link: https://lore.kernel.org/linux-media/20211026112348.2878040-1-wanghai3= 8@huawei.com Fixes: 93203dd6c7c4 ("[media] msi001: Mirics MSi001 silicon tuner driver") Reported-by: Hulk Robot Signed-off-by: Wang Hai Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/tuners/msi001.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/media/tuners/msi001.c b/drivers/media/tuners/msi001.c index 3a12ef35682b5..64d98517f470f 100644 --- a/drivers/media/tuners/msi001.c +++ b/drivers/media/tuners/msi001.c @@ -464,6 +464,13 @@ static int msi001_probe(struct spi_device *spi) V4L2_CID_RF_TUNER_BANDWIDTH_AUTO, 0, 1, 1, 1); dev->bandwidth =3D v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops, V4L2_CID_RF_TUNER_BANDWIDTH, 200000, 8000000, 1, 200000); + if (dev->hdl.error) { + ret =3D dev->hdl.error; + dev_err(&spi->dev, "Could not initialize controls\n"); + /* control init failed, free handler */ + goto err_ctrl_handler_free; + } + v4l2_ctrl_auto_cluster(2, &dev->bandwidth_auto, 0, false); dev->lna_gain =3D v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops, V4L2_CID_RF_TUNER_LNA_GAIN, 0, 1, 1, 1); --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9D654C433EF for ; Mon, 24 Jan 2022 18:50:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245705AbiAXSu2 (ORCPT ); Mon, 24 Jan 2022 13:50:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42634 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245526AbiAXStk (ORCPT ); Mon, 24 Jan 2022 13:49:40 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A25C5C06176A; Mon, 24 Jan 2022 10:49:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 40885614D2; Mon, 24 Jan 2022 18:49:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20AB9C340E5; Mon, 24 Jan 2022 18:49:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050173; bh=unDISHqfT2l35nCeXqnlHSiBvJ2C0S4ZO6Uu0LBzuqs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AEkfDuNLYlOzUSmwtHmSg6riG1omor+vrHNwBgVvA5AYEf5qMd8P7lqNJ9JbjVJJ4 MOdtvRe9qsaCH2lYTUxxtBv9sKj/x0Arg6I7vvWzaxiZftO+8sJlRna16HdVciFMbL K2DU/QEEiirB0pFTBwe/RuGximq2+M6PYmQuwI64= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wei Yongjun , Sasha Levin Subject: [PATCH 4.4 033/114] usb: ftdi-elan: fix memory leak on device disconnect Date: Mon, 24 Jan 2022 19:42:08 +0100 Message-Id: <20220124183928.139941564@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wei Yongjun [ Upstream commit 1646566b5e0c556f779180a8514e521ac735de1e ] 'ftdi' is alloced when probe device, but not free on device disconnect, this cause a memory leak as follows: unreferenced object 0xffff88800d584000 (size 8400): comm "kworker/0:2", pid 3809, jiffies 4295453055 (age 13.784s) hex dump (first 32 bytes): 00 40 58 0d 80 88 ff ff 00 40 58 0d 80 88 ff ff .@X......@X..... 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. backtrace: [<000000000d47f947>] kmalloc_order_trace+0x19/0x110 mm/slab_common.c:960 [<000000008548ac68>] ftdi_elan_probe+0x8c/0x880 drivers/usb/misc/ftdi-e= lan.c:2647 [<000000007f73e422>] usb_probe_interface+0x31b/0x800 drivers/usb/core/d= river.c:396 [<00000000fe8d07fc>] really_probe+0x299/0xc30 drivers/base/dd.c:517 [<0000000005da7d32>] __driver_probe_device+0x357/0x500 drivers/base/dd.= c:751 [<000000003c2c9579>] driver_probe_device+0x4e/0x140 drivers/base/dd.c:7= 81 Fix it by freeing 'ftdi' after nobody use it. Fixes: a5c66e4b2418 ("USB: ftdi-elan: client driver for ELAN Uxxx adapters") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Link: https://lore.kernel.org/r/20211217083428.2441-1-weiyongjun1@huawei.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/usb/misc/ftdi-elan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c index 52c27cab78c3e..6f6315082bc44 100644 --- a/drivers/usb/misc/ftdi-elan.c +++ b/drivers/usb/misc/ftdi-elan.c @@ -209,6 +209,7 @@ static void ftdi_elan_delete(struct kref *kref) mutex_unlock(&ftdi_module_lock); kfree(ftdi->bulk_in_buffer); ftdi->bulk_in_buffer =3D NULL; + kfree(ftdi); } =20 static void ftdi_elan_put_kref(struct usb_ftdi *ftdi) --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B6D1C433FE for ; Mon, 24 Jan 2022 18:50:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245331AbiAXSur (ORCPT ); Mon, 24 Jan 2022 13:50:47 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:49604 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245520AbiAXStj (ORCPT ); Mon, 24 Jan 2022 13:49:39 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3DF00B81221; Mon, 24 Jan 2022 18:49:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4F3A5C340E5; Mon, 24 Jan 2022 18:49:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050177; bh=IyEZm5VJ9DTUvGD5ch3pdHZ+oyGhrNtAXW8JkE7kfH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LMM3g83VQvVgGF5G64GlaIBPJIvwbwi1DNMvYmCWb1665jD/vm/z5w9Zlu8tOW7Rt mz4zRAbfIMwPsVU0QG+C4ihF3muHg2BNUeWZohkjCDmWqER4rfUhkckYdeXXL4dOK1 0Qy9NEJVWROCyJOwM9eI9FhaIEBoVgR24zL8owE0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Dominik Brodowski , Sasha Levin Subject: [PATCH 4.4 034/114] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() Date: Mon, 24 Jan 2022 19:42:09 +0100 Message-Id: <20220124183928.169382566@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit ca0fe0d7c35c97528bdf621fdca75f13157c27af ] In __nonstatic_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_PCCARD_NONSTATIC=3Dy show no new warnings, and our static analyzer no longer warns about this code. Fixes: 49b1153adfe1 ("pcmcia: move all pcmcia_resource_ops providers into o= ne module") Signed-off-by: Zhou Qingyang [linux@dominikbrodowski.net: Fix typo in commit message] Signed-off-by: Dominik Brodowski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/pcmcia/rsrc_nonstatic.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstati= c.c index 5ef7b46a25786..4d244014f423f 100644 --- a/drivers/pcmcia/rsrc_nonstatic.c +++ b/drivers/pcmcia/rsrc_nonstatic.c @@ -693,6 +693,9 @@ static struct resource *__nonstatic_find_io_region(stru= ct pcmcia_socket *s, unsigned long min =3D base; int ret; =20 + if (!res) + return NULL; + data.mask =3D align - 1; data.offset =3D base & data.mask; data.map =3D &s_data->io_db; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52B3DC433EF for ; Mon, 24 Jan 2022 18:50:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245758AbiAXSuk (ORCPT ); Mon, 24 Jan 2022 13:50:40 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:49624 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245531AbiAXStn (ORCPT ); Mon, 24 Jan 2022 13:49:43 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9B0DAB8121F; Mon, 24 Jan 2022 18:49:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ABB14C340E5; Mon, 24 Jan 2022 18:49:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050180; bh=WwExldU9G39L2ssPdcPuqzKK5FM6hA2PmC/gQghHkmE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=arAFBWbzB20YeVvl/FNUtFmapyW62sezautw0WludFS7EAZcLzfz2byadfft56Xo8 ugSRB/G2uhNCiTMu/RcnjpiN1WOjVuSHkkVdN8zmWt32XUncanIaY6BakFnoJDui2t WsshAdFYz/B1J2/pDFr6idCf6ic+IczZhph218ys= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Dominik Brodowski , Sasha Levin Subject: [PATCH 4.4 035/114] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() Date: Mon, 24 Jan 2022 19:42:10 +0100 Message-Id: <20220124183928.201248888@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 977d2e7c63c3d04d07ba340b39987742e3241554 ] In nonstatic_find_mem_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_PCCARD_NONSTATIC=3Dy show no new warnings, and our static analyzer no longer warns about this code. Fixes: 49b1153adfe1 ("pcmcia: move all pcmcia_resource_ops providers into o= ne module") Signed-off-by: Zhou Qingyang Signed-off-by: Dominik Brodowski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/pcmcia/rsrc_nonstatic.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstati= c.c index 4d244014f423f..2e96d9273b780 100644 --- a/drivers/pcmcia/rsrc_nonstatic.c +++ b/drivers/pcmcia/rsrc_nonstatic.c @@ -815,6 +815,9 @@ static struct resource *nonstatic_find_mem_region(u_lon= g base, u_long num, unsigned long min, max; int ret, i, j; =20 + if (!res) + return NULL; + low =3D low || !(s->features & SS_CAP_PAGE_REGS); =20 data.mask =3D align - 1; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EC77C433F5 for ; Mon, 24 Jan 2022 18:50:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245521AbiAXSum (ORCPT ); Mon, 24 Jan 2022 13:50:42 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:49730 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241971AbiAXSty (ORCPT ); Mon, 24 Jan 2022 13:49:54 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DFA92B81227; Mon, 24 Jan 2022 18:49:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFFBBC340E5; Mon, 24 Jan 2022 18:49:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050183; bh=J4IP5pvWFW9dfShp8XiaAsZ1GggdgqBAu+DMu39gvzc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qnI0tQzsjCooMeVAK5nIlx5su+nLed/RZ3u2uBgS5EZIISkwNzMPLD/8jhPqcDlJ+ UEV/NEGf3Xw3zoPqkcN9je73RokvY634nqmKoSt5MIBOVawDHlVrF9eQNOyIKiyZ1K B26qEG8RFQ8dtNyLnxEdh0J8Ylk0WmbHkHBS9TZo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Paul Mackerras , linux-ppp@vger.kernel.org, syzbot , Guillaume Nault , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 036/114] ppp: ensure minimum packet size in ppp_write() Date: Mon, 24 Jan 2022 19:42:11 +0100 Message-Id: <20220124183928.230569342@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 44073187990d5629804ce0627525f6ea5cfef171 ] It seems pretty clear ppp layer assumed user space would always be kind to provide enough data in their write() to a ppp device. This patch makes sure user provides at least 2 bytes. It adds PPP_PROTO_LEN macro that could replace in net-next many occurrences of hard-coded 2 value. I replaced only one occurrence to ease backports to stable kernels. The bug manifests in the following report: BUG: KMSAN: uninit-value in ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp= _generic.c:1740 ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740 __ppp_xmit_process+0x23e/0x4b0 drivers/net/ppp/ppp_generic.c:1640 ppp_xmit_process+0x1fe/0x480 drivers/net/ppp/ppp_generic.c:1661 ppp_write+0x5cb/0x5e0 drivers/net/ppp/ppp_generic.c:513 do_iter_write+0xb0c/0x1500 fs/read_write.c:853 vfs_writev fs/read_write.c:924 [inline] do_writev+0x645/0xe00 fs/read_write.c:967 __do_sys_writev fs/read_write.c:1040 [inline] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] ppp_write+0x11d/0x5e0 drivers/net/ppp/ppp_generic.c:501 do_iter_write+0xb0c/0x1500 fs/read_write.c:853 vfs_writev fs/read_write.c:924 [inline] do_writev+0x645/0xe00 fs/read_write.c:967 __do_sys_writev fs/read_write.c:1040 [inline] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Cc: Paul Mackerras Cc: linux-ppp@vger.kernel.org Reported-by: syzbot Acked-by: Guillaume Nault Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/ppp/ppp_generic.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c index 46448d7e32902..679b14759379f 100644 --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -70,6 +70,8 @@ #define MPHDRLEN 6 /* multilink protocol header length */ #define MPHDRLEN_SSN 4 /* ditto with short sequence numbers */ =20 +#define PPP_PROTO_LEN 2 + /* * An instance of /dev/ppp can be associated with either a ppp * interface unit or a ppp channel. In both cases, file->private_data @@ -487,6 +489,9 @@ static ssize_t ppp_write(struct file *file, const char = __user *buf, =20 if (!pf) return -ENXIO; + /* All PPP packets should start with the 2-byte protocol */ + if (count < PPP_PROTO_LEN) + return -EINVAL; ret =3D -ENOMEM; skb =3D alloc_skb(count + pf->hdrlen, GFP_KERNEL); if (!skb) @@ -1293,7 +1298,7 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb) } =20 ++ppp->stats64.tx_packets; - ppp->stats64.tx_bytes +=3D skb->len - 2; + ppp->stats64.tx_bytes +=3D skb->len - PPP_PROTO_LEN; =20 switch (proto) { case PPP_IP: --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9E3FC433FE for ; Mon, 24 Jan 2022 18:50:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245413AbiAXSug (ORCPT ); Mon, 24 Jan 2022 13:50:36 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48420 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245546AbiAXStr (ORCPT ); Mon, 24 Jan 2022 13:49:47 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5BBE1614C9; Mon, 24 Jan 2022 18:49:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 27344C340E5; Mon, 24 Jan 2022 18:49:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050186; bh=u+aBQpTuCtY9LJk5bEHF2dL9U4aLOFqYV4b54fbW9AY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gDnALDqm8Fbits8VUxpINVGxvgG/ewHq9slqwU0Av52W9ic/g+Ayxpu2A9l2bzWfV CgFymSykZFW7/T6jlw8GV8EH621tVIjnT56F2qxLl6M4xDKFeOT3FeCntTEpEHzUcc CX/YNotzuLz5nEURoGRjm1DxohU5Vc57m7/1nOQo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Mark Brown , Sasha Levin Subject: [PATCH 4.4 037/114] spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe Date: Mon, 24 Jan 2022 19:42:12 +0100 Message-Id: <20220124183928.260103655@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 69c1b87516e327a60b39f96b778fe683259408bf ] If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable(). Add missing pm_runtime_disable() for meson_spifc_probe. Fixes: c3e4bc5434d2 ("spi: meson: Add support for Amlogic Meson SPIFC") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220107075424.7774-1-linmq006@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/spi/spi-meson-spifc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/spi/spi-meson-spifc.c b/drivers/spi/spi-meson-spifc.c index 2465259f62411..8e662e7a35181 100644 --- a/drivers/spi/spi-meson-spifc.c +++ b/drivers/spi/spi-meson-spifc.c @@ -357,6 +357,7 @@ static int meson_spifc_probe(struct platform_device *pd= ev) return 0; out_clk: clk_disable_unprepare(spifc->clk); + pm_runtime_disable(spifc->dev); out_err: spi_master_put(master); return ret; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4904DC4332F for ; Mon, 24 Jan 2022 18:50:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245744AbiAXSue (ORCPT ); Mon, 24 Jan 2022 13:50:34 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48460 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241963AbiAXStv (ORCPT ); Mon, 24 Jan 2022 13:49:51 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 75EFC614ED; Mon, 24 Jan 2022 18:49:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4635BC340E5; Mon, 24 Jan 2022 18:49:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050189; bh=3hDW7gIhEOondEF4Jh+0/sHITCd+cZaNzno8dlPJPuE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=miz8Vm8BOybyr3b8UPwu5ebijGp4PIZU37ESmgT+qMDG66t5rR1HUc20su7jkYq8P +OHuytL60VIYXKS2htojHyXhoorI0cM/iqn0+CDnEqcRZxnuBHNoFIp2TDCtrKgGE3 Kywj0g6snL7b7tP+yXRGttGIP+i+aANg/hOki5/w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kurt Van Dijck , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.4 038/114] can: softing: softing_startstop(): fix set but not used variable warning Date: Mon, 24 Jan 2022 19:42:13 +0100 Message-Id: <20220124183928.288083321@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marc Kleine-Budde [ Upstream commit 370d988cc529598ebaec6487d4f84c2115dc696b ] In the function softing_startstop() the variable error_reporting is assigned but not used. The code that uses this variable is commented out. Its stated that the functionality is not finally verified. To fix the warning: | drivers/net/can/softing/softing_fw.c:424:9: error: variable 'error_report= ing' set but not used [-Werror,-Wunused-but-set-variable] remove the comment, activate the code, but add a "0 &&" to the if expression and rely on the optimizer rather than the preprocessor to remove the code. Link: https://lore.kernel.org/all/20220109103126.1872833-1-mkl@pengutronix.= de Fixes: 03fd3cf5a179 ("can: add driver for Softing card") Cc: Kurt Van Dijck Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/can/softing/softing_fw.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing= /softing_fw.c index 52fe50725d749..a74c779feb90e 100644 --- a/drivers/net/can/softing/softing_fw.c +++ b/drivers/net/can/softing/softing_fw.c @@ -576,18 +576,19 @@ int softing_startstop(struct net_device *dev, int up) if (ret < 0) goto failed; } - /* enable_error_frame */ - /* + + /* enable_error_frame + * * Error reporting is switched off at the moment since * the receiving of them is not yet 100% verified * This should be enabled sooner or later - * - if (error_reporting) { + */ + if (0 && error_reporting) { ret =3D softing_fct_cmd(card, 51, "enable_error_frame"); if (ret < 0) goto failed; } - */ + /* initialize interface */ iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 2]); iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 4]); --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3491C433EF for ; Mon, 24 Jan 2022 18:50:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343521AbiAXSuu (ORCPT ); Mon, 24 Jan 2022 13:50:50 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42922 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245375AbiAXStz (ORCPT ); Mon, 24 Jan 2022 13:49:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6A32BC061759; Mon, 24 Jan 2022 10:49:55 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3268EB8121B; Mon, 24 Jan 2022 18:49:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E125C340E7; Mon, 24 Jan 2022 18:49:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050193; bh=1iwX9fiVdN109SENSvLbS9g6OOk2fPkxM7KXrvSR8zU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=B3I/OgOW5w8tqXNrkt1vSIwsGHsYx4WKwUsNOZk7PP8wgWdT78ujJHASRQ2NbEVk2 P0K2DRDOVNC9o+RgBlJAUiYunvtnbzSO6O2/hrlcuVxVYO1Rla6OkuC4vyCki1J181 5QIG5yBJaQp3MAYJU+bU170KbzKFaedqsrRXfprk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.4 039/114] can: xilinx_can: xcan_probe(): check for error irq Date: Mon, 24 Jan 2022 19:42:14 +0100 Message-Id: <20220124183928.318364577@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit c6564c13dae25cd7f8e1de5127b4da4500ee5844 ] For the possible failure of the platform_get_irq(), the returned irq could be error number and will finally cause the failure of the request_irq(). Consider that platform_get_irq() can now in certain cases return -EPROBE_DEFER, and the consequences of letting request_irq() effectively convert that into -EINVAL, even at probe time rather than later on. So it might be better to check just now. Fixes: b1201e44f50b ("can: xilinx CAN controller support") Link: https://lore.kernel.org/all/20211224021324.1447494-1-jiasheng@iscas.a= c.cn Signed-off-by: Jiasheng Jiang Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/can/xilinx_can.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c index 700b98d9c2500..19745e88774e2 100644 --- a/drivers/net/can/xilinx_can.c +++ b/drivers/net/can/xilinx_can.c @@ -1284,7 +1284,12 @@ static int xcan_probe(struct platform_device *pdev) spin_lock_init(&priv->tx_lock); =20 /* Get IRQ for the device */ - ndev->irq =3D platform_get_irq(pdev, 0); + ret =3D platform_get_irq(pdev, 0); + if (ret < 0) + goto err_free; + + ndev->irq =3D ret; + ndev->flags |=3D IFF_ECHO; /* We support local echo */ =20 platform_set_drvdata(pdev, ndev); --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3B85C433F5 for ; Mon, 24 Jan 2022 18:51:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343586AbiAXSvE (ORCPT ); Mon, 24 Jan 2022 13:51:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42936 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245391AbiAXSt5 (ORCPT ); Mon, 24 Jan 2022 13:49:57 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0015BC06176E; Mon, 24 Jan 2022 10:49:56 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 946F3614E8; Mon, 24 Jan 2022 18:49:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7455DC340E5; Mon, 24 Jan 2022 18:49:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050196; bh=tnFxo+X8MhMhJfzopAdktpTd6isKsEkPQG4eerdzgBg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GCRhfs1xSmzSFyX9AaCXh5hNaX+LDyG1xFA0oFB+ZnpOwVemYz07io4c49iQXwZd7 lrWGOh0OjrYRgndCVrxA1qJHapACoo3ZRzfWT/gLJnPuWixO2NzIwD+zeArI8CWbUH Bv3CjOWm8C9De4meJ/jPwnJ6Uxss8eDHUX2/DMsA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro , "Matthew Wilcox (Oracle)" , Dominik Brodowski , Sasha Levin Subject: [PATCH 4.4 040/114] pcmcia: fix setting of kthread task states Date: Mon, 24 Jan 2022 19:42:15 +0100 Message-Id: <20220124183928.348724102@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dominik Brodowski [ Upstream commit fbb3485f1f931102d8ba606f1c28123f5b48afa3 ] We need to set TASK_INTERRUPTIBLE before calling kthread_should_stop(). Otherwise, kthread_stop() might see that the pccardd thread is still in TASK_RUNNING state and fail to wake it up. Additionally, we only need to set the state back to TASK_RUNNING if kthread_should_stop() breaks the loop. Cc: Greg Kroah-Hartman Reported-by: Al Viro Reviewed-by: Matthew Wilcox (Oracle) Fixes: d3046ba809ce ("pcmcia: fix a boot time warning in pcmcia cs code") Signed-off-by: Dominik Brodowski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/pcmcia/cs.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c index c3b615c94b4bf..a92cbc952b70b 100644 --- a/drivers/pcmcia/cs.c +++ b/drivers/pcmcia/cs.c @@ -665,18 +665,16 @@ static int pccardd(void *__skt) if (events || sysfs_events) continue; =20 + set_current_state(TASK_INTERRUPTIBLE); if (kthread_should_stop()) break; =20 - set_current_state(TASK_INTERRUPTIBLE); - schedule(); =20 - /* make sure we are running */ - __set_current_state(TASK_RUNNING); - try_to_freeze(); } + /* make sure we are running before we exit */ + __set_current_state(TASK_RUNNING); =20 /* shut down socket, if a device is still present */ if (skt->state & SOCKET_PRESENT) { --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6996C433FE for ; Mon, 24 Jan 2022 18:51:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343622AbiAXSvK (ORCPT ); Mon, 24 Jan 2022 13:51:10 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48650 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245404AbiAXSuA (ORCPT ); Mon, 24 Jan 2022 13:50:00 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A55CC614FE; Mon, 24 Jan 2022 18:49:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 85D8FC340E8; Mon, 24 Jan 2022 18:49:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050199; bh=xyb7el4B8LdNx+P5MYu2OzNDCK3CD8EPUq/+flDETEc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BYV4ZJVKvVtH5vzFOoAIyhgbDvjkOVbqvGuGKGHPb+dx9tUHtPryP698peloDSE9s 3rVd6NsAbzZlcDS9mixCzoMhILBvun/KBMDOR6RYgGyTfFFozeW76EfwWan52k8fJ1 sK5e+Cs0No535aQ2ysaUtase24w9u9xuEoSFf9ns= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Arnd Bergmann , Jakub Kicinski , Sasha Levin , syzbot+003c0a286b9af5412510@syzkaller.appspotmail.com Subject: [PATCH 4.4 041/114] net: mcs7830: handle usb read errors properly Date: Mon, 24 Jan 2022 19:42:16 +0100 Message-Id: <20220124183928.377684769@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin [ Upstream commit d668769eb9c52b150753f1653f7f5a0aeb8239d2 ] Syzbot reported uninit value in mcs7830_bind(). The problem was in missing validation check for bytes read via usbnet_read_cmd(). usbnet_read_cmd() internally calls usb_control_msg(), that returns number of bytes read. Code should validate that requested number of bytes was actually read. So, this patch adds missing size validation check inside mcs7830_get_reg() to prevent uninit value bugs Reported-and-tested-by: syzbot+003c0a286b9af5412510@syzkaller.appspotmail.c= om Fixes: 2a36d7083438 ("USB: driver for mcs7830 (aka DeLOCK) USB ethernet ada= pter") Signed-off-by: Pavel Skripkin Reviewed-by: Arnd Bergmann Link: https://lore.kernel.org/r/20220106225716.7425-1-paskripkin@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/usb/mcs7830.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c index 4f345bd4e6e29..95151b46f2001 100644 --- a/drivers/net/usb/mcs7830.c +++ b/drivers/net/usb/mcs7830.c @@ -121,8 +121,16 @@ static const char driver_name[] =3D "MOSCHIP usb-ether= net driver"; =20 static int mcs7830_get_reg(struct usbnet *dev, u16 index, u16 size, void *= data) { - return usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ, - 0x0000, index, data, size); + int ret; + + ret =3D usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ, + 0x0000, index, data, size); + if (ret < 0) + return ret; + else if (ret < size) + return -ENODATA; + + return ret; } =20 static int mcs7830_set_reg(struct usbnet *dev, u16 index, u16 size, const = void *data) --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F0C5C433EF for ; Mon, 24 Jan 2022 18:51:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343693AbiAXSv0 (ORCPT ); Mon, 24 Jan 2022 13:51:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42670 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245603AbiAXSuQ (ORCPT ); Mon, 24 Jan 2022 13:50:16 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E6B8C06177F; Mon, 24 Jan 2022 10:50:07 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 57ED9B81223; Mon, 24 Jan 2022 18:50:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F3FFC340E5; Mon, 24 Jan 2022 18:50:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050205; bh=G+qescP4ZkOlDYSWHuyWyHuhkYEpB4EQDZFd4VMvkEI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=khCj/zUQvP5pizOfa+KKkseY8kWzk1J2D/y8byD5kf1WRuMT3sR0wsdcdnZXjcuEc isp4NC4sSl65VrL8+YLNbbJ2i83R0NPT9UVCXc8lm319ZGaGjhY95uQkTklos9aIY8 Au4bxTq6xEVZ9NUF9JCpTjQC5UcW8muL/1MkX6tE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukas Czerner , Jan Kara , Theodore Tso , Sasha Levin Subject: [PATCH 4.4 042/114] ext4: avoid trim error on fs with small groups Date: Mon, 24 Jan 2022 19:42:17 +0100 Message-Id: <20220124183928.406825806@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jan Kara [ Upstream commit 173b6e383d2a204c9921ffc1eca3b87aa2106c33 ] A user reported FITRIM ioctl failing for him on ext4 on some devices without apparent reason. After some debugging we've found out that these devices (being LVM volumes) report rather large discard granularity of 42MB and the filesystem had 1k blocksize and thus group size of 8MB. Because ext4 FITRIM implementation puts discard granularity into minlen, ext4_trim_fs() declared the trim request as invalid. However just silently doing nothing seems to be a more appropriate reaction to such combination of parameters since user did not specify anything wrong. CC: Lukas Czerner Fixes: 5c2ed62fd447 ("ext4: Adjust minlen with discard_granularity in the F= ITRIM ioctl") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20211112152202.26614-1-jack@suse.cz Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- fs/ext4/ioctl.c | 2 -- fs/ext4/mballoc.c | 8 ++++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c index 84f8d07302efa..a224d6efb5a6d 100644 --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -610,8 +610,6 @@ resizefs_out: sizeof(range))) return -EFAULT; =20 - range.minlen =3D max((unsigned int)range.minlen, - q->limits.discard_granularity); ret =3D ext4_trim_fs(sb, &range); if (ret < 0) return ret; diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index ac87f7e5d6a4f..c7be47ed71144 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -5223,6 +5223,7 @@ out: */ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range) { + struct request_queue *q =3D bdev_get_queue(sb->s_bdev); struct ext4_group_info *grp; ext4_group_t group, first_group, last_group; ext4_grpblk_t cnt =3D 0, first_cluster, last_cluster; @@ -5241,6 +5242,13 @@ int ext4_trim_fs(struct super_block *sb, struct fstr= im_range *range) start >=3D max_blks || range->len < sb->s_blocksize) return -EINVAL; + /* No point to try to trim less than discard granularity */ + if (range->minlen < q->limits.discard_granularity) { + minlen =3D EXT4_NUM_B2C(EXT4_SB(sb), + q->limits.discard_granularity >> sb->s_blocksize_bits); + if (minlen > EXT4_CLUSTERS_PER_GROUP(sb)) + goto out; + } if (end >=3D max_blks) end =3D max_blks - 1; if (end <=3D first_data_blk) --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8DAFAC433FE for ; Mon, 24 Jan 2022 18:51:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343640AbiAXSvQ (ORCPT ); Mon, 24 Jan 2022 13:51:16 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48834 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236766AbiAXSuJ (ORCPT ); Mon, 24 Jan 2022 13:50:09 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id ADF0A614D7; Mon, 24 Jan 2022 18:50:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8805DC340E5; Mon, 24 Jan 2022 18:50:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050208; bh=Y6WHr/nO1RZeWIVVbbieVTNw/VGG4rsX2v4GkT3h1gw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YQHHOXMVJqU9dHSgcGeu/JfC3xTDwhUSDLEcACuw+ucoTLMs4wYURTgtZRUhixR+P mlxDNR9saJS+6HsB22PUXrtM+gYg1V0NWQt/BlD9tZ5zyeSqrpooKEY3xM0y7MjZpY u6QD+o0bdEQrX90bNBeHn1LukJg2RJaZmxp/g8sc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 4.4 043/114] ALSA: jack: Add missing rwsem around snd_ctl_remove() calls Date: Mon, 24 Jan 2022 19:42:18 +0100 Message-Id: <20220124183928.438211582@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 06764dc931848c3a9bc01a63bbf76a605408bb54 ] snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it. Fixes: 9058cbe1eed2 ("ALSA: jack: implement kctl creating for jack devices") Link: https://lore.kernel.org/r/20211116071314.15065-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- sound/core/jack.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/core/jack.c b/sound/core/jack.c index fcc972fbe8ffd..ecbdac88f95ad 100644 --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -64,10 +64,13 @@ static int snd_jack_dev_free(struct snd_device *device) struct snd_card *card =3D device->card; struct snd_jack_kctl *jack_kctl, *tmp_jack_kctl; =20 + down_write(&card->controls_rwsem); list_for_each_entry_safe(jack_kctl, tmp_jack_kctl, &jack->kctl_list, list= ) { list_del_init(&jack_kctl->list); snd_ctl_remove(card, jack_kctl->kctl); } + up_write(&card->controls_rwsem); + if (jack->private_free) jack->private_free(jack); =20 --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 658F9C433FE for ; Mon, 24 Jan 2022 18:51:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245636AbiAXSvU (ORCPT ); Mon, 24 Jan 2022 13:51:20 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48884 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245556AbiAXSuM (ORCPT ); Mon, 24 Jan 2022 13:50:12 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 30DC9614CF; Mon, 24 Jan 2022 18:50:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8BF7BC340E5; Mon, 24 Jan 2022 18:50:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050211; bh=pEIEsDSrG3oWDQUzVwhFvwuMJ95sRq01nVXR4rmLB9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v7KYNRYAUMYZdRTogzo3P2mb3SKW/7tn1VZcr8COPmsgpEQcSoURG/+nvMI3aoBW6 SaU+daEhlfJrz2yAXK+wXeGvF4NehQY/GXyZzZAWr/r+w9bByZqyOjN4gFsLvHRRxg aCfmzQ8c9WASMi3BohRKhbFyPYmvafbCQroxil7U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 4.4 044/114] ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls Date: Mon, 24 Jan 2022 19:42:19 +0100 Message-Id: <20220124183928.467243188@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 5471e9762e1af4b7df057a96bfd46cc250979b88 ] snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it. Fixes: a8ff48cb7083 ("ALSA: pcm: Free chmap at PCM free callback, too") Link: https://lore.kernel.org/r/20211116071314.15065-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- sound/core/pcm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/core/pcm.c b/sound/core/pcm.c index cdff5f9764808..6ae28dcd79945 100644 --- a/sound/core/pcm.c +++ b/sound/core/pcm.c @@ -857,7 +857,11 @@ EXPORT_SYMBOL(snd_pcm_new_internal); static void free_chmap(struct snd_pcm_str *pstr) { if (pstr->chmap_kctl) { - snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl); + struct snd_card *card =3D pstr->pcm->card; + + down_write(&card->controls_rwsem); + snd_ctl_remove(card, pstr->chmap_kctl); + up_write(&card->controls_rwsem); pstr->chmap_kctl =3D NULL; } } --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A778DC433FE for ; Mon, 24 Jan 2022 18:51:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245648AbiAXSvY (ORCPT ); Mon, 24 Jan 2022 13:51:24 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48972 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242005AbiAXSuP (ORCPT ); Mon, 24 Jan 2022 13:50:15 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 258E0614EE; Mon, 24 Jan 2022 18:50:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01E44C340EC; Mon, 24 Jan 2022 18:50:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050214; bh=u4rdTNfjLYwAFzUQETfWg9clXMBotXlWIY1suq3Pf0k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eloj5W58uMgn3cktv3oEmNS/OY5acNiWJLdwLyimvooXnK+vyYdpUIqH4ue1Tx+Zv yZPiYcaGJ9BRQzbEEE7Rup5fjkCooJJXFnbG9sFXe9tU2EhC3m5x1oSX6oDhKVcP7/ /aU1Pme6qn54UP/Qx0kqKz/JuQXvr50tc0Ke0h4U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 4.4 045/114] ALSA: hda: Add missing rwsem around snd_ctl_remove() calls Date: Mon, 24 Jan 2022 19:42:20 +0100 Message-Id: <20220124183928.497524144@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 80bd64af75b4bb11c0329bc66c35da2ddfb66d88 ] snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it. Fixes: d13bd412dce2 ("ALSA: hda - Manage kcontrol lists") Link: https://lore.kernel.org/r/20211116071314.15065-3-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- sound/pci/hda/hda_codec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 4962a9d8a572b..7533f8860c57e 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -1608,8 +1608,11 @@ void snd_hda_ctls_clear(struct hda_codec *codec) { int i; struct hda_nid_item *items =3D codec->mixers.list; + + down_write(&codec->card->controls_rwsem); for (i =3D 0; i < codec->mixers.used; i++) snd_ctl_remove(codec->card, items[i].kctl); + up_write(&codec->card->controls_rwsem); snd_array_free(&codec->mixers); snd_array_free(&codec->nids); } --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 02C92C433FE for ; Mon, 24 Jan 2022 18:51:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245673AbiAXSva (ORCPT ); Mon, 24 Jan 2022 13:51:30 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48420 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245638AbiAXSuS (ORCPT ); Mon, 24 Jan 2022 13:50:18 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7AB79614FB; Mon, 24 Jan 2022 18:50:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 60ABDC340E5; Mon, 24 Jan 2022 18:50:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050217; bh=vZjh1a99CF8nIXVH4rDeTL1IpxVOUgeFv9TdLR4y08c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JZukpkwV+6kBsp4mLQoLdRDJaH3E/pC/UwlVSeen34VGBqO09ZyqzyNP3hDgLUeiV 1JN+VvHgJEjn4N4u/+yCp+Y3gUJMh/tAZhToDm8baaJ7Wulvq6GSseslBB3473hy5H D1WmyO3vfcj6xeratxG7dJ6jFnld3qz6m6wLGaUg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peiwei Hu , Michael Ellerman , Sasha Levin Subject: [PATCH 4.4 046/114] powerpc/prom_init: Fix improper check of prom_getprop() Date: Mon, 24 Jan 2022 19:42:21 +0100 Message-Id: <20220124183928.526538761@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peiwei Hu [ Upstream commit 869fb7e5aecbc163003f93f36dcc26d0554319f6 ] prom_getprop() can return PROM_ERROR. Binary operator can not identify it. Fixes: 94d2dde738a5 ("[POWERPC] Efika: prune fixups and make them more care= full") Signed-off-by: Peiwei Hu Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/tencent_BA28CC6897B7C95A92EB8C580B5D1858910= 5@qq.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/powerpc/kernel/prom_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_ini= t.c index 3139533640fc8..204e44cc896ec 100644 --- a/arch/powerpc/kernel/prom_init.c +++ b/arch/powerpc/kernel/prom_init.c @@ -2526,7 +2526,7 @@ static void __init fixup_device_tree_efika_add_phy(vo= id) =20 /* Check if the phy-handle property exists - bail if it does */ rv =3D prom_getprop(node, "phy-handle", prop, sizeof(prop)); - if (!rv) + if (rv <=3D 0) return; =20 /* --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E6626C433F5 for ; Mon, 24 Jan 2022 18:51:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245716AbiAXSvc (ORCPT ); Mon, 24 Jan 2022 13:51:32 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:50044 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245677AbiAXSuX (ORCPT ); Mon, 24 Jan 2022 13:50:23 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 34CB6B8121A; Mon, 24 Jan 2022 18:50:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 52E4BC340E7; Mon, 24 Jan 2022 18:50:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050220; bh=qvukJeWuPH2cNPFvVyAkRgKIPsGmzXQ3XKZOb3xPYf4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Or/PiTuGquJvvVEFrTahnO6HHw38/JzNj2ces5m7QcY1/bqMxwnxat7gVCFR5L5yp FV5ZjMP91OexFjUIMesMeq3tbCT2hq1qZsIFsljqpxywP4vc2hZsNQmbSlCGaFxTEr HvuaW9pXLdM//Z5mJW3SXrgwfgvKe8df83BPAQ1s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bixuan Cui , Takashi Iwai , Sasha Levin Subject: [PATCH 4.4 047/114] ALSA: oss: fix compile error when OSS_DEBUG is enabled Date: Mon, 24 Jan 2022 19:42:22 +0100 Message-Id: <20220124183928.557739669@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bixuan Cui [ Upstream commit 8e7daf318d97f25e18b2fc7eb5909e34cd903575 ] Fix compile error when OSS_DEBUG is enabled: sound/core/oss/pcm_oss.c: In function 'snd_pcm_oss_set_trigger': sound/core/oss/pcm_oss.c:2055:10: error: 'substream' undeclared (first use in this function); did you mean 'csubstream'? pcm_dbg(substream->pcm, "pcm_oss: trigger =3D 0x%x\n", trigger); ^ Fixes: 61efcee8608c ("ALSA: oss: Use standard printk helpers") Signed-off-by: Bixuan Cui Link: https://lore.kernel.org/r/1638349134-110369-1-git-send-email-cuibixua= n@linux.alibaba.com Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- sound/core/oss/pcm_oss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 593791d9a334f..6af4afe23e373 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -2121,7 +2121,7 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss= _file *pcm_oss_file, int tr int err, cmd; =20 #ifdef OSS_DEBUG - pcm_dbg(substream->pcm, "pcm_oss: trigger =3D 0x%x\n", trigger); + pr_debug("pcm_oss: trigger =3D 0x%x\n", trigger); #endif =09 psubstream =3D pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK]; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BFBE5C433F5 for ; Mon, 24 Jan 2022 18:55:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344338AbiAXSy1 (ORCPT ); Mon, 24 Jan 2022 13:54:27 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:51690 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236282AbiAXSwf (ORCPT ); Mon, 24 Jan 2022 13:52:35 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C514A614EC; Mon, 24 Jan 2022 18:52:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9CB7BC340E5; Mon, 24 Jan 2022 18:52:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050354; bh=qtKkJMFmMPARKOd3X03qqmFD/4R6AL0N8Z/w7kj3lLo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=evSUhN1/wjx0RojmPt3msuMt54WzFH2avvDxM9oLw3ScE9fWiePCYElN/6rWOVdRw 9rXqImHreAF0BxyTZToSDqbKfQ+tJZ4QFQmM0KgPOd0yADf8S+pS9M8vji6SwoO1g2 1PaWwV5FQe82HNWkkQyJf/hScXRGzvC+zsO/53PA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kees Cook , Sasha Levin Subject: [PATCH 4.4 048/114] char/mwave: Adjust io port register size Date: Mon, 24 Jan 2022 19:42:23 +0100 Message-Id: <20220124183928.587436790@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kees Cook [ Upstream commit f5912cc19acd7c24b2dbf65a6340bf194244f085 ] Using MKWORD() on a byte-sized variable results in OOB read. Expand the size of the reserved area so both MKWORD and MKBYTE continue to work without overflow. Silences this warning on a -Warray-bounds build: drivers/char/mwave/3780i.h:346:22: error: array subscript 'short unsigned i= nt[0]' is partly outside array bounds of 'DSP_ISA_SLAVE_CONTROL[1]' [-Werro= r=3Darray-bounds] 346 | #define MKWORD(var) (*((unsigned short *)(&var))) | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/char/mwave/3780i.h:356:40: note: in definition of macro 'OutWordDsp' 356 | #define OutWordDsp(index,value) outw(value,usDspBaseIO+index) | ^~~~~ drivers/char/mwave/3780i.c:373:41: note: in expansion of macro 'MKWORD' 373 | OutWordDsp(DSP_IsaSlaveControl, MKWORD(rSlaveControl)); | ^~~~~~ drivers/char/mwave/3780i.c:358:31: note: while referencing 'rSlaveControl' 358 | DSP_ISA_SLAVE_CONTROL rSlaveControl; | ^~~~~~~~~~~~~ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20211203084206.3104326-1-keescook@chromium.= org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/char/mwave/3780i.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/mwave/3780i.h b/drivers/char/mwave/3780i.h index fba6ab1160ce8..b167163b18277 100644 --- a/drivers/char/mwave/3780i.h +++ b/drivers/char/mwave/3780i.h @@ -68,7 +68,7 @@ typedef struct { unsigned char ClockControl:1; /* RW: Clock control: 0=3Dnormal, 1=3Dstop = 3780i clocks */ unsigned char SoftReset:1; /* RW: Soft reset 0=3Dnormal, 1=3Dsoft reset a= ctive */ unsigned char ConfigMode:1; /* RW: Configuration mode, 0=3Dnormal, 1=3Dco= nfig mode */ - unsigned char Reserved:5; /* 0: Reserved */ + unsigned short Reserved:13; /* 0: Reserved */ } DSP_ISA_SLAVE_CONTROL; =20 =20 --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3A52C433EF for ; Mon, 24 Jan 2022 18:52:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245368AbiAXSwg (ORCPT ); Mon, 24 Jan 2022 13:52:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43014 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343617AbiAXSvJ (ORCPT ); Mon, 24 Jan 2022 13:51:09 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C45EEC0617A3; Mon, 24 Jan 2022 10:50:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 68941B810BD; Mon, 24 Jan 2022 18:50:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9980BC340E5; Mon, 24 Jan 2022 18:50:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050245; bh=ZKj5uNOC/s2GY6wnIqIljyZ3oiYEhoGF8RHpon+/GPY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ju+cgYghedEWVbVAGTtpRu5pyHv0ZqcKp+4PaOKiQUsi+PQO+ifIduTMlARTvjCZS Ph5CrOT95UuZGBamz4j8gqtQP9VLk4mkxKRxKYxnUTGmAVNlmHxE+HWUmTTek8oNGj 1vNYn+O1/Ph0VIJ+imD5sYzwRScIsY3bW9U5xjVc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Sasha Levin Subject: [PATCH 4.4 049/114] uio: uio_dmem_genirq: Catch the Exception Date: Mon, 24 Jan 2022 19:42:24 +0100 Message-Id: <20220124183928.616303968@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit eec91694f927d1026974444eb6a3adccd4f1cbc2 ] The return value of dma_set_coherent_mask() is not always 0. To catch the exception in case that dma is not support the mask. Fixes: 0a0c3b5a24bd ("Add new uio device for dynamic memory allocation") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20211204000326.1592687-1-jiasheng@iscas.ac.= cn Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/uio/uio_dmem_genirq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c index a00b4aee6c799..a31b9d5260ca0 100644 --- a/drivers/uio/uio_dmem_genirq.c +++ b/drivers/uio/uio_dmem_genirq.c @@ -194,7 +194,11 @@ static int uio_dmem_genirq_probe(struct platform_devic= e *pdev) goto bad0; } =20 - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + ret =3D dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + if (ret) { + dev_err(&pdev->dev, "DMA enable failed\n"); + return ret; + } =20 priv->uioinfo =3D uioinfo; spin_lock_init(&priv->lock); --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20909C433F5 for ; Mon, 24 Jan 2022 18:52:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343698AbiAXSwo (ORCPT ); Mon, 24 Jan 2022 13:52:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42934 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343688AbiAXSv0 (ORCPT ); Mon, 24 Jan 2022 13:51:26 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ACCD9C061751; Mon, 24 Jan 2022 10:51:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 76795B81227; Mon, 24 Jan 2022 18:51:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AB902C340E7; Mon, 24 Jan 2022 18:51:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050279; bh=D77353yRkWUoeoAkcoVvyTrgVQDRoCb6uV1U5naKB+w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=N6nMVQXiGmiEcZXgJOVq7yIvK/ofCSgFYZXdf3HNDdPmxn7bvRl2yQLcKw+GcPIZy IKrRPQWj/64AKW6lEt7rbXooB55u7Ta8WNOAKdgKjtxrUTeISCOM3m7hTB7Etwtteo /R3y75gqlHwcE49KhZoL3+cHqKDsYPTWDJdF8vXQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Avihai Horon , Mark Zhang , Leon Romanovsky , Jason Gunthorpe , Sasha Levin Subject: [PATCH 4.4 050/114] RDMA/core: Let ib_find_gid() continue search even after empty entry Date: Mon, 24 Jan 2022 19:42:25 +0100 Message-Id: <20220124183928.647449106@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Avihai Horon [ Upstream commit 483d805191a23191f8294bbf9b4e94836f5d92e4 ] Currently, ib_find_gid() will stop searching after encountering the first empty GID table entry. This behavior is wrong since neither IB nor RoCE spec enforce tightly packed GID tables. For example, when a valid GID entry exists at index N, and if a GID entry is empty at index N-1, ib_find_gid() will fail to find the valid entry. Fix it by making ib_find_gid() continue searching even after encountering missing entries. Fixes: 5eb620c81ce3 ("IB/core: Add helpers for uncached GID and P_Key searc= hes") Link: https://lore.kernel.org/r/e55d331b96cecfc2cf19803d16e7109ea966882d.16= 39055490.git.leonro@nvidia.com Signed-off-by: Avihai Horon Reviewed-by: Mark Zhang Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/infiniband/core/device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/dev= ice.c index 179e8134d57fc..a14a3ec99ffe1 100644 --- a/drivers/infiniband/core/device.c +++ b/drivers/infiniband/core/device.c @@ -848,7 +848,8 @@ int ib_find_gid(struct ib_device *device, union ib_gid = *gid, for (i =3D 0; i < device->port_immutable[port].gid_tbl_len; ++i) { ret =3D ib_query_gid(device, port, i, &tmp_gid, NULL); if (ret) - return ret; + continue; + if (!memcmp(&tmp_gid, gid, sizeof *gid)) { *port_num =3D port; if (index) --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 73409C433EF for ; Mon, 24 Jan 2022 18:53:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343531AbiAXSxh (ORCPT ); Mon, 24 Jan 2022 13:53:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42634 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343599AbiAXSwH (ORCPT ); Mon, 24 Jan 2022 13:52:07 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F0D87C061747; Mon, 24 Jan 2022 10:51:54 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 90C2B614F5; Mon, 24 Jan 2022 18:51:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6C720C340E5; Mon, 24 Jan 2022 18:51:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050314; bh=PXQvNXSynGedMbXNskrLymAziKLhVRUN27jmdLGmQu0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kYylGHdHDm2f9+8UnpWPypGsTqYQjLqikenBhiVkmJ++1Fo4GLfAXL1UCowM8n6QU KUurWZWXax5Du9g1rzftJl0vSSOARFGnQ1xK/nCcVuCjrtq46CAurqaI1roeTXE4K/ BUNDKFp/mTCNlLyWZ5lTY1CzBV/PpoPwWqtg1uaQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arnd Bergmann , Mark Brown , Vinod Koul , Sasha Levin Subject: [PATCH 4.4 051/114] dmaengine: pxa/mmp: stop referencing config->slave_id Date: Mon, 24 Jan 2022 19:42:26 +0100 Message-Id: <20220124183928.675412763@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arnd Bergmann [ Upstream commit 134c37fa250a87a7e77c80a7c59ae16c462e46e0 ] The last driver referencing the slave_id on Marvell PXA and MMP platforms was the SPI driver, but this stopped doing so a long time ago, so the TODO from the earlier patch can no be removed. Fixes: b729bf34535e ("spi/pxa2xx: Don't use slave_id of dma_slave_config") Fixes: 13b3006b8ebd ("dma: mmp_pdma: add filter function") Signed-off-by: Arnd Bergmann Acked-by: Mark Brown Link: https://lore.kernel.org/r/20211122222203.4103644-7-arnd@kernel.org Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/dma/mmp_pdma.c | 6 ------ drivers/dma/pxa_dma.c | 7 ------- 2 files changed, 13 deletions(-) diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c index e39457f13d4dd..548600ce6cc87 100644 --- a/drivers/dma/mmp_pdma.c +++ b/drivers/dma/mmp_pdma.c @@ -723,12 +723,6 @@ static int mmp_pdma_config(struct dma_chan *dchan, =20 chan->dir =3D cfg->direction; chan->dev_addr =3D addr; - /* FIXME: drivers should be ported over to use the filter - * function. Once that's done, the following two lines can - * be removed. - */ - if (cfg->slave_id) - chan->drcmr =3D cfg->slave_id; =20 return 0; } diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c index 4251e9ac0373c..ff2e28137a7b1 100644 --- a/drivers/dma/pxa_dma.c +++ b/drivers/dma/pxa_dma.c @@ -959,13 +959,6 @@ static void pxad_get_config(struct pxad_chan *chan, *dcmd |=3D PXA_DCMD_BURST16; else if (maxburst =3D=3D 32) *dcmd |=3D PXA_DCMD_BURST32; - - /* FIXME: drivers should be ported over to use the filter - * function. Once that's done, the following two lines can - * be removed. - */ - if (chan->cfg.slave_id) - chan->drcmr =3D chan->cfg.slave_id; } =20 static struct dma_async_tx_descriptor * --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62F14C43217 for ; Mon, 24 Jan 2022 18:54:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343940AbiAXSyV (ORCPT ); Mon, 24 Jan 2022 13:54:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343592AbiAXSw3 (ORCPT ); Mon, 24 Jan 2022 13:52:29 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A9EA0C0617AD; Mon, 24 Jan 2022 10:52:16 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4A8CD614E5; Mon, 24 Jan 2022 18:52:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0CED3C340E5; Mon, 24 Jan 2022 18:52:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050335; bh=psuyDMM6MvL9f/VYUohhevJw8G1rkBO4hNdRr21J+v0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Bd7GJW9RTu/fYm8ZDBuRPHDDMRpAyvx8kT8Fu5uncAusESUUD6VqQrVGfHxM3UdcE 1qzdMdPNhkLjFPLD/z8wPtElIZXLLMopzEFtRCH7ILuqbXWYa+il/0oSdx/l48GZ6C 86//xFlLuhQ2CEiWiYshSkWdvLCi6mvp67s+i5kI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Krzysztof Kozlowski , Mark Brown , Sasha Levin Subject: [PATCH 4.4 052/114] ASoC: samsung: idma: Check of ioremap return value Date: Mon, 24 Jan 2022 19:42:27 +0100 Message-Id: <20220124183928.707294544@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 3ecb46755eb85456b459a1a9f952c52986bce8ec ] Because of the potential failure of the ioremap(), the buf->area could be NULL. Therefore, we need to check it and return -ENOMEM in order to transfer the error. Fixes: f09aecd50f39 ("ASoC: SAMSUNG: Add I2S0 internal dma driver") Signed-off-by: Jiasheng Jiang Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20211228034026.1659385-1-jiasheng@iscas.ac.= cn Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- sound/soc/samsung/idma.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/samsung/idma.c b/sound/soc/samsung/idma.c index 4ed29ffc1c54e..d9cd9350ffbe2 100644 --- a/sound/soc/samsung/idma.c +++ b/sound/soc/samsung/idma.c @@ -370,6 +370,8 @@ static int preallocate_idma_buffer(struct snd_pcm *pcm,= int stream) buf->addr =3D idma.lp_tx_addr; buf->bytes =3D idma_hardware.buffer_bytes_max; buf->area =3D (unsigned char * __force)ioremap(buf->addr, buf->bytes); + if (!buf->area) + return -ENOMEM; =20 return 0; } --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 884F8C433FE for ; Mon, 24 Jan 2022 18:54:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343925AbiAXSyS (ORCPT ); Mon, 24 Jan 2022 13:54:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43094 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343626AbiAXSw3 (ORCPT ); Mon, 24 Jan 2022 13:52:29 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF95EC0617AF; Mon, 24 Jan 2022 10:52:19 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7F746614BE; Mon, 24 Jan 2022 18:52:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 517B0C340E5; Mon, 24 Jan 2022 18:52:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050338; bh=2C18HuDLscgc4+tKatxU9QstG6/auVKahETKdInN1gE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZGBSCntfqqIT/ZvapoUW/PEumvSrBNBjTGZh7nfKMBYwlFx4fFo2yGSYDtmLLhNZO zhDbvyyC9qsnAnneoaci3rGlIjcwmf7v/ROdlbuR0nZu++kOXkqrL8e/GQ0Jki4Wvl w7sOJyDbxhPomT++AC7BBHNj0Lrnp9toy+7yuZOE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wei Yongjun , Sasha Levin Subject: [PATCH 4.4 053/114] misc: lattice-ecp3-config: Fix task hung when firmware load failed Date: Mon, 24 Jan 2022 19:42:28 +0100 Message-Id: <20220124183928.743604648@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wei Yongjun [ Upstream commit fcee5ce50bdb21116711e38635e3865594af907e ] When firmware load failed, kernel report task hung as follows: INFO: task xrun:5191 blocked for more than 147 seconds. Tainted: G W 5.16.0-rc5-next-20211220+ #11 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:xrun state:D stack: 0 pid: 5191 ppid: 270 flags:0x0000= 0004 Call Trace: __schedule+0xc12/0x4b50 kernel/sched/core.c:4986 schedule+0xd7/0x260 kernel/sched/core.c:6369 (discriminator 1) schedule_timeout+0x7aa/0xa80 kernel/time/timer.c:1857 wait_for_completion+0x181/0x290 kernel/sched/completion.c:85 lattice_ecp3_remove+0x32/0x40 drivers/misc/lattice-ecp3-config.c:221 spi_remove+0x72/0xb0 drivers/spi/spi.c:409 lattice_ecp3_remove() wait for signals from firmware loading, but when load failed, firmware_load() does not send this signal. This cause device remove hung. Fix it by sending signal even if load failed. Fixes: 781551df57c7 ("misc: Add Lattice ECP3 FPGA configuration via SPI") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Link: https://lore.kernel.org/r/20211228125522.3122284-1-weiyongjun1@huawei= .com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/misc/lattice-ecp3-config.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/misc/lattice-ecp3-config.c b/drivers/misc/lattice-ecp3= -config.c index 626fdcaf25101..645d26536114f 100644 --- a/drivers/misc/lattice-ecp3-config.c +++ b/drivers/misc/lattice-ecp3-config.c @@ -81,12 +81,12 @@ static void firmware_load(const struct firmware *fw, vo= id *context) =20 if (fw =3D=3D NULL) { dev_err(&spi->dev, "Cannot load firmware, aborting\n"); - return; + goto out; } =20 if (fw->size =3D=3D 0) { dev_err(&spi->dev, "Error: Firmware size is 0!\n"); - return; + goto out; } =20 /* Fill dummy data (24 stuffing bits for commands) */ @@ -108,7 +108,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) dev_err(&spi->dev, "Error: No supported FPGA detected (JEDEC_ID=3D%08x)!\n", jedec_id); - return; + goto out; } =20 dev_info(&spi->dev, "FPGA %s detected\n", ecp3_dev[i].name); @@ -121,7 +121,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) buffer =3D kzalloc(fw->size + 8, GFP_KERNEL); if (!buffer) { dev_err(&spi->dev, "Error: Can't allocate memory!\n"); - return; + goto out; } =20 /* @@ -160,7 +160,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) "Error: Timeout waiting for FPGA to clear (status=3D%08x)!\n", status); kfree(buffer); - return; + goto out; } =20 dev_info(&spi->dev, "Configuring the FPGA...\n"); @@ -186,7 +186,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) release_firmware(fw); =20 kfree(buffer); - +out: complete(&data->fw_loaded); } =20 --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0847C433EF for ; Mon, 24 Jan 2022 18:54:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344211AbiAXSx6 (ORCPT ); Mon, 24 Jan 2022 13:53:58 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:51480 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343877AbiAXSwW (ORCPT ); Mon, 24 Jan 2022 13:52:22 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6C7EA614E5; Mon, 24 Jan 2022 18:52:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 75F43C340E8; Mon, 24 Jan 2022 18:52:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050341; bh=doETBAvxueIqZl8ijjF86AueapnD81Xaah17I3OIXA4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PJzuhCqlJEIVbzpIrunex7ubplCgoNg1+aaQMiZblHw/mMmGOfr+aUHHvPq5MdA+l 1g5zGfqtKnKbvZDgwMxO/ffndrSmzxDmDASQhTR7lMxfZRVizon/qSaKpRapXTGkud w1reNiAuqdCG4IBHC2kRHuhcN2kHYhlpOyGUuTYw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , kernel test robot , Jonathan Cameron , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.4 054/114] mips: lantiq: add support for clk_set_parent() Date: Mon, 24 Jan 2022 19:42:29 +0100 Message-Id: <20220124183928.773171920@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 76f66dfd60dc5d2f9dec22d99091fea1035c5d03 ] Provide a simple implementation of clk_set_parent() in the lantiq subarch so that callers of it will build without errors. Fixes these build errors: ERROR: modpost: "clk_set_parent" [sound/soc/jz4740/snd-soc-jz4740-i2s.ko] u= ndefined! ERROR: modpost: "clk_set_parent" [sound/soc/atmel/snd-soc-atmel-i2s.ko] und= efined! Fixes: 171bb2f19ed6 ("MIPS: Lantiq: Add initial support for Lantiq SoCs") Signed-off-by: Randy Dunlap Reported-by: kernel test robot --to=3Dlinux-mips@vger.kernel.org --cc=3D"John Crispin " = --cc=3D"Jonathan Cameron " --cc=3D"Russell King " --cc=3D"Andy Shevchenko " --cc= =3Dalsa-devel@alsa-project.org --to=3D"Thomas Bogendoerfer " Reviewed-by: Jonathan Cameron Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/mips/lantiq/clk.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c index a0706fd4ce0a0..80bdcb26ef8a3 100644 --- a/arch/mips/lantiq/clk.c +++ b/arch/mips/lantiq/clk.c @@ -165,6 +165,12 @@ struct clk *of_clk_get_from_provider(struct of_phandle= _args *clkspec) return NULL; } =20 +int clk_set_parent(struct clk *clk, struct clk *parent) +{ + return 0; +} +EXPORT_SYMBOL(clk_set_parent); + static inline u32 get_counter_resolution(void) { u32 res; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A960DC4332F for ; Mon, 24 Jan 2022 18:55:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344370AbiAXSyd (ORCPT ); Mon, 24 Jan 2022 13:54:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42742 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343954AbiAXSwr (ORCPT ); Mon, 24 Jan 2022 13:52:47 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 170C1C06177D; Mon, 24 Jan 2022 10:52:26 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id ABA8F614EC; Mon, 24 Jan 2022 18:52:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 715D0C340E8; Mon, 24 Jan 2022 18:52:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050345; bh=x4SL9WF8io313e5A39RZiytXL/H7HNZcY5I6SgbcOpA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LK+AkndQO4wk0E76lRCINlYVI3r72xApg4bYfV2FPKQYUefeL1KqYmVeALO/zPTh9 720EoYCFXFterTUAXuUea4/ne7b3q+jvdscAcTnkwCUBOBD7dms3ZKRySEUhmWQgjA On4HeLH7lUji/djLQfnrPWN4DaBqfrqLqP76Y7S8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Jonathan Cameron , Florian Fainelli , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.4 055/114] mips: bcm63xx: add support for clk_set_parent() Date: Mon, 24 Jan 2022 19:42:30 +0100 Message-Id: <20220124183928.802970550@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 6f03055d508ff4feb8db02ba3df9303a1db8d381 ] The MIPS BMC63XX subarch does not provide/support clk_set_parent(). This causes build errors in a few drivers, so add a simple implementation of that function so that callers of it will build without errors. Fixes these build errors: ERROR: modpost: "clk_set_parent" [sound/soc/jz4740/snd-soc-jz4740-i2s.ko] u= ndefined! ERROR: modpost: "clk_set_parent" [sound/soc/atmel/snd-soc-atmel-i2s.ko] und= efined! Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx f= amily of SOCs." ) Signed-off-by: Randy Dunlap Reviewed-by: Jonathan Cameron Acked-by: Florian Fainelli Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/mips/bcm63xx/clk.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c index ef268c9aac80d..fe90c1c86a600 100644 --- a/arch/mips/bcm63xx/clk.c +++ b/arch/mips/bcm63xx/clk.c @@ -339,6 +339,12 @@ struct clk *clk_get_parent(struct clk *clk) } EXPORT_SYMBOL(clk_get_parent); =20 +int clk_set_parent(struct clk *clk, struct clk *parent) +{ + return 0; +} +EXPORT_SYMBOL(clk_set_parent); + unsigned long clk_get_rate(struct clk *clk) { return clk->rate; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0F9DC433FE for ; Mon, 24 Jan 2022 18:54:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344302AbiAXSyP (ORCPT ); Mon, 24 Jan 2022 13:54:15 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:51594 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245665AbiAXSw3 (ORCPT ); Mon, 24 Jan 2022 13:52:29 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BAFED614DF; Mon, 24 Jan 2022 18:52:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83D0EC340E5; Mon, 24 Jan 2022 18:52:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050348; bh=eiYg0iM2iJ3C43B6e4lYIqT+CDmMTJ/3boG0NTD4FaI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eKYDSkeUscFojejx/b4ViOJ1bFrFE7TuVfrH1GHK3c3XE+RR8mzG8oafhfucdhRCd MlsUDElLo6Tz/GeUWbV7xW9Xtp+MOzgSSngVFnJtfgR6XDYZWsU5qKxPD3csCmnx1d pirIvmXJlk1z2dPSu68gxtAXpJeyZyNsgctXMDLo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kamal Heib , Leon Romanovsky , Jason Gunthorpe , Sasha Levin Subject: [PATCH 4.4 056/114] RDMA/cxgb4: Set queue pair state when being queried Date: Mon, 24 Jan 2022 19:42:31 +0100 Message-Id: <20220124183928.833978329@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kamal Heib [ Upstream commit e375b9c92985e409c4bb95dd43d34915ea7f5e28 ] The API for ib_query_qp requires the driver to set cur_qp_state on return, add the missing set. Fixes: 67bbc05512d8 ("RDMA/cxgb4: Add query_qp support") Link: https://lore.kernel.org/r/20211220152530.60399-1-kamalheib1@gmail.com Signed-off-by: Kamal Heib Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/infiniband/hw/cxgb4/qp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4= /qp.c index 67e4002bd776e..31a8119685114 100644 --- a/drivers/infiniband/hw/cxgb4/qp.c +++ b/drivers/infiniband/hw/cxgb4/qp.c @@ -1896,6 +1896,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp= _attr *attr, memset(attr, 0, sizeof *attr); memset(init_attr, 0, sizeof *init_attr); attr->qp_state =3D to_ib_qp_state(qhp->attr.state); + attr->cur_qp_state =3D to_ib_qp_state(qhp->attr.state); init_attr->cap.max_send_wr =3D qhp->attr.sq_num_entries; init_attr->cap.max_recv_wr =3D qhp->attr.rq_num_entries; init_attr->cap.max_send_sge =3D qhp->attr.sq_max_sges; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65F44C433FE for ; Mon, 24 Jan 2022 18:54:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343959AbiAXSyW (ORCPT ); Mon, 24 Jan 2022 13:54:22 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:51522 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343689AbiAXSwd (ORCPT ); Mon, 24 Jan 2022 13:52:33 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6E810B81227; Mon, 24 Jan 2022 18:52:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9D143C340E5; Mon, 24 Jan 2022 18:52:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050351; bh=i5PnfJ5ACF12zxhZM9oXbHuElB0dKR9hdwAK0CLrRJE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Gsq8CSzOSFBF061eTlTuHIkxF5w5Lp0G2WyL1CMAlTjerF1t1x+s5qCXK5tYsHtX3 pW4Hgf7DOb+9quT/uWAcBTrwHsFFu5hzJtt7cQ2xb1VBfpGMCSEbzcSW63BzPNWRvU t2AqLbvH+/2OoquszEMqP4eeoUpDhwKGdd2UKei4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wei Yongjun , Marcel Holtmann , Sasha Levin Subject: [PATCH 4.4 057/114] Bluetooth: Fix debugfs entry leak in hci_register_dev() Date: Mon, 24 Jan 2022 19:42:32 +0100 Message-Id: <20220124183928.865449135@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wei Yongjun [ Upstream commit 5a4bb6a8e981d3d0d492aa38412ee80b21033177 ] Fault injection test report debugfs entry leak as follows: debugfs: Directory 'hci0' with parent 'bluetooth' already present! When register_pm_notifier() failed in hci_register_dev(), the debugfs create by debugfs_create_dir() do not removed in the error handing path. Add the remove debugfs code to fix it. Signed-off-by: Wei Yongjun Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- net/bluetooth/hci_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index eefaa10c74dbb..1cc78b88a0d9f 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3459,6 +3459,7 @@ int hci_register_dev(struct hci_dev *hdev) return id; =20 err_wqueue: + debugfs_remove_recursive(hdev->debugfs); destroy_workqueue(hdev->workqueue); destroy_workqueue(hdev->req_workqueue); err: --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9137BC433FE for ; Mon, 24 Jan 2022 18:52:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343507AbiAXSwC (ORCPT ); Mon, 24 Jan 2022 13:52:02 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:48834 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245520AbiAXSut (ORCPT ); Mon, 24 Jan 2022 13:50:49 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E1ADE614BE; Mon, 24 Jan 2022 18:50:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA6F9C340E7; Mon, 24 Jan 2022 18:50:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050248; bh=tvYs1VSePffa4h5x8YjWrQTm+RhMLjGYNBC6EzBNKdU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HYtU/NmsD1M78KnQb4IIgWTAAGi3ZjPRKzXlOuDjJw4lIlSHKaPJXwS000mMsLzOb ppyNY1TcM2/CEYkLdSL/fRkXmFRNiiq9NRkyXFtDuAEa63VDMk4OpIR6+qz1N6zozA wfOw5Qz0CsW6da0d30crwJvf6LjxcHAIz3qu2xKI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Aring , David Teigland , Sasha Levin Subject: [PATCH 4.4 058/114] fs: dlm: filter user dlm messages for kernel locks Date: Mon, 24 Jan 2022 19:42:33 +0100 Message-Id: <20220124183928.895238375@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Aring [ Upstream commit 6c2e3bf68f3e5e5a647aa52be246d5f552d7496d ] This patch fixes the following crash by receiving a invalid message: [ 160.672220] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 160.676206] BUG: KASAN: user-memory-access in dlm_user_add_ast+0xc3/0x370 [ 160.679659] Read of size 8 at addr 00000000deadbeef by task kworker/u32:= 13/319 [ 160.681447] [ 160.681824] CPU: 10 PID: 319 Comm: kworker/u32:13 Not tainted 5.14.0-rc2= + #399 [ 160.683472] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.14.0-1.module+el8= .6.0+12648+6ede71a5 04/01/2014 [ 160.685574] Workqueue: dlm_recv process_recv_sockets [ 160.686721] Call Trace: [ 160.687310] dump_stack_lvl+0x56/0x6f [ 160.688169] ? dlm_user_add_ast+0xc3/0x370 [ 160.689116] kasan_report.cold.14+0x116/0x11b [ 160.690138] ? dlm_user_add_ast+0xc3/0x370 [ 160.690832] dlm_user_add_ast+0xc3/0x370 [ 160.691502] _receive_unlock_reply+0x103/0x170 [ 160.692241] _receive_message+0x11df/0x1ec0 [ 160.692926] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 160.693700] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 160.694427] ? lock_acquire+0x175/0x400 [ 160.695058] ? do_purge.isra.51+0x200/0x200 [ 160.695744] ? lock_acquired+0x360/0x5d0 [ 160.696400] ? lock_contended+0x6a0/0x6a0 [ 160.697055] ? lock_release+0x21d/0x5e0 [ 160.697686] ? lock_is_held_type+0xe0/0x110 [ 160.698352] ? lock_is_held_type+0xe0/0x110 [ 160.699026] ? ___might_sleep+0x1cc/0x1e0 [ 160.699698] ? dlm_wait_requestqueue+0x94/0x140 [ 160.700451] ? dlm_process_requestqueue+0x240/0x240 [ 160.701249] ? down_write_killable+0x2b0/0x2b0 [ 160.701988] ? do_raw_spin_unlock+0xa2/0x130 [ 160.702690] dlm_receive_buffer+0x1a5/0x210 [ 160.703385] dlm_process_incoming_buffer+0x726/0x9f0 [ 160.704210] receive_from_sock+0x1c0/0x3b0 [ 160.704886] ? dlm_tcp_shutdown+0x30/0x30 [ 160.705561] ? lock_acquire+0x175/0x400 [ 160.706197] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 160.706941] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 160.707681] process_recv_sockets+0x32/0x40 [ 160.708366] process_one_work+0x55e/0xad0 [ 160.709045] ? pwq_dec_nr_in_flight+0x110/0x110 [ 160.709820] worker_thread+0x65/0x5e0 [ 160.710423] ? process_one_work+0xad0/0xad0 [ 160.711087] kthread+0x1ed/0x220 [ 160.711628] ? set_kthread_struct+0x80/0x80 [ 160.712314] ret_from_fork+0x22/0x30 The issue is that we received a DLM message for a user lock but the destination lock is a kernel lock. Note that the address which is trying to derefence is 00000000deadbeef, which is in a kernel lock lkb->lkb_astparam, this field should never be derefenced by the DLM kernel stack. In case of a user lock lkb->lkb_astparam is lkb->lkb_ua (memory is shared by a union field). The struct lkb_ua will be handled by the DLM kernel stack but on a kernel lock it will contain invalid data and ends in most likely crashing the kernel. It can be reproduced with two cluster nodes. node 2: dlm_tool join test echo "862 fooobaar 1 2 1" > /sys/kernel/debug/dlm/test_locks echo "862 3 1" > /sys/kernel/debug/dlm/test_waiters node 1: dlm_tool join test python: foo =3D DLM(h_cmd=3D3, o_nextcmd=3D1, h_nodeid=3D1, h_lockspace=3D0x7722202= 7, \ m_type=3D7, m_flags=3D0x1, m_remid=3D0x862, m_result=3D0xFFFEFFFE) newFile =3D open("/sys/kernel/debug/dlm/comms/2/rawmsg", "wb") newFile.write(bytes(foo)) Signed-off-by: Alexander Aring Signed-off-by: David Teigland Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- fs/dlm/lock.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c index 3a7f401e943c1..ffab7dc881574 100644 --- a/fs/dlm/lock.c +++ b/fs/dlm/lock.c @@ -3975,6 +3975,14 @@ static int validate_message(struct dlm_lkb *lkb, str= uct dlm_message *ms) int from =3D ms->m_header.h_nodeid; int error =3D 0; =20 + /* currently mixing of user/kernel locks are not supported */ + if (ms->m_flags & DLM_IFL_USER && ~lkb->lkb_flags & DLM_IFL_USER) { + log_error(lkb->lkb_resource->res_ls, + "got user dlm message for a kernel lock"); + error =3D -EINVAL; + goto out; + } + switch (ms->m_type) { case DLM_MSG_CONVERT: case DLM_MSG_UNLOCK: @@ -4003,6 +4011,7 @@ static int validate_message(struct dlm_lkb *lkb, stru= ct dlm_message *ms) error =3D -EINVAL; } =20 +out: if (error) log_error(lkb->lkb_resource->res_ls, "ignore invalid message %d from %d %x %x %x %d", --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAC4EC433FE for ; Mon, 24 Jan 2022 18:52:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343713AbiAXSw7 (ORCPT ); Mon, 24 Jan 2022 13:52:59 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:50446 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343541AbiAXSux (ORCPT ); Mon, 24 Jan 2022 13:50:53 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A5BEAB8122D; Mon, 24 Jan 2022 18:50:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CFBF7C36AEC; Mon, 24 Jan 2022 18:50:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050251; bh=c/VsU68PR/sAcuUNBYexTDgEwJxQ72KXGmsmTdrHLqg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h7uX4RX6UmZYBlwxO4NhXXzjhRYKoQxWqDJTqxlui1LQCs/RJs6QtaUBfiVRxS6HA EF+uztE6fmlPfSM4U/AXOatFnSGauM8xcbptMHEcLXwff9bAcKqsKJFiusCxRpQr98 Vz3OXwREAuLOltUwb77iy7nntzBciF1QmUNd9KlY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zekun Shen , Kalle Valo , Sasha Levin Subject: [PATCH 4.4 059/114] ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply Date: Mon, 24 Jan 2022 19:42:34 +0100 Message-Id: <20220124183928.927893679@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit ae80b6033834342601e99f74f6a62ff5092b1cee ] Unexpected WDCMSG_TARGET_START replay can lead to null-ptr-deref when ar->tx_cmd->odata is NULL. The patch adds a null check to prevent such case. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] ar5523_cmd+0x46a/0x581 [ar5523] ar5523_probe.cold+0x1b7/0x18da [ar5523] ? ar5523_cmd_rx_cb+0x7a0/0x7a0 [ar5523] ? __pm_runtime_set_status+0x54a/0x8f0 ? _raw_spin_trylock_bh+0x120/0x120 ? pm_runtime_barrier+0x220/0x220 ? __pm_runtime_resume+0xb1/0xf0 usb_probe_interface+0x25b/0x710 really_probe+0x209/0x5d0 driver_probe_device+0xc6/0x1b0 device_driver_attach+0xe2/0x120 I found the bug using a custome USBFuzz port. It's a research work to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, providing hand-crafted usb descriptors to QEMU. After fixing the code (fourth byte in usb packet) to WDCMSG_TARGET_START, I got the null-ptr-deref bug. I believe the bug is triggerable whenever cmd->odata is NULL. After patching, I tested with the same input and no longer see the KASAN report. This was NOT tested on a real device. Signed-off-by: Zekun Shen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YXsmPQ3awHFLuAj2@10-18-43-117.dynapool.wire= less.nyu.edu Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/wireless/ath/ar5523/ar5523.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireles= s/ath/ar5523/ar5523.c index bc6330b437958..67c20cb92f138 100644 --- a/drivers/net/wireless/ath/ar5523/ar5523.c +++ b/drivers/net/wireless/ath/ar5523/ar5523.c @@ -153,6 +153,10 @@ static void ar5523_cmd_rx_cb(struct urb *urb) ar5523_err(ar, "Invalid reply to WDCMSG_TARGET_START"); return; } + if (!cmd->odata) { + ar5523_err(ar, "Unexpected WDCMSG_TARGET_START reply"); + return; + } memcpy(cmd->odata, hdr + 1, sizeof(u32)); cmd->olen =3D sizeof(u32); cmd->res =3D 0; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7749FC433EF for ; Mon, 24 Jan 2022 18:52:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343676AbiAXSwb (ORCPT ); Mon, 24 Jan 2022 13:52:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43028 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343628AbiAXSvM (ORCPT ); Mon, 24 Jan 2022 13:51:12 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 789BFC0617BA; Mon, 24 Jan 2022 10:50:55 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 157B4614DF; Mon, 24 Jan 2022 18:50:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DBFD1C340E5; Mon, 24 Jan 2022 18:50:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050254; bh=U6RKr9vFK/7T1bwk178thgThkYtuoXo3nEgOP/hosJw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gCAq9dj3PVUxaNfvvK8rmzYXVAOr4Vfy9Wk6aeIEL2WENtGf4MFaGfWb8GZWkM+U2 0DDQv69WR4xoEDzhBJ9Pe3fTD9lCtalCW+EyydOz0GSPE+WMmCuweKW848FkJ/Mxhz z+Hq/7HYrX2mMN0iCFaNFmuqBcrNfyFapbuLnX2c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Keeping , Pavankumar Kondeti , Sasha Levin Subject: [PATCH 4.4 060/114] usb: gadget: f_fs: Use stream_open() for endpoint files Date: Mon, 24 Jan 2022 19:42:35 +0100 Message-Id: <20220124183928.957319424@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavankumar Kondeti [ Upstream commit c76ef96fc00eb398c8fc836b0eb2f82bcc619dc7 ] Function fs endpoint file operations are synchronized via an interruptible mutex wait. However we see threads that do ep file operations concurrently are getting blocked for the mutex lock in __fdget_pos(). This is an uninterruptible wait and we see hung task warnings and kernel panic if hung_task_panic systcl is enabled if host does not send/receive the data for long time. The reason for threads getting blocked in __fdget_pos() is due to the file position protection introduced by the commit 9c225f2655e3 ("vfs: atomic f_pos accesses as per POSIX"). Since function fs endpoint files does not have the notion of the file position, switch to the stream mode. This will bypass the file position mutex and threads will be blocked in interruptible state for the function fs mutex. It should not affects user space as we are only changing the task state changes the task state from UNINTERRUPTIBLE to INTERRUPTIBLE while waiting for the USB transfers to be finished. However there is a slight change to the O_NONBLOCK behavior. Earlier threads that are using O_NONBLOCK are also getting blocked inside fdget_pos(). Now they reach to function fs and error code is returned. The non blocking behavior is actually honoured now. Reviewed-by: John Keeping Signed-off-by: Pavankumar Kondeti Link: https://lore.kernel.org/r/1636712682-1226-1-git-send-email-quic_pkond= eti@quicinc.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/usb/gadget/function/f_fs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/functi= on/f_fs.c index 390e592358e63..7af4d05dabeaa 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -541,7 +541,7 @@ static int ffs_ep0_open(struct inode *inode, struct fil= e *file) file->private_data =3D ffs; ffs_data_opened(ffs); =20 - return 0; + return stream_open(inode, file); } =20 static int ffs_ep0_release(struct inode *inode, struct file *file) @@ -882,7 +882,7 @@ ffs_epfile_open(struct inode *inode, struct file *file) file->private_data =3D epfile; ffs_data_opened(epfile->ffs); =20 - return 0; + return stream_open(inode, file); } =20 static int ffs_aio_cancel(struct kiocb *kiocb) --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C635EC433FE for ; Mon, 24 Jan 2022 18:52:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245562AbiAXSwF (ORCPT ); Mon, 24 Jan 2022 13:52:05 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49676 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343561AbiAXSu6 (ORCPT ); Mon, 24 Jan 2022 13:50:58 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3D08A614EC; Mon, 24 Jan 2022 18:50:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1DB9AC340E5; Mon, 24 Jan 2022 18:50:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050257; bh=YIMLe/3p1ZJgH25RIuDqydanQaUzOC5cKLPXYArW3Fg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=B1p++vYPoocCBohtYkv5z3XJGp84Eygl7B8rXPf6LwUB9rWDMhR74RNDOAwxLnow+ uGZr5KbDv/T3jdQ3Oose94infJkBgerDsI0QlATQ1URF8vpTZ6EFAeXFw4g/hmxk+X 43/YnpYAOEuI37atarjTiQvZcWVDG1mLYQXnl/Ao= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.4 061/114] media: b2c2: Add missing check in flexcop_pci_isr: Date: Mon, 24 Jan 2022 19:42:36 +0100 Message-Id: <20220124183928.988733869@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit b13203032e679674c7c518f52a7ec0801ca3a829 ] A out-of-bounds bug can be triggered by an interrupt, the reason for this bug is the lack of checking of register values. In flexcop_pci_isr, the driver reads value from a register and uses it as a dma address. Finally, this address will be passed to the count parameter of find_next_packet. If this value is larger than the size of dma, the index of buffer will be out-of-bounds. Fix this by adding a check after reading the value of the register. The following KASAN report reveals it: BUG: KASAN: slab-out-of-bounds in find_next_packet drivers/media/dvb-core/dvb_demux.c:528 [inline] BUG: KASAN: slab-out-of-bounds in _dvb_dmx_swfilter drivers/media/dvb-core/dvb_demux.c:572 [inline] BUG: KASAN: slab-out-of-bounds in dvb_dmx_swfilter+0x3fa/0x420 drivers/media/dvb-core/dvb_demux.c:603 Read of size 1 at addr ffff8880608c00a0 by task swapper/2/0 CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xec/0x156 lib/dump_stack.c:118 print_address_description+0x78/0x290 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report+0x25b/0x380 mm/kasan/report.c:412 __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:430 find_next_packet drivers/media/dvb-core/dvb_demux.c:528 [inline] _dvb_dmx_swfilter drivers/media/dvb-core/dvb_demux.c:572 [inline] dvb_dmx_swfilter+0x3fa/0x420 drivers/media/dvb-core/dvb_demux.c:603 flexcop_pass_dmx_data+0x2e/0x40 drivers/media/common/b2c2/flexcop.c:167 flexcop_pci_isr+0x3d1/0x5d0 drivers/media/pci/b2c2/flexcop-pci.c:212 __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149 handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189 handle_irq_event+0xac/0x140 kernel/irq/handle.c:206 handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87 do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 RIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61 Code: 00 00 55 be 04 00 00 00 48 c7 c7 00 62 2f 8c 48 89 e5 e8 fb 31 e8 f8 8b 05 75 4f 8e 03 85 c0 7e 07 0f 00 2d 8a 61 66 00 fb f4 <5d> c3 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 RSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde RAX: 0000000000000000 RBX: ffffffff8bde44c8 RCX: ffffffff88a11285 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2f6200 RBP: ffff88806b71fcc8 R08: fffffbfff185ec40 R09: fffffbfff185ec40 R10: 0000000000000001 R11: fffffbfff185ec40 R12: 0000000000000002 R13: ffffffff8be9d6e0 R14: 0000000000000000 R15: 0000000000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline] default_idle+0x6f/0x360 arch/x86/kernel/process.c:557 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548 default_idle_call+0x3b/0x60 kernel/sched/idle.c:93 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263 cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369 start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 Allocated by task 1: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:553 kasan_slab_alloc+0x11/0x20 mm/kasan/kasan.c:490 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slub.c:2741 [inline] slab_alloc mm/slub.c:2749 [inline] kmem_cache_alloc+0xeb/0x280 mm/slub.c:2754 kmem_cache_zalloc include/linux/slab.h:699 [inline] __kernfs_new_node+0xe2/0x6f0 fs/kernfs/dir.c:633 kernfs_new_node+0x9a/0x120 fs/kernfs/dir.c:693 __kernfs_create_file+0x5f/0x340 fs/kernfs/file.c:992 sysfs_add_file_mode_ns+0x22a/0x4e0 fs/sysfs/file.c:306 create_files fs/sysfs/group.c:63 [inline] internal_create_group+0x34e/0xc30 fs/sysfs/group.c:147 sysfs_create_group fs/sysfs/group.c:173 [inline] sysfs_create_groups+0x9c/0x140 fs/sysfs/group.c:200 driver_add_groups+0x3e/0x50 drivers/base/driver.c:129 bus_add_driver+0x3a5/0x790 drivers/base/bus.c:684 driver_register+0x1cd/0x410 drivers/base/driver.c:170 __pci_register_driver+0x197/0x200 drivers/pci/pci-driver.c:1411 cx88_audio_pci_driver_init+0x23/0x25 drivers/media/pci/cx88/cx88-alsa.c: 1017 do_one_initcall+0xe0/0x610 init/main.c:884 do_initcall_level init/main.c:952 [inline] do_initcalls init/main.c:960 [inline] do_basic_setup init/main.c:978 [inline] kernel_init_freeable+0x4d0/0x592 init/main.c:1145 kernel_init+0x18/0x190 init/main.c:1062 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8880608c0000 which belongs to the cache kernfs_node_cache of size 160 The buggy address is located 0 bytes to the right of 160-byte region [ffff8880608c0000, ffff8880608c00a0) The buggy address belongs to the page: page:ffffea0001823000 count:1 mapcount:0 mapping:ffff88806bed1e00 index:0x0 compound_mapcount: 0 flags: 0x100000000008100(slab|head) raw: 0100000000008100 dead000000000100 dead000000000200 ffff88806bed1e00 raw: 0000000000000000 0000000000240024 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880608bff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880608c0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880608c0080: 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 ^ ffff8880608c0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880608c0180: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Link: https://lore.kernel.org/linux-media/1620723603-30912-1-git-send-email= -zheyuma97@gmail.com Reported-by: Zheyu Ma Signed-off-by: Zheyu Ma Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/pci/b2c2/flexcop-pci.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/pci/b2c2/flexcop-pci.c b/drivers/media/pci/b2c2/= flexcop-pci.c index 8b5e0b3a92a0c..2f496c05a3316 100644 --- a/drivers/media/pci/b2c2/flexcop-pci.c +++ b/drivers/media/pci/b2c2/flexcop-pci.c @@ -184,6 +184,8 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_i= d) dma_addr_t cur_addr =3D fc->read_ibi_reg(fc,dma1_008).dma_0x8.dma_cur_addr << 2; u32 cur_pos =3D cur_addr - fc_pci->dma[0].dma_addr0; + if (cur_pos > fc_pci->dma[0].size * 2) + goto error; =20 deb_irq("%u irq: %08x cur_addr: %llx: cur_pos: %08x, " "last_cur_pos: %08x ", @@ -225,6 +227,7 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_i= d) ret =3D IRQ_NONE; } =20 +error: spin_unlock_irqrestore(&fc_pci->irq_lock, flags); return ret; } --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 87915C4332F for ; Mon, 24 Jan 2022 18:52:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343621AbiAXSwI (ORCPT ); Mon, 24 Jan 2022 13:52:08 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49716 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343581AbiAXSvB (ORCPT ); Mon, 24 Jan 2022 13:51:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8385561500; Mon, 24 Jan 2022 18:51:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 40CEAC340E5; Mon, 24 Jan 2022 18:51:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050261; bh=ltfBF/t0KEK7VJPJMB0V8iusdFPJKGVQeC+PLK7eJGQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yoM/w3laACBOuB7BhhLs1kSVlLYchWKnfjI0ebsFOjhzF6Uua1BKllnjJ7Hkko6we PrgxEt94D3UuHz9mgH9No2UQDcSlSpRLo3bHhOwtmlwUYAWOmYKhRS7OfT7it+k01G KHX8/KY8NX0eJH8nCEkmr4DUlhpdlizw03X56h/U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengfeng Ye , Sebastian Reichel , Sasha Levin Subject: [PATCH 4.4 062/114] HSI: core: Fix return freed object in hsi_new_client Date: Mon, 24 Jan 2022 19:42:37 +0100 Message-Id: <20220124183929.023202219@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengfeng Ye [ Upstream commit a1ee1c08fcd5af03187dcd41dcab12fd5b379555 ] cl is freed on error of calling device_register, but this object is return later, which will cause uaf issue. Fix it by return NULL on error. Signed-off-by: Chengfeng Ye Signed-off-by: Sebastian Reichel Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/hsi/hsi.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/hsi/hsi.c b/drivers/hsi/hsi.c index 55e36fcd7ff35..e1080f005a19e 100644 --- a/drivers/hsi/hsi.c +++ b/drivers/hsi/hsi.c @@ -115,6 +115,7 @@ struct hsi_client *hsi_new_client(struct hsi_port *port, if (device_register(&cl->device) < 0) { pr_err("hsi: failed to register client: %s\n", info->name); put_device(&cl->device); + goto err; } =20 return cl; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A26BEC433EF for ; Mon, 24 Jan 2022 18:52:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343901AbiAXSwi (ORCPT ); Mon, 24 Jan 2022 13:52:38 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49780 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245564AbiAXSvF (ORCPT ); Mon, 24 Jan 2022 13:51:05 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AC1F7614F4; Mon, 24 Jan 2022 18:51:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 85CDDC340E5; Mon, 24 Jan 2022 18:51:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050264; bh=R+egNYGbRmltRhDCPHVWNkHEUf6HAsx1h7zm+wAUvEU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Et3Azm6TBqFxK/ib8TAEcMSBoezrOFWkhXD54+gqlNgcoEal6f1+aCL8xmopV2fAB JASYi1i8YDU3Hp1PEAMbOqhytuhUOTKuafC7/hszqCTTdMMmt2MSMp3z/9xhR4GMki QSBboZc8hNRRbXZYv3jeqWjJUxJYPIuXihrimQP0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brendan Dolan-Gavitt , Zekun Shen , Kalle Valo , Sasha Levin Subject: [PATCH 4.4 063/114] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() Date: Mon, 24 Jan 2022 19:42:38 +0100 Message-Id: <20220124183929.051654191@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit 04d80663f67ccef893061b49ec8a42ff7045ae84 ] Currently, with an unknown recv_type, mwifiex_usb_recv just return -1 without restoring the skb. Next time mwifiex_usb_rx_complete is invoked with the same skb, calling skb_put causes skb_over_panic. The bug is triggerable with a compromised/malfunctioning usb device. After applying the patch, skb_over_panic no longer shows up with the same input. Attached is the panic report from fuzzing. skbuff: skb_over_panic: text:000000003bf1b5fa len:2048 put:4 head:00000000dd6a115b data:000000000a9445d8 tail:0x844 end:0x840 dev: kernel BUG at net/core/skbuff.c:109! invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 PID: 198 Comm: in:imklog Not tainted 5.6.0 #60 RIP: 0010:skb_panic+0x15f/0x161 Call Trace: ? mwifiex_usb_rx_complete+0x26b/0xfcd [mwifiex_usb] skb_put.cold+0x24/0x24 mwifiex_usb_rx_complete+0x26b/0xfcd [mwifiex_usb] __usb_hcd_giveback_urb+0x1e4/0x380 usb_giveback_urb_bh+0x241/0x4f0 ? __hrtimer_run_queues+0x316/0x740 ? __usb_hcd_giveback_urb+0x380/0x380 tasklet_action_common.isra.0+0x135/0x330 __do_softirq+0x18c/0x634 irq_exit+0x114/0x140 smp_apic_timer_interrupt+0xde/0x380 apic_timer_interrupt+0xf/0x20 Reported-by: Brendan Dolan-Gavitt Signed-off-by: Zekun Shen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.= home Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/wireless/mwifiex/usb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwif= iex/usb.c index 1be7b219cb202..4cdf6450aeedd 100644 --- a/drivers/net/wireless/mwifiex/usb.c +++ b/drivers/net/wireless/mwifiex/usb.c @@ -132,7 +132,8 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *ada= pter, default: mwifiex_dbg(adapter, ERROR, "unknown recv_type %#x\n", recv_type); - return -1; + ret =3D -1; + goto exit_restore_skb; } break; case MWIFIEX_USB_EP_DATA: --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 72506C4321E for ; Mon, 24 Jan 2022 18:52:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245545AbiAXSwe (ORCPT ); Mon, 24 Jan 2022 13:52:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43042 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343652AbiAXSvS (ORCPT ); Mon, 24 Jan 2022 13:51:18 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 22C04C061776; Mon, 24 Jan 2022 10:51:08 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B3FE461514; Mon, 24 Jan 2022 18:51:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9569BC340E8; Mon, 24 Jan 2022 18:51:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050267; bh=ryaLA9s4ic0UyRgR1BPQvm3ZbngJz68AdEU/0//C1yM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AuHOn6vdkj35Ifr+IuBKaG/QmohdRac3wUQE6ZGxgQHmsyK6S7t6f8n2qyPT+d8CN agIKheC60d9EwMVZqnWoj4AWVB6IGVkhub/yMlkh9kfUjzWAlYyz05lqXZwQy9r/fM FaK50CtlLCFakMBUKb4LhHYsPb7r+B0WN7X5M2OY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+23a02c7df2cf2bc93fa2@syzkaller.appspotmail.com, Xiongwei Song , Denis Efremov , Jens Axboe , Sasha Levin Subject: [PATCH 4.4 064/114] floppy: Add max size check for user space request Date: Mon, 24 Jan 2022 19:42:39 +0100 Message-Id: <20220124183929.080923085@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiongwei Song [ Upstream commit 545a32498c536ee152331cd2e7d2416aa0f20e01 ] We need to check the max request size that is from user space before allocating pages. If the request size exceeds the limit, return -EINVAL. This check can avoid the warning below from page allocator. WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 current_gfp_context incl= ude/linux/sched/mm.h:195 [inline] WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 __alloc_pages+0x45d/0x50= 0 mm/page_alloc.c:5356 Modules linked in: CPU: 3 PID: 16525 Comm: syz-executor.3 Not tainted 5.15.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 RIP: 0010:__alloc_pages+0x45d/0x500 mm/page_alloc.c:5344 Code: be c9 00 00 00 48 c7 c7 20 4a 97 89 c6 05 62 32 a7 0b 01 e8 74 9a 42 = 07 e9 6a ff ff ff 0f 0b e9 a0 fd ff ff 40 80 e5 3f eb 88 <0f> 0b e9 18 ff f= f ff 4c 89 ef 44 89 e6 45 31 ed e8 1e 76 ff ff e9 RSP: 0018:ffffc90023b87850 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff92004770f0b RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000033 RDI: 0000000000010cc1 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff81bb4686 R11: 0000000000000001 R12: ffffffff902c1960 R13: 0000000000000033 R14: 0000000000000000 R15: ffff88804cf64a30 FS: 0000000000000000(0000) GS:ffff88802cd00000(0063) knlGS:00000000f44b4b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000002c921000 CR3: 000000004f507000 CR4: 0000000000150ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191 __get_free_pages+0x8/0x40 mm/page_alloc.c:5418 raw_cmd_copyin drivers/block/floppy.c:3113 [inline] raw_cmd_ioctl drivers/block/floppy.c:3160 [inline] fd_locked_ioctl+0x12e5/0x2820 drivers/block/floppy.c:3528 fd_ioctl drivers/block/floppy.c:3555 [inline] fd_compat_ioctl+0x891/0x1b60 drivers/block/floppy.c:3869 compat_blkdev_ioctl+0x3b8/0x810 block/ioctl.c:662 __do_compat_sys_ioctl+0x1c7/0x290 fs/ioctl.c:972 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Reported-by: syzbot+23a02c7df2cf2bc93fa2@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20211116131033.27685-1-sxwjean@me.com Signed-off-by: Xiongwei Song Signed-off-by: Denis Efremov Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/block/floppy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 826ab5f2f6b9f..373dab29addf2 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -3116,6 +3116,8 @@ static void raw_cmd_free(struct floppy_raw_cmd **ptr) } } =20 +#define MAX_LEN (1UL << MAX_ORDER << PAGE_SHIFT) + static int raw_cmd_copyin(int cmd, void __user *param, struct floppy_raw_cmd **rcmd) { @@ -3153,7 +3155,7 @@ loop: ptr->resultcode =3D 0; =20 if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) { - if (ptr->length <=3D 0) + if (ptr->length <=3D 0 || ptr->length >=3D MAX_LEN) return -EINVAL; ptr->kernel_data =3D (char *)fd_dma_mem_alloc(ptr->length); fallback_on_nodma_alloc(&ptr->kernel_data, ptr->length); --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B14A3C433F5 for ; Mon, 24 Jan 2022 18:52:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245597AbiAXSwW (ORCPT ); Mon, 24 Jan 2022 13:52:22 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49944 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245404AbiAXSvL (ORCPT ); Mon, 24 Jan 2022 13:51:11 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D08A5614E5; Mon, 24 Jan 2022 18:51:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A1288C340E5; Mon, 24 Jan 2022 18:51:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050270; bh=0v+JllOVEUPwx1fjNp5aIjDUrj9rNqlMNdUqUcRfCJ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kFP8c/P0q5MH2t2OdAOqYlag7SbSlna9SiAe2yPfHXyn3u59YK9rn9PcT2Axxx694 WMXxNwLyOsV2dpdclu+d28f8xJipYbFK00b18yvk57ka+uHPX66q5ETYqsOkwoiqrc PLO1L4KoFI435dZ5mmUynaKdKXQu4BEcaXatJehE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.4 065/114] media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() Date: Mon, 24 Jan 2022 19:42:40 +0100 Message-Id: <20220124183929.110060331@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 348df8035301dd212e3cc2860efe4c86cb0d3303 ] In hexium_attach(dev, info), saa7146_vv_init() is called to allocate a new memory for dev->vv_data. In hexium_detach(), saa7146_vv_release() will be called and there is a dereference of dev->vv_data in saa7146_vv_release(), which could lead to a NULL pointer dereference on failure of saa7146_vv_init() according to the following logic. Both hexium_attach() and hexium_detach() are callback functions of the variable 'extension', so there exists a possible call chain directly from hexium_attach() to hexium_detach(): hexium_attach(dev, info) -- fail to alloc memory to dev->vv_data | in saa7146_vv_init(). | | hexium_detach() -- a dereference of dev->vv_data in saa7146_vv_release() Fix this bug by adding a check of saa7146_vv_init(). This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_VIDEO_HEXIUM_ORION=3Dm show no new warnings, and our static analyzer no longer warns about this code. Signed-off-by: Zhou Qingyang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/pci/saa7146/hexium_orion.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/media/pci/saa7146/hexium_orion.c b/drivers/media/pci/s= aa7146/hexium_orion.c index 214396b1ca73c..2f3b4e01ff289 100644 --- a/drivers/media/pci/saa7146/hexium_orion.c +++ b/drivers/media/pci/saa7146/hexium_orion.c @@ -366,10 +366,16 @@ static struct saa7146_ext_vv vv_data; static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_exten= sion_data *info) { struct hexium *hexium =3D (struct hexium *) dev->ext_priv; + int ret; =20 DEB_EE("\n"); =20 - saa7146_vv_init(dev, &vv_data); + ret =3D saa7146_vv_init(dev, &vv_data); + if (ret) { + pr_err("Error in saa7146_vv_init()\n"); + return ret; + } + vv_data.vid_ops.vidioc_enum_input =3D vidioc_enum_input; vv_data.vid_ops.vidioc_g_input =3D vidioc_g_input; vv_data.vid_ops.vidioc_s_input =3D vidioc_s_input; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1FE03C433EF for ; Mon, 24 Jan 2022 18:52:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343924AbiAXSwm (ORCPT ); Mon, 24 Jan 2022 13:52:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42922 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242005AbiAXSvY (ORCPT ); Mon, 24 Jan 2022 13:51:24 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF39AC06177E; Mon, 24 Jan 2022 10:51:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 96C70B8121B; Mon, 24 Jan 2022 18:51:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9646C340E5; Mon, 24 Jan 2022 18:51:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050273; bh=4jx1Bl4S5uQyeaT0H4TWgXfSBRxVssLycfkRR4kmCkU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VRNJXTh773fKJA81a19OFXtUAvLEswz4a3/JCCAL8rEZHLovVQFqqa/tZcyEbAdQx 7BLd/hj7DCroJQWpQ7lDoT/a2Kv2IYggYJR/m/r3KJ9Q3u+Qa71tAtIs80dfxaf4WB 1L7QyJQz4KKGzIexGqE6Ayv6/swNRmzAYS90oH0Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, rkardell@mida.se, Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.4 066/114] media: m920x: dont use stack on USB reads Date: Mon, 24 Jan 2022 19:42:41 +0100 Message-Id: <20220124183929.139516454@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mauro Carvalho Chehab [ Upstream commit a2ab06d7c4d6bfd0b545a768247a70463e977e27 ] Using stack-allocated pointers for USB message data don't work. This driver is almost OK with that, except for the I2C read logic. Fix it by using a temporary read buffer, just like on all other calls to m920x_read(). Link: https://lore.kernel.org/all/ccc99e48-de4f-045e-0fe4-61e3118e3f74@mida= .se/ Reported-by: rkardell@mida.se Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/usb/dvb-usb/m920x.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/= m920x.c index eafc5c82467f4..5b806779e2106 100644 --- a/drivers/media/usb/dvb-usb/m920x.c +++ b/drivers/media/usb/dvb-usb/m920x.c @@ -284,6 +284,13 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, st= ruct i2c_msg msg[], int nu /* Should check for ack here, if we knew how. */ } if (msg[i].flags & I2C_M_RD) { + char *read =3D kmalloc(1, GFP_KERNEL); + if (!read) { + ret =3D -ENOMEM; + kfree(read); + goto unlock; + } + for (j =3D 0; j < msg[i].len; j++) { /* Last byte of transaction? * Send STOP, otherwise send ACK. */ @@ -291,9 +298,12 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, st= ruct i2c_msg msg[], int nu =20 if ((ret =3D m920x_read(d->udev, M9206_I2C, 0x0, 0x20 | stop, - &msg[i].buf[j], 1)) !=3D 0) + read, 1)) !=3D 0) goto unlock; + msg[i].buf[j] =3D read[0]; } + + kfree(read); } else { for (j =3D 0; j < msg[i].len; j++) { /* Last byte of transaction? Then send STOP. */ --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79BE0C433EF for ; Mon, 24 Jan 2022 18:52:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343941AbiAXSwr (ORCPT ); Mon, 24 Jan 2022 13:52:47 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42932 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245688AbiAXSvZ (ORCPT ); Mon, 24 Jan 2022 13:51:25 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D935C0613E6; Mon, 24 Jan 2022 10:51:17 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9068EB8121B; Mon, 24 Jan 2022 18:51:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BBCE1C340E5; Mon, 24 Jan 2022 18:51:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050276; bh=x0GDq5/TGahdJpi0k1BZhKdPLlEVphD7FM3LYcMZxcg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OAD4+M46JYtUFi/fR0FiyNSnO/70mlGPHSF+QX8rebE24OWYfrHzYC4H7yHjtZBwI zpL0iLXQsw16Q1HZZf7VtlTb7udnZs4LLeletq6cDakoysgf/cRTF0T2Rx7fB7DDx/ F+PysBrOotP1do6Jwe+gDW+3tOMqRm+UwZSMj/wo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Emmanuel Grumbach , Maximilian Ernestus , Johannes Berg , Luca Coelho , Sasha Levin Subject: [PATCH 4.4 067/114] iwlwifi: mvm: synchronize with FW after multicast commands Date: Mon, 24 Jan 2022 19:42:42 +0100 Message-Id: <20220124183929.170826912@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johannes Berg [ Upstream commit db66abeea3aefed481391ecc564fb7b7fb31d742 ] If userspace installs a lot of multicast groups very quickly, then we may run out of command queue space as we send the updates in an asynchronous fashion (due to locking concerns), and the CPU can create them faster than the firmware can process them. This is true even when mac80211 has a work struct that gets scheduled. Fix this by synchronizing with the firmware after sending all those commands - outside of the iteration we can send a synchronous echo command that just has the effect of the CPU waiting for the prior asynchronous commands to finish. This also will cause fewer of the commands to be sent to the firmware overall, because the work will only run once when rescheduled multiple times while it's running. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D213649 Suggested-by: Emmanuel Grumbach Reported-by: Maximilian Ernestus Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20211204083238.51aea5b79ea4.I88a447= 98efda16e9fe480fb3e94224931d311b29@changeid Signed-off-by: Luca Coelho Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/wireless/iwlwifi/mvm/mac80211.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wire= less/iwlwifi/mvm/mac80211.c index ca498b1f1f568..6417fda88733c 100644 --- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c +++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c @@ -1957,6 +1957,7 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *= mvm) struct iwl_mvm_mc_iter_data iter_data =3D { .mvm =3D mvm, }; + int ret; =20 lockdep_assert_held(&mvm->mutex); =20 @@ -1966,6 +1967,22 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm = *mvm) ieee80211_iterate_active_interfaces_atomic( mvm->hw, IEEE80211_IFACE_ITER_NORMAL, iwl_mvm_mc_iface_iterator, &iter_data); + + /* + * Send a (synchronous) ech command so that we wait for the + * multiple asynchronous MCAST_FILTER_CMD commands sent by + * the interface iterator. Otherwise, we might get here over + * and over again (by userspace just sending a lot of these) + * and the CPU can send them faster than the firmware can + * process them. + * Note that the CPU is still faster - but with this we'll + * actually send fewer commands overall because the CPU will + * not schedule the work in mac80211 as frequently if it's + * still running when rescheduled (possibly multiple times). + */ + ret =3D iwl_mvm_send_cmd_pdu(mvm, ECHO_CMD, 0, 0, NULL); + if (ret) + IWL_ERR(mvm, "Failed to synchronize multicast groups update\n"); } =20 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw, --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97A1FC433EF for ; Mon, 24 Jan 2022 18:53:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343998AbiAXSxC (ORCPT ); Mon, 24 Jan 2022 13:53:02 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43112 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245710AbiAXSvc (ORCPT ); Mon, 24 Jan 2022 13:51:32 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 63B05C061762; Mon, 24 Jan 2022 10:51:23 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 02A00614EE; Mon, 24 Jan 2022 18:51:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D7D29C36AE9; Mon, 24 Jan 2022 18:51:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050282; bh=YK2Gn4itlikwVgKPl0phpcidOiyoXHP8xusJ1dRVh8U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lIjig3YpsuI7qHpRdSTuH+JVzSXxZ1knfRarbg6aZ0pE1E/0g5ErKqcqmiN9Da4zk L9FCNqtkYPV5jIYl2N/8yUFlJNlrpZj5wkcnTo2klg0LJIgXN4HqjHOUy9Y8xFn69X hEB/z7zcVR+j65QCi1rBBnuPX7uB4qOruTSAOXts= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Suresh Kumar , "David S. Miller" , Sasha Levin Subject: [PATCH 4.4 068/114] net: bonding: debug: avoid printing debug logs when bond is not notifying peers Date: Mon, 24 Jan 2022 19:42:43 +0100 Message-Id: <20220124183929.200187325@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Suresh Kumar [ Upstream commit fee32de284ac277ba434a2d59f8ce46528ff3946 ] Currently "bond_should_notify_peers: slave ..." messages are printed whenev= er "bond_should_notify_peers" function is called. +++ Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): Received LACPDU on po= rt 1 Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): Rx Machine: Port=3D1,= Last State=3D6, Curr State=3D6 Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): partner sync=3D1 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 ... Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): Received LACPDU on por= t 2 Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): Rx Machine: Port=3D2, = Last State=3D6, Curr State=3D6 Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): partner sync=3D1 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +++ This is confusing and can also clutter up debug logs. Print logs only when the peer notification happens. Signed-off-by: Suresh Kumar Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/bonding/bond_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_mai= n.c index d6363ae220526..bbf18d6e4f677 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -785,14 +785,14 @@ static bool bond_should_notify_peers(struct bonding *= bond) slave =3D rcu_dereference(bond->curr_active_slave); rcu_read_unlock(); =20 - netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n", - slave ? slave->dev->name : "NULL"); - if (!slave || !bond->send_peer_notif || !netif_carrier_ok(bond->dev) || test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state)) return false; =20 + netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n", + slave ? slave->dev->name : "NULL"); + return true; } =20 --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 41521C433EF for ; Mon, 24 Jan 2022 18:53:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245474AbiAXSxO (ORCPT ); Mon, 24 Jan 2022 13:53:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42742 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343720AbiAXSvh (ORCPT ); Mon, 24 Jan 2022 13:51:37 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6F23EC061759; Mon, 24 Jan 2022 10:51:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 37D20B81227; Mon, 24 Jan 2022 18:51:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9693DC340E5; Mon, 24 Jan 2022 18:51:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050286; bh=jfkLL6rXolBMxv55YyFzWn2CWtcA4vLhtAVsUilZUhY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ThIk+aW/NpGrWPJupeat7WFTrwMVmRGfnrHeIQOBydxutk8ebL2YAbsbmn6GfwRnG 0dkyp2AKc+1ijltv7J36C+L6+LxdzidWXlFYBBzzVJ4K5GrDQC2qME2A2EpHipoFvu 9kPXaLtSpFFN1KbHwKkJrsGVojolomKU/2DOclAM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sean Young , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.4 069/114] media: igorplugusb: receiver overflow should be reported Date: Mon, 24 Jan 2022 19:42:44 +0100 Message-Id: <20220124183929.230821748@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Young [ Upstream commit 8fede658e7ddb605bbd68ed38067ddb0af033db4 ] Without this, some IR will be missing mid-stream and we might decode something which never really occurred. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/rc/igorplugusb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c index b36e51576f8e4..645ea00c472ab 100644 --- a/drivers/media/rc/igorplugusb.c +++ b/drivers/media/rc/igorplugusb.c @@ -73,9 +73,11 @@ static void igorplugusb_irdata(struct igorplugusb *ir, u= nsigned len) if (start >=3D len) { dev_err(ir->dev, "receive overflow invalid: %u", overflow); } else { - if (overflow > 0) + if (overflow > 0) { dev_warn(ir->dev, "receive overflow, at least %u lost", overflow); + ir_raw_event_reset(ir->rc); + } =20 do { rawir.duration =3D ir->buf_in[i] * 85333; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A763C433EF for ; Mon, 24 Jan 2022 18:53:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344056AbiAXSxP (ORCPT ); Mon, 24 Jan 2022 13:53:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43128 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343718AbiAXSvh (ORCPT ); Mon, 24 Jan 2022 13:51:37 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8C4E6C06175A; Mon, 24 Jan 2022 10:51:30 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 32E9CB8121C; Mon, 24 Jan 2022 18:51:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58DF6C340E5; Mon, 24 Jan 2022 18:51:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050288; bh=C3A7l53Vz4Z6yLJ0779NqAjKBF2eewvXM/vs65DiBvY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bzVKa3TPoRM3Gs2WH0hB/5IrtSFS+rE7clGwlgw0FoUy1sAL/QQn5wvomjGPpNBHF Ig/cbxyuEPWF4CaDfJL6XfxMfVdXqTwP+NFBCYmN1Rg+Z2BxPwkQSFGmcDtAFKG2kD VZj4OAdeuhmwSgmR/NFwAT1ApxoeYIpkgec5DR+4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.4 070/114] media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() Date: Mon, 24 Jan 2022 19:42:45 +0100 Message-Id: <20220124183929.260020963@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 3af86b046933ba513d08399dba0d4d8b50d607d0 ] In hexium_attach(dev, info), saa7146_vv_init() is called to allocate a new memory for dev->vv_data. saa7146_vv_release() will be called on failure of saa7146_register_device(). There is a dereference of dev->vv_data in saa7146_vv_release(), which could lead to a NULL pointer dereference on failure of saa7146_vv_init(). Fix this bug by adding a check of saa7146_vv_init(). This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_VIDEO_HEXIUM_GEMINI=3Dm show no new warnings, and our static analyzer no longer warns about this code. Link: https://lore.kernel.org/linux-media/20211203154030.111210-1-zhou1615@= umn.edu Signed-off-by: Zhou Qingyang Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/media/common/saa7146/saa7146_fops.c | 2 +- drivers/media/pci/saa7146/hexium_gemini.c | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/media/common/saa7146/saa7146_fops.c b/drivers/media/co= mmon/saa7146/saa7146_fops.c index df1e8c975cd82..6d0a0b08853b4 100644 --- a/drivers/media/common/saa7146/saa7146_fops.c +++ b/drivers/media/common/saa7146/saa7146_fops.c @@ -524,7 +524,7 @@ int saa7146_vv_init(struct saa7146_dev* dev, struct saa= 7146_ext_vv *ext_vv) ERR("out of memory. aborting.\n"); kfree(vv); v4l2_ctrl_handler_free(hdl); - return -1; + return -ENOMEM; } =20 saa7146_video_uops.init(dev,vv); diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/= saa7146/hexium_gemini.c index 343cd75fcd8d1..f09f311a316f5 100644 --- a/drivers/media/pci/saa7146/hexium_gemini.c +++ b/drivers/media/pci/saa7146/hexium_gemini.c @@ -296,7 +296,12 @@ static int hexium_attach(struct saa7146_dev *dev, stru= ct saa7146_pci_extension_d hexium_set_input(hexium, 0); hexium->cur_input =3D 0; =20 - saa7146_vv_init(dev, &vv_data); + ret =3D saa7146_vv_init(dev, &vv_data); + if (ret) { + i2c_del_adapter(&hexium->i2c_adapter); + kfree(hexium); + return ret; + } =20 vv_data.vid_ops.vidioc_enum_input =3D vidioc_enum_input; vv_data.vid_ops.vidioc_g_input =3D vidioc_g_input; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 348A4C433FE for ; Mon, 24 Jan 2022 18:53:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344015AbiAXSxG (ORCPT ); Mon, 24 Jan 2022 13:53:06 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:50822 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245724AbiAXSve (ORCPT ); Mon, 24 Jan 2022 13:51:34 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 44161B810BD; Mon, 24 Jan 2022 18:51:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 68654C36AE3; Mon, 24 Jan 2022 18:51:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050292; bh=7aaGjrrgNJ1aKX+foSv3KxNFkbrvGSzDYPPjGLXPFQA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ckt1/OQtWxdH4NJ/VU0XqqupKi0X0L3Twh5DfGvmmBGz7BhvTjpJ5v9mYQe3fQa39 jy/lLx15BEjEGVHE1edj5HVGd+tIhHKj+XoNjP62vObioIkMZNJnwR8EHTFS8O+a1X Vvo9Szh+YdHTC45l2b+7M7MLNij0cKucaJWASla4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Kai-Heng Feng , Sasha Levin Subject: [PATCH 4.4 071/114] usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 Date: Mon, 24 Jan 2022 19:42:46 +0100 Message-Id: <20220124183929.289646365@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kai-Heng Feng [ Upstream commit 00558586382891540c59c9febc671062425a6e47 ] When a new USB device gets plugged to nested hubs, the affected hub, which connects to usb 2-1.4-port2, doesn't report there's any change, hence the nested hubs go back to runtime suspend like nothing happened: [ 281.032951] usb usb2: usb wakeup-resume [ 281.032959] usb usb2: usb auto-resume [ 281.032974] hub 2-0:1.0: hub_resume [ 281.033011] usb usb2-port1: status 0263 change 0000 [ 281.033077] hub 2-0:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.049797] usb 2-1: usb wakeup-resume [ 281.069800] usb 2-1: Waited 0ms for CONNECT [ 281.069810] usb 2-1: finish resume [ 281.070026] hub 2-1:1.0: hub_resume [ 281.070250] usb 2-1-port4: status 0203 change 0000 [ 281.070272] usb usb2-port1: resume, status 0 [ 281.070282] hub 2-1:1.0: state 7 ports 4 chg 0010 evt 0000 [ 281.089813] usb 2-1.4: usb wakeup-resume [ 281.109792] usb 2-1.4: Waited 0ms for CONNECT [ 281.109801] usb 2-1.4: finish resume [ 281.109991] hub 2-1.4:1.0: hub_resume [ 281.110147] usb 2-1.4-port2: status 0263 change 0000 [ 281.110234] usb 2-1-port4: resume, status 0 [ 281.110239] usb 2-1-port4: status 0203, change 0000, 10.0 Gb/s [ 281.110266] hub 2-1.4:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.110426] hub 2-1.4:1.0: hub_suspend [ 281.110565] usb 2-1.4: usb auto-suspend, wakeup 1 [ 281.130998] hub 2-1:1.0: hub_suspend [ 281.137788] usb 2-1: usb auto-suspend, wakeup 1 [ 281.142935] hub 2-0:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.177828] usb 2-1: usb wakeup-resume [ 281.197839] usb 2-1: Waited 0ms for CONNECT [ 281.197850] usb 2-1: finish resume [ 281.197984] hub 2-1:1.0: hub_resume [ 281.198203] usb 2-1-port4: status 0203 change 0000 [ 281.198228] usb usb2-port1: resume, status 0 [ 281.198237] hub 2-1:1.0: state 7 ports 4 chg 0010 evt 0000 [ 281.217835] usb 2-1.4: usb wakeup-resume [ 281.237834] usb 2-1.4: Waited 0ms for CONNECT [ 281.237845] usb 2-1.4: finish resume [ 281.237990] hub 2-1.4:1.0: hub_resume [ 281.238067] usb 2-1.4-port2: status 0263 change 0000 [ 281.238148] usb 2-1-port4: resume, status 0 [ 281.238152] usb 2-1-port4: status 0203, change 0000, 10.0 Gb/s [ 281.238166] hub 2-1.4:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.238385] hub 2-1.4:1.0: hub_suspend [ 281.238523] usb 2-1.4: usb auto-suspend, wakeup 1 [ 281.258076] hub 2-1:1.0: hub_suspend [ 281.265744] usb 2-1: usb auto-suspend, wakeup 1 [ 281.285976] hub 2-0:1.0: hub_suspend [ 281.285988] usb usb2: bus auto-suspend, wakeup 1 USB 3.2 spec, 9.2.5.4 "Changing Function Suspend State" says that "If the link is in a non-U0 state, then the device must transition the link to U0 prior to sending the remote wake message", but the hub only transits the link to U0 after signaling remote wakeup. So be more forgiving and use a 20ms delay to let the link transit to U0 for remote wakeup. Suggested-by: Alan Stern Acked-by: Alan Stern Signed-off-by: Kai-Heng Feng Link: https://lore.kernel.org/r/20211215120108.336597-1-kai.heng.feng@canon= ical.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/usb/core/hub.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 97edc38eb8d2d..9b6d41740aaa6 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1054,7 +1054,10 @@ static void hub_activate(struct usb_hub *hub, enum h= ub_activation_type type) } else { hub_power_on(hub, true); } - } + /* Give some time on remote wakeup to let links to transit to U0 */ + } else if (hub_is_superspeed(hub->hdev)) + msleep(20); + init2: =20 /* --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 92595C433F5 for ; Mon, 24 Jan 2022 18:53:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242135AbiAXSxT (ORCPT ); Mon, 24 Jan 2022 13:53:19 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:50600 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343708AbiAXSvg (ORCPT ); Mon, 24 Jan 2022 13:51:36 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B6A28614DD; Mon, 24 Jan 2022 18:51:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 79B7BC340EE; Mon, 24 Jan 2022 18:51:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050295; bh=wxHpRND5njXX8eY0Ajb3h03AwZttuekxSrz5d3J35nY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OUw/3t4TIwQj+a5mCQNW4IlCXiZwcvixJ4Nab/WERkMknmOJaphQUYtlUCuBI2Rv2 bzF/Kur+Ffj+L7WvIkZnEOOf0iHCTxeUQO3F4FOb+bNIjEzNn3r94kyw/4sMaK1JXx oXh69i0Cay64VubgbqFkqsq5QuzSqzFYDh6xCUBo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zekun Shen , Kalle Valo , Sasha Levin Subject: [PATCH 4.4 072/114] ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream Date: Mon, 24 Jan 2022 19:42:47 +0100 Message-Id: <20220124183929.319859922@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit 6ce708f54cc8d73beca213cec66ede5ce100a781 ] Large pkt_len can lead to out-out-bound memcpy. Current ath9k_hif_usb_rx_stream allows combining the content of two urb inputs to one pkt. The first input can indicate the size of the pkt. Any remaining size is saved in hif_dev->rx_remain_len. While processing the next input, memcpy is used with rx_remain_len. 4-byte pkt_len can go up to 0xffff, while a single input is 0x4000 maximum in size (MAX_RX_BUF_SIZE). Thus, the patch adds a check for pkt_len which must not exceed 2 * MAX_RX_BUG_SIZE. BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_ht= c] Read of size 46393 at addr ffff888018798000 by task kworker/0:1/23 CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 5.6.0 #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] __kasan_report.cold+0x37/0x7c ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] kasan_report+0xe/0x20 check_memory_region+0x15a/0x1d0 memcpy+0x20/0x50 ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] ? hif_usb_mgmt_cb+0x2d9/0x2d9 [ath9k_htc] ? _raw_spin_lock_irqsave+0x7b/0xd0 ? _raw_spin_trylock_bh+0x120/0x120 ? __usb_unanchor_urb+0x12f/0x210 __usb_hcd_giveback_urb+0x1e4/0x380 usb_giveback_urb_bh+0x241/0x4f0 ? __hrtimer_run_queues+0x316/0x740 ? __usb_hcd_giveback_urb+0x380/0x380 tasklet_action_common.isra.0+0x135/0x330 __do_softirq+0x18c/0x634 irq_exit+0x114/0x140 smp_apic_timer_interrupt+0xde/0x380 apic_timer_interrupt+0xf/0x20 I found the bug using a custome USBFuzz port. It's a research work to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, providing hand-crafted usb descriptors to QEMU. After fixing the value of pkt_tag to ATH_USB_RX_STREAM_MODE_TAG in QEMU emulation, I found the KASAN report. The bug is triggerable whenever pkt_len is above two MAX_RX_BUG_SIZE. I used the same input that crashes to test the driver works when applying the patch. Signed-off-by: Zekun Shen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YXsidrRuK6zBJicZ@10-18-43-117.dynapool.wire= less.nyu.edu Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireles= s/ath/ath9k/hif_usb.c index 75072a8f8cf42..15fb14f818f8b 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -586,6 +586,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_= usb *hif_dev, return; } =20 + if (pkt_len > 2 * MAX_RX_BUF_SIZE) { + dev_err(&hif_dev->udev->dev, + "ath9k_htc: invalid pkt_len (%x)\n", pkt_len); + RX_STAT_INC(skb_dropped); + return; + } + pad_len =3D 4 - (pkt_len & 0x3); if (pad_len =3D=3D 4) pad_len =3D 0; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D35B4C4332F for ; Mon, 24 Jan 2022 18:53:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245414AbiAXSxK (ORCPT ); Mon, 24 Jan 2022 13:53:10 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:50702 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245509AbiAXSvj (ORCPT ); Mon, 24 Jan 2022 13:51:39 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 06740614E3; Mon, 24 Jan 2022 18:51:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D28FCC340E5; Mon, 24 Jan 2022 18:51:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050298; bh=ypGe6ZiPObWziSfTo04HOWAK/HNjCmpuxDJ2gVqG6As=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LJiPRyOYfYRQ40CQ9xX0+bAS7cEN84nMmPiK/xQ5YqW3aWH9o7tkh4/suK+mZwsVs z72ldc7GxXlss+iFhIv2qdmEGCkFECYH2L6qp8rV1yzkWaBKAxDmx2HCGPeK/0ks53 JPGq7rtnYowDzH9wuANcvB/9Oxw7T9D2rEZslsoI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Jeff Dike , Richard Weinberger , Anton Ivanov , linux-um@lists.infradead.org, Sasha Levin Subject: [PATCH 4.4 073/114] um: registers: Rename function names to avoid conflicts and build problems Date: Mon, 24 Jan 2022 19:42:48 +0100 Message-Id: <20220124183929.351144409@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 077b7320942b64b0da182aefd83c374462a65535 ] The function names init_registers() and restore_registers() are used in several net/ethernet/ and gpu/drm/ drivers for other purposes (not calls to UML functions), so rename them. This fixes multiple build errors. Signed-off-by: Randy Dunlap Cc: Jeff Dike Cc: Richard Weinberger Cc: Anton Ivanov Cc: linux-um@lists.infradead.org Signed-off-by: Richard Weinberger Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/um/include/shared/registers.h | 4 ++-- arch/um/os-Linux/registers.c | 4 ++-- arch/um/os-Linux/start_up.c | 2 +- arch/x86/um/syscalls_64.c | 3 ++- 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/arch/um/include/shared/registers.h b/arch/um/include/shared/re= gisters.h index f5b76355ad71a..089f979e112e3 100644 --- a/arch/um/include/shared/registers.h +++ b/arch/um/include/shared/registers.h @@ -14,8 +14,8 @@ extern int restore_fp_registers(int pid, unsigned long *f= p_regs); extern int save_fpx_registers(int pid, unsigned long *fp_regs); extern int restore_fpx_registers(int pid, unsigned long *fp_regs); extern int save_registers(int pid, struct uml_pt_regs *regs); -extern int restore_registers(int pid, struct uml_pt_regs *regs); -extern int init_registers(int pid); +extern int restore_pid_registers(int pid, struct uml_pt_regs *regs); +extern int init_pid_registers(int pid); extern void get_safe_registers(unsigned long *regs, unsigned long *fp_regs= ); extern unsigned long get_thread_reg(int reg, jmp_buf *buf); extern int get_fp_registers(int pid, unsigned long *regs); diff --git a/arch/um/os-Linux/registers.c b/arch/um/os-Linux/registers.c index 2ff8d4fe83c4f..34a5963bd7efd 100644 --- a/arch/um/os-Linux/registers.c +++ b/arch/um/os-Linux/registers.c @@ -21,7 +21,7 @@ int save_registers(int pid, struct uml_pt_regs *regs) return 0; } =20 -int restore_registers(int pid, struct uml_pt_regs *regs) +int restore_pid_registers(int pid, struct uml_pt_regs *regs) { int err; =20 @@ -36,7 +36,7 @@ int restore_registers(int pid, struct uml_pt_regs *regs) static unsigned long exec_regs[MAX_REG_NR]; static unsigned long exec_fp_regs[FP_SIZE]; =20 -int init_registers(int pid) +int init_pid_registers(int pid) { int err; =20 diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c index 22a358ef1b0cd..dc06933ba63d9 100644 --- a/arch/um/os-Linux/start_up.c +++ b/arch/um/os-Linux/start_up.c @@ -334,7 +334,7 @@ void __init os_early_checks(void) check_tmpexec(); =20 pid =3D start_ptraced_child(); - if (init_registers(pid)) + if (init_pid_registers(pid)) fatal("Failed to initialize default registers"); stop_ptraced_child(pid, 1, 1); } diff --git a/arch/x86/um/syscalls_64.c b/arch/x86/um/syscalls_64.c index e6552275320bc..40ecacb2c54b3 100644 --- a/arch/x86/um/syscalls_64.c +++ b/arch/x86/um/syscalls_64.c @@ -9,6 +9,7 @@ #include #include /* XXX This should get the constants from libc */ #include +#include =20 long arch_prctl(struct task_struct *task, int code, unsigned long __user *= addr) { @@ -32,7 +33,7 @@ long arch_prctl(struct task_struct *task, int code, unsig= ned long __user *addr) switch (code) { case ARCH_SET_FS: case ARCH_SET_GS: - ret =3D restore_registers(pid, ¤t->thread.regs.regs); + ret =3D restore_pid_registers(pid, ¤t->thread.regs.regs); if (ret) return ret; break; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A9322C433F5 for ; Mon, 24 Jan 2022 18:53:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344032AbiAXSxM (ORCPT ); Mon, 24 Jan 2022 13:53:12 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:50970 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343755AbiAXSvn (ORCPT ); Mon, 24 Jan 2022 13:51:43 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B098BB8121A; Mon, 24 Jan 2022 18:51:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7E46C340E5; Mon, 24 Jan 2022 18:51:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050301; bh=grI4u8o/65l7DGOuYfV+pUOSJnr68kyNlzxbNKNfxLY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1xvG0jiNchsAaaerZkIH686oNJcs2+BUEUyPSN/7kbir1pUmaiZmq3CDNgk4axvf3 1vG7hk/hWFZRJDc/Dqx0S0a7XE5VCqiAgTNjOhqm5j8oxTfIA8s6DKrfvadCbBM3Qp 1SqD4KTIo++h4KDHQ00M9h72/4TX0Wa2vr2GsTuw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Asselstine , "Rafael J. Wysocki" , Bob Moore , Sasha Levin Subject: [PATCH 4.4 074/114] ACPICA: Utilities: Avoid deleting the same object twice in a row Date: Mon, 24 Jan 2022 19:42:49 +0100 Message-Id: <20220124183929.380763040@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rafael J. Wysocki [ Upstream commit 1cdfe9e346b4c5509ffe19ccde880fd259d9f7a3 ] ACPICA commit c11af67d8f7e3d381068ce7771322f2b5324d687 If original_count is 0 in acpi_ut_update_ref_count (), acpi_ut_delete_internal_obj () is invoked for the target object, which is incorrect, because that object has been deleted once already and the memory allocated to store it may have been reclaimed and allocated for a different purpose by the host OS. Moreover, a confusing debug message following the "Reference Count is already zero, cannot decrement" warning is printed in that case. To fix this issue, make acpi_ut_update_ref_count () return after finding that original_count is 0 and printing the above warning. Link: https://github.com/acpica/acpica/commit/c11af67d Link: https://github.com/acpica/acpica/pull/652 Reported-by: Mark Asselstine Signed-off-by: Rafael J. Wysocki Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/acpi/acpica/utdelete.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c index 9f8b088e21d7e..d90b2cf310fb1 100644 --- a/drivers/acpi/acpica/utdelete.c +++ b/drivers/acpi/acpica/utdelete.c @@ -439,6 +439,7 @@ acpi_ut_update_ref_count(union acpi_operand_object *obj= ect, u32 action) ACPI_WARNING((AE_INFO, "Obj %p, Reference Count is already zero, cannot decrement\n", object)); + return; } =20 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8DB59C433EF for ; Mon, 24 Jan 2022 18:53:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343601AbiAXSxW (ORCPT ); Mon, 24 Jan 2022 13:53:22 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:50868 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343770AbiAXSvp (ORCPT ); Mon, 24 Jan 2022 13:51:45 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 26D8A614B8; Mon, 24 Jan 2022 18:51:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 059E8C340E5; Mon, 24 Jan 2022 18:51:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050304; bh=8lkdPXw64WnH0LbJLLWSNBVo1R68EaddM02RHx+wedE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vmmXMmEQzZYuN+GteBYUIto+NXFQ6ziRnonCeUGHaSYG4H/xaQo37sk+dZgbrurkM fVi12ptyw2K1mAnwue1paRegFVbHGEULDvq68i5Q9Pjh4WwD+xVkiliWKiR3umHIzh AIg84eDv/GjY9aV9dAccfIjikCJjDxw8xs0IAgh4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lenny Szubowicz , "Rafael J. Wysocki" , Bob Moore , Sasha Levin Subject: [PATCH 4.4 075/114] ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() Date: Mon, 24 Jan 2022 19:42:50 +0100 Message-Id: <20220124183929.409926826@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rafael J. Wysocki [ Upstream commit 24ea5f90ec9548044a6209685c5010edd66ffe8f ] ACPICA commit d984f12041392fa4156b52e2f7e5c5e7bc38ad9e If Operand[0] is a reference of the ACPI_REFCLASS_REFOF class, acpi_ex_opcode_1A_0T_1R () calls acpi_ns_get_attached_object () to obtain return_desc which may require additional resolution with the help of acpi_ex_read_data_from_field (). If the latter fails, the reference counter of the original return_desc is decremented which is incorrect, because acpi_ns_get_attached_object () does not increment the reference counter of the object returned by it. This issue may lead to premature deletion of the attached object while it is still attached and a use-after-free and crash in the host OS. For example, this may happen when on evaluation of ref_of() a local region field where there is no registered handler for the given Operation Region. Fix it by making acpi_ex_opcode_1A_0T_1R () return Status right away after a acpi_ex_read_data_from_field () failure. Link: https://github.com/acpica/acpica/commit/d984f120 Link: https://github.com/acpica/acpica/pull/685 Reported-by: Lenny Szubowicz Signed-off-by: Rafael J. Wysocki Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/acpi/acpica/exoparg1.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c index 77930683ab7dd..c20b7dfec7b20 100644 --- a/drivers/acpi/acpica/exoparg1.c +++ b/drivers/acpi/acpica/exoparg1.c @@ -1016,7 +1016,8 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_= state *walk_state) (walk_state, return_desc, &temp_desc); if (ACPI_FAILURE(status)) { - goto cleanup; + return_ACPI_STATUS + (status); } =20 return_desc =3D temp_desc; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8CC3C43217 for ; Mon, 24 Jan 2022 18:53:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343524AbiAXSxc (ORCPT ); Mon, 24 Jan 2022 13:53:32 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:50968 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343799AbiAXSvs (ORCPT ); Mon, 24 Jan 2022 13:51:48 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 67BB06151E; Mon, 24 Jan 2022 18:51:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 30400C340E7; Mon, 24 Jan 2022 18:51:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050307; bh=mOgLhHho0OlNC/JpctgxY53RxDZv8N0vDhyZlun2JZY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q3pjVM0PuJMHrJ/1dWupCuo7qSBMeXSfHwpC635DEL2tsucuw5/gOXVDwDpOrcsnE gg7OidspADTt1wwEPMxv5rDsOfeYaC7XPF0IIBMXUV2A/nX3o/m8QKrv2WNNm93Ovl +5mFobGjRfUbnRRV1IxLI6/XAsB2nH3GnPNc/e/w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , David Sterba , Sasha Levin Subject: [PATCH 4.4 076/114] btrfs: remove BUG_ON() in find_parent_nodes() Date: Mon, 24 Jan 2022 19:42:51 +0100 Message-Id: <20220124183929.439324789@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Josef Bacik [ Upstream commit fcba0120edf88328524a4878d1d6f4ad39f2ec81 ] We search for an extent entry with .offset =3D -1, which shouldn't be a thing, but corruption happens. Add an ASSERT() for the developers, return -EUCLEAN for mortals. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- fs/btrfs/backref.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c index 228bfa19b745d..c59a13a53b1cc 100644 --- a/fs/btrfs/backref.c +++ b/fs/btrfs/backref.c @@ -975,7 +975,12 @@ again: ret =3D btrfs_search_slot(trans, fs_info->extent_root, &key, path, 0, 0); if (ret < 0) goto out; - BUG_ON(ret =3D=3D 0); + if (ret =3D=3D 0) { + /* This shouldn't happen, indicates a bug or fs corruption. */ + ASSERT(ret !=3D 0); + ret =3D -EUCLEAN; + goto out; + } =20 #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS if (trans && likely(trans->type !=3D __TRANS_DUMMY) && --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8507BC433EF for ; Mon, 24 Jan 2022 18:53:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343643AbiAXSxe (ORCPT ); Mon, 24 Jan 2022 13:53:34 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:51046 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245298AbiAXSvx (ORCPT ); Mon, 24 Jan 2022 13:51:53 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 32315B81232; Mon, 24 Jan 2022 18:51:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 52C6DC340E5; Mon, 24 Jan 2022 18:51:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050310; bh=E11yzEnzznprBxC2hU2BGRcgYcoLM2kAXeZ9TWZ6f7g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tKT7B9RiYUr83/C2zqz8yfJ1LxwfTfn6SkEaQVyDWwc1XyvYvayPOAUCmHjeK/dBn XuWu/5bhz1qSvwGoTp9GIF2IOEQR3RaXBL6YfFKFa8PzmmVKyOdw4vow3M6AZPUmO7 6BGeWzdz2Xk+jiwWoVko+eU6wrJ/eFDIAC0wBBSY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , David Sterba , Sasha Levin Subject: [PATCH 4.4 077/114] btrfs: remove BUG_ON(!eie) in find_parent_nodes Date: Mon, 24 Jan 2022 19:42:52 +0100 Message-Id: <20220124183929.470311970@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Josef Bacik [ Upstream commit 9f05c09d6baef789726346397438cca4ec43c3ee ] If we're looking for leafs that point to a data extent we want to record the extent items that point at our bytenr. At this point we have the reference and we know for a fact that this leaf should have a reference to our bytenr. However if there's some sort of corruption we may not find any references to our leaf, and thus could end up with eie =3D=3D NULL. Replace this BUG_ON() with an ASSERT() and then return -EUCLEAN for the mortals. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- fs/btrfs/backref.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c index c59a13a53b1cc..00c9a9e719ece 100644 --- a/fs/btrfs/backref.c +++ b/fs/btrfs/backref.c @@ -1109,10 +1109,18 @@ again: goto out; if (!ret && extent_item_pos) { /* - * we've recorded that parent, so we must extend - * its inode list here + * We've recorded that parent, so we must extend + * its inode list here. + * + * However if there was corruption we may not + * have found an eie, return an error in this + * case. */ - BUG_ON(!eie); + ASSERT(eie); + if (!eie) { + ret =3D -EUCLEAN; + goto out; + } while (eie->next) eie =3D eie->next; eie->next =3D ref->inode_list; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03F5BC433FE for ; Mon, 24 Jan 2022 18:53:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344199AbiAXSxz (ORCPT ); Mon, 24 Jan 2022 13:53:55 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:51124 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245499AbiAXSv7 (ORCPT ); Mon, 24 Jan 2022 13:51:59 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 51BF8B81223; Mon, 24 Jan 2022 18:51:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 95C14C340E5; Mon, 24 Jan 2022 18:51:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050317; bh=ohSD3H6PwcHAXjnc8cPnR0pRDWhhFXJoW7p+x+J3LEw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D75OLag6it4UaXI9wqqdiVSivpaCgWxPkFbAzHfXgh4BnfS0ySFmtcsG2YMhCz9zp KEEYoUU8F2HUVg13MKE6BgakENf9iQfBNmHn8d/uMZues5j8nmaxqF3xOfuisC9vrR rQ5FuGV5RGqvfVD86YHPHKncTnO/9eCw8QV5rc5A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maxime Bizon , Florian Fainelli , Andrew Lunn , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.4 078/114] net: mdio: Demote probed message to debug print Date: Mon, 24 Jan 2022 19:42:53 +0100 Message-Id: <20220124183929.500442597@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Fainelli [ Upstream commit 7590fc6f80ac2cbf23e6b42b668bbeded070850b ] On systems with large numbers of MDIO bus/muxes the message indicating that a given MDIO bus has been successfully probed is repeated for as many buses we have, which can eat up substantial boot time for no reason, demote to a debug print. Reported-by: Maxime Bizon Signed-off-by: Florian Fainelli Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220103194024.2620-1-f.fainelli@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/phy/mdio_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 4066fb5a935a7..2fb95cca33183 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -295,7 +295,7 @@ int __mdiobus_register(struct mii_bus *bus, struct modu= le *owner) } =20 bus->state =3D MDIOBUS_REGISTERED; - pr_info("%s: probed\n", bus->name); + dev_dbg(&bus->dev, "probed\n"); return 0; =20 error: --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4FFFC433EF for ; Mon, 24 Jan 2022 18:53:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344131AbiAXSxm (ORCPT ); Mon, 24 Jan 2022 13:53:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43034 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245480AbiAXSwI (ORCPT ); Mon, 24 Jan 2022 13:52:08 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ADD4BC061774; Mon, 24 Jan 2022 10:52:02 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 757A4B81235; Mon, 24 Jan 2022 18:52:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 984A7C340E5; Mon, 24 Jan 2022 18:51:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050320; bh=m3dT+BwIryTLHf0an/Okp1ItP323n1YSAxKneotYt5o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yt6IKtSjvrHGd9jDqe+YBcI7lBw7iModgcbS/gEZS++pN7ABEYTtBEXEbrUh4Z4F8 +b8VKlGw6Rrxi7AMIgXIuKy7dlp8Yysey4eAiHH2cS1jvO6tMdqpMlFpFYYcR7ygjV 2efcSFq5NLTDGhyUPZeqyW9CqYz4ZyeP5cy7PbO8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joe Thornber , Mike Snitzer , Sasha Levin Subject: [PATCH 4.4 079/114] dm btree: add a defensive bounds check to insert_at() Date: Mon, 24 Jan 2022 19:42:54 +0100 Message-Id: <20220124183929.535984756@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joe Thornber [ Upstream commit 85bca3c05b6cca31625437eedf2060e846c4bbad ] Corrupt metadata could trigger an out of bounds write. Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/md/persistent-data/dm-btree.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-= data/dm-btree.c index fa9039a53ae5c..23b1d22f693c1 100644 --- a/drivers/md/persistent-data/dm-btree.c +++ b/drivers/md/persistent-data/dm-btree.c @@ -83,14 +83,16 @@ void inc_children(struct dm_transaction_manager *tm, st= ruct btree_node *n, } =20 static int insert_at(size_t value_size, struct btree_node *node, unsigned = index, - uint64_t key, void *value) - __dm_written_to_disk(value) + uint64_t key, void *value) + __dm_written_to_disk(value) { uint32_t nr_entries =3D le32_to_cpu(node->header.nr_entries); + uint32_t max_entries =3D le32_to_cpu(node->header.max_entries); __le64 key_le =3D cpu_to_le64(key); =20 if (index > nr_entries || - index >=3D le32_to_cpu(node->header.max_entries)) { + index >=3D max_entries || + nr_entries >=3D max_entries) { DMERR("too many entries in btree node for insert"); __dm_unbless_for_disk(value); return -ENOMEM; --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A2E2C433F5 for ; Mon, 24 Jan 2022 18:53:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343608AbiAXSxt (ORCPT ); Mon, 24 Jan 2022 13:53:49 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:49716 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343517AbiAXSwE (ORCPT ); Mon, 24 Jan 2022 13:52:04 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 01FEF614F0; Mon, 24 Jan 2022 18:52:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CB91CC340E5; Mon, 24 Jan 2022 18:52:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050323; bh=PE5eRi3IE9VNLlQ1ed9CSr4cABoF8ehAGM5W/x8b8/k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nX8iKJ20S5qK6FiN8tZR0g3XTlf0gRIIua4AsCabxCSFbriJtJSlMJpjDKmbk7wVx VHNr7KaqE5gMtlqTS/Cg6dLuUUphqdCZ41Ftmbm8FviK8RUmSyY6/SvhxtUrc+HwiD Yip3K2OB2tn3Q4Xlcg8W9y+nUolsZs9xC42/T01s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joe Thornber , Mike Snitzer , Sasha Levin Subject: [PATCH 4.4 080/114] dm space map common: add bounds check to sm_ll_lookup_bitmap() Date: Mon, 24 Jan 2022 19:42:55 +0100 Message-Id: <20220124183929.580137882@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joe Thornber [ Upstream commit cba23ac158db7f3cd48a923d6861bee2eb7a2978 ] Corrupted metadata could warrant returning error from sm_ll_lookup_bitmap(). Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/md/persistent-data/dm-space-map-common.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/= persistent-data/dm-space-map-common.c index ca09ad2a639c4..6fa4a68e78b0d 100644 --- a/drivers/md/persistent-data/dm-space-map-common.c +++ b/drivers/md/persistent-data/dm-space-map-common.c @@ -279,6 +279,11 @@ int sm_ll_lookup_bitmap(struct ll_disk *ll, dm_block_t= b, uint32_t *result) struct disk_index_entry ie_disk; struct dm_block *blk; =20 + if (b >=3D ll->nr_blocks) { + DMERR_LIMIT("metadata block out of bounds"); + return -EINVAL; + } + b =3D do_div(index, ll->entries_per_block); r =3D ll->load_ie(ll, index, &ie_disk); if (r < 0) --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23812C433F5 for ; Mon, 24 Jan 2022 18:53:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343861AbiAXSxk (ORCPT ); Mon, 24 Jan 2022 13:53:40 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:51220 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343823AbiAXSwJ (ORCPT ); Mon, 24 Jan 2022 13:52:09 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BF5E0B81235; Mon, 24 Jan 2022 18:52:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DD2F7C340E8; Mon, 24 Jan 2022 18:52:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050326; bh=mOa3viRnCiyugN9lsjwtjitWUVuvU+gNzpDpjLjWNzE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=at53GGcWgI0wNYCSpoRMg5z+51aTIAv1moiu4nAxIA4UD00rFu7bIVv5xnybDkfGA zHJcouBhWUIuGC3x1UVHwMw/bqOAeReTLJ++kQ3Rh8he3MYsnpvV+qmAJc6mHrVD5Q 33Y/rQK9yK1NIS8fk70f7Wx63865+Z38Pvz8cjLk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Russell King , Lukas Wunner , Sasha Levin Subject: [PATCH 4.4 081/114] serial: pl010: Drop CR register reset on set_termios Date: Mon, 24 Jan 2022 19:42:56 +0100 Message-Id: <20220124183929.610093670@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Wunner [ Upstream commit 08a0c6dff91c965e39905cf200d22db989203ccb ] pl010_set_termios() briefly resets the CR register to zero. Where does this register write come from? The PL010 driver's IRQ handler ambauart_int() originally modified the CR register without holding the port spinlock. ambauart_set_termios() also modified that register. To prevent concurrent read-modify-writes by the IRQ handler and to prevent transmission while changing baudrate, ambauart_set_termios() had to disable interrupts. That is achieved by writing zero to the CR register. However in 2004 the PL010 driver was amended to acquire the port spinlock in the IRQ handler, obviating the need to disable interrupts in ->set_termios(): https://git.kernel.org/history/history/c/157c0342e591 That rendered the CR register write obsolete. Drop it. Cc: Russell King Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/fcaff16e5b1abb4cc3da5a2879ac13f278b99ed0.16= 41128728.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/tty/serial/amba-pl010.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl01= 0.c index 5d41d5b92619a..7f4ba92739663 100644 --- a/drivers/tty/serial/amba-pl010.c +++ b/drivers/tty/serial/amba-pl010.c @@ -465,14 +465,11 @@ pl010_set_termios(struct uart_port *port, struct kter= mios *termios, if ((termios->c_cflag & CREAD) =3D=3D 0) uap->port.ignore_status_mask |=3D UART_DUMMY_RSR_RX; =20 - /* first, disable everything */ old_cr =3D readb(uap->port.membase + UART010_CR) & ~UART010_CR_MSIE; =20 if (UART_ENABLE_MS(port, termios->c_cflag)) old_cr |=3D UART010_CR_MSIE; =20 - writel(0, uap->port.membase + UART010_CR); - /* Set baud rate */ quot -=3D 1; writel((quot & 0xf00) >> 8, uap->port.membase + UART010_LCRM); --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3642C433F5 for ; Mon, 24 Jan 2022 18:54:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344266AbiAXSyF (ORCPT ); Mon, 24 Jan 2022 13:54:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43086 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343606AbiAXSwZ (ORCPT ); Mon, 24 Jan 2022 13:52:25 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D173AC061778; Mon, 24 Jan 2022 10:52:11 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 99717B8121F; Mon, 24 Jan 2022 18:52:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA342C340E5; Mon, 24 Jan 2022 18:52:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050329; bh=bVUJF15LlFX41avPvtpvLU1etpW0ALCZyjgvlj4BjYY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rMfdIHMv6roMgI7JgKGkb4VkBi73ero74QqwUZwbt1YiwUU9curGdl0jPqU4dHJnV 1GrVGAXa9xYXQs3rxNwUY/74ALGvy4Iaf4BG9qjRM/AlNJPdY96EJ9nk7GtZN3QsN0 AJCUWCtV0DPW9tkWpw9GaGgEYCxjoYXJfynt20yU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukas Wunner , Sasha Levin Subject: [PATCH 4.4 082/114] serial: core: Keep mctrl register state and cached copy in sync Date: Mon, 24 Jan 2022 19:42:57 +0100 Message-Id: <20220124183929.640099678@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Wunner [ Upstream commit 93a770b7e16772530196674ffc79bb13fa927dc6 ] struct uart_port contains a cached copy of the Modem Control signals. It is used to skip register writes in uart_update_mctrl() if the new signal state equals the old signal state. It also avoids a register read to obtain the current state of output signals. When a uart_port is registered, uart_configure_port() changes signal state but neglects to keep the cached copy in sync. That may cause a subsequent register write to be incorrectly skipped. Fix it before it trips somebody up. This behavior has been present ever since the serial core was introduced in 2002: https://git.kernel.org/history/history/c/33c0d1b0c3eb So far it was never an issue because the cached copy is initialized to 0 by kzalloc() and when uart_configure_port() is executed, at most DTR has been set by uart_set_options() or sunsu_console_setup(). Therefore, a stable designation seems unnecessary. Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/bceeaba030b028ed810272d55d5fc6f3656ddddb.16= 41129752.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/tty/serial/serial_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_c= ore.c index 013fb874c64e2..8142135a2eec4 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -2247,7 +2247,8 @@ uart_configure_port(struct uart_driver *drv, struct u= art_state *state, * We probably don't need a spinlock around this, but */ spin_lock_irqsave(&port->lock, flags); - port->ops->set_mctrl(port, port->mctrl & TIOCM_DTR); + port->mctrl &=3D TIOCM_DTR; + port->ops->set_mctrl(port, port->mctrl); spin_unlock_irqrestore(&port->lock, flags); =20 /* --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6DE6C433EF for ; Mon, 24 Jan 2022 18:54:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343681AbiAXSyJ (ORCPT ); Mon, 24 Jan 2022 13:54:09 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42914 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343611AbiAXSwZ (ORCPT ); Mon, 24 Jan 2022 13:52:25 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0B21EC0617A6; Mon, 24 Jan 2022 10:52:14 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A7E5FB81227; Mon, 24 Jan 2022 18:52:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C708BC340E5; Mon, 24 Jan 2022 18:52:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050332; bh=nF1g3TlmBQAjvdwYb0PgfScODMcjqpRH4mw4fHaeTBE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mG2A3L/i/p0+bxE92vI63bV153IeD/X+bklsBH3IE0QJYIFXXwIrnO0jctyXYogKm xLwpIpz9J9z+dxEY0QwsCYb+tqqrd1vM5J4kEQSpIFRylB11O4d3fFcCWEPDRI+ER0 Gq3vWpf+gmr1qoFs36WlwO9sefhio+70XhKApE/w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John David Anglin , Helge Deller , Sasha Levin Subject: [PATCH 4.4 083/114] parisc: Avoid calling faulthandler_disabled() twice Date: Mon, 24 Jan 2022 19:42:58 +0100 Message-Id: <20220124183929.673037481@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: John David Anglin [ Upstream commit 9e9d4b460f23bab61672eae397417d03917d116c ] In handle_interruption(), we call faulthandler_disabled() to check whether = the fault handler is not disabled. If the fault handler is disabled, we immedia= tely call do_page_fault(). It then calls faulthandler_disabled(). If disabled, do_page_fault() attempts to fixup the exception by jumping to no_context: no_context: if (!user_mode(regs) && fixup_exception(regs)) { return; } parisc_terminate("Bad Address (null pointer deref?)", regs, code, a= ddress); Apart from the error messages, the two blocks of code perform the same function. We can avoid two calls to faulthandler_disabled() by a simple revision to the code in handle_interruption(). Note: I didn't try to fix the formatting of this code block. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/parisc/kernel/traps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c index 6f61a17e2485a..55e7ba06511df 100644 --- a/arch/parisc/kernel/traps.c +++ b/arch/parisc/kernel/traps.c @@ -796,7 +796,7 @@ void notrace handle_interruption(int code, struct pt_re= gs *regs) * unless pagefault_disable() was called before. */ =20 - if (fault_space =3D=3D 0 && !faulthandler_disabled()) + if (faulthandler_disabled() || fault_space =3D=3D 0) { /* Clean up and return if in exception table. */ if (fixup_exception(regs)) --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 968FAC4332F for ; Mon, 24 Jan 2022 18:58:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344612AbiAXS65 (ORCPT ); Mon, 24 Jan 2022 13:58:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44568 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344002AbiAXS4o (ORCPT ); Mon, 24 Jan 2022 13:56:44 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE8FEC0612DB; Mon, 24 Jan 2022 10:54:14 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 96C42B8119D; Mon, 24 Jan 2022 18:54:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A446BC340E5; Mon, 24 Jan 2022 18:54:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050453; bh=t5RLsDi1gqzl5ZKjE09qGfMniqUkYH6q6fx12EjtQxw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d9VIR5CEbMK4dWZ9loKfGkyyiXysEFwx2BqwBEaDinkimi7HNiHY9cwxKZPQQ21S4 Vk7Ag8nQ2/E/XSviFziAgT2ZVY2LZ9CRyL1csQW7Y4zJFLxo3UTKVlkH37WLLrtY5p XOdj7nQxKi8lZUJobrZLAi6Umx+i8nnvn3rHoXGk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.4 084/114] powerpc/6xx: add missing of_node_put Date: Mon, 24 Jan 2022 19:42:59 +0100 Message-Id: <20220124183929.703877872@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit f6e82647ff71d427d4148964b71f239fba9d7937 ] for_each_compatible_node performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ expression e; local idexpression n; @@ @@ local idexpression n; expression e; @@ for_each_compatible_node(n,...) { ... ( of_node_put(n); | e =3D n | + of_node_put(n); ? break; ) ... } ... when !=3D n // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-2-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/p= latforms/embedded6xx/hlwd-pic.c index 9485f1024d46c..b3bcdce89c3bb 100644 --- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c @@ -220,6 +220,7 @@ void hlwd_pic_probe(void) irq_set_chained_handler(cascade_virq, hlwd_pic_irq_cascade); hlwd_irq_host =3D host; + of_node_put(np); break; } } --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 793FBC433F5 for ; Mon, 24 Jan 2022 18:55:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245755AbiAXSzf (ORCPT ); Mon, 24 Jan 2022 13:55:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43164 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344048AbiAXSxN (ORCPT ); Mon, 24 Jan 2022 13:53:13 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E151FC06175F; Mon, 24 Jan 2022 10:52:39 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A90C0B8121B; Mon, 24 Jan 2022 18:52:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B85D5C340E5; Mon, 24 Jan 2022 18:52:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050357; bh=nRljK2iWbb10p4w6RFd1lQ40Hofhpav2Nn+BCIRYQ08=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IDDVLbzAkBr63m3nN1+o6IOMmTMKowQKdRmbCVc/CzUtOTcp41BHMVNuacIJvnU2d wmY9zhSS0lBHRsuERQFUZBc6HsL299lq4a+bYRKu4HrhxVQOb5NjykbbTMIs3gHIil NKkebnAyOb1oVnmYaGwxb8HJabq/abgC742hOAGg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.4 085/114] powerpc/powernv: add missing of_node_put Date: Mon, 24 Jan 2022 19:43:00 +0100 Message-Id: <20220124183929.736400679@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit 7d405a939ca960162eb30c1475759cb2fdf38f8c ] for_each_compatible_node performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ local idexpression n; expression e; @@ for_each_compatible_node(n,...) { ... ( of_node_put(n); | e =3D n | + of_node_put(n); ? break; ) ... } ... when !=3D n // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-4-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/powerpc/platforms/powernv/opal-lpc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/powernv/opal-lpc.c b/arch/powerpc/platf= orms/powernv/opal-lpc.c index e4169d68cb328..d28c4a9269c38 100644 --- a/arch/powerpc/platforms/powernv/opal-lpc.c +++ b/arch/powerpc/platforms/powernv/opal-lpc.c @@ -401,6 +401,7 @@ void opal_lpc_init(void) if (!of_get_property(np, "primary", NULL)) continue; opal_lpc_chip_id =3D of_get_ibm_chip_id(np); + of_node_put(np); break; } if (opal_lpc_chip_id < 0) --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7872C433F5 for ; Mon, 24 Jan 2022 18:56:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343695AbiAXS4P (ORCPT ); Mon, 24 Jan 2022 13:56:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43108 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343530AbiAXSyM (ORCPT ); Mon, 24 Jan 2022 13:54:12 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8EF7DC06176D; Mon, 24 Jan 2022 10:53:13 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2DB0F6152E; Mon, 24 Jan 2022 18:53:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0D95DC340E5; Mon, 24 Jan 2022 18:53:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050392; bh=DBhoTDsqf5w5ZsFacLKJcbmnshW2rD6yux0NBPC2nTY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0DRAXmBpVZpMCyISpsXBRM1HKgug/N6J9C6ehA4LznR+jLP9Ni/VbYerG2QHTUppu 7k/9Ct81NueU1XKacSgdfe00vjaOZAuAjhBjeOAMgNJ5Rsl61kwwe18yClOi9qbTmT +RsM4BCXvLr8W3ivIYNxH6j+IljZZ4fbKbMEwWCc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.4 086/114] powerpc/cell: add missing of_node_put Date: Mon, 24 Jan 2022 19:43:01 +0100 Message-Id: <20220124183929.766007630@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit a841fd009e51c8c0a8f07c942e9ab6bb48da8858 ] for_each_node_by_name performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ expression e,e1; local idexpression n; @@ for_each_node_by_name(n, e1) { ... when !=3D of_node_put(n) when !=3D e =3D n ( return n; | + of_node_put(n); ? return ...; ) ... } // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-7-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/powerpc/platforms/cell/iommu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/c= ell/iommu.c index 14a582b212745..4edceff5791ad 100644 --- a/arch/powerpc/platforms/cell/iommu.c +++ b/arch/powerpc/platforms/cell/iommu.c @@ -1107,6 +1107,7 @@ static int __init cell_iommu_fixed_mapping_init(void) if (hbase < dbase || (hend > (dbase + dsize))) { pr_debug("iommu: hash window doesn't fit in" "real DMA window\n"); + of_node_put(np); return -1; } } --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5E62CC4332F for ; Mon, 24 Jan 2022 18:57:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344363AbiAXS5W (ORCPT ); Mon, 24 Jan 2022 13:57:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44172 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344704AbiAXSzF (ORCPT ); Mon, 24 Jan 2022 13:55:05 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 60BAFC06136B; Mon, 24 Jan 2022 10:53:50 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1DDA5B8119D; Mon, 24 Jan 2022 18:53:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3296FC340E5; Mon, 24 Jan 2022 18:53:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050427; bh=bZMho04zzMVM6kYWcyHEghrY3neLzEAufpfoVc5JEsk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QBCBxg+OMSols5yQ8DC/VWFA8K8sHRr2vq2Vpl9fwQnXSAOjE+v4OZOs6gvROA7B0 H9WDawPDnaywMyh3eaHsrJ2GOYcIKCSM59e/f0w2f2Ves5M4FrdsZBHoOjaxtD6fJU QB0UN4/1Gh745ImTLPoAx5VfVIMpSxCjPZGagF7w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.4 087/114] powerpc/btext: add missing of_node_put Date: Mon, 24 Jan 2022 19:43:02 +0100 Message-Id: <20220124183929.795969298@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit a1d2b210ffa52d60acabbf7b6af3ef7e1e69cda0 ] for_each_node_by_type performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ local idexpression n; expression e; @@ for_each_node_by_type(n,...) { ... ( of_node_put(n); | e =3D n | + of_node_put(n); ? break; ) ... } ... when !=3D n // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-6-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/powerpc/kernel/btext.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/btext.c b/arch/powerpc/kernel/btext.c index 41c011cb60706..8d05ef26dea9d 100644 --- a/arch/powerpc/kernel/btext.c +++ b/arch/powerpc/kernel/btext.c @@ -257,8 +257,10 @@ int __init btext_find_display(int allow_nonstdout) rc =3D btext_initialize(np); printk("result: %d\n", rc); } - if (rc =3D=3D 0) + if (rc =3D=3D 0) { + of_node_put(np); break; + } } return rc; } --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 294C6C433EF for ; Mon, 24 Jan 2022 18:55:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343858AbiAXSzy (ORCPT ); Mon, 24 Jan 2022 13:55:54 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:53088 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344194AbiAXSxz (ORCPT ); Mon, 24 Jan 2022 13:53:55 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EA6386153A; Mon, 24 Jan 2022 18:53:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CCBC3C340E5; Mon, 24 Jan 2022 18:53:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050434; bh=iyFxWuN2vu/dulDTqndeNcafmcjOaQG2EV3AgqR2eKc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KRBski63ZkOSJvnqTb/ggAG7pWt5RErOIVV6RZy9SOEUYwB5a3NRB0wLofVVsTcR7 nzQJbsk3sJsB6W3HaNXZV2WlH5eRSxba8po6drOO40ucofKph/qz8G0MmMoZ3rHbI8 1AEaTlRh6+lc2JZAoQBaxJBSS0P+uS5f7P/FZ7NQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Heiner Kallweit , Jean Delvare , Wolfram Sang , Sasha Levin Subject: [PATCH 4.4 088/114] i2c: i801: Dont silently correct invalid transfer size Date: Mon, 24 Jan 2022 19:43:03 +0100 Message-Id: <20220124183929.828492465@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Heiner Kallweit [ Upstream commit effa453168a7eeb8a562ff4edc1dbf9067360a61 ] If an invalid block size is provided, reject it instead of silently changing it to a supported value. Especially critical I see the case of a write transfer with block length 0. In this case we have no guarantee that the byte we would write is valid. When silently reducing a read to 32 bytes then we don't return an error and the caller may falsely assume that we returned the full requested data. If this change should break any (broken) caller, then I think we should fix the caller. Signed-off-by: Heiner Kallweit Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/i2c/busses/i2c-i801.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c index 4399016a6caba..73026c00220c2 100644 --- a/drivers/i2c/busses/i2c-i801.c +++ b/drivers/i2c/busses/i2c-i801.c @@ -669,6 +669,11 @@ static int i801_block_transaction(struct i801_priv *pr= iv, int result =3D 0; unsigned char hostc; =20 + if (read_write =3D=3D I2C_SMBUS_READ && command =3D=3D I2C_SMBUS_BLOCK_DA= TA) + data->block[0] =3D I2C_SMBUS_BLOCK_MAX; + else if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX) + return -EPROTO; + if (command =3D=3D I2C_SMBUS_I2C_BLOCK_DATA) { if (read_write =3D=3D I2C_SMBUS_WRITE) { /* set I2C_EN bit in configuration register */ @@ -682,16 +687,6 @@ static int i801_block_transaction(struct i801_priv *pr= iv, } } =20 - if (read_write =3D=3D I2C_SMBUS_WRITE - || command =3D=3D I2C_SMBUS_I2C_BLOCK_DATA) { - if (data->block[0] < 1) - data->block[0] =3D 1; - if (data->block[0] > I2C_SMBUS_BLOCK_MAX) - data->block[0] =3D I2C_SMBUS_BLOCK_MAX; - } else { - data->block[0] =3D 32; /* max for SMBus block reads */ - } - /* Experience has shown that the block buffer can only be used for SMBus (not I2C) block transactions, even though the datasheet doesn't mention this limitation. */ --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B38BC433F5 for ; Mon, 24 Jan 2022 18:58:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242594AbiAXS6Q (ORCPT ); Mon, 24 Jan 2022 13:58:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43964 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344147AbiAXS4B (ORCPT ); Mon, 24 Jan 2022 13:56:01 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0200AC0617A9; Mon, 24 Jan 2022 10:54:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BDC5BB8119D; Mon, 24 Jan 2022 18:53:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E4579C36AE9; Mon, 24 Jan 2022 18:53:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050437; bh=4Dw/6zFwUu1pvPlMw2/pQ1gJ+iowxFDpDx957UrzjiM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ExvwCPWNcDnTl20lwT6qXgSr5gtjJCmPy2iYaLf5xyFxzg1GLEeZMCdCqsRttQ3Ae juz1hAG4azMW4ipmNcU3v5rUuUPCI9rfIiyBBHHq5OYkMx0Ajrm+SeWGOza9tKkVb9 Tqs1Di3gcXE07CAQitX/FNSOHoRwBqiVWn5pFio0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Ellerman , Sasha Levin Subject: [PATCH 4.4 089/114] powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING Date: Mon, 24 Jan 2022 19:43:04 +0100 Message-Id: <20220124183929.862014993@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Michael Ellerman [ Upstream commit a4ac0d249a5db80e79d573db9e4ad29354b643a8 ] setup_profiling_timer() is only needed when CONFIG_PROFILING is enabled. Fixes the following W=3D1 warning when CONFIG_PROFILING=3Dn: linux/arch/powerpc/kernel/smp.c:1638:5: error: no previous prototype for = =E2=80=98setup_profiling_timer=E2=80=99 Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211124093254.1054750-5-mpe@ellerman.id.au Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/powerpc/kernel/smp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c index ec9ec2058d2d3..19ba60ab18073 100644 --- a/arch/powerpc/kernel/smp.c +++ b/arch/powerpc/kernel/smp.c @@ -732,10 +732,12 @@ void start_secondary(void *unused) BUG(); } =20 +#ifdef CONFIG_PROFILING int setup_profiling_timer(unsigned int multiplier) { return 0; } +#endif =20 #ifdef CONFIG_SCHED_SMT /* cpumask of CPUs with asymetric SMT dependancy */ --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 431C6C433EF for ; Mon, 24 Jan 2022 18:56:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344177AbiAXS4E (ORCPT ); Mon, 24 Jan 2022 13:56:04 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:53188 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344233AbiAXSyB (ORCPT ); Mon, 24 Jan 2022 13:54:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4986E61507; Mon, 24 Jan 2022 18:54:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1B35BC340E5; Mon, 24 Jan 2022 18:53:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050440; bh=P8JodIRX2uzjywT3FD6+DpyuTrOHA3GSKST3Iwdgot4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gk3BE7J3Qp7aXxCQgrXnMZg1iEG78agJP06QMFsRB1RrCMa9sk+2kSADFy07yHF1T FyoBfbMYWbbjnTRLKxfK31hZEIlT/bbwNnwgOiwSwREv2qZB0bM9yzhfXIv2VYEtDu H4AQU2qY5pP58fljuWTRdG6wtwt4MDlEPVRLh+gk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joakim Tjernlund , Scott Wood , Wolfram Sang , Sasha Levin Subject: [PATCH 4.4 090/114] i2c: mpc: Correct I2C reset procedure Date: Mon, 24 Jan 2022 19:43:05 +0100 Message-Id: <20220124183929.891467756@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joakim Tjernlund [ Upstream commit ebe82cf92cd4825c3029434cabfcd2f1780e64be ] Current I2C reset procedure is broken in two ways: 1) It only generate 1 START instead of 9 STARTs and STOP. 2) It leaves the bus Busy so every I2C xfer after the first fixup calls the reset routine again, for every xfer there after. This fixes both errors. Signed-off-by: Joakim Tjernlund Acked-by: Scott Wood Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/i2c/busses/i2c-mpc.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c index 2e083a71c2215..988ea9df6654c 100644 --- a/drivers/i2c/busses/i2c-mpc.c +++ b/drivers/i2c/busses/i2c-mpc.c @@ -107,23 +107,30 @@ static irqreturn_t mpc_i2c_isr(int irq, void *dev_id) /* Sometimes 9th clock pulse isn't generated, and slave doesn't release * the bus, because it wants to send ACK. * Following sequence of enabling/disabling and sending start/stop generat= es - * the 9 pulses, so it's all OK. + * the 9 pulses, each with a START then ending with STOP, so it's all OK. */ static void mpc_i2c_fixup(struct mpc_i2c *i2c) { int k; - u32 delay_val =3D 1000000 / i2c->real_clk + 1; - - if (delay_val < 2) - delay_val =3D 2; + unsigned long flags; =20 for (k =3D 9; k; k--) { writeccr(i2c, 0); - writeccr(i2c, CCR_MSTA | CCR_MTX | CCR_MEN); + writeb(0, i2c->base + MPC_I2C_SR); /* clear any status bits */ + writeccr(i2c, CCR_MEN | CCR_MSTA); /* START */ + readb(i2c->base + MPC_I2C_DR); /* init xfer */ + udelay(15); /* let it hit the bus */ + local_irq_save(flags); /* should not be delayed further */ + writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSTA); /* delay SDA */ readb(i2c->base + MPC_I2C_DR); - writeccr(i2c, CCR_MEN); - udelay(delay_val << 1); + if (k !=3D 1) + udelay(5); + local_irq_restore(flags); } + writeccr(i2c, CCR_MEN); /* Initiate STOP */ + readb(i2c->base + MPC_I2C_DR); + udelay(15); /* Let STOP propagate */ + writeccr(i2c, 0); } =20 static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing) --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0297C433EF for ; Mon, 24 Jan 2022 18:56:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344201AbiAXS4J (ORCPT ); Mon, 24 Jan 2022 13:56:09 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52686 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245338AbiAXSyG (ORCPT ); Mon, 24 Jan 2022 13:54:06 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 20B95B8122F; Mon, 24 Jan 2022 18:54:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2C234C340E5; Mon, 24 Jan 2022 18:54:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050443; bh=ttM8YBV/tYxefzD0DSRUsWriYStpWazeCAtSPZpQEGI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VdiHkR3EgoDNdpDgiLwNT/TbPvnV8tE5CSdJUKx3EPo7vZMChZGtVVcbf0B6ZiUCy OXMvIbyzobK8wvvsRnYyM+9R/+fA6e4myn6edBgiljM4grydGF8MgmcUk+elaSRHpI yDgQU8yo1LMbYF9bLbnArOCKsC6yx/Zmqezr+5Tw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Christophe Leroy , Sasha Levin Subject: [PATCH 4.4 091/114] w1: Misuse of get_user()/put_user() reported by sparse Date: Mon, 24 Jan 2022 19:43:06 +0100 Message-Id: <20220124183929.921111897@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe Leroy [ Upstream commit 33dc3e3e99e626ce51f462d883b05856c6c30b1d ] sparse warnings: (new ones prefixed by >>) >> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in= initializer (different address spaces) @@ expected char [noderef] __us= er *_pu_addr @@ got char *buf @@ drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [nodere= f] __user *_pu_addr drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf >> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in= initializer (different address spaces) @@ expected char const [noderef= ] __user *_gu_addr @@ got char const *buf @@ drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [= noderef] __user *_gu_addr drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf The buffer buf is a failsafe buffer in kernel space, it's not user memory hence doesn't deserve the use of get_user() or put_user(). Access 'buf' content directly. Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/ Reported-by: kernel test robot Signed-off-by: Christophe Leroy Link: https://lore.kernel.org/r/d14ed8d71ad4372e6839ae427f91441d3ba0e94d.16= 37946316.git.christophe.leroy@csgroup.eu Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/w1/slaves/w1_ds28e04.c | 26 ++++++-------------------- 1 file changed, 6 insertions(+), 20 deletions(-) diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c index 365d6dff21de2..83c5864891424 100644 --- a/drivers/w1/slaves/w1_ds28e04.c +++ b/drivers/w1/slaves/w1_ds28e04.c @@ -39,7 +39,7 @@ static int w1_strong_pullup =3D 1; module_param_named(strong_pullup, w1_strong_pullup, int, 0); =20 /* enable/disable CRC checking on DS28E04-100 memory accesses */ -static char w1_enable_crccheck =3D 1; +static bool w1_enable_crccheck =3D true; =20 #define W1_EEPROM_SIZE 512 #define W1_PAGE_COUNT 16 @@ -346,32 +346,18 @@ static BIN_ATTR_RW(pio, 1); static ssize_t crccheck_show(struct device *dev, struct device_attribute *= attr, char *buf) { - if (put_user(w1_enable_crccheck + 0x30, buf)) - return -EFAULT; - - return sizeof(w1_enable_crccheck); + return sysfs_emit(buf, "%d\n", w1_enable_crccheck); } =20 static ssize_t crccheck_store(struct device *dev, struct device_attribute = *attr, const char *buf, size_t count) { - char val; - - if (count !=3D 1 || !buf) - return -EINVAL; + int err =3D kstrtobool(buf, &w1_enable_crccheck); =20 - if (get_user(val, buf)) - return -EFAULT; + if (err) + return err; =20 - /* convert to decimal */ - val =3D val - 0x30; - if (val !=3D 0 && val !=3D 1) - return -EINVAL; - - /* set the new value */ - w1_enable_crccheck =3D val; - - return sizeof(w1_enable_crccheck); + return count; } =20 static DEVICE_ATTR_RW(crccheck); --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4F7DC4332F for ; Mon, 24 Jan 2022 18:56:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245661AbiAXS4M (ORCPT ); Mon, 24 Jan 2022 13:56:12 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52714 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343628AbiAXSyJ (ORCPT ); Mon, 24 Jan 2022 13:54:09 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 53EEFB81227; Mon, 24 Jan 2022 18:54:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 71435C340E5; Mon, 24 Jan 2022 18:54:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050447; bh=1j7mayRmOuGQ+nRLdXsL59wVA+c5vHDalgnqM39ocY4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nMpDYfUKS0sdYaNKkuwJzC5A3eUSbOcG5E/OtxdCRoenb6lPNcVHefkPT2Oz4rq1V n6jUByyUCCJCTlDrCeLao2ORnUsXinVdZUK9WxCGyEVLUFSvGdb99DMu8XwCAHRCY4 xJbsc5Db4tsSww+WKp2z2OjMnoI//+v0fUoLgjac= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zqiang , syzbot+bb950e68b400ab4f65f8@syzkaller.appspotmail.com, Takashi Iwai , Sasha Levin Subject: [PATCH 4.4 092/114] ALSA: seq: Set upper limit of processed events Date: Mon, 24 Jan 2022 19:43:07 +0100 Message-Id: <20220124183929.951106226@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 6fadb494a638d8b8a55864ecc6ac58194f03f327 ] Currently ALSA sequencer core tries to process the queued events as much as possible when they become dispatchable. If applications try to queue too massive events to be processed at the very same timing, the sequencer core would still try to process such all events, either in the interrupt context or via some notifier; in either away, it might be a cause of RCU stall or such problems. As a potential workaround for those problems, this patch adds the upper limit of the amount of events to be processed. The remaining events are processed in the next batch, so they won't be lost. For the time being, it's limited up to 1000 events per queue, which should be high enough for any normal usages. Reported-by: Zqiang Reported-by: syzbot+bb950e68b400ab4f65f8@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20211102033222.3849-1-qiang.zhang1211@gmail= .com Link: https://lore.kernel.org/r/20211207165146.2888-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- sound/core/seq/seq_queue.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c index ea1aa07962761..b923059a22276 100644 --- a/sound/core/seq/seq_queue.c +++ b/sound/core/seq/seq_queue.c @@ -257,12 +257,15 @@ struct snd_seq_queue *snd_seq_queue_find_name(char *n= ame) =20 /* -------------------------------------------------------- */ =20 +#define MAX_CELL_PROCESSES_IN_QUEUE 1000 + void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) { unsigned long flags; struct snd_seq_event_cell *cell; snd_seq_tick_time_t cur_tick; snd_seq_real_time_t cur_time; + int processed =3D 0; =20 if (q =3D=3D NULL) return; @@ -285,6 +288,8 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int a= tomic, int hop) if (!cell) break; snd_seq_dispatch_event(cell, atomic, hop); + if (++processed >=3D MAX_CELL_PROCESSES_IN_QUEUE) + goto out; /* the rest processed at the next batch */ } =20 /* Process time queue... */ @@ -294,14 +299,19 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int= atomic, int hop) if (!cell) break; snd_seq_dispatch_event(cell, atomic, hop); + if (++processed >=3D MAX_CELL_PROCESSES_IN_QUEUE) + goto out; /* the rest processed at the next batch */ } =20 + out: /* free lock */ spin_lock_irqsave(&q->check_lock, flags); if (q->check_again) { q->check_again =3D 0; - spin_unlock_irqrestore(&q->check_lock, flags); - goto __again; + if (processed < MAX_CELL_PROCESSES_IN_QUEUE) { + spin_unlock_irqrestore(&q->check_lock, flags); + goto __again; + } } q->check_blocked =3D 0; spin_unlock_irqrestore(&q->check_lock, flags); --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B82DC433FE for ; Mon, 24 Jan 2022 19:01:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344276AbiAXTBg (ORCPT ); Mon, 24 Jan 2022 14:01:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44554 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344293AbiAXS4n (ORCPT ); Mon, 24 Jan 2022 13:56:43 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A5AD7C0617B9; Mon, 24 Jan 2022 10:54:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6CD81B81233; Mon, 24 Jan 2022 18:54:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9055CC340E7; Mon, 24 Jan 2022 18:54:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050450; bh=acYIa2DHDSiyTToTyPnjGfQq3nXl/LCD7YZBPa9Qvbc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ed95+sCVgf3u0JemdpE3qG10G7OtOXzPxG+6vIlHVes4Mi7aRXeBLeXmGDFpAFdC/ 5knPvhW9VgO4KK0f1BnKqdQI/LEHCKXyGP1IsEGVpeXabfE1BZphmHybuFfBySjEwZ vPXzz3zuw6RBrdLu2liK6a/F9osY4rmMYJ75ThHY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wolfram Sang , Lakshmi Sowjanya D , Andy Shevchenko , Jarkko Nikula , Sasha Levin Subject: [PATCH 4.4 093/114] i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters Date: Mon, 24 Jan 2022 19:43:08 +0100 Message-Id: <20220124183929.981431091@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lakshmi Sowjanya D [ Upstream commit d52097010078c1844348dc0e467305e5f90fd317 ] The data type of hcnt and lcnt in the struct dw_i2c_dev is of type u16. It's better to have same data type in struct dw_scl_sda_cfg as well. Reported-by: Wolfram Sang Signed-off-by: Lakshmi Sowjanya D Signed-off-by: Andy Shevchenko Signed-off-by: Jarkko Nikula Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/i2c/busses/i2c-designware-pcidrv.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busse= s/i2c-designware-pcidrv.c index 1543d35d228df..6831883741215 100644 --- a/drivers/i2c/busses/i2c-designware-pcidrv.c +++ b/drivers/i2c/busses/i2c-designware-pcidrv.c @@ -53,10 +53,10 @@ enum dw_pci_ctl_id_t { }; =20 struct dw_scl_sda_cfg { - u32 ss_hcnt; - u32 fs_hcnt; - u32 ss_lcnt; - u32 fs_lcnt; + u16 ss_hcnt; + u16 fs_hcnt; + u16 ss_lcnt; + u16 fs_lcnt; u32 sda_hold; }; =20 --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A947C433EF for ; Mon, 24 Jan 2022 18:57:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245522AbiAXS5I (ORCPT ); Mon, 24 Jan 2022 13:57:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43264 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245760AbiAXSxS (ORCPT ); Mon, 24 Jan 2022 13:53:18 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1D160C06138E; Mon, 24 Jan 2022 10:52:42 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B8C35B8122C; Mon, 24 Jan 2022 18:52:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E3170C340EC; Mon, 24 Jan 2022 18:52:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050360; bh=wuNoMB1LjI/E5Xc0U+R3Df730bHsuveOR5VYnDBx41E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kw/uhcO5Ml03X8AR1hUpxdQFRD6tme1gdZ1j03EvqXtQibnAwQIZzUs2gEehxMn0G 6sRmUpFphPb+K9C0lgBMGTgSbUAFB7aiNUuUCu4qUQqTnhM2rGB/75839gPn7jLCFo ebWA0PzB+nK8sNZs33Hr/gLJT0EHyUShxv5n4MgY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tianjia Zhang , Nathan Chancellor , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.4 094/114] MIPS: Octeon: Fix build errors using clang Date: Mon, 24 Jan 2022 19:43:09 +0100 Message-Id: <20220124183930.014172186@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tianjia Zhang [ Upstream commit 95339b70677dc6f9a2d669c4716058e71b8dc1c7 ] A large number of the following errors is reported when compiling with clang: cvmx-bootinfo.h:326:3: error: adding 'int' to a string does not append to= the string [-Werror,-Wstring-plus-int] ENUM_BRD_TYPE_CASE(CVMX_BOARD_TYPE_NULL) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cvmx-bootinfo.h:321:20: note: expanded from macro 'ENUM_BRD_TYPE_CASE' case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ ~~~^~~~ cvmx-bootinfo.h:326:3: note: use array indexing to silence this warning cvmx-bootinfo.h:321:20: note: expanded from macro 'ENUM_BRD_TYPE_CASE' case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ ^ Follow the prompts to use the address operator '&' to fix this error. Signed-off-by: Tianjia Zhang Reviewed-by: Nathan Chancellor Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/mips/include/asm/octeon/cvmx-bootinfo.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/mips/include/asm/octeon/cvmx-bootinfo.h b/arch/mips/inclu= de/asm/octeon/cvmx-bootinfo.h index d92cf59bdae63..bc414657601c4 100644 --- a/arch/mips/include/asm/octeon/cvmx-bootinfo.h +++ b/arch/mips/include/asm/octeon/cvmx-bootinfo.h @@ -303,7 +303,7 @@ enum cvmx_chip_types_enum { =20 /* Functions to return string based on type */ #define ENUM_BRD_TYPE_CASE(x) \ - case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ + case x: return (&#x[16]); /* Skip CVMX_BOARD_TYPE_ */ static inline const char *cvmx_board_type_to_string(enum cvmx_board_types_enum type) { @@ -392,7 +392,7 @@ static inline const char *cvmx_board_type_to_string(enum } =20 #define ENUM_CHIP_TYPE_CASE(x) \ - case x: return(#x + 15); /* Skip CVMX_CHIP_TYPE */ + case x: return (&#x[15]); /* Skip CVMX_CHIP_TYPE */ static inline const char *cvmx_chip_type_to_string(enum cvmx_chip_types_enum type) { --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39C3EC433FE for ; Mon, 24 Jan 2022 18:55:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343977AbiAXSy3 (ORCPT ); Mon, 24 Jan 2022 13:54:29 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:50822 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236401AbiAXSwq (ORCPT ); Mon, 24 Jan 2022 13:52:46 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 07AEBB8121B; Mon, 24 Jan 2022 18:52:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 191D2C340E5; Mon, 24 Jan 2022 18:52:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050363; bh=1WUYU2h+Ihp81t3u07UTnT8V09OXmsMPudnXV6CtIy8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HB06RHFPxJSOLYs/MiB2bsTrTvfAc/z0rwkQS2QsptjEWfLjOhf3e7hE4U6KcUbAE pYlS7E9jK4bHPNc6ccv9xNaWjouTHmNkciLudU4EJl1yR8BTpbx6Bpd1htRYE8qQPN wa4x4w6It/ZDwPs56kGo4L6sY90F7mhBwSXLM8Yw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Baoquan He , Christoph Hellwig , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.4 095/114] scsi: sr: Dont use GFP_DMA Date: Mon, 24 Jan 2022 19:43:10 +0100 Message-Id: <20220124183930.045525842@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christoph Hellwig [ Upstream commit d94d94969a4ba07a43d62429c60372320519c391 ] The allocated buffers are used as a command payload, for which the block layer and/or DMA API do the proper bounce buffering if needed. Link: https://lore.kernel.org/r/20211222090842.920724-1-hch@lst.de Reported-by: Baoquan He Reviewed-by: Baoquan He Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/scsi/sr.c | 2 +- drivers/scsi/sr_vendor.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c index df019b78d9f79..e26d6cc3c8716 100644 --- a/drivers/scsi/sr.c +++ b/drivers/scsi/sr.c @@ -883,7 +883,7 @@ static void get_capabilities(struct scsi_cd *cd) =20 =20 /* allocate transfer buffer */ - buffer =3D kmalloc(512, GFP_KERNEL | GFP_DMA); + buffer =3D kmalloc(512, GFP_KERNEL); if (!buffer) { sr_printk(KERN_ERR, cd, "out of memory.\n"); return; diff --git a/drivers/scsi/sr_vendor.c b/drivers/scsi/sr_vendor.c index 11a238cb22223..629bfe1b20263 100644 --- a/drivers/scsi/sr_vendor.c +++ b/drivers/scsi/sr_vendor.c @@ -118,7 +118,7 @@ int sr_set_blocklength(Scsi_CD *cd, int blocklength) density =3D (blocklength > 2048) ? 0x81 : 0x83; #endif =20 - buffer =3D kmalloc(512, GFP_KERNEL | GFP_DMA); + buffer =3D kmalloc(512, GFP_KERNEL); if (!buffer) return -ENOMEM; =20 @@ -166,7 +166,7 @@ int sr_cd_check(struct cdrom_device_info *cdi) if (cd->cdi.mask & CDC_MULTI_SESSION) return 0; =20 - buffer =3D kmalloc(512, GFP_KERNEL | GFP_DMA); + buffer =3D kmalloc(512, GFP_KERNEL); if (!buffer) return -ENOMEM; =20 --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52644C433EF for ; Mon, 24 Jan 2022 18:55:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344396AbiAXSyi (ORCPT ); Mon, 24 Jan 2022 13:54:38 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:50600 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343945AbiAXSws (ORCPT ); Mon, 24 Jan 2022 13:52:48 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 848826151A; Mon, 24 Jan 2022 18:52:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E6B1C340E5; Mon, 24 Jan 2022 18:52:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050366; bh=tiEztUcTC2j5P794DPJgbNB59Cy+LICX+yJmsLn7KSc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UmNllmtrGRMIiydKpk4pDD0pFJL+VSlTygyOEFQbeffhRa69ouxt20M9c/CDCBVVr OcyqV6qU+tnKlnu2dRTZEZ8PZK8EaOs9RrhsRZxr4yLVKl7rBVityjQ3RMuaoB7p4O V/VABxsBO2gdz4iQXrJhgMneSbnlLypYDPXYM19k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yauhen Kharuzhy , Hans de Goede , Sebastian Reichel , Sasha Levin Subject: [PATCH 4.4 096/114] power: bq25890: Enable continuous conversion for ADC at charging Date: Mon, 24 Jan 2022 19:43:11 +0100 Message-Id: <20220124183930.077354285@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yauhen Kharuzhy [ Upstream commit 80211be1b9dec04cc2805d3d81e2091ecac289a1 ] Instead of one shot run of ADC at beginning of charging, run continuous conversion to ensure that all charging-related values are monitored properly (input voltage, input current, themperature etc.). Signed-off-by: Yauhen Kharuzhy Reviewed-by: Hans de Goede Signed-off-by: Sebastian Reichel Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/power/bq25890_charger.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/power/bq25890_charger.c b/drivers/power/bq25890_charge= r.c index f993a55cde20f..faf2a62435674 100644 --- a/drivers/power/bq25890_charger.c +++ b/drivers/power/bq25890_charger.c @@ -521,12 +521,12 @@ static void bq25890_handle_state_change(struct bq2589= 0_device *bq, =20 if (!new_state->online) { /* power removed */ /* disable ADC */ - ret =3D bq25890_field_write(bq, F_CONV_START, 0); + ret =3D bq25890_field_write(bq, F_CONV_RATE, 0); if (ret < 0) goto error; } else if (!old_state.online) { /* power inserted */ /* enable ADC, to have control of charge current/voltage */ - ret =3D bq25890_field_write(bq, F_CONV_START, 1); + ret =3D bq25890_field_write(bq, F_CONV_RATE, 1); if (ret < 0) goto error; } --=20 2.34.1 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EE2BC433F5 for ; Mon, 24 Jan 2022 18:55:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344063AbiAXSzn (ORCPT ); Mon, 24 Jan 2022 13:55:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42862 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344084AbiAXSxU (ORCPT ); Mon, 24 Jan 2022 13:53:20 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1C2E4C0613A7; Mon, 24 Jan 2022 10:52:51 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AD152614E3; Mon, 24 Jan 2022 18:52:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6F9B4C340E5; Mon, 24 Jan 2022 18:52:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050370; bh=xlYj8+vdIvrzfMuQbGn3srN8dLG2vTqYB47vCUgP9Qo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fDyfMjtliTD+/toqy+LinISx8XnUZPYZTSON8yZzV0a+Ae2xE8iwP59c4bpi91PI6 Hsh5qf99DY0m4JjlhlAf3e+QmbT3eOTuQhdHQpYZ1ygEbxXrRqYj5Dsl4tcmR0ozW/ jRA5457VnaoXDVbhRrjz2BT7EdxBssQXy0vCsxyQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Petr Cvachoucek , Richard Weinberger Subject: [PATCH 4.4 097/114] ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers Date: Mon, 24 Jan 2022 19:43:12 +0100 Message-Id: <20220124183930.107878239@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Petr Cvachoucek commit 3fea4d9d160186617ff40490ae01f4f4f36b28ff upstream. it seems freeing the write buffers in the error path of the ubifs_remount_rw() is wrong. It leads later to a kernel oops like this: [10016.431274] UBIFS (ubi0:0): start fixing up free space [10090.810042] UBIFS (ubi0:0): free space fixup complete [10090.814623] UBIFS error (ubi0:0 pid 512): ubifs_remount_fs: cannot spawn "ubifs_bgt0_0", error -4 [10101.915108] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 517 [10105.275498] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 [10105.284352] Mem abort info: [10105.287160] ESR =3D 0x96000006 [10105.290252] EC =3D 0x25: DABT (current EL), IL =3D 32 bits [10105.295592] SET =3D 0, FnV =3D 0 [10105.298652] EA =3D 0, S1PTW =3D 0 [10105.301848] Data abort info: [10105.304723] ISV =3D 0, ISS =3D 0x00000006 [10105.308573] CM =3D 0, WnR =3D 0 [10105.311564] user pgtable: 4k pages, 48-bit VAs, pgdp=3D00000000f03d1000 [10105.318034] [0000000000000030] pgd=3D00000000f6cee003, pud=3D00000000f4884003, pmd=3D0000000000000000 [10105.326783] Internal error: Oops: 96000006 [#1] PREEMPT SMP [10105.332355] Modules linked in: ath10k_pci ath10k_core ath mac80211 libarc4 cfg80211 nvme nvme_core cryptodev(O) [10105.342468] CPU: 3 PID: 518 Comm: touch Tainted: G O 5.4.3 #1 [10105.349517] Hardware name: HYPEX CPU (DT) [10105.353525] pstate: 40000005 (nZcv daif -PAN -UAO) [10105.358324] pc : atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34 [10105.364596] lr : mutex_lock+0x1c/0x34 [10105.368253] sp : ffff000075633aa0 [10105.371563] x29: ffff000075633aa0 x28: 0000000000000001 [10105.376874] x27: ffff000076fa80c8 x26: 0000000000000004 [10105.382185] x25: 0000000000000030 x24: 0000000000000000 [10105.387495] x23: 0000000000000000 x22: 0000000000000038 [10105.392807] x21: 000000000000000c x20: ffff000076fa80c8 [10105.398119] x19: ffff000076fa8000 x18: 0000000000000000 [10105.403429] x17: 0000000000000000 x16: 0000000000000000 [10105.408741] x15: 0000000000000000 x14: fefefefefefefeff [10105.414052] x13: 0000000000000000 x12: 0000000000000fe0 [10105.419364] x11: 0000000000000fe0 x10: ffff000076709020 [10105.424675] x9 : 0000000000000000 x8 : 00000000000000a0 [10105.429986] x7 : ffff000076fa80f4 x6 : 0000000000000030 [10105.435297] x5 : 0000000000000000 x4 : 0000000000000000 [10105.440609] x3 : 0000000000000000 x2 : ffff00006f276040 [10105.445920] x1 : ffff000075633ab8 x0 : 0000000000000030 [10105.451232] Call trace: [10105.453676] atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34 [10105.459600] ubifs_garbage_collect+0xb4/0x334 [10105.463956] ubifs_budget_space+0x398/0x458 [10105.468139] ubifs_create+0x50/0x180 [10105.471712] path_openat+0x6a0/0x9b0 [10105.475284] do_filp_open+0x34/0x7c [10105.478771] do_sys_open+0x78/0xe4 [10105.482170] __arm64_sys_openat+0x1c/0x24 [10105.486180] el0_svc_handler+0x84/0xc8 [10105.489928] el0_svc+0x8/0xc [10105.492808] Code: 52800013 17fffffb d2800003 f9800011 (c85ffc05) [10105.498903] ---[ end trace 46b721d93267a586 ]--- To reproduce the problem: 1. Filesystem initially mounted read-only, free space fixup flag set. 2. mount -o remount,rw 3. it takes some time (free space fixup running) ... try to terminate running mount by CTRL-C ... does not respond, only after free space fixup is complete ... then "ubifs_remount_fs: cannot spawn "ubifs_bgt0_0", error -4" 4. mount -o remount,rw ... now finished instantly (fixup already done). 5. Create file or just unmount the filesystem and we get the oops. Cc: Fixes: b50b9f408502 ("UBIFS: do not free write-buffers when in R/O mode") Signed-off-by: Petr Cvachoucek Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- fs/ubifs/super.c | 1 - 1 file changed, 1 deletion(-) --- a/fs/ubifs/super.c +++ b/fs/ubifs/super.c @@ -1695,7 +1695,6 @@ out: kthread_stop(c->bgt); c->bgt =3D NULL; } - free_wbufs(c); kfree(c->write_reserve_buf); c->write_reserve_buf =3D NULL; vfree(c->ileb_buf); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1BF50C433EF for ; Mon, 24 Jan 2022 18:55:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245411AbiAXSzW (ORCPT ); Mon, 24 Jan 2022 13:55:22 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:52078 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343982AbiAXSwy (ORCPT ); Mon, 24 Jan 2022 13:52:54 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EB390614BE; Mon, 24 Jan 2022 18:52:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2613C340E5; Mon, 24 Jan 2022 18:52:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050373; bh=W46B476feYqGoB0BzzWIPhXASw9qeqBJiY3JXo5Z8qE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UUzn2C5cBpCuTGlw2zb2KlsqeQ/2uu2HPOaZzIbLKmmHdt1Oc15c7TVQGZo63n2n2 0vdfp4hth7/9f30os2CV6OgNuCjySd36hC2C/lqD0ERP1sAdQ6zziq+YCuMx+vSVTe nWM6qo1hFPb7y/LobVPXuRTMrT0ulm3MRv2T4RGE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jeroen van Wolffelaar , =?UTF-8?q?Lu=C3=ADs=20Henriques?= , Theodore Tso , stable@kernel.org Subject: [PATCH 4.4 098/114] ext4: set csum seed in tmp inode while migrating to extents Date: Mon, 24 Jan 2022 19:43:13 +0100 Message-Id: <20220124183930.140510144@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Lu=C3=ADs Henriques commit e81c9302a6c3c008f5c30beb73b38adb0170ff2d upstream. When migrating to extents, the temporary inode will have it's own checksum seed. This means that, when swapping the inodes data, the inode checksums will be incorrect. This can be fixed by recalculating the extents checksums again. Or simply by copying the seed into the temporary inode. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D213357 Reported-by: Jeroen van Wolffelaar Signed-off-by: Lu=C3=ADs Henriques Link: https://lore.kernel.org/r/20211214175058.19511-1-lhenriques@suse.de Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- fs/ext4/migrate.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/fs/ext4/migrate.c +++ b/fs/ext4/migrate.c @@ -481,6 +481,17 @@ int ext4_ext_migrate(struct inode *inode ext4_journal_stop(handle); return retval; } + /* + * Use the correct seed for checksum (i.e. the seed from 'inode'). This + * is so that the metadata blocks will have the correct checksum after + * the migration. + * + * Note however that, if a crash occurs during the migration process, + * the recovery process is broken because the tmp_inode checksums will + * be wrong and the orphans cleanup will fail. + */ + ei =3D EXT4_I(inode); + EXT4_I(tmp_inode)->i_csum_seed =3D ei->i_csum_seed; i_size_write(tmp_inode, i_size_read(inode)); /* * Set the i_nlink to zero so it will be deleted later @@ -524,7 +535,6 @@ int ext4_ext_migrate(struct inode *inode goto out; } =20 - ei =3D EXT4_I(inode); i_data =3D ei->i_data; memset(&lb, 0, sizeof(lb)); =20 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 31044C433FE for ; Mon, 24 Jan 2022 18:55:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343668AbiAXSzZ (ORCPT ); Mon, 24 Jan 2022 13:55:25 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:50970 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245734AbiAXSw7 (ORCPT ); Mon, 24 Jan 2022 13:52:59 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DFD20B8122C; Mon, 24 Jan 2022 18:52:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01D2EC340E5; Mon, 24 Jan 2022 18:52:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050376; bh=V5X3RuIQ2qy9oxbWKQ/Xn6WH2wPG0zTUN1YywhvLYjA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EWXe26/YibV8R8CpRVceoNhYzeINDQqV92qXsyQ2RFlk3z83Z9LQiwOlJb75SD2hJ lu8uxznIwmn25QnrOjhqoP1VYHYR2SdRB5iNdjabaKgglpFWOqPaeP19/hvF1P0v8H gRRMb1FOont8wSwS8E5jf8ecTM/xUO8Kzk0WNoJg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ye Bin , Jan Kara , Theodore Tso , stable@kernel.org Subject: [PATCH 4.4 099/114] ext4: Fix BUG_ON in ext4_bread when write quota data Date: Mon, 24 Jan 2022 19:43:14 +0100 Message-Id: <20220124183930.169205304@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Bin commit 380a0091cab482489e9b19e07f2a166ad2b76d5c upstream. We got issue as follows when run syzkaller: [ 167.936972] EXT4-fs error (device loop0): __ext4_remount:6314: comm rep:= Abort forced by user [ 167.938306] EXT4-fs (loop0): Remounting filesystem read-only [ 167.981637] Assertion failure in ext4_getblk() at fs/ext4/inode.c:847: '= (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) || handle !=3D NULL = || create =3D=3D 0' [ 167.983601] ------------[ cut here ]------------ [ 167.984245] kernel BUG at fs/ext4/inode.c:847! [ 167.984882] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 167.985624] CPU: 7 PID: 2290 Comm: rep Tainted: G B 5.16.= 0-rc5-next-20211217+ #123 [ 167.986823] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS = ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ 167.988590] RIP: 0010:ext4_getblk+0x17e/0x504 [ 167.989189] Code: c6 01 74 28 49 c7 c0 a0 a3 5c 9b b9 4f 03 00 00 48 c7 = c2 80 9c 5c 9b 48 c7 c6 40 b6 5c 9b 48 c7 c7 20 a4 5c 9b e8 77 e3 fd ff <0f= > 0b 8b 04 244 [ 167.991679] RSP: 0018:ffff8881736f7398 EFLAGS: 00010282 [ 167.992385] RAX: 0000000000000094 RBX: 1ffff1102e6dee75 RCX: 00000000000= 00000 [ 167.993337] RDX: 0000000000000001 RSI: ffffffff9b6e29e0 RDI: ffffed102e6= dee66 [ 167.994292] RBP: ffff88816a076210 R08: 0000000000000094 R09: ffffed10736= 3fa09 [ 167.995252] R10: ffff88839b1fd047 R11: ffffed107363fa08 R12: ffff88816a0= 761e8 [ 167.996205] R13: 0000000000000000 R14: 0000000000000021 R15: 00000000000= 00001 [ 167.997158] FS: 00007f6a1428c740(0000) GS:ffff88839b000000(0000) knlGS:= 0000000000000000 [ 167.998238] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 167.999025] CR2: 00007f6a140716c8 CR3: 0000000133216000 CR4: 00000000000= 006e0 [ 167.999987] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000= 00000 [ 168.000944] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000= 00400 [ 168.001899] Call Trace: [ 168.002235] [ 168.007167] ext4_bread+0xd/0x53 [ 168.007612] ext4_quota_write+0x20c/0x5c0 [ 168.010457] write_blk+0x100/0x220 [ 168.010944] remove_free_dqentry+0x1c6/0x440 [ 168.011525] free_dqentry.isra.0+0x565/0x830 [ 168.012133] remove_tree+0x318/0x6d0 [ 168.014744] remove_tree+0x1eb/0x6d0 [ 168.017346] remove_tree+0x1eb/0x6d0 [ 168.019969] remove_tree+0x1eb/0x6d0 [ 168.022128] qtree_release_dquot+0x291/0x340 [ 168.023297] v2_release_dquot+0xce/0x120 [ 168.023847] dquot_release+0x197/0x3e0 [ 168.024358] ext4_release_dquot+0x22a/0x2d0 [ 168.024932] dqput.part.0+0x1c9/0x900 [ 168.025430] __dquot_drop+0x120/0x190 [ 168.025942] ext4_clear_inode+0x86/0x220 [ 168.026472] ext4_evict_inode+0x9e8/0xa22 [ 168.028200] evict+0x29e/0x4f0 [ 168.028625] dispose_list+0x102/0x1f0 [ 168.029148] evict_inodes+0x2c1/0x3e0 [ 168.030188] generic_shutdown_super+0xa4/0x3b0 [ 168.030817] kill_block_super+0x95/0xd0 [ 168.031360] deactivate_locked_super+0x85/0xd0 [ 168.031977] cleanup_mnt+0x2bc/0x480 [ 168.033062] task_work_run+0xd1/0x170 [ 168.033565] do_exit+0xa4f/0x2b50 [ 168.037155] do_group_exit+0xef/0x2d0 [ 168.037666] __x64_sys_exit_group+0x3a/0x50 [ 168.038237] do_syscall_64+0x3b/0x90 [ 168.038751] entry_SYSCALL_64_after_hwframe+0x44/0xae In order to reproduce this problem, the following conditions need to be met: 1. Ext4 filesystem with no journal; 2. Filesystem image with incorrect quota data; 3. Abort filesystem forced by user; 4. umount filesystem; As in ext4_quota_write: ... if (EXT4_SB(sb)->s_journal && !handle) { ext4_msg(sb, KERN_WARNING, "Quota write (off=3D%llu, len= =3D%llu)" " cancelled because transaction is not started", (unsigned long long)off, (unsigned long long)len); return -EIO; } ... We only check handle if NULL when filesystem has journal. There is need check handle if NULL even when filesystem has no journal. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20211223015506.297766-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5367,7 +5367,7 @@ static ssize_t ext4_quota_write(struct s struct buffer_head *bh; handle_t *handle =3D journal_current_handle(); =20 - if (EXT4_SB(sb)->s_journal && !handle) { + if (!handle) { ext4_msg(sb, KERN_WARNING, "Quota write (off=3D%llu, len=3D%llu)" " cancelled because transaction is not started", (unsigned long long)off, (unsigned long long)len); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8BBADC433F5 for ; Mon, 24 Jan 2022 18:56:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344318AbiAXS4r (ORCPT ); Mon, 24 Jan 2022 13:56:47 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:51876 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343997AbiAXSxC (ORCPT ); Mon, 24 Jan 2022 13:53:02 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 387FAB8121C; Mon, 24 Jan 2022 18:53:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43B8EC36AE9; Mon, 24 Jan 2022 18:52:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050380; bh=sTTgpgmbUcfDJ3e7vQshhsXsvJ02IkzeYILauBlTR2k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PTZmIJ5Bm0gP/comaZwtf0CJ/rjU5liQSdl8lSJAEcI0usiv4IdGMQAxfDFLwK4DL MZy2y5Qn2WIWSI4URkSK3b0VTFgSpB/z8Px2BRRD5wNjDgeaS2Vf96HstL/Cb2ZKTZ 80K3I9b6s2mfFvD/1oETTe9TPrEnO+OVeYfdD8+Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Theodore Tso , Lukas Czerner , stable@kernel.org Subject: [PATCH 4.4 100/114] ext4: dont use the orphan list when migrating an inode Date: Mon, 24 Jan 2022 19:43:15 +0100 Message-Id: <20220124183930.198387689@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Theodore Ts'o commit 6eeaf88fd586f05aaf1d48cb3a139d2a5c6eb055 upstream. We probably want to remove the indirect block to extents migration feature after a deprecation window, but until then, let's fix a potential data loss problem caused by the fact that we put the tmp_inode on the orphan list. In the unlikely case where we crash and do a journal recovery, the data blocks belonging to the inode being migrated are also represented in the tmp_inode on the orphan list --- and so its data blocks will get marked unallocated, and available for reuse. Instead, stop putting the tmp_inode on the oprhan list. So in the case where we crash while migrating the inode, we'll leak an inode, which is not a disaster. It will be easily fixed the next time we run fsck, and it's better than potentially having blocks getting claimed by two different files, and losing data as a result. Signed-off-by: Theodore Ts'o Reviewed-by: Lukas Czerner Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- fs/ext4/migrate.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) --- a/fs/ext4/migrate.c +++ b/fs/ext4/migrate.c @@ -459,12 +459,12 @@ int ext4_ext_migrate(struct inode *inode return retval; =20 /* - * Worst case we can touch the allocation bitmaps, a bgd - * block, and a block to link in the orphan list. We do need - * need to worry about credits for modifying the quota inode. + * Worst case we can touch the allocation bitmaps and a block + * group descriptor block. We do need need to worry about + * credits for modifying the quota inode. */ handle =3D ext4_journal_start(inode, EXT4_HT_MIGRATE, - 4 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); + 3 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); =20 if (IS_ERR(handle)) { retval =3D PTR_ERR(handle); @@ -485,10 +485,6 @@ int ext4_ext_migrate(struct inode *inode * Use the correct seed for checksum (i.e. the seed from 'inode'). This * is so that the metadata blocks will have the correct checksum after * the migration. - * - * Note however that, if a crash occurs during the migration process, - * the recovery process is broken because the tmp_inode checksums will - * be wrong and the orphans cleanup will fail. */ ei =3D EXT4_I(inode); EXT4_I(tmp_inode)->i_csum_seed =3D ei->i_csum_seed; @@ -500,7 +496,6 @@ int ext4_ext_migrate(struct inode *inode clear_nlink(tmp_inode); =20 ext4_ext_tree_init(handle, tmp_inode); - ext4_orphan_add(handle, tmp_inode); ext4_journal_stop(handle); =20 /* @@ -525,12 +520,6 @@ int ext4_ext_migrate(struct inode *inode =20 handle =3D ext4_journal_start(inode, EXT4_HT_MIGRATE, 1); if (IS_ERR(handle)) { - /* - * It is impossible to update on-disk structures without - * a handle, so just rollback in-core changes and live other - * work to orphan_list_cleanup() - */ - ext4_orphan_del(NULL, tmp_inode); retval =3D PTR_ERR(handle); goto out; } From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5CDC2C4332F for ; Mon, 24 Jan 2022 18:56:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343880AbiAXS4D (ORCPT ); Mon, 24 Jan 2022 13:56:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43086 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344187AbiAXSxy (ORCPT ); Mon, 24 Jan 2022 13:53:54 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BB052C06175B; Mon, 24 Jan 2022 10:53:05 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 78049B810BD; Mon, 24 Jan 2022 18:53:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83272C340E5; Mon, 24 Jan 2022 18:53:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050383; bh=SqqKlmrkJD2ajJiHT7F53gMvsqqsiJfdubXqh3QjyAo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LXHOT118XShLCB1XxGaKuI1ApFICs4MQBvuoFKVgUkti8rDp3d3q8u1miwMElwnrF dMLsss3xAYnlfGMlVUvB5zNEUrsoUs57sHXo7X0rmeEzJlTknoB7gVmU0GFJNJ2EM4 0uTYihnLgT7TigeDT3MWEYFR2U0NGPnVRHTZn1oM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tobias Waldekranz , Jakub Kicinski Subject: [PATCH 4.4 101/114] powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses Date: Mon, 24 Jan 2022 19:43:16 +0100 Message-Id: <20220124183930.228586236@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tobias Waldekranz commit 0d375d610fa96524e2ee2b46830a46a7bfa92a9f upstream. This block is used in (at least) T1024 and T1040, including their variants like T1023 etc. Fixes: d55ad2967d89 ("powerpc/mpc85xx: Create dts components for the FSL Qo= rIQ DPAA FMan") Signed-off-by: Tobias Waldekranz Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi +++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi @@ -78,6 +78,7 @@ fman0: fman@400000 { #size-cells =3D <0>; compatible =3D "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg =3D <0xfc000 0x1000>; + fsl,erratum-a009885; }; =20 xmdio0: mdio@fd000 { @@ -85,6 +86,7 @@ fman0: fman@400000 { #size-cells =3D <0>; compatible =3D "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg =3D <0xfd000 0x1000>; + fsl,erratum-a009885; }; =20 ptp_timer0: ptp-timer@fe000 { From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6104C433EF for ; Mon, 24 Jan 2022 18:56:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344137AbiAXSz7 (ORCPT ); Mon, 24 Jan 2022 13:55:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42914 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344191AbiAXSxz (ORCPT ); Mon, 24 Jan 2022 13:53:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2406EC06176A; Mon, 24 Jan 2022 10:53:08 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BC3D4B8121F; Mon, 24 Jan 2022 18:53:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CC749C340E8; Mon, 24 Jan 2022 18:53:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050386; bh=FIqYHvH6IqcIa7qor3u4vpchq2nShExahI2dprWf424=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eKrsa0gEhQEMYAuxOPM2+zhjDzPRpCoszb6SBUORiwAvEaawA+6UvQSVRAp1nfqGi pcYAghX617Ng3b5poJGpdbZtomydyrRVGSJxTolgxO3enm89ZWAuP7aePI99hxXzBN 5DhlrHPoE5ebCTGi09J5a5dycZhzFmU/urlAXDE0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tobias Waldekranz , Andrew Lunn , Jakub Kicinski Subject: [PATCH 4.4 102/114] net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module Date: Mon, 24 Jan 2022 19:43:17 +0100 Message-Id: <20220124183930.260689505@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tobias Waldekranz commit 3f7c239c7844d2044ed399399d97a5f1c6008e1b upstream. As reported by sparse: In the remove path, the driver would attempt to unmap its own priv pointer - instead of the io memory that it mapped in probe. Fixes: 9f35a7342cff ("net/fsl: introduce Freescale 10G MDIO driver") Signed-off-by: Tobias Waldekranz Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/ethernet/freescale/xgmac_mdio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/freescale/xgmac_mdio.c +++ b/drivers/net/ethernet/freescale/xgmac_mdio.c @@ -304,9 +304,10 @@ err_ioremap: static int xgmac_mdio_remove(struct platform_device *pdev) { struct mii_bus *bus =3D platform_get_drvdata(pdev); + struct mdio_fsl_priv *priv =3D bus->priv; =20 mdiobus_unregister(bus); - iounmap(bus->priv); + iounmap(priv->mdio_base); mdiobus_free(bus); =20 return 0; From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A772AC433EF for ; Mon, 24 Jan 2022 18:57:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344092AbiAXS5Q (ORCPT ); Mon, 24 Jan 2022 13:57:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42934 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344263AbiAXSyF (ORCPT ); Mon, 24 Jan 2022 13:54:05 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8DC11C0613E9; Mon, 24 Jan 2022 10:53:10 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2A04C614E3; Mon, 24 Jan 2022 18:53:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D3D30C340E5; Mon, 24 Jan 2022 18:53:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050389; bh=sGOvretFgauqF2/LGbvj1iZr7JxVo+3umuYUrti16Ho=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dOEMyXdMc+GAwbXcsr7qK+YVSIRsvynzpBmj/4Qq50u08KpAYmNXD79FIiVRGZAW7 56NHAyXF2ps5H6wYRVaB7UJs2u/I0wQW8Rm19J+/W7/vJFV24demf0IiYvwJ8w7kWm o6e4HykwupjITpgzla2MroBLwisd5B1UBgh+2YQc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Helge Deller Subject: [PATCH 4.4 103/114] parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries Date: Mon, 24 Jan 2022 19:43:18 +0100 Message-Id: <20220124183930.290507116@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Miaoqian Lin commit d24846a4246b6e61ecbd036880a4adf61681d241 upstream. kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add()=EF=BC=9A If this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object. Fix memory leak by calling kobject_put(). Fixes: 73f368cf679b ("Kobject: change drivers/parisc/pdc_stable.c to use ko= bject_init_and_add") Signed-off-by: Miaoqian Lin Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/parisc/pdc_stable.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/parisc/pdc_stable.c +++ b/drivers/parisc/pdc_stable.c @@ -992,8 +992,10 @@ pdcs_register_pathentries(void) entry->kobj.kset =3D paths_kset; err =3D kobject_init_and_add(&entry->kobj, &ktype_pdcspath, NULL, "%s", entry->name); - if (err) + if (err) { + kobject_put(&entry->kobj); return err; + } =20 /* kobject is now registered */ write_lock(&entry->rw_lock); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2ECDC433F5 for ; Mon, 24 Jan 2022 18:56:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343898AbiAXS4X (ORCPT ); Mon, 24 Jan 2022 13:56:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42944 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343701AbiAXSyS (ORCPT ); Mon, 24 Jan 2022 13:54:18 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ACEFCC0613EF; Mon, 24 Jan 2022 10:53:16 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4C27A614F4; Mon, 24 Jan 2022 18:53:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0D077C340E5; Mon, 24 Jan 2022 18:53:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050395; bh=63F1nd3KDMNKL6yqbHKJOnOSr+qJ79dax9b58eVEicc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h6VEFixOBZlhqrxUpNdH2awppm1YTJb3pcZdC/p7QpQSDy/Lqz1Bdeoi0hHdcdNlC Bp1GZuBtFFLKaVVUGuO5GQJtz4sz9L9NJ4bHz70XHwaPDI/J1LrSioEiAInzwBxmRQ VhzgPXgKRsqNdflw5+bFhJzdTHAqJ2QQFzGFt+94= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , Jakub Kicinski Subject: [PATCH 4.4 104/114] af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress Date: Mon, 24 Jan 2022 19:43:19 +0100 Message-Id: <20220124183930.320576074@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 9d6d7f1cb67cdee15f1a0e85aacfb924e0e02435 upstream. wait_for_unix_gc() reads unix_tot_inflight & gc_in_progress without synchronization. Adds READ_ONCE()/WRITE_ONCE() and their associated comments to better document the intent. BUG: KCSAN: data-race in unix_inflight / wait_for_unix_gc write to 0xffffffff86e2b7c0 of 4 bytes by task 9380 on cpu 0: unix_inflight+0x1e8/0x260 net/unix/scm.c:63 unix_attach_fds+0x10c/0x1e0 net/unix/scm.c:121 unix_scm_to_skb net/unix/af_unix.c:1674 [inline] unix_dgram_sendmsg+0x679/0x16b0 net/unix/af_unix.c:1817 unix_seqpacket_sendmsg+0xcc/0x110 net/unix/af_unix.c:2258 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2409 ___sys_sendmsg net/socket.c:2463 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549 __do_sys_sendmmsg net/socket.c:2578 [inline] __se_sys_sendmmsg net/socket.c:2575 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffffffff86e2b7c0 of 4 bytes by task 9375 on cpu 1: wait_for_unix_gc+0x24/0x160 net/unix/garbage.c:196 unix_dgram_sendmsg+0x8e/0x16b0 net/unix/af_unix.c:1772 unix_seqpacket_sendmsg+0xcc/0x110 net/unix/af_unix.c:2258 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2409 ___sys_sendmsg net/socket.c:2463 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549 __do_sys_sendmmsg net/socket.c:2578 [inline] __se_sys_sendmmsg net/socket.c:2575 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000002 -> 0x00000004 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 9375 Comm: syz-executor.1 Not tainted 5.16.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Fixes: 9915672d4127 ("af_unix: limit unix_tot_inflight") Signed-off-by: Eric Dumazet Reported-by: syzbot Link: https://lore.kernel.org/r/20220114164328.2038499-1-eric.dumazet@gmail= .com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- net/unix/garbage.c | 14 +++++++++++--- net/unix/scm.c | 6 ++++-- 2 files changed, 15 insertions(+), 5 deletions(-) --- a/net/unix/garbage.c +++ b/net/unix/garbage.c @@ -197,8 +197,11 @@ void wait_for_unix_gc(void) { /* If number of inflight sockets is insane, * force a garbage collect right now. + * Paired with the WRITE_ONCE() in unix_inflight(), + * unix_notinflight() and gc_in_progress(). */ - if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress) + if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC && + !READ_ONCE(gc_in_progress)) unix_gc(); wait_event(unix_gc_wait, gc_in_progress =3D=3D false); } @@ -218,7 +221,9 @@ void unix_gc(void) if (gc_in_progress) goto out; =20 - gc_in_progress =3D true; + /* Paired with READ_ONCE() in wait_for_unix_gc(). */ + WRITE_ONCE(gc_in_progress, true); + /* First, select candidates for garbage collection. Only * in-flight sockets are considered, and from those only ones * which don't have any external reference. @@ -304,7 +309,10 @@ void unix_gc(void) =20 /* All candidates should have been detached by now. */ BUG_ON(!list_empty(&gc_candidates)); - gc_in_progress =3D false; + + /* Paired with READ_ONCE() in wait_for_unix_gc(). */ + WRITE_ONCE(gc_in_progress, false); + wake_up(&unix_gc_wait); =20 out: --- a/net/unix/scm.c +++ b/net/unix/scm.c @@ -56,7 +56,8 @@ void unix_inflight(struct user_struct *u } else { BUG_ON(list_empty(&u->link)); } - unix_tot_inflight++; + /* Paired with READ_ONCE() in wait_for_unix_gc() */ + WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1); } user->unix_inflight++; spin_unlock(&unix_gc_lock); @@ -76,7 +77,8 @@ void unix_notinflight(struct user_struct =20 if (atomic_long_dec_and_test(&u->inflight)) list_del_init(&u->link); - unix_tot_inflight--; + /* Paired with READ_ONCE() in wait_for_unix_gc() */ + WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1); } user->unix_inflight--; spin_unlock(&unix_gc_lock); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D8EFC433EF for ; Mon, 24 Jan 2022 18:56:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236776AbiAXS4a (ORCPT ); Mon, 24 Jan 2022 13:56:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43970 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343937AbiAXSyT (ORCPT ); Mon, 24 Jan 2022 13:54:19 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8F25FC06173D; Mon, 24 Jan 2022 10:53:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 57DF0B8121A; Mon, 24 Jan 2022 18:53:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6A2BEC340E5; Mon, 24 Jan 2022 18:53:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050399; bh=32uOvvkf5PwtZBQ1zKQge2AigcWs01gd5KpLT3qG+qQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IS8KnmZSLOw4K1E+DChIXdwIEvnvWafUg94qP7zsXApeLqfOE7rLUmPOgYPpdb0r3 E5FgSFFwSIhZWTjDaX3X0PTD+wnz963TIYntQoWHgNaMC5TC3RjFQ0JxfNxLkORyV/ fgFoxI4D5JbmOoaRiT741FZmiLajC6SOLQ/ZYZDw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert Hancock , Andrew Lunn , "David S. Miller" Subject: [PATCH 4.4 105/114] net: axienet: Wait for PhyRstCmplt after core reset Date: Mon, 24 Jan 2022 19:43:20 +0100 Message-Id: <20220124183930.351490754@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Robert Hancock commit b400c2f4f4c53c86594dd57098970d97d488bfde upstream. When resetting the device, wait for the PhyRstCmplt bit to be set in the interrupt status register before continuing initialization, to ensure that the core is actually ready. When using an external PHY, this also ensures we do not start trying to access the PHY while it is still in reset. The PHY reset is initiated by the core reset which is triggered just above, but remains asserted for 5ms after the core is reset according to the documentation. The MgtRdy bit could also be waited for, but unfortunately when using 7-series devices, the bit does not appear to work as documented (it seems to behave as some sort of link state indication and not just an indication the transceiver is ready) so it can't really be relied on for this purpose. Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethern= et driver") Signed-off-by: Robert Hancock Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c @@ -278,6 +278,16 @@ static int axienet_dma_bd_init(struct ne axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET, cr | XAXIDMA_CR_RUNSTOP_MASK); =20 + /* Wait for PhyRstCmplt bit to be set, indicating the PHY reset has finis= hed */ + ret =3D read_poll_timeout(axienet_ior, value, + value & XAE_INT_PHYRSTCMPLT_MASK, + DELAY_OF_ONE_MILLISEC, 50000, false, lp, + XAE_IS_OFFSET); + if (ret) { + dev_err(lp->dev, "%s: timeout waiting for PhyRstCmplt\n", __func__); + return ret; + } + return 0; out: axienet_dma_bd_release(ndev); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B76C2C433FE for ; Mon, 24 Jan 2022 18:58:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344378AbiAXS6z (ORCPT ); Mon, 24 Jan 2022 13:58:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43132 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344424AbiAXSyj (ORCPT ); Mon, 24 Jan 2022 13:54:39 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5369FC061744; Mon, 24 Jan 2022 10:53:23 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E6644614D4; Mon, 24 Jan 2022 18:53:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C6C64C340E5; Mon, 24 Jan 2022 18:53:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050402; bh=zvNxJIBpGYAJAFDVKjkPscRL8chuDPUd05tL6Yf77iQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zC4+w1UmkXksjyvnXnn4xgET5iiB7agvo774wmlKVqkYXYAZHsS73o/YWTAk0llgM +I3IQ/1CiYjuMmYLt3NEUtDoEjt1AG+alPCD27B88sjWM3WQfXkvPW+Egq0SXOu2Gt hq3OzhksnZmGKdYggVL0L/ErF3RJl+CtjOT+fdCw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert Hancock , "David S. Miller" Subject: [PATCH 4.4 106/114] net: axienet: fix number of TX ring slots for available check Date: Mon, 24 Jan 2022 19:43:21 +0100 Message-Id: <20220124183930.380100924@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Robert Hancock commit aba57a823d2985a2cc8c74a2535f3a88e68d9424 upstream. The check for the number of available TX ring slots was off by 1 since a slot is required for the skb header as well as each fragment. This could result in overwriting a TX ring slot that was still in use. Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethern= et driver") Signed-off-by: Robert Hancock Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c @@ -681,7 +681,7 @@ axienet_start_xmit(struct sk_buff *skb, num_frag =3D skb_shinfo(skb)->nr_frags; cur_p =3D &lp->tx_bd_v[lp->tx_bd_tail]; =20 - if (axienet_check_tx_bd_space(lp, num_frag)) { + if (axienet_check_tx_bd_space(lp, num_frag + 1)) { if (netif_queue_stopped(ndev)) return NETDEV_TX_BUSY; =20 @@ -691,7 +691,7 @@ axienet_start_xmit(struct sk_buff *skb, smp_mb(); =20 /* Space might have just been freed - check again */ - if (axienet_check_tx_bd_space(lp, num_frag)) + if (axienet_check_tx_bd_space(lp, num_frag + 1)) return NETDEV_TX_BUSY; =20 netif_wake_queue(ndev); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB468C433EF for ; Mon, 24 Jan 2022 18:58:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245739AbiAXS6j (ORCPT ); Mon, 24 Jan 2022 13:58:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43142 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344435AbiAXSyk (ORCPT ); Mon, 24 Jan 2022 13:54:40 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 30BA1C06175E; Mon, 24 Jan 2022 10:53:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EC80DB8121A; Mon, 24 Jan 2022 18:53:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0944C340E5; Mon, 24 Jan 2022 18:53:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050405; bh=Jp1D2HXeEPJRnII3/fBMon8Hpv+73Bm1AarWOZp1Gfk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y2BmY5eP6H6QWMBaHrzR8O12LysqN1gSfdU4/UOGODfNXehAzoPSLjDDtbvjrr62d W3gqdV0ihohjwYhA/Un1IDHMBOFHkWt8FblNb2i75WKDM/or4YKEyWjZ5n2cjCiQ1m GpaKD0pajuqwF77sPMxSxBhauMtXL84rViL9sWeQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , "Eric W. Biederman" , "David S. Miller" Subject: [PATCH 4.4 107/114] netns: add schedule point in ops_exit_list() Date: Mon, 24 Jan 2022 19:43:22 +0100 Message-Id: <20220124183930.408812024@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 2836615aa22de55b8fca5e32fe1b27a67cda625e upstream. When under stress, cleanup_net() can have to dismantle netns in big numbers. ops_exit_list() currently calls many helpers [1] that have no schedule point, and we can end up with soft lockups, particularly on hosts with many cpus. Even for moderate amount of netns processed by cleanup_net() this patch avoids latency spikes. [1] Some of these helpers like fib_sync_up() and fib_sync_down_dev() are very slow because net/ipv4/fib_semantics.c uses host-wide hash tables, and ifindex is used as the only input of two hash functions. ifindexes tend to be the same for all netns (lo.ifindex=3D=3D1 per inst= ance) This will be fixed in a separate patch. Fixes: 72ad937abd0a ("net: Add support for batching network namespace clean= ups") Signed-off-by: Eric Dumazet Cc: Eric W. Biederman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- net/core/net_namespace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -130,8 +130,10 @@ static void ops_exit_list(const struct p { struct net *net; if (ops->exit) { - list_for_each_entry(net, net_exit_list, exit_list) + list_for_each_entry(net, net_exit_list, exit_list) { ops->exit(net); + cond_resched(); + } } if (ops->exit_batch) ops->exit_batch(net_exit_list); From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0CACC433EF for ; Mon, 24 Jan 2022 18:55:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343562AbiAXSzp (ORCPT ); Mon, 24 Jan 2022 13:55:45 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:52590 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343557AbiAXSxa (ORCPT ); Mon, 24 Jan 2022 13:53:30 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 96C2C614D4; Mon, 24 Jan 2022 18:53:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D628C340E5; Mon, 24 Jan 2022 18:53:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050409; bh=7ZmSP83pnz/9ovn3uNxo/a+ALAEvGbkM4+KUbVVkoBY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qnnyy1BfNKaqUvETjIi4p5NfpLBx4Lc48uDReAvj2HLmySIZbG2nhlHxPgi5UXpXT h0BkGzxBOLsUe+CZnG/X9m2FvxnJNmoZ4qg698lp1NYy0K1/VY5e3KSQ1AhtC/Ctfd PnbAYAeJtwHMRQtRskFTgqMM/HYaqZDhSIkBL9oc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.4 108/114] dmaengine: at_xdmac: Dont start transactions at tx_submit level Date: Mon, 24 Jan 2022 19:43:23 +0100 Message-Id: <20220124183930.439839274@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit bccfb96b59179d4f96cbbd1ddff8fac6d335eae4 upstream. tx_submit is supposed to push the current transaction descriptor to a pending queue, waiting for issue_pending() to be called. issue_pending() must start the transfer, not tx_submit(), thus remove at_xdmac_start_xfer() from at_xdmac_tx_submit(). Clients of at_xdmac that assume that tx_submit() starts the transfer must be updated and call dma_async_issue_pending() if they miss to call it (one example is atmel_serial). As the at_xdmac_start_xfer() is now called only from at_xdmac_advance_work() when !at_xdmac_chan_is_enabled(), the at_xdmac_chan_is_enabled() check is no longer needed in at_xdmac_start_xfer(), thus remove it. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended D= MA Controller driver") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-2-tudor.ambarus@micro= chip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/dma/at_xdmac.c | 6 ------ 1 file changed, 6 deletions(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -345,9 +345,6 @@ static void at_xdmac_start_xfer(struct a =20 dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, first); =20 - if (at_xdmac_chan_is_enabled(atchan)) - return; - /* Set transfer as active to not try to start it again. */ first->active_xfer =3D true; =20 @@ -431,9 +428,6 @@ static dma_cookie_t at_xdmac_tx_submit(s dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_lis= t\n", __func__, atchan, desc); list_add_tail(&desc->xfer_node, &atchan->xfers_list); - if (list_is_singular(&atchan->xfers_list)) - at_xdmac_start_xfer(atchan, desc); - spin_unlock_irqrestore(&atchan->lock, irqflags); return cookie; } From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9FF8C43219 for ; Mon, 24 Jan 2022 18:57:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343863AbiAXS5O (ORCPT ); Mon, 24 Jan 2022 13:57:14 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52318 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343851AbiAXSxe (ORCPT ); Mon, 24 Jan 2022 13:53:34 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4242EB8121F; Mon, 24 Jan 2022 18:53:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6BAF5C340E7; Mon, 24 Jan 2022 18:53:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050412; bh=28gUiN8z0/7XjkyiXCAPk6JN17+wymAYbKOfXAnxsLg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j6R1T9vuCcwGxMlxBJmYjIC2pvG2IuP5MLYd8G87rB5t83ZHf4y9HkuoJqnqwXuvW l9cGUFXFAC0xmwiYjOLgH2OiY7h2W7tdTLfCL0zukkbj+diSKxu0KmYFQc48rMiqnv 3nHG+kbJyHkqdQeG6PHKRAgqyQXmEG52DF3HOsfA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.4 109/114] dmaengine: at_xdmac: Print debug message after realeasing the lock Date: Mon, 24 Jan 2022 19:43:24 +0100 Message-Id: <20220124183930.469406895@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit 5edc24ac876a928f36f407a0fcdb33b94a3a210f upstream. It is desirable to do the prints without the lock held if possible, so move the print after the lock is released. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended D= MA Controller driver") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-4-tudor.ambarus@micro= chip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/dma/at_xdmac.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -425,10 +425,12 @@ static dma_cookie_t at_xdmac_tx_submit(s spin_lock_irqsave(&atchan->lock, irqflags); cookie =3D dma_cookie_assign(tx); =20 - dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_lis= t\n", - __func__, atchan, desc); list_add_tail(&desc->xfer_node, &atchan->xfers_list); spin_unlock_irqrestore(&atchan->lock, irqflags); + + dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_lis= t\n", + __func__, atchan, desc); + return cookie; } =20 From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E78C8C433FE for ; Mon, 24 Jan 2022 18:58:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344278AbiAXS6Z (ORCPT ); Mon, 24 Jan 2022 13:58:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43290 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344530AbiAXSyq (ORCPT ); Mon, 24 Jan 2022 13:54:46 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0EA8CC061394; Mon, 24 Jan 2022 10:53:36 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A087C614E3; Mon, 24 Jan 2022 18:53:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E806C340EC; Mon, 24 Jan 2022 18:53:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050415; bh=5Xvu8d/C0wWF0Z0O/hZRvCFnTmXcuejuftS0FbGyOM4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=locq8A0qfIrk5HT/7iFzihBrJD0g1h6ocwlw7Ud5eeQUJ1kk3kwW1BUOgi/eu3u17 X06mdOYjDOOXHvAxzCfRBNo0j9hARfzXGBPTPcvCTBJVMCtAQn5OWz53X7IGC0zfmm EMb7JEpCRqmMGVSasLbOaWrhAQgq8p55TXkXcTq8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.4 110/114] dmaengine: at_xdmac: Fix lld view setting Date: Mon, 24 Jan 2022 19:43:25 +0100 Message-Id: <20220124183930.501498125@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit 1385eb4d14d447cc5d744bc2ac34f43be66c9963 upstream. AT_XDMAC_CNDC_NDVIEW_NDV3 was set even for AT_XDMAC_MBR_UBC_NDV2, because of the wrong bit handling. Fix it. Fixes: ee0fe35c8dcd ("dmaengine: xdmac: Handle descriptor's view 3 register= s") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-10-tudor.ambarus@micr= ochip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/dma/at_xdmac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -100,6 +100,7 @@ #define AT_XDMAC_CNDC_NDE (0x1 << 0) /* Channel x Next Descriptor Enabl= e */ #define AT_XDMAC_CNDC_NDSUP (0x1 << 1) /* Channel x Next Descriptor Sou= rce Update */ #define AT_XDMAC_CNDC_NDDUP (0x1 << 2) /* Channel x Next Descriptor Des= tination Update */ +#define AT_XDMAC_CNDC_NDVIEW_MASK GENMASK(28, 27) #define AT_XDMAC_CNDC_NDVIEW_NDV0 (0x0 << 3) /* Channel x Next Descripto= r View 0 */ #define AT_XDMAC_CNDC_NDVIEW_NDV1 (0x1 << 3) /* Channel x Next Descripto= r View 1 */ #define AT_XDMAC_CNDC_NDVIEW_NDV2 (0x2 << 3) /* Channel x Next Descripto= r View 2 */ @@ -360,7 +361,8 @@ static void at_xdmac_start_xfer(struct a */ if (at_xdmac_chan_is_cyclic(atchan)) reg =3D AT_XDMAC_CNDC_NDVIEW_NDV1; - else if (first->lld.mbr_ubc & AT_XDMAC_MBR_UBC_NDV3) + else if ((first->lld.mbr_ubc & + AT_XDMAC_CNDC_NDVIEW_MASK) =3D=3D AT_XDMAC_MBR_UBC_NDV3) reg =3D AT_XDMAC_CNDC_NDVIEW_NDV3; else reg =3D AT_XDMAC_CNDC_NDVIEW_NDV2; From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78130C433EF for ; Mon, 24 Jan 2022 18:58:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344545AbiAXS55 (ORCPT ); Mon, 24 Jan 2022 13:57:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44094 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344555AbiAXSyr (ORCPT ); Mon, 24 Jan 2022 13:54:47 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 66EBCC061348; Mon, 24 Jan 2022 10:53:39 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 069CB61507; Mon, 24 Jan 2022 18:53:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ADA99C340E5; Mon, 24 Jan 2022 18:53:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050418; bh=/5CAYepTBiNKnuaUxeDRApQltX0ss9gMvwPaaxbIzC0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S38W0PBxPryzO+sycbJXNS6y6OzUus4F9ZvKw7q14zFa9XAKl8JlIjPwED9mHNFqP ESjUG8i0fCfKJs9yeFpVPXoyv9+nW3LpceRSVJhetC43is53fvQf5Z7IA/Oa2tkZQd Llmj7FUTvjYQLMcrCnFK4TUzbKt7ffl9+AVEJXQY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.4 111/114] dmaengine: at_xdmac: Fix at_xdmac_lld struct definition Date: Mon, 24 Jan 2022 19:43:26 +0100 Message-Id: <20220124183930.530893189@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit 912f7c6f7fac273f40e621447cf17d14b50d6e5b upstream. The hardware channel next descriptor view structure contains just fields of 32 bits, while dma_addr_t can be of type u64 or u32 depending on CONFIG_ARCH_DMA_ADDR_T_64BIT. Force u32 to comply with what the hardware expects. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended D= MA Controller driver") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-11-tudor.ambarus@micr= ochip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/dma/at_xdmac.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -233,15 +233,15 @@ struct at_xdmac { =20 /* Linked List Descriptor */ struct at_xdmac_lld { - dma_addr_t mbr_nda; /* Next Descriptor Member */ - u32 mbr_ubc; /* Microblock Control Member */ - dma_addr_t mbr_sa; /* Source Address Member */ - dma_addr_t mbr_da; /* Destination Address Member */ - u32 mbr_cfg; /* Configuration Register */ - u32 mbr_bc; /* Block Control Register */ - u32 mbr_ds; /* Data Stride Register */ - u32 mbr_sus; /* Source Microblock Stride Register */ - u32 mbr_dus; /* Destination Microblock Stride Register */ + u32 mbr_nda; /* Next Descriptor Member */ + u32 mbr_ubc; /* Microblock Control Member */ + u32 mbr_sa; /* Source Address Member */ + u32 mbr_da; /* Destination Address Member */ + u32 mbr_cfg; /* Configuration Register */ + u32 mbr_bc; /* Block Control Register */ + u32 mbr_ds; /* Data Stride Register */ + u32 mbr_sus; /* Source Microblock Stride Register */ + u32 mbr_dus; /* Destination Microblock Stride Register */ }; =20 /* 64-bit alignment needed to update CNDA and CUBC registers in an atomic = way. */ From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24144C433EF for ; Mon, 24 Jan 2022 18:55:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242605AbiAXSzv (ORCPT ); Mon, 24 Jan 2022 13:55:51 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:52854 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343868AbiAXSxm (ORCPT ); Mon, 24 Jan 2022 13:53:42 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2E5EA61509; Mon, 24 Jan 2022 18:53:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC0A3C340E8; Mon, 24 Jan 2022 18:53:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050421; bh=Hy+ui+Jr/K4eBMHQYquo8g8R0kY5wd2sQfzD1NdsSPo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SxI2SX0gZnQakCvxUjNMYqQR3VKczvV0nm95HJqHEe6xXVVMUFaONumKeaZMGviCL sbzf6M92l0zzkVCFZm/v6R22naHsud+u9bHc19dErcb77dsbiMmlFT95OWdOMuK9mw xrt1FWaCYWKXMfWwYYKNQcKlMqoRtNIGAsGBspEw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kevin Bracey , Eric Dumazet , Jiri Pirko , Vimalkumar , Jakub Kicinski Subject: [PATCH 4.4 112/114] net_sched: restore "mpu xxx" handling Date: Mon, 24 Jan 2022 19:43:27 +0100 Message-Id: <20220124183930.559884856@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kevin Bracey commit fb80445c438c78b40b547d12b8d56596ce4ccfeb upstream. commit 56b765b79e9a ("htb: improved accuracy at high rates") broke "overhead X", "linklayer atm" and "mpu X" attributes. "overhead X" and "linklayer atm" have already been fixed. This restores the "mpu X" handling, as might be used by DOCSIS or Ethernet shaping: tc class add ... htb rate X overhead 4 mpu 64 The code being fixed is used by htb, tbf and act_police. Cake has its own mpu handling. qdisc_calculate_pkt_len still uses the size table containing values adjusted for mpu by user space. iproute2 tc has always passed mpu into the kernel via a tc_ratespec structure, but the kernel never directly acted on it, merely stored it so that it could be read back by `tc class show`. Rather, tc would generate length-to-time tables that included the mpu (and linklayer) in their construction, and the kernel used those tables. Since v3.7, the tables were no longer used. Along with "mpu", this also broke "overhead" and "linklayer" which were fixed in 01cb71d2d47b ("net_sched: restore "overhead xxx" handling", v3.10) and 8a8e3d84b171 ("net_sched: restore "linklayer atm" handling", v3.11). "overhead" was fixed by simply restoring use of tc_ratespec::overhead - this had originally been used by the kernel but was initially omitted from the new non-table-based calculations. "linklayer" had been handled in the table like "mpu", but the mode was not originally passed in tc_ratespec. The new implementation was made to handle it by getting new versions of tc to pass the mode in an extended tc_ratespec, and for older versions of tc the table contents were analysed at load time to deduce linklayer. As "mpu" has always been given to the kernel in tc_ratespec, accompanying the mpu-based table, we can restore system functionality with no userspace change by making the kernel act on the tc_ratespec value. Fixes: 56b765b79e9a ("htb: improved accuracy at high rates") Signed-off-by: Kevin Bracey Cc: Eric Dumazet Cc: Jiri Pirko Cc: Vimalkumar Link: https://lore.kernel.org/r/20220112170210.1014351-1-kevin@bracey.fi Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- include/net/sch_generic.h | 5 +++++ net/sched/sch_generic.c | 1 + 2 files changed, 6 insertions(+) --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -797,6 +797,7 @@ struct psched_ratecfg { u64 rate_bytes_ps; /* bytes per second */ u32 mult; u16 overhead; + u16 mpu; u8 linklayer; u8 shift; }; @@ -806,6 +807,9 @@ static inline u64 psched_l2t_ns(const st { len +=3D r->overhead; =20 + if (len < r->mpu) + len =3D r->mpu; + if (unlikely(r->linklayer =3D=3D TC_LINKLAYER_ATM)) return ((u64)(DIV_ROUND_UP(len,48)*53) * r->mult) >> r->shift; =20 @@ -828,6 +832,7 @@ static inline void psched_ratecfg_getrat res->rate =3D min_t(u64, r->rate_bytes_ps, ~0U); =20 res->overhead =3D r->overhead; + res->mpu =3D r->mpu; res->linklayer =3D (r->linklayer & TC_LINKLAYER_MASK); } =20 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -966,6 +966,7 @@ void psched_ratecfg_precompute(struct ps { memset(r, 0, sizeof(*r)); r->overhead =3D conf->overhead; + r->mpu =3D conf->mpu; r->rate_bytes_ps =3D max_t(u64, conf->rate, rate64); r->linklayer =3D (conf->linklayer & TC_LINKLAYER_MASK); r->mult =3D 1; From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 351ABC433F5 for ; Mon, 24 Jan 2022 18:57:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343968AbiAXS5o (ORCPT ); Mon, 24 Jan 2022 13:57:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44136 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344628AbiAXSyz (ORCPT ); Mon, 24 Jan 2022 13:54:55 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A6EF8C061365; Mon, 24 Jan 2022 10:53:45 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4805161507; Mon, 24 Jan 2022 18:53:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1C909C340E8; Mon, 24 Jan 2022 18:53:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050424; bh=XyB6tBQRGSlyvJTRw3bhsJ6pQSHWxE71MEwmOka4C64=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ztXXCONDJxHbAz0xjaZNkOICZr16176JPpD3IFaTvSPMSxR0Ckd26+D5n8R4YBWC4 myjeTNnfrHqtt0mixhgrsFaC423AHurWiGEhQFnhqLm90N/1nVAa/2xA8vHUBAhiBi 5ph3ev9WCgYxa2tm8Gdo9um2VWsvpfiTKN/Oa0d8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Florian Fainelli , "David S. Miller" Subject: [PATCH 4.4 113/114] bcmgenet: add WOL IRQ check Date: Mon, 24 Jan 2022 19:43:28 +0100 Message-Id: <20220124183930.591414342@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sergey Shtylyov commit 9deb48b53e7f4056c2eaa2dc2ee3338df619e4f6 upstream. The driver neglects to check the result of platform_get_irq_optional()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL. Stop calling devm_request_irq() with the invalid IRQ #s. Fixes: 8562056f267d ("net: bcmgenet: request Wake-on-LAN interrupt") Signed-off-by: Sergey Shtylyov Acked-by: Florian Fainelli Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -3443,10 +3443,12 @@ static int bcmgenet_probe(struct platfor =20 /* Request the WOL interrupt and advertise suspend if available */ priv->wol_irq_disabled =3D true; - err =3D devm_request_irq(&pdev->dev, priv->wol_irq, bcmgenet_wol_isr, 0, - dev->name, priv); - if (!err) - device_set_wakeup_capable(&pdev->dev, 1); + if (priv->wol_irq > 0) { + err =3D devm_request_irq(&pdev->dev, priv->wol_irq, + bcmgenet_wol_isr, 0, dev->name, priv); + if (!err) + device_set_wakeup_capable(&pdev->dev, 1); + } =20 /* Set the needed headroom to account for any possible * features enabling/disabling at runtime From nobody Tue Jun 30 05:22:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4F21C433F5 for ; Mon, 24 Jan 2022 18:57:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344411AbiAXS5Y (ORCPT ); Mon, 24 Jan 2022 13:57:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43088 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344726AbiAXSzJ (ORCPT ); Mon, 24 Jan 2022 13:55:09 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 381E6C06136D; Mon, 24 Jan 2022 10:53:52 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CCA3261527; Mon, 24 Jan 2022 18:53:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 904D2C340E5; Mon, 24 Jan 2022 18:53:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050431; bh=/WuAenPvtHoOYxe2cLjzMTFFnpRHp7Hh7oLwX6A9/98=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KC4CRU6wn+N4qqHAqGWYnjWMWWOhuWAySACWXbqjzXkrmnv4uA9plpsVgJSj1gy0S BBbAh0cd2PWglu/qL9Qsf0GQpDQl2KNF5ZRd3QQnbrnDf9UuKcvQNr1Uj37iSipBfz q5hxvoZBATTv/QY+8EOt8venHZUh21y95WCddMeY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , "David S. Miller" Subject: [PATCH 4.4 114/114] lib82596: Fix IRQ check in sni_82596_probe Date: Mon, 24 Jan 2022 19:43:29 +0100 Message-Id: <20220124183930.620954574@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183927.095545464@linuxfoundation.org> References: <20220124183927.095545464@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin commit 99218cbf81bf21355a3de61cd46a706d36e900e6 upstream. platform_get_irq() returns negative error number instead 0 on failure. And the doc of platform_get_irq() provides a usage example: int irq =3D platform_get_irq(pdev, 0); if (irq < 0) return irq; Fix the check of return value to catch errors correctly. Fixes: 115978859272 ("i825xx: Move the Intel 82586/82593/82596 based driver= s") Signed-off-by: Miaoqian Lin Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) = =20 Tested-by: Shuah Khan --- drivers/net/ethernet/i825xx/sni_82596.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/i825xx/sni_82596.c +++ b/drivers/net/ethernet/i825xx/sni_82596.c @@ -122,9 +122,10 @@ static int sni_82596_probe(struct platfo netdevice->dev_addr[5] =3D readb(eth_addr + 0x06); iounmap(eth_addr); =20 - if (!netdevice->irq) { + if (netdevice->irq < 0) { printk(KERN_ERR "%s: IRQ not found for i82596 at 0x%lx\n", __FILE__, netdevice->base_addr); + retval =3D netdevice->irq; goto probe_failed; } =20