From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5BFB7C433EF for ; Mon, 24 Jan 2022 18:56:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245638AbiAXS4U (ORCPT ); Mon, 24 Jan 2022 13:56:20 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:53486 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245340AbiAXSyR (ORCPT ); Mon, 24 Jan 2022 13:54:17 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 01E0461527; Mon, 24 Jan 2022 18:54:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CAA68C36AF7; Mon, 24 Jan 2022 18:54:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050456; bh=CBPENbkco7iWTiGBptNuAshMijpXyfLZVEct9/ZpMIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=l7QRquwEqiVPF6369KP6Xxyjs3aQtSTTTo69uiUsHLuiZeVSqQ4sehOR5oFZ+piAm Tnf4y2Xi9/7f9ZB+qlsqlCG2XRwn8jxfz1i4SnKjtkzfqRqpFweIJd14DYJtZ8fdV6 I1IKFHHzdfUYH94Duo3WcpSiMltPkV3xgXhmpXq8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Marcel Holtmann Subject: [PATCH 4.9 001/157] Bluetooth: bfusb: fix division by zero in send path Date: Mon, 24 Jan 2022 19:41:31 +0100 Message-Id: <20220124183932.834484960@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit b5e6fa7a12572c82f1e7f2f51fbb02a322291291 upstream. Add the missing bulk-out endpoint sanity check to probe() to avoid division by zero in bfusb_send_frame() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=3D0")). Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/bluetooth/bfusb.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/bluetooth/bfusb.c +++ b/drivers/bluetooth/bfusb.c @@ -644,6 +644,9 @@ static int bfusb_probe(struct usb_interf data->bulk_out_ep =3D bulk_out_ep->desc.bEndpointAddress; data->bulk_pkt_size =3D le16_to_cpu(bulk_out_ep->desc.wMaxPacketSize); =20 + if (!data->bulk_pkt_size) + goto done; + rwlock_init(&data->lock); =20 data->reassembly =3D NULL; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82AA5C433FE for ; Mon, 24 Jan 2022 18:56:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343947AbiAXS4f (ORCPT ); Mon, 24 Jan 2022 13:56:35 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:50600 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344315AbiAXSyU (ORCPT ); Mon, 24 Jan 2022 13:54:20 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1D53F614E5; Mon, 24 Jan 2022 18:54:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E2427C340E5; Mon, 24 Jan 2022 18:54:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050459; bh=T8JLmq3cdGe2ZkGZz6n3ygpv8WuAWbfj3Wcv7M1rBR4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XbkbAmj0LSv6kvkCelSekiTxOi8EI6z3SydD/IJiFuUoRGY++O5HBQfUUzXAMhb01 p3yim28LI1BSmbbzc0Bj1NJuy5PiUMZ+7BA6ZtZurzm0fnopNqKbdRWQhsoLu8TQKi sA9XCVnpLsnipXB5Y+7zrmqZtl2mQ5O9g9M5XRhA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan McDowell , Alan Stern Subject: [PATCH 4.9 002/157] USB: core: Fix bug in resuming hubs handling of wakeup requests Date: Mon, 24 Jan 2022 19:41:32 +0100 Message-Id: <20220124183932.864573637@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 0f663729bb4afc92a9986b66131ebd5b8a9254d1 upstream. Bugzilla #213839 reports a 7-port hub that doesn't work properly when devices are plugged into some of the ports; the kernel goes into an unending disconnect/reinitialize loop as shown in the bug report. This "7-port hub" comprises two four-port hubs with one plugged into the other; the failures occur when a device is plugged into one of the downstream hub's ports. (These hubs have other problems too. For example, they bill themselves as USB-2.0 compliant but they only run at full speed.) It turns out that the failures are caused by bugs in both the kernel and the hub. The hub's bug is that it reports a different bmAttributes value in its configuration descriptor following a remote wakeup (0xe0 before, 0xc0 after -- the wakeup-support bit has changed). The kernel's bug is inside the hub driver's resume handler. When hub_activate() sees that one of the hub's downstream ports got a wakeup request from a child device, it notes this fact by setting the corresponding bit in the hub->change_bits variable. But this variable is meant for connection changes, not wakeup events; setting it causes the driver to believe the downstream port has been disconnected and then connected again (in addition to having received a wakeup request). Because of this, the hub driver then tries to check whether the device currently plugged into the downstream port is the same as the device that had been attached there before. Normally this check succeeds and wakeup handling continues with no harm done (which is why the bug remained undetected until now). But with these dodgy hubs, the check fails because the config descriptor has changed. This causes the hub driver to reinitialize the child device, leading to the disconnect/reinitialize loop described in the bug report. The proper way to note reception of a downstream wakeup request is to set a bit in the hub->event_bits variable instead of hub->change_bits. That way the hub driver will realize that something has happened to the port but will not think the port and child device have been disconnected. This patch makes that change. Cc: Tested-by: Jonathan McDowell Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YdCw7nSfWYPKWQoD@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/usb/core/hub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1185,7 +1185,7 @@ static void hub_activate(struct usb_hub */ if (portchange || (hub_is_superspeed(hub->hdev) && port_resumed)) - set_bit(port1, hub->change_bits); + set_bit(port1, hub->event_bits); =20 } else if (udev->persist_enabled) { #ifdef CONFIG_PM From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E6B20C433F5 for ; Mon, 24 Jan 2022 18:56:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344288AbiAXS4m (ORCPT ); Mon, 24 Jan 2022 13:56:42 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52874 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245382AbiAXSyZ (ORCPT ); Mon, 24 Jan 2022 13:54:25 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 10AD7B8119D; Mon, 24 Jan 2022 18:54:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3131BC36AE9; Mon, 24 Jan 2022 18:54:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050462; bh=Io2+Uf8iX62ifCS4sfF36cL/eq/TWFhVD839P/VDRqc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0+e9wmMIAxd94xnokeCnJmhI1LQXwZirPhJO8WyBq5NU9W9Ap5KxUo8x3iC3fCWKG z8RVAC5iSrKllyi87hRn0rJFAZckrcgsqUVNW4U3JIG96+xN92uN5MsCpo+TMfXPkz i28JgePGUjmbGAywtjeqIjvhNSemrMievtzTf6AE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , syzbot+3ae6a2b06f131ab9849f@syzkaller.appspotmail.com Subject: [PATCH 4.9 003/157] USB: Fix "slab-out-of-bounds Write" bug in usb_hcd_poll_rh_status Date: Mon, 24 Jan 2022 19:41:33 +0100 Message-Id: <20220124183932.896149282@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 1d7d4c07932e04355d6e6528d44a2f2c9e354346 upstream. When the USB core code for getting root-hub status reports was originally written, it was assumed that the hub driver would be its only caller. But this isn't true now; user programs can use usbfs to communicate with root hubs and get status reports. When they do this, they may use a transfer_buffer that is smaller than the data returned by the HCD, which will lead to a buffer overflow error when usb_hcd_poll_rh_status() tries to store the status data. This was discovered by syzbot: BUG: KASAN: slab-out-of-bounds in memcpy include/linux/fortify-string.h:225= [inline] BUG: KASAN: slab-out-of-bounds in usb_hcd_poll_rh_status+0x5f4/0x780 driver= s/usb/core/hcd.c:776 Write of size 2 at addr ffff88801da403c0 by task syz-executor133/4062 This patch fixes the bug by reducing the amount of status data if it won't fit in the transfer_buffer. If some data gets discarded then the URB's completion status is set to -EOVERFLOW rather than 0, to let the user know what happened. Reported-and-tested-by: syzbot+3ae6a2b06f131ab9849f@syzkaller.appspotmail.c= om Signed-off-by: Alan Stern Cc: Link: https://lore.kernel.org/r/Yc+3UIQJ2STbxNua@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/usb/core/hcd.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -760,6 +760,7 @@ void usb_hcd_poll_rh_status(struct usb_h { struct urb *urb; int length; + int status; unsigned long flags; char buffer[6]; /* Any root hubs with > 31 ports? */ =20 @@ -777,11 +778,17 @@ void usb_hcd_poll_rh_status(struct usb_h if (urb) { clear_bit(HCD_FLAG_POLL_PENDING, &hcd->flags); hcd->status_urb =3D NULL; + if (urb->transfer_buffer_length >=3D length) { + status =3D 0; + } else { + status =3D -EOVERFLOW; + length =3D urb->transfer_buffer_length; + } urb->actual_length =3D length; memcpy(urb->transfer_buffer, buffer, length); =20 usb_hcd_unlink_urb_from_ep(hcd, urb); - usb_hcd_giveback_urb(hcd, urb, 0); + usb_hcd_giveback_urb(hcd, urb, status); } else { length =3D 0; set_bit(HCD_FLAG_POLL_PENDING, &hcd->flags); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9311C43217 for ; Mon, 24 Jan 2022 18:59:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344781AbiAXS7M (ORCPT ); Mon, 24 Jan 2022 13:59:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44632 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344454AbiAXS4z (ORCPT ); Mon, 24 Jan 2022 13:56:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 543D5C0612A8; Mon, 24 Jan 2022 10:54:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1C9B1B81235; Mon, 24 Jan 2022 18:54:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 48701C340E7; Mon, 24 Jan 2022 18:54:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050465; bh=qcG9Tun+JuSkYfdP86U9ugYq/gIq4GAX/x3IPX3Gbxc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zIxHNwcdFFfZEHxHO9sOhb4NHwSd8rCRPqJDX3INiA52N6U76BH2JQfRWqFcRY5OU tdB7f0gQhwlwwvkX1Ipjb3LIql8Df8hQwBboA12+EB/3efUmYoFJLZMk1o0MDxYoda dr/Wd1svBy6lQzMmmXOU7GNhdk6MW90+bbglNHlQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Orlando Chamberlain , Aditya Garg , Andy Shevchenko , Lee Jones Subject: [PATCH 4.9 004/157] mfd: intel-lpss: Fix too early PM enablement in the ACPI ->probe() Date: Mon, 24 Jan 2022 19:41:34 +0100 Message-Id: <20220124183932.926947993@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andy Shevchenko commit c9e143084d1a602f829115612e1ec79df3727c8b upstream. The runtime PM callback may be called as soon as the runtime PM facility is enabled and activated. It means that ->suspend() may be called before we finish probing the device in the ACPI case. Hence, NULL pointer dereference: intel-lpss INT34BA:00: IRQ index 0 not found BUG: kernel NULL pointer dereference, address: 0000000000000030 ... Workqueue: pm pm_runtime_work RIP: 0010:intel_lpss_suspend+0xb/0x40 [intel_lpss] To fix this, first try to register the device and only after that enable runtime PM facility. Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices") Reported-by: Orlando Chamberlain Reported-by: Aditya Garg Signed-off-by: Andy Shevchenko Tested-by: Aditya Garg Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20211101190008.86473-1-andriy.shevchenko@li= nux.intel.com Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/mfd/intel-lpss-acpi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/mfd/intel-lpss-acpi.c +++ b/drivers/mfd/intel-lpss-acpi.c @@ -84,6 +84,7 @@ static int intel_lpss_acpi_probe(struct { struct intel_lpss_platform_info *info; const struct acpi_device_id *id; + int ret; =20 id =3D acpi_match_device(intel_lpss_acpi_ids, &pdev->dev); if (!id) @@ -97,10 +98,14 @@ static int intel_lpss_acpi_probe(struct info->mem =3D platform_get_resource(pdev, IORESOURCE_MEM, 0); info->irq =3D platform_get_irq(pdev, 0); =20 + ret =3D intel_lpss_probe(&pdev->dev, info); + if (ret) + return ret; + pm_runtime_set_active(&pdev->dev); pm_runtime_enable(&pdev->dev); =20 - return intel_lpss_probe(&pdev->dev, info); + return 0; } =20 static int intel_lpss_acpi_remove(struct platform_device *pdev) From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CC8D3C4167E for ; Mon, 24 Jan 2022 19:01:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345102AbiAXS7t (ORCPT ); Mon, 24 Jan 2022 13:59:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44628 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344502AbiAXS4z (ORCPT ); Mon, 24 Jan 2022 13:56:55 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 177ACC0612A9; Mon, 24 Jan 2022 10:54:30 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AD2EB614C9; Mon, 24 Jan 2022 18:54:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 73C64C340E5; Mon, 24 Jan 2022 18:54:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050469; bh=6tmTeqTNP3KBX1hcRrZiqO7BaY+kpbpNKJCvnuGuh6c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XIkgAJ7frEyXAlx1PnY7TFiw3aQJv8Im+HB/nEce2CFxS/RvkCpb6bAgljwMrsqBY YOYv3ZyFi1NDGnr4n273EP5R8nnBIZMBhhJWBEj8CQxVSg/GPbL9/pexzDRMCyHfS0 7XGgNkpzO265Z3/f97s8MUTp5cVihcBPCxqpH2l0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Kleine-Budde Subject: [PATCH 4.9 005/157] can: gs_usb: fix use of uninitialized variable, detach device on reception of invalid USB data Date: Mon, 24 Jan 2022 19:41:35 +0100 Message-Id: <20220124183932.959124093@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marc Kleine-Budde commit 4a8737ff068724f509d583fef404d349adba80d6 upstream. The received data contains the channel the received data is associated with. If the channel number is bigger than the actual number of channels assume broken or malicious USB device and shut it down. This fixes the error found by clang: | drivers/net/can/usb/gs_usb.c:386:6: error: variable 'dev' is used | uninitialized whenever 'if' condition= is true | if (hf->channel >=3D GS_MAX_INTF) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ | drivers/net/can/usb/gs_usb.c:474:10: note: uninitialized use occurs here | hf, dev->gs_hf_size, gs_usb_receive_bulk_callba= ck, | ^~~ Link: https://lore.kernel.org/all/20211210091158.408326-1-mkl@pengutronix.de Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices= ") Cc: stable@vger.kernel.org Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/can/usb/gs_usb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -328,7 +328,7 @@ static void gs_usb_receive_bulk_callback =20 /* device reports out of range channel id */ if (hf->channel >=3D GS_MAX_INTF) - goto resubmit_urb; + goto device_detach; =20 dev =3D usbcan->canch[hf->channel]; =20 @@ -413,6 +413,7 @@ static void gs_usb_receive_bulk_callback =20 /* USB failure take down all interfaces */ if (rc =3D=3D -ENODEV) { + device_detach: for (rc =3D 0; rc < GS_MAX_INTF; rc++) { if (usbcan->canch[rc]) netif_device_detach(usbcan->canch[rc]->netdev); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5CD07C433FE for ; Mon, 24 Jan 2022 18:58:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343921AbiAXS6e (ORCPT ); Mon, 24 Jan 2022 13:58:34 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:54730 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242005AbiAXS40 (ORCPT ); Mon, 24 Jan 2022 13:56:26 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F1180B8121F; Mon, 24 Jan 2022 18:56:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 28248C340E5; Mon, 24 Jan 2022 18:56:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050583; bh=28t1sweoB4qHEe4T76xab8j4fhECdC4c7ySIQE2cgDk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GaiUig8efS81yFkK8fBJJuG377O1NOHG8BrG4Q78OzBJpGi/nVp8+j3PEYH8zzQz0 50oPYl1w3n1GXkZpZXrc4ip5rOuQ2WRhezTMGZb682qmULZPqe8nZ9/W6ehglSeFVm kP+j/I/JcXekOYOMyxBg3kNjP4Q0agr9aAhK23YE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brian Silverman , Marc Kleine-Budde Subject: [PATCH 4.9 006/157] can: gs_usb: gs_can_start_xmit(): zero-initialize hf->{flags,reserved} Date: Mon, 24 Jan 2022 19:41:36 +0100 Message-Id: <20220124183932.989219541@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Brian Silverman commit 89d58aebe14a365c25ba6645414afdbf4e41cea4 upstream. No information is deliberately sent in hf->flags in host -> device communications, but the open-source candleLight firmware echoes it back, which can result in the GS_CAN_FLAG_OVERFLOW flag being set and generating spurious ERRORFRAMEs. While there also initialize the reserved member with 0. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices= ") Link: https://lore.kernel.org/all/20220106002952.25883-1-brian.silverman@bl= uerivertech.com Link: https://github.com/candle-usb/candleLight_fw/issues/87 Cc: stable@vger.kernel.org Signed-off-by: Brian Silverman [mkl: initialize the reserved member, too] Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/can/usb/gs_usb.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -515,6 +515,8 @@ static netdev_tx_t gs_can_start_xmit(str =20 hf->echo_id =3D idx; hf->channel =3D dev->channel; + hf->flags =3D 0; + hf->reserved =3D 0; =20 cf =3D (struct can_frame *)skb->data; =20 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF6BFC43217 for ; Mon, 24 Jan 2022 19:01:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345123AbiAXS7u (ORCPT ); Mon, 24 Jan 2022 13:59:50 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44116 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344483AbiAXS4z (ORCPT ); Mon, 24 Jan 2022 13:56:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 84E13C0612B0; Mon, 24 Jan 2022 10:54:37 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2BFDBB810BD; Mon, 24 Jan 2022 18:54:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 51E5CC340E5; Mon, 24 Jan 2022 18:54:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050475; bh=bfcNSSSFgCqI3GxKVbE6LXuPeSyfon74j0nK3vab2lY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NSaQcZPxe2InvKodciSfmD/LECf8NWmeWmK03ZVCBp4DkPYsxk2GFAsqkjaLWeV+A vw0eL+wB4u7kZYbw1uAP56cLoQXomVHY8MFnydgi4zqBQ0hAL0CIRNMyMfj/r4Gs8T kHjmfcItt3uDN30nbDxGDNfLGK/rHUkPT1rQPzWY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Biggers , "Paul E. McKenney" , "Jason A. Donenfeld" Subject: [PATCH 4.9 007/157] random: fix data race on crng_node_pool Date: Mon, 24 Jan 2022 19:41:37 +0100 Message-Id: <20220124183933.019583375@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Biggers commit 5d73d1e320c3fd94ea15ba5f79301da9a8bcc7de upstream. extract_crng() and crng_backtrack_protect() load crng_node_pool with a plain load, which causes undefined behavior if do_numa_crng_init() modifies it concurrently. Fix this by using READ_ONCE(). Note: as per the previous discussion https://lore.kernel.org/lkml/20211219025139.31085-1-ebiggers@kernel.org/T/#= u, READ_ONCE() is believed to be sufficient here, and it was requested that it be used here instead of smp_load_acquire(). Also change do_numa_crng_init() to set crng_node_pool using cmpxchg_release() instead of mb() + cmpxchg(), as the former is sufficient here but is more lightweight. Fixes: 1e7f583af67b ("random: make /dev/urandom scalable for silly userspac= e programs") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Acked-by: Paul E. McKenney Signed-off-by: Jason A. Donenfeld Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/char/random.c | 42 ++++++++++++++++++++++-------------------- 1 file changed, 22 insertions(+), 20 deletions(-) --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -845,8 +845,8 @@ static void do_numa_crng_init(struct wor crng_initialize(crng); pool[i] =3D crng; } - mb(); - if (cmpxchg(&crng_node_pool, NULL, pool)) { + /* pairs with READ_ONCE() in select_crng() */ + if (cmpxchg_release(&crng_node_pool, NULL, pool) !=3D NULL) { for_each_node(i) kfree(pool[i]); kfree(pool); @@ -859,8 +859,26 @@ static void numa_crng_init(void) { schedule_work(&numa_crng_init_work); } + +static struct crng_state *select_crng(void) +{ + struct crng_state **pool; + int nid =3D numa_node_id(); + + /* pairs with cmpxchg_release() in do_numa_crng_init() */ + pool =3D READ_ONCE(crng_node_pool); + if (pool && pool[nid]) + return pool[nid]; + + return &primary_crng; +} #else static void numa_crng_init(void) {} + +static struct crng_state *select_crng(void) +{ + return &primary_crng; +} #endif =20 static void crng_reseed(struct crng_state *crng, struct entropy_store *r) @@ -945,15 +963,7 @@ static void _extract_crng(struct crng_st =20 static void extract_crng(__u8 out[CHACHA20_BLOCK_SIZE]) { - struct crng_state *crng =3D NULL; - -#ifdef CONFIG_NUMA - if (crng_node_pool) - crng =3D crng_node_pool[numa_node_id()]; - if (crng =3D=3D NULL) -#endif - crng =3D &primary_crng; - _extract_crng(crng, out); + _extract_crng(select_crng(), out); } =20 /* @@ -982,15 +992,7 @@ static void _crng_backtrack_protect(stru =20 static void crng_backtrack_protect(__u8 tmp[CHACHA20_BLOCK_SIZE], int used) { - struct crng_state *crng =3D NULL; - -#ifdef CONFIG_NUMA - if (crng_node_pool) - crng =3D crng_node_pool[numa_node_id()]; - if (crng =3D=3D NULL) -#endif - crng =3D &primary_crng; - _crng_backtrack_protect(crng, tmp, used); + _crng_backtrack_protect(select_crng(), tmp, used); } =20 static ssize_t extract_crng_user(void __user *buf, size_t nbytes) From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A2D0C433F5 for ; Mon, 24 Jan 2022 18:59:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344465AbiAXS71 (ORCPT ); Mon, 24 Jan 2022 13:59:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44174 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343568AbiAXS5F (ORCPT ); Mon, 24 Jan 2022 13:57:05 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 331D7C061759; Mon, 24 Jan 2022 10:55:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C702E61509; Mon, 24 Jan 2022 18:55:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9B2F4C340E5; Mon, 24 Jan 2022 18:55:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050511; bh=qAKyD/fvJ7v//yJ2hNYiXSdEGeERP8oQyMU7qc6xpG4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qj5r8VgBucjV9A9U5ciASlC0KsRaOkI172OpLnXETypxg2Q3ubMQqU/tWLkgPtUwD CpiQNE8VsdmIig8BBMxG36OR1SyH4jRnquHbr5FbMlXXLV3bWAU4ka67HXEF+Xbl3l 2WAuvZ7ovovcQxvubnEkqMtaKbxCZNTZqZm7kzjg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Biggers , "Paul E. McKenney" , "Jason A. Donenfeld" Subject: [PATCH 4.9 008/157] random: fix data race on crng init time Date: Mon, 24 Jan 2022 19:41:38 +0100 Message-Id: <20220124183933.050687345@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Biggers commit 009ba8568be497c640cab7571f7bfd18345d7b24 upstream. _extract_crng() does plain loads of crng->init_time and crng_global_init_time, which causes undefined behavior if crng_reseed() and RNDRESEEDCRNG modify these corrently. Use READ_ONCE() and WRITE_ONCE() to make the behavior defined. Don't fix the race on crng->init_time by protecting it with crng->lock, since it's not a problem for duplicate reseedings to occur. I.e., the lockless access with READ_ONCE() is fine. Fixes: d848e5f8e1eb ("random: add new ioctl RNDRESEEDCRNG") Fixes: e192be9d9a30 ("random: replace non-blocking pool with a Chacha20-bas= ed CRNG") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Acked-by: Paul E. McKenney Signed-off-by: Jason A. Donenfeld Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/char/random.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -908,7 +908,7 @@ static void crng_reseed(struct crng_stat crng->state[i+4] ^=3D buf.key[i] ^ rv; } memzero_explicit(&buf, sizeof(buf)); - crng->init_time =3D jiffies; + WRITE_ONCE(crng->init_time, jiffies); if (crng =3D=3D &primary_crng && crng_init < 2) { numa_crng_init(); crng_init =3D 2; @@ -946,12 +946,15 @@ static inline void crng_wait_ready(void) static void _extract_crng(struct crng_state *crng, __u8 out[CHACHA20_BLOCK_SIZE]) { - unsigned long v, flags; + unsigned long v, flags, init_time; =20 - if (crng_ready() && - (time_after(crng_global_init_time, crng->init_time) || - time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL))) - crng_reseed(crng, crng =3D=3D &primary_crng ? &input_pool : NULL); + if (crng_ready()) { + init_time =3D READ_ONCE(crng->init_time); + if (time_after(READ_ONCE(crng_global_init_time), init_time) || + time_after(jiffies, init_time + CRNG_RESEED_INTERVAL)) + crng_reseed(crng, crng =3D=3D &primary_crng ? + &input_pool : NULL); + } spin_lock_irqsave(&crng->lock, flags); if (arch_get_random_long(&v)) crng->state[14] ^=3D v; @@ -1916,7 +1919,7 @@ static long random_ioctl(struct file *f, if (crng_init < 2) return -ENODATA; crng_reseed(&primary_crng, &input_pool); - crng_global_init_time =3D jiffies - 1; + WRITE_ONCE(crng_global_init_time, jiffies - 1); return 0; default: return -EINVAL; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DDADAC433EF for ; Mon, 24 Jan 2022 18:58:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344576AbiAXS6F (ORCPT ); Mon, 24 Jan 2022 13:58:05 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:55008 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343565AbiAXSzs (ORCPT ); Mon, 24 Jan 2022 13:55:48 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5869861507; Mon, 24 Jan 2022 18:55:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 316A0C340EC; Mon, 24 Jan 2022 18:55:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050546; bh=UeIk/6h2m960zT2fJm51+GzcCIYPNCXiVBySTF5hzY8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2AjKMMA+BmdmCeH4zPPsRmJAKtUsYiH5piUi9rELtDLIQg3lxbQmjenfPE7B9Nlz5 NMrqzeuKZWk3q6JmkxJW6B3KFIp5l6lcf5JzKaJ2Ob80CzMv5bxtrK3EyWU8uzkZFj goyOGfodlJjwWtAlh5zlZT4TeZPs3CSKXr/iLPbg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor Subject: [PATCH 4.9 009/157] staging: wlan-ng: Avoid bitwise vs logical OR warning in hfa384x_usb_throttlefn() Date: Mon, 24 Jan 2022 19:41:39 +0100 Message-Id: <20220124183933.084840126@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nathan Chancellor commit 502408a61f4b7eb4713f44bd77f4a48e6cb1b59a upstream. A new warning in clang points out a place in this file where a bitwise OR is being used with boolean expressions: In file included from drivers/staging/wlan-ng/prism2usb.c:2: drivers/staging/wlan-ng/hfa384x_usb.c:3787:7: warning: use of bitwise '|' w= ith boolean operands [-Wbitwise-instead-of-logical] ((test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) && ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/staging/wlan-ng/hfa384x_usb.c:3787:7: note: cast one or both operan= ds to int to silence this warning 1 warning generated. The comment explains that short circuiting here is undesirable, as the calls to test_and_{clear,set}_bit() need to happen for both sides of the expression. Clang's suggestion would work to silence the warning but the readability of the expression would suffer even more. To clean up the warning and make the block more readable, use a variable for each side of the bitwise expression. Link: https://github.com/ClangBuiltLinux/linux/issues/1478 Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20211014215703.3705371-1-nathan@kernel.org Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/staging/wlan-ng/hfa384x_usb.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) --- a/drivers/staging/wlan-ng/hfa384x_usb.c +++ b/drivers/staging/wlan-ng/hfa384x_usb.c @@ -3848,18 +3848,18 @@ static void hfa384x_usb_throttlefn(unsig =20 spin_lock_irqsave(&hw->ctlxq.lock, flags); =20 - /* - * We need to check BOTH the RX and the TX throttle controls, - * so we use the bitwise OR instead of the logical OR. - */ pr_debug("flags=3D0x%lx\n", hw->usb_flags); - if (!hw->wlandev->hwremoved && - ((test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) && - !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags)) | - (test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) && - !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags)) - )) { - schedule_work(&hw->usb_work); + if (!hw->wlandev->hwremoved) { + bool rx_throttle =3D test_and_clear_bit(THROTTLE_RX, &hw->usb_flags) && + !test_and_set_bit(WORK_RX_RESUME, &hw->usb_flags); + bool tx_throttle =3D test_and_clear_bit(THROTTLE_TX, &hw->usb_flags) && + !test_and_set_bit(WORK_TX_RESUME, &hw->usb_flags); + /* + * We need to check BOTH the RX and the TX throttle controls, + * so we use the bitwise OR instead of the logical OR. + */ + if (rx_throttle | tx_throttle) + schedule_work(&hw->usb_work); } =20 spin_unlock_irqrestore(&hw->ctlxq.lock, flags); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99C80C433FE for ; Mon, 24 Jan 2022 19:02:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245548AbiAXTCv (ORCPT ); Mon, 24 Jan 2022 14:02:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44112 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344675AbiAXS6y (ORCPT ); Mon, 24 Jan 2022 13:58:54 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2238BC0613B0; Mon, 24 Jan 2022 10:56:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B58D161537; Mon, 24 Jan 2022 18:56:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 855B4C340E7; Mon, 24 Jan 2022 18:56:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050565; bh=4e2c9QG+xOFsS+hz96NS9KY9zF5wK4/cpjzUua0tK1o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ik2KZ1iis7RtIkhJPz2AOcM3B0twnC5ETw2w5YUcURGq1DtVARtmAZHzD2blJ7Gsx HKJ/wsf1koAlRWmstqTVnPDYzNZYNlEgFHzNx3NNdKyZczpiNuU3A8S/7yQIXxyKXg xDI8F0CPKyHWWAy7ubZfWZ7vbSL9mR8Rq7iyRMTg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nick Desaulniers , Nathan Chancellor , =?UTF-8?q?D=C3=A1vid=20Bolvansk=C3=BD?= , =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= Subject: [PATCH 4.9 010/157] drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() Date: Mon, 24 Jan 2022 19:41:40 +0100 Message-Id: <20220124183933.112710894@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Nathan Chancellor commit 2e70570656adfe1c5d9a29940faa348d5f132199 upstream. A new warning in clang points out a place in this file where a bitwise OR is being used with boolean types: drivers/gpu/drm/i915/intel_pm.c:3066:12: warning: use of bitwise '|' with b= oolean operands [-Wbitwise-instead-of-logical] changed =3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_late= ncy, 12) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~= ~~~~~~~~ This construct is intentional, as it allows every one of the calls to ilk_increase_wm_latency() to occur (instead of short circuiting with logical OR) while still caring about the result of each call. To make this clearer to the compiler, use the '|=3D' operator to assign the result of each ilk_increase_wm_latency() call to changed, which keeps the meaning of the code the same but makes it obvious that every one of these calls is expected to happen. Link: https://github.com/ClangBuiltLinux/linux/issues/1473 Reported-by: Nick Desaulniers Signed-off-by: Nathan Chancellor Suggested-by: D=C3=A1vid Bolvansk=C3=BD Reviewed-by: Nick Desaulniers Signed-off-by: Ville Syrj=C3=A4l=C3=A4 Link: https://patchwork.freedesktop.org/patch/msgid/20211014211916.3550122-= 1-nathan@kernel.org Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/gpu/drm/i915/intel_pm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/gpu/drm/i915/intel_pm.c +++ b/drivers/gpu/drm/i915/intel_pm.c @@ -2274,9 +2274,9 @@ static void snb_wm_latency_quirk(struct * The BIOS provided WM memory latency values are often * inadequate for high resolution displays. Adjust them. */ - changed =3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 1= 2) | - ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, 12) | - ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, 12); + changed =3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.pri_latency, 1= 2); + changed |=3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.spr_latency, = 12); + changed |=3D ilk_increase_wm_latency(dev_priv, dev_priv->wm.cur_latency, = 12); =20 if (!changed) return; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 94B9EC433F5 for ; Mon, 24 Jan 2022 19:02:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344522AbiAXTCx (ORCPT ); Mon, 24 Jan 2022 14:02:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44636 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344428AbiAXS6z (ORCPT ); Mon, 24 Jan 2022 13:58:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D11E2C061340; Mon, 24 Jan 2022 10:56:10 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8CD35B81235; Mon, 24 Jan 2022 18:56:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A75F5C340E5; Mon, 24 Jan 2022 18:56:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050568; bh=qJGO70c2a2ulGpa0+3IZx4+4uG78TZ2lXQht9kVfXc8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FNxuwaGZwxI80bsVBV3WUgS82GeD6igNUo69pb20wAb2zgZw1dEOWN9bdS9qJ45FV S2EMF9Ab5xKJt5DKPN9bP30bHbDpoQ5iOANqaVFObdU//6bM0pfCzbrZcpUCQiPhwU kqKZxxd9V3sBA5UvmrhH0CYciHaJf129+PD5P1H0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Kieran Bingham , Laurent Pinchart , Mauro Carvalho Chehab Subject: [PATCH 4.9 011/157] media: uvcvideo: fix division by zero at stream start Date: Mon, 24 Jan 2022 19:41:41 +0100 Message-Id: <20220124183933.144507896@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 8aa637bf6d70d2fb2ad4d708d8b9dd02b1c095df upstream. Add the missing bulk-endpoint max-packet sanity check to uvc_video_start_transfer() to avoid division by zero in uvc_alloc_urb_buffers() in case a malicious device has broken descriptors (or when doing descriptor fuzz testing). Note that USB core will reject URBs submitted for endpoints with zero wMaxPacketSize but that drivers doing packet-size calculations still need to handle this (cf. commit 2548288b4fb0 ("USB: Fix: Don't skip endpoint descriptors with maxpacket=3D0")). Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver") Cc: stable@vger.kernel.org # 2.6.26 Signed-off-by: Johan Hovold Reviewed-by: Kieran Bingham Signed-off-by: Laurent Pinchart Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/usb/uvc/uvc_video.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/media/usb/uvc/uvc_video.c +++ b/drivers/media/usb/uvc/uvc_video.c @@ -1716,6 +1716,10 @@ static int uvc_init_video(struct uvc_str if (ep =3D=3D NULL) return -EIO; =20 + /* Reject broken descriptors. */ + if (usb_endpoint_maxp(&ep->desc) =3D=3D 0) + return -EIO; + ret =3D uvc_init_video_bulk(stream, ep, gfp_flags); } =20 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 64954C433F5 for ; Mon, 24 Jan 2022 19:03:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344000AbiAXTDE (ORCPT ); Mon, 24 Jan 2022 14:03:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44638 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344678AbiAXS6z (ORCPT ); Mon, 24 Jan 2022 13:58:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE6C0C0612B2; Mon, 24 Jan 2022 10:56:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 933E1B81227; Mon, 24 Jan 2022 18:56:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B5E31C340E5; Mon, 24 Jan 2022 18:56:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050571; bh=szx3KHnAGqYPCIQSnKc2YO2cne5YMw4r5dPOGfee4w8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gDA3qoz1BCSoPeI7kQzY9xiO/MZKav2tbhtPnwK4mVJy0jld8g8oVWFZi8OkSKqMI EkcPNyxjNd3H8oD2CNPmFhSGEI0pfXBlxRbTJFZ/Dbfj2BcvQLcUMjd/RAfNS/e08z CfySvCJdHsUEQrJVHQYkz/t8Y9AUu27STFUrQq4M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+cce1ee31614c171f5595@syzkaller.appspotmail.com, Larry Finger , Kalle Valo Subject: [PATCH 4.9 012/157] rtlwifi: rtl8192cu: Fix WARNING when calling local_irq_restore() with interrupts enabled Date: Mon, 24 Jan 2022 19:41:42 +0100 Message-Id: <20220124183933.183700115@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Larry Finger commit 8b144dedb928e4e2f433a328d58f44c3c098d63e upstream. Syzbot reports the following WARNING: [200~raw_local_irq_restore() called with IRQs enabled WARNING: CPU: 1 PID: 1206 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x1d/0x20 kernel/locking/irqflag-debug.c:10 Hardware initialization for the rtl8188cu can run for as long as 350 ms, and the routine may be called with interrupts disabled. To avoid locking the machine for this long, the current routine saves the interrupt flags and enables local interrupts. The problem is that it restores the flags at the end without disabling local interrupts first. This patch fixes commit a53268be0cb9 ("rtlwifi: rtl8192cu: Fix too long disable of IRQs"). Reported-by: syzbot+cce1ee31614c171f5595@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Fixes: a53268be0cb9 ("rtlwifi: rtl8192cu: Fix too long disable of IRQs") Signed-off-by: Larry Finger Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20211215171105.20623-1-Larry.Finger@lwfinge= r.net Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/hw.c @@ -1037,6 +1037,7 @@ int rtl92cu_hw_init(struct ieee80211_hw _InitPABias(hw); rtl92c_dm_init(hw); exit: + local_irq_disable(); local_irq_restore(flags); return err; } From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26291C433EF for ; Mon, 24 Jan 2022 19:03:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343720AbiAXTDP (ORCPT ); Mon, 24 Jan 2022 14:03:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44664 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344710AbiAXS65 (ORCPT ); Mon, 24 Jan 2022 13:58:57 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 06A61C06124C; Mon, 24 Jan 2022 10:56:17 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C22D1B8122F; Mon, 24 Jan 2022 18:56:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C5C6DC340E7; Mon, 24 Jan 2022 18:56:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050574; bh=XjFCQMtChNzQu+/wivrPl0tpf7DCbKXansZw5loAbeM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hMmzBOZ9Z2UfJk79nwr4opRE8jqstYwFAzPrYgmxOyQ6sV5w2YD1WB3HYQh/020sP WV7J/UH6rDa3xXAu11Hf7TJjd09UBLkM1n0Je3wlGqrzq6dQcoUZgvg8DXD4mNy4mP yLSw/tpFz9POxGq6n2QfVfFG7+bq0esGpl6Am8hM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jann Horn , Jiri Kosina Subject: [PATCH 4.9 013/157] HID: uhid: Fix worker destroying device without any protection Date: Mon, 24 Jan 2022 19:41:43 +0100 Message-Id: <20220124183933.213789762@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jann Horn commit 4ea5763fb79ed89b3bdad455ebf3f33416a81624 upstream. uhid has to run hid_add_device() from workqueue context while allowing parallel use of the userspace API (which is protected with ->devlock). But hid_add_device() can fail. Currently, that is handled by immediately destroying the associated HID device, without using ->devlock - but if there are concurrent requests from userspace, that's wrong and leads to NULL dereferences and/or memory corruption (via use-after-free). Fix it by leaving the HID device as-is in the worker. We can clean it up later, either in the UHID_DESTROY command handler or in the ->release() handler. Cc: stable@vger.kernel.org Fixes: 67f8ecc550b5 ("HID: uhid: fix timeout when probe races with IO") Signed-off-by: Jann Horn Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/hid/uhid.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) --- a/drivers/hid/uhid.c +++ b/drivers/hid/uhid.c @@ -33,11 +33,22 @@ =20 struct uhid_device { struct mutex devlock; + + /* This flag tracks whether the HID device is usable for commands from + * userspace. The flag is already set before hid_add_device(), which + * runs in workqueue context, to allow hid_add_device() to communicate + * with userspace. + * However, if hid_add_device() fails, the flag is cleared without + * holding devlock. + * We guarantee that if @running changes from true to false while you're + * holding @devlock, it's still fine to access @hid. + */ bool running; =20 __u8 *rd_data; uint rd_size; =20 + /* When this is NULL, userspace may use UHID_CREATE/UHID_CREATE2. */ struct hid_device *hid; struct uhid_event input_buf; =20 @@ -68,9 +79,18 @@ static void uhid_device_add_worker(struc if (ret) { hid_err(uhid->hid, "Cannot register HID device: error %d\n", ret); =20 - hid_destroy_device(uhid->hid); - uhid->hid =3D NULL; + /* We used to call hid_destroy_device() here, but that's really + * messy to get right because we have to coordinate with + * concurrent writes from userspace that might be in the middle + * of using uhid->hid. + * Just leave uhid->hid as-is for now, and clean it up when + * userspace tries to close or reinitialize the uhid instance. + * + * However, we do have to clear the ->running flag and do a + * wakeup to make sure userspace knows that the device is gone. + */ uhid->running =3D false; + wake_up_interruptible(&uhid->report_wait); } } =20 @@ -479,7 +499,7 @@ static int uhid_dev_create2(struct uhid_ void *rd_data; int ret; =20 - if (uhid->running) + if (uhid->hid) return -EALREADY; =20 rd_size =3D ev->u.create2.rd_size; @@ -560,7 +580,7 @@ static int uhid_dev_create(struct uhid_d =20 static int uhid_dev_destroy(struct uhid_device *uhid) { - if (!uhid->running) + if (!uhid->hid) return -EINVAL; =20 uhid->running =3D false; @@ -569,6 +589,7 @@ static int uhid_dev_destroy(struct uhid_ cancel_work_sync(&uhid->worker); =20 hid_destroy_device(uhid->hid); + uhid->hid =3D NULL; kfree(uhid->rd_data); =20 return 0; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C98B2C433EF for ; Mon, 24 Jan 2022 19:03:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345348AbiAXTDZ (ORCPT ); Mon, 24 Jan 2022 14:03:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44194 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245492AbiAXS7K (ORCPT ); Mon, 24 Jan 2022 13:59:10 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2CAE6C061259; Mon, 24 Jan 2022 10:56:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E790DB81233; Mon, 24 Jan 2022 18:56:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 04AF4C340E5; Mon, 24 Jan 2022 18:56:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050577; bh=0llLWABPLExHlQs4euURpnH0F+1WsUmniWIHam1or1M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=voJd23qb9H7g8ubTybR22rQdDpO85IuuN6kPh9YgLXQxQkxS/KlOH2IB2WSMUM0Wj 5NgrMjMylpZ4B9mX8+CIWwbJCR4P6XDNoIsWwLCJTphfERg+mbLMq5SY4X5CAPPh8y KxCmKQUXjONZ8KUtIyfIKiJeYETSZNYVAVZPmMK4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jason Gerecke , Ping Cheng , Jiri Kosina Subject: [PATCH 4.9 014/157] HID: wacom: Avoid using stale array indicies to read contact count Date: Mon, 24 Jan 2022 19:41:44 +0100 Message-Id: <20220124183933.243616752@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason Gerecke commit 20f3cf5f860f9f267a6a6e5642d3d0525edb1814 upstream. If we ever see a touch report with contact count data we initialize several variables used to read the contact count in the pre-report phase. These variables are never reset if we process a report which doesn't contain a contact count, however. This can cause the pre- report function to trigger a read of arbitrary memory (e.g. NULL if we're lucky) and potentially crash the driver. This commit restores resetting of the variables back to default "none" values that were used prior to the commit mentioned below. Link: https://github.com/linuxwacom/input-wacom/issues/276 Fixes: 003f50ab673c (HID: wacom: Update last_slot_field during pre_report p= hase) CC: stable@vger.kernel.org Signed-off-by: Jason Gerecke Reviewed-by: Ping Cheng Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/hid/wacom_wac.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -1693,6 +1693,10 @@ static void wacom_wac_finger_pre_report( struct hid_data* hid_data =3D &wacom_wac->hid_data; int i; =20 + hid_data->cc_report =3D 0; + hid_data->cc_index =3D -1; + hid_data->cc_value_index =3D -1; + for (i =3D 0; i < report->maxfield; i++) { struct hid_field *field =3D report->field[i]; int j; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4BA8C4332F for ; Mon, 24 Jan 2022 19:05:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346203AbiAXTFM (ORCPT ); Mon, 24 Jan 2022 14:05:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44224 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344772AbiAXS7M (ORCPT ); Mon, 24 Jan 2022 13:59:12 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B1BD8C06127B; Mon, 24 Jan 2022 10:56:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 51E5D61416; Mon, 24 Jan 2022 18:56:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2FD98C340E5; Mon, 24 Jan 2022 18:56:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050580; bh=Oo2lX6416TxPeLNk85BzSqjJdoOIIwJmRJQe4N3bdMg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M0BVcOeJ+nfxQhXf65FCIfG+HFwaBwPDzjDJwH8/3Z+f1/58rsARlO5z6XV2Bb3+8 TO4R7OjvkydxD/j3gyb6HjlzKm3vA9OG5C9Az1yhlDy+ETcxjZhGScUigjsTngqUIz A1imRAj9yJR0NwU0H5iPOGLBr3xNMMd752u3kAkg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , "David S. Miller" , syzbot+7f23bcddf626e0593a39@syzkaller.appspotmail.com Subject: [PATCH 4.9 015/157] nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() Date: Mon, 24 Jan 2022 19:41:45 +0100 Message-Id: <20220124183933.281022426@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski commit dded08927ca3c31a5c37f8e7f95fe98770475dd4 upstream. Syzbot detected a NULL pointer dereference of nfc_llcp_sock->dev pointer (which is a 'struct nfc_dev *') with calls to llcp_sock_sendmsg() after a failed llcp_sock_bind(). The message being sent is a SOCK_DGRAM. KASAN report: BUG: KASAN: null-ptr-deref in nfc_alloc_send_skb+0x2d/0xc0 Read of size 4 at addr 00000000000005c8 by task llcp_sock_nfc_a/899 CPU: 5 PID: 899 Comm: llcp_sock_nfc_a Not tainted 5.16.0-rc6-next-2021122= 4-00001-gc6437fbf18b0 #125 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/0= 1/2014 Call Trace: dump_stack_lvl+0x45/0x59 ? nfc_alloc_send_skb+0x2d/0xc0 __kasan_report.cold+0x117/0x11c ? mark_lock+0x480/0x4f0 ? nfc_alloc_send_skb+0x2d/0xc0 kasan_report+0x38/0x50 nfc_alloc_send_skb+0x2d/0xc0 nfc_llcp_send_ui_frame+0x18c/0x2a0 ? nfc_llcp_send_i_frame+0x230/0x230 ? __local_bh_enable_ip+0x86/0xe0 ? llcp_sock_connect+0x470/0x470 ? llcp_sock_connect+0x470/0x470 sock_sendmsg+0x8e/0xa0 ____sys_sendmsg+0x253/0x3f0 ... The issue was visible only with multiple simultaneous calls to bind() and sendmsg(), which resulted in most of the bind() calls to fail. The bind() was failing on checking if there is available WKS/SDP/SAP (respective bit in 'struct nfc_llcp_local' fields). When there was no available WKS/SDP/SAP, the bind returned error but the sendmsg() to such socket was able to trigger mentioned NULL pointer dereference of nfc_llcp_sock->dev. The code looks simply racy and currently it protects several paths against race with checks for (!nfc_llcp_sock->local) which is NULL-ified in error paths of bind(). The llcp_sock_sendmsg() did not have such check but called function nfc_llcp_send_ui_frame() had, although not protected with lock_sock(). Therefore the race could look like (same socket is used all the time): CPU0 CPU1 =3D=3D=3D=3D =3D=3D=3D=3D llcp_sock_bind() - lock_sock() - success - release_sock() - return 0 llcp_sock_sendmsg() - lock_sock() - release_sock() llcp_sock_bind(), same socket - lock_sock() - error - nfc_llcp_send_ui_frame() - if (!llcp_sock->local) - llcp_sock->local =3D NULL - nfc_put_device(dev) - dereference llcp_sock->dev - release_sock() - return -ERRNO The nfc_llcp_send_ui_frame() checked llcp_sock->local outside of the lock, which is racy and ineffective check. Instead, its caller llcp_sock_sendmsg(), should perform the check inside lock_sock(). Reported-and-tested-by: syzbot+7f23bcddf626e0593a39@syzkaller.appspotmail.c= om Fixes: b874dec21d1c ("NFC: Implement LLCP connection less Tx path") Cc: Signed-off-by: Krzysztof Kozlowski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- net/nfc/llcp_sock.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/net/nfc/llcp_sock.c +++ b/net/nfc/llcp_sock.c @@ -796,6 +796,11 @@ static int llcp_sock_sendmsg(struct sock =20 lock_sock(sk); =20 + if (!llcp_sock->local) { + release_sock(sk); + return -ENODEV; + } + if (sk->sk_type =3D=3D SOCK_DGRAM) { DECLARE_SOCKADDR(struct sockaddr_nfc_llcp *, addr, msg->msg_name); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85730C433F5 for ; Mon, 24 Jan 2022 18:58:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245720AbiAXS62 (ORCPT ); Mon, 24 Jan 2022 13:58:28 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:51876 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344441AbiAXSyl (ORCPT ); Mon, 24 Jan 2022 13:54:41 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 564B2B81223; Mon, 24 Jan 2022 18:54:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80508C340E5; Mon, 24 Jan 2022 18:54:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050479; bh=vDJRKSzAiyqZ3JsQoCOUZTM/7+iANswPWyR4RSwGAxk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iv4KEPoEshbCsTDYRn2Gl4iCw6b5QHs6LSRU13v9G8o8neuLZNjOWvZ4MOA4RyV0m S6NjOWA5kz/mVfPcp2OlR0lsQSKS+DNV39FKGSMXjyjEKv9lX7Pi/zAsqlk3/8wNw1 aY5ykSpsk1t+t+K5ts7+zk7HKaBK6LV2N7w9Iv5E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Mateusz=20Jo=C5=84czyk?= , Nobuhiro Iwamatsu , Alessandro Zummo , Alexandre Belloni Subject: [PATCH 4.9 016/157] rtc: cmos: take rtc_lock while reading from CMOS Date: Mon, 24 Jan 2022 19:41:46 +0100 Message-Id: <20220124183933.312229794@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mateusz Jo=C5=84czyk commit 454f47ff464325223129b9b5b8d0b61946ec704d upstream. Reading from the CMOS involves writing to the index register and then reading from the data register. Therefore access to the CMOS has to be serialized with rtc_lock. This invocation of CMOS_READ was not serialized, which could cause trouble when other code is accessing CMOS at the same time. Use spin_lock_irq() like the rest of the function. Nothing in kernel modifies the RTC_DM_BINARY bit, so there could be a separate pair of spin_lock_irq() / spin_unlock_irq() before doing the math. Signed-off-by: Mateusz Jo=C5=84czyk Reviewed-by: Nobuhiro Iwamatsu Cc: Alessandro Zummo Cc: Alexandre Belloni Cc: stable@vger.kernel.org Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20211210200131.153887-2-mat.jonczyk@o2.pl Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/rtc/rtc-cmos.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/rtc/rtc-cmos.c +++ b/drivers/rtc/rtc-cmos.c @@ -342,7 +342,10 @@ static int cmos_set_alarm(struct device min =3D t->time.tm_min; sec =3D t->time.tm_sec; =20 + spin_lock_irq(&rtc_lock); rtc_control =3D CMOS_READ(RTC_CONTROL); + spin_unlock_irq(&rtc_lock); + if (!(rtc_control & RTC_DM_BINARY) || RTC_ALWAYS_BCD) { /* Writing 0xff means "don't care" or "match all". */ mon =3D (mon <=3D 12) ? bin2bcd(mon) : 0xff; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97C5DC43217 for ; Mon, 24 Jan 2022 19:01:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344085AbiAXTBR (ORCPT ); Mon, 24 Jan 2022 14:01:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44636 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344516AbiAXS4z (ORCPT ); Mon, 24 Jan 2022 13:56:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F3011C061748; Mon, 24 Jan 2022 10:54:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id ADED3B810BD; Mon, 24 Jan 2022 18:54:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1356C340E5; Mon, 24 Jan 2022 18:54:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050482; bh=F65ag6AKE7JrZXlzplJis1GPW0kUgcO2P1TwKqs3nPQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G1dnkgcrbSZ4DHysvLDOPvyZbbpoPCaX3/w8MINIK1LvCF4qdU1cPjW+BZkzPXKkN AKzbpZeMePmNbqEAigYPi2Tdv85UjZ9FHopGiXnIH5+G1TuEaEUPovGtcOSS/VIIq2 d3vllNCX9IGeGk/49RSWU6piEYHJN0bB1v+PFL6w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.9 017/157] media: flexcop-usb: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:47 +0100 Message-Id: <20220124183933.341999304@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit cd1798a387825cc4a51282f5a611ad05bb1ad75f upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Note that the driver was multiplying some of the timeout values with HZ twice resulting in 3000-second timeouts with HZ=3D1000. Also note that two of the timeout defines are currently unused. Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device dr= iver") Cc: stable@vger.kernel.org # 3.0 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/usb/b2c2/flexcop-usb.c | 10 +++++----- drivers/media/usb/b2c2/flexcop-usb.h | 12 ++++++------ 2 files changed, 11 insertions(+), 11 deletions(-) --- a/drivers/media/usb/b2c2/flexcop-usb.c +++ b/drivers/media/usb/b2c2/flexcop-usb.c @@ -87,7 +87,7 @@ static int flexcop_usb_readwrite_dw(stru 0, fc_usb->data, sizeof(u32), - B2C2_WAIT_FOR_OPERATION_RDW * HZ); + B2C2_WAIT_FOR_OPERATION_RDW); =20 if (ret !=3D sizeof(u32)) { err("error while %s dword from %d (%d).", read ? "reading" : @@ -155,7 +155,7 @@ static int flexcop_usb_v8_memory_req(str wIndex, fc_usb->data, buflen, - nWaitTime * HZ); + nWaitTime); if (ret !=3D buflen) ret =3D -EIO; =20 @@ -249,13 +249,13 @@ static int flexcop_usb_i2c_req(struct fl /* DKT 020208 - add this to support special case of DiSEqC */ case USB_FUNC_I2C_CHECKWRITE: pipe =3D B2C2_USB_CTRL_PIPE_OUT; - nWaitTime =3D 2; + nWaitTime =3D 2000; request_type |=3D USB_DIR_OUT; break; case USB_FUNC_I2C_READ: case USB_FUNC_I2C_REPEATREAD: pipe =3D B2C2_USB_CTRL_PIPE_IN; - nWaitTime =3D 2; + nWaitTime =3D 2000; request_type |=3D USB_DIR_IN; break; default: @@ -282,7 +282,7 @@ static int flexcop_usb_i2c_req(struct fl wIndex, fc_usb->data, buflen, - nWaitTime * HZ); + nWaitTime); =20 if (ret !=3D buflen) ret =3D -EIO; --- a/drivers/media/usb/b2c2/flexcop-usb.h +++ b/drivers/media/usb/b2c2/flexcop-usb.h @@ -90,13 +90,13 @@ typedef enum { UTILITY_SRAM_TESTVERIFY =3D 0x16, } flexcop_usb_utility_function_t; =20 -#define B2C2_WAIT_FOR_OPERATION_RW (1*HZ) -#define B2C2_WAIT_FOR_OPERATION_RDW (3*HZ) -#define B2C2_WAIT_FOR_OPERATION_WDW (1*HZ) +#define B2C2_WAIT_FOR_OPERATION_RW 1000 +#define B2C2_WAIT_FOR_OPERATION_RDW 3000 +#define B2C2_WAIT_FOR_OPERATION_WDW 1000 =20 -#define B2C2_WAIT_FOR_OPERATION_V8READ (3*HZ) -#define B2C2_WAIT_FOR_OPERATION_V8WRITE (3*HZ) -#define B2C2_WAIT_FOR_OPERATION_V8FLASH (3*HZ) +#define B2C2_WAIT_FOR_OPERATION_V8READ 3000 +#define B2C2_WAIT_FOR_OPERATION_V8WRITE 3000 +#define B2C2_WAIT_FOR_OPERATION_V8FLASH 3000 =20 typedef enum { V8_MEMORY_PAGE_DVB_CI =3D 0x20, From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85267C433EF for ; Mon, 24 Jan 2022 18:57:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344238AbiAXS5S (ORCPT ); Mon, 24 Jan 2022 13:57:18 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53010 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344545AbiAXSys (ORCPT ); Mon, 24 Jan 2022 13:54:48 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D4D89B810BD; Mon, 24 Jan 2022 18:54:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EAA66C340E5; Mon, 24 Jan 2022 18:54:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050485; bh=axNKMA7GKOMDqQQ6KEjlUnFq8shm+cIF6WYV7RhtX34=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UAaZhxdXExUcWHPoEi+Xfd5EvzSDdPG6TZIu9zyUK3wpgTzxYvPaYvquXi0OhRp7z WxqzbJ3uvYoxcxnKSlbKHEJ1PmnKsMVXZHjKvPUf3QcQ3aQPXNoBZXop92SEG19ceR G/nLu2YZdMRC0BSJXybjXomLVlg2mGnOI7+32f5g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.9 018/157] media: mceusb: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:48 +0100 Message-Id: <20220124183933.374165514@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 16394e998cbb050730536bdf7e89f5a70efbd974 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") Cc: stable@vger.kernel.org # 2.6.36 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/rc/mceusb.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/media/rc/mceusb.c +++ b/drivers/media/rc/mceusb.c @@ -1129,7 +1129,7 @@ static void mceusb_gen1_init(struct mceu */ ret =3D usb_control_msg(ir->usbdev, usb_rcvctrlpipe(ir->usbdev, 0), USB_REQ_SET_ADDRESS, USB_TYPE_VENDOR, 0, 0, - data, USB_CTRL_MSG_SZ, HZ * 3); + data, USB_CTRL_MSG_SZ, 3000); dev_dbg(dev, "set address - ret =3D %d", ret); dev_dbg(dev, "set address - data[0] =3D %d, data[1] =3D %d", data[0], data[1]); @@ -1137,20 +1137,20 @@ static void mceusb_gen1_init(struct mceu /* set feature: bit rate 38400 bps */ ret =3D usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), USB_REQ_SET_FEATURE, USB_TYPE_VENDOR, - 0xc04e, 0x0000, NULL, 0, HZ * 3); + 0xc04e, 0x0000, NULL, 0, 3000); =20 dev_dbg(dev, "set feature - ret =3D %d", ret); =20 /* bRequest 4: set char length to 8 bits */ ret =3D usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), 4, USB_TYPE_VENDOR, - 0x0808, 0x0000, NULL, 0, HZ * 3); + 0x0808, 0x0000, NULL, 0, 3000); dev_dbg(dev, "set char length - retB =3D %d", ret); =20 /* bRequest 2: set handshaking to use DTR/DSR */ ret =3D usb_control_msg(ir->usbdev, usb_sndctrlpipe(ir->usbdev, 0), 2, USB_TYPE_VENDOR, - 0x0000, 0x0100, NULL, 0, HZ * 3); + 0x0000, 0x0100, NULL, 0, 3000); dev_dbg(dev, "set handshake - retC =3D %d", ret); =20 /* device resume */ From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B58AC433EF for ; Mon, 24 Jan 2022 18:59:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344058AbiAXS7O (ORCPT ); Mon, 24 Jan 2022 13:59:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44136 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241949AbiAXS45 (ORCPT ); Mon, 24 Jan 2022 13:56:57 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DA025C061749; Mon, 24 Jan 2022 10:54:49 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 790156153F; Mon, 24 Jan 2022 18:54:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3B3F7C340E5; Mon, 24 Jan 2022 18:54:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050488; bh=MH0E6NCxT8S0JirUSBlxUe9H0Emh2ArelTUEIROEmLs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AkocO5/ZiQ1v/VtUn9cGdmw4W+NwMg525k028K0R0dpzJahYjWm+anCOL1AZlranh enXTLMdMZznHF0Q/pzDXsc+Bt101Mp+ZlEhriN1bGQWlxhnlGAV54SvLxM3lBF9vxX i5TSftihCY0fY8aWoCqE2CIOvVfgmnUQbGxtNmYA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.9 019/157] media: em28xx: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:49 +0100 Message-Id: <20220124183933.405332952@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit d9b7e8df3aa9b8c10708aab60e72e79ac08237e4 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: a6c2ba283565 ("[PATCH] v4l: 716: support for em28xx board family") Cc: stable@vger.kernel.org # 2.6.16 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/usb/em28xx/em28xx-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/em28xx/em28xx-core.c +++ b/drivers/media/usb/em28xx/em28xx-core.c @@ -99,7 +99,7 @@ int em28xx_read_reg_req_len(struct em28x mutex_lock(&dev->ctrl_urb_lock); ret =3D usb_control_msg(dev->udev, pipe, req, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x0000, reg, dev->urb_buf, len, HZ); + 0x0000, reg, dev->urb_buf, len, 1000); if (ret < 0) { if (reg_debug) printk(" failed!\n"); @@ -182,7 +182,7 @@ int em28xx_write_regs_req(struct em28xx memcpy(dev->urb_buf, buf, len); ret =3D usb_control_msg(dev->udev, pipe, req, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x0000, reg, dev->urb_buf, len, HZ); + 0x0000, reg, dev->urb_buf, len, 1000); mutex_unlock(&dev->ctrl_urb_lock); =20 if (ret < 0) From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95AC5C433FE for ; Mon, 24 Jan 2022 19:01:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344995AbiAXS7n (ORCPT ); Mon, 24 Jan 2022 13:59:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44662 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343809AbiAXS46 (ORCPT ); Mon, 24 Jan 2022 13:56:58 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 20BEDC06174E; Mon, 24 Jan 2022 10:54:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B29BE61536; Mon, 24 Jan 2022 18:54:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97855C340E5; Mon, 24 Jan 2022 18:54:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050492; bh=b4kcivluYJh7pgswgQPg1zU3hkH+p9fBoPRamCNu/wc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dSLq3TXvymF5VT3CcMzZ8PP4Tgi7oguv7lIeWJxHw8366BYQx+WP9vxGWp1uHbH75 EmhxGUwKiFtaPYpOV6DMiYYyoBZmCHBnlneNejTJimzzzaaq4/WDloRiNakfloM/7s cq78EHcAcyV42xTAkjueZ5X4PH57BSNCa1xYyttw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.9 020/157] media: cpia2: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:50 +0100 Message-Id: <20220124183933.438024587@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 10729be03327f53258cb196362015ad5c6eabe02 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: ab33d5071de7 ("V4L/DVB (3376): Add cpia2 camera support") Cc: stable@vger.kernel.org # 2.6.17 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/usb/cpia2/cpia2_usb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/cpia2/cpia2_usb.c +++ b/drivers/media/usb/cpia2/cpia2_usb.c @@ -565,7 +565,7 @@ static int write_packet(struct usb_devic 0, /* index */ buf, /* buffer */ size, - HZ); + 1000); =20 kfree(buf); return ret; @@ -597,7 +597,7 @@ static int read_packet(struct usb_device 0, /* index */ buf, /* buffer */ size, - HZ); + 1000); =20 if (ret >=3D 0) memcpy(registers, buf, size); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB9DEC433F5 for ; Mon, 24 Jan 2022 18:57:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344460AbiAXS52 (ORCPT ); Mon, 24 Jan 2022 13:57:28 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53070 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344644AbiAXSy6 (ORCPT ); Mon, 24 Jan 2022 13:54:58 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9A0C8B8121C; Mon, 24 Jan 2022 18:54:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A9613C340E5; Mon, 24 Jan 2022 18:54:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050495; bh=5pHBXSS37SjLEywnV64e/T0JCOZezx0FqdIwEEI7r90=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VkNYLSn9fDeyNQfsFmIg3LOgh/LBI+0BXyp2W1NBYKdVa38W0oPnnpS9lk56P0jU8 aBmsjuJF9OF1xg2jT7+7KaX/p8hjL0BZkCzezWxYHna68W097WW6xyEkqMdNn1hjXR w0d5pKgST88BdY/aCir4xZayxmdYl9KaQc62RCvs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.9 021/157] media: s2255: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:51 +0100 Message-Id: <20220124183933.468340652@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit f71d272ad4e354097020a4e6b1dc6e4b59feb50f upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Use the common control-message timeout define for the five-second timeouts. Fixes: 38f993ad8b1f ("V4L/DVB (8125): This driver adds support for the Sens= oray 2255 devices.") Cc: stable@vger.kernel.org # 2.6.27 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/usb/s2255/s2255drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/s2255/s2255drv.c +++ b/drivers/media/usb/s2255/s2255drv.c @@ -1913,7 +1913,7 @@ static long s2255_vendor_req(struct s225 USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, Value, Index, buf, - TransferBufferLength, HZ * 5); + TransferBufferLength, USB_CTRL_SET_TIMEOUT); =20 if (r >=3D 0) memcpy(TransferBuffer, buf, TransferBufferLength); @@ -1922,7 +1922,7 @@ static long s2255_vendor_req(struct s225 r =3D usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE, Value, Index, buf, - TransferBufferLength, HZ * 5); + TransferBufferLength, USB_CTRL_SET_TIMEOUT); } kfree(buf); return r; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A77A7C4332F for ; Mon, 24 Jan 2022 19:01:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344965AbiAXS7l (ORCPT ); Mon, 24 Jan 2022 13:59:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44664 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343815AbiAXS46 (ORCPT ); Mon, 24 Jan 2022 13:56:58 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0EE71C061753; Mon, 24 Jan 2022 10:55:01 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C0A63B8121A; Mon, 24 Jan 2022 18:54:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2F0CC340EA; Mon, 24 Jan 2022 18:54:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050498; bh=qJAm7nxkvWLXikpp65EDpvm73EhmGBm8p+/E1dgdSS0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=A8tuTd34f10vxkcqfyyi2ZAAE120up6vp5uHkxRKar3KI/636c/AZqU5U6lN2JvvM ViCytgWTSXu+1VMORszkKJmm/S2mFQqboJGR3b0VJ11SzxGa6ziEGUbGHMtREhmBMm 9iIdyYUczqV9ve9IHocxYp3NKXKnF8+QgS89eaDc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Kuron , Mauro Carvalho Chehab Subject: [PATCH 4.9 022/157] media: dib0700: fix undefined behavior in tuner shutdown Date: Mon, 24 Jan 2022 19:41:52 +0100 Message-Id: <20220124183933.500112255@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Kuron commit f7b77ebe6d2f49c7747b2d619586d1aa33f9ea91 upstream. This fixes a problem where closing the tuner would leave it in a state where it would not tune to any channel when reopened. This problem was discovered as part of https://github.com/hselasky/webcamd/issues/16. Since adap->id is 0 or 1, this bit-shift overflows, which is undefined behavior. The driver still worked in practice as the overflow would in most environments result in 0, which rendered the line a no-op. When running the driver as part of webcamd however, the overflow could lead to 0xff due to optimizations by the compiler, which would, in the end, improperly shut down the tuner. The bug is a regression introduced in the commit referenced below. The present patch causes identical behavior to before that commit for adap->id equal to 0 or 1. The driver does not contain support for dib0700 devices with more adapters, assuming such even exist. Tests have been performed with the Xbox One Digital TV Tuner on amd64. Not all dib0700 devices are expected to be affected by the regression; this code path is only taken by those with incorrect endpoint numbers. Link: https://lore.kernel.org/linux-media/1d2fc36d94ced6f67c7cc21dcc469d5e5= bdd8201.1632689033.git.mchehab+huawei@kernel.org Cc: stable@vger.kernel.org Fixes: 7757ddda6f4f ("[media] DiB0700: add function to change I2C-speed") Signed-off-by: Michael Kuron Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/usb/dvb-usb/dib0700_core.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/media/usb/dvb-usb/dib0700_core.c +++ b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -610,8 +610,6 @@ int dib0700_streaming_ctrl(struct dvb_us deb_info("the endpoint number (%i) is not correct, use the adapter id in= stead", adap->fe_adap[0].stream.props.endpoint); if (onoff) st->channel_state |=3D 1 << (adap->id); - else - st->channel_state |=3D 1 << ~(adap->id); } else { if (onoff) st->channel_state |=3D 1 << (adap->fe_adap[0].stream.props.endpoint-2); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4158C433EF for ; Mon, 24 Jan 2022 18:57:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344336AbiAXS5V (ORCPT ); Mon, 24 Jan 2022 13:57:21 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:54094 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344682AbiAXSzC (ORCPT ); Mon, 24 Jan 2022 13:55:02 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 47A8E61506; Mon, 24 Jan 2022 18:55:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 22258C340E5; Mon, 24 Jan 2022 18:55:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050501; bh=H2k4HtpmfTWc2oUVAdWY+FQGtWRLmONpm8sYETeH2qY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jFjyxt6Kh/VktpqSz24CvquG91gm1fcike5TLPpxTvmIEbkBnv0Nj3F3PSZKy16IZ PmfHy17DZPcuWjCtP6x6BQ7ch5fwO8qn4Z3RY9UrT5OAwYqxS6lJ9bQpK4R5/eQ4UY +BPoFXFM+XpH4ZmVJOgDY2Unya6juhh+eEtlRlUs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.9 023/157] media: redrat3: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:53 +0100 Message-Id: <20220124183933.530566539@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 2adc965c8bfa224e11ecccf9c92fd458c4236428 upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: 2154be651b90 ("[media] redrat3: new rc-core IR transceiver device dr= iver") Cc: stable@vger.kernel.org # 3.0 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/rc/redrat3.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) --- a/drivers/media/rc/redrat3.c +++ b/drivers/media/rc/redrat3.c @@ -427,7 +427,7 @@ static int redrat3_send_cmd(int cmd, str udev =3D rr3->udev; res =3D usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), cmd, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - 0x0000, 0x0000, data, sizeof(u8), HZ * 10); + 0x0000, 0x0000, data, sizeof(u8), 10000); =20 if (res < 0) { dev_err(rr3->dev, "%s: Error sending rr3 cmd res %d, data %d", @@ -493,7 +493,7 @@ static u32 redrat3_get_timeout(struct re pipe =3D usb_rcvctrlpipe(rr3->udev, 0); ret =3D usb_control_msg(rr3->udev, pipe, RR3_GET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, HZ * 5); + RR3_IR_IO_SIG_TIMEOUT, 0, tmp, len, 5000); if (ret !=3D len) dev_warn(rr3->dev, "Failed to read timeout from hardware\n"); else { @@ -523,7 +523,7 @@ static int redrat3_set_timeout(struct rc ret =3D usb_control_msg(udev, usb_sndctrlpipe(udev, 0), RR3_SET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, RR3_IR_IO_SIG_TIMEOUT, 0, timeout, sizeof(*timeout), - HZ * 25); + 25000); dev_dbg(dev, "set ir parm timeout %d ret 0x%02x\n", be32_to_cpu(*timeout), ret); =20 @@ -557,32 +557,32 @@ static void redrat3_reset(struct redrat3 *val =3D 0x01; rc =3D usb_control_msg(udev, rxpipe, RR3_RESET, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - RR3_CPUCS_REG_ADDR, 0, val, len, HZ * 25); + RR3_CPUCS_REG_ADDR, 0, val, len, 25000); dev_dbg(dev, "reset returned 0x%02x\n", rc); =20 *val =3D length_fuzz; rc =3D usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - RR3_IR_IO_LENGTH_FUZZ, 0, val, len, HZ * 25); + RR3_IR_IO_LENGTH_FUZZ, 0, val, len, 25000); dev_dbg(dev, "set ir parm len fuzz %d rc 0x%02x\n", *val, rc); =20 *val =3D (65536 - (minimum_pause * 2000)) / 256; rc =3D usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - RR3_IR_IO_MIN_PAUSE, 0, val, len, HZ * 25); + RR3_IR_IO_MIN_PAUSE, 0, val, len, 25000); dev_dbg(dev, "set ir parm min pause %d rc 0x%02x\n", *val, rc); =20 *val =3D periods_measure_carrier; rc =3D usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - RR3_IR_IO_PERIODS_MF, 0, val, len, HZ * 25); + RR3_IR_IO_PERIODS_MF, 0, val, len, 25000); dev_dbg(dev, "set ir parm periods measure carrier %d rc 0x%02x", *val, rc); =20 *val =3D RR3_DRIVER_MAXLENS; rc =3D usb_control_msg(udev, txpipe, RR3_SET_IR_PARAM, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT, - RR3_IR_IO_MAX_LENGTHS, 0, val, len, HZ * 25); + RR3_IR_IO_MAX_LENGTHS, 0, val, len, 25000); dev_dbg(dev, "set ir parm max lens %d rc 0x%02x\n", *val, rc); =20 kfree(val); @@ -602,7 +602,7 @@ static void redrat3_get_firmware_rev(str rc =3D usb_control_msg(rr3->udev, usb_rcvctrlpipe(rr3->udev, 0), RR3_FW_VERSION, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - 0, 0, buffer, RR3_FW_VERSION_LEN, HZ * 5); + 0, 0, buffer, RR3_FW_VERSION_LEN, 5000); =20 if (rc >=3D 0) dev_info(rr3->dev, "Firmware rev: %s", buffer); @@ -842,14 +842,14 @@ static int redrat3_transmit_ir(struct rc =20 pipe =3D usb_sndbulkpipe(rr3->udev, rr3->ep_out->bEndpointAddress); ret =3D usb_bulk_msg(rr3->udev, pipe, irdata, - sendbuf_len, &ret_len, 10 * HZ); + sendbuf_len, &ret_len, 10000); dev_dbg(dev, "sent %d bytes, (ret %d)\n", ret_len, ret); =20 /* now tell the hardware to transmit what we sent it */ pipe =3D usb_rcvctrlpipe(rr3->udev, 0); ret =3D usb_control_msg(rr3->udev, pipe, RR3_TX_SEND_SIGNAL, USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, - 0, 0, irdata, 2, HZ * 10); + 0, 0, irdata, 2, 10000); =20 if (ret < 0) dev_err(dev, "Error: control msg send failed, rc %d\n", ret); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B8EEC433FE for ; Mon, 24 Jan 2022 19:01:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344920AbiAXS7h (ORCPT ); Mon, 24 Jan 2022 13:59:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44672 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343515AbiAXS5A (ORCPT ); Mon, 24 Jan 2022 13:57:00 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5515BC061755; Mon, 24 Jan 2022 10:55:07 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1EA1BB8121A; Mon, 24 Jan 2022 18:55:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34293C340E5; Mon, 24 Jan 2022 18:55:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050504; bh=hImpkszlYouxmdM/301iwqVHx5Xo0QnkQ+plX6an+o4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zeRAw5hQAE61LH9Fazva9USpb2jGq5b0avfFCIFioCqboykEYvXhaTtl6eNCuapfy AN/MLReO/HywAKt64lS83Iu5HFR/mfhuDxVPSaFaJvYnmJxwZSsVz0Q62YQYRhDdl3 LuS4Sl+PXEOtVfV5JioUcKb1gYl33uWSQy4/ituM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.9 024/157] media: pvrusb2: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:54 +0100 Message-Id: <20220124183933.560152782@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit b82bf9b9dc305d7d3d93eab106d70dbf2171b43e upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: d855497edbfb ("V4L/DVB (4228a): pvrusb2 to kernel 2.6.18") Cc: stable@vger.kernel.org # 2.6.18 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c @@ -1488,7 +1488,7 @@ static int pvr2_upload_firmware1(struct for (address =3D 0; address < fwsize; address +=3D 0x800) { memcpy(fw_ptr, fw_entry->data + address, 0x800); ret +=3D usb_control_msg(hdw->usb_dev, pipe, 0xa0, 0x40, address, - 0, fw_ptr, 0x800, HZ); + 0, fw_ptr, 0x800, 1000); } =20 trace_firmware("Upload done, releasing device's CPU"); @@ -1627,7 +1627,7 @@ int pvr2_upload_firmware2(struct pvr2_hd ((u32 *)fw_ptr)[icnt] =3D swab32(((u32 *)fw_ptr)[icnt]); =20 ret |=3D usb_bulk_msg(hdw->usb_dev, pipe, fw_ptr,bcnt, - &actual_length, HZ); + &actual_length, 1000); ret |=3D (actual_length !=3D bcnt); if (ret) break; fw_done +=3D bcnt; @@ -3486,7 +3486,7 @@ void pvr2_hdw_cpufw_set_enabled(struct p 0xa0,0xc0, address,0, hdw->fw_buffer+address, - 0x800,HZ); + 0x800,1000); if (ret < 0) break; } =20 @@ -4011,7 +4011,7 @@ void pvr2_hdw_cpureset_assert(struct pvr /* Write the CPUCS register on the 8051. The lsb of the register is the reset bit; a 1 asserts reset while a 0 clears it. */ pipe =3D usb_sndctrlpipe(hdw->usb_dev, 0); - ret =3D usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,HZ); + ret =3D usb_control_msg(hdw->usb_dev,pipe,0xa0,0x40,0xe600,0,da,1,1000); if (ret < 0) { pvr2_trace(PVR2_TRACE_ERROR_LEGS, "cpureset_assert(%d) error=3D%d",val,ret); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 626A9C433F5 for ; Mon, 24 Jan 2022 18:59:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344832AbiAXS7T (ORCPT ); Mon, 24 Jan 2022 13:59:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44170 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343595AbiAXS5E (ORCPT ); Mon, 24 Jan 2022 13:57:04 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A337BC061756; Mon, 24 Jan 2022 10:55:10 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 61852B8121A; Mon, 24 Jan 2022 18:55:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77EE0C340E5; Mon, 24 Jan 2022 18:55:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050508; bh=+JGX5V6bckuGbkPso6Uwk7DIgB1lnA95aSlFuON2aDk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L+nqPbPXrgq1c6zWPND5LjU1TxEQo10clOBqFzQqZKU+UAOonlefyEjsnDf6K6KyH ujhiYKUhAQAaTpYySodjeztWyUJLS2sjRhiRhwVGv+GB5JkDTnErQi5b5dIjDNbiyy L6wo+uoNhG3cZKgJfQC8ek/kph3v9XV6OQ8BHLtU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.9 025/157] media: stk1160: fix control-message timeouts Date: Mon, 24 Jan 2022 19:41:55 +0100 Message-Id: <20220124183933.591621918@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 6aa6e70cdb5b863a57bad61310bf89b6617a5d2d upstream. USB control-message timeouts are specified in milliseconds and should specifically not vary with CONFIG_HZ. Fixes: 9cb2173e6ea8 ("[media] media: Add stk1160 new driver (easycap replac= ement)") Cc: stable@vger.kernel.org # 3.7 Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/usb/stk1160/stk1160-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/stk1160/stk1160-core.c +++ b/drivers/media/usb/stk1160/stk1160-core.c @@ -76,7 +76,7 @@ int stk1160_read_reg(struct stk1160 *dev return -ENOMEM; ret =3D usb_control_msg(dev->udev, pipe, 0x00, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - 0x00, reg, buf, sizeof(u8), HZ); + 0x00, reg, buf, sizeof(u8), 1000); if (ret < 0) { stk1160_err("read failed on reg 0x%x (%d)\n", reg, ret); @@ -96,7 +96,7 @@ int stk1160_write_reg(struct stk1160 *de =20 ret =3D usb_control_msg(dev->udev, pipe, 0x01, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE, - value, reg, NULL, 0, HZ); + value, reg, NULL, 0, 1000); if (ret < 0) { stk1160_err("write failed on reg 0x%x (%d)\n", reg, ret); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BBCFDC433F5 for ; Mon, 24 Jan 2022 19:01:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345069AbiAXS7q (ORCPT ); Mon, 24 Jan 2022 13:59:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44172 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242265AbiAXS5G (ORCPT ); Mon, 24 Jan 2022 13:57:06 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5C191C06175A; Mon, 24 Jan 2022 10:55:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EE7E2614C9; Mon, 24 Jan 2022 18:55:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C790DC340E5; Mon, 24 Jan 2022 18:55:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050514; bh=gTiAsola0UWMwwPm3YlisJWsAT/oMqMZKVdHyRXMZh0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FtiiME9r6FGv0Y4sLXEJYlQAx39i44yOK/Nm1QcwIHVVzJ1yodcKd0Op1O9SGtqbJ YSAB6mxBTwsKxjuo6odN74oWs1OZunbtPVRMsZarTWevnYqCibTXdu2M8DFCphK4y6 ccHUj5r+rNAXApj72VS7xr67+EEnjkTQHtBGuibM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Marc Kleine-Budde Subject: [PATCH 4.9 026/157] can: softing_cs: softingcs_probe(): fix memleak on registration failure Date: Mon, 24 Jan 2022 19:41:56 +0100 Message-Id: <20220124183933.624598620@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit ced4913efb0acc844ed65cc01d091a85d83a2082 upstream. In case device registration fails during probe, the driver state and the embedded platform device structure needs to be freed using platform_device_put() to properly free all resources (e.g. the device name). Fixes: 0a0b7a5f7a04 ("can: add driver for Softing card") Link: https://lore.kernel.org/all/20211222104843.6105-1-johan@kernel.org Cc: stable@vger.kernel.org # 2.6.38 Signed-off-by: Johan Hovold Reviewed-by: Greg Kroah-Hartman Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/can/softing/softing_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/can/softing/softing_cs.c +++ b/drivers/net/can/softing/softing_cs.c @@ -304,7 +304,7 @@ static int softingcs_probe(struct pcmcia return 0; =20 platform_failed: - kfree(dev); + platform_device_put(pdev); mem_failed: pcmcia_bad: pcmcia_failed: From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1990C433EF for ; Mon, 24 Jan 2022 18:57:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245425AbiAXS5d (ORCPT ); Mon, 24 Jan 2022 13:57:33 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52686 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344808AbiAXSzU (ORCPT ); Mon, 24 Jan 2022 13:55:20 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BAC0EB8121A; Mon, 24 Jan 2022 18:55:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DE47BC340E5; Mon, 24 Jan 2022 18:55:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050517; bh=/GzlMNYkGDgORLvWcuEHRi5YFjUBD8uWWSi8uea6hA0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ew12jJTrQ511UesLPYy2xw3gG2kyp9KJrKxUtfW0ERFdN6dmmqAOJP3lsJ36N4ord q4pN+oklL4K5HMdlKjmLFn37d6uHVtd3LAqOZzqqAXKALoNEHPWn0ME0DxXSurz7qN Idjb6zqsraNgFgMdsDsP42SrCLyCqfpRXHWCERuo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sam Bingner , Yifeng Li , Bjorn Helgaas , =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= Subject: [PATCH 4.9 027/157] PCI: Add function 1 DMA alias quirk for Marvell 88SE9125 SATA controller Date: Mon, 24 Jan 2022 19:41:57 +0100 Message-Id: <20220124183933.655867157@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Yifeng Li commit e445375882883f69018aa669b67cbb37ec873406 upstream. Like other SATA controller chips in the Marvell 88SE91xx series, the Marvell 88SE9125 has the same DMA requester ID hardware bug that prevents it from working under IOMMU. Add it to the list of devices that need the quirk. Without this patch, device initialization fails with DMA errors: ata8: softreset failed (1st FIS failed) DMAR: DRHD: handling fault status reg 2 DMAR: [DMA Write NO_PASID] Request device [03:00.1] fault addr 0xfffc0000= [fault reason 0x02] Present bit in context entry is clear DMAR: DRHD: handling fault status reg 2 DMAR: [DMA Read NO_PASID] Request device [03:00.1] fault addr 0xfffc0000 = [fault reason 0x02] Present bit in context entry is clear After applying the patch, the controller can be successfully initialized: ata8: SATA link up 1.5 Gbps (SStatus 113 SControl 330) ata8.00: ATAPI: PIONEER BD-RW BDR-207M, 1.21, max UDMA/100 ata8.00: configured for UDMA/100 scsi 7:0:0:0: CD-ROM PIONEER BD-RW BDR-207M 1.21 PQ: 0 ANSI= : 5 Link: https://lore.kernel.org/r/YahpKVR+McJVDdkD@work Reported-by: Sam Bingner Tested-by: Sam Bingner Tested-by: Yifeng Li Signed-off-by: Yifeng Li Signed-off-by: Bjorn Helgaas Reviewed-by: Krzysztof Wilczy=C5=84ski Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/pci/quirks.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -3916,6 +3916,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_M quirk_dma_func1_alias); DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123, quirk_dma_func1_alias); +/* https://bugzilla.kernel.org/show_bug.cgi?id=3D42679#c136 */ +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9125, + quirk_dma_func1_alias); DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128, quirk_dma_func1_alias); /* https://bugzilla.kernel.org/show_bug.cgi?id=3D42679#c14 */ From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5AF97C4332F for ; Mon, 24 Jan 2022 18:57:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245734AbiAXS5l (ORCPT ); Mon, 24 Jan 2022 13:57:41 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:54456 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242579AbiAXSzW (ORCPT ); Mon, 24 Jan 2022 13:55:22 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 797BC61546; Mon, 24 Jan 2022 18:55:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 47CAFC340E5; Mon, 24 Jan 2022 18:55:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050520; bh=zI/1cUxs2Lx51Wv//L7ZwxnwEnotIG2j9eMjB/HmDbw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QI+9nn6GRqv3r7qUNv/7rKSx2bZEvVDlL7qI3WVanmQj7tXpQXeW1UdU/ewhOlLQv P0EexLUEdI9ces1gqrqdTOk0AsVo91sgf8CyolC9APu2LyrduupommNlUC4Xol3AB0 twAbVFRpuEuhP8kfm6wANBEhQh9kCefNHzizmew4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gang Li , Muchun Song , "Kirill A. Shutemov" , Hugh Dickins , Andrew Morton , Linus Torvalds Subject: [PATCH 4.9 028/157] shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode Date: Mon, 24 Jan 2022 19:41:58 +0100 Message-Id: <20220124183933.687407653@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Gang Li commit 62c9827cbb996c2c04f615ecd783ce28bcea894b upstream. Fix a data race in commit 779750d20b93 ("shmem: split huge pages beyond i_size under memory pressure"). Here are call traces causing race: Call Trace 1: shmem_unused_huge_shrink+0x3ae/0x410 ? __list_lru_walk_one.isra.5+0x33/0x160 super_cache_scan+0x17c/0x190 shrink_slab.part.55+0x1ef/0x3f0 shrink_node+0x10e/0x330 kswapd+0x380/0x740 kthread+0xfc/0x130 ? mem_cgroup_shrink_node+0x170/0x170 ? kthread_create_on_node+0x70/0x70 ret_from_fork+0x1f/0x30 Call Trace 2: shmem_evict_inode+0xd8/0x190 evict+0xbe/0x1c0 do_unlinkat+0x137/0x330 do_syscall_64+0x76/0x120 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 A simple explanation: Image there are 3 items in the local list (@list). In the first traversal, A is not deleted from @list. 1) A->B->C ^ | pos (leave) In the second traversal, B is deleted from @list. Concurrently, A is deleted from @list through shmem_evict_inode() since last reference counter of inode is dropped by other thread. Then the @list is corrupted. 2) A->B->C ^ ^ | | evict pos (drop) We should make sure the inode is either on the global list or deleted from any local list before iput(). Fixed by moving inodes back to global list before we put them. [akpm@linux-foundation.org: coding style fixes] Link: https://lkml.kernel.org/r/20211125064502.99983-1-ligang.bdlg@bytedanc= e.com Fixes: 779750d20b93 ("shmem: split huge pages beyond i_size under memory pr= essure") Signed-off-by: Gang Li Reviewed-by: Muchun Song Acked-by: Kirill A. Shutemov Cc: Hugh Dickins Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- mm/shmem.c | 37 +++++++++++++++++++++---------------- 1 file changed, 21 insertions(+), 16 deletions(-) --- a/mm/shmem.c +++ b/mm/shmem.c @@ -436,7 +436,7 @@ static unsigned long shmem_unused_huge_s struct shmem_inode_info *info; struct page *page; unsigned long batch =3D sc ? sc->nr_to_scan : 128; - int removed =3D 0, split =3D 0; + int split =3D 0; =20 if (list_empty(&sbinfo->shrinklist)) return SHRINK_STOP; @@ -451,7 +451,6 @@ static unsigned long shmem_unused_huge_s /* inode is about to be evicted */ if (!inode) { list_del_init(&info->shrinklist); - removed++; goto next; } =20 @@ -459,12 +458,12 @@ static unsigned long shmem_unused_huge_s if (round_up(inode->i_size, PAGE_SIZE) =3D=3D round_up(inode->i_size, HPAGE_PMD_SIZE)) { list_move(&info->shrinklist, &to_remove); - removed++; goto next; } =20 list_move(&info->shrinklist, &list); next: + sbinfo->shrinklist_len--; if (!--batch) break; } @@ -484,7 +483,7 @@ next: inode =3D &info->vfs_inode; =20 if (nr_to_split && split >=3D nr_to_split) - goto leave; + goto move_back; =20 page =3D find_get_page(inode->i_mapping, (inode->i_size & HPAGE_PMD_MASK) >> PAGE_SHIFT); @@ -498,38 +497,44 @@ next: } =20 /* - * Leave the inode on the list if we failed to lock - * the page at this time. + * Move the inode on the list back to shrinklist if we failed + * to lock the page at this time. * * Waiting for the lock may lead to deadlock in the * reclaim path. */ if (!trylock_page(page)) { put_page(page); - goto leave; + goto move_back; } =20 ret =3D split_huge_page(page); unlock_page(page); put_page(page); =20 - /* If split failed leave the inode on the list */ + /* If split failed move the inode on the list back to shrinklist */ if (ret) - goto leave; + goto move_back; =20 split++; drop: list_del_init(&info->shrinklist); - removed++; -leave: + goto put; +move_back: + /* + * Make sure the inode is either on the global list or deleted + * from any local list before iput() since it could be deleted + * in another thread once we put the inode (then the local list + * is corrupted). + */ + spin_lock(&sbinfo->shrinklist_lock); + list_move(&info->shrinklist, &sbinfo->shrinklist); + sbinfo->shrinklist_len++; + spin_unlock(&sbinfo->shrinklist_lock); +put: iput(inode); } =20 - spin_lock(&sbinfo->shrinklist_lock); - list_splice_tail(&list, &sbinfo->shrinklist); - sbinfo->shrinklist_len -=3D removed; - spin_unlock(&sbinfo->shrinklist_lock); - return split; } =20 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0124C433EF for ; Mon, 24 Jan 2022 19:01:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345147AbiAXS7w (ORCPT ); Mon, 24 Jan 2022 13:59:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44704 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343508AbiAXS5J (ORCPT ); Mon, 24 Jan 2022 13:57:09 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 93977C06175B; Mon, 24 Jan 2022 10:55:26 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5D71CB8121F; Mon, 24 Jan 2022 18:55:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8AE7DC340E5; Mon, 24 Jan 2022 18:55:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050524; bh=Us75XI7l1VTBnBYvjSJriVtvVpSWcfd0l6dAH8GK9QU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XHKfwLkiCxp6SGf5nQ0g7P41bCeFs3YnQcgcBvmKhsyY3YXayuJ1n6Z7fXMUDqTIS GtL6li6vbN0HnfGMdnYMIS/NpckCaCkUN6AgZhsG93NhRbhaMHHgkN2rmWYqITjE7H hq/URxFKg2O52ZI22HpUhcC/bWRGdcaxlAj2ZWoE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wang Hai , Marcel Holtmann , Sasha Levin Subject: [PATCH 4.9 029/157] Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails Date: Mon, 24 Jan 2022 19:41:59 +0100 Message-Id: <20220124183933.720677033@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wang Hai [ Upstream commit 2a7ca7459d905febf519163bd9e3eed894de6bb7 ] I got a kernel BUG report when doing fault injection test: Reported-by: Hulk Robot Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:45! ... RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d ... Call Trace: proto_unregister+0x83/0x220 cmtp_cleanup_sockets+0x37/0x40 [cmtp] cmtp_exit+0xe/0x1f [cmtp] do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns success. This will cause a kernel bug when accessing uncreated ctmp related data when the module exits. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Hulk Robot Signed-off-by: Wang Hai Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin --- net/bluetooth/cmtp/core.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c index 0bb150e68c53f..e2e580c747f4b 100644 --- a/net/bluetooth/cmtp/core.c +++ b/net/bluetooth/cmtp/core.c @@ -499,9 +499,7 @@ static int __init cmtp_init(void) { BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION); =20 - cmtp_init_sockets(); - - return 0; + return cmtp_init_sockets(); } =20 static void __exit cmtp_exit(void) --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8E9BC4321E for ; Mon, 24 Jan 2022 19:01:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345169AbiAXS7y (ORCPT ); Mon, 24 Jan 2022 13:59:54 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44220 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344085AbiAXS5P (ORCPT ); Mon, 24 Jan 2022 13:57:15 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4260DC061765; Mon, 24 Jan 2022 10:55:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D7B4E614DF; Mon, 24 Jan 2022 18:55:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B50D4C340E5; Mon, 24 Jan 2022 18:55:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050527; bh=LkWRsFK9aS7oNkjHvVcPCtvA/eUHuU3Kl8vHPnMu2YU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wq0MkcAGhkbKN6ndCfWB+FtEzHOdd4qLQfxBJXtUtsnRrOUYjtcspAOGVqD/4SJIF +baAg1fmuh3PRwaiiIGadMs12Wo7kncJSnHK/2vhz3FTXwuAB5vfOiLktBWqXpDIMN tQUNoHA93/EdmUKcXwHhRXEh+GtmHyF7u2XEsFPQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bryan ODonoghue , Kalle Valo , Sasha Levin Subject: [PATCH 4.9 030/157] wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND Date: Mon, 24 Jan 2022 19:42:00 +0100 Message-Id: <20220124183933.759384695@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bryan O'Donoghue [ Upstream commit 588b45c88ae130fe373a8c50edaf54735c3f4fe3 ] Firmware can trigger a missed beacon indication, this is not the same as a lost signal. Flag to Linux the missed beacon and let the WiFi stack decide for itself if the link is up or down by sending its own probe to determine this. We should only be signalling the link is lost when the firmware indicates Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680= hardware") Signed-off-by: Bryan O'Donoghue Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20211027232529.657764-1-bryan.odonoghue@lin= aro.org Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/wireless/ath/wcn36xx/smd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/= ath/wcn36xx/smd.c index 914c210c9e605..da2f442cab271 100644 --- a/drivers/net/wireless/ath/wcn36xx/smd.c +++ b/drivers/net/wireless/ath/wcn36xx/smd.c @@ -2052,7 +2052,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36= xx *wcn, wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n", tmp->bss_index); vif =3D wcn36xx_priv_to_vif(tmp); - ieee80211_connection_loss(vif); + ieee80211_beacon_loss(vif); } return 0; } @@ -2067,7 +2067,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36= xx *wcn, wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n", rsp->bss_index); vif =3D wcn36xx_priv_to_vif(tmp); - ieee80211_connection_loss(vif); + ieee80211_beacon_loss(vif); return 0; } } --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F836C433EF for ; Mon, 24 Jan 2022 19:05:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345986AbiAXTEx (ORCPT ); Mon, 24 Jan 2022 14:04:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43970 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344554AbiAXS6D (ORCPT ); Mon, 24 Jan 2022 13:58:03 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 07FD6C0613E8; Mon, 24 Jan 2022 10:55:33 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B85CAB8122C; Mon, 24 Jan 2022 18:55:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C696FC340E5; Mon, 24 Jan 2022 18:55:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050530; bh=6eJMNFLC4J4YXEf8UTR8rPyP5Sm6y2D30rxDWjAaccU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RlLBnA6vHwwoO2gTXb6t8kzAqOnlnN1xMYgnqz+guPypnl4xrautXQE11f+mA86Q4 P15imPggJTp68hERIggNIaEIozQ6ytpegSr1Y5opRb1P026QIGKtZsBlzzE6W+QPYB yjRjxpIl2st27GJkxbnuWZH9/6bMAmSv6ecnxbUo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Marcel Holtmann , Sasha Levin , syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com Subject: [PATCH 4.9 031/157] Bluetooth: stop proccessing malicious adv data Date: Mon, 24 Jan 2022 19:42:01 +0100 Message-Id: <20220124183933.790385755@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin [ Upstream commit 3a56ef719f0b9682afb8a86d64b2399e36faa4e6 ] Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The problem was in missing validaion check. We should check if data is not malicious and we can read next data block. If we won't check ptr validness, code can read a way beyond skb->end and it can cause problems, of course. Fixes: e95beb414168 ("Bluetooth: hci_le_adv_report_evt code refactoring") Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.c= om Signed-off-by: Pavel Skripkin Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- net/bluetooth/hci_event.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index f9484755a9baf..17cfd9f8e98e0 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -4967,7 +4967,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hde= v, struct sk_buff *skb) struct hci_ev_le_advertising_info *ev =3D ptr; s8 rssi; =20 - if (ev->length <=3D HCI_MAX_AD_LENGTH) { + if (ev->length <=3D HCI_MAX_AD_LENGTH && + ev->data + ev->length <=3D skb_tail_pointer(skb)) { rssi =3D ev->data[ev->length]; process_adv_report(hdev, ev->evt_type, &ev->bdaddr, ev->bdaddr_type, NULL, 0, rssi, @@ -4977,6 +4978,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hd= ev, struct sk_buff *skb) } =20 ptr +=3D sizeof(*ev) + ev->length + 1; + + if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) { + bt_dev_err(hdev, "Malicious advertising data. Stopping processing"); + break; + } } =20 hci_dev_unlock(hdev); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86592C433FE for ; Mon, 24 Jan 2022 19:05:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346092AbiAXTFD (ORCPT ); Mon, 24 Jan 2022 14:05:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44046 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343948AbiAXS6m (ORCPT ); Mon, 24 Jan 2022 13:58:42 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1AC20C0617BD; Mon, 24 Jan 2022 10:55:36 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D7805B8121F; Mon, 24 Jan 2022 18:55:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0AAFC340E5; Mon, 24 Jan 2022 18:55:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050533; bh=Z4nxAGJ3zNBXE1ZFPZ/Q4sjK2iny9EAwaDNANlUTFik=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EM6a3ANhzO9vWEnLRTaqyiMYqiHBNHlbLhCZycGIfWtLqC9Yeisd0wDBHO3HsPep4 dBCi8MnI7bgbfjJvFXWoS13NZrNLApgAGNpbLzsmt5cwhm4icTIcegulssPQJlGFm0 MBeoCjL9FAzNOdDDBd+VCcQL/wgv4FjAlPMlBRqU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wang Hai , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.9 032/157] media: dmxdev: fix UAF when dvb_register_device() fails Date: Mon, 24 Jan 2022 19:42:02 +0100 Message-Id: <20220124183933.821294735@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wang Hai [ Upstream commit ab599eb11882f834951c436cc080c3455ba32b9b ] I got a use-after-free report: dvbdev: dvb_register_device: failed to create device dvb1.dvr0 (-12) ... =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in dvb_dmxdev_release+0xce/0x2f0 ... Call Trace: dump_stack_lvl+0x6c/0x8b print_address_description.constprop.0+0x48/0x70 kasan_report.cold+0x82/0xdb __asan_load4+0x6b/0x90 dvb_dmxdev_release+0xce/0x2f0 ... Allocated by task 7666: kasan_save_stack+0x23/0x50 __kasan_kmalloc+0x83/0xa0 kmem_cache_alloc_trace+0x22e/0x470 dvb_register_device+0x12f/0x980 dvb_dmxdev_init+0x1f3/0x230 ... Freed by task 7666: kasan_save_stack+0x23/0x50 kasan_set_track+0x20/0x30 kasan_set_free_info+0x24/0x40 __kasan_slab_free+0xf2/0x130 kfree+0xd1/0x5c0 dvb_register_device.cold+0x1ac/0x1fa dvb_dmxdev_init+0x1f3/0x230 ... When dvb_register_device() in dvb_dmxdev_init() fails, dvb_dmxdev_init() does not return a failure, and the memory pointed to by dvbdev or dvr_dvbdev is invalid at this point. If they are used subsequently, it will result in UFA or null-ptr-deref. If dvb_register_device() in dvb_dmxdev_init() fails, fix the bug by making dvb_dmxdev_init() return an error as well. Link: https://lore.kernel.org/linux-media/20211015085741.1203283-1-wanghai3= 8@huawei.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Hulk Robot Signed-off-by: Wang Hai Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/dvb-core/dmxdev.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxde= v.c index 0418b5a0fb645..32a2e6ffdb097 100644 --- a/drivers/media/dvb-core/dmxdev.c +++ b/drivers/media/dvb-core/dmxdev.c @@ -1225,7 +1225,7 @@ static const struct dvb_device dvbdev_dvr =3D { }; int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter) { - int i; + int i, ret; =20 if (dmxdev->demux->open(dmxdev->demux) < 0) return -EUSERS; @@ -1243,14 +1243,26 @@ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct d= vb_adapter *dvb_adapter) DMXDEV_STATE_FREE); } =20 - dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev, + ret =3D dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, = dmxdev, DVB_DEVICE_DEMUX, dmxdev->filternum); - dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, + if (ret < 0) + goto err_register_dvbdev; + + ret =3D dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, dmxdev, DVB_DEVICE_DVR, dmxdev->filternum); + if (ret < 0) + goto err_register_dvr_dvbdev; =20 dvb_ringbuffer_init(&dmxdev->dvr_buffer, NULL, 8192); =20 return 0; + +err_register_dvr_dvbdev: + dvb_unregister_device(dmxdev->dvbdev); +err_register_dvbdev: + vfree(dmxdev->filter); + dmxdev->filter =3D NULL; + return ret; } =20 EXPORT_SYMBOL(dvb_dmxdev_init); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7049CC433EF for ; Mon, 24 Jan 2022 18:57:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344500AbiAXS5t (ORCPT ); Mon, 24 Jan 2022 13:57:49 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53492 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343516AbiAXSzj (ORCPT ); Mon, 24 Jan 2022 13:55:39 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 12DF9B8121D; Mon, 24 Jan 2022 18:55:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 413B9C340E5; Mon, 24 Jan 2022 18:55:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050536; bh=2oJQ6ThJe2gdSrrrORMLu8Meow0HMdp7Eylv6Q47zng=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mhy68iMT+KScqpT4i10dlQGFmXC5VJWY0/AUvUJPbuCIn0OfxjYHhqgb4mGBKWoUd /elaSl8j5ur4NhkkMSR2hnm4Oc9S6GaH+aI2buTjeN1PEkky1iDOU1d8E2hFtWhFLa PmlZXOg+faWAvRhDlyq77kwJW2xrdjSllantxoSg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengfeng Ye , Thara Gopinath , Herbert Xu , Sasha Levin Subject: [PATCH 4.9 033/157] crypto: qce - fix uaf on qce_ahash_register_one Date: Mon, 24 Jan 2022 19:42:03 +0100 Message-Id: <20220124183933.852827950@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengfeng Ye [ Upstream commit b4cb4d31631912842eb7dce02b4350cbb7562d5e ] Pointer base points to sub field of tmpl, it is dereferenced after tmpl is freed. Fix this by accessing base before free tmpl. Fixes: ec8f5d8f ("crypto: qce - Qualcomm crypto engine driver") Signed-off-by: Chengfeng Ye Acked-by: Thara Gopinath Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/crypto/qce/sha.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c index 47e114ac09d01..ff1e788f92767 100644 --- a/drivers/crypto/qce/sha.c +++ b/drivers/crypto/qce/sha.c @@ -544,8 +544,8 @@ static int qce_ahash_register_one(const struct qce_ahas= h_def *def, =20 ret =3D crypto_register_ahash(alg); if (ret) { - kfree(tmpl); dev_err(qce->dev, "%s registration failed\n", base->cra_name); + kfree(tmpl); return ret; } =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1AEC3C433F5 for ; Mon, 24 Jan 2022 18:57:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343808AbiAXS5v (ORCPT ); Mon, 24 Jan 2022 13:57:51 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:54894 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344025AbiAXSzl (ORCPT ); Mon, 24 Jan 2022 13:55:41 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5DD79614DF; Mon, 24 Jan 2022 18:55:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2FFDAC340EA; Mon, 24 Jan 2022 18:55:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050539; bh=N5i4yPkMGOGZWPx39tArLwVI6Joe3fpdUu7DUezqYmo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dPvGtnQUt99QGJAnX6Ho95/aMaD5oQGeJi9RLVGyLMTqoyhU/vGKEp9aF+5Z6x1fW IWHZRTm/my1UaiRTPbhPYARKTwQOcTqtkeXGgm3OttCYBffTN7fUJExqqLj9jPFy2R UXBSs13C0hYhKPThqqGNsswYvmcRownaa0eAzDwQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Richard Genoud , Sasha Levin Subject: [PATCH 4.9 034/157] tty: serial: atmel: Check return code of dmaengine_submit() Date: Mon, 24 Jan 2022 19:42:04 +0100 Message-Id: <20220124183933.886617946@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus [ Upstream commit 1e67bd2b8cb90b66e89562598e9c2046246832d3 ] The tx_submit() method of struct dma_async_tx_descriptor is entitled to do sanity checks and return errors if encountered. It's not the case for the DMA controller drivers that this client is using (at_h/xdmac), because they currently don't do sanity checks and always return a positive cookie at tx_submit() method. In case the controller drivers will implement sanity checks and return errors, print a message so that the client will be informed that something went wrong at tx_submit() level. Fixes: 08f738be88bb ("serial: at91: add tx dma support") Signed-off-by: Tudor Ambarus Acked-by: Richard Genoud Link: https://lore.kernel.org/r/20211125090028.786832-3-tudor.ambarus@micro= chip.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/tty/serial/atmel_serial.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_s= erial.c index 4a7eb85f7c857..4aaafc88a151b 100644 --- a/drivers/tty/serial/atmel_serial.c +++ b/drivers/tty/serial/atmel_serial.c @@ -928,6 +928,11 @@ static void atmel_tx_dma(struct uart_port *port) desc->callback =3D atmel_complete_tx_dma; desc->callback_param =3D atmel_port; atmel_port->cookie_tx =3D dmaengine_submit(desc); + if (dma_submit_error(atmel_port->cookie_tx)) { + dev_err(port->dev, "dma_submit_error %d\n", + atmel_port->cookie_tx); + return; + } } =20 if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) @@ -1186,6 +1191,11 @@ static int atmel_prepare_rx_dma(struct uart_port *po= rt) desc->callback_param =3D port; atmel_port->desc_rx =3D desc; atmel_port->cookie_rx =3D dmaengine_submit(desc); + if (dma_submit_error(atmel_port->cookie_rx)) { + dev_err(port->dev, "dma_submit_error %d\n", + atmel_port->cookie_rx); + goto chan_err; + } =20 return 0; =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C82E6C433FE for ; Mon, 24 Jan 2022 19:02:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345048AbiAXTCc (ORCPT ); Mon, 24 Jan 2022 14:02:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44552 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344617AbiAXS6n (ORCPT ); Mon, 24 Jan 2022 13:58:43 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 40734C06138E; Mon, 24 Jan 2022 10:55:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D27B661507; Mon, 24 Jan 2022 18:55:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4566DC340E5; Mon, 24 Jan 2022 18:55:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050543; bh=JTtng4QJ7NBHFBumRNtIbeLMQ3MADqJF9nWIPqFjPPI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TWc1hGO/oo3FbSgmOyivifaeUQhYs8KdffhsATiv8Rvwafb7NVXuNEmwV7Jyk5Ieu tF082ex/VXIf4fm1pu3CpHePZQiatZPGwO/rFZE5HKs5jQ41OMGrTaIM90AtmAfA4b KtIlk/NB8tt+4pwMEFJkp7ohdwPDvCSw5V1wLnOo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Sasha Levin Subject: [PATCH 4.9 035/157] tty: serial: atmel: Call dma_async_issue_pending() Date: Mon, 24 Jan 2022 19:42:05 +0100 Message-Id: <20220124183933.917721224@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus [ Upstream commit 4f4b9b5895614eb2e2b5f4cab7858f44bd113e1b ] The driver wrongly assummed that tx_submit() will start the transfer, which is not the case, now that the at_xdmac driver is fixed. tx_submit is supposed to push the current transaction descriptor to a pending queue, waiting for issue_pending to be called. issue_pending must start the transfer, not tx_submit. Fixes: 34df42f59a60 ("serial: at91: add rx dma support") Fixes: 08f738be88bb ("serial: at91: add tx dma support") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211125090028.786832-4-tudor.ambarus@micro= chip.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/tty/serial/atmel_serial.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_s= erial.c index 4aaafc88a151b..5dd04a1145b40 100644 --- a/drivers/tty/serial/atmel_serial.c +++ b/drivers/tty/serial/atmel_serial.c @@ -933,6 +933,8 @@ static void atmel_tx_dma(struct uart_port *port) atmel_port->cookie_tx); return; } + + dma_async_issue_pending(chan); } =20 if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) @@ -1197,6 +1199,8 @@ static int atmel_prepare_rx_dma(struct uart_port *por= t) goto chan_err; } =20 + dma_async_issue_pending(atmel_port->chan_rx); + return 0; =20 chan_err: --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24763C433EF for ; Mon, 24 Jan 2022 18:58:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344195AbiAXS6I (ORCPT ); Mon, 24 Jan 2022 13:58:08 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53666 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343642AbiAXSzw (ORCPT ); Mon, 24 Jan 2022 13:55:52 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DF87EB8121B; Mon, 24 Jan 2022 18:55:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 22693C340E5; Mon, 24 Jan 2022 18:55:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050549; bh=tE9mdAFFt751Py3IuTt7RHTt7U7FMIfiWEJmBQ1SPbc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vtwbLCfT8QLj1eAKz0NgzU/yy2fZTYGLT7yCH8pF3Z6NxZd02P7UYJ3340GIbmCya Ky7p0Pg5RJdbALhJ+t0KzXyelYpVeJeqCGPvzhyQv9Va2V35pQFwCKOU8wKQRH21eD 4cce7L5EqgYHpYmftVIart/OKLu2Ju2SCLkwmPN0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Florian Westphal , Pablo Neira Ayuso , Sasha Levin , Amish Chana Subject: [PATCH 4.9 036/157] netfilter: bridge: add support for pppoe filtering Date: Mon, 24 Jan 2022 19:42:06 +0100 Message-Id: <20220124183933.950801836@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal [ Upstream commit 28b78ecffea8078d81466b2e01bb5a154509f1ba ] This makes 'bridge-nf-filter-pppoe-tagged' sysctl work for bridged traffic. Looking at the original commit it doesn't appear this ever worked: static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *= *pskb, [..] if (skb->protocol =3D=3D htons(ETH_P_8021Q)) { skb_pull(skb, VLAN_HLEN); skb->network_header +=3D VLAN_HLEN; + } else if (skb->protocol =3D=3D htons(ETH_P_PPP_SES)) { + skb_pull(skb, PPPOE_SES_HLEN); + skb->network_header +=3D PPPOE_SES_HLEN; } [..] NF_HOOK(... POST_ROUTING, ...) ... but the adjusted offsets are never restored. The alternative would be to rip this code out for good, but otoh we'd have to keep this anyway for the vlan handling (which works because vlan tag info is in the skb, not the packet payload). Reported-and-tested-by: Amish Chana Fixes: 516299d2f5b6f97 ("[NETFILTER]: bridge-nf: filter bridged IPv4/IPv6 e= ncapsulated in pppoe traffic") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- net/bridge/br_netfilter_hooks.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hook= s.c index 7104d5e64abb3..11d4d18012fed 100644 --- a/net/bridge/br_netfilter_hooks.c +++ b/net/bridge/br_netfilter_hooks.c @@ -724,6 +724,9 @@ static int br_nf_dev_queue_xmit(struct net *net, struct= sock *sk, struct sk_buff if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu) mtu =3D nf_bridge->frag_max_size; =20 + nf_bridge_update_protocol(skb); + nf_bridge_push_encap_header(skb); + if (skb_is_gso(skb) || skb->len + mtu_reserved <=3D mtu) { nf_bridge_info_free(skb); return br_dev_queue_push_xmit(net, sk, skb); @@ -741,8 +744,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct= sock *sk, struct sk_buff =20 IPCB(skb)->frag_max_size =3D nf_bridge->frag_max_size; =20 - nf_bridge_update_protocol(skb); - data =3D this_cpu_ptr(&brnf_frag_data_storage); =20 data->vlan_tci =3D skb->vlan_tci; @@ -765,8 +766,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct= sock *sk, struct sk_buff =20 IP6CB(skb)->frag_max_size =3D nf_bridge->frag_max_size; =20 - nf_bridge_update_protocol(skb); - data =3D this_cpu_ptr(&brnf_frag_data_storage); data->encap_size =3D nf_bridge_encap_header_len(skb); data->size =3D ETH_HLEN + data->encap_size; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F8E8C433EF for ; Mon, 24 Jan 2022 18:58:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343611AbiAXS6L (ORCPT ); Mon, 24 Jan 2022 13:58:11 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53702 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343873AbiAXSzz (ORCPT ); Mon, 24 Jan 2022 13:55:55 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 46DA7B8122C; Mon, 24 Jan 2022 18:55:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5337CC340E5; Mon, 24 Jan 2022 18:55:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050553; bh=85ZKOly/jIKhJSM2YyWDUxBKNqjNm1US5//guO2uhV0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p17Pan8pnlHGLDywaUKf5OGdO5TrpvZLOfbkLYNy8dOzkQu48VJvbgBgj47BaLTxS kU1ozh47RXBS0QmJGjngoG0iH1elsdvkZ+gkpj3halimeDnws558ehbnMbc6z2fAsO EcPxkK0t1s4P2iBaOxFfod7kwkPf+Qnzq/mnCM8c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Baryshkov , Bjorn Andersson , Sasha Levin Subject: [PATCH 4.9 037/157] arm64: dts: qcom: msm8916: fix MMC controller aliases Date: Mon, 24 Jan 2022 19:42:07 +0100 Message-Id: <20220124183933.980599336@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dmitry Baryshkov [ Upstream commit b0293c19d42f6d6951c2fab9a47fed50baf2c14d ] Change sdhcN aliases to mmcN to make them actually work. Currently the board uses non-standard aliases sdhcN, which do not work, resulting in mmc0 and mmc1 hosts randomly changing indices between boots. Fixes: c4da5a561627 ("arm64: dts: qcom: Add msm8916 sdhci configuration nod= es") Signed-off-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20211201020559.1611890-1-dmitry.baryshkov@l= inaro.org Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qc= om/msm8916.dtsi index c2557cf43b3dc..d8bf83d732be3 100644 --- a/arch/arm64/boot/dts/qcom/msm8916.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi @@ -25,8 +25,8 @@ #size-cells =3D <2>; =20 aliases { - sdhc1 =3D &sdhc_1; /* SDC1 eMMC slot */ - sdhc2 =3D &sdhc_2; /* SDC2 SD card slot */ + mmc0 =3D &sdhc_1; /* SDC1 eMMC slot */ + mmc1 =3D &sdhc_2; /* SDC2 SD card slot */ }; =20 chosen { }; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3587FC433F5 for ; Mon, 24 Jan 2022 19:02:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344905AbiAXTCU (ORCPT ); Mon, 24 Jan 2022 14:02:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44592 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344652AbiAXS6r (ORCPT ); Mon, 24 Jan 2022 13:58:47 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CC5FFC0613AA; Mon, 24 Jan 2022 10:55:58 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 92211B81232; Mon, 24 Jan 2022 18:55:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A6AC1C340E5; Mon, 24 Jan 2022 18:55:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050556; bh=D7sd48NRqJ8w9AVxw+DsqmoMe7eXTNl0cdZocun+HFk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i+UM0CuJfWjU1W7h/xt62S/0ibSW8xkWTAnJVT2350Vs17PWdgaSYnjliFYo1ClQ9 +mh9lJsRZQ2xvG5y0aGagQZmSeASJWYPL7cmd6DfFNxGgfdSP1daOlcXuMiuECYqww MLTaqjteRc86rLkgZ+Sy4Oo41MDxgjQMwTK0SYic= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Alex Deucher , Sasha Levin Subject: [PATCH 4.9 038/157] drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() Date: Mon, 24 Jan 2022 19:42:08 +0100 Message-Id: <20220124183934.010734423@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit b220110e4cd442156f36e1d9b4914bb9e87b0d00 ] In amdgpu_connector_lcd_native_mode(), the return value of drm_mode_duplicate() is assigned to mode, and there is a dereference of it in amdgpu_connector_lcd_native_mode(), which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Fix this bug add a check of mode. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_DRM_AMDGPU=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") Signed-off-by: Zhou Qingyang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/d= rm/amd/amdgpu/amdgpu_connectors.c index eb79d0d3d34f1..7264169d5f2a7 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c @@ -404,6 +404,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *en= coder) native_mode->vdisplay !=3D 0 && native_mode->clock !=3D 0) { mode =3D drm_mode_duplicate(dev, native_mode); + if (!mode) + return NULL; + mode->type =3D DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; drm_mode_set_name(mode); =20 @@ -418,6 +421,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *en= coder) * simpler. */ mode =3D drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay,= 60, true, false, false); + if (!mode) + return NULL; + mode->type =3D DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode= ->name); } --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70A07C433EF for ; Mon, 24 Jan 2022 18:58:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245340AbiAXS6W (ORCPT ); Mon, 24 Jan 2022 13:58:22 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:53486 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344144AbiAXS4B (ORCPT ); Mon, 24 Jan 2022 13:56:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E17FD6153F; Mon, 24 Jan 2022 18:55:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1754C340E5; Mon, 24 Jan 2022 18:55:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050559; bh=8CiU7b02IfI9DVn5xiIo5MTYuU5Jo6xdU+CHw3d+S2s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C1VScGEM3VmKUEjCfaSbVaa1vRRg1urLgA3QtVJkojolezYzuhO+EJrDnVCapoxbW RTyxgOEKl7ASFa12VwfdokGG+Ci0kobwC48H0y72UnkPtLFfgZG1zeNInhOg5jQlDA CIoJAfnGSF/jRTZFo+7bJSoEVsBXhkR391vxSDw8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Christian=20K=C3=B6nig?= , Zhou Qingyang , Alex Deucher , Sasha Levin Subject: [PATCH 4.9 039/157] drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() Date: Mon, 24 Jan 2022 19:42:09 +0100 Message-Id: <20220124183934.041026358@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Zhou Qingyang [ Upstream commit ab50cb9df8896b39aae65c537a30de2c79c19735 ] In radeon_driver_open_kms(), radeon_vm_bo_add() is assigned to vm->ib_bo_va and passes and used in radeon_vm_bo_set_addr(). In radeon_vm_bo_set_addr(), there is a dereference of vm->ib_bo_va, which could lead to a NULL pointer dereference on failure of radeon_vm_bo_add(). Fix this bug by adding a check of vm->ib_bo_va. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_DRM_RADEON=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: cc9e67e3d700 ("drm/radeon: fix VM IB handling") Reviewed-by: Christian K=C3=B6nig Signed-off-by: Zhou Qingyang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/gpu/drm/radeon/radeon_kms.c | 36 ++++++++++++++++------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/r= adeon_kms.c index 61000e3b2e793..e65afdc4838d2 100644 --- a/drivers/gpu/drm/radeon/radeon_kms.c +++ b/drivers/gpu/drm/radeon/radeon_kms.c @@ -630,6 +630,8 @@ void radeon_driver_lastclose_kms(struct drm_device *dev) int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_p= riv) { struct radeon_device *rdev =3D dev->dev_private; + struct radeon_fpriv *fpriv; + struct radeon_vm *vm; int r; =20 file_priv->driver_priv =3D NULL; @@ -642,8 +644,6 @@ int radeon_driver_open_kms(struct drm_device *dev, stru= ct drm_file *file_priv) =20 /* new gpu have virtual address space support */ if (rdev->family >=3D CHIP_CAYMAN) { - struct radeon_fpriv *fpriv; - struct radeon_vm *vm; =20 fpriv =3D kzalloc(sizeof(*fpriv), GFP_KERNEL); if (unlikely(!fpriv)) { @@ -654,35 +654,39 @@ int radeon_driver_open_kms(struct drm_device *dev, st= ruct drm_file *file_priv) if (rdev->accel_working) { vm =3D &fpriv->vm; r =3D radeon_vm_init(rdev, vm); - if (r) { - kfree(fpriv); - goto out_suspend; - } + if (r) + goto out_fpriv; =20 r =3D radeon_bo_reserve(rdev->ring_tmp_bo.bo, false); - if (r) { - radeon_vm_fini(rdev, vm); - kfree(fpriv); - goto out_suspend; - } + if (r) + goto out_vm_fini; =20 /* map the ib pool buffer read only into * virtual address space */ vm->ib_bo_va =3D radeon_vm_bo_add(rdev, vm, rdev->ring_tmp_bo.bo); + if (!vm->ib_bo_va) { + r =3D -ENOMEM; + goto out_vm_fini; + } + r =3D radeon_vm_bo_set_addr(rdev, vm->ib_bo_va, RADEON_VA_IB_OFFSET, RADEON_VM_PAGE_READABLE | RADEON_VM_PAGE_SNOOPED); - if (r) { - radeon_vm_fini(rdev, vm); - kfree(fpriv); - goto out_suspend; - } + if (r) + goto out_vm_fini; } file_priv->driver_priv =3D fpriv; } =20 + if (!r) + goto out_suspend; + +out_vm_fini: + radeon_vm_fini(rdev, vm); +out_fpriv: + kfree(fpriv); out_suspend: pm_runtime_mark_last_busy(dev->dev); pm_runtime_put_autosuspend(dev->dev); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0897EC433EF for ; Mon, 24 Jan 2022 19:02:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344945AbiAXTCY (ORCPT ); Mon, 24 Jan 2022 14:02:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344311AbiAXS6s (ORCPT ); Mon, 24 Jan 2022 13:58:48 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BB365C061401; Mon, 24 Jan 2022 10:56:04 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7993EB81232; Mon, 24 Jan 2022 18:56:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AFCB2C340E5; Mon, 24 Jan 2022 18:56:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050562; bh=ZUleYBx33pheNGvpCjLcbvgWBZOjmzP4MlgY3Ryw6IA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CsIRnK4aQFMErW9Xbvarvq12918/yYkR+eHb/QLg2tqbjx85WHaj5K+mupr04qVGw e22edk3dImbX3p7XcZ7xHmOeF9qjXZTj2t08jvABNja27EW77Di0F/RouoqHKaqN7h Y3G9nGRQ0XIYLaIHyC8c+Kpt25t3bOn462C0Gh/k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lino Sanfilippo , Sasha Levin Subject: [PATCH 4.9 040/157] serial: amba-pl011: do not request memory region twice Date: Mon, 24 Jan 2022 19:42:10 +0100 Message-Id: <20220124183934.070860739@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Lino Sanfilippo [ Upstream commit d1180405c7b5c7a1c6bde79d5fc24fe931430737 ] With commit 3873e2d7f63a ("drivers: PL011: refactor pl011_probe()") the function devm_ioremap() called from pl011_setup_port() was replaced with devm_ioremap_resource(). Since this function not only remaps but also requests the ports io memory region it now collides with the .config_port() callback which requests the same region at uart port registration. Since devm_ioremap_resource() already claims the memory successfully, the request in .config_port() fails. Later at uart port deregistration the attempt to release the unclaimed memory also fails. The failure results in a =E2=80=9CTrying to free nonexis= tent resource" warning. Fix these issues by removing the callbacks that implement the redundant memory allocation/release. Also make sure that changing the drivers io memory base address via TIOCSSERIAL is not allowed any more. Fixes: 3873e2d7f63a ("drivers: PL011: refactor pl011_probe()") Signed-off-by: Lino Sanfilippo Link: https://lore.kernel.org/r/20211129174238.8333-1-LinoSanfilippo@gmx.de Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/tty/serial/amba-pl011.c | 27 +++------------------------ 1 file changed, 3 insertions(+), 24 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl01= 1.c index e91bdd7d4c054..ad1d665e9962f 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -2090,32 +2090,13 @@ static const char *pl011_type(struct uart_port *por= t) return uap->port.type =3D=3D PORT_AMBA ? uap->type : NULL; } =20 -/* - * Release the memory region(s) being used by 'port' - */ -static void pl011_release_port(struct uart_port *port) -{ - release_mem_region(port->mapbase, SZ_4K); -} - -/* - * Request the memory region(s) being used by 'port' - */ -static int pl011_request_port(struct uart_port *port) -{ - return request_mem_region(port->mapbase, SZ_4K, "uart-pl011") - !=3D NULL ? 0 : -EBUSY; -} - /* * Configure/autoconfigure the port. */ static void pl011_config_port(struct uart_port *port, int flags) { - if (flags & UART_CONFIG_TYPE) { + if (flags & UART_CONFIG_TYPE) port->type =3D PORT_AMBA; - pl011_request_port(port); - } } =20 /* @@ -2130,6 +2111,8 @@ static int pl011_verify_port(struct uart_port *port, = struct serial_struct *ser) ret =3D -EINVAL; if (ser->baud_base < 9600) ret =3D -EINVAL; + if (port->mapbase !=3D (unsigned long) ser->iomem_base) + ret =3D -EINVAL; return ret; } =20 @@ -2147,8 +2130,6 @@ static struct uart_ops amba_pl011_pops =3D { .flush_buffer =3D pl011_dma_flush_buffer, .set_termios =3D pl011_set_termios, .type =3D pl011_type, - .release_port =3D pl011_release_port, - .request_port =3D pl011_request_port, .config_port =3D pl011_config_port, .verify_port =3D pl011_verify_port, #ifdef CONFIG_CONSOLE_POLL @@ -2178,8 +2159,6 @@ static const struct uart_ops sbsa_uart_pops =3D { .shutdown =3D sbsa_uart_shutdown, .set_termios =3D sbsa_uart_set_termios, .type =3D pl011_type, - .release_port =3D pl011_release_port, - .request_port =3D pl011_request_port, .config_port =3D pl011_config_port, .verify_port =3D pl011_verify_port, #ifdef CONFIG_CONSOLE_POLL --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6924C433EF for ; Mon, 24 Jan 2022 19:07:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345183AbiAXTG4 (ORCPT ); Mon, 24 Jan 2022 14:06:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44398 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345668AbiAXTAw (ORCPT ); Mon, 24 Jan 2022 14:00:52 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 351AEC061365; Mon, 24 Jan 2022 10:58:17 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CDD59B81235; Mon, 24 Jan 2022 18:58:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D7471C340E5; Mon, 24 Jan 2022 18:58:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050695; bh=l31NYPDy27HsQINdourGHA5+CrTxr1+qXptsDsZ7qy0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ccBx9IZTM1ODMIgWTYkCquGhUf0RnSOZYpCkfgknrDFVtlhj8uuROS0XGA8qoZZGy Mr2ENuGlUgEwpfhU6GDRsNkVeQ14PeComNjPgyZBnAAxkdTFcnYDjsQWJhJl/l0ykj mFz3EIPLe71sqr/7lhZs5KagFCiITggITPPP2S/k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tasos Sahanidis , Denis Efremov , Jens Axboe , Sasha Levin Subject: [PATCH 4.9 041/157] floppy: Fix hang in watchdog when disk is ejected Date: Mon, 24 Jan 2022 19:42:11 +0100 Message-Id: <20220124183934.101171195@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tasos Sahanidis [ Upstream commit fb48febce7e30baed94dd791e19521abd2c3fd83 ] When the watchdog detects a disk change, it calls cancel_activity(), which in turn tries to cancel the fd_timer delayed work. In the above scenario, fd_timer_fn is set to fd_watchdog(), meaning it is trying to cancel its own work. This results in a hang as cancel_delayed_work_sync() is waiting for the watchdog (itself) to return, which never happens. This can be reproduced relatively consistently by attempting to read a broken floppy, and ejecting it while IO is being attempted and retried. To resolve this, this patch calls cancel_delayed_work() instead, which cancels the work without waiting for the watchdog to return and finish. Before this regression was introduced, the code in this section used del_timer(), and not del_timer_sync() to delete the watchdog timer. Link: https://lore.kernel.org/r/399e486c-6540-db27-76aa-7a271b061f76@tasoss= ah.com Fixes: 070ad7e793dc ("floppy: convert to delayed work and single-thread wq") Signed-off-by: Tasos Sahanidis Signed-off-by: Denis Efremov Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/block/floppy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 4496e7a492352..d508dda49dee4 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -994,7 +994,7 @@ static DECLARE_DELAYED_WORK(fd_timer, fd_timer_workfn); static void cancel_activity(void) { do_floppy =3D NULL; - cancel_delayed_work_sync(&fd_timer); + cancel_delayed_work(&fd_timer); cancel_work_sync(&floppy_work); } =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3725EC433F5 for ; Mon, 24 Jan 2022 19:04:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344782AbiAXTEM (ORCPT ); Mon, 24 Jan 2022 14:04:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44538 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345175AbiAXS7z (ORCPT ); Mon, 24 Jan 2022 13:59:55 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BE4A8C061199; Mon, 24 Jan 2022 10:56:27 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5C422614C9; Mon, 24 Jan 2022 18:56:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 39F31C340E5; Mon, 24 Jan 2022 18:56:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050586; bh=vgwsl+jdADVz49FxFFVWrEoBGKT50PEO1EEbsNXfSf0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PcsJKDkLdIqDv+ZRtRnorhsnWwG4NERrUe0boQGVFBYU9WcrYgfdf05QlhmMTYzeF 4PT9F1JvIUigmX78pFXzAk8zsJk+J1fB8pvNYfEmsj0O6UwoHkSOJlyVNE6d+imZkN zCMirKZ1WSSWbKwiHdoybnBldMjuaseYljc1cwZs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.9 042/157] media: dib8000: Fix a memleak in dib8000_init() Date: Mon, 24 Jan 2022 19:42:12 +0100 Message-Id: <20220124183934.131078033@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 8dbdcc7269a83305ee9d677b75064d3530a48ee2 ] In dib8000_init(), the variable fe is not freed or passed out on the failure of dib8000_identify(&state->i2c), which could lead to a memleak. Fix this bug by adding a kfree of fe in the error path. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_DVB_DIB8000=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: 77e2c0f5d471 ("V4L/DVB (12900): DiB8000: added support for DiBcom IS= DB-T/ISDB-Tsb demodulator DiB8000") Signed-off-by: Zhou Qingyang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/dvb-frontends/dib8000.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-fron= tends/dib8000.c index ddf9c44877a25..ea2eab2d5be91 100644 --- a/drivers/media/dvb-frontends/dib8000.c +++ b/drivers/media/dvb-frontends/dib8000.c @@ -4462,8 +4462,10 @@ static struct dvb_frontend *dib8000_init(struct i2c_= adapter *i2c_adap, u8 i2c_ad =20 state->timf_default =3D cfg->pll->timf; =20 - if (dib8000_identify(&state->i2c) =3D=3D 0) + if (dib8000_identify(&state->i2c) =3D=3D 0) { + kfree(fe); goto error; + } =20 dibx000_init_i2c_master(&state->i2c_master, DIB8000, state->i2c.adap, sta= te->i2c.addr); =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DFA98C433EF for ; Mon, 24 Jan 2022 18:59:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343648AbiAXS7Y (ORCPT ); Mon, 24 Jan 2022 13:59:24 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:56110 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343495AbiAXS5D (ORCPT ); Mon, 24 Jan 2022 13:57:03 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3192D61562; Mon, 24 Jan 2022 18:57:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 121A0C36AEC; Mon, 24 Jan 2022 18:57:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050622; bh=R1Ks1+PCvdgWaCBScyCkSEWthZvRFUjY3tMhIVMKsH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xWANy4D5zsKryJ41O+4OoiPeu9BnquIToMJk2oxye22RC71HynKzbaY4O68GbmUI6 zTjnEPj1wPOjOTWVGMfVcMkutOGI7ML7Q6Al+B7G7pob/WBDnxMJvGR0NWihvxWPga sx2tnYHUkKOdzLtfaPMxXmCAsxfmLh8qjXYlFZQc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.9 043/157] media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() Date: Mon, 24 Jan 2022 19:42:13 +0100 Message-Id: <20220124183934.162201552@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 0407c49ebe330333478440157c640fffd986f41b ] In mxb_attach(dev, info), saa7146_vv_init() is called to allocate a new memory for dev->vv_data. saa7146_vv_release() will be called on failure of mxb_probe(dev). There is a dereference of dev->vv_data in saa7146_vv_release(), which could lead to a NULL pointer dereference on failure of saa7146_vv_init(). Fix this bug by adding a check of saa7146_vv_init(). This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_VIDEO_MXB=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: 03b1930efd3c ("V4L/DVB: saa7146: fix regression of the av7110/budget= -av driver") Signed-off-by: Zhou Qingyang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/pci/saa7146/mxb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mx= b.c index 3e8753c9e1e47..849c2a1d09f99 100644 --- a/drivers/media/pci/saa7146/mxb.c +++ b/drivers/media/pci/saa7146/mxb.c @@ -694,10 +694,16 @@ static struct saa7146_ext_vv vv_data; static int mxb_attach(struct saa7146_dev *dev, struct saa7146_pci_extensio= n_data *info) { struct mxb *mxb; + int ret; =20 DEB_EE("dev:%p\n", dev); =20 - saa7146_vv_init(dev, &vv_data); + ret =3D saa7146_vv_init(dev, &vv_data); + if (ret) { + ERR("Error in saa7146_vv_init()"); + return ret; + } + if (mxb_probe(dev)) { saa7146_vv_release(dev); return -1; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43EBCC433FE for ; Mon, 24 Jan 2022 19:01:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344601AbiAXTBn (ORCPT ); Mon, 24 Jan 2022 14:01:43 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:56694 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241958AbiAXS5i (ORCPT ); Mon, 24 Jan 2022 13:57:38 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E024961541; Mon, 24 Jan 2022 18:57:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A7EB2C340E5; Mon, 24 Jan 2022 18:57:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050657; bh=nfkrZ9vQdQXDle1iSPGaPmUkloG2VzjbMbrmFoaNN7s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LVNNRTFko74Fecs90MgWg52TCXeTV5ZfkPqSCuIb5b4Gbxh+htAkCOh01Ibfx5NZ2 Pjzwvjj8TDt1AWgytrZdUvyaNAf1XmnD9esRwmFRhrMqFGakjp9CLT9vgm8dE6bQkT Z67fV0Cn8LeFnE49lVo94CEdGt6tr2RmJWpbyTjo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert Schlabbach , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.9 044/157] media: si2157: Fix "warm" tuner state detection Date: Mon, 24 Jan 2022 19:42:14 +0100 Message-Id: <20220124183934.191880514@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Robert Schlabbach [ Upstream commit a6441ea29cb2c9314654e093a1cd8020b9b851c8 ] Commit e955f959ac52 ("media: si2157: Better check for running tuner in init") completely broke the "warm" tuner detection of the si2157 driver due to a simple endian error: The Si2157 CRYSTAL_TRIM property code is 0x0402 and needs to be transmitted LSB first. However, it was inserted MSB first, causing the warm detection to always fail and spam the kernel log with tuner initialization messages each time the DVB frontend device was closed and reopened: [ 312.215682] si2157 16-0060: found a 'Silicon Labs Si2157-A30' [ 312.264334] si2157 16-0060: firmware version: 3.0.5 [ 342.248593] si2157 16-0060: found a 'Silicon Labs Si2157-A30' [ 342.295743] si2157 16-0060: firmware version: 3.0.5 [ 372.328574] si2157 16-0060: found a 'Silicon Labs Si2157-A30' [ 372.385035] si2157 16-0060: firmware version: 3.0.5 Also, the reinitializations were observed disturb _other_ tuners on multi-tuner cards such as the Hauppauge WinTV-QuadHD, leading to missed or errored packets when one of the other DVB frontend devices on that card was opened. Fix the order of the property code bytes to make the warm detection work again, also reducing the tuner initialization message in the kernel log to once per power-on, as well as fixing the interference with other tuners. Link: https://lore.kernel.org/linux-media/trinity-2a86eb9d-6264-4387-95e1-b= a7b79a4050f-1638392923493@3c-app-gmx-bap03 Fixes: e955f959ac52 ("media: si2157: Better check for running tuner in init= ") Reported-by: Robert Schlabbach Signed-off-by: Robert Schlabbach Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/tuners/si2157.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c index 72a47da0db2ae..e56837414e2c7 100644 --- a/drivers/media/tuners/si2157.c +++ b/drivers/media/tuners/si2157.c @@ -89,7 +89,7 @@ static int si2157_init(struct dvb_frontend *fe) dev_dbg(&client->dev, "\n"); =20 /* Try to get Xtal trim property, to verify tuner still running */ - memcpy(cmd.args, "\x15\x00\x04\x02", 4); + memcpy(cmd.args, "\x15\x00\x02\x04", 4); cmd.wlen =3D 4; cmd.rlen =3D 4; ret =3D si2157_cmd_execute(client, &cmd); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3787C433F5 for ; Mon, 24 Jan 2022 19:05:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346389AbiAXTF1 (ORCPT ); Mon, 24 Jan 2022 14:05:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45446 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345496AbiAXTAV (ORCPT ); Mon, 24 Jan 2022 14:00:21 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D144CC0617A9; Mon, 24 Jan 2022 10:57:58 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8EA58B81227; Mon, 24 Jan 2022 18:57:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 94CB4C340E5; Mon, 24 Jan 2022 18:57:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050676; bh=5NY77zdV9ozn/+VEAlvfkSk/XENHtvV6igQMct3x6Ls=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lQaNuxM4oZGQh1j2icAQG+PnRTpPwRSjjuwuKgWTfkjVBCPB/laO4qcs7TPVcGN+d bIerxKSBhgAZZx7QrVe/+ngPfRNL/n9tRudn+1JaDNKmm56mrC9UG+kp8wtPHaRzwh ww5+ZD+G/Cw+N7NqcMXT2ZYflszIg3TU8UvbXvcw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wang Hai , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.9 045/157] media: msi001: fix possible null-ptr-deref in msi001_probe() Date: Mon, 24 Jan 2022 19:42:15 +0100 Message-Id: <20220124183934.223028602@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wang Hai [ Upstream commit 3d5831a40d3464eea158180eb12cbd81c5edfb6a ] I got a null-ptr-deref report: BUG: kernel NULL pointer dereference, address: 0000000000000060 ... RIP: 0010:v4l2_ctrl_auto_cluster+0x57/0x270 ... Call Trace: msi001_probe+0x13b/0x24b [msi001] spi_probe+0xeb/0x130 ... do_syscall_64+0x35/0xb0 In msi001_probe(), if the creation of control for bandwidth_auto fails, there will be a null-ptr-deref issue when it is used in v4l2_ctrl_auto_cluster(). Check dev->hdl.error before v4l2_ctrl_auto_cluster() to fix this bug. Link: https://lore.kernel.org/linux-media/20211026112348.2878040-1-wanghai3= 8@huawei.com Fixes: 93203dd6c7c4 ("[media] msi001: Mirics MSi001 silicon tuner driver") Reported-by: Hulk Robot Signed-off-by: Wang Hai Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/tuners/msi001.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/media/tuners/msi001.c b/drivers/media/tuners/msi001.c index 3a12ef35682b5..64d98517f470f 100644 --- a/drivers/media/tuners/msi001.c +++ b/drivers/media/tuners/msi001.c @@ -464,6 +464,13 @@ static int msi001_probe(struct spi_device *spi) V4L2_CID_RF_TUNER_BANDWIDTH_AUTO, 0, 1, 1, 1); dev->bandwidth =3D v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops, V4L2_CID_RF_TUNER_BANDWIDTH, 200000, 8000000, 1, 200000); + if (dev->hdl.error) { + ret =3D dev->hdl.error; + dev_err(&spi->dev, "Could not initialize controls\n"); + /* control init failed, free handler */ + goto err_ctrl_handler_free; + } + v4l2_ctrl_auto_cluster(2, &dev->bandwidth_auto, 0, false); dev->lna_gain =3D v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops, V4L2_CID_RF_TUNER_LNA_GAIN, 0, 1, 1, 1); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4D7CC4332F for ; Mon, 24 Jan 2022 19:06:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346425AbiAXTFc (ORCPT ); Mon, 24 Jan 2022 14:05:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44252 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345520AbiAXTAY (ORCPT ); Mon, 24 Jan 2022 14:00:24 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6DF58C061359; Mon, 24 Jan 2022 10:58:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0E2B461537; Mon, 24 Jan 2022 18:58:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BEC9FC340E7; Mon, 24 Jan 2022 18:57:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050679; bh=JmBD2R4rJpw1HEWs73qfuZLPYJpA6yiNXtyVg0d3xUc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UE0MpB+k55t0zRcwLbp6/85FPXc0mN65E55eTLOwv85ib1Gf9Euq+WPwdXjqB1Wn0 8k3jn9clcX3y1caQhdlGSKjTe/Boimf9gJUJqhHfUOKlJEcWeVpPln7YVZ2XDgBv+G VAKNzHefDuyayPnMtw+Mh16KJq+5osF2tfYNai8g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wei Yongjun , Sasha Levin Subject: [PATCH 4.9 046/157] usb: ftdi-elan: fix memory leak on device disconnect Date: Mon, 24 Jan 2022 19:42:16 +0100 Message-Id: <20220124183934.253859563@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wei Yongjun [ Upstream commit 1646566b5e0c556f779180a8514e521ac735de1e ] 'ftdi' is alloced when probe device, but not free on device disconnect, this cause a memory leak as follows: unreferenced object 0xffff88800d584000 (size 8400): comm "kworker/0:2", pid 3809, jiffies 4295453055 (age 13.784s) hex dump (first 32 bytes): 00 40 58 0d 80 88 ff ff 00 40 58 0d 80 88 ff ff .@X......@X..... 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. backtrace: [<000000000d47f947>] kmalloc_order_trace+0x19/0x110 mm/slab_common.c:960 [<000000008548ac68>] ftdi_elan_probe+0x8c/0x880 drivers/usb/misc/ftdi-e= lan.c:2647 [<000000007f73e422>] usb_probe_interface+0x31b/0x800 drivers/usb/core/d= river.c:396 [<00000000fe8d07fc>] really_probe+0x299/0xc30 drivers/base/dd.c:517 [<0000000005da7d32>] __driver_probe_device+0x357/0x500 drivers/base/dd.= c:751 [<000000003c2c9579>] driver_probe_device+0x4e/0x140 drivers/base/dd.c:7= 81 Fix it by freeing 'ftdi' after nobody use it. Fixes: a5c66e4b2418 ("USB: ftdi-elan: client driver for ELAN Uxxx adapters") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Link: https://lore.kernel.org/r/20211217083428.2441-1-weiyongjun1@huawei.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/usb/misc/ftdi-elan.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c index 9a82f8308ad7f..0738078fe8b82 100644 --- a/drivers/usb/misc/ftdi-elan.c +++ b/drivers/usb/misc/ftdi-elan.c @@ -206,6 +206,7 @@ static void ftdi_elan_delete(struct kref *kref) mutex_unlock(&ftdi_module_lock); kfree(ftdi->bulk_in_buffer); ftdi->bulk_in_buffer =3D NULL; + kfree(ftdi); } =20 static void ftdi_elan_put_kref(struct usb_ftdi *ftdi) --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D96F7C433F5 for ; Mon, 24 Jan 2022 19:06:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346006AbiAXTEz (ORCPT ); Mon, 24 Jan 2022 14:04:55 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:55930 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344568AbiAXS6F (ORCPT ); Mon, 24 Jan 2022 13:58:05 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 32804B8124B; Mon, 24 Jan 2022 18:58:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 14570C340E7; Mon, 24 Jan 2022 18:58:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050682; bh=IyEZm5VJ9DTUvGD5ch3pdHZ+oyGhrNtAXW8JkE7kfH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vH8qIMtzoL8JA/VQ/vI6GvytJJPsr43Qbt7FlRxLpZl5SkHZ3kixjchVrLFwVV2ib Gp51JgB6skfbOgZ/h1TxCiT2agl2AkWKE0/vXyll9mwnNqy206hXa8fMB4DTsNG+Qk B5RPyAKZJedxmvw1iyYVBgNua11RNDW9OgVlJp1I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Dominik Brodowski , Sasha Levin Subject: [PATCH 4.9 047/157] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in __nonstatic_find_io_region() Date: Mon, 24 Jan 2022 19:42:17 +0100 Message-Id: <20220124183934.283948361@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit ca0fe0d7c35c97528bdf621fdca75f13157c27af ] In __nonstatic_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_PCCARD_NONSTATIC=3Dy show no new warnings, and our static analyzer no longer warns about this code. Fixes: 49b1153adfe1 ("pcmcia: move all pcmcia_resource_ops providers into o= ne module") Signed-off-by: Zhou Qingyang [linux@dominikbrodowski.net: Fix typo in commit message] Signed-off-by: Dominik Brodowski Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/pcmcia/rsrc_nonstatic.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstati= c.c index 5ef7b46a25786..4d244014f423f 100644 --- a/drivers/pcmcia/rsrc_nonstatic.c +++ b/drivers/pcmcia/rsrc_nonstatic.c @@ -693,6 +693,9 @@ static struct resource *__nonstatic_find_io_region(stru= ct pcmcia_socket *s, unsigned long min =3D base; int ret; =20 + if (!res) + return NULL; + data.mask =3D align - 1; data.offset =3D base & data.mask; data.map =3D &s_data->io_db; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF4B0C433F5 for ; Mon, 24 Jan 2022 19:02:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229474AbiAXTCM (ORCPT ); Mon, 24 Jan 2022 14:02:12 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:57124 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344583AbiAXS6H (ORCPT ); Mon, 24 Jan 2022 13:58:07 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id ACA5C614DF; Mon, 24 Jan 2022 18:58:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 89928C340E5; Mon, 24 Jan 2022 18:58:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050686; bh=WwExldU9G39L2ssPdcPuqzKK5FM6hA2PmC/gQghHkmE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fLG4xhSVTCarQQ/e7clHoCz5CRBvHUGWg3IvTvHEnmwmn5IyZ9c6/TOmOlPKIuE1B ipu9zJgH0iLt32UtesLsNr0uFJ2a/Fm2pkqb3Mk26iYSHx1MUFJ7ZQgDgmxDUhY7S/ vdyPx+Zd+Po9jijonhj9ZrF4QB/t4b75ryASaZJc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Dominik Brodowski , Sasha Levin Subject: [PATCH 4.9 048/157] pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in nonstatic_find_mem_region() Date: Mon, 24 Jan 2022 19:42:18 +0100 Message-Id: <20220124183934.314338325@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 977d2e7c63c3d04d07ba340b39987742e3241554 ] In nonstatic_find_mem_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_PCCARD_NONSTATIC=3Dy show no new warnings, and our static analyzer no longer warns about this code. Fixes: 49b1153adfe1 ("pcmcia: move all pcmcia_resource_ops providers into o= ne module") Signed-off-by: Zhou Qingyang Signed-off-by: Dominik Brodowski Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/pcmcia/rsrc_nonstatic.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstati= c.c index 4d244014f423f..2e96d9273b780 100644 --- a/drivers/pcmcia/rsrc_nonstatic.c +++ b/drivers/pcmcia/rsrc_nonstatic.c @@ -815,6 +815,9 @@ static struct resource *nonstatic_find_mem_region(u_lon= g base, u_long num, unsigned long min, max; int ret, i, j; =20 + if (!res) + return NULL; + low =3D low || !(s->features & SS_CAP_PAGE_REGS); =20 data.mask =3D align - 1; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF9ADC433EF for ; Mon, 24 Jan 2022 19:03:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345270AbiAXTDK (ORCPT ); Mon, 24 Jan 2022 14:03:10 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:56022 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245690AbiAXS6L (ORCPT ); Mon, 24 Jan 2022 13:58:11 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 603B9B8123F; Mon, 24 Jan 2022 18:58:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82A27C340E8; Mon, 24 Jan 2022 18:58:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050689; bh=agoNMi90ZhC246six2voGL/6IHiCf2B0eTOKT3NbzG8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SqKRrne+5bqTus4Kir9dfosYya4d0CUQdQKxW144aOjcijm1ufg8odO7XNLvarew3 +a8q6Xuv/f+Jx5OM/XDkIMpF8916kpmaodFGaQlxL8bWTrvwcxIFyTSLTE/5hnaGkb B+7k3d89SIqeP7+vKhKjUl57MdHeiKofjhi2qvvA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Paul Mackerras , linux-ppp@vger.kernel.org, syzbot , Guillaume Nault , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 049/157] ppp: ensure minimum packet size in ppp_write() Date: Mon, 24 Jan 2022 19:42:19 +0100 Message-Id: <20220124183934.347808204@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 44073187990d5629804ce0627525f6ea5cfef171 ] It seems pretty clear ppp layer assumed user space would always be kind to provide enough data in their write() to a ppp device. This patch makes sure user provides at least 2 bytes. It adds PPP_PROTO_LEN macro that could replace in net-next many occurrences of hard-coded 2 value. I replaced only one occurrence to ease backports to stable kernels. The bug manifests in the following report: BUG: KMSAN: uninit-value in ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp= _generic.c:1740 ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740 __ppp_xmit_process+0x23e/0x4b0 drivers/net/ppp/ppp_generic.c:1640 ppp_xmit_process+0x1fe/0x480 drivers/net/ppp/ppp_generic.c:1661 ppp_write+0x5cb/0x5e0 drivers/net/ppp/ppp_generic.c:513 do_iter_write+0xb0c/0x1500 fs/read_write.c:853 vfs_writev fs/read_write.c:924 [inline] do_writev+0x645/0xe00 fs/read_write.c:967 __do_sys_writev fs/read_write.c:1040 [inline] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] ppp_write+0x11d/0x5e0 drivers/net/ppp/ppp_generic.c:501 do_iter_write+0xb0c/0x1500 fs/read_write.c:853 vfs_writev fs/read_write.c:924 [inline] do_writev+0x645/0xe00 fs/read_write.c:967 __do_sys_writev fs/read_write.c:1040 [inline] __se_sys_writev fs/read_write.c:1037 [inline] __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Cc: Paul Mackerras Cc: linux-ppp@vger.kernel.org Reported-by: syzbot Acked-by: Guillaume Nault Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/ppp/ppp_generic.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c index 0a29844676f92..6287d2ad77c6d 100644 --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -71,6 +71,8 @@ #define MPHDRLEN 6 /* multilink protocol header length */ #define MPHDRLEN_SSN 4 /* ditto with short sequence numbers */ =20 +#define PPP_PROTO_LEN 2 + /* * An instance of /dev/ppp can be associated with either a ppp * interface unit or a ppp channel. In both cases, file->private_data @@ -500,6 +502,9 @@ static ssize_t ppp_write(struct file *file, const char = __user *buf, =20 if (!pf) return -ENXIO; + /* All PPP packets should start with the 2-byte protocol */ + if (count < PPP_PROTO_LEN) + return -EINVAL; ret =3D -ENOMEM; skb =3D alloc_skb(count + pf->hdrlen, GFP_KERNEL); if (!skb) @@ -1563,7 +1568,7 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb) } =20 ++ppp->stats64.tx_packets; - ppp->stats64.tx_bytes +=3D skb->len - 2; + ppp->stats64.tx_bytes +=3D skb->len - PPP_PROTO_LEN; =20 switch (proto) { case PPP_IP: --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E273CC433F5 for ; Mon, 24 Jan 2022 19:06:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346487AbiAXTGk (ORCPT ); Mon, 24 Jan 2022 14:06:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45256 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345655AbiAXTAs (ORCPT ); Mon, 24 Jan 2022 14:00:48 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D561AC061361; Mon, 24 Jan 2022 10:58:14 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 941DBB8122C; Mon, 24 Jan 2022 18:58:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A6681C340E5; Mon, 24 Jan 2022 18:58:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050692; bh=PqIes5aqMi82sgamTCFW7C3quXpYhrox4Cg+Dwcr4wg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Du6mV6bFt+PRmELFiFAYojpzSXTNo+tmT8HSIgRMSJfp+yTJvVHTxaVZw6yflFl7L Qd4vxZSswmOhJQxXXZ1Jvn8d9voOL/XRRovp2KWOBL+cd+niVmw5aNgTuJ0VEnDaPp W1TA2faLZZuvL2kS7cyJ5ePXP03an7e9urT9u89I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 050/157] fsl/fman: Check for null pointer after calling devm_ioremap Date: Mon, 24 Jan 2022 19:42:20 +0100 Message-Id: <20220124183934.378195759@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit d5a73ec96cc57cf67e51b12820fc2354e7ca46f8 ] As the possible failure of the allocation, the devm_ioremap() may return NULL pointer. Take tgec_initialization() as an example. If allocation fails, the params->base_addr will be NULL pointer and will be assigned to tgec->regs in tgec_config(). Then it will cause the dereference of NULL pointer in set_mac_address(), which is called by tgec_init(). Therefore, it should be better to add the sanity check after the calling of the devm_ioremap(). Fixes: 3933961682a3 ("fsl/fman: Add FMan MAC driver") Signed-off-by: Jiasheng Jiang Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/ethernet/freescale/fman/mac.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethern= et/freescale/fman/mac.c index 81021f87e4f39..93b7ed361b82e 100644 --- a/drivers/net/ethernet/freescale/fman/mac.c +++ b/drivers/net/ethernet/freescale/fman/mac.c @@ -96,14 +96,17 @@ static void mac_exception(void *handle, enum fman_mac_e= xceptions ex) __func__, ex); } =20 -static void set_fman_mac_params(struct mac_device *mac_dev, - struct fman_mac_params *params) +static int set_fman_mac_params(struct mac_device *mac_dev, + struct fman_mac_params *params) { struct mac_priv_s *priv =3D mac_dev->priv; =20 params->base_addr =3D (typeof(params->base_addr)) devm_ioremap(priv->dev, mac_dev->res->start, resource_size(mac_dev->res)); + if (!params->base_addr) + return -ENOMEM; + memcpy(¶ms->addr, mac_dev->addr, sizeof(mac_dev->addr)); params->max_speed =3D priv->max_speed; params->phy_if =3D priv->phy_if; @@ -114,6 +117,8 @@ static void set_fman_mac_params(struct mac_device *mac_= dev, params->event_cb =3D mac_exception; params->dev_id =3D mac_dev; params->internal_phy_node =3D priv->internal_phy_node; + + return 0; } =20 static int tgec_initialization(struct mac_device *mac_dev) @@ -125,7 +130,9 @@ static int tgec_initialization(struct mac_device *mac_d= ev) =20 priv =3D mac_dev->priv; =20 - set_fman_mac_params(mac_dev, ¶ms); + err =3D set_fman_mac_params(mac_dev, ¶ms); + if (err) + goto _return; =20 mac_dev->fman_mac =3D tgec_config(¶ms); if (!mac_dev->fman_mac) { @@ -171,7 +178,9 @@ static int dtsec_initialization(struct mac_device *mac_= dev) =20 priv =3D mac_dev->priv; =20 - set_fman_mac_params(mac_dev, ¶ms); + err =3D set_fman_mac_params(mac_dev, ¶ms); + if (err) + goto _return; =20 mac_dev->fman_mac =3D dtsec_config(¶ms); if (!mac_dev->fman_mac) { @@ -220,7 +229,9 @@ static int memac_initialization(struct mac_device *mac_= dev) =20 priv =3D mac_dev->priv; =20 - set_fman_mac_params(mac_dev, ¶ms); + err =3D set_fman_mac_params(mac_dev, ¶ms); + if (err) + goto _return; =20 if (priv->max_speed =3D=3D SPEED_10000) params.phy_if =3D PHY_INTERFACE_MODE_XGMII; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7104FC433EF for ; Mon, 24 Jan 2022 18:58:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343914AbiAXS6n (ORCPT ); Mon, 24 Jan 2022 13:58:43 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:55670 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343931AbiAXS4b (ORCPT ); Mon, 24 Jan 2022 13:56:31 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6E607614C9; Mon, 24 Jan 2022 18:56:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4D096C340E5; Mon, 24 Jan 2022 18:56:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050589; bh=gZSDVsfYlsAxlWnp9Aw1egp1OcnEtoIW76K3GdYQkMs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FdlosXZgziQHF0HO1F7gJ5gKYQtfkpKKD5C7+296vhR5vCs3t6rcCpIWjNjPEXNrc FAeG8TeSLGpIxck5xe5e6VsVmcjwbOc74Pq1GDfqL3lVf24dtiDh29D5KyY/6LqIZq l++23GjZfQ6X9YD4D6sEVMaWhZSWZE1Ay8iw1YPI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Mark Brown , Sasha Levin Subject: [PATCH 4.9 051/157] spi: spi-meson-spifc: Add missing pm_runtime_disable() in meson_spifc_probe Date: Mon, 24 Jan 2022 19:42:21 +0100 Message-Id: <20220124183934.407264436@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 69c1b87516e327a60b39f96b778fe683259408bf ] If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable(). Add missing pm_runtime_disable() for meson_spifc_probe. Fixes: c3e4bc5434d2 ("spi: meson: Add support for Amlogic Meson SPIFC") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220107075424.7774-1-linmq006@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/spi/spi-meson-spifc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/spi/spi-meson-spifc.c b/drivers/spi/spi-meson-spifc.c index 616566e793c62..28975b6f054fa 100644 --- a/drivers/spi/spi-meson-spifc.c +++ b/drivers/spi/spi-meson-spifc.c @@ -357,6 +357,7 @@ static int meson_spifc_probe(struct platform_device *pd= ev) return 0; out_clk: clk_disable_unprepare(spifc->clk); + pm_runtime_disable(spifc->dev); out_err: spi_master_put(master); return ret; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF85FC433F5 for ; Mon, 24 Jan 2022 19:04:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345377AbiAXTER (ORCPT ); Mon, 24 Jan 2022 14:04:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44554 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345215AbiAXS74 (ORCPT ); Mon, 24 Jan 2022 13:59:56 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9892EC0619C9; Mon, 24 Jan 2022 10:56:35 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6097EB81235; Mon, 24 Jan 2022 18:56:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77125C340E5; Mon, 24 Jan 2022 18:56:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050593; bh=3hDW7gIhEOondEF4Jh+0/sHITCd+cZaNzno8dlPJPuE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=a4EoOBrvqpSR4wmb492altdE034+NALGsrJOwGz6dtDhog0lFOtal7baH9ZDG3l5D kdtZ+7E0qrNuBiO+H0JJ9ivlGE9pGdb0vBkcn/k0SFmXbaYTGbVN5GHiGI9REiwrSL gmZZ9GvX4Hfo317adxJPfsDXbJP3IsbxpbkXuR+w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kurt Van Dijck , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.9 052/157] can: softing: softing_startstop(): fix set but not used variable warning Date: Mon, 24 Jan 2022 19:42:22 +0100 Message-Id: <20220124183934.438803830@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marc Kleine-Budde [ Upstream commit 370d988cc529598ebaec6487d4f84c2115dc696b ] In the function softing_startstop() the variable error_reporting is assigned but not used. The code that uses this variable is commented out. Its stated that the functionality is not finally verified. To fix the warning: | drivers/net/can/softing/softing_fw.c:424:9: error: variable 'error_report= ing' set but not used [-Werror,-Wunused-but-set-variable] remove the comment, activate the code, but add a "0 &&" to the if expression and rely on the optimizer rather than the preprocessor to remove the code. Link: https://lore.kernel.org/all/20220109103126.1872833-1-mkl@pengutronix.= de Fixes: 03fd3cf5a179 ("can: add driver for Softing card") Cc: Kurt Van Dijck Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/can/softing/softing_fw.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing= /softing_fw.c index 52fe50725d749..a74c779feb90e 100644 --- a/drivers/net/can/softing/softing_fw.c +++ b/drivers/net/can/softing/softing_fw.c @@ -576,18 +576,19 @@ int softing_startstop(struct net_device *dev, int up) if (ret < 0) goto failed; } - /* enable_error_frame */ - /* + + /* enable_error_frame + * * Error reporting is switched off at the moment since * the receiving of them is not yet 100% verified * This should be enabled sooner or later - * - if (error_reporting) { + */ + if (0 && error_reporting) { ret =3D softing_fct_cmd(card, 51, "enable_error_frame"); if (ret < 0) goto failed; } - */ + /* initialize interface */ iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 2]); iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 4]); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21CB8C433EF for ; Mon, 24 Jan 2022 18:58:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343773AbiAXS6s (ORCPT ); Mon, 24 Jan 2022 13:58:48 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:55756 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343689AbiAXS4h (ORCPT ); Mon, 24 Jan 2022 13:56:37 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E11DD614E5; Mon, 24 Jan 2022 18:56:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9CA74C340E5; Mon, 24 Jan 2022 18:56:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050596; bh=35jegGiN93H7Fj9HVJIl3g4TLC5sxCZv4Kb0JVKO0CU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FxXVDFif86HUwJd0Z/7v0QwopkPNHxS9yB038Vx4rhUyIdhVIH6HSb/xTNBPO8RlT 0QF8KKZivGg3z899Q2fhhocigXAFpKrLhS1DWDBpQauJz/CteaRJyqXexXIZt7DQMX MZQPWUklYQivp+xSqetIEsmOnDKruApLTliChqjc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.9 053/157] can: xilinx_can: xcan_probe(): check for error irq Date: Mon, 24 Jan 2022 19:42:23 +0100 Message-Id: <20220124183934.470430305@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit c6564c13dae25cd7f8e1de5127b4da4500ee5844 ] For the possible failure of the platform_get_irq(), the returned irq could be error number and will finally cause the failure of the request_irq(). Consider that platform_get_irq() can now in certain cases return -EPROBE_DEFER, and the consequences of letting request_irq() effectively convert that into -EINVAL, even at probe time rather than later on. So it might be better to check just now. Fixes: b1201e44f50b ("can: xilinx CAN controller support") Link: https://lore.kernel.org/all/20211224021324.1447494-1-jiasheng@iscas.a= c.cn Signed-off-by: Jiasheng Jiang Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/can/xilinx_can.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c index e680bab27dd7e..ef24b619e0e57 100644 --- a/drivers/net/can/xilinx_can.c +++ b/drivers/net/can/xilinx_can.c @@ -1302,7 +1302,12 @@ static int xcan_probe(struct platform_device *pdev) spin_lock_init(&priv->tx_lock); =20 /* Get IRQ for the device */ - ndev->irq =3D platform_get_irq(pdev, 0); + ret =3D platform_get_irq(pdev, 0); + if (ret < 0) + goto err_free; + + ndev->irq =3D ret; + ndev->flags |=3D IFF_ECHO; /* We support local echo */ =20 platform_set_drvdata(pdev, ndev); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3009CC433F5 for ; Mon, 24 Jan 2022 19:06:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345670AbiAXTEa (ORCPT ); Mon, 24 Jan 2022 14:04:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45318 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345268AbiAXS77 (ORCPT ); Mon, 24 Jan 2022 13:59:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A74E4C0619D0; Mon, 24 Jan 2022 10:56:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4663B61416; Mon, 24 Jan 2022 18:56:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A37EC340E5; Mon, 24 Jan 2022 18:56:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050599; bh=tnFxo+X8MhMhJfzopAdktpTd6isKsEkPQG4eerdzgBg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jvlHXLzPptJjz0N4M+7QM3sYEwMqNMIk+u0mmXW8zbIIYvuQKX55cr4rAIprTxxrQ xosC6oqE0jQfvp/cyNGADw7HSx4D6gfZ6eRLi6qI4fiSlQLbLyGmiKHl+iABYqlirh CJw3NodlSxa04THOz3ahfpptDT/qj+vbtQN6p17Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro , "Matthew Wilcox (Oracle)" , Dominik Brodowski , Sasha Levin Subject: [PATCH 4.9 054/157] pcmcia: fix setting of kthread task states Date: Mon, 24 Jan 2022 19:42:24 +0100 Message-Id: <20220124183934.499963137@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dominik Brodowski [ Upstream commit fbb3485f1f931102d8ba606f1c28123f5b48afa3 ] We need to set TASK_INTERRUPTIBLE before calling kthread_should_stop(). Otherwise, kthread_stop() might see that the pccardd thread is still in TASK_RUNNING state and fail to wake it up. Additionally, we only need to set the state back to TASK_RUNNING if kthread_should_stop() breaks the loop. Cc: Greg Kroah-Hartman Reported-by: Al Viro Reviewed-by: Matthew Wilcox (Oracle) Fixes: d3046ba809ce ("pcmcia: fix a boot time warning in pcmcia cs code") Signed-off-by: Dominik Brodowski Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/pcmcia/cs.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c index c3b615c94b4bf..a92cbc952b70b 100644 --- a/drivers/pcmcia/cs.c +++ b/drivers/pcmcia/cs.c @@ -665,18 +665,16 @@ static int pccardd(void *__skt) if (events || sysfs_events) continue; =20 + set_current_state(TASK_INTERRUPTIBLE); if (kthread_should_stop()) break; =20 - set_current_state(TASK_INTERRUPTIBLE); - schedule(); =20 - /* make sure we are running */ - __set_current_state(TASK_RUNNING); - try_to_freeze(); } + /* make sure we are running before we exit */ + __set_current_state(TASK_RUNNING); =20 /* shut down socket, if a device is still present */ if (skt->state & SOCKET_PRESENT) { --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40729C433FE for ; Mon, 24 Jan 2022 18:59:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344729AbiAXS7A (ORCPT ); Mon, 24 Jan 2022 13:59:00 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:55858 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245730AbiAXS4o (ORCPT ); Mon, 24 Jan 2022 13:56:44 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 90D1E61540; Mon, 24 Jan 2022 18:56:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 64C68C340E5; Mon, 24 Jan 2022 18:56:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050603; bh=xyb7el4B8LdNx+P5MYu2OzNDCK3CD8EPUq/+flDETEc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uPNDvbVym2SsJEB4PnUG5+epDqOj/36wOvaKKU2Tc38ixgQ7CmMuwtQ5Cwv0o3uhZ h6CgBRgm5V3svGnz9VHTQiDN2a03BGr1gWcgVDGplEyYFrWj9rcA+ZuTl8P28RljBy LS5BO+efNLxRYgTHqFIf3Ho7kEt1zktYMjHNozsY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Arnd Bergmann , Jakub Kicinski , Sasha Levin , syzbot+003c0a286b9af5412510@syzkaller.appspotmail.com Subject: [PATCH 4.9 055/157] net: mcs7830: handle usb read errors properly Date: Mon, 24 Jan 2022 19:42:25 +0100 Message-Id: <20220124183934.529532759@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin [ Upstream commit d668769eb9c52b150753f1653f7f5a0aeb8239d2 ] Syzbot reported uninit value in mcs7830_bind(). The problem was in missing validation check for bytes read via usbnet_read_cmd(). usbnet_read_cmd() internally calls usb_control_msg(), that returns number of bytes read. Code should validate that requested number of bytes was actually read. So, this patch adds missing size validation check inside mcs7830_get_reg() to prevent uninit value bugs Reported-and-tested-by: syzbot+003c0a286b9af5412510@syzkaller.appspotmail.c= om Fixes: 2a36d7083438 ("USB: driver for mcs7830 (aka DeLOCK) USB ethernet ada= pter") Signed-off-by: Pavel Skripkin Reviewed-by: Arnd Bergmann Link: https://lore.kernel.org/r/20220106225716.7425-1-paskripkin@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/usb/mcs7830.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c index 4f345bd4e6e29..95151b46f2001 100644 --- a/drivers/net/usb/mcs7830.c +++ b/drivers/net/usb/mcs7830.c @@ -121,8 +121,16 @@ static const char driver_name[] =3D "MOSCHIP usb-ether= net driver"; =20 static int mcs7830_get_reg(struct usbnet *dev, u16 index, u16 size, void *= data) { - return usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ, - 0x0000, index, data, size); + int ret; + + ret =3D usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ, + 0x0000, index, data, size); + if (ret < 0) + return ret; + else if (ret < size) + return -ENODATA; + + return ret; } =20 static int mcs7830_set_reg(struct usbnet *dev, u16 index, u16 size, const = void *data) --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74AA5C433EF for ; Mon, 24 Jan 2022 19:06:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345719AbiAXTEc (ORCPT ); Mon, 24 Jan 2022 14:04:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45326 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345284AbiAXTAA (ORCPT ); Mon, 24 Jan 2022 14:00:00 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0006C061772; Mon, 24 Jan 2022 10:56:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 77AEEB8122F; Mon, 24 Jan 2022 18:56:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8940EC340E5; Mon, 24 Jan 2022 18:56:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050606; bh=HxKvqnUteLCSiyLVRAp2YIgzPudHjG4+MlokUgSHc+8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Zox/JKMc+OCcLPRePflYDXO+iwRWFz31Dp218IsbYwc3LCfj1KLRajqqvAghXsv7p jziWpgvDzrATBrlMSG5JUU5rI8a6hhy6zF/bdESmeAWLFeraom11lFuAQ4bEQG8603 gyEAMvyDuXiuefcH1HMHVDootNR4IqX5eTHOe3y8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukas Czerner , Jan Kara , Theodore Tso , Sasha Levin Subject: [PATCH 4.9 056/157] ext4: avoid trim error on fs with small groups Date: Mon, 24 Jan 2022 19:42:26 +0100 Message-Id: <20220124183934.559402099@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jan Kara [ Upstream commit 173b6e383d2a204c9921ffc1eca3b87aa2106c33 ] A user reported FITRIM ioctl failing for him on ext4 on some devices without apparent reason. After some debugging we've found out that these devices (being LVM volumes) report rather large discard granularity of 42MB and the filesystem had 1k blocksize and thus group size of 8MB. Because ext4 FITRIM implementation puts discard granularity into minlen, ext4_trim_fs() declared the trim request as invalid. However just silently doing nothing seems to be a more appropriate reaction to such combination of parameters since user did not specify anything wrong. CC: Lukas Czerner Fixes: 5c2ed62fd447 ("ext4: Adjust minlen with discard_granularity in the F= ITRIM ioctl") Signed-off-by: Jan Kara Link: https://lore.kernel.org/r/20211112152202.26614-1-jack@suse.cz Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- fs/ext4/ioctl.c | 2 -- fs/ext4/mballoc.c | 8 ++++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c index 75fff707beb6a..e7384a6e6a083 100644 --- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -760,8 +760,6 @@ resizefs_out: sizeof(range))) return -EFAULT; =20 - range.minlen =3D max((unsigned int)range.minlen, - q->limits.discard_granularity); ret =3D ext4_trim_fs(sb, &range); if (ret < 0) return ret; diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c index 807331da9dfc1..2a7fb2cf19b81 100644 --- a/fs/ext4/mballoc.c +++ b/fs/ext4/mballoc.c @@ -5224,6 +5224,7 @@ out: */ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range) { + struct request_queue *q =3D bdev_get_queue(sb->s_bdev); struct ext4_group_info *grp; ext4_group_t group, first_group, last_group; ext4_grpblk_t cnt =3D 0, first_cluster, last_cluster; @@ -5242,6 +5243,13 @@ int ext4_trim_fs(struct super_block *sb, struct fstr= im_range *range) start >=3D max_blks || range->len < sb->s_blocksize) return -EINVAL; + /* No point to try to trim less than discard granularity */ + if (range->minlen < q->limits.discard_granularity) { + minlen =3D EXT4_NUM_B2C(EXT4_SB(sb), + q->limits.discard_granularity >> sb->s_blocksize_bits); + if (minlen > EXT4_CLUSTERS_PER_GROUP(sb)) + goto out; + } if (end >=3D max_blks) end =3D max_blks - 1; if (end <=3D first_data_blk) --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F29AAC433FE for ; Mon, 24 Jan 2022 18:59:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245623AbiAXS7J (ORCPT ); Mon, 24 Jan 2022 13:59:09 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:55932 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344384AbiAXS4x (ORCPT ); Mon, 24 Jan 2022 13:56:53 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1B9CB61544; Mon, 24 Jan 2022 18:56:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D37F0C340E5; Mon, 24 Jan 2022 18:56:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050609; bh=GI8rViXqs2bdhiSwCmv3aNUVUSabK0VoZcqOpoSJ5sQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EAJhY/izrZVACYRf/+Z6E+ze7yRvEQc7JAT8TeqvDfqZkdJDuDJyOBYi5+w4HieOD mBKFiZ8j00yhdwltnc2PkA0XUOis3LaI+rmTRrYbyD55BsuzSQpsjwJtkL+W/F3T4R JcU/03us5+kGMGbviPggcUBZsHeyfUUs5ux4UM9o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 4.9 057/157] ALSA: jack: Add missing rwsem around snd_ctl_remove() calls Date: Mon, 24 Jan 2022 19:42:27 +0100 Message-Id: <20220124183934.590738006@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 06764dc931848c3a9bc01a63bbf76a605408bb54 ] snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it. Fixes: 9058cbe1eed2 ("ALSA: jack: implement kctl creating for jack devices") Link: https://lore.kernel.org/r/20211116071314.15065-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- sound/core/jack.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/core/jack.c b/sound/core/jack.c index 5ddf81f091fa9..36cfe1c54109d 100644 --- a/sound/core/jack.c +++ b/sound/core/jack.c @@ -68,10 +68,13 @@ static int snd_jack_dev_free(struct snd_device *device) struct snd_card *card =3D device->card; struct snd_jack_kctl *jack_kctl, *tmp_jack_kctl; =20 + down_write(&card->controls_rwsem); list_for_each_entry_safe(jack_kctl, tmp_jack_kctl, &jack->kctl_list, list= ) { list_del_init(&jack_kctl->list); snd_ctl_remove(card, jack_kctl->kctl); } + up_write(&card->controls_rwsem); + if (jack->private_free) jack->private_free(jack); =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AAE70C4167B for ; Mon, 24 Jan 2022 19:01:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345033AbiAXS7p (ORCPT ); Mon, 24 Jan 2022 13:59:45 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:55964 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344602AbiAXS4z (ORCPT ); Mon, 24 Jan 2022 13:56:55 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 42870614D4; Mon, 24 Jan 2022 18:56:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A2F2C340E5; Mon, 24 Jan 2022 18:56:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050612; bh=pEIEsDSrG3oWDQUzVwhFvwuMJ95sRq01nVXR4rmLB9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JZdTfJa6oW/VyNQCK8qoNFvszG39n5RRXGJHaE+kKG5F7yeznlwECGiWwwEv0Ugz2 hYTWNmnH177oBKdFhfbi1XlIeXl6uHKZtAj3W7DgWXspvNe48YH/7LiQptvhCpBmTo ClXcSDaE369meknX+bcOxUeVo0UT48P60JSJ4nWk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 4.9 058/157] ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls Date: Mon, 24 Jan 2022 19:42:28 +0100 Message-Id: <20220124183934.626355735@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 5471e9762e1af4b7df057a96bfd46cc250979b88 ] snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it. Fixes: a8ff48cb7083 ("ALSA: pcm: Free chmap at PCM free callback, too") Link: https://lore.kernel.org/r/20211116071314.15065-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- sound/core/pcm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/core/pcm.c b/sound/core/pcm.c index cdff5f9764808..6ae28dcd79945 100644 --- a/sound/core/pcm.c +++ b/sound/core/pcm.c @@ -857,7 +857,11 @@ EXPORT_SYMBOL(snd_pcm_new_internal); static void free_chmap(struct snd_pcm_str *pstr) { if (pstr->chmap_kctl) { - snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl); + struct snd_card *card =3D pstr->pcm->card; + + down_write(&card->controls_rwsem); + snd_ctl_remove(card, pstr->chmap_kctl); + up_write(&card->controls_rwsem); pstr->chmap_kctl =3D NULL; } } --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F268C433F5 for ; Mon, 24 Jan 2022 19:05:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345757AbiAXTEg (ORCPT ); Mon, 24 Jan 2022 14:04:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45332 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345300AbiAXTAB (ORCPT ); Mon, 24 Jan 2022 14:00:01 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0FCBBC061776; Mon, 24 Jan 2022 10:56:57 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A2A0661555; Mon, 24 Jan 2022 18:56:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 89B05C340E8; Mon, 24 Jan 2022 18:56:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050616; bh=yRZ5PLm8YrBcENjVOphL8zjDmRVYXJ/aiF4IzO9WfI8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YzU+piB0eZbtED4xYg5byd6VnSFEH9+zhoGjJj2pnIUqhcvMZhcCiBONkvsXBh4Eu +0999KEAv4QIuwuiIEqdplz6AfWQWmmenkllemvcR1WGt5EBLHZs+MNThbqfdkxbXR EIEUynKnsOCddTh0Pj4pH9EkBY9xvu/AXGh8U4kg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 4.9 059/157] ALSA: hda: Add missing rwsem around snd_ctl_remove() calls Date: Mon, 24 Jan 2022 19:42:29 +0100 Message-Id: <20220124183934.655747009@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 80bd64af75b4bb11c0329bc66c35da2ddfb66d88 ] snd_ctl_remove() has to be called with card->controls_rwsem held (when called after the card instantiation). This patch add the missing rwsem calls around it. Fixes: d13bd412dce2 ("ALSA: hda - Manage kcontrol lists") Link: https://lore.kernel.org/r/20211116071314.15065-3-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- sound/pci/hda/hda_codec.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c index 4e67614f15f8e..8976da3e1e288 100644 --- a/sound/pci/hda/hda_codec.c +++ b/sound/pci/hda/hda_codec.c @@ -1608,8 +1608,11 @@ void snd_hda_ctls_clear(struct hda_codec *codec) { int i; struct hda_nid_item *items =3D codec->mixers.list; + + down_write(&codec->card->controls_rwsem); for (i =3D 0; i < codec->mixers.used; i++) snd_ctl_remove(codec->card, items[i].kctl); + up_write(&codec->card->controls_rwsem); snd_array_free(&codec->mixers); snd_array_free(&codec->nids); } --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 683FBC433EF for ; Mon, 24 Jan 2022 19:01:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344008AbiAXS7e (ORCPT ); Mon, 24 Jan 2022 13:59:34 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:55094 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343556AbiAXS5B (ORCPT ); Mon, 24 Jan 2022 13:57:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5ECABB810BD; Mon, 24 Jan 2022 18:57:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 89A7CC340E5; Mon, 24 Jan 2022 18:56:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050619; bh=y+we92SPknJm552z1ppO/DVAZMNczlZ+j1Y2CQ3lDoU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nimoex8BIwEfsQnunmPmLnzSOVi28qVo/5So+MpIlgQX2iPA71RlyA1ZccouNY+uy lpZo7EWzL41wQEQz6sZLWlewpHEw3Y0OHt3QIf3tmsy+IVD+CtZA/X2vAQmVgiFV1h miEIyechZ5zuVGBN6CTCrb4ylQ4MykHweoAqIpLE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kamal Heib , Jason Gunthorpe , Sasha Levin Subject: [PATCH 4.9 060/157] RDMA/hns: Validate the pkey index Date: Mon, 24 Jan 2022 19:42:30 +0100 Message-Id: <20220124183934.685563589@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kamal Heib [ Upstream commit 2a67fcfa0db6b4075515bd23497750849b88850f ] Before query pkey, make sure that the queried index is valid. Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Link: https://lore.kernel.org/r/20211117145954.123893-1-kamalheib1@gmail.com Signed-off-by: Kamal Heib Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/infiniband/hw/hns/hns_roce_main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband= /hw/hns/hns_roce_main.c index 764e35a54457e..852aac146ac78 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -475,6 +475,9 @@ static int hns_roce_query_gid(struct ib_device *ib_dev,= u8 port_num, int index, static int hns_roce_query_pkey(struct ib_device *ib_dev, u8 port, u16 inde= x, u16 *pkey) { + if (index > 0) + return -EINVAL; + *pkey =3D PKEY_ID; =20 return 0; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83C14C433FE for ; Mon, 24 Jan 2022 19:06:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345905AbiAXTEn (ORCPT ); Mon, 24 Jan 2022 14:04:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45346 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345323AbiAXTAD (ORCPT ); Mon, 24 Jan 2022 14:00:03 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 07454C061787; Mon, 24 Jan 2022 10:57:08 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C2555B8121C; Mon, 24 Jan 2022 18:57:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F00CDC340E8; Mon, 24 Jan 2022 18:57:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050625; bh=Qs0FuTYXs5t3/atNAdr+O7e+rOaKWpprhLBnwiJYbDY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e57+BsUPrC1kZz33bIPd4AoiEgrFK84e07vuNcyXLECWtwq7EvcO75UNFE4cKdR2u vImhTrmSUpTJwNiAozvbH2TTyQ9M5U2PeHuGLnwM947d1qdVuC+Ekn6mgYE4QwHlcF MzXFkFXAzYuYGMpNCppodguiwEDBOAIK7qyGuE9Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peiwei Hu , Michael Ellerman , Sasha Levin Subject: [PATCH 4.9 061/157] powerpc/prom_init: Fix improper check of prom_getprop() Date: Mon, 24 Jan 2022 19:42:31 +0100 Message-Id: <20220124183934.721480975@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peiwei Hu [ Upstream commit 869fb7e5aecbc163003f93f36dcc26d0554319f6 ] prom_getprop() can return PROM_ERROR. Binary operator can not identify it. Fixes: 94d2dde738a5 ("[POWERPC] Efika: prune fixups and make them more care= full") Signed-off-by: Peiwei Hu Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/tencent_BA28CC6897B7C95A92EB8C580B5D1858910= 5@qq.com Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/powerpc/kernel/prom_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_ini= t.c index 1e8c57207346e..df3af10b8cc95 100644 --- a/arch/powerpc/kernel/prom_init.c +++ b/arch/powerpc/kernel/prom_init.c @@ -2528,7 +2528,7 @@ static void __init fixup_device_tree_efika_add_phy(vo= id) =20 /* Check if the phy-handle property exists - bail if it does */ rv =3D prom_getprop(node, "phy-handle", prop, sizeof(prop)); - if (!rv) + if (rv <=3D 0) return; =20 /* --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 742CDC433EF for ; Mon, 24 Jan 2022 19:05:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345863AbiAXTEl (ORCPT ); Mon, 24 Jan 2022 14:04:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45350 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345324AbiAXTAD (ORCPT ); Mon, 24 Jan 2022 14:00:03 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1E17FC061788; Mon, 24 Jan 2022 10:57:10 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B8BE3B8122F; Mon, 24 Jan 2022 18:57:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF22EC340E5; Mon, 24 Jan 2022 18:57:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050628; bh=gbD5XTH2jhfWmR2vXKFnpm2jNz7iLJYEMqBB1XYRMa4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ocIXtbr2zNVnDZrC85Iqtf03DWuE+/hwpCmJKDGQHe/iQNFMnPAoQSKj3yx3YDF1F 9ddX/Hgjcx6vOS131voWkGKAmkG1Pz+pZ8/s66XPaUecAU8qbdI8xS4Awb02L7Y5OX Ib/P5dZMIiQJBBhw+7B/1q1kbtYaaIUhFsuM2Mu8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bixuan Cui , Takashi Iwai , Sasha Levin Subject: [PATCH 4.9 062/157] ALSA: oss: fix compile error when OSS_DEBUG is enabled Date: Mon, 24 Jan 2022 19:42:32 +0100 Message-Id: <20220124183934.758121826@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bixuan Cui [ Upstream commit 8e7daf318d97f25e18b2fc7eb5909e34cd903575 ] Fix compile error when OSS_DEBUG is enabled: sound/core/oss/pcm_oss.c: In function 'snd_pcm_oss_set_trigger': sound/core/oss/pcm_oss.c:2055:10: error: 'substream' undeclared (first use in this function); did you mean 'csubstream'? pcm_dbg(substream->pcm, "pcm_oss: trigger =3D 0x%x\n", trigger); ^ Fixes: 61efcee8608c ("ALSA: oss: Use standard printk helpers") Signed-off-by: Bixuan Cui Link: https://lore.kernel.org/r/1638349134-110369-1-git-send-email-cuibixua= n@linux.alibaba.com Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- sound/core/oss/pcm_oss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c index 0ce3f42721c4d..440c16e0d0713 100644 --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -2122,7 +2122,7 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss= _file *pcm_oss_file, int tr int err, cmd; =20 #ifdef OSS_DEBUG - pcm_dbg(substream->pcm, "pcm_oss: trigger =3D 0x%x\n", trigger); + pr_debug("pcm_oss: trigger =3D 0x%x\n", trigger); #endif =09 psubstream =3D pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK]; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CCE50C4167E for ; Mon, 24 Jan 2022 19:06:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346338AbiAXTFX (ORCPT ); Mon, 24 Jan 2022 14:05:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44632 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345343AbiAXTAI (ORCPT ); Mon, 24 Jan 2022 14:00:08 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7F51DC061793; Mon, 24 Jan 2022 10:57:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1FAF76154A; Mon, 24 Jan 2022 18:57:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D7E2FC340E5; Mon, 24 Jan 2022 18:57:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050631; bh=0KD1eiKFQZ+15lvlwGjcpA2CZ9608oocxiXbhgHw+rM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aHyujCZAr2Z2Fm9pqKveNg4112DjtAV/WiSCnEl78T1iWeKOUu4akxiCwKqxJeLkV B2XOR+/5sRJ2tN03MHnw50uhi/HUDazg0MERtQ9CRl+dLoPMYnCTZiMajgisFVzCHj 6srHYjqe1Cx4hkrDxfwbdAZuZQ+KaDkm4eZpx+qE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kees Cook , Sasha Levin Subject: [PATCH 4.9 063/157] char/mwave: Adjust io port register size Date: Mon, 24 Jan 2022 19:42:33 +0100 Message-Id: <20220124183934.788737719@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kees Cook [ Upstream commit f5912cc19acd7c24b2dbf65a6340bf194244f085 ] Using MKWORD() on a byte-sized variable results in OOB read. Expand the size of the reserved area so both MKWORD and MKBYTE continue to work without overflow. Silences this warning on a -Warray-bounds build: drivers/char/mwave/3780i.h:346:22: error: array subscript 'short unsigned i= nt[0]' is partly outside array bounds of 'DSP_ISA_SLAVE_CONTROL[1]' [-Werro= r=3Darray-bounds] 346 | #define MKWORD(var) (*((unsigned short *)(&var))) | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/char/mwave/3780i.h:356:40: note: in definition of macro 'OutWordDsp' 356 | #define OutWordDsp(index,value) outw(value,usDspBaseIO+index) | ^~~~~ drivers/char/mwave/3780i.c:373:41: note: in expansion of macro 'MKWORD' 373 | OutWordDsp(DSP_IsaSlaveControl, MKWORD(rSlaveControl)); | ^~~~~~ drivers/char/mwave/3780i.c:358:31: note: while referencing 'rSlaveControl' 358 | DSP_ISA_SLAVE_CONTROL rSlaveControl; | ^~~~~~~~~~~~~ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20211203084206.3104326-1-keescook@chromium.= org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/char/mwave/3780i.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/mwave/3780i.h b/drivers/char/mwave/3780i.h index 9ccb6b270b071..95164246afd1a 100644 --- a/drivers/char/mwave/3780i.h +++ b/drivers/char/mwave/3780i.h @@ -68,7 +68,7 @@ typedef struct { unsigned char ClockControl:1; /* RW: Clock control: 0=3Dnormal, 1=3Dstop = 3780i clocks */ unsigned char SoftReset:1; /* RW: Soft reset 0=3Dnormal, 1=3Dsoft reset a= ctive */ unsigned char ConfigMode:1; /* RW: Configuration mode, 0=3Dnormal, 1=3Dco= nfig mode */ - unsigned char Reserved:5; /* 0: Reserved */ + unsigned short Reserved:13; /* 0: Reserved */ } DSP_ISA_SLAVE_CONTROL; =20 =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1705BC43219 for ; Mon, 24 Jan 2022 19:01:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345236AbiAXS75 (ORCPT ); Mon, 24 Jan 2022 13:59:57 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:52686 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344100AbiAXS5R (ORCPT ); Mon, 24 Jan 2022 13:57:17 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 42749B81232; Mon, 24 Jan 2022 18:57:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B9EBC340EC; Mon, 24 Jan 2022 18:57:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050635; bh=ZKj5uNOC/s2GY6wnIqIljyZ3oiYEhoGF8RHpon+/GPY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=go2KSm5kBt/gbVtIYtBja6jDQmOcabNx/bvw9wxjmAJQb399W2/ISQ72LaglcdXM1 rzA0ajmVdmUru43LrXh3RrYZ88353yAuDbQmrKzKyHigtLTfph2bhvc4J7DKlBM6bT IFC/DQZm5b90uEhL8jtzcghGfi4ImSB7V79SCFQY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Sasha Levin Subject: [PATCH 4.9 064/157] uio: uio_dmem_genirq: Catch the Exception Date: Mon, 24 Jan 2022 19:42:34 +0100 Message-Id: <20220124183934.818907126@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit eec91694f927d1026974444eb6a3adccd4f1cbc2 ] The return value of dma_set_coherent_mask() is not always 0. To catch the exception in case that dma is not support the mask. Fixes: 0a0c3b5a24bd ("Add new uio device for dynamic memory allocation") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20211204000326.1592687-1-jiasheng@iscas.ac.= cn Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/uio/uio_dmem_genirq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c index a00b4aee6c799..a31b9d5260ca0 100644 --- a/drivers/uio/uio_dmem_genirq.c +++ b/drivers/uio/uio_dmem_genirq.c @@ -194,7 +194,11 @@ static int uio_dmem_genirq_probe(struct platform_devic= e *pdev) goto bad0; } =20 - dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + ret =3D dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); + if (ret) { + dev_err(&pdev->dev, "DMA enable failed\n"); + return ret; + } =20 priv->uioinfo =3D uioinfo; spin_lock_init(&priv->lock); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 309A6C4167D for ; Mon, 24 Jan 2022 19:01:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345262AbiAXS77 (ORCPT ); Mon, 24 Jan 2022 13:59:59 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:56362 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344243AbiAXS5T (ORCPT ); Mon, 24 Jan 2022 13:57:19 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E825A61506; Mon, 24 Jan 2022 18:57:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B53A5C340E5; Mon, 24 Jan 2022 18:57:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050638; bh=DuW7291uSSX9Mly7trvoT7UBTolHWvx9CQ3PWEItId8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S1g+QH4SGWR1piRYRYj16psptdSV2rO17U5AAWUt4kscIUeE4yKcg5Gl3nki46Rgy lthy04I8XOIYGDmBviJ+7Y4tXbIBKuFr530olT5ZvNrlaxt3sLNDCh9XzR2f4aNIy+ qj977yTpibL8liXK4a8GMi2osThZbOmZFDI+HKTA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexey Dobriyan , Bean Huo , Bart Van Assche , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.9 065/157] scsi: ufs: Fix race conditions related to driver data Date: Mon, 24 Jan 2022 19:42:35 +0100 Message-Id: <20220124183934.847864454@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bart Van Assche [ Upstream commit 21ad0e49085deb22c094f91f9da57319a97188e4 ] The driver data pointer must be set before any callbacks are registered that use that pointer. Hence move the initialization of that pointer from after the ufshcd_init() call to inside ufshcd_init(). Link: https://lore.kernel.org/r/20211203231950.193369-7-bvanassche@acm.org Fixes: 3b1d05807a9a ("[SCSI] ufs: Segregate PCI Specific Code") Reported-by: Alexey Dobriyan Tested-by: Bean Huo Reviewed-by: Bean Huo Signed-off-by: Bart Van Assche Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/scsi/ufs/tc-dwc-g210-pci.c | 1 - drivers/scsi/ufs/ufshcd-pltfrm.c | 2 -- drivers/scsi/ufs/ufshcd.c | 7 +++++++ 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/ufs/tc-dwc-g210-pci.c b/drivers/scsi/ufs/tc-dwc-g= 210-pci.c index c09a0fef0fe60..a1785b0239667 100644 --- a/drivers/scsi/ufs/tc-dwc-g210-pci.c +++ b/drivers/scsi/ufs/tc-dwc-g210-pci.c @@ -140,7 +140,6 @@ tc_dwc_g210_pci_probe(struct pci_dev *pdev, const struc= t pci_device_id *id) return err; } =20 - pci_set_drvdata(pdev, hba); pm_runtime_put_noidle(&pdev->dev); pm_runtime_allow(&pdev->dev); =20 diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-plt= frm.c index b47decc1fb5ba..e9b0cc4cbb4d2 100644 --- a/drivers/scsi/ufs/ufshcd-pltfrm.c +++ b/drivers/scsi/ufs/ufshcd-pltfrm.c @@ -350,8 +350,6 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, goto dealloc_host; } =20 - platform_set_drvdata(pdev, hba); - pm_runtime_set_active(&pdev->dev); pm_runtime_enable(&pdev->dev); =20 diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index a767d942bfca5..cf7946c840165 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -6766,6 +6766,13 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *m= mio_base, unsigned int irq) struct Scsi_Host *host =3D hba->host; struct device *dev =3D hba->dev; =20 + /* + * dev_set_drvdata() must be called before any callbacks are registered + * that use dev_get_drvdata() (frequency scaling, clock scaling, hwmon, + * sysfs). + */ + dev_set_drvdata(dev, hba); + if (!mmio_base) { dev_err(hba->dev, "Invalid memory reference for mmio_base is NULL\n"); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0FC9FC433FE for ; Mon, 24 Jan 2022 19:05:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345912AbiAXTEo (ORCPT ); Mon, 24 Jan 2022 14:04:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45378 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345351AbiAXTAI (ORCPT ); Mon, 24 Jan 2022 14:00:08 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8C1D4C06179A; Mon, 24 Jan 2022 10:57:22 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 294CE6153A; Mon, 24 Jan 2022 18:57:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CCF7DC340E5; Mon, 24 Jan 2022 18:57:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050641; bh=w46WblcSNnkv/REghqn6QUVMuYOSbyXJbKRtxqJJU4E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xHkQZD1KhE3lYh+d2w/ePp3bMpAmer4UU8vyjm3VlY1tGbX1ioSGm6+NnCVpSquMp Ic5nxskLJ8hHCFYyJsvvONhuw/kQ4fktxmziXuZP9iAL9p8/jnlo2whkJN7vR0mMBq yCUD4MRsURCHLCdq+alqtAXqOGbbBnYHXzCkp8X4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Avihai Horon , Mark Zhang , Leon Romanovsky , Jason Gunthorpe , Sasha Levin Subject: [PATCH 4.9 066/157] RDMA/core: Let ib_find_gid() continue search even after empty entry Date: Mon, 24 Jan 2022 19:42:36 +0100 Message-Id: <20220124183934.877562935@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Avihai Horon [ Upstream commit 483d805191a23191f8294bbf9b4e94836f5d92e4 ] Currently, ib_find_gid() will stop searching after encountering the first empty GID table entry. This behavior is wrong since neither IB nor RoCE spec enforce tightly packed GID tables. For example, when a valid GID entry exists at index N, and if a GID entry is empty at index N-1, ib_find_gid() will fail to find the valid entry. Fix it by making ib_find_gid() continue searching even after encountering missing entries. Fixes: 5eb620c81ce3 ("IB/core: Add helpers for uncached GID and P_Key searc= hes") Link: https://lore.kernel.org/r/e55d331b96cecfc2cf19803d16e7109ea966882d.16= 39055490.git.leonro@nvidia.com Signed-off-by: Avihai Horon Reviewed-by: Mark Zhang Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/infiniband/core/device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/dev= ice.c index 4b947d5cafe28..c5c175b72f21e 100644 --- a/drivers/infiniband/core/device.c +++ b/drivers/infiniband/core/device.c @@ -870,7 +870,8 @@ int ib_find_gid(struct ib_device *device, union ib_gid = *gid, for (i =3D 0; i < device->port_immutable[port].gid_tbl_len; ++i) { ret =3D ib_query_gid(device, port, i, &tmp_gid, NULL); if (ret) - return ret; + continue; + if (!memcmp(&tmp_gid, gid, sizeof *gid)) { *port_num =3D port; if (index) --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26F6FC433F5 for ; Mon, 24 Jan 2022 19:01:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236524AbiAXTB3 (ORCPT ); Mon, 24 Jan 2022 14:01:29 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:55398 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344445AbiAXS52 (ORCPT ); Mon, 24 Jan 2022 13:57:28 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0E387B8121A; Mon, 24 Jan 2022 18:57:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1610AC340E7; Mon, 24 Jan 2022 18:57:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050644; bh=/MjpDm1YZmvmKSGToVy1rcMTPnzaAsDqT6sqqBJs1SY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hr3txjuoZB73JUQcKorV1od4/MucA7vQeEpdZdbUPrW4yWpiMRs9/TerwIm0yrPKB MaGe6n5H8gL7v+RMivpIm3XsoKzySalyIv/UIbRIOGCiazpkCZjOUddUX30Q6EFL10 Mp3VrQTfX3JvqjmcSlulkj22cSaYcQwaPoMmZ7kM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arnd Bergmann , Mark Brown , Vinod Koul , Sasha Levin Subject: [PATCH 4.9 067/157] dmaengine: pxa/mmp: stop referencing config->slave_id Date: Mon, 24 Jan 2022 19:42:37 +0100 Message-Id: <20220124183934.915131207@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arnd Bergmann [ Upstream commit 134c37fa250a87a7e77c80a7c59ae16c462e46e0 ] The last driver referencing the slave_id on Marvell PXA and MMP platforms was the SPI driver, but this stopped doing so a long time ago, so the TODO from the earlier patch can no be removed. Fixes: b729bf34535e ("spi/pxa2xx: Don't use slave_id of dma_slave_config") Fixes: 13b3006b8ebd ("dma: mmp_pdma: add filter function") Signed-off-by: Arnd Bergmann Acked-by: Mark Brown Link: https://lore.kernel.org/r/20211122222203.4103644-7-arnd@kernel.org Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/dma/mmp_pdma.c | 6 ------ drivers/dma/pxa_dma.c | 7 ------- 2 files changed, 13 deletions(-) diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c index eb3a1f42ab065..e8b2d3e31de80 100644 --- a/drivers/dma/mmp_pdma.c +++ b/drivers/dma/mmp_pdma.c @@ -722,12 +722,6 @@ static int mmp_pdma_config(struct dma_chan *dchan, =20 chan->dir =3D cfg->direction; chan->dev_addr =3D addr; - /* FIXME: drivers should be ported over to use the filter - * function. Once that's done, the following two lines can - * be removed. - */ - if (cfg->slave_id) - chan->drcmr =3D cfg->slave_id; =20 return 0; } diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c index 3f56f9ca44824..5bd1ade187d3f 100644 --- a/drivers/dma/pxa_dma.c +++ b/drivers/dma/pxa_dma.c @@ -975,13 +975,6 @@ static void pxad_get_config(struct pxad_chan *chan, *dcmd |=3D PXA_DCMD_BURST16; else if (maxburst =3D=3D 32) *dcmd |=3D PXA_DCMD_BURST32; - - /* FIXME: drivers should be ported over to use the filter - * function. Once that's done, the following two lines can - * be removed. - */ - if (chan->cfg.slave_id) - chan->drcmr =3D chan->cfg.slave_id; } =20 static struct dma_async_tx_descriptor * --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9317C433F5 for ; Mon, 24 Jan 2022 19:06:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345579AbiAXTGS (ORCPT ); Mon, 24 Jan 2022 14:06:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45420 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345433AbiAXTAR (ORCPT ); Mon, 24 Jan 2022 14:00:17 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 55D74C061395; Mon, 24 Jan 2022 10:57:30 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 146AFB8121C; Mon, 24 Jan 2022 18:57:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3BCE6C340E5; Mon, 24 Jan 2022 18:57:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050647; bh=3/GDKWH79l9YKLNBw8nBU2t0luvKr2hRfUyc9c5GEiI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xCGuxkcXueGrj5qbWx6e/NDz6jzE3oB+BXtA5EbY4/9JEeDjARdZow7uCyh9o3wWK jtzqsOfInWHCkdt8E789G0ik703m8RS6oSxkbeB3XxNLU0RK8Wzu5DV/yPFCT0cWlI G9i0brfbnPtrJhNLV8/X/T4Fysfeti5xmRJ9DTWY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Krzysztof Kozlowski , Mark Brown , Sasha Levin Subject: [PATCH 4.9 068/157] ASoC: samsung: idma: Check of ioremap return value Date: Mon, 24 Jan 2022 19:42:38 +0100 Message-Id: <20220124183934.947037909@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 3ecb46755eb85456b459a1a9f952c52986bce8ec ] Because of the potential failure of the ioremap(), the buf->area could be NULL. Therefore, we need to check it and return -ENOMEM in order to transfer the error. Fixes: f09aecd50f39 ("ASoC: SAMSUNG: Add I2S0 internal dma driver") Signed-off-by: Jiasheng Jiang Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20211228034026.1659385-1-jiasheng@iscas.ac.= cn Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- sound/soc/samsung/idma.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/samsung/idma.c b/sound/soc/samsung/idma.c index 3e408158625db..72014dea75422 100644 --- a/sound/soc/samsung/idma.c +++ b/sound/soc/samsung/idma.c @@ -369,6 +369,8 @@ static int preallocate_idma_buffer(struct snd_pcm *pcm,= int stream) buf->addr =3D idma.lp_tx_addr; buf->bytes =3D idma_hardware.buffer_bytes_max; buf->area =3D (unsigned char * __force)ioremap(buf->addr, buf->bytes); + if (!buf->area) + return -ENOMEM; =20 return 0; } --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 983B5C433EF for ; Mon, 24 Jan 2022 19:06:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237360AbiAXTGF (ORCPT ); Mon, 24 Jan 2022 14:06:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44704 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345456AbiAXTAT (ORCPT ); Mon, 24 Jan 2022 14:00:19 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8C114C061345; Mon, 24 Jan 2022 10:57:32 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 30218B81223; Mon, 24 Jan 2022 18:57:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5262FC340E7; Mon, 24 Jan 2022 18:57:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050650; bh=2C18HuDLscgc4+tKatxU9QstG6/auVKahETKdInN1gE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LFNSYsTL38dDAuKLIs67a22ws6vLC99frPvw2bE3pMtr+2IFCSZVthzclN2RFOygq 9vfrKHSoGI9KjgUN2SSDwgXM6lvp4d7q/FX/jQgMdIhvFqY1MeoZbK8VQE6bChCRCi Y3wzFhTYyQPkedEe/g6kScFqvAPJpD+CYyu5mWG4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Wei Yongjun , Sasha Levin Subject: [PATCH 4.9 069/157] misc: lattice-ecp3-config: Fix task hung when firmware load failed Date: Mon, 24 Jan 2022 19:42:39 +0100 Message-Id: <20220124183934.983778839@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wei Yongjun [ Upstream commit fcee5ce50bdb21116711e38635e3865594af907e ] When firmware load failed, kernel report task hung as follows: INFO: task xrun:5191 blocked for more than 147 seconds. Tainted: G W 5.16.0-rc5-next-20211220+ #11 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:xrun state:D stack: 0 pid: 5191 ppid: 270 flags:0x0000= 0004 Call Trace: __schedule+0xc12/0x4b50 kernel/sched/core.c:4986 schedule+0xd7/0x260 kernel/sched/core.c:6369 (discriminator 1) schedule_timeout+0x7aa/0xa80 kernel/time/timer.c:1857 wait_for_completion+0x181/0x290 kernel/sched/completion.c:85 lattice_ecp3_remove+0x32/0x40 drivers/misc/lattice-ecp3-config.c:221 spi_remove+0x72/0xb0 drivers/spi/spi.c:409 lattice_ecp3_remove() wait for signals from firmware loading, but when load failed, firmware_load() does not send this signal. This cause device remove hung. Fix it by sending signal even if load failed. Fixes: 781551df57c7 ("misc: Add Lattice ECP3 FPGA configuration via SPI") Reported-by: Hulk Robot Signed-off-by: Wei Yongjun Link: https://lore.kernel.org/r/20211228125522.3122284-1-weiyongjun1@huawei= .com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/misc/lattice-ecp3-config.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/misc/lattice-ecp3-config.c b/drivers/misc/lattice-ecp3= -config.c index 626fdcaf25101..645d26536114f 100644 --- a/drivers/misc/lattice-ecp3-config.c +++ b/drivers/misc/lattice-ecp3-config.c @@ -81,12 +81,12 @@ static void firmware_load(const struct firmware *fw, vo= id *context) =20 if (fw =3D=3D NULL) { dev_err(&spi->dev, "Cannot load firmware, aborting\n"); - return; + goto out; } =20 if (fw->size =3D=3D 0) { dev_err(&spi->dev, "Error: Firmware size is 0!\n"); - return; + goto out; } =20 /* Fill dummy data (24 stuffing bits for commands) */ @@ -108,7 +108,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) dev_err(&spi->dev, "Error: No supported FPGA detected (JEDEC_ID=3D%08x)!\n", jedec_id); - return; + goto out; } =20 dev_info(&spi->dev, "FPGA %s detected\n", ecp3_dev[i].name); @@ -121,7 +121,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) buffer =3D kzalloc(fw->size + 8, GFP_KERNEL); if (!buffer) { dev_err(&spi->dev, "Error: Can't allocate memory!\n"); - return; + goto out; } =20 /* @@ -160,7 +160,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) "Error: Timeout waiting for FPGA to clear (status=3D%08x)!\n", status); kfree(buffer); - return; + goto out; } =20 dev_info(&spi->dev, "Configuring the FPGA...\n"); @@ -186,7 +186,7 @@ static void firmware_load(const struct firmware *fw, vo= id *context) release_firmware(fw); =20 kfree(buffer); - +out: complete(&data->fw_loaded); } =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7182FC433F5 for ; Mon, 24 Jan 2022 19:01:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344481AbiAXTBk (ORCPT ); Mon, 24 Jan 2022 14:01:40 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:55464 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344476AbiAXS5h (ORCPT ); Mon, 24 Jan 2022 13:57:37 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 66BACB81239; Mon, 24 Jan 2022 18:57:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F907C340E5; Mon, 24 Jan 2022 18:57:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050654; bh=gv03a/CWi+yexEoIcHsTlDZu6ixquMHZ02S4S20gDIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NTAAXCER7RIAw219iFnd5br3Gk6mNQ3qmawZpsvyC+VeuuSfpOeSRSvUlDKNbUVUZ uot7Vneh60FEubIyTBTEInAHsvJQerLIzHvTsLLqT5UsRPPliPFY53mCnuVic73DlW kQVQWH8RfrDqTzd6c4B/WKICiHTDjKoxERFxyXO0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , kernel test robot , Jonathan Cameron , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.9 070/157] mips: lantiq: add support for clk_set_parent() Date: Mon, 24 Jan 2022 19:42:40 +0100 Message-Id: <20220124183935.014225574@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 76f66dfd60dc5d2f9dec22d99091fea1035c5d03 ] Provide a simple implementation of clk_set_parent() in the lantiq subarch so that callers of it will build without errors. Fixes these build errors: ERROR: modpost: "clk_set_parent" [sound/soc/jz4740/snd-soc-jz4740-i2s.ko] u= ndefined! ERROR: modpost: "clk_set_parent" [sound/soc/atmel/snd-soc-atmel-i2s.ko] und= efined! Fixes: 171bb2f19ed6 ("MIPS: Lantiq: Add initial support for Lantiq SoCs") Signed-off-by: Randy Dunlap Reported-by: kernel test robot --to=3Dlinux-mips@vger.kernel.org --cc=3D"John Crispin " = --cc=3D"Jonathan Cameron " --cc=3D"Russell King " --cc=3D"Andy Shevchenko " --cc= =3Dalsa-devel@alsa-project.org --to=3D"Thomas Bogendoerfer " Reviewed-by: Jonathan Cameron Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/mips/lantiq/clk.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c index 149f0513c4f5d..d1de57b86683c 100644 --- a/arch/mips/lantiq/clk.c +++ b/arch/mips/lantiq/clk.c @@ -165,6 +165,12 @@ struct clk *of_clk_get_from_provider(struct of_phandle= _args *clkspec) return NULL; } =20 +int clk_set_parent(struct clk *clk, struct clk *parent) +{ + return 0; +} +EXPORT_SYMBOL(clk_set_parent); + static inline u32 get_counter_resolution(void) { u32 res; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 939BEC43217 for ; Mon, 24 Jan 2022 19:06:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345966AbiAXTEv (ORCPT ); Mon, 24 Jan 2022 14:04:51 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:56714 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245463AbiAXS5l (ORCPT ); Mon, 24 Jan 2022 13:57:41 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 17F9F6153A; Mon, 24 Jan 2022 18:57:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2359C340E5; Mon, 24 Jan 2022 18:57:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050660; bh=9ZnAhV7QLSl4tRYWVnlLpmppsIYCvGjGJBqgxDy0hwg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TMD+evnF53eZEs3UnfqerAqzbc6CyDO0TigejtgXDEPNr/bj+b7SrsbH2vgROGX8j UGFgXGDcl9i0udRcY+UcQIbuE+ud9dHggKJdXKyOwMbkmEhWThBU5bxHCjGB2bIw0K Ag3WFwBJf7ZsdFpJUl8yarCBPlDHKL89DEu0aH0Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Jonathan Cameron , Florian Fainelli , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.9 071/157] mips: bcm63xx: add support for clk_set_parent() Date: Mon, 24 Jan 2022 19:42:41 +0100 Message-Id: <20220124183935.047540583@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 6f03055d508ff4feb8db02ba3df9303a1db8d381 ] The MIPS BMC63XX subarch does not provide/support clk_set_parent(). This causes build errors in a few drivers, so add a simple implementation of that function so that callers of it will build without errors. Fixes these build errors: ERROR: modpost: "clk_set_parent" [sound/soc/jz4740/snd-soc-jz4740-i2s.ko] u= ndefined! ERROR: modpost: "clk_set_parent" [sound/soc/atmel/snd-soc-atmel-i2s.ko] und= efined! Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx f= amily of SOCs." ) Signed-off-by: Randy Dunlap Reviewed-by: Jonathan Cameron Acked-by: Florian Fainelli Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/mips/bcm63xx/clk.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c index 4f375050ab8e9..3be875a45c834 100644 --- a/arch/mips/bcm63xx/clk.c +++ b/arch/mips/bcm63xx/clk.c @@ -342,6 +342,12 @@ struct clk *clk_get_parent(struct clk *clk) } EXPORT_SYMBOL(clk_get_parent); =20 +int clk_set_parent(struct clk *clk, struct clk *parent) +{ + return 0; +} +EXPORT_SYMBOL(clk_set_parent); + unsigned long clk_get_rate(struct clk *clk) { return clk->rate; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21BDBC433F5 for ; Mon, 24 Jan 2022 19:05:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345944AbiAXTEt (ORCPT ); Mon, 24 Jan 2022 14:04:49 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:56764 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343972AbiAXS5o (ORCPT ); Mon, 24 Jan 2022 13:57:44 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4F2B361571; Mon, 24 Jan 2022 18:57:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1C2F0C340E5; Mon, 24 Jan 2022 18:57:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050663; bh=Qjjcms0dCT2MCUurdm3bONYYlLGmNucgLwcM9IbxerE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LCpIuFmHfdgEV/6wEf6JytC1c0lRO8d7n+/UA4TOT7GFxRp+zuwi1p83Pbk6EPrnI HHNUSJL75ibyQWQKQLyH4RPETIAUPHxu1gs+Xlj/Lz8SaU9GwVSH4qOchzQfm18nl7 OkkxRmsuzPP4ii83/j9Yzy0naN+NcLoXvts1UnQM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kamal Heib , Leon Romanovsky , Jason Gunthorpe , Sasha Levin Subject: [PATCH 4.9 072/157] RDMA/cxgb4: Set queue pair state when being queried Date: Mon, 24 Jan 2022 19:42:42 +0100 Message-Id: <20220124183935.077018026@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kamal Heib [ Upstream commit e375b9c92985e409c4bb95dd43d34915ea7f5e28 ] The API for ib_query_qp requires the driver to set cur_qp_state on return, add the missing set. Fixes: 67bbc05512d8 ("RDMA/cxgb4: Add query_qp support") Link: https://lore.kernel.org/r/20211220152530.60399-1-kamalheib1@gmail.com Signed-off-by: Kamal Heib Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/infiniband/hw/cxgb4/qp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4= /qp.c index 87bc7b0db892b..2eeac8401c927 100644 --- a/drivers/infiniband/hw/cxgb4/qp.c +++ b/drivers/infiniband/hw/cxgb4/qp.c @@ -1974,6 +1974,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp= _attr *attr, memset(attr, 0, sizeof *attr); memset(init_attr, 0, sizeof *init_attr); attr->qp_state =3D to_ib_qp_state(qhp->attr.state); + attr->cur_qp_state =3D to_ib_qp_state(qhp->attr.state); init_attr->cap.max_send_wr =3D qhp->attr.sq_num_entries; init_attr->cap.max_recv_wr =3D qhp->attr.rq_num_entries; init_attr->cap.max_send_sge =3D qhp->attr.sq_max_sges; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00647C433FE for ; Mon, 24 Jan 2022 19:01:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344660AbiAXTBt (ORCPT ); Mon, 24 Jan 2022 14:01:49 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:55618 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343518AbiAXS5t (ORCPT ); Mon, 24 Jan 2022 13:57:49 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 09CC5B8121C; Mon, 24 Jan 2022 18:57:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2DF25C340E5; Mon, 24 Jan 2022 18:57:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050666; bh=8HhqhLYUtzscszQjAX1dCUydahnbhPvnAe7pYo2zT+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zYd5Bvls/YEUFsQUt3AK+YZrMqvsifYgAWqP3YEYKCLIIZBjl4Xt7C61vzSbRDL/M oLKHITcHGOKlILK4sbbiO6O1BEnAFq0ysFNhfpczQLBMmfBHlco6mQU0PvSoMhjX/g cKc7gFFq2NROdJo5N++c8yGJ8FRG2NksbP72HjHI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wei Yongjun , Marcel Holtmann , Sasha Levin Subject: [PATCH 4.9 073/157] Bluetooth: Fix debugfs entry leak in hci_register_dev() Date: Mon, 24 Jan 2022 19:42:43 +0100 Message-Id: <20220124183935.107317641@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wei Yongjun [ Upstream commit 5a4bb6a8e981d3d0d492aa38412ee80b21033177 ] Fault injection test report debugfs entry leak as follows: debugfs: Directory 'hci0' with parent 'bluetooth' already present! When register_pm_notifier() failed in hci_register_dev(), the debugfs create by debugfs_create_dir() do not removed in the error handing path. Add the remove debugfs code to fix it. Signed-off-by: Wei Yongjun Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- net/bluetooth/hci_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index b43f31203a430..40e6e5feb1e06 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3148,6 +3148,7 @@ int hci_register_dev(struct hci_dev *hdev) return id; =20 err_wqueue: + debugfs_remove_recursive(hdev->debugfs); destroy_workqueue(hdev->workqueue); destroy_workqueue(hdev->req_workqueue); err: --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B90FFC4167B for ; Mon, 24 Jan 2022 19:06:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346309AbiAXTFU (ORCPT ); Mon, 24 Jan 2022 14:05:20 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:53666 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343848AbiAXS5w (ORCPT ); Mon, 24 Jan 2022 13:57:52 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 382A2B81243; Mon, 24 Jan 2022 18:57:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D0B8C340EC; Mon, 24 Jan 2022 18:57:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050669; bh=tvYs1VSePffa4h5x8YjWrQTm+RhMLjGYNBC6EzBNKdU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Jaa5jmhznhj5/G8HnXTwnxiQelejV1z3GQSMwUiloxIwjEFFpKXui35xVCFuyxRlN 9+fgF8WVVd7w7wg7GqZzadaQY7SzQYpPP/Y6BrN7vv+HzCkl3YT6A7SPF/KccJ0P20 DbqXEqkWVoV8edGoL84qzdm1o5n7m1bvYNCOd4cg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Aring , David Teigland , Sasha Levin Subject: [PATCH 4.9 074/157] fs: dlm: filter user dlm messages for kernel locks Date: Mon, 24 Jan 2022 19:42:44 +0100 Message-Id: <20220124183935.136173920@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Aring [ Upstream commit 6c2e3bf68f3e5e5a647aa52be246d5f552d7496d ] This patch fixes the following crash by receiving a invalid message: [ 160.672220] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 160.676206] BUG: KASAN: user-memory-access in dlm_user_add_ast+0xc3/0x370 [ 160.679659] Read of size 8 at addr 00000000deadbeef by task kworker/u32:= 13/319 [ 160.681447] [ 160.681824] CPU: 10 PID: 319 Comm: kworker/u32:13 Not tainted 5.14.0-rc2= + #399 [ 160.683472] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.14.0-1.module+el8= .6.0+12648+6ede71a5 04/01/2014 [ 160.685574] Workqueue: dlm_recv process_recv_sockets [ 160.686721] Call Trace: [ 160.687310] dump_stack_lvl+0x56/0x6f [ 160.688169] ? dlm_user_add_ast+0xc3/0x370 [ 160.689116] kasan_report.cold.14+0x116/0x11b [ 160.690138] ? dlm_user_add_ast+0xc3/0x370 [ 160.690832] dlm_user_add_ast+0xc3/0x370 [ 160.691502] _receive_unlock_reply+0x103/0x170 [ 160.692241] _receive_message+0x11df/0x1ec0 [ 160.692926] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 160.693700] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 160.694427] ? lock_acquire+0x175/0x400 [ 160.695058] ? do_purge.isra.51+0x200/0x200 [ 160.695744] ? lock_acquired+0x360/0x5d0 [ 160.696400] ? lock_contended+0x6a0/0x6a0 [ 160.697055] ? lock_release+0x21d/0x5e0 [ 160.697686] ? lock_is_held_type+0xe0/0x110 [ 160.698352] ? lock_is_held_type+0xe0/0x110 [ 160.699026] ? ___might_sleep+0x1cc/0x1e0 [ 160.699698] ? dlm_wait_requestqueue+0x94/0x140 [ 160.700451] ? dlm_process_requestqueue+0x240/0x240 [ 160.701249] ? down_write_killable+0x2b0/0x2b0 [ 160.701988] ? do_raw_spin_unlock+0xa2/0x130 [ 160.702690] dlm_receive_buffer+0x1a5/0x210 [ 160.703385] dlm_process_incoming_buffer+0x726/0x9f0 [ 160.704210] receive_from_sock+0x1c0/0x3b0 [ 160.704886] ? dlm_tcp_shutdown+0x30/0x30 [ 160.705561] ? lock_acquire+0x175/0x400 [ 160.706197] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 160.706941] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 160.707681] process_recv_sockets+0x32/0x40 [ 160.708366] process_one_work+0x55e/0xad0 [ 160.709045] ? pwq_dec_nr_in_flight+0x110/0x110 [ 160.709820] worker_thread+0x65/0x5e0 [ 160.710423] ? process_one_work+0xad0/0xad0 [ 160.711087] kthread+0x1ed/0x220 [ 160.711628] ? set_kthread_struct+0x80/0x80 [ 160.712314] ret_from_fork+0x22/0x30 The issue is that we received a DLM message for a user lock but the destination lock is a kernel lock. Note that the address which is trying to derefence is 00000000deadbeef, which is in a kernel lock lkb->lkb_astparam, this field should never be derefenced by the DLM kernel stack. In case of a user lock lkb->lkb_astparam is lkb->lkb_ua (memory is shared by a union field). The struct lkb_ua will be handled by the DLM kernel stack but on a kernel lock it will contain invalid data and ends in most likely crashing the kernel. It can be reproduced with two cluster nodes. node 2: dlm_tool join test echo "862 fooobaar 1 2 1" > /sys/kernel/debug/dlm/test_locks echo "862 3 1" > /sys/kernel/debug/dlm/test_waiters node 1: dlm_tool join test python: foo =3D DLM(h_cmd=3D3, o_nextcmd=3D1, h_nodeid=3D1, h_lockspace=3D0x7722202= 7, \ m_type=3D7, m_flags=3D0x1, m_remid=3D0x862, m_result=3D0xFFFEFFFE) newFile =3D open("/sys/kernel/debug/dlm/comms/2/rawmsg", "wb") newFile.write(bytes(foo)) Signed-off-by: Alexander Aring Signed-off-by: David Teigland Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- fs/dlm/lock.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c index 3a7f401e943c1..ffab7dc881574 100644 --- a/fs/dlm/lock.c +++ b/fs/dlm/lock.c @@ -3975,6 +3975,14 @@ static int validate_message(struct dlm_lkb *lkb, str= uct dlm_message *ms) int from =3D ms->m_header.h_nodeid; int error =3D 0; =20 + /* currently mixing of user/kernel locks are not supported */ + if (ms->m_flags & DLM_IFL_USER && ~lkb->lkb_flags & DLM_IFL_USER) { + log_error(lkb->lkb_resource->res_ls, + "got user dlm message for a kernel lock"); + error =3D -EINVAL; + goto out; + } + switch (ms->m_type) { case DLM_MSG_CONVERT: case DLM_MSG_UNLOCK: @@ -4003,6 +4011,7 @@ static int validate_message(struct dlm_lkb *lkb, stru= ct dlm_message *ms) error =3D -EINVAL; } =20 +out: if (error) log_error(lkb->lkb_resource->res_ls, "ignore invalid message %d from %d %x %x %x %d", --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40BD5C433FE for ; Mon, 24 Jan 2022 19:02:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344705AbiAXTB4 (ORCPT ); Mon, 24 Jan 2022 14:01:56 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:56912 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344104AbiAXS5y (ORCPT ); Mon, 24 Jan 2022 13:57:54 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AD52C61318; Mon, 24 Jan 2022 18:57:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 88235C340E5; Mon, 24 Jan 2022 18:57:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050673; bh=X2HMSLWSypMHKIOh7Y660kYKewFTYjIlF/6xNVgEuFs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BYUQYybYptfOC0sbkpaRLon2SWR6uAZWWwcFZHpiNSZxHiZdzyMh5xD8CjueZKLCX XEzjyKfr0VNJEV10QYuTc9ZGfL7+n0FBBw0x5UgNIMY6N1uk3rNzlavr0oCi9CRuDj u2cwQ0c/S//Ul0ZFJXQ39pz4UWlrolUu/TIYSuUE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zekun Shen , Kalle Valo , Sasha Levin Subject: [PATCH 4.9 075/157] ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply Date: Mon, 24 Jan 2022 19:42:45 +0100 Message-Id: <20220124183935.166532036@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit ae80b6033834342601e99f74f6a62ff5092b1cee ] Unexpected WDCMSG_TARGET_START replay can lead to null-ptr-deref when ar->tx_cmd->odata is NULL. The patch adds a null check to prevent such case. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] ar5523_cmd+0x46a/0x581 [ar5523] ar5523_probe.cold+0x1b7/0x18da [ar5523] ? ar5523_cmd_rx_cb+0x7a0/0x7a0 [ar5523] ? __pm_runtime_set_status+0x54a/0x8f0 ? _raw_spin_trylock_bh+0x120/0x120 ? pm_runtime_barrier+0x220/0x220 ? __pm_runtime_resume+0xb1/0xf0 usb_probe_interface+0x25b/0x710 really_probe+0x209/0x5d0 driver_probe_device+0xc6/0x1b0 device_driver_attach+0xe2/0x120 I found the bug using a custome USBFuzz port. It's a research work to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, providing hand-crafted usb descriptors to QEMU. After fixing the code (fourth byte in usb packet) to WDCMSG_TARGET_START, I got the null-ptr-deref bug. I believe the bug is triggerable whenever cmd->odata is NULL. After patching, I tested with the same input and no longer see the KASAN report. This was NOT tested on a real device. Signed-off-by: Zekun Shen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YXsmPQ3awHFLuAj2@10-18-43-117.dynapool.wire= less.nyu.edu Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/wireless/ath/ar5523/ar5523.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireles= s/ath/ar5523/ar5523.c index 9f4ee1d125b68..0c6b33c464cd9 100644 --- a/drivers/net/wireless/ath/ar5523/ar5523.c +++ b/drivers/net/wireless/ath/ar5523/ar5523.c @@ -153,6 +153,10 @@ static void ar5523_cmd_rx_cb(struct urb *urb) ar5523_err(ar, "Invalid reply to WDCMSG_TARGET_START"); return; } + if (!cmd->odata) { + ar5523_err(ar, "Unexpected WDCMSG_TARGET_START reply"); + return; + } memcpy(cmd->odata, hdr + 1, sizeof(u32)); cmd->olen =3D sizeof(u32); cmd->res =3D 0; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78146C433EF for ; Mon, 24 Jan 2022 19:06:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344981AbiAXTG1 (ORCPT ); Mon, 24 Jan 2022 14:06:27 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57424 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345389AbiAXTAN (ORCPT ); Mon, 24 Jan 2022 14:00:13 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B2149B81236; Mon, 24 Jan 2022 19:00:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1A98C340E5; Mon, 24 Jan 2022 19:00:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050810; bh=46ZQ2Ukvtqdel2YKeI9Beyu+coFEEPVZxoQUk1YKJUY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lEDO1P8+vcdWgtmZiCU/NEiRmyQeTHlH0/JWJIlshPpaPnAy9ngSa7UQxbQPLZ/tN kOXpsYn4Gs3iNfC1oF+cTo4QELWxZuBz51dR2dNjt0H4HdE7cF+BdBKyJ4PjEiQnDW c4dnwuM0gT3IMqgM/f2tfNyWYNTxnX4h8JWBKbr4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Keeping , Pavankumar Kondeti , Sasha Levin Subject: [PATCH 4.9 076/157] usb: gadget: f_fs: Use stream_open() for endpoint files Date: Mon, 24 Jan 2022 19:42:46 +0100 Message-Id: <20220124183935.198233579@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavankumar Kondeti [ Upstream commit c76ef96fc00eb398c8fc836b0eb2f82bcc619dc7 ] Function fs endpoint file operations are synchronized via an interruptible mutex wait. However we see threads that do ep file operations concurrently are getting blocked for the mutex lock in __fdget_pos(). This is an uninterruptible wait and we see hung task warnings and kernel panic if hung_task_panic systcl is enabled if host does not send/receive the data for long time. The reason for threads getting blocked in __fdget_pos() is due to the file position protection introduced by the commit 9c225f2655e3 ("vfs: atomic f_pos accesses as per POSIX"). Since function fs endpoint files does not have the notion of the file position, switch to the stream mode. This will bypass the file position mutex and threads will be blocked in interruptible state for the function fs mutex. It should not affects user space as we are only changing the task state changes the task state from UNINTERRUPTIBLE to INTERRUPTIBLE while waiting for the USB transfers to be finished. However there is a slight change to the O_NONBLOCK behavior. Earlier threads that are using O_NONBLOCK are also getting blocked inside fdget_pos(). Now they reach to function fs and error code is returned. The non blocking behavior is actually honoured now. Reviewed-by: John Keeping Signed-off-by: Pavankumar Kondeti Link: https://lore.kernel.org/r/1636712682-1226-1-git-send-email-quic_pkond= eti@quicinc.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/usb/gadget/function/f_fs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/functi= on/f_fs.c index 0336392686935..e4826454de1a7 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -608,7 +608,7 @@ static int ffs_ep0_open(struct inode *inode, struct fil= e *file) file->private_data =3D ffs; ffs_data_opened(ffs); =20 - return 0; + return stream_open(inode, file); } =20 static int ffs_ep0_release(struct inode *inode, struct file *file) @@ -1071,7 +1071,7 @@ ffs_epfile_open(struct inode *inode, struct file *fil= e) file->private_data =3D epfile; ffs_data_opened(epfile->ffs); =20 - return 0; + return stream_open(inode, file); } =20 static int ffs_aio_cancel(struct kiocb *kiocb) --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 37D01C43219 for ; Mon, 24 Jan 2022 19:06:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346021AbiAXTE5 (ORCPT ); Mon, 24 Jan 2022 14:04:57 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:56126 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344165AbiAXS6V (ORCPT ); Mon, 24 Jan 2022 13:58:21 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E94A4B8122F; Mon, 24 Jan 2022 18:58:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 26A08C340E5; Mon, 24 Jan 2022 18:58:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050698; bh=+0PMCPFJn7nX+bXhEzg0RONY2GIh1YcE9doSXyviagA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iTnQ6D00rw2cKE0/1U+7ujWlhFa98V8fKTRMrejd0ceHu5LzeQRnT9mNOlIP/Nu46 BuQ4I3tZNPJCDaanz7vQhAZeFlVosc0DOLDga+SN9TD5iFrY7u1+IjGdZBA9mw0N0R IW0ipgYfSIJ72WfuF7VPvhM9wfrk4N0LiQjJx2uI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= , Jiri Kosina , Sasha Levin Subject: [PATCH 4.9 077/157] HID: apple: Do not reset quirks when the Fn key is not found Date: Mon, 24 Jan 2022 19:42:47 +0100 Message-Id: <20220124183935.228809192@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jos=C3=A9 Exp=C3=B3sito [ Upstream commit a5fe7864d8ada170f19cc47d176bf8260ffb4263 ] When a keyboard without a function key is detected, instead of removing all quirks, remove only the APPLE_HAS_FN quirk. Signed-off-by: Jos=C3=A9 Exp=C3=B3sito Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/hid/hid-apple.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c index 149902619cbc8..0074091c27aa2 100644 --- a/drivers/hid/hid-apple.c +++ b/drivers/hid/hid-apple.c @@ -390,7 +390,7 @@ static int apple_input_configured(struct hid_device *hd= ev, =20 if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) { hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disab= ling Fn key handling\n"); - asc->quirks =3D 0; + asc->quirks &=3D ~APPLE_HAS_FN; } =20 return 0; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 382D2C433EF for ; Mon, 24 Jan 2022 19:11:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347156AbiAXTJp (ORCPT ); Mon, 24 Jan 2022 14:09:45 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46092 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345276AbiAXTDN (ORCPT ); Mon, 24 Jan 2022 14:03:13 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1FD58C0617B1; Mon, 24 Jan 2022 10:58:54 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A17406156C; Mon, 24 Jan 2022 18:58:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82B77C340E5; Mon, 24 Jan 2022 18:58:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050733; bh=YH7HfRmQPrQX2wNff6Hbvunfjo8I8OoZpWqxbVVvQtc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qUArMgqO2Y5CqKmBOz+yQLmpVjLewhIKX1gGitQbt1SaNjMM1CdRXCnbn/UUDfH8r u18SBQwpUs1V+OZPECBGafpUhahqAkPXz8GBHhdslQtgRNqLpKbkIu/TszY/rRYKeO 2fJDFh5PyqbPgJy4HmNEh/gcuFnOTuR4YSDpqPx8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.9 078/157] media: b2c2: Add missing check in flexcop_pci_isr: Date: Mon, 24 Jan 2022 19:42:48 +0100 Message-Id: <20220124183935.259065698@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit b13203032e679674c7c518f52a7ec0801ca3a829 ] A out-of-bounds bug can be triggered by an interrupt, the reason for this bug is the lack of checking of register values. In flexcop_pci_isr, the driver reads value from a register and uses it as a dma address. Finally, this address will be passed to the count parameter of find_next_packet. If this value is larger than the size of dma, the index of buffer will be out-of-bounds. Fix this by adding a check after reading the value of the register. The following KASAN report reveals it: BUG: KASAN: slab-out-of-bounds in find_next_packet drivers/media/dvb-core/dvb_demux.c:528 [inline] BUG: KASAN: slab-out-of-bounds in _dvb_dmx_swfilter drivers/media/dvb-core/dvb_demux.c:572 [inline] BUG: KASAN: slab-out-of-bounds in dvb_dmx_swfilter+0x3fa/0x420 drivers/media/dvb-core/dvb_demux.c:603 Read of size 1 at addr ffff8880608c00a0 by task swapper/2/0 CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef #25 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xec/0x156 lib/dump_stack.c:118 print_address_description+0x78/0x290 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report+0x25b/0x380 mm/kasan/report.c:412 __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:430 find_next_packet drivers/media/dvb-core/dvb_demux.c:528 [inline] _dvb_dmx_swfilter drivers/media/dvb-core/dvb_demux.c:572 [inline] dvb_dmx_swfilter+0x3fa/0x420 drivers/media/dvb-core/dvb_demux.c:603 flexcop_pass_dmx_data+0x2e/0x40 drivers/media/common/b2c2/flexcop.c:167 flexcop_pci_isr+0x3d1/0x5d0 drivers/media/pci/b2c2/flexcop-pci.c:212 __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149 handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189 handle_irq_event+0xac/0x140 kernel/irq/handle.c:206 handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87 do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 RIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61 Code: 00 00 55 be 04 00 00 00 48 c7 c7 00 62 2f 8c 48 89 e5 e8 fb 31 e8 f8 8b 05 75 4f 8e 03 85 c0 7e 07 0f 00 2d 8a 61 66 00 fb f4 <5d> c3 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 RSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde RAX: 0000000000000000 RBX: ffffffff8bde44c8 RCX: ffffffff88a11285 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2f6200 RBP: ffff88806b71fcc8 R08: fffffbfff185ec40 R09: fffffbfff185ec40 R10: 0000000000000001 R11: fffffbfff185ec40 R12: 0000000000000002 R13: ffffffff8be9d6e0 R14: 0000000000000000 R15: 0000000000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline] default_idle+0x6f/0x360 arch/x86/kernel/process.c:557 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548 default_idle_call+0x3b/0x60 kernel/sched/idle.c:93 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263 cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369 start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 Allocated by task 1: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:553 kasan_slab_alloc+0x11/0x20 mm/kasan/kasan.c:490 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc_node mm/slub.c:2741 [inline] slab_alloc mm/slub.c:2749 [inline] kmem_cache_alloc+0xeb/0x280 mm/slub.c:2754 kmem_cache_zalloc include/linux/slab.h:699 [inline] __kernfs_new_node+0xe2/0x6f0 fs/kernfs/dir.c:633 kernfs_new_node+0x9a/0x120 fs/kernfs/dir.c:693 __kernfs_create_file+0x5f/0x340 fs/kernfs/file.c:992 sysfs_add_file_mode_ns+0x22a/0x4e0 fs/sysfs/file.c:306 create_files fs/sysfs/group.c:63 [inline] internal_create_group+0x34e/0xc30 fs/sysfs/group.c:147 sysfs_create_group fs/sysfs/group.c:173 [inline] sysfs_create_groups+0x9c/0x140 fs/sysfs/group.c:200 driver_add_groups+0x3e/0x50 drivers/base/driver.c:129 bus_add_driver+0x3a5/0x790 drivers/base/bus.c:684 driver_register+0x1cd/0x410 drivers/base/driver.c:170 __pci_register_driver+0x197/0x200 drivers/pci/pci-driver.c:1411 cx88_audio_pci_driver_init+0x23/0x25 drivers/media/pci/cx88/cx88-alsa.c: 1017 do_one_initcall+0xe0/0x610 init/main.c:884 do_initcall_level init/main.c:952 [inline] do_initcalls init/main.c:960 [inline] do_basic_setup init/main.c:978 [inline] kernel_init_freeable+0x4d0/0x592 init/main.c:1145 kernel_init+0x18/0x190 init/main.c:1062 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8880608c0000 which belongs to the cache kernfs_node_cache of size 160 The buggy address is located 0 bytes to the right of 160-byte region [ffff8880608c0000, ffff8880608c00a0) The buggy address belongs to the page: page:ffffea0001823000 count:1 mapcount:0 mapping:ffff88806bed1e00 index:0x0 compound_mapcount: 0 flags: 0x100000000008100(slab|head) raw: 0100000000008100 dead000000000100 dead000000000200 ffff88806bed1e00 raw: 0000000000000000 0000000000240024 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880608bff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880608c0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880608c0080: 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 ^ ffff8880608c0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880608c0180: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Link: https://lore.kernel.org/linux-media/1620723603-30912-1-git-send-email= -zheyuma97@gmail.com Reported-by: Zheyu Ma Signed-off-by: Zheyu Ma Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/pci/b2c2/flexcop-pci.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/media/pci/b2c2/flexcop-pci.c b/drivers/media/pci/b2c2/= flexcop-pci.c index 4cac1fc233f28..98e94cd8bfad7 100644 --- a/drivers/media/pci/b2c2/flexcop-pci.c +++ b/drivers/media/pci/b2c2/flexcop-pci.c @@ -184,6 +184,8 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_i= d) dma_addr_t cur_addr =3D fc->read_ibi_reg(fc,dma1_008).dma_0x8.dma_cur_addr << 2; u32 cur_pos =3D cur_addr - fc_pci->dma[0].dma_addr0; + if (cur_pos > fc_pci->dma[0].size * 2) + goto error; =20 deb_irq("%u irq: %08x cur_addr: %llx: cur_pos: %08x, " "last_cur_pos: %08x ", @@ -225,6 +227,7 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_i= d) ret =3D IRQ_NONE; } =20 +error: spin_unlock_irqrestore(&fc_pci->irq_lock, flags); return ret; } --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 87A37C4321E for ; Mon, 24 Jan 2022 19:06:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346250AbiAXTFO (ORCPT ); Mon, 24 Jan 2022 14:05:14 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57104 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344474AbiAXS7b (ORCPT ); Mon, 24 Jan 2022 13:59:31 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1B3D2B81223; Mon, 24 Jan 2022 18:59:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 30B64C340E5; Mon, 24 Jan 2022 18:59:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050768; bh=FOyqZlOeBq6u+MSMKyoUAfWpX/QM9j9Q1bEwVmshbS4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BEI8GBTbDswwxFN42t/MaJeiChfPsVMqkTG1pKirsx93MNXmEvTJsQ4tpisFj5kJU ZkHIgADFQ0f37PQxrntwkoA1BWjN+VFuK2DiSdzs1FSiqrhcN4CrJqgkYzZwORON/i tMOklyxb5ArWtazvGWfV/OmrsPn3SEgN4tG5K/g4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukas Bulwahn , Arnd Bergmann , Shawn Guo , Sasha Levin Subject: [PATCH 4.9 079/157] ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART Date: Mon, 24 Jan 2022 19:42:49 +0100 Message-Id: <20220124183935.290933240@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Bulwahn [ Upstream commit b0100bce4ff82ec1ccd3c1f3d339fd2df6a81784 ] Since commit 4b563a066611 ("ARM: imx: Remove imx21 support"), the config DEBUG_IMX21_IMX27_UART is really only debug support for IMX27. So, rename this option to DEBUG_IMX27_UART and adjust dependencies in Kconfig and rename the definitions to IMX27 as further clean-up. This issue was discovered with ./scripts/checkkconfigsymbols.py, which reported that DEBUG_IMX21_IMX27_UART depends on the non-existing config SOC_IMX21. Signed-off-by: Lukas Bulwahn Reviewed-by: Arnd Bergmann Signed-off-by: Shawn Guo Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/arm/Kconfig.debug | 14 +++++++------- arch/arm/include/debug/imx-uart.h | 18 +++++++++--------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug index bb8f39fe3a225..8349a171a8f3c 100644 --- a/arch/arm/Kconfig.debug +++ b/arch/arm/Kconfig.debug @@ -341,12 +341,12 @@ choice Say Y here if you want kernel low-level debugging support on i.MX25. =20 - config DEBUG_IMX21_IMX27_UART - bool "i.MX21 and i.MX27 Debug UART" - depends on SOC_IMX21 || SOC_IMX27 + config DEBUG_IMX27_UART + bool "i.MX27 Debug UART" + depends on SOC_IMX27 help Say Y here if you want kernel low-level debugging support - on i.MX21 or i.MX27. + on i.MX27. =20 config DEBUG_IMX28_UART bool "i.MX28 Debug UART" @@ -1350,7 +1350,7 @@ config DEBUG_IMX_UART_PORT int "i.MX Debug UART Port Selection" depends on DEBUG_IMX1_UART || \ DEBUG_IMX25_UART || \ - DEBUG_IMX21_IMX27_UART || \ + DEBUG_IMX27_UART || \ DEBUG_IMX31_UART || \ DEBUG_IMX35_UART || \ DEBUG_IMX50_UART || \ @@ -1403,12 +1403,12 @@ config DEBUG_LL_INCLUDE default "debug/icedcc.S" if DEBUG_ICEDCC default "debug/imx.S" if DEBUG_IMX1_UART || \ DEBUG_IMX25_UART || \ - DEBUG_IMX21_IMX27_UART || \ + DEBUG_IMX27_UART || \ DEBUG_IMX31_UART || \ DEBUG_IMX35_UART || \ DEBUG_IMX50_UART || \ DEBUG_IMX51_UART || \ - DEBUG_IMX53_UART ||\ + DEBUG_IMX53_UART || \ DEBUG_IMX6Q_UART || \ DEBUG_IMX6SL_UART || \ DEBUG_IMX6SX_UART || \ diff --git a/arch/arm/include/debug/imx-uart.h b/arch/arm/include/debug/imx= -uart.h index bce58e975ad1f..c750cc9876f6d 100644 --- a/arch/arm/include/debug/imx-uart.h +++ b/arch/arm/include/debug/imx-uart.h @@ -14,13 +14,6 @@ #define IMX1_UART_BASE_ADDR(n) IMX1_UART##n##_BASE_ADDR #define IMX1_UART_BASE(n) IMX1_UART_BASE_ADDR(n) =20 -#define IMX21_UART1_BASE_ADDR 0x1000a000 -#define IMX21_UART2_BASE_ADDR 0x1000b000 -#define IMX21_UART3_BASE_ADDR 0x1000c000 -#define IMX21_UART4_BASE_ADDR 0x1000d000 -#define IMX21_UART_BASE_ADDR(n) IMX21_UART##n##_BASE_ADDR -#define IMX21_UART_BASE(n) IMX21_UART_BASE_ADDR(n) - #define IMX25_UART1_BASE_ADDR 0x43f90000 #define IMX25_UART2_BASE_ADDR 0x43f94000 #define IMX25_UART3_BASE_ADDR 0x5000c000 @@ -29,6 +22,13 @@ #define IMX25_UART_BASE_ADDR(n) IMX25_UART##n##_BASE_ADDR #define IMX25_UART_BASE(n) IMX25_UART_BASE_ADDR(n) =20 +#define IMX27_UART1_BASE_ADDR 0x1000a000 +#define IMX27_UART2_BASE_ADDR 0x1000b000 +#define IMX27_UART3_BASE_ADDR 0x1000c000 +#define IMX27_UART4_BASE_ADDR 0x1000d000 +#define IMX27_UART_BASE_ADDR(n) IMX27_UART##n##_BASE_ADDR +#define IMX27_UART_BASE(n) IMX27_UART_BASE_ADDR(n) + #define IMX31_UART1_BASE_ADDR 0x43f90000 #define IMX31_UART2_BASE_ADDR 0x43f94000 #define IMX31_UART3_BASE_ADDR 0x5000c000 @@ -115,10 +115,10 @@ =20 #ifdef CONFIG_DEBUG_IMX1_UART #define UART_PADDR IMX_DEBUG_UART_BASE(IMX1) -#elif defined(CONFIG_DEBUG_IMX21_IMX27_UART) -#define UART_PADDR IMX_DEBUG_UART_BASE(IMX21) #elif defined(CONFIG_DEBUG_IMX25_UART) #define UART_PADDR IMX_DEBUG_UART_BASE(IMX25) +#elif defined(CONFIG_DEBUG_IMX27_UART) +#define UART_PADDR IMX_DEBUG_UART_BASE(IMX27) #elif defined(CONFIG_DEBUG_IMX31_UART) #define UART_PADDR IMX_DEBUG_UART_BASE(IMX31) #elif defined(CONFIG_DEBUG_IMX35_UART) --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3DBFC433F5 for ; Mon, 24 Jan 2022 19:04:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344090AbiAXTEF (ORCPT ); Mon, 24 Jan 2022 14:04:05 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:55670 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345141AbiAXS7w (ORCPT ); Mon, 24 Jan 2022 13:59:52 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B8E4760917; Mon, 24 Jan 2022 18:59:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 794FEC340E5; Mon, 24 Jan 2022 18:59:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050791; bh=mt14UD5wwUsEVPzv/slcZn+yEj+oYq8IMyN2ZD3IgCw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zSGK7A+MOyaEkY1WRjDmCEqPOopGSAmXxHfdiHfS68eVcfkMps1OljmyXjKjUgHDa wykEzlM1LmVwRCPtGUwv5Z4I0QGHHDm11G5w8FG6sjZv6b9LDWyZ+9WbZRsQ5J/Crg jvOH0ridKvYC5cRZFac/gDdmyxSajOwzVHHPm4+M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hans de Goede , Andy Shevchenko , Sasha Levin Subject: [PATCH 4.9 080/157] gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use Date: Mon, 24 Jan 2022 19:42:50 +0100 Message-Id: <20220124183935.323620286@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hans de Goede [ Upstream commit bdfd6ab8fdccd8b138837efff66f4a1911496378 ] If the IRQ is already in use, then acpi_dev_gpio_irq_get_by() really should not change the type underneath the current owner. I specifically hit an issue with this an a Chuwi Hi8 Super (CWI509) Bay Trail tablet, when the Boot OS selection in the BIOS is set to Android. In this case _STA for a MAX17047 ACPI I2C device wrongly returns 0xf and the _CRS resources for this device include a GpioInt pointing to a GPIO already in use by an _AEI handler, with a different type then specified in the _CRS for the MAX17047 device. Leading to the acpi_dev_gpio_irq_get() call done by the i2c-core-acpi.c code changing the type breaking the _AEI handler. Now this clearly is a bug in the DSDT of this tablet (in Android mode), but in general calling irq_set_irq_type() on an IRQ which already is in use seems like a bad idea. Signed-off-by: Hans de Goede Signed-off-by: Andy Shevchenko Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/gpio/gpiolib-acpi.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c index 986248f7011aa..c479280590e42 100644 --- a/drivers/gpio/gpiolib-acpi.c +++ b/drivers/gpio/gpiolib-acpi.c @@ -675,10 +675,17 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, i= nt index) irq_flags =3D acpi_dev_get_irq_type(info.triggering, info.polarity); =20 - /* Set type if specified and different than the current one */ - if (irq_flags !=3D IRQ_TYPE_NONE && - irq_flags !=3D irq_get_trigger_type(irq)) - irq_set_irq_type(irq, irq_flags); + /* + * If the IRQ is not already in use then set type + * if specified and different than the current one. + */ + if (can_request_irq(irq, irq_flags)) { + if (irq_flags !=3D IRQ_TYPE_NONE && + irq_flags !=3D irq_get_trigger_type(irq)) + irq_set_irq_type(irq, irq_flags); + } else { + dev_dbg(&adev->dev, "IRQ %d already in use\n", irq); + } =20 return irq; } --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4230DC433EF for ; Mon, 24 Jan 2022 19:04:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344896AbiAXTEY (ORCPT ); Mon, 24 Jan 2022 14:04:24 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57298 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345206AbiAXS74 (ORCPT ); Mon, 24 Jan 2022 13:59:56 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B707CB8121C; Mon, 24 Jan 2022 18:59:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D6AE1C340E5; Mon, 24 Jan 2022 18:59:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050794; bh=8+gCBx0g7+QE7u/fTFVaw7lf8xg7PIrSLStF9YpUgcY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xHKf48nyTKpw/plnmYAT6zNUOJeROWaddZQmsn9VnES2b0+MxEUWPIP2cpdIZlNfT 87wRhOtXh9bPkysGf7MUV0TGlP0bP8Oqk0WjAhi1TmVjSbQqK/HyLh3MXH3GS80ow+ pcT+y6y0Ga2knJ0ErF6xyoWvaWtBvLGnDpKRho54= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengfeng Ye , Sebastian Reichel , Sasha Levin Subject: [PATCH 4.9 081/157] HSI: core: Fix return freed object in hsi_new_client Date: Mon, 24 Jan 2022 19:42:51 +0100 Message-Id: <20220124183935.354484686@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengfeng Ye [ Upstream commit a1ee1c08fcd5af03187dcd41dcab12fd5b379555 ] cl is freed on error of calling device_register, but this object is return later, which will cause uaf issue. Fix it by return NULL on error. Signed-off-by: Chengfeng Ye Signed-off-by: Sebastian Reichel Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/hsi/hsi_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c index e9d63b966caff..4a9fd745b8cb4 100644 --- a/drivers/hsi/hsi_core.c +++ b/drivers/hsi/hsi_core.c @@ -115,6 +115,7 @@ struct hsi_client *hsi_new_client(struct hsi_port *port, if (device_register(&cl->device) < 0) { pr_err("hsi: failed to register client: %s\n", info->name); put_device(&cl->device); + goto err; } =20 return cl; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 27221C433FE for ; Mon, 24 Jan 2022 19:13:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346456AbiAXTNl (ORCPT ); Mon, 24 Jan 2022 14:13:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46098 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346206AbiAXTFN (ORCPT ); Mon, 24 Jan 2022 14:05:13 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 53251C06176D; Mon, 24 Jan 2022 11:00:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1BAB2B8119D; Mon, 24 Jan 2022 18:59:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2C9E8C340E5; Mon, 24 Jan 2022 18:59:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050797; bh=ytqGsn8MmYRAVpbzLdd12cjfjLBCERwhbxRlqhLvZ30=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XX3C2T7XakFqsaq1EPmfggB3fyQtqbJUCGOMfzccuIDnU3f6S2FjixYLj2O1vhYlE 6/ZeFuAyLGuLrUpvSH9N/q+9J0eiskDGKZQvb0gdONs6KNIcJb95v2ZMpEMH0H5dkM J0gcln9gk9qEI9lihg6TG5DVnFliujEc7cDCU8E4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brendan Dolan-Gavitt , Zekun Shen , Kalle Valo , Sasha Levin Subject: [PATCH 4.9 082/157] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() Date: Mon, 24 Jan 2022 19:42:52 +0100 Message-Id: <20220124183935.385431507@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit 04d80663f67ccef893061b49ec8a42ff7045ae84 ] Currently, with an unknown recv_type, mwifiex_usb_recv just return -1 without restoring the skb. Next time mwifiex_usb_rx_complete is invoked with the same skb, calling skb_put causes skb_over_panic. The bug is triggerable with a compromised/malfunctioning usb device. After applying the patch, skb_over_panic no longer shows up with the same input. Attached is the panic report from fuzzing. skbuff: skb_over_panic: text:000000003bf1b5fa len:2048 put:4 head:00000000dd6a115b data:000000000a9445d8 tail:0x844 end:0x840 dev: kernel BUG at net/core/skbuff.c:109! invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 PID: 198 Comm: in:imklog Not tainted 5.6.0 #60 RIP: 0010:skb_panic+0x15f/0x161 Call Trace: ? mwifiex_usb_rx_complete+0x26b/0xfcd [mwifiex_usb] skb_put.cold+0x24/0x24 mwifiex_usb_rx_complete+0x26b/0xfcd [mwifiex_usb] __usb_hcd_giveback_urb+0x1e4/0x380 usb_giveback_urb_bh+0x241/0x4f0 ? __hrtimer_run_queues+0x316/0x740 ? __usb_hcd_giveback_urb+0x380/0x380 tasklet_action_common.isra.0+0x135/0x330 __do_softirq+0x18c/0x634 irq_exit+0x114/0x140 smp_apic_timer_interrupt+0xde/0x380 apic_timer_interrupt+0xf/0x20 Reported-by: Brendan Dolan-Gavitt Signed-off-by: Zekun Shen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.= home Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/wireless/marvell/mwifiex/usb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wirel= ess/marvell/mwifiex/usb.c index 2c4225e57c396..3a26add665ca0 100644 --- a/drivers/net/wireless/marvell/mwifiex/usb.c +++ b/drivers/net/wireless/marvell/mwifiex/usb.c @@ -132,7 +132,8 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *ada= pter, default: mwifiex_dbg(adapter, ERROR, "unknown recv_type %#x\n", recv_type); - return -1; + ret =3D -1; + goto exit_restore_skb; } break; case MWIFIEX_USB_EP_DATA: --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2434C4332F for ; Mon, 24 Jan 2022 19:06:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345817AbiAXTEj (ORCPT ); Mon, 24 Jan 2022 14:04:39 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:58834 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345314AbiAXTAB (ORCPT ); Mon, 24 Jan 2022 14:00:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 71A7C6090A; Mon, 24 Jan 2022 19:00:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4E46AC340E5; Mon, 24 Jan 2022 19:00:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050800; bh=FVnpSvec1j/MlZ+c/SLq9KK4B+zNtg27zPySVYQJosI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KNMaJFkw3ywS5u/e/u9bUiOvgXnHfCujfTXxLiBvfpON50X93gv79w9TKLok19vuL Dn+VpLxEUtqsOnyQM1ZkNWgugsujiYt7hKCbriaWabZJjBvI9qFi2E+mIc2RjlMRAN Ysk+5AHr6fZHjXyk8JsGt3ML2IZerp9gv80v4bvE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+23a02c7df2cf2bc93fa2@syzkaller.appspotmail.com, Xiongwei Song , Denis Efremov , Jens Axboe , Sasha Levin Subject: [PATCH 4.9 083/157] floppy: Add max size check for user space request Date: Mon, 24 Jan 2022 19:42:53 +0100 Message-Id: <20220124183935.415556544@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiongwei Song [ Upstream commit 545a32498c536ee152331cd2e7d2416aa0f20e01 ] We need to check the max request size that is from user space before allocating pages. If the request size exceeds the limit, return -EINVAL. This check can avoid the warning below from page allocator. WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 current_gfp_context incl= ude/linux/sched/mm.h:195 [inline] WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 __alloc_pages+0x45d/0x50= 0 mm/page_alloc.c:5356 Modules linked in: CPU: 3 PID: 16525 Comm: syz-executor.3 Not tainted 5.15.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 RIP: 0010:__alloc_pages+0x45d/0x500 mm/page_alloc.c:5344 Code: be c9 00 00 00 48 c7 c7 20 4a 97 89 c6 05 62 32 a7 0b 01 e8 74 9a 42 = 07 e9 6a ff ff ff 0f 0b e9 a0 fd ff ff 40 80 e5 3f eb 88 <0f> 0b e9 18 ff f= f ff 4c 89 ef 44 89 e6 45 31 ed e8 1e 76 ff ff e9 RSP: 0018:ffffc90023b87850 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff92004770f0b RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000033 RDI: 0000000000010cc1 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff81bb4686 R11: 0000000000000001 R12: ffffffff902c1960 R13: 0000000000000033 R14: 0000000000000000 R15: ffff88804cf64a30 FS: 0000000000000000(0000) GS:ffff88802cd00000(0063) knlGS:00000000f44b4b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000002c921000 CR3: 000000004f507000 CR4: 0000000000150ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191 __get_free_pages+0x8/0x40 mm/page_alloc.c:5418 raw_cmd_copyin drivers/block/floppy.c:3113 [inline] raw_cmd_ioctl drivers/block/floppy.c:3160 [inline] fd_locked_ioctl+0x12e5/0x2820 drivers/block/floppy.c:3528 fd_ioctl drivers/block/floppy.c:3555 [inline] fd_compat_ioctl+0x891/0x1b60 drivers/block/floppy.c:3869 compat_blkdev_ioctl+0x3b8/0x810 block/ioctl.c:662 __do_compat_sys_ioctl+0x1c7/0x290 fs/ioctl.c:972 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Reported-by: syzbot+23a02c7df2cf2bc93fa2@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20211116131033.27685-1-sxwjean@me.com Signed-off-by: Xiongwei Song Signed-off-by: Denis Efremov Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/block/floppy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index d508dda49dee4..7164be9710e51 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -3116,6 +3116,8 @@ static void raw_cmd_free(struct floppy_raw_cmd **ptr) } } =20 +#define MAX_LEN (1UL << MAX_ORDER << PAGE_SHIFT) + static int raw_cmd_copyin(int cmd, void __user *param, struct floppy_raw_cmd **rcmd) { @@ -3153,7 +3155,7 @@ loop: ptr->resultcode =3D 0; =20 if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) { - if (ptr->length <=3D 0) + if (ptr->length <=3D 0 || ptr->length >=3D MAX_LEN) return -EINVAL; ptr->kernel_data =3D (char *)fd_dma_mem_alloc(ptr->length); fallback_on_nodma_alloc(&ptr->kernel_data, ptr->length); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C378AC433F5 for ; Mon, 24 Jan 2022 19:13:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343501AbiAXTNp (ORCPT ); Mon, 24 Jan 2022 14:13:45 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46578 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346214AbiAXTFN (ORCPT ); Mon, 24 Jan 2022 14:05:13 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2FBA4C06173B; Mon, 24 Jan 2022 11:00:05 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C1B1560918; Mon, 24 Jan 2022 19:00:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 81F59C340E5; Mon, 24 Jan 2022 19:00:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050804; bh=nwxvpnCJGN3d5gfMZI1cygkOOdHF9MuMEb7fCRve4OY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h7cS6OJ7W7Vgo4GsjdywLfWj7qcXhyDJT8gXCqzHGG87bshikP/fur47OBFe0VCPx akY1e3oX42GJJdqfF+sDtAp6X5ld8YXoQK0QVTwHdorQEl8o5oJ/Fttbmp8FsqaWKL Qb6yqt4egG3cCznNtKFp/91Ym1nglEtxYqjabs6A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.9 084/157] media: saa7146: hexium_orion: Fix a NULL pointer dereference in hexium_attach() Date: Mon, 24 Jan 2022 19:42:54 +0100 Message-Id: <20220124183935.454758172@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 348df8035301dd212e3cc2860efe4c86cb0d3303 ] In hexium_attach(dev, info), saa7146_vv_init() is called to allocate a new memory for dev->vv_data. In hexium_detach(), saa7146_vv_release() will be called and there is a dereference of dev->vv_data in saa7146_vv_release(), which could lead to a NULL pointer dereference on failure of saa7146_vv_init() according to the following logic. Both hexium_attach() and hexium_detach() are callback functions of the variable 'extension', so there exists a possible call chain directly from hexium_attach() to hexium_detach(): hexium_attach(dev, info) -- fail to alloc memory to dev->vv_data | in saa7146_vv_init(). | | hexium_detach() -- a dereference of dev->vv_data in saa7146_vv_release() Fix this bug by adding a check of saa7146_vv_init(). This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_VIDEO_HEXIUM_ORION=3Dm show no new warnings, and our static analyzer no longer warns about this code. Signed-off-by: Zhou Qingyang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/pci/saa7146/hexium_orion.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/media/pci/saa7146/hexium_orion.c b/drivers/media/pci/s= aa7146/hexium_orion.c index dc07ca37ebd06..e8e96c7a57844 100644 --- a/drivers/media/pci/saa7146/hexium_orion.c +++ b/drivers/media/pci/saa7146/hexium_orion.c @@ -366,10 +366,16 @@ static struct saa7146_ext_vv vv_data; static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_exten= sion_data *info) { struct hexium *hexium =3D (struct hexium *) dev->ext_priv; + int ret; =20 DEB_EE("\n"); =20 - saa7146_vv_init(dev, &vv_data); + ret =3D saa7146_vv_init(dev, &vv_data); + if (ret) { + pr_err("Error in saa7146_vv_init()\n"); + return ret; + } + vv_data.vid_ops.vidioc_enum_input =3D vidioc_enum_input; vv_data.vid_ops.vidioc_g_input =3D vidioc_g_input; vv_data.vid_ops.vidioc_s_input =3D vidioc_s_input; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71151C433FE for ; Mon, 24 Jan 2022 19:05:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346354AbiAXTFZ (ORCPT ); Mon, 24 Jan 2022 14:05:25 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57388 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345360AbiAXTAK (ORCPT ); Mon, 24 Jan 2022 14:00:10 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B27FCB8119D; Mon, 24 Jan 2022 19:00:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2837C340E5; Mon, 24 Jan 2022 19:00:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050807; bh=4jx1Bl4S5uQyeaT0H4TWgXfSBRxVssLycfkRR4kmCkU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CaYt9ENsPHL31F3ng/UEsgKGmXW/2Sh2PjUe68INQrCSlDyFZObqonXN0swwjVy2E qaa36zOmWnlmck1TQRKfOMRgqj6Rggs8UUDMOdlSayY4ySyaWYrXKODa22h59EjMtX qXEQe4xaNouaMExAlBe4zgJ6qnIseb1963gx07r8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, rkardell@mida.se, Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.9 085/157] media: m920x: dont use stack on USB reads Date: Mon, 24 Jan 2022 19:42:55 +0100 Message-Id: <20220124183935.484109346@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mauro Carvalho Chehab [ Upstream commit a2ab06d7c4d6bfd0b545a768247a70463e977e27 ] Using stack-allocated pointers for USB message data don't work. This driver is almost OK with that, except for the I2C read logic. Fix it by using a temporary read buffer, just like on all other calls to m920x_read(). Link: https://lore.kernel.org/all/ccc99e48-de4f-045e-0fe4-61e3118e3f74@mida= .se/ Reported-by: rkardell@mida.se Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/usb/dvb-usb/m920x.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/= m920x.c index eafc5c82467f4..5b806779e2106 100644 --- a/drivers/media/usb/dvb-usb/m920x.c +++ b/drivers/media/usb/dvb-usb/m920x.c @@ -284,6 +284,13 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, st= ruct i2c_msg msg[], int nu /* Should check for ack here, if we knew how. */ } if (msg[i].flags & I2C_M_RD) { + char *read =3D kmalloc(1, GFP_KERNEL); + if (!read) { + ret =3D -ENOMEM; + kfree(read); + goto unlock; + } + for (j =3D 0; j < msg[i].len; j++) { /* Last byte of transaction? * Send STOP, otherwise send ACK. */ @@ -291,9 +298,12 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, st= ruct i2c_msg msg[], int nu =20 if ((ret =3D m920x_read(d->udev, M9206_I2C, 0x0, 0x20 | stop, - &msg[i].buf[j], 1)) !=3D 0) + read, 1)) !=3D 0) goto unlock; + msg[i].buf[j] =3D read[0]; } + + kfree(read); } else { for (j =3D 0; j < msg[i].len; j++) { /* Last byte of transaction? Then send STOP. */ --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82C72C433EF for ; Mon, 24 Jan 2022 19:07:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346741AbiAXTHV (ORCPT ); Mon, 24 Jan 2022 14:07:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44570 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345794AbiAXTBG (ORCPT ); Mon, 24 Jan 2022 14:01:06 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D01E8C061377; Mon, 24 Jan 2022 10:58:22 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7131761565; Mon, 24 Jan 2022 18:58:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38441C340F0; Mon, 24 Jan 2022 18:58:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050701; bh=YRKkvkAcKs2Ut1KZ8rbi8X5DHzR8hVK6GnvFFZknyOg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=w/qLQezqPIAMWjxMxxC2CrFFIEZYyhTOpZ+dM8sRPk2HjLQcIvi7nftA+gUCY/pNY kb7h6PTinLHYJAIdhIhp0akTMQlFwQbu99pq8m3yiH2mvY7XHeUxOAwPAZ8zVGdXV2 +kXKc3EdGbI2k5h4HSAkviUJDgLKzzJYyOaQNJeg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Emmanuel Grumbach , Maximilian Ernestus , Johannes Berg , Luca Coelho , Sasha Levin Subject: [PATCH 4.9 086/157] iwlwifi: mvm: synchronize with FW after multicast commands Date: Mon, 24 Jan 2022 19:42:56 +0100 Message-Id: <20220124183935.514328522@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johannes Berg [ Upstream commit db66abeea3aefed481391ecc564fb7b7fb31d742 ] If userspace installs a lot of multicast groups very quickly, then we may run out of command queue space as we send the updates in an asynchronous fashion (due to locking concerns), and the CPU can create them faster than the firmware can process them. This is true even when mac80211 has a work struct that gets scheduled. Fix this by synchronizing with the firmware after sending all those commands - outside of the iteration we can send a synchronous echo command that just has the effect of the CPU waiting for the prior asynchronous commands to finish. This also will cause fewer of the commands to be sent to the firmware overall, because the work will only run once when rescheduled multiple times while it's running. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D213649 Suggested-by: Emmanuel Grumbach Reported-by: Maximilian Ernestus Signed-off-by: Johannes Berg Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20211204083238.51aea5b79ea4.I88a447= 98efda16e9fe480fb3e94224931d311b29@changeid Signed-off-by: Luca Coelho Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/ne= t/wireless/intel/iwlwifi/mvm/mac80211.c index d46efa8d70732..f8c225a726bd4 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c @@ -1599,6 +1599,7 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *= mvm) struct iwl_mvm_mc_iter_data iter_data =3D { .mvm =3D mvm, }; + int ret; =20 lockdep_assert_held(&mvm->mutex); =20 @@ -1608,6 +1609,22 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm = *mvm) ieee80211_iterate_active_interfaces_atomic( mvm->hw, IEEE80211_IFACE_ITER_NORMAL, iwl_mvm_mc_iface_iterator, &iter_data); + + /* + * Send a (synchronous) ech command so that we wait for the + * multiple asynchronous MCAST_FILTER_CMD commands sent by + * the interface iterator. Otherwise, we might get here over + * and over again (by userspace just sending a lot of these) + * and the CPU can send them faster than the firmware can + * process them. + * Note that the CPU is still faster - but with this we'll + * actually send fewer commands overall because the CPU will + * not schedule the work in mac80211 as frequently if it's + * still running when rescheduled (possibly multiple times). + */ + ret =3D iwl_mvm_send_cmd_pdu(mvm, ECHO_CMD, 0, 0, NULL); + if (ret) + IWL_ERR(mvm, "Failed to synchronize multicast groups update\n"); } =20 static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw, --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33E6DC4321E for ; Mon, 24 Jan 2022 19:07:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344610AbiAXTHe (ORCPT ); Mon, 24 Jan 2022 14:07:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45350 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345879AbiAXTBO (ORCPT ); Mon, 24 Jan 2022 14:01:14 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 53369C061A83; Mon, 24 Jan 2022 10:58:27 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1CD14B8121B; Mon, 24 Jan 2022 18:58:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 54BEAC340E5; Mon, 24 Jan 2022 18:58:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050704; bh=fkB1Uenr+wOd5Si9NwVeQ3Cj6i2+Q4Nx/VagxEJT/Tc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KmRuewr7Xh+iiNhTMzLbA2CUGDG9jJkQz2VvIxZ6NfdVBac0dOuHZdCKRfPQP/Mok cbE/v2Bsu9hVivdbFeb2qV90GUikfmH4kJdgy5z6JwosYjxqXJ41L0ML+ESlWRYoNH 5JKVTvSu3gx0MDjpwFrSXThVA1edSiHr5TyEJMc8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sebastian Gottschall , Kalle Valo , Sasha Levin Subject: [PATCH 4.9 087/157] ath10k: Fix tx hanging Date: Mon, 24 Jan 2022 19:42:57 +0100 Message-Id: <20220124183935.544944696@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sebastian Gottschall [ Upstream commit e8a91863eba3966a447d2daa1526082d52b5db2a ] While running stress tests in roaming scenarios (switching ap's every 5 seconds, we discovered a issue which leads to tx hangings of exactly 5 seconds while or after scanning for new accesspoints. We found out that this hanging is triggered by ath10k_mac_wait_tx_complete since the empty_tx_wq was not wake when the num_tx_pending counter reaches zero. To fix this, we simply move the wake_up call to htt_tx_dec_pending, since this call was missed on several locations within the ath10k code. Signed-off-by: Sebastian Gottschall Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210505085806.11474-1-s.gottschall@dd-wrt.= com Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/wireless/ath/ath10k/htt_tx.c | 3 +++ drivers/net/wireless/ath/ath10k/txrx.c | 2 -- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireles= s/ath/ath10k/htt_tx.c index ae5b33fe5ba82..374ce35940d07 100644 --- a/drivers/net/wireless/ath/ath10k/htt_tx.c +++ b/drivers/net/wireless/ath/ath10k/htt_tx.c @@ -158,6 +158,9 @@ void ath10k_htt_tx_dec_pending(struct ath10k_htt *htt) htt->num_pending_tx--; if (htt->num_pending_tx =3D=3D htt->max_num_pending_tx - 1) ath10k_mac_tx_unlock(htt->ar, ATH10K_TX_PAUSE_Q_FULL); + + if (htt->num_pending_tx =3D=3D 0) + wake_up(&htt->empty_tx_wq); } =20 int ath10k_htt_tx_inc_pending(struct ath10k_htt *htt) diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/= ath/ath10k/txrx.c index beeb6be06939b..b6c050452b757 100644 --- a/drivers/net/wireless/ath/ath10k/txrx.c +++ b/drivers/net/wireless/ath/ath10k/txrx.c @@ -89,8 +89,6 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt, =20 ath10k_htt_tx_free_msdu_id(htt, tx_done->msdu_id); ath10k_htt_tx_dec_pending(htt); - if (htt->num_pending_tx =3D=3D 0) - wake_up(&htt->empty_tx_wq); spin_unlock_bh(&htt->tx_lock); =20 dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 498E6C433F5 for ; Mon, 24 Jan 2022 19:07:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238443AbiAXTHw (ORCPT ); Mon, 24 Jan 2022 14:07:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45428 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344602AbiAXTBn (ORCPT ); Mon, 24 Jan 2022 14:01:43 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 94C7CC0604E0; Mon, 24 Jan 2022 10:58:30 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5C8B9B8121D; Mon, 24 Jan 2022 18:58:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 653D0C340E5; Mon, 24 Jan 2022 18:58:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050708; bh=tlhxMPv9xAdFHyHVPSocNKb4ygBkd3GToRMLuTLcu/s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KnsGcz//pomxc8AqcI/omO69Y6PFkbrQ1si37LH5tHJmlEqCFGqQ4t6XZ6XbDR0uw l2jmO4TvrXizLeZvzfFHIL1vZLKX3XHpNXkAR8mpCtmUGxq0K+W8/5a8L3wthhg9nZ f6p0RY6zcWufvI8Sqi5v58blW3zmNi1VsLGqURP0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Suresh Kumar , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 088/157] net: bonding: debug: avoid printing debug logs when bond is not notifying peers Date: Mon, 24 Jan 2022 19:42:58 +0100 Message-Id: <20220124183935.577925109@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Suresh Kumar [ Upstream commit fee32de284ac277ba434a2d59f8ce46528ff3946 ] Currently "bond_should_notify_peers: slave ..." messages are printed whenev= er "bond_should_notify_peers" function is called. +++ Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): Received LACPDU on po= rt 1 Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): Rx Machine: Port=3D1,= Last State=3D6, Curr State=3D6 Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): partner sync=3D1 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 ... Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): Received LACPDU on por= t 2 Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): Rx Machine: Port=3D2, = Last State=3D6, Curr State=3D6 Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): partner sync=3D1 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +++ This is confusing and can also clutter up debug logs. Print logs only when the peer notification happens. Signed-off-by: Suresh Kumar Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/bonding/bond_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_mai= n.c index 2b721ed392adb..0d9226bdf6614 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -782,14 +782,14 @@ static bool bond_should_notify_peers(struct bonding *= bond) slave =3D rcu_dereference(bond->curr_active_slave); rcu_read_unlock(); =20 - netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n", - slave ? slave->dev->name : "NULL"); - if (!slave || !bond->send_peer_notif || !netif_carrier_ok(bond->dev) || test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state)) return false; =20 + netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n", + slave ? slave->dev->name : "NULL"); + return true; } =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9EA6C4332F for ; Mon, 24 Jan 2022 19:05:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346045AbiAXTE7 (ORCPT ); Mon, 24 Jan 2022 14:04:59 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:55670 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344468AbiAXS6c (ORCPT ); Mon, 24 Jan 2022 13:58:32 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 007CF61566; Mon, 24 Jan 2022 18:58:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B521FC340E5; Mon, 24 Jan 2022 18:58:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050711; bh=+XtKoOjpVtsjzrCJegCHfhUIBfJ+lHSZtrtZyDlAyA4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EEgP12C5wTXb0f+sotmAXuaGiuurV3UwXaGvPnWiJNkv981ipzjZ3SfHddzLSOgV1 I6Hl1yk/KGRw8y3gntfvfKDgS1MfUeOt2RwgQKbtImBU36f3YYDDLgEXpbFVgd1ILX yECXRDYmBO5WdC6A9BJKc6f994x7UbbHS1ihFrj8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sean Young , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.9 089/157] media: igorplugusb: receiver overflow should be reported Date: Mon, 24 Jan 2022 19:42:59 +0100 Message-Id: <20220124183935.608122385@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Young [ Upstream commit 8fede658e7ddb605bbd68ed38067ddb0af033db4 ] Without this, some IR will be missing mid-stream and we might decode something which never really occurred. Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/rc/igorplugusb.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c index 5cf983be07a20..0f4c4c39bf6da 100644 --- a/drivers/media/rc/igorplugusb.c +++ b/drivers/media/rc/igorplugusb.c @@ -73,9 +73,11 @@ static void igorplugusb_irdata(struct igorplugusb *ir, u= nsigned len) if (start >=3D len) { dev_err(ir->dev, "receive overflow invalid: %u", overflow); } else { - if (overflow > 0) + if (overflow > 0) { dev_warn(ir->dev, "receive overflow, at least %u lost", overflow); + ir_raw_event_reset(ir->rc); + } =20 do { rawir.duration =3D ir->buf_in[i] * 85333; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8F3BC433F5 for ; Mon, 24 Jan 2022 19:02:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245410AbiAXTCS (ORCPT ); Mon, 24 Jan 2022 14:02:18 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:56420 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343909AbiAXS6h (ORCPT ); Mon, 24 Jan 2022 13:58:37 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EDC3EB8121D; Mon, 24 Jan 2022 18:58:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20B00C340E5; Mon, 24 Jan 2022 18:58:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050714; bh=0EuiXQC7yZLmB+/NRw14oLRHq8SrNpRc3adz04dxiF0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WKpAA2wfhOBvmpBB64WZ5L1pgH83j2KfyaV+1BXGpe8mgokG4W0jZTXQKAqH4i7Ce alwwWzPH86y9jHm3VjsA04902Ykxd3WLuMjy6J4oOeVyA1Ubb8njBhVNeGHzHwphKU VL5C16C4i3DMUIsbKYl9iT+AE9rnvTtDZtrAelHs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.9 090/157] media: saa7146: hexium_gemini: Fix a NULL pointer dereference in hexium_attach() Date: Mon, 24 Jan 2022 19:43:00 +0100 Message-Id: <20220124183935.642741273@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit 3af86b046933ba513d08399dba0d4d8b50d607d0 ] In hexium_attach(dev, info), saa7146_vv_init() is called to allocate a new memory for dev->vv_data. saa7146_vv_release() will be called on failure of saa7146_register_device(). There is a dereference of dev->vv_data in saa7146_vv_release(), which could lead to a NULL pointer dereference on failure of saa7146_vv_init(). Fix this bug by adding a check of saa7146_vv_init(). This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_VIDEO_HEXIUM_GEMINI=3Dm show no new warnings, and our static analyzer no longer warns about this code. Link: https://lore.kernel.org/linux-media/20211203154030.111210-1-zhou1615@= umn.edu Signed-off-by: Zhou Qingyang Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/media/common/saa7146/saa7146_fops.c | 2 +- drivers/media/pci/saa7146/hexium_gemini.c | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/media/common/saa7146/saa7146_fops.c b/drivers/media/co= mmon/saa7146/saa7146_fops.c index 930d2c94d5d30..2c9365a39270a 100644 --- a/drivers/media/common/saa7146/saa7146_fops.c +++ b/drivers/media/common/saa7146/saa7146_fops.c @@ -524,7 +524,7 @@ int saa7146_vv_init(struct saa7146_dev* dev, struct saa= 7146_ext_vv *ext_vv) ERR("out of memory. aborting.\n"); kfree(vv); v4l2_ctrl_handler_free(hdl); - return -1; + return -ENOMEM; } =20 saa7146_video_uops.init(dev,vv); diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/= saa7146/hexium_gemini.c index be85a2c4318e7..be91a2de81dcc 100644 --- a/drivers/media/pci/saa7146/hexium_gemini.c +++ b/drivers/media/pci/saa7146/hexium_gemini.c @@ -296,7 +296,12 @@ static int hexium_attach(struct saa7146_dev *dev, stru= ct saa7146_pci_extension_d hexium_set_input(hexium, 0); hexium->cur_input =3D 0; =20 - saa7146_vv_init(dev, &vv_data); + ret =3D saa7146_vv_init(dev, &vv_data); + if (ret) { + i2c_del_adapter(&hexium->i2c_adapter); + kfree(hexium); + return ret; + } =20 vv_data.vid_ops.vidioc_enum_input =3D vidioc_enum_input; vv_data.vid_ops.vidioc_g_input =3D vidioc_g_input; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D357EC433F5 for ; Mon, 24 Jan 2022 19:12:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346051AbiAXTMX (ORCPT ); Mon, 24 Jan 2022 14:12:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46038 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345180AbiAXTDD (ORCPT ); Mon, 24 Jan 2022 14:03:03 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 26CC5C0604FB; Mon, 24 Jan 2022 10:58:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E333EB81227; Mon, 24 Jan 2022 18:58:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0CDE0C340E5; Mon, 24 Jan 2022 18:58:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050717; bh=jVojy5ALgdj1kn9VcaJCjEHW1ktu1nFBMSftQYDqjRk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Akzdt3GnGY7Np3Xy4/b5Yk9EGfo2Y9Xtt70Z8+NkQSOUG72m2kERWpieo3Pty+HAL XCNQWN/nIQ6s47PQj8gDYA4EGGGLRtx0IEjqc55fMpLJmFlYm3yayHAZxSsMEUv7Rt myNkSXZgpGZ0aucis+TU2MzaHLOzIbdXV486F/bs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Kai-Heng Feng , Sasha Levin Subject: [PATCH 4.9 091/157] usb: hub: Add delay for SuperSpeed hub resume to let links transit to U0 Date: Mon, 24 Jan 2022 19:43:01 +0100 Message-Id: <20220124183935.672130357@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kai-Heng Feng [ Upstream commit 00558586382891540c59c9febc671062425a6e47 ] When a new USB device gets plugged to nested hubs, the affected hub, which connects to usb 2-1.4-port2, doesn't report there's any change, hence the nested hubs go back to runtime suspend like nothing happened: [ 281.032951] usb usb2: usb wakeup-resume [ 281.032959] usb usb2: usb auto-resume [ 281.032974] hub 2-0:1.0: hub_resume [ 281.033011] usb usb2-port1: status 0263 change 0000 [ 281.033077] hub 2-0:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.049797] usb 2-1: usb wakeup-resume [ 281.069800] usb 2-1: Waited 0ms for CONNECT [ 281.069810] usb 2-1: finish resume [ 281.070026] hub 2-1:1.0: hub_resume [ 281.070250] usb 2-1-port4: status 0203 change 0000 [ 281.070272] usb usb2-port1: resume, status 0 [ 281.070282] hub 2-1:1.0: state 7 ports 4 chg 0010 evt 0000 [ 281.089813] usb 2-1.4: usb wakeup-resume [ 281.109792] usb 2-1.4: Waited 0ms for CONNECT [ 281.109801] usb 2-1.4: finish resume [ 281.109991] hub 2-1.4:1.0: hub_resume [ 281.110147] usb 2-1.4-port2: status 0263 change 0000 [ 281.110234] usb 2-1-port4: resume, status 0 [ 281.110239] usb 2-1-port4: status 0203, change 0000, 10.0 Gb/s [ 281.110266] hub 2-1.4:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.110426] hub 2-1.4:1.0: hub_suspend [ 281.110565] usb 2-1.4: usb auto-suspend, wakeup 1 [ 281.130998] hub 2-1:1.0: hub_suspend [ 281.137788] usb 2-1: usb auto-suspend, wakeup 1 [ 281.142935] hub 2-0:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.177828] usb 2-1: usb wakeup-resume [ 281.197839] usb 2-1: Waited 0ms for CONNECT [ 281.197850] usb 2-1: finish resume [ 281.197984] hub 2-1:1.0: hub_resume [ 281.198203] usb 2-1-port4: status 0203 change 0000 [ 281.198228] usb usb2-port1: resume, status 0 [ 281.198237] hub 2-1:1.0: state 7 ports 4 chg 0010 evt 0000 [ 281.217835] usb 2-1.4: usb wakeup-resume [ 281.237834] usb 2-1.4: Waited 0ms for CONNECT [ 281.237845] usb 2-1.4: finish resume [ 281.237990] hub 2-1.4:1.0: hub_resume [ 281.238067] usb 2-1.4-port2: status 0263 change 0000 [ 281.238148] usb 2-1-port4: resume, status 0 [ 281.238152] usb 2-1-port4: status 0203, change 0000, 10.0 Gb/s [ 281.238166] hub 2-1.4:1.0: state 7 ports 4 chg 0000 evt 0000 [ 281.238385] hub 2-1.4:1.0: hub_suspend [ 281.238523] usb 2-1.4: usb auto-suspend, wakeup 1 [ 281.258076] hub 2-1:1.0: hub_suspend [ 281.265744] usb 2-1: usb auto-suspend, wakeup 1 [ 281.285976] hub 2-0:1.0: hub_suspend [ 281.285988] usb usb2: bus auto-suspend, wakeup 1 USB 3.2 spec, 9.2.5.4 "Changing Function Suspend State" says that "If the link is in a non-U0 state, then the device must transition the link to U0 prior to sending the remote wake message", but the hub only transits the link to U0 after signaling remote wakeup. So be more forgiving and use a 20ms delay to let the link transit to U0 for remote wakeup. Suggested-by: Alan Stern Acked-by: Alan Stern Signed-off-by: Kai-Heng Feng Link: https://lore.kernel.org/r/20211215120108.336597-1-kai.heng.feng@canon= ical.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/usb/core/hub.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index 1629fdba37ad3..33bf5ba438397 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -1070,7 +1070,10 @@ static void hub_activate(struct usb_hub *hub, enum h= ub_activation_type type) } else { hub_power_on(hub, true); } - } + /* Give some time on remote wakeup to let links to transit to U0 */ + } else if (hub_is_superspeed(hub->hdev)) + msleep(20); + init2: =20 /* --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C25BC433EF for ; Mon, 24 Jan 2022 19:02:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345081AbiAXTCj (ORCPT ); Mon, 24 Jan 2022 14:02:39 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:56518 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344608AbiAXS6n (ORCPT ); Mon, 24 Jan 2022 13:58:43 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 78EE1B8119D; Mon, 24 Jan 2022 18:58:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A7C1AC340E5; Mon, 24 Jan 2022 18:58:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050721; bh=o11xyAHF7QM9ay3mFhVdFKCCVn9gyNacICIfQl/LbLQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rZwHbmNQMzqsZpdkHPXLL0szftsY1+/bV8r2JamZmvXYQVCru83s05Ag+VsrB2ZjG qfo2BbeoVwCKzpH6p4jKduAvwc0O+Uivvtykd9VKelmnNRP5//i/xKatSw0UFujzqw HD7pvxpmjRCqrO3VqzvOw83TbVwrcHXpcW8PuVBI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zekun Shen , Kalle Valo , Sasha Levin Subject: [PATCH 4.9 092/157] ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream Date: Mon, 24 Jan 2022 19:43:02 +0100 Message-Id: <20220124183935.701284303@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zekun Shen [ Upstream commit 6ce708f54cc8d73beca213cec66ede5ce100a781 ] Large pkt_len can lead to out-out-bound memcpy. Current ath9k_hif_usb_rx_stream allows combining the content of two urb inputs to one pkt. The first input can indicate the size of the pkt. Any remaining size is saved in hif_dev->rx_remain_len. While processing the next input, memcpy is used with rx_remain_len. 4-byte pkt_len can go up to 0xffff, while a single input is 0x4000 maximum in size (MAX_RX_BUF_SIZE). Thus, the patch adds a check for pkt_len which must not exceed 2 * MAX_RX_BUG_SIZE. BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_ht= c] Read of size 46393 at addr ffff888018798000 by task kworker/0:1/23 CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 5.6.0 #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] __kasan_report.cold+0x37/0x7c ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] kasan_report+0xe/0x20 check_memory_region+0x15a/0x1d0 memcpy+0x20/0x50 ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] ? hif_usb_mgmt_cb+0x2d9/0x2d9 [ath9k_htc] ? _raw_spin_lock_irqsave+0x7b/0xd0 ? _raw_spin_trylock_bh+0x120/0x120 ? __usb_unanchor_urb+0x12f/0x210 __usb_hcd_giveback_urb+0x1e4/0x380 usb_giveback_urb_bh+0x241/0x4f0 ? __hrtimer_run_queues+0x316/0x740 ? __usb_hcd_giveback_urb+0x380/0x380 tasklet_action_common.isra.0+0x135/0x330 __do_softirq+0x18c/0x634 irq_exit+0x114/0x140 smp_apic_timer_interrupt+0xde/0x380 apic_timer_interrupt+0xf/0x20 I found the bug using a custome USBFuzz port. It's a research work to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, providing hand-crafted usb descriptors to QEMU. After fixing the value of pkt_tag to ATH_USB_RX_STREAM_MODE_TAG in QEMU emulation, I found the KASAN report. The bug is triggerable whenever pkt_len is above two MAX_RX_BUG_SIZE. I used the same input that crashes to test the driver works when applying the patch. Signed-off-by: Zekun Shen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/YXsidrRuK6zBJicZ@10-18-43-117.dynapool.wire= less.nyu.edu Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireles= s/ath/ath9k/hif_usb.c index 7c409cd43b709..33a6be0f21cac 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -588,6 +588,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_= usb *hif_dev, return; } =20 + if (pkt_len > 2 * MAX_RX_BUF_SIZE) { + dev_err(&hif_dev->udev->dev, + "ath9k_htc: invalid pkt_len (%x)\n", pkt_len); + RX_STAT_INC(skb_dropped); + return; + } + pad_len =3D 4 - (pkt_len & 0x3); if (pad_len =3D=3D 4) pad_len =3D 0; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2BB27C433F5 for ; Mon, 24 Jan 2022 19:09:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344607AbiAXTJ3 (ORCPT ); Mon, 24 Jan 2022 14:09:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46056 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344320AbiAXTDG (ORCPT ); Mon, 24 Jan 2022 14:03:06 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ADEAAC0617AD; Mon, 24 Jan 2022 10:58:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 74B57B8122C; Mon, 24 Jan 2022 18:58:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A219EC340E5; Mon, 24 Jan 2022 18:58:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050724; bh=M6edZIbd7JkwHb10SCA5x8BMURt0Yhbc6PoZH1PX6tw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qiGRah1iU3b3SSpt4/OqYhy1oTmYPJG3muZ0etPayryaEx9TvMfZLqVpjcg3/gGab gs0y0J3Ip3a2oEWZblj4BoGvmo8/usYTMETv+wU40aZF4rN4gnIsXg6qKwVcjFiH+8 Zw2pHVoBhkL6DgkB4rnxw6FRTO/ZqjXbVMwrauu8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Jeff Dike , Richard Weinberger , Anton Ivanov , linux-um@lists.infradead.org, Sasha Levin Subject: [PATCH 4.9 093/157] um: registers: Rename function names to avoid conflicts and build problems Date: Mon, 24 Jan 2022 19:43:03 +0100 Message-Id: <20220124183935.730425818@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 077b7320942b64b0da182aefd83c374462a65535 ] The function names init_registers() and restore_registers() are used in several net/ethernet/ and gpu/drm/ drivers for other purposes (not calls to UML functions), so rename them. This fixes multiple build errors. Signed-off-by: Randy Dunlap Cc: Jeff Dike Cc: Richard Weinberger Cc: Anton Ivanov Cc: linux-um@lists.infradead.org Signed-off-by: Richard Weinberger Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/um/include/shared/registers.h | 4 ++-- arch/um/os-Linux/registers.c | 4 ++-- arch/um/os-Linux/start_up.c | 2 +- arch/x86/um/syscalls_64.c | 3 ++- 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/arch/um/include/shared/registers.h b/arch/um/include/shared/re= gisters.h index a74449b5b0e31..12ad7c435e97f 100644 --- a/arch/um/include/shared/registers.h +++ b/arch/um/include/shared/registers.h @@ -16,8 +16,8 @@ extern int restore_fp_registers(int pid, unsigned long *f= p_regs); extern int save_fpx_registers(int pid, unsigned long *fp_regs); extern int restore_fpx_registers(int pid, unsigned long *fp_regs); extern int save_registers(int pid, struct uml_pt_regs *regs); -extern int restore_registers(int pid, struct uml_pt_regs *regs); -extern int init_registers(int pid); +extern int restore_pid_registers(int pid, struct uml_pt_regs *regs); +extern int init_pid_registers(int pid); extern void get_safe_registers(unsigned long *regs, unsigned long *fp_regs= ); extern unsigned long get_thread_reg(int reg, jmp_buf *buf); extern int get_fp_registers(int pid, unsigned long *regs); diff --git a/arch/um/os-Linux/registers.c b/arch/um/os-Linux/registers.c index 2ff8d4fe83c4f..34a5963bd7efd 100644 --- a/arch/um/os-Linux/registers.c +++ b/arch/um/os-Linux/registers.c @@ -21,7 +21,7 @@ int save_registers(int pid, struct uml_pt_regs *regs) return 0; } =20 -int restore_registers(int pid, struct uml_pt_regs *regs) +int restore_pid_registers(int pid, struct uml_pt_regs *regs) { int err; =20 @@ -36,7 +36,7 @@ int restore_registers(int pid, struct uml_pt_regs *regs) static unsigned long exec_regs[MAX_REG_NR]; static unsigned long exec_fp_regs[FP_SIZE]; =20 -int init_registers(int pid) +int init_pid_registers(int pid) { int err; =20 diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c index 22a358ef1b0cd..dc06933ba63d9 100644 --- a/arch/um/os-Linux/start_up.c +++ b/arch/um/os-Linux/start_up.c @@ -334,7 +334,7 @@ void __init os_early_checks(void) check_tmpexec(); =20 pid =3D start_ptraced_child(); - if (init_registers(pid)) + if (init_pid_registers(pid)) fatal("Failed to initialize default registers"); stop_ptraced_child(pid, 1, 1); } diff --git a/arch/x86/um/syscalls_64.c b/arch/x86/um/syscalls_64.c index e6552275320bc..40ecacb2c54b3 100644 --- a/arch/x86/um/syscalls_64.c +++ b/arch/x86/um/syscalls_64.c @@ -9,6 +9,7 @@ #include #include /* XXX This should get the constants from libc */ #include +#include =20 long arch_prctl(struct task_struct *task, int code, unsigned long __user *= addr) { @@ -32,7 +33,7 @@ long arch_prctl(struct task_struct *task, int code, unsig= ned long __user *addr) switch (code) { case ARCH_SET_FS: case ARCH_SET_GS: - ret =3D restore_registers(pid, ¤t->thread.regs.regs); + ret =3D restore_pid_registers(pid, ¤t->thread.regs.regs); if (ret) return ret; break; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B297C433F5 for ; Mon, 24 Jan 2022 19:11:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347035AbiAXTJh (ORCPT ); Mon, 24 Jan 2022 14:09:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46062 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345233AbiAXTDG (ORCPT ); Mon, 24 Jan 2022 14:03:06 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 31D51C061777; Mon, 24 Jan 2022 10:58:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C70526154A; Mon, 24 Jan 2022 18:58:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AD559C340E7; Mon, 24 Jan 2022 18:58:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050727; bh=6+/Oo9XO52MP/CUVThTtWd/19ICfGPzvfT5bMIBO7hI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qQXLW2WF2vGdgzBnrfuEZUvUHM5Sr8Kwta/4Cc8Grr16DKLR94CTZo0egmPH6AnbQ OFWu9AHkExApbG7RmSdBGkYI5xa1iFAH3uz3jKk0LApjw5bDQuN0eyHN5tOLb9jrWK N3WS6u7y4UEuOVYP+yLhPRUaHE34ysRmRzxe7nJA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kyeong Yoo , Richard Weinberger , Sasha Levin Subject: [PATCH 4.9 094/157] jffs2: GC deadlock reading a page that is used in jffs2_write_begin() Date: Mon, 24 Jan 2022 19:43:04 +0100 Message-Id: <20220124183935.760570016@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kyeong Yoo [ Upstream commit aa39cc675799bc92da153af9a13d6f969c348e82 ] GC task can deadlock in read_cache_page() because it may attempt to release a page that is actually allocated by another task in jffs2_write_begin(). The reason is that in jffs2_write_begin() there is a small window a cache page is allocated for use but not set Uptodate yet. This ends up with a deadlock between two tasks: 1) A task (e.g. file copy) - jffs2_write_begin() locks a cache page - jffs2_write_end() tries to lock "alloc_sem" from jffs2_reserve_space() <-- STUCK 2) GC task (jffs2_gcd_mtd3) - jffs2_garbage_collect_pass() locks "alloc_sem" - try to lock the same cache page in read_cache_page() <-- STUCK So to avoid this deadlock, hold "alloc_sem" in jffs2_write_begin() while reading data in a cache page. Signed-off-by: Kyeong Yoo Signed-off-by: Richard Weinberger Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- fs/jffs2/file.c | 40 +++++++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 15 deletions(-) diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c index c12476e309c67..eb4e4d784d26e 100644 --- a/fs/jffs2/file.c +++ b/fs/jffs2/file.c @@ -135,20 +135,15 @@ static int jffs2_write_begin(struct file *filp, struc= t address_space *mapping, struct page *pg; struct inode *inode =3D mapping->host; struct jffs2_inode_info *f =3D JFFS2_INODE_INFO(inode); + struct jffs2_sb_info *c =3D JFFS2_SB_INFO(inode->i_sb); pgoff_t index =3D pos >> PAGE_SHIFT; uint32_t pageofs =3D index << PAGE_SHIFT; int ret =3D 0; =20 - pg =3D grab_cache_page_write_begin(mapping, index, flags); - if (!pg) - return -ENOMEM; - *pagep =3D pg; - jffs2_dbg(1, "%s()\n", __func__); =20 if (pageofs > inode->i_size) { /* Make new hole frag from old EOF to new page */ - struct jffs2_sb_info *c =3D JFFS2_SB_INFO(inode->i_sb); struct jffs2_raw_inode ri; struct jffs2_full_dnode *fn; uint32_t alloc_len; @@ -159,7 +154,7 @@ static int jffs2_write_begin(struct file *filp, struct = address_space *mapping, ret =3D jffs2_reserve_space(c, sizeof(ri), &alloc_len, ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE); if (ret) - goto out_page; + goto out_err; =20 mutex_lock(&f->sem); memset(&ri, 0, sizeof(ri)); @@ -189,7 +184,7 @@ static int jffs2_write_begin(struct file *filp, struct = address_space *mapping, ret =3D PTR_ERR(fn); jffs2_complete_reservation(c); mutex_unlock(&f->sem); - goto out_page; + goto out_err; } ret =3D jffs2_add_full_dnode_to_inode(c, f, fn); if (f->metadata) { @@ -204,13 +199,26 @@ static int jffs2_write_begin(struct file *filp, struc= t address_space *mapping, jffs2_free_full_dnode(fn); jffs2_complete_reservation(c); mutex_unlock(&f->sem); - goto out_page; + goto out_err; } jffs2_complete_reservation(c); inode->i_size =3D pageofs; mutex_unlock(&f->sem); } =20 + /* + * While getting a page and reading data in, lock c->alloc_sem until + * the page is Uptodate. Otherwise GC task may attempt to read the same + * page in read_cache_page(), which causes a deadlock. + */ + mutex_lock(&c->alloc_sem); + pg =3D grab_cache_page_write_begin(mapping, index, flags); + if (!pg) { + ret =3D -ENOMEM; + goto release_sem; + } + *pagep =3D pg; + /* * Read in the page if it wasn't already present. Cannot optimize away * the whole page write case until jffs2_write_end can handle the @@ -220,15 +228,17 @@ static int jffs2_write_begin(struct file *filp, struc= t address_space *mapping, mutex_lock(&f->sem); ret =3D jffs2_do_readpage_nolock(inode, pg); mutex_unlock(&f->sem); - if (ret) - goto out_page; + if (ret) { + unlock_page(pg); + put_page(pg); + goto release_sem; + } } jffs2_dbg(1, "end write_begin(). pg->flags %lx\n", pg->flags); - return ret; =20 -out_page: - unlock_page(pg); - put_page(pg); +release_sem: + mutex_unlock(&c->alloc_sem); +out_err: return ret; } =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 657CAC433EF for ; Mon, 24 Jan 2022 19:06:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346064AbiAXTFB (ORCPT ); Mon, 24 Jan 2022 14:05:01 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:57802 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344004AbiAXS6v (ORCPT ); Mon, 24 Jan 2022 13:58:51 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B55F461569; Mon, 24 Jan 2022 18:58:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 94B14C340E5; Mon, 24 Jan 2022 18:58:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050730; bh=qOpc2/0oxmHJE4wi0lGuFKhNcUljuprERWZbbP+bl24=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Z/a3xXon8Q8Nb57+0xAtzKnyuTjpc0zft6jKYsA+h8Mpen+4jtDy/ICf+h/Ws1us1 gHBfvVTEUl3lmcTV68gq8VRRBf4DGKP8ADj3DOuO/0Eln7dlKVwJs2uWIftqmxp9NY mH43yI/cKqNDoPLBAOEiDTS11H5qKyIrjkb+y7UY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Asselstine , "Rafael J. Wysocki" , Bob Moore , Sasha Levin Subject: [PATCH 4.9 095/157] ACPICA: Utilities: Avoid deleting the same object twice in a row Date: Mon, 24 Jan 2022 19:43:05 +0100 Message-Id: <20220124183935.790529145@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rafael J. Wysocki [ Upstream commit 1cdfe9e346b4c5509ffe19ccde880fd259d9f7a3 ] ACPICA commit c11af67d8f7e3d381068ce7771322f2b5324d687 If original_count is 0 in acpi_ut_update_ref_count (), acpi_ut_delete_internal_obj () is invoked for the target object, which is incorrect, because that object has been deleted once already and the memory allocated to store it may have been reclaimed and allocated for a different purpose by the host OS. Moreover, a confusing debug message following the "Reference Count is already zero, cannot decrement" warning is printed in that case. To fix this issue, make acpi_ut_update_ref_count () return after finding that original_count is 0 and printing the above warning. Link: https://github.com/acpica/acpica/commit/c11af67d Link: https://github.com/acpica/acpica/pull/652 Reported-by: Mark Asselstine Signed-off-by: Rafael J. Wysocki Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/acpi/acpica/utdelete.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c index 03a2282ceb9ca..81a9c47973ce8 100644 --- a/drivers/acpi/acpica/utdelete.c +++ b/drivers/acpi/acpica/utdelete.c @@ -440,6 +440,7 @@ acpi_ut_update_ref_count(union acpi_operand_object *obj= ect, u32 action) ACPI_WARNING((AE_INFO, "Obj %p, Reference Count is already zero, cannot decrement\n", object)); + return; } =20 ACPI_DEBUG_PRINT((ACPI_DB_ALLOCATIONS, --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 92013C433FE for ; Mon, 24 Jan 2022 19:11:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347184AbiAXTJt (ORCPT ); Mon, 24 Jan 2022 14:09:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345275AbiAXTDN (ORCPT ); Mon, 24 Jan 2022 14:03:13 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1C24DC06174E; Mon, 24 Jan 2022 10:58:59 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CCE11B8122C; Mon, 24 Jan 2022 18:58:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01645C340E5; Mon, 24 Jan 2022 18:58:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050736; bh=yqra3Bl1aJz0zvUd6eMq6pYqBx4bxEbp699g1+233U8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UXgy7v9U9uhiD4IxrqTiDfjUijmZXa+FX02gK6+40Vj1io9mpAk0XVkhKO9zOmmWI vWf+cNYBsriQfjxFBivKh0yRGsn+5+a/T6nsRzqKLPUTHa10V5TuepBrVNgc0B/1Sk gfWagipdpcotfL2saiEFBneb1JD46l8diePGlesY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lenny Szubowicz , "Rafael J. Wysocki" , Bob Moore , Sasha Levin Subject: [PATCH 4.9 096/157] ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() Date: Mon, 24 Jan 2022 19:43:06 +0100 Message-Id: <20220124183935.819994578@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rafael J. Wysocki [ Upstream commit 24ea5f90ec9548044a6209685c5010edd66ffe8f ] ACPICA commit d984f12041392fa4156b52e2f7e5c5e7bc38ad9e If Operand[0] is a reference of the ACPI_REFCLASS_REFOF class, acpi_ex_opcode_1A_0T_1R () calls acpi_ns_get_attached_object () to obtain return_desc which may require additional resolution with the help of acpi_ex_read_data_from_field (). If the latter fails, the reference counter of the original return_desc is decremented which is incorrect, because acpi_ns_get_attached_object () does not increment the reference counter of the object returned by it. This issue may lead to premature deletion of the attached object while it is still attached and a use-after-free and crash in the host OS. For example, this may happen when on evaluation of ref_of() a local region field where there is no registered handler for the given Operation Region. Fix it by making acpi_ex_opcode_1A_0T_1R () return Status right away after a acpi_ex_read_data_from_field () failure. Link: https://github.com/acpica/acpica/commit/d984f120 Link: https://github.com/acpica/acpica/pull/685 Reported-by: Lenny Szubowicz Signed-off-by: Rafael J. Wysocki Signed-off-by: Bob Moore Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/acpi/acpica/exoparg1.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c index 007300433cdea..1cea26a741474 100644 --- a/drivers/acpi/acpica/exoparg1.c +++ b/drivers/acpi/acpica/exoparg1.c @@ -1029,7 +1029,8 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_= state *walk_state) (walk_state, return_desc, &temp_desc); if (ACPI_FAILURE(status)) { - goto cleanup; + return_ACPI_STATUS + (status); } =20 return_desc =3D temp_desc; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25654C433F5 for ; Mon, 24 Jan 2022 19:05:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346130AbiAXTFF (ORCPT ); Mon, 24 Jan 2022 14:05:05 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:56110 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344731AbiAXS7A (ORCPT ); Mon, 24 Jan 2022 13:59:00 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5A33C60010; Mon, 24 Jan 2022 18:59:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 32099C36AE2; Mon, 24 Jan 2022 18:58:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050739; bh=DChxv8YFRrtwCojAA4/44bOFk8gKrjPyvXuZ4JI20dQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RsbCS2wJBkcH9l83tnJ1l0pb9JJE039t9pWmrgAIRXFBsgc07GbLyvSBZCQfHY6rl jQeYY8XyAWklZjpivC8BshAOooxSayYFp/NzoG7bGU0N1Byjv6JpsQhprMPKx4bGX8 a/YNIoilYfba6Jh5n0z8jdrMuL7IVspXbfEm1WsY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , David Sterba , Sasha Levin Subject: [PATCH 4.9 097/157] btrfs: remove BUG_ON() in find_parent_nodes() Date: Mon, 24 Jan 2022 19:43:07 +0100 Message-Id: <20220124183935.849473541@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Josef Bacik [ Upstream commit fcba0120edf88328524a4878d1d6f4ad39f2ec81 ] We search for an extent entry with .offset =3D -1, which shouldn't be a thing, but corruption happens. Add an ASSERT() for the developers, return -EUCLEAN for mortals. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- fs/btrfs/backref.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c index bb008ac507fe3..29a19bc2abe18 100644 --- a/fs/btrfs/backref.c +++ b/fs/btrfs/backref.c @@ -1271,7 +1271,12 @@ again: ret =3D btrfs_search_slot(trans, fs_info->extent_root, &key, path, 0, 0); if (ret < 0) goto out; - BUG_ON(ret =3D=3D 0); + if (ret =3D=3D 0) { + /* This shouldn't happen, indicates a bug or fs corruption. */ + ASSERT(ret !=3D 0); + ret =3D -EUCLEAN; + goto out; + } =20 #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS if (trans && likely(trans->type !=3D __TRANS_DUMMY) && --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6698AC4332F for ; Mon, 24 Jan 2022 19:11:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347124AbiAXTJn (ORCPT ); Mon, 24 Jan 2022 14:09:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45326 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344246AbiAXTDN (ORCPT ); Mon, 24 Jan 2022 14:03:13 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1045AC061753; Mon, 24 Jan 2022 10:59:04 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A17E86020F; Mon, 24 Jan 2022 18:59:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7257EC340E7; Mon, 24 Jan 2022 18:59:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050743; bh=1LsIV7lL5lJ40dfUxO8pKqDVJSLOtPvkZEuXKWupjx0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=k0nQjD9z2HTYmojl9TbYPZWt96gPnaPgE6OsqV44iyClLzRf0HpDxd+5pLRb3P9Lo 9tT8gXVK/zDXV8n+DsBzLhPhfzlarpLG2tSMk8MGPXvIAnrYli/kvWXyTEitCjIZgZ pXG+dBIxDlvXmSgJV78chz1t+5G8A5IpKdj4bMso= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , David Sterba , Sasha Levin Subject: [PATCH 4.9 098/157] btrfs: remove BUG_ON(!eie) in find_parent_nodes Date: Mon, 24 Jan 2022 19:43:08 +0100 Message-Id: <20220124183935.878229190@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Josef Bacik [ Upstream commit 9f05c09d6baef789726346397438cca4ec43c3ee ] If we're looking for leafs that point to a data extent we want to record the extent items that point at our bytenr. At this point we have the reference and we know for a fact that this leaf should have a reference to our bytenr. However if there's some sort of corruption we may not find any references to our leaf, and thus could end up with eie =3D=3D NULL. Replace this BUG_ON() with an ASSERT() and then return -EUCLEAN for the mortals. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- fs/btrfs/backref.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c index 29a19bc2abe18..16169b35ab6e5 100644 --- a/fs/btrfs/backref.c +++ b/fs/btrfs/backref.c @@ -1437,10 +1437,18 @@ again: goto out; if (!ret && extent_item_pos) { /* - * we've recorded that parent, so we must extend - * its inode list here + * We've recorded that parent, so we must extend + * its inode list here. + * + * However if there was corruption we may not + * have found an eie, return an error in this + * case. */ - BUG_ON(!eie); + ASSERT(eie); + if (!eie) { + ret =3D -EUCLEAN; + goto out; + } while (eie->next) eie =3D eie->next; eie->next =3D ref->inode_list; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2B2FC433EF for ; Mon, 24 Jan 2022 19:05:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346176AbiAXTFJ (ORCPT ); Mon, 24 Jan 2022 14:05:09 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:56818 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344625AbiAXS7I (ORCPT ); Mon, 24 Jan 2022 13:59:08 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 79397B8121F; Mon, 24 Jan 2022 18:59:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A4568C340E5; Mon, 24 Jan 2022 18:59:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050746; bh=03o1csNbjLwxt1ijV6RGrc3lrOSe+NXYg76KWG2DTlI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OUPxr3+68NcZ407UMKBgfULUhE/ud0TIpU2dB9DDRpLu5x8nFGM6Fu48P1fZ7UyLp mQxf5ep3rN8P00VutJiwDfy9PAKIFZL/D8Xi58nzw39MKx7D7A5NyvXQF/TnVIPFmC V++QKyObZ8OD7tB31QUgmZCqLLUVMSOJQWbBHgbg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maxime Bizon , Florian Fainelli , Andrew Lunn , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.9 099/157] net: mdio: Demote probed message to debug print Date: Mon, 24 Jan 2022 19:43:09 +0100 Message-Id: <20220124183935.907510934@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Fainelli [ Upstream commit 7590fc6f80ac2cbf23e6b42b668bbeded070850b ] On systems with large numbers of MDIO bus/muxes the message indicating that a given MDIO bus has been successfully probed is repeated for as many buses we have, which can eat up substantial boot time for no reason, demote to a debug print. Reported-by: Maxime Bizon Signed-off-by: Florian Fainelli Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20220103194024.2620-1-f.fainelli@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/phy/mdio_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 92fb664b56fbb..0fa6e2da4b5a2 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -347,7 +347,7 @@ int __mdiobus_register(struct mii_bus *bus, struct modu= le *owner) } =20 bus->state =3D MDIOBUS_REGISTERED; - pr_info("%s: probed\n", bus->name); + dev_dbg(&bus->dev, "probed\n"); return 0; =20 error: --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69F62C433EF for ; Mon, 24 Jan 2022 19:12:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344863AbiAXTMV (ORCPT ); Mon, 24 Jan 2022 14:12:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45332 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345282AbiAXTDN (ORCPT ); Mon, 24 Jan 2022 14:03:13 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E5CDAC06175A; Mon, 24 Jan 2022 10:59:11 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A347FB81238; Mon, 24 Jan 2022 18:59:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6E6AC340E7; Mon, 24 Jan 2022 18:59:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050749; bh=1irUI/gODjLwvM/jMUYlUbBn28oVk1kyE3HGzfg2p/A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yvSJW3QMjDmDV4q5GrvTO/b2SDCrmhrhqbNSt6u/xwRS1P8/HUzbZJdYpBIz/MLgK vyjJ7aiPDCtMnf44wpI6ldMj+AWCi7bmkkd7hDwgyXh3NW+/qBQm1LU1k0lrYt1Bfo nuG38J4mtFLirzjcrnH25nejZ0xETAnqzU7BFnz0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joe Thornber , Mike Snitzer , Sasha Levin Subject: [PATCH 4.9 100/157] dm btree: add a defensive bounds check to insert_at() Date: Mon, 24 Jan 2022 19:43:10 +0100 Message-Id: <20220124183935.937971550@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joe Thornber [ Upstream commit 85bca3c05b6cca31625437eedf2060e846c4bbad ] Corrupt metadata could trigger an out of bounds write. Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/md/persistent-data/dm-btree.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-= data/dm-btree.c index 386215245dfe2..85273da5da206 100644 --- a/drivers/md/persistent-data/dm-btree.c +++ b/drivers/md/persistent-data/dm-btree.c @@ -83,14 +83,16 @@ void inc_children(struct dm_transaction_manager *tm, st= ruct btree_node *n, } =20 static int insert_at(size_t value_size, struct btree_node *node, unsigned = index, - uint64_t key, void *value) - __dm_written_to_disk(value) + uint64_t key, void *value) + __dm_written_to_disk(value) { uint32_t nr_entries =3D le32_to_cpu(node->header.nr_entries); + uint32_t max_entries =3D le32_to_cpu(node->header.max_entries); __le64 key_le =3D cpu_to_le64(key); =20 if (index > nr_entries || - index >=3D le32_to_cpu(node->header.max_entries)) { + index >=3D max_entries || + nr_entries >=3D max_entries) { DMERR("too many entries in btree node for insert"); __dm_unbless_for_disk(value); return -ENOMEM; --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54E15C433EF for ; Mon, 24 Jan 2022 19:11:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347086AbiAXTJl (ORCPT ); Mon, 24 Jan 2022 14:09:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45334 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345290AbiAXTDN (ORCPT ); Mon, 24 Jan 2022 14:03:13 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 80EC5C06175B; Mon, 24 Jan 2022 10:59:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 47693B81227; Mon, 24 Jan 2022 18:59:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 65046C340E7; Mon, 24 Jan 2022 18:59:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050753; bh=PE5eRi3IE9VNLlQ1ed9CSr4cABoF8ehAGM5W/x8b8/k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KD91//CEVsu1WGngMaEKLrmK5aJ016cj0/OzMaCq/E69dNbzgL4crpsSy/RaXIJv4 UBft3QxkVOX2jshKJV4A8tqZyurGjWc7cFsC9whhgTQ/ffq0sZQ0/RXjhMMmATWM7l /0wfx/cf9HdmTyjv/4Sq9cQC+w2KTWx+jivV5ayU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joe Thornber , Mike Snitzer , Sasha Levin Subject: [PATCH 4.9 101/157] dm space map common: add bounds check to sm_ll_lookup_bitmap() Date: Mon, 24 Jan 2022 19:43:11 +0100 Message-Id: <20220124183935.966414011@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joe Thornber [ Upstream commit cba23ac158db7f3cd48a923d6861bee2eb7a2978 ] Corrupted metadata could warrant returning error from sm_ll_lookup_bitmap(). Signed-off-by: Joe Thornber Signed-off-by: Mike Snitzer Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/md/persistent-data/dm-space-map-common.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/= persistent-data/dm-space-map-common.c index ca09ad2a639c4..6fa4a68e78b0d 100644 --- a/drivers/md/persistent-data/dm-space-map-common.c +++ b/drivers/md/persistent-data/dm-space-map-common.c @@ -279,6 +279,11 @@ int sm_ll_lookup_bitmap(struct ll_disk *ll, dm_block_t= b, uint32_t *result) struct disk_index_entry ie_disk; struct dm_block *blk; =20 + if (b >=3D ll->nr_blocks) { + DMERR_LIMIT("metadata block out of bounds"); + return -EINVAL; + } + b =3D do_div(index, ll->entries_per_block); r =3D ll->load_ie(ll, index, &ie_disk); if (r < 0) --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B4E7C433EF for ; Mon, 24 Jan 2022 19:03:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245310AbiAXTD3 (ORCPT ); Mon, 24 Jan 2022 14:03:29 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:56920 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344054AbiAXS7S (ORCPT ); Mon, 24 Jan 2022 13:59:18 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9EDAEB81232; Mon, 24 Jan 2022 18:59:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ACE3DC340E8; Mon, 24 Jan 2022 18:59:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050756; bh=mOa3viRnCiyugN9lsjwtjitWUVuvU+gNzpDpjLjWNzE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XwoAm/SKUAqIeRNVaFY9g5m6hhBwAyQYw71Q0oNmpcUx5v185nDozUBxnFTzJAuxt 7U5wGz7KLACcOaVgRXV1eT5aPPWxloHIXzrIzZr+tjQnWvRf2mDNM0E9rFHrN06O6G tDl7LZcZor3J63bhj3eGbYj16SP4FCtm2jXRC0Co= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Russell King , Lukas Wunner , Sasha Levin Subject: [PATCH 4.9 102/157] serial: pl010: Drop CR register reset on set_termios Date: Mon, 24 Jan 2022 19:43:12 +0100 Message-Id: <20220124183935.998455892@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Wunner [ Upstream commit 08a0c6dff91c965e39905cf200d22db989203ccb ] pl010_set_termios() briefly resets the CR register to zero. Where does this register write come from? The PL010 driver's IRQ handler ambauart_int() originally modified the CR register without holding the port spinlock. ambauart_set_termios() also modified that register. To prevent concurrent read-modify-writes by the IRQ handler and to prevent transmission while changing baudrate, ambauart_set_termios() had to disable interrupts. That is achieved by writing zero to the CR register. However in 2004 the PL010 driver was amended to acquire the port spinlock in the IRQ handler, obviating the need to disable interrupts in ->set_termios(): https://git.kernel.org/history/history/c/157c0342e591 That rendered the CR register write obsolete. Drop it. Cc: Russell King Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/fcaff16e5b1abb4cc3da5a2879ac13f278b99ed0.16= 41128728.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/tty/serial/amba-pl010.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl01= 0.c index 5d41d5b92619a..7f4ba92739663 100644 --- a/drivers/tty/serial/amba-pl010.c +++ b/drivers/tty/serial/amba-pl010.c @@ -465,14 +465,11 @@ pl010_set_termios(struct uart_port *port, struct kter= mios *termios, if ((termios->c_cflag & CREAD) =3D=3D 0) uap->port.ignore_status_mask |=3D UART_DUMMY_RSR_RX; =20 - /* first, disable everything */ old_cr =3D readb(uap->port.membase + UART010_CR) & ~UART010_CR_MSIE; =20 if (UART_ENABLE_MS(port, termios->c_cflag)) old_cr |=3D UART010_CR_MSIE; =20 - writel(0, uap->port.membase + UART010_CR); - /* Set baud rate */ quot -=3D 1; writel((quot & 0xf00) >> 8, uap->port.membase + UART010_LCRM); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 91F7AC433EF for ; Mon, 24 Jan 2022 19:03:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345460AbiAXTDl (ORCPT ); Mon, 24 Jan 2022 14:03:41 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:56362 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344839AbiAXS7U (ORCPT ); Mon, 24 Jan 2022 13:59:20 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 357ED608D4; Mon, 24 Jan 2022 18:59:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1149C340E7; Mon, 24 Jan 2022 18:59:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050759; bh=JcvhSTU1IQqq+oYId9prgK7Cki2I3kfKY0v6RsGm2zU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZZRCyZTDZyPus2+l4q0LdJRch7rrwToPzmfdrchKkx/NsSdfTlSMdLQF/BawoYX8a 78FylcI1c47+0HY0hSsCRTaC3ztSh4zN+vYf/UKxh6hRkGW3ZNVBI1n63z6ONdxhCN NoIbIxqzJVm8rMtd9dTd/t3lX7NhyLH4ECZvBlPw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lukas Wunner , Sasha Levin Subject: [PATCH 4.9 103/157] serial: core: Keep mctrl register state and cached copy in sync Date: Mon, 24 Jan 2022 19:43:13 +0100 Message-Id: <20220124183936.032114999@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Wunner [ Upstream commit 93a770b7e16772530196674ffc79bb13fa927dc6 ] struct uart_port contains a cached copy of the Modem Control signals. It is used to skip register writes in uart_update_mctrl() if the new signal state equals the old signal state. It also avoids a register read to obtain the current state of output signals. When a uart_port is registered, uart_configure_port() changes signal state but neglects to keep the cached copy in sync. That may cause a subsequent register write to be incorrectly skipped. Fix it before it trips somebody up. This behavior has been present ever since the serial core was introduced in 2002: https://git.kernel.org/history/history/c/33c0d1b0c3eb So far it was never an issue because the cached copy is initialized to 0 by kzalloc() and when uart_configure_port() is executed, at most DTR has been set by uart_set_options() or sunsu_console_setup(). Therefore, a stable designation seems unnecessary. Signed-off-by: Lukas Wunner Link: https://lore.kernel.org/r/bceeaba030b028ed810272d55d5fc6f3656ddddb.16= 41129752.git.lukas@wunner.de Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/tty/serial/serial_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_c= ore.c index e97961dc3622d..ec458add38833 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -2349,7 +2349,8 @@ uart_configure_port(struct uart_driver *drv, struct u= art_state *state, * We probably don't need a spinlock around this, but */ spin_lock_irqsave(&port->lock, flags); - port->ops->set_mctrl(port, port->mctrl & TIOCM_DTR); + port->mctrl &=3D TIOCM_DTR; + port->ops->set_mctrl(port, port->mctrl); spin_unlock_irqrestore(&port->lock, flags); =20 /* --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B8B3C4332F for ; Mon, 24 Jan 2022 19:13:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344297AbiAXTNT (ORCPT ); Mon, 24 Jan 2022 14:13:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46034 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346088AbiAXTFD (ORCPT ); Mon, 24 Jan 2022 14:05:03 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1EA67C0604FD; Mon, 24 Jan 2022 10:59:25 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DB8EDB8122C; Mon, 24 Jan 2022 18:59:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F21BC340E5; Mon, 24 Jan 2022 18:59:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050762; bh=bgNt8tan3HJNugIA65XVudB9fyuaNnnmV3HhitjxRuw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qOvJWEn/tAmqC7/MM0moTbTgUDeNUYKM7YIkLQrulRXWnyX6lnpwmRu2WZxhemBZo OfZxykkoeGg0xOKy89EVIl0ZfSvz7MnsGd7DGPLJvYQqoT9KcQG4zitrdmTQRGFzb3 JnfIjfht1onWAyZ/Mw6IvXVzYLpd6UUSb4dxa/DQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John David Anglin , Helge Deller , Sasha Levin Subject: [PATCH 4.9 104/157] parisc: Avoid calling faulthandler_disabled() twice Date: Mon, 24 Jan 2022 19:43:14 +0100 Message-Id: <20220124183936.063719333@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: John David Anglin [ Upstream commit 9e9d4b460f23bab61672eae397417d03917d116c ] In handle_interruption(), we call faulthandler_disabled() to check whether = the fault handler is not disabled. If the fault handler is disabled, we immedia= tely call do_page_fault(). It then calls faulthandler_disabled(). If disabled, do_page_fault() attempts to fixup the exception by jumping to no_context: no_context: if (!user_mode(regs) && fixup_exception(regs)) { return; } parisc_terminate("Bad Address (null pointer deref?)", regs, code, a= ddress); Apart from the error messages, the two blocks of code perform the same function. We can avoid two calls to faulthandler_disabled() by a simple revision to the code in handle_interruption(). Note: I didn't try to fix the formatting of this code block. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/parisc/kernel/traps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c index 11c91697d5f9e..5b41779de2337 100644 --- a/arch/parisc/kernel/traps.c +++ b/arch/parisc/kernel/traps.c @@ -793,7 +793,7 @@ void notrace handle_interruption(int code, struct pt_re= gs *regs) * unless pagefault_disable() was called before. */ =20 - if (fault_space =3D=3D 0 && !faulthandler_disabled()) + if (faulthandler_disabled() || fault_space =3D=3D 0) { /* Clean up and return if in exception table. */ if (fixup_exception(regs)) --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B19EC433EF for ; Mon, 24 Jan 2022 19:03:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345379AbiAXTDf (ORCPT ); Mon, 24 Jan 2022 14:03:35 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:58432 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344382AbiAXS70 (ORCPT ); Mon, 24 Jan 2022 13:59:26 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5A9BC609EE; Mon, 24 Jan 2022 18:59:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 227D9C340E5; Mon, 24 Jan 2022 18:59:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050765; bh=qNILM1RdhmA5Zm0cLlQ79sNMcY7CTw2k9YHU8nTci04=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q7tOC2MsMSRF56FHDLDNos9ZL06NEyjJ602gPqebdg2S0akyWOLEiK1Gf9r+VbcdK LZEThRQK/DqS/eTKn2v2Ra+fOHdrASJJ7EM+VcljJpxLrZItIISMIatPqi/7sZjdqH 8wYMgDsldUqknXKYI4ytvs082A1rQMjFa6vIRlQM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.9 105/157] powerpc/6xx: add missing of_node_put Date: Mon, 24 Jan 2022 19:43:15 +0100 Message-Id: <20220124183936.094440495@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit f6e82647ff71d427d4148964b71f239fba9d7937 ] for_each_compatible_node performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ expression e; local idexpression n; @@ @@ local idexpression n; expression e; @@ for_each_compatible_node(n,...) { ... ( of_node_put(n); | e =3D n | + of_node_put(n); ? break; ) ... } ... when !=3D n // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-2-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/p= latforms/embedded6xx/hlwd-pic.c index bf4a125faec66..db2ea6b6889de 100644 --- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c @@ -220,6 +220,7 @@ void hlwd_pic_probe(void) irq_set_chained_handler(cascade_virq, hlwd_pic_irq_cascade); hlwd_irq_host =3D host; + of_node_put(np); break; } } --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 265DFC433F5 for ; Mon, 24 Jan 2022 19:13:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345011AbiAXTNf (ORCPT ); Mon, 24 Jan 2022 14:13:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46074 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346179AbiAXTFJ (ORCPT ); Mon, 24 Jan 2022 14:05:09 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7F48DC0401FA; Mon, 24 Jan 2022 10:59:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 495F6B81236; Mon, 24 Jan 2022 18:59:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7511CC340EA; Mon, 24 Jan 2022 18:59:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050772; bh=nRljK2iWbb10p4w6RFd1lQ40Hofhpav2Nn+BCIRYQ08=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yrdujnL5g8LcruFa6Euut5oINMfQgOoiCk2e+zLYAL0y7ArGK6iWDqwn6NLOggbYP CJD3cU6q1PUsk5rvRamJJPOSwDTkKI/tm9wqNVHUmf+8XIo6c0ILudAjx9Yn+jEp4g neRizVS0+ySoI0zH/i2rG2aXzggoxOhIaePw5BtM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.9 106/157] powerpc/powernv: add missing of_node_put Date: Mon, 24 Jan 2022 19:43:16 +0100 Message-Id: <20220124183936.133978740@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit 7d405a939ca960162eb30c1475759cb2fdf38f8c ] for_each_compatible_node performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ local idexpression n; expression e; @@ for_each_compatible_node(n,...) { ... ( of_node_put(n); | e =3D n | + of_node_put(n); ? break; ) ... } ... when !=3D n // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-4-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/powerpc/platforms/powernv/opal-lpc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/powernv/opal-lpc.c b/arch/powerpc/platf= orms/powernv/opal-lpc.c index e4169d68cb328..d28c4a9269c38 100644 --- a/arch/powerpc/platforms/powernv/opal-lpc.c +++ b/arch/powerpc/platforms/powernv/opal-lpc.c @@ -401,6 +401,7 @@ void opal_lpc_init(void) if (!of_get_property(np, "primary", NULL)) continue; opal_lpc_chip_id =3D of_get_ibm_chip_id(np); + of_node_put(np); break; } if (opal_lpc_chip_id < 0) --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44891C433F5 for ; Mon, 24 Jan 2022 19:05:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346284AbiAXTFQ (ORCPT ); Mon, 24 Jan 2022 14:05:16 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:58564 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344910AbiAXS7g (ORCPT ); Mon, 24 Jan 2022 13:59:36 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BE2AE60909; Mon, 24 Jan 2022 18:59:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9EDD5C340E5; Mon, 24 Jan 2022 18:59:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050775; bh=ehxo8YQgznHOl0EbViewbaIP5NiLJZCNpNXsawUryR8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d0Hj4omVSC/gbT5VkWrXoDeAft0RgdnaWh75xGAFmBhj5eFI1UlCQyuftjjqChv7l fq8mBZ+gMse6fVab1ubiJb6fPydtfEADykPUvpbr2RslMAtRhIoSijlElNrO2oSD2/ FX1Zx7te5hAdfi3ZsbxJ/tOdRgJPNfJKESbtm73Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.9 107/157] powerpc/cell: add missing of_node_put Date: Mon, 24 Jan 2022 19:43:17 +0100 Message-Id: <20220124183936.163649241@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit a841fd009e51c8c0a8f07c942e9ab6bb48da8858 ] for_each_node_by_name performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ expression e,e1; local idexpression n; @@ for_each_node_by_name(n, e1) { ... when !=3D of_node_put(n) when !=3D e =3D n ( return n; | + of_node_put(n); ? return ...; ) ... } // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-7-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/powerpc/platforms/cell/iommu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/c= ell/iommu.c index 7ff51f96a00e8..8df43781f5db9 100644 --- a/arch/powerpc/platforms/cell/iommu.c +++ b/arch/powerpc/platforms/cell/iommu.c @@ -1107,6 +1107,7 @@ static int __init cell_iommu_fixed_mapping_init(void) if (hbase < dbase || (hend > (dbase + dsize))) { pr_debug("iommu: hash window doesn't fit in" "real DMA window\n"); + of_node_put(np); return -1; } } --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90936C433F5 for ; Mon, 24 Jan 2022 19:13:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345877AbiAXTN0 (ORCPT ); Mon, 24 Jan 2022 14:13:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46094 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346191AbiAXTFK (ORCPT ); Mon, 24 Jan 2022 14:05:10 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F0DC4C08C5C0; Mon, 24 Jan 2022 10:59:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AF9E7B81215; Mon, 24 Jan 2022 18:59:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C79EFC340E7; Mon, 24 Jan 2022 18:59:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050778; bh=n+OG6gPeo3Ix3CdWwgkqT9r920PvemF2ny3sKHTPWSk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WwUdcj1SCUKCCYP8DIdu5XwZLKM78EsbifiY+g6N7ZDSDYW4O1/mlr7y0S9z6SS8k ujP88jYxgEz7q++31Pw+n9ZNmpdVeCIYJTofVD63XjuoVcQAi9Wt4iAu1QMoTimSG+ 5Yc1gUENDH4acaftA+znb3xZxIH3QxFKkdyE5wlc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julia Lawall , Michael Ellerman , Sasha Levin Subject: [PATCH 4.9 108/157] powerpc/btext: add missing of_node_put Date: Mon, 24 Jan 2022 19:43:18 +0100 Message-Id: <20220124183936.198527817@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julia Lawall [ Upstream commit a1d2b210ffa52d60acabbf7b6af3ef7e1e69cda0 ] for_each_node_by_type performs an of_node_get on each iteration, so a break out of the loop requires an of_node_put. A simplified version of the semantic patch that fixes this problem is as follows (http://coccinelle.lip6.fr): // @@ local idexpression n; expression e; @@ for_each_node_by_type(n,...) { ... ( of_node_put(n); | e =3D n | + of_node_put(n); ? break; ) ... } ... when !=3D n // Signed-off-by: Julia Lawall Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/1448051604-25256-6-git-send-email-Julia.Law= all@lip6.fr Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/powerpc/kernel/btext.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/btext.c b/arch/powerpc/kernel/btext.c index 8275858a434d9..2d91ba38b4524 100644 --- a/arch/powerpc/kernel/btext.c +++ b/arch/powerpc/kernel/btext.c @@ -257,8 +257,10 @@ int __init btext_find_display(int allow_nonstdout) rc =3D btext_initialize(np); printk("result: %d\n", rc); } - if (rc =3D=3D 0) + if (rc =3D=3D 0) { + of_node_put(np); break; + } } return rc; } --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7BD0C433EF for ; Mon, 24 Jan 2022 19:03:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344613AbiAXTDu (ORCPT ); Mon, 24 Jan 2022 14:03:50 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57212 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344997AbiAXS7o (ORCPT ); Mon, 24 Jan 2022 13:59:44 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E1830B81215; Mon, 24 Jan 2022 18:59:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01E89C340E5; Mon, 24 Jan 2022 18:59:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050781; bh=Nnp6w8GL4hiQozY8T/6HlO69LhX6+pjDvbt3rnlGots=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JpN2lQH1L0GC35MmICwqcFQCpWOO2W37sGPbuNkzpnLwYi7FmGhSd59WYdC4B7Yqr yKuShdZRPrkASHIURUAE1hX9jxshFXaHsAQbHNi4LWGH+RAEyuIHt5ezNT36JpCByL xIa765JWGnn9M2bd5iFQYrIoLf2L75iEHpTyZKsg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Heiner Kallweit , Jean Delvare , Wolfram Sang , Sasha Levin Subject: [PATCH 4.9 109/157] i2c: i801: Dont silently correct invalid transfer size Date: Mon, 24 Jan 2022 19:43:19 +0100 Message-Id: <20220124183936.231220313@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Heiner Kallweit [ Upstream commit effa453168a7eeb8a562ff4edc1dbf9067360a61 ] If an invalid block size is provided, reject it instead of silently changing it to a supported value. Especially critical I see the case of a write transfer with block length 0. In this case we have no guarantee that the byte we would write is valid. When silently reducing a read to 32 bytes then we don't return an error and the caller may falsely assume that we returned the full requested data. If this change should break any (broken) caller, then I think we should fix the caller. Signed-off-by: Heiner Kallweit Reviewed-by: Jean Delvare Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/i2c/busses/i2c-i801.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c index 0e04b27e3158d..b577c64f3b3ec 100644 --- a/drivers/i2c/busses/i2c-i801.c +++ b/drivers/i2c/busses/i2c-i801.c @@ -762,6 +762,11 @@ static int i801_block_transaction(struct i801_priv *pr= iv, int result =3D 0; unsigned char hostc; =20 + if (read_write =3D=3D I2C_SMBUS_READ && command =3D=3D I2C_SMBUS_BLOCK_DA= TA) + data->block[0] =3D I2C_SMBUS_BLOCK_MAX; + else if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX) + return -EPROTO; + if (command =3D=3D I2C_SMBUS_I2C_BLOCK_DATA) { if (read_write =3D=3D I2C_SMBUS_WRITE) { /* set I2C_EN bit in configuration register */ @@ -775,16 +780,6 @@ static int i801_block_transaction(struct i801_priv *pr= iv, } } =20 - if (read_write =3D=3D I2C_SMBUS_WRITE - || command =3D=3D I2C_SMBUS_I2C_BLOCK_DATA) { - if (data->block[0] < 1) - data->block[0] =3D 1; - if (data->block[0] > I2C_SMBUS_BLOCK_MAX) - data->block[0] =3D I2C_SMBUS_BLOCK_MAX; - } else { - data->block[0] =3D 32; /* max for SMBus block reads */ - } - /* Experience has shown that the block buffer can only be used for SMBus (not I2C) block transactions, even though the datasheet doesn't mention this limitation. */ --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4216FC433F5 for ; Mon, 24 Jan 2022 19:04:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344668AbiAXTDy (ORCPT ); Mon, 24 Jan 2022 14:03:54 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:56912 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345041AbiAXS7p (ORCPT ); Mon, 24 Jan 2022 13:59:45 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 613446090C; Mon, 24 Jan 2022 18:59:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 416C7C340E5; Mon, 24 Jan 2022 18:59:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050784; bh=FWikH7Ue5U2AmBBJHD/wrnCX9gAjKiiBLs4NTXotUXo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F4SUYd3tk2gm18YsfArtjvGmziHfYoAlxRvuCXbMISlG0KrgoOQZZTcpQg5+GNPPW 4jAGzR6BADGldEyM6nTDR3eUOdv1zSdZXwi6H2n06D354f3VuiZ3O79L35N7q/mlW5 E8N16RujXBWAusvZYPvEuVshDFPQehBVGsg7tTKY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Ellerman , Sasha Levin Subject: [PATCH 4.9 110/157] powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING Date: Mon, 24 Jan 2022 19:43:20 +0100 Message-Id: <20220124183936.264195605@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Michael Ellerman [ Upstream commit a4ac0d249a5db80e79d573db9e4ad29354b643a8 ] setup_profiling_timer() is only needed when CONFIG_PROFILING is enabled. Fixes the following W=3D1 warning when CONFIG_PROFILING=3Dn: linux/arch/powerpc/kernel/smp.c:1638:5: error: no previous prototype for = =E2=80=98setup_profiling_timer=E2=80=99 Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20211124093254.1054750-5-mpe@ellerman.id.au Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/powerpc/kernel/smp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c index 9c6f3fd580597..31675c1d678b6 100644 --- a/arch/powerpc/kernel/smp.c +++ b/arch/powerpc/kernel/smp.c @@ -759,10 +759,12 @@ void start_secondary(void *unused) BUG(); } =20 +#ifdef CONFIG_PROFILING int setup_profiling_timer(unsigned int multiplier) { return 0; } +#endif =20 #ifdef CONFIG_SCHED_SMT /* cpumask of CPUs with asymetric SMT dependancy */ --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7BCB1C433EF for ; Mon, 24 Jan 2022 19:04:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237101AbiAXTED (ORCPT ); Mon, 24 Jan 2022 14:04:03 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:56022 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345105AbiAXS7u (ORCPT ); Mon, 24 Jan 2022 13:59:50 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4A893B8123A; Mon, 24 Jan 2022 18:59:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6CA31C340E8; Mon, 24 Jan 2022 18:59:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050788; bh=ztCq9ANAcBkHdS4/TOCP4mgItl7HAp3oyahqlUf+rPU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FGx6sWtYwNjCULfuIZmxOrmX+8f7oaet0NivhRDIfNdnHxHlirS2NEmzpkb5NWqlP doiBetpbyCHKvCv2c1pkFnyfPUKEY7qSotuNQGjc1kqWajKHYnyy229bhC6oQ0OPaN 6LmJKWlgXDsQPQ6iVMVmvqQs3E0A8M7hUTi3t5Nc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joakim Tjernlund , Scott Wood , Wolfram Sang , Sasha Levin Subject: [PATCH 4.9 111/157] i2c: mpc: Correct I2C reset procedure Date: Mon, 24 Jan 2022 19:43:21 +0100 Message-Id: <20220124183936.296733102@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joakim Tjernlund [ Upstream commit ebe82cf92cd4825c3029434cabfcd2f1780e64be ] Current I2C reset procedure is broken in two ways: 1) It only generate 1 START instead of 9 STARTs and STOP. 2) It leaves the bus Busy so every I2C xfer after the first fixup calls the reset routine again, for every xfer there after. This fixes both errors. Signed-off-by: Joakim Tjernlund Acked-by: Scott Wood Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/i2c/busses/i2c-mpc.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c index 90e4f839eb1cb..d153fc28e6bfb 100644 --- a/drivers/i2c/busses/i2c-mpc.c +++ b/drivers/i2c/busses/i2c-mpc.c @@ -107,23 +107,30 @@ static irqreturn_t mpc_i2c_isr(int irq, void *dev_id) /* Sometimes 9th clock pulse isn't generated, and slave doesn't release * the bus, because it wants to send ACK. * Following sequence of enabling/disabling and sending start/stop generat= es - * the 9 pulses, so it's all OK. + * the 9 pulses, each with a START then ending with STOP, so it's all OK. */ static void mpc_i2c_fixup(struct mpc_i2c *i2c) { int k; - u32 delay_val =3D 1000000 / i2c->real_clk + 1; - - if (delay_val < 2) - delay_val =3D 2; + unsigned long flags; =20 for (k =3D 9; k; k--) { writeccr(i2c, 0); - writeccr(i2c, CCR_MSTA | CCR_MTX | CCR_MEN); + writeb(0, i2c->base + MPC_I2C_SR); /* clear any status bits */ + writeccr(i2c, CCR_MEN | CCR_MSTA); /* START */ + readb(i2c->base + MPC_I2C_DR); /* init xfer */ + udelay(15); /* let it hit the bus */ + local_irq_save(flags); /* should not be delayed further */ + writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSTA); /* delay SDA */ readb(i2c->base + MPC_I2C_DR); - writeccr(i2c, CCR_MEN); - udelay(delay_val << 1); + if (k !=3D 1) + udelay(5); + local_irq_restore(flags); } + writeccr(i2c, CCR_MEN); /* Initiate STOP */ + readb(i2c->base + MPC_I2C_DR); + udelay(15); /* Let STOP propagate */ + writeccr(i2c, 0); } =20 static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing) --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6E8B3C433EF for ; Mon, 24 Jan 2022 19:08:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345021AbiAXTIW (ORCPT ); Mon, 24 Jan 2022 14:08:22 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:60716 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343864AbiAXTCF (ORCPT ); Mon, 24 Jan 2022 14:02:05 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0F54460BB9; Mon, 24 Jan 2022 19:02:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E3403C340E7; Mon, 24 Jan 2022 19:01:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050920; bh=sySPTNdEhcF7C94lJKAfucfeS/5lj3Mr/SaXWyQkuJs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0mB09bF4S/+NacBEQ+XKx6hMBxY7OvPvqpKk72c6TGCz/PPVCuMGLYknOAusNxXFH /79cK51VQCNsfs/4EDEdKdBvstbF3gdSYX5tQtP/NbRo9EwIAR5EJTODTKo7SnWIl1 qAIRrIFIWMqnmg47rrRDYjl5YaeSTgiAZdADuFh8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Christophe Leroy , Sasha Levin Subject: [PATCH 4.9 112/157] w1: Misuse of get_user()/put_user() reported by sparse Date: Mon, 24 Jan 2022 19:43:22 +0100 Message-Id: <20220124183936.326986368@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe Leroy [ Upstream commit 33dc3e3e99e626ce51f462d883b05856c6c30b1d ] sparse warnings: (new ones prefixed by >>) >> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in= initializer (different address spaces) @@ expected char [noderef] __us= er *_pu_addr @@ got char *buf @@ drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [nodere= f] __user *_pu_addr drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf >> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in= initializer (different address spaces) @@ expected char const [noderef= ] __user *_gu_addr @@ got char const *buf @@ drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [= noderef] __user *_gu_addr drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf The buffer buf is a failsafe buffer in kernel space, it's not user memory hence doesn't deserve the use of get_user() or put_user(). Access 'buf' content directly. Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/ Reported-by: kernel test robot Signed-off-by: Christophe Leroy Link: https://lore.kernel.org/r/d14ed8d71ad4372e6839ae427f91441d3ba0e94d.16= 37946316.git.christophe.leroy@csgroup.eu Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/w1/slaves/w1_ds28e04.c | 26 ++++++-------------------- 1 file changed, 6 insertions(+), 20 deletions(-) diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c index 5e348d38ec5c9..f4cf54c256fd8 100644 --- a/drivers/w1/slaves/w1_ds28e04.c +++ b/drivers/w1/slaves/w1_ds28e04.c @@ -39,7 +39,7 @@ static int w1_strong_pullup =3D 1; module_param_named(strong_pullup, w1_strong_pullup, int, 0); =20 /* enable/disable CRC checking on DS28E04-100 memory accesses */ -static char w1_enable_crccheck =3D 1; +static bool w1_enable_crccheck =3D true; =20 #define W1_EEPROM_SIZE 512 #define W1_PAGE_COUNT 16 @@ -346,32 +346,18 @@ static BIN_ATTR_RW(pio, 1); static ssize_t crccheck_show(struct device *dev, struct device_attribute *= attr, char *buf) { - if (put_user(w1_enable_crccheck + 0x30, buf)) - return -EFAULT; - - return sizeof(w1_enable_crccheck); + return sysfs_emit(buf, "%d\n", w1_enable_crccheck); } =20 static ssize_t crccheck_store(struct device *dev, struct device_attribute = *attr, const char *buf, size_t count) { - char val; - - if (count !=3D 1 || !buf) - return -EINVAL; + int err =3D kstrtobool(buf, &w1_enable_crccheck); =20 - if (get_user(val, buf)) - return -EFAULT; + if (err) + return err; =20 - /* convert to decimal */ - val =3D val - 0x30; - if (val !=3D 0 && val !=3D 1) - return -EINVAL; - - /* set the new value */ - w1_enable_crccheck =3D val; - - return sizeof(w1_enable_crccheck); + return count; } =20 static DEVICE_ATTR_RW(crccheck); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47C13C433F5 for ; Mon, 24 Jan 2022 19:17:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344901AbiAXTR5 (ORCPT ); Mon, 24 Jan 2022 14:17:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46108 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346225AbiAXTFN (ORCPT ); Mon, 24 Jan 2022 14:05:13 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4FC14C0613E4; Mon, 24 Jan 2022 11:00:16 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EA2B9B8122C; Mon, 24 Jan 2022 19:00:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0DBC8C340E5; Mon, 24 Jan 2022 19:00:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050813; bh=1j7mayRmOuGQ+nRLdXsL59wVA+c5vHDalgnqM39ocY4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jKANspLH371SZXx7seO4q4AbvOaqoeDpxtiBzWuxbClsW5DyYF1P8id/r50S/vvaC uCY6/30J7H9hEcxw827vzUkuZkHau6OpbaRbH6mqoYXF91MpWfXVwyKJ5Z6q48TNWl nIiZOwxb6Cs6clPY0F1hgguj4tFl/IlM+OO7CQpk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zqiang , syzbot+bb950e68b400ab4f65f8@syzkaller.appspotmail.com, Takashi Iwai , Sasha Levin Subject: [PATCH 4.9 113/157] ALSA: seq: Set upper limit of processed events Date: Mon, 24 Jan 2022 19:43:23 +0100 Message-Id: <20220124183936.354960884@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 6fadb494a638d8b8a55864ecc6ac58194f03f327 ] Currently ALSA sequencer core tries to process the queued events as much as possible when they become dispatchable. If applications try to queue too massive events to be processed at the very same timing, the sequencer core would still try to process such all events, either in the interrupt context or via some notifier; in either away, it might be a cause of RCU stall or such problems. As a potential workaround for those problems, this patch adds the upper limit of the amount of events to be processed. The remaining events are processed in the next batch, so they won't be lost. For the time being, it's limited up to 1000 events per queue, which should be high enough for any normal usages. Reported-by: Zqiang Reported-by: syzbot+bb950e68b400ab4f65f8@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20211102033222.3849-1-qiang.zhang1211@gmail= .com Link: https://lore.kernel.org/r/20211207165146.2888-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- sound/core/seq/seq_queue.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c index ea1aa07962761..b923059a22276 100644 --- a/sound/core/seq/seq_queue.c +++ b/sound/core/seq/seq_queue.c @@ -257,12 +257,15 @@ struct snd_seq_queue *snd_seq_queue_find_name(char *n= ame) =20 /* -------------------------------------------------------- */ =20 +#define MAX_CELL_PROCESSES_IN_QUEUE 1000 + void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) { unsigned long flags; struct snd_seq_event_cell *cell; snd_seq_tick_time_t cur_tick; snd_seq_real_time_t cur_time; + int processed =3D 0; =20 if (q =3D=3D NULL) return; @@ -285,6 +288,8 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int a= tomic, int hop) if (!cell) break; snd_seq_dispatch_event(cell, atomic, hop); + if (++processed >=3D MAX_CELL_PROCESSES_IN_QUEUE) + goto out; /* the rest processed at the next batch */ } =20 /* Process time queue... */ @@ -294,14 +299,19 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int= atomic, int hop) if (!cell) break; snd_seq_dispatch_event(cell, atomic, hop); + if (++processed >=3D MAX_CELL_PROCESSES_IN_QUEUE) + goto out; /* the rest processed at the next batch */ } =20 + out: /* free lock */ spin_lock_irqsave(&q->check_lock, flags); if (q->check_again) { q->check_again =3D 0; - spin_unlock_irqrestore(&q->check_lock, flags); - goto __again; + if (processed < MAX_CELL_PROCESSES_IN_QUEUE) { + spin_unlock_irqrestore(&q->check_lock, flags); + goto __again; + } } q->check_blocked =3D 0; spin_unlock_irqrestore(&q->check_lock, flags); --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D89C8C433F5 for ; Mon, 24 Jan 2022 19:06:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242186AbiAXTGq (ORCPT ); Mon, 24 Jan 2022 14:06:46 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:56912 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345661AbiAXTAt (ORCPT ); Mon, 24 Jan 2022 14:00:49 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0224560010; Mon, 24 Jan 2022 19:00:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BB116C340E5; Mon, 24 Jan 2022 19:00:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050848; bh=bpMBu5yH7MGhV8vmY6xchErCuexz35VkhDge5dgYqqc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kJ866/vpa0FkVCchhimFZmQQkjcD8EGMF9zdtkzs49/clyGnSgPy46/E3+2514fgV G18C2noDF3pZ4JIbjZ4faxNcD2E6fJg1vhYd+01lzNTqjkLmxFslprdTAA7udrjoeL W6YvmIICGSK8RCgmoUc53xkLQpjdD3X7bf5atTIY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wolfram Sang , Lakshmi Sowjanya D , Andy Shevchenko , Jarkko Nikula , Sasha Levin Subject: [PATCH 4.9 114/157] i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters Date: Mon, 24 Jan 2022 19:43:24 +0100 Message-Id: <20220124183936.391505465@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lakshmi Sowjanya D [ Upstream commit d52097010078c1844348dc0e467305e5f90fd317 ] The data type of hcnt and lcnt in the struct dw_i2c_dev is of type u16. It's better to have same data type in struct dw_scl_sda_cfg as well. Reported-by: Wolfram Sang Signed-off-by: Lakshmi Sowjanya D Signed-off-by: Andy Shevchenko Signed-off-by: Jarkko Nikula Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/i2c/busses/i2c-designware-pcidrv.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busse= s/i2c-designware-pcidrv.c index 96f8230cd2d33..5c32a7ef476da 100644 --- a/drivers/i2c/busses/i2c-designware-pcidrv.c +++ b/drivers/i2c/busses/i2c-designware-pcidrv.c @@ -49,10 +49,10 @@ enum dw_pci_ctl_id_t { }; =20 struct dw_scl_sda_cfg { - u32 ss_hcnt; - u32 fs_hcnt; - u32 ss_lcnt; - u32 fs_lcnt; + u16 ss_hcnt; + u16 fs_hcnt; + u16 ss_lcnt; + u16 fs_lcnt; u32 sda_hold; }; =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66562C4167B for ; Mon, 24 Jan 2022 19:15:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348226AbiAXTPE (ORCPT ); Mon, 24 Jan 2022 14:15:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45848 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237315AbiAXTGS (ORCPT ); Mon, 24 Jan 2022 14:06:18 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DC49AC061794; Mon, 24 Jan 2022 11:01:23 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7CB9560BB7; Mon, 24 Jan 2022 19:01:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 75DBAC340E5; Mon, 24 Jan 2022 19:01:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050882; bh=Qf6XnIzeElSZlaTPE0+w9iFReX52uTDmquC2axMPOMY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uherd27hb+yB2e/005qIB2XgwTj+NH5xUNY69YCzq6s7oefdU2Qvf51m5YITh0qx5 jS2AE0ftcnvU/TbO0o0zxS/h9VQKqNr0ZRJBy0FZ84eZyY7X8lIBjnKYb0ydhiJR7W 0Riwxe/gjnXOdUOiJRysB1aBb/p6qtaGMpPIm8QY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tianjia Zhang , Nathan Chancellor , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.9 115/157] MIPS: Octeon: Fix build errors using clang Date: Mon, 24 Jan 2022 19:43:25 +0100 Message-Id: <20220124183936.423191959@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tianjia Zhang [ Upstream commit 95339b70677dc6f9a2d669c4716058e71b8dc1c7 ] A large number of the following errors is reported when compiling with clang: cvmx-bootinfo.h:326:3: error: adding 'int' to a string does not append to= the string [-Werror,-Wstring-plus-int] ENUM_BRD_TYPE_CASE(CVMX_BOARD_TYPE_NULL) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cvmx-bootinfo.h:321:20: note: expanded from macro 'ENUM_BRD_TYPE_CASE' case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ ~~~^~~~ cvmx-bootinfo.h:326:3: note: use array indexing to silence this warning cvmx-bootinfo.h:321:20: note: expanded from macro 'ENUM_BRD_TYPE_CASE' case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ ^ Follow the prompts to use the address operator '&' to fix this error. Signed-off-by: Tianjia Zhang Reviewed-by: Nathan Chancellor Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/mips/include/asm/octeon/cvmx-bootinfo.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/mips/include/asm/octeon/cvmx-bootinfo.h b/arch/mips/inclu= de/asm/octeon/cvmx-bootinfo.h index 62787765575ef..ce6e5fddce0bf 100644 --- a/arch/mips/include/asm/octeon/cvmx-bootinfo.h +++ b/arch/mips/include/asm/octeon/cvmx-bootinfo.h @@ -315,7 +315,7 @@ enum cvmx_chip_types_enum { =20 /* Functions to return string based on type */ #define ENUM_BRD_TYPE_CASE(x) \ - case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ + case x: return (&#x[16]); /* Skip CVMX_BOARD_TYPE_ */ static inline const char *cvmx_board_type_to_string(enum cvmx_board_types_enum type) { @@ -404,7 +404,7 @@ static inline const char *cvmx_board_type_to_string(enum } =20 #define ENUM_CHIP_TYPE_CASE(x) \ - case x: return(#x + 15); /* Skip CVMX_CHIP_TYPE */ + case x: return (&#x[15]); /* Skip CVMX_CHIP_TYPE */ static inline const char *cvmx_chip_type_to_string(enum cvmx_chip_types_enum type) { --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D16FBC433F5 for ; Mon, 24 Jan 2022 19:08:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242524AbiAXTIB (ORCPT ); Mon, 24 Jan 2022 14:08:01 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57470 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344597AbiAXTBn (ORCPT ); Mon, 24 Jan 2022 14:01:43 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 07F33B8123D; Mon, 24 Jan 2022 19:01:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3907BC340E5; Mon, 24 Jan 2022 19:01:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050900; bh=GmG+/voixByuzyHwsMFBsuj2PX+ZSiBIZM0+gB8/Sjg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eqiRpQTAu0D67xHnugDBo0GEuNdZMYaEsqwqxT6WeEC641xHrn6+FtbSov/Cb+hPd YSo+9sZCDcHm3/ufBp04Hj1zYSfWalCkDFxIUcyQ/WShFKr21b/NI6GfoGJJ/Epzrg ZNnhcJzetHzdqQ7ypN7vPT+OFLHbSPeENO/VDFsI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Baoquan He , Christoph Hellwig , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.9 116/157] scsi: sr: Dont use GFP_DMA Date: Mon, 24 Jan 2022 19:43:26 +0100 Message-Id: <20220124183936.462228849@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christoph Hellwig [ Upstream commit d94d94969a4ba07a43d62429c60372320519c391 ] The allocated buffers are used as a command payload, for which the block layer and/or DMA API do the proper bounce buffering if needed. Link: https://lore.kernel.org/r/20211222090842.920724-1-hch@lst.de Reported-by: Baoquan He Reviewed-by: Baoquan He Signed-off-by: Christoph Hellwig Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/scsi/sr.c | 2 +- drivers/scsi/sr_vendor.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c index 9b63e46edffcc..a2a4c6e22c68d 100644 --- a/drivers/scsi/sr.c +++ b/drivers/scsi/sr.c @@ -882,7 +882,7 @@ static void get_capabilities(struct scsi_cd *cd) =20 =20 /* allocate transfer buffer */ - buffer =3D kmalloc(512, GFP_KERNEL | GFP_DMA); + buffer =3D kmalloc(512, GFP_KERNEL); if (!buffer) { sr_printk(KERN_ERR, cd, "out of memory.\n"); return; diff --git a/drivers/scsi/sr_vendor.c b/drivers/scsi/sr_vendor.c index 11a238cb22223..629bfe1b20263 100644 --- a/drivers/scsi/sr_vendor.c +++ b/drivers/scsi/sr_vendor.c @@ -118,7 +118,7 @@ int sr_set_blocklength(Scsi_CD *cd, int blocklength) density =3D (blocklength > 2048) ? 0x81 : 0x83; #endif =20 - buffer =3D kmalloc(512, GFP_KERNEL | GFP_DMA); + buffer =3D kmalloc(512, GFP_KERNEL); if (!buffer) return -ENOMEM; =20 @@ -166,7 +166,7 @@ int sr_cd_check(struct cdrom_device_info *cdi) if (cd->cdi.mask & CDC_MULTI_SESSION) return 0; =20 - buffer =3D kmalloc(512, GFP_KERNEL | GFP_DMA); + buffer =3D kmalloc(512, GFP_KERNEL); if (!buffer) return -ENOMEM; =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 730E7C4707F for ; Mon, 24 Jan 2022 19:15:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344733AbiAXTPf (ORCPT ); Mon, 24 Jan 2022 14:15:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46132 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346735AbiAXTHV (ORCPT ); Mon, 24 Jan 2022 14:07:21 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DFBAAC061244; Mon, 24 Jan 2022 11:01:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7E1D16090C; Mon, 24 Jan 2022 19:01:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43CC1C340E5; Mon, 24 Jan 2022 19:01:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050903; bh=/hdemuENqnf/jOGaiRcSiGH0J0G5zPzuLXuG/sxnf9g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=shArt8N7ASkwTUDC98shOBvd45PoSQeTumiVNM5DROLe7XkCT57UWeSG82VxnvUoj q5TH6MoVDltljyVSyjqfGo3z0pOLHyxZnametZ82+MaH+cc3HU+sBbudl+8NBaU5UM mvuoB3Dz3I6DsuS5g3Nrwj3rH/m5g8PHjdmNjUd0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tzung-Bi Shih , Mark Brown , Sasha Levin Subject: [PATCH 4.9 117/157] ASoC: mediatek: mt8173: fix device_node leak Date: Mon, 24 Jan 2022 19:43:27 +0100 Message-Id: <20220124183936.493606975@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tzung-Bi Shih [ Upstream commit 493433785df0075afc0c106ab65f10a605d0b35d ] Fixes the device_node leak. Signed-off-by: Tzung-Bi Shih Link: https://lore.kernel.org/r/20211224064719.2031210-2-tzungbi@google.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- sound/soc/mediatek/mt8173/mt8173-max98090.c | 3 +++ sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c | 2 ++ sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 2 ++ sound/soc/mediatek/mt8173/mt8173-rt5650.c | 2 ++ 4 files changed, 9 insertions(+) diff --git a/sound/soc/mediatek/mt8173/mt8173-max98090.c b/sound/soc/mediat= ek/mt8173/mt8173-max98090.c index 5524a2c727ec7..cab30cb48366d 100644 --- a/sound/soc/mediatek/mt8173/mt8173-max98090.c +++ b/sound/soc/mediatek/mt8173/mt8173-max98090.c @@ -183,6 +183,9 @@ static int mt8173_max98090_dev_probe(struct platform_de= vice *pdev) if (ret) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); + + of_node_put(codec_node); + of_node_put(platform_node); return ret; } =20 diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c b/sound/soc/m= ediatek/mt8173/mt8173-rt5650-rt5514.c index 467f7049a2886..52fdd766ee82c 100644 --- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c +++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c @@ -228,6 +228,8 @@ static int mt8173_rt5650_rt5514_dev_probe(struct platfo= rm_device *pdev) if (ret) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); + + of_node_put(platform_node); return ret; } =20 diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/m= ediatek/mt8173/mt8173-rt5650-rt5676.c index 1b8b2a7788450..5d75b04f074fe 100644 --- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c @@ -285,6 +285,8 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platfo= rm_device *pdev) if (ret) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); + + of_node_put(platform_node); return ret; } =20 diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek= /mt8173/mt8173-rt5650.c index ba65f4157a7e0..d02a90201b13b 100644 --- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c +++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c @@ -317,6 +317,8 @@ static int mt8173_rt5650_dev_probe(struct platform_devi= ce *pdev) if (ret) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); + + of_node_put(platform_node); return ret; } =20 --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A36BCC433F5 for ; Mon, 24 Jan 2022 19:07:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234902AbiAXTHz (ORCPT ); Mon, 24 Jan 2022 14:07:55 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:60472 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344657AbiAXTBt (ORCPT ); Mon, 24 Jan 2022 14:01:49 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 07CED60B86; Mon, 24 Jan 2022 19:01:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BEEBDC340E5; Mon, 24 Jan 2022 19:01:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050908; bh=76HVBb0t5v3c1y4QZ4tIBcCqirxUjeVEVr/1bZHAtoI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wI3WAnSupWwhKIgq9KjADJsPpCe+rm/9qQf7RoqQlwFn96/ngoaC7LonTivoB+TBS IgP6Fyf2XsZjI6+JzyqiNmjq8kQHh7XskRXSZQBv5RnNKnm2JEJzemJz6dVh6yHnfJ OW/SXcQxqHJYYbFaH92n6El4WvF+vPmfwPkKK6R8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yauhen Kharuzhy , Hans de Goede , Sebastian Reichel , Sasha Levin Subject: [PATCH 4.9 118/157] power: bq25890: Enable continuous conversion for ADC at charging Date: Mon, 24 Jan 2022 19:43:28 +0100 Message-Id: <20220124183936.522999069@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yauhen Kharuzhy [ Upstream commit 80211be1b9dec04cc2805d3d81e2091ecac289a1 ] Instead of one shot run of ADC at beginning of charging, run continuous conversion to ensure that all charging-related values are monitored properly (input voltage, input current, themperature etc.). Signed-off-by: Yauhen Kharuzhy Reviewed-by: Hans de Goede Signed-off-by: Sebastian Reichel Signed-off-by: Sasha Levin Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/power/supply/bq25890_charger.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/power/supply/bq25890_charger.c b/drivers/power/supply/= bq25890_charger.c index f993a55cde20f..faf2a62435674 100644 --- a/drivers/power/supply/bq25890_charger.c +++ b/drivers/power/supply/bq25890_charger.c @@ -521,12 +521,12 @@ static void bq25890_handle_state_change(struct bq2589= 0_device *bq, =20 if (!new_state->online) { /* power removed */ /* disable ADC */ - ret =3D bq25890_field_write(bq, F_CONV_START, 0); + ret =3D bq25890_field_write(bq, F_CONV_RATE, 0); if (ret < 0) goto error; } else if (!old_state.online) { /* power inserted */ /* enable ADC, to have control of charge current/voltage */ - ret =3D bq25890_field_write(bq, F_CONV_START, 1); + ret =3D bq25890_field_write(bq, F_CONV_RATE, 1); if (ret < 0) goto error; } --=20 2.34.1 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E13EAC43219 for ; Mon, 24 Jan 2022 19:18:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346895AbiAXTSO (ORCPT ); Mon, 24 Jan 2022 14:18:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46480 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346873AbiAXTIt (ORCPT ); Mon, 24 Jan 2022 14:08:49 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D5362C06118F; Mon, 24 Jan 2022 11:01:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 941ACB81215; Mon, 24 Jan 2022 19:01:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA645C340E5; Mon, 24 Jan 2022 19:01:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050911; bh=xlYj8+vdIvrzfMuQbGn3srN8dLG2vTqYB47vCUgP9Qo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d2Xk/Ejtqf+KG00nlV4ivS7fSja1uYMJtNJjRm/Ck7IiTiGW1rgMJ3uDtpZi+LFoX 7BBaVVzV3NAtj1ZOeZeKNeKu8j4WyZ8g6tDkid8ERZQbdhCeiNoA/BZoBCx2EIgKE3 b7/Q0aFY9VsEyQ17hvLeYJFkTgS8Bv/VZ0+KT3wE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Petr Cvachoucek , Richard Weinberger Subject: [PATCH 4.9 119/157] ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers Date: Mon, 24 Jan 2022 19:43:29 +0100 Message-Id: <20220124183936.552565731@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Petr Cvachoucek commit 3fea4d9d160186617ff40490ae01f4f4f36b28ff upstream. it seems freeing the write buffers in the error path of the ubifs_remount_rw() is wrong. It leads later to a kernel oops like this: [10016.431274] UBIFS (ubi0:0): start fixing up free space [10090.810042] UBIFS (ubi0:0): free space fixup complete [10090.814623] UBIFS error (ubi0:0 pid 512): ubifs_remount_fs: cannot spawn "ubifs_bgt0_0", error -4 [10101.915108] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, PID 517 [10105.275498] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030 [10105.284352] Mem abort info: [10105.287160] ESR =3D 0x96000006 [10105.290252] EC =3D 0x25: DABT (current EL), IL =3D 32 bits [10105.295592] SET =3D 0, FnV =3D 0 [10105.298652] EA =3D 0, S1PTW =3D 0 [10105.301848] Data abort info: [10105.304723] ISV =3D 0, ISS =3D 0x00000006 [10105.308573] CM =3D 0, WnR =3D 0 [10105.311564] user pgtable: 4k pages, 48-bit VAs, pgdp=3D00000000f03d1000 [10105.318034] [0000000000000030] pgd=3D00000000f6cee003, pud=3D00000000f4884003, pmd=3D0000000000000000 [10105.326783] Internal error: Oops: 96000006 [#1] PREEMPT SMP [10105.332355] Modules linked in: ath10k_pci ath10k_core ath mac80211 libarc4 cfg80211 nvme nvme_core cryptodev(O) [10105.342468] CPU: 3 PID: 518 Comm: touch Tainted: G O 5.4.3 #1 [10105.349517] Hardware name: HYPEX CPU (DT) [10105.353525] pstate: 40000005 (nZcv daif -PAN -UAO) [10105.358324] pc : atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34 [10105.364596] lr : mutex_lock+0x1c/0x34 [10105.368253] sp : ffff000075633aa0 [10105.371563] x29: ffff000075633aa0 x28: 0000000000000001 [10105.376874] x27: ffff000076fa80c8 x26: 0000000000000004 [10105.382185] x25: 0000000000000030 x24: 0000000000000000 [10105.387495] x23: 0000000000000000 x22: 0000000000000038 [10105.392807] x21: 000000000000000c x20: ffff000076fa80c8 [10105.398119] x19: ffff000076fa8000 x18: 0000000000000000 [10105.403429] x17: 0000000000000000 x16: 0000000000000000 [10105.408741] x15: 0000000000000000 x14: fefefefefefefeff [10105.414052] x13: 0000000000000000 x12: 0000000000000fe0 [10105.419364] x11: 0000000000000fe0 x10: ffff000076709020 [10105.424675] x9 : 0000000000000000 x8 : 00000000000000a0 [10105.429986] x7 : ffff000076fa80f4 x6 : 0000000000000030 [10105.435297] x5 : 0000000000000000 x4 : 0000000000000000 [10105.440609] x3 : 0000000000000000 x2 : ffff00006f276040 [10105.445920] x1 : ffff000075633ab8 x0 : 0000000000000030 [10105.451232] Call trace: [10105.453676] atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34 [10105.459600] ubifs_garbage_collect+0xb4/0x334 [10105.463956] ubifs_budget_space+0x398/0x458 [10105.468139] ubifs_create+0x50/0x180 [10105.471712] path_openat+0x6a0/0x9b0 [10105.475284] do_filp_open+0x34/0x7c [10105.478771] do_sys_open+0x78/0xe4 [10105.482170] __arm64_sys_openat+0x1c/0x24 [10105.486180] el0_svc_handler+0x84/0xc8 [10105.489928] el0_svc+0x8/0xc [10105.492808] Code: 52800013 17fffffb d2800003 f9800011 (c85ffc05) [10105.498903] ---[ end trace 46b721d93267a586 ]--- To reproduce the problem: 1. Filesystem initially mounted read-only, free space fixup flag set. 2. mount -o remount,rw 3. it takes some time (free space fixup running) ... try to terminate running mount by CTRL-C ... does not respond, only after free space fixup is complete ... then "ubifs_remount_fs: cannot spawn "ubifs_bgt0_0", error -4" 4. mount -o remount,rw ... now finished instantly (fixup already done). 5. Create file or just unmount the filesystem and we get the oops. Cc: Fixes: b50b9f408502 ("UBIFS: do not free write-buffers when in R/O mode") Signed-off-by: Petr Cvachoucek Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- fs/ubifs/super.c | 1 - 1 file changed, 1 deletion(-) --- a/fs/ubifs/super.c +++ b/fs/ubifs/super.c @@ -1695,7 +1695,6 @@ out: kthread_stop(c->bgt); c->bgt =3D NULL; } - free_wbufs(c); kfree(c->write_reserve_buf); c->write_reserve_buf =3D NULL; vfree(c->ileb_buf); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8649C433EF for ; Mon, 24 Jan 2022 19:08:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238294AbiAXTIF (ORCPT ); Mon, 24 Jan 2022 14:08:05 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:60634 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344711AbiAXTB4 (ORCPT ); Mon, 24 Jan 2022 14:01:56 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0BCD260918; Mon, 24 Jan 2022 19:01:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF714C340E5; Mon, 24 Jan 2022 19:01:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050914; bh=fPduRhDomwXOHZBVoIJNXQf0d40yj/fwjhlZgy8WlxQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=waP01q/7BUrsTkSsnR8Zd4EqY6HBcBRY9UyzWJWMZqlSSpHX7zWG0m93tZXx+Akh4 uiLKB7xK1vw1GG4AyfCE43xj/iqzdmDJGlRCskGYSG/zI/MJlWlsGmwVkkZf+m27Jk 40GEXcFNEdcEKlIC+zSvqSTuzGyjGKm68lZCm0Zg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ilan Peer , Luca Coelho Subject: [PATCH 4.9 120/157] iwlwifi: mvm: Increase the scan timeout guard to 30 seconds Date: Mon, 24 Jan 2022 19:43:30 +0100 Message-Id: <20220124183936.584785900@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ilan Peer commit ced50f1133af12f7521bb777fcf4046ca908fb77 upstream. With the introduction of 6GHz channels the scan guard timeout should be adjusted to account for the following extreme case: - All 6GHz channels are scanned passively: 58 channels. - The scan is fragmented with the following parameters: 3 fragments, 95 TUs suspend time, 44 TUs maximal out of channel time. The above would result with scan time of more than 24 seconds. Thus, set the timeout to 30 seconds. Cc: stable@vger.kernel.org Signed-off-by: Ilan Peer Signed-off-by: Luca Coelho Link: https://lore.kernel.org/r/iwlwifi.20211210090244.3c851b93aef5.I346fa2= e1d79220a6770496e773c6f87a2ad9e6c4@changeid Signed-off-by: Luca Coelho Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c @@ -1260,7 +1260,7 @@ static int iwl_mvm_check_running_scans(s return -EIO; } =20 -#define SCAN_TIMEOUT 20000 +#define SCAN_TIMEOUT 30000 =20 void iwl_mvm_scan_timeout_wk(struct work_struct *work) { From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 269B4C433FE for ; Mon, 24 Jan 2022 19:08:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346787AbiAXTIP (ORCPT ); Mon, 24 Jan 2022 14:08:15 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:58958 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344722AbiAXTCB (ORCPT ); Mon, 24 Jan 2022 14:02:01 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BE2E8B8123F; Mon, 24 Jan 2022 19:01:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E0E5DC340E5; Mon, 24 Jan 2022 19:01:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050917; bh=HiMokRcWVrkWobPHLR9Q0PWQ6ThwoWIl6UQONrxaaJM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Idna65wm5caU5zLWG2RQ4s1u1fQci000oWjIEWhFHFOpwbUL1rQ3E2chFr/kNQtFM pHpKSVerWno8JUpMfM1tsmIxE1eYNEaAAaDy29RTFMYRBehzRqL4nauWxPOIz7uPE1 +UDSIhZaFu3YbgVFbDdnz/5IF1MHHkjZeYV490zk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Lucas Stach , Christian Gmeiner Subject: [PATCH 4.9 121/157] drm/etnaviv: limit submit sizes Date: Mon, 24 Jan 2022 19:43:31 +0100 Message-Id: <20220124183936.614611281@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lucas Stach commit 6dfa2fab8ddd46faa771a102672176bee7a065de upstream. Currently we allow rediculous amounts of kernel memory being allocated via the etnaviv GEM_SUBMIT ioctl, which is a pretty easy DoS vector. Put some reasonable limits in to fix this. The commandstream size is limited to 64KB, which was already a soft limit on older kernels after which the kernel only took submits on a best effort base, so there is no userspace that tries to submit commandstreams larger than this. Even if the whole commandstream is a single incrementing address load, the size limit also limits the number of potential relocs and referenced buffers to slightly under 64K, so use the same limit for those arguments. The performance monitoring infrastructure currently supports less than 50 performance counter signals, so limiting them to 128 on a single submit seems like a reasonably future-proof number for now. This number can be bumped if needed without breaking the interface. Cc: stable@vger.kernel.org Reported-by: Dan Carpenter Signed-off-by: Lucas Stach Reviewed-by: Christian Gmeiner Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c @@ -325,6 +325,12 @@ int etnaviv_ioctl_gem_submit(struct drm_ return -EINVAL; } =20 + if (args->stream_size > SZ_64K || args->nr_relocs > SZ_64K || + args->nr_bos > SZ_64K || args->nr_pmrs > 128) { + DRM_ERROR("submit arguments out of size limits\n"); + return -EINVAL; + } + /* * Copy the command submission and bo array to kernel space in * one go, and do this outside of any locks. From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8E8BC433F5 for ; Mon, 24 Jan 2022 19:06:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237429AbiAXTGL (ORCPT ); Mon, 24 Jan 2022 14:06:11 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57470 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345446AbiAXTAT (ORCPT ); Mon, 24 Jan 2022 14:00:19 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0874EB8122F; Mon, 24 Jan 2022 19:00:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50F94C340E5; Mon, 24 Jan 2022 19:00:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050816; bh=VCURiyomUVIPoWf9AU+8FLL/6YFSGAUikU9Mn+zQSdE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KA85OKoDneVlezWGaFdaZdvHlDLDOHCqXcDnUvgUFIC6eFrIMe01eZMgfDVjaW6jJ gdN3EzUYMDj4OIyvx3gmBMW4ht5+Vt4m8SVqM8XQENMHeVpAtQcG69qIZBjHyQStxS mdjV2iy/k51J1Eo4SllcW8ABhih7RGn1tih6HsOM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jeroen van Wolffelaar , =?UTF-8?q?Lu=C3=ADs=20Henriques?= , Theodore Tso , stable@kernel.org Subject: [PATCH 4.9 122/157] ext4: set csum seed in tmp inode while migrating to extents Date: Mon, 24 Jan 2022 19:43:32 +0100 Message-Id: <20220124183936.643926225@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Lu=C3=ADs Henriques commit e81c9302a6c3c008f5c30beb73b38adb0170ff2d upstream. When migrating to extents, the temporary inode will have it's own checksum seed. This means that, when swapping the inodes data, the inode checksums will be incorrect. This can be fixed by recalculating the extents checksums again. Or simply by copying the seed into the temporary inode. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D213357 Reported-by: Jeroen van Wolffelaar Signed-off-by: Lu=C3=ADs Henriques Link: https://lore.kernel.org/r/20211214175058.19511-1-lhenriques@suse.de Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- fs/ext4/migrate.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/fs/ext4/migrate.c +++ b/fs/ext4/migrate.c @@ -484,6 +484,17 @@ int ext4_ext_migrate(struct inode *inode ext4_journal_stop(handle); goto out_unlock; } + /* + * Use the correct seed for checksum (i.e. the seed from 'inode'). This + * is so that the metadata blocks will have the correct checksum after + * the migration. + * + * Note however that, if a crash occurs during the migration process, + * the recovery process is broken because the tmp_inode checksums will + * be wrong and the orphans cleanup will fail. + */ + ei =3D EXT4_I(inode); + EXT4_I(tmp_inode)->i_csum_seed =3D ei->i_csum_seed; i_size_write(tmp_inode, i_size_read(inode)); /* * Set the i_nlink to zero so it will be deleted later @@ -527,7 +538,6 @@ int ext4_ext_migrate(struct inode *inode goto out_tmp_inode; } =20 - ei =3D EXT4_I(inode); i_data =3D ei->i_data; memset(&lb, 0, sizeof(lb)); =20 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 106D8C4167D for ; Mon, 24 Jan 2022 19:06:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346410AbiAXTFb (ORCPT ); Mon, 24 Jan 2022 14:05:31 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57490 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345493AbiAXTAW (ORCPT ); Mon, 24 Jan 2022 14:00:22 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 32722B8121F; Mon, 24 Jan 2022 19:00:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D2D5C340EA; Mon, 24 Jan 2022 19:00:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050820; bh=Z845udqUw2rjUiaPdUgkj+7y6/B6zzKwPohCDuK4TyE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iGsG7OmRp3gvFtjJpUUOOQqyALY0JbkJWcFrPvQTwT2myob/RIOnqtZ5suV30y0IX BuX/gaxcnASuDnDFKex4x4pQ1la6/HcyTb9DNkdrKWjthJwUEKZ3OofvXeegLUhm+v gugSkbxrX7Emxsks9G7df5aoZG1wb57O7yRrQ4fY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ye Bin , Jan Kara , Theodore Tso , stable@kernel.org Subject: [PATCH 4.9 123/157] ext4: Fix BUG_ON in ext4_bread when write quota data Date: Mon, 24 Jan 2022 19:43:33 +0100 Message-Id: <20220124183936.676801278@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Bin commit 380a0091cab482489e9b19e07f2a166ad2b76d5c upstream. We got issue as follows when run syzkaller: [ 167.936972] EXT4-fs error (device loop0): __ext4_remount:6314: comm rep:= Abort forced by user [ 167.938306] EXT4-fs (loop0): Remounting filesystem read-only [ 167.981637] Assertion failure in ext4_getblk() at fs/ext4/inode.c:847: '= (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) || handle !=3D NULL = || create =3D=3D 0' [ 167.983601] ------------[ cut here ]------------ [ 167.984245] kernel BUG at fs/ext4/inode.c:847! [ 167.984882] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI [ 167.985624] CPU: 7 PID: 2290 Comm: rep Tainted: G B 5.16.= 0-rc5-next-20211217+ #123 [ 167.986823] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS = ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ 167.988590] RIP: 0010:ext4_getblk+0x17e/0x504 [ 167.989189] Code: c6 01 74 28 49 c7 c0 a0 a3 5c 9b b9 4f 03 00 00 48 c7 = c2 80 9c 5c 9b 48 c7 c6 40 b6 5c 9b 48 c7 c7 20 a4 5c 9b e8 77 e3 fd ff <0f= > 0b 8b 04 244 [ 167.991679] RSP: 0018:ffff8881736f7398 EFLAGS: 00010282 [ 167.992385] RAX: 0000000000000094 RBX: 1ffff1102e6dee75 RCX: 00000000000= 00000 [ 167.993337] RDX: 0000000000000001 RSI: ffffffff9b6e29e0 RDI: ffffed102e6= dee66 [ 167.994292] RBP: ffff88816a076210 R08: 0000000000000094 R09: ffffed10736= 3fa09 [ 167.995252] R10: ffff88839b1fd047 R11: ffffed107363fa08 R12: ffff88816a0= 761e8 [ 167.996205] R13: 0000000000000000 R14: 0000000000000021 R15: 00000000000= 00001 [ 167.997158] FS: 00007f6a1428c740(0000) GS:ffff88839b000000(0000) knlGS:= 0000000000000000 [ 167.998238] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 167.999025] CR2: 00007f6a140716c8 CR3: 0000000133216000 CR4: 00000000000= 006e0 [ 167.999987] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000= 00000 [ 168.000944] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000= 00400 [ 168.001899] Call Trace: [ 168.002235] [ 168.007167] ext4_bread+0xd/0x53 [ 168.007612] ext4_quota_write+0x20c/0x5c0 [ 168.010457] write_blk+0x100/0x220 [ 168.010944] remove_free_dqentry+0x1c6/0x440 [ 168.011525] free_dqentry.isra.0+0x565/0x830 [ 168.012133] remove_tree+0x318/0x6d0 [ 168.014744] remove_tree+0x1eb/0x6d0 [ 168.017346] remove_tree+0x1eb/0x6d0 [ 168.019969] remove_tree+0x1eb/0x6d0 [ 168.022128] qtree_release_dquot+0x291/0x340 [ 168.023297] v2_release_dquot+0xce/0x120 [ 168.023847] dquot_release+0x197/0x3e0 [ 168.024358] ext4_release_dquot+0x22a/0x2d0 [ 168.024932] dqput.part.0+0x1c9/0x900 [ 168.025430] __dquot_drop+0x120/0x190 [ 168.025942] ext4_clear_inode+0x86/0x220 [ 168.026472] ext4_evict_inode+0x9e8/0xa22 [ 168.028200] evict+0x29e/0x4f0 [ 168.028625] dispose_list+0x102/0x1f0 [ 168.029148] evict_inodes+0x2c1/0x3e0 [ 168.030188] generic_shutdown_super+0xa4/0x3b0 [ 168.030817] kill_block_super+0x95/0xd0 [ 168.031360] deactivate_locked_super+0x85/0xd0 [ 168.031977] cleanup_mnt+0x2bc/0x480 [ 168.033062] task_work_run+0xd1/0x170 [ 168.033565] do_exit+0xa4f/0x2b50 [ 168.037155] do_group_exit+0xef/0x2d0 [ 168.037666] __x64_sys_exit_group+0x3a/0x50 [ 168.038237] do_syscall_64+0x3b/0x90 [ 168.038751] entry_SYSCALL_64_after_hwframe+0x44/0xae In order to reproduce this problem, the following conditions need to be met: 1. Ext4 filesystem with no journal; 2. Filesystem image with incorrect quota data; 3. Abort filesystem forced by user; 4. umount filesystem; As in ext4_quota_write: ... if (EXT4_SB(sb)->s_journal && !handle) { ext4_msg(sb, KERN_WARNING, "Quota write (off=3D%llu, len= =3D%llu)" " cancelled because transaction is not started", (unsigned long long)off, (unsigned long long)len); return -EIO; } ... We only check handle if NULL when filesystem has journal. There is need check handle if NULL even when filesystem has no journal. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20211223015506.297766-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5602,7 +5602,7 @@ static ssize_t ext4_quota_write(struct s struct buffer_head *bh; handle_t *handle =3D journal_current_handle(); =20 - if (EXT4_SB(sb)->s_journal && !handle) { + if (!handle) { ext4_msg(sb, KERN_WARNING, "Quota write (off=3D%llu, len=3D%llu)" " cancelled because transaction is not started", (unsigned long long)off, (unsigned long long)len); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1FE27C433F5 for ; Mon, 24 Jan 2022 19:14:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344407AbiAXTOA (ORCPT ); Mon, 24 Jan 2022 14:14:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46590 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346233AbiAXTFN (ORCPT ); Mon, 24 Jan 2022 14:05:13 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 369ADC0613E9; Mon, 24 Jan 2022 11:00:24 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CA64360B86; Mon, 24 Jan 2022 19:00:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A6034C340E5; Mon, 24 Jan 2022 19:00:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050823; bh=WGNVpAlelXoXa7YIBX5GGnhU0Tj3kAZDb3k7l8hJze8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zrKAnwMhA+5cIEKFRFKnLWYLEo94uFaARbe1AnRt2feexqxeq3jLUOvl6i7CxnOgS AAGx4WIPXt5wgLnTFOa1XWvtN4es0v/jI2RGRARTZE0z1hcujB0u/HjKVvf67ZlGDP rhlN/4kiRrCwNudzoqBaCS7SGvKF8ff2WiDUuUTs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Theodore Tso , Lukas Czerner , stable@kernel.org Subject: [PATCH 4.9 124/157] ext4: dont use the orphan list when migrating an inode Date: Mon, 24 Jan 2022 19:43:34 +0100 Message-Id: <20220124183936.708241634@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Theodore Ts'o commit 6eeaf88fd586f05aaf1d48cb3a139d2a5c6eb055 upstream. We probably want to remove the indirect block to extents migration feature after a deprecation window, but until then, let's fix a potential data loss problem caused by the fact that we put the tmp_inode on the orphan list. In the unlikely case where we crash and do a journal recovery, the data blocks belonging to the inode being migrated are also represented in the tmp_inode on the orphan list --- and so its data blocks will get marked unallocated, and available for reuse. Instead, stop putting the tmp_inode on the oprhan list. So in the case where we crash while migrating the inode, we'll leak an inode, which is not a disaster. It will be easily fixed the next time we run fsck, and it's better than potentially having blocks getting claimed by two different files, and losing data as a result. Signed-off-by: Theodore Ts'o Reviewed-by: Lukas Czerner Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- fs/ext4/migrate.c | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) --- a/fs/ext4/migrate.c +++ b/fs/ext4/migrate.c @@ -462,12 +462,12 @@ int ext4_ext_migrate(struct inode *inode percpu_down_write(&sbi->s_writepages_rwsem); =20 /* - * Worst case we can touch the allocation bitmaps, a bgd - * block, and a block to link in the orphan list. We do need - * need to worry about credits for modifying the quota inode. + * Worst case we can touch the allocation bitmaps and a block + * group descriptor block. We do need need to worry about + * credits for modifying the quota inode. */ handle =3D ext4_journal_start(inode, EXT4_HT_MIGRATE, - 4 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); + 3 + EXT4_MAXQUOTAS_TRANS_BLOCKS(inode->i_sb)); =20 if (IS_ERR(handle)) { retval =3D PTR_ERR(handle); @@ -488,10 +488,6 @@ int ext4_ext_migrate(struct inode *inode * Use the correct seed for checksum (i.e. the seed from 'inode'). This * is so that the metadata blocks will have the correct checksum after * the migration. - * - * Note however that, if a crash occurs during the migration process, - * the recovery process is broken because the tmp_inode checksums will - * be wrong and the orphans cleanup will fail. */ ei =3D EXT4_I(inode); EXT4_I(tmp_inode)->i_csum_seed =3D ei->i_csum_seed; @@ -503,7 +499,6 @@ int ext4_ext_migrate(struct inode *inode clear_nlink(tmp_inode); =20 ext4_ext_tree_init(handle, tmp_inode); - ext4_orphan_add(handle, tmp_inode); ext4_journal_stop(handle); =20 /* @@ -528,12 +523,6 @@ int ext4_ext_migrate(struct inode *inode =20 handle =3D ext4_journal_start(inode, EXT4_HT_MIGRATE, 1); if (IS_ERR(handle)) { - /* - * It is impossible to update on-disk structures without - * a handle, so just rollback in-core changes and live other - * work to orphan_list_cleanup() - */ - ext4_orphan_del(NULL, tmp_inode); retval =3D PTR_ERR(handle); goto out_tmp_inode; } From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6DE66C4321E for ; Mon, 24 Jan 2022 19:06:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345537AbiAXTF7 (ORCPT ); Mon, 24 Jan 2022 14:05:59 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57520 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345559AbiAXTA3 (ORCPT ); Mon, 24 Jan 2022 14:00:29 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C2212B81235; Mon, 24 Jan 2022 19:00:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9B55C340E5; Mon, 24 Jan 2022 19:00:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050826; bh=+mVVBcmYiWFq57Eundfb2TBRXsBxz7QMderfc/I7INw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gHDUDjLPGuNfRngHIKJ7SbP98SdwFWYJSX0wr81N/DmVPYw0kBukQ8m0u6jNcyQxw emCxWA9Zx+xGT2OvMMuxho6Ta6rlPYD0jw8UtSWqWON5xbMCOE9GJsWtuZ11hG3dyI 1sH8lt8FRbWUFHrzS6p+niExjra7P6FyJdn2mhDs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+f427adf9324b92652ccc@syzkaller.appspotmail.com, Miklos Szeredi , Jan Kara , Ben Hutchings Subject: [PATCH 4.9 125/157] fuse: fix bad inode Date: Mon, 24 Jan 2022 19:43:35 +0100 Message-Id: <20220124183936.738513760@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miklos Szeredi commit 5d069dbe8aaf2a197142558b6fb2978189ba3454 upstream. Jan Kara's analysis of the syzbot report (edited): The reproducer opens a directory on FUSE filesystem, it then attaches dnotify mark to the open directory. After that a fuse_do_getattr() call finds that attributes returned by the server are inconsistent, and calls make_bad_inode() which, among other things does: inode->i_mode =3D S_IFREG; This then confuses dnotify which doesn't tear down its structures properly and eventually crashes. Avoid calling make_bad_inode() on a live inode: switch to a private flag on the fuse inode. Also add the test to ops which the bad_inode_ops would have caught. This bug goes back to the initial merge of fuse in 2.6.14... Reported-by: syzbot+f427adf9324b92652ccc@syzkaller.appspotmail.com Signed-off-by: Miklos Szeredi Tested-by: Jan Kara Cc: [bwh: Backported to 4.9: - Drop changes in fuse_dir_fsync(), fuse_readahead(), fuse_evict_inode() - In fuse_get_link(), return ERR_PTR(-EIO) for bad inodes - Convert some additional calls to is_bad_inode() - Adjust filename, context] Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- fs/fuse/acl.c | 6 ++++++ fs/fuse/dir.c | 40 +++++++++++++++++++++++++++++++++++----- fs/fuse/file.c | 27 ++++++++++++++++++--------- fs/fuse/fuse_i.h | 12 ++++++++++++ fs/fuse/inode.c | 2 +- fs/fuse/xattr.c | 9 +++++++++ 6 files changed, 81 insertions(+), 15 deletions(-) --- a/fs/fuse/acl.c +++ b/fs/fuse/acl.c @@ -19,6 +19,9 @@ struct posix_acl *fuse_get_acl(struct in void *value =3D NULL; struct posix_acl *acl; =20 + if (fuse_is_bad(inode)) + return ERR_PTR(-EIO); + if (!fc->posix_acl || fc->no_getxattr) return NULL; =20 @@ -53,6 +56,9 @@ int fuse_set_acl(struct inode *inode, st const char *name; int ret; =20 + if (fuse_is_bad(inode)) + return -EIO; + if (!fc->posix_acl || fc->no_setxattr) return -EOPNOTSUPP; =20 --- a/fs/fuse/dir.c +++ b/fs/fuse/dir.c @@ -187,7 +187,7 @@ static int fuse_dentry_revalidate(struct int ret; =20 inode =3D d_inode_rcu(entry); - if (inode && is_bad_inode(inode)) + if (inode && fuse_is_bad(inode)) goto invalid; else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) || (flags & LOOKUP_REVAL)) { @@ -364,6 +364,9 @@ static struct dentry *fuse_lookup(struct bool outarg_valid =3D true; bool locked; =20 + if (fuse_is_bad(dir)) + return ERR_PTR(-EIO); + locked =3D fuse_lock_inode(dir); err =3D fuse_lookup_name(dir->i_sb, get_node_id(dir), &entry->d_name, &outarg, &inode); @@ -504,6 +507,9 @@ static int fuse_atomic_open(struct inode struct fuse_conn *fc =3D get_fuse_conn(dir); struct dentry *res =3D NULL; =20 + if (fuse_is_bad(dir)) + return -EIO; + if (d_in_lookup(entry)) { res =3D fuse_lookup(dir, entry, 0); if (IS_ERR(res)) @@ -551,6 +557,9 @@ static int create_new_entry(struct fuse_ int err; struct fuse_forget_link *forget; =20 + if (fuse_is_bad(dir)) + return -EIO; + forget =3D fuse_alloc_forget(); if (!forget) return -ENOMEM; @@ -672,6 +681,9 @@ static int fuse_unlink(struct inode *dir struct fuse_conn *fc =3D get_fuse_conn(dir); FUSE_ARGS(args); =20 + if (fuse_is_bad(dir)) + return -EIO; + args.in.h.opcode =3D FUSE_UNLINK; args.in.h.nodeid =3D get_node_id(dir); args.in.numargs =3D 1; @@ -708,6 +720,9 @@ static int fuse_rmdir(struct inode *dir, struct fuse_conn *fc =3D get_fuse_conn(dir); FUSE_ARGS(args); =20 + if (fuse_is_bad(dir)) + return -EIO; + args.in.h.opcode =3D FUSE_RMDIR; args.in.h.nodeid =3D get_node_id(dir); args.in.numargs =3D 1; @@ -786,6 +801,9 @@ static int fuse_rename2(struct inode *ol struct fuse_conn *fc =3D get_fuse_conn(olddir); int err; =20 + if (fuse_is_bad(olddir)) + return -EIO; + if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE)) return -EINVAL; =20 @@ -921,7 +939,7 @@ static int fuse_do_getattr(struct inode if (!err) { if (fuse_invalid_attr(&outarg.attr) || (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { - make_bad_inode(inode); + fuse_make_bad(inode); err =3D -EIO; } else { fuse_change_attributes(inode, &outarg.attr, @@ -1114,6 +1132,9 @@ static int fuse_permission(struct inode bool refreshed =3D false; int err =3D 0; =20 + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(fc)) return -EACCES; =20 @@ -1251,7 +1272,7 @@ retry: dput(dentry); goto retry; } - if (is_bad_inode(inode)) { + if (fuse_is_bad(inode)) { dput(dentry); return -EIO; } @@ -1349,7 +1370,7 @@ static int fuse_readdir(struct file *fil u64 attr_version =3D 0; bool locked; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 req =3D fuse_get_req(fc, 1); @@ -1409,6 +1430,9 @@ static const char *fuse_get_link(struct if (!dentry) return ERR_PTR(-ECHILD); =20 + if (fuse_is_bad(inode)) + return ERR_PTR(-EIO); + link =3D kmalloc(PAGE_SIZE, GFP_KERNEL); if (!link) return ERR_PTR(-ENOMEM); @@ -1707,7 +1731,7 @@ int fuse_do_setattr(struct dentry *dentr =20 if (fuse_invalid_attr(&outarg.attr) || (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { - make_bad_inode(inode); + fuse_make_bad(inode); err =3D -EIO; goto error; } @@ -1763,6 +1787,9 @@ static int fuse_setattr(struct dentry *e struct file *file =3D (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL; int ret; =20 + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(get_fuse_conn(inode))) return -EACCES; =20 @@ -1821,6 +1848,9 @@ static int fuse_getattr(struct vfsmount struct inode *inode =3D d_inode(entry); struct fuse_conn *fc =3D get_fuse_conn(inode); =20 + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(fc)) return -EACCES; =20 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -206,6 +206,9 @@ int fuse_open_common(struct inode *inode fc->atomic_o_trunc && fc->writeback_cache; =20 + if (fuse_is_bad(inode)) + return -EIO; + err =3D generic_file_open(inode, file); if (err) return err; @@ -411,7 +414,7 @@ static int fuse_flush(struct file *file, struct fuse_flush_in inarg; int err; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 if (fc->no_flush) @@ -459,7 +462,7 @@ int fuse_fsync_common(struct file *file, struct fuse_fsync_in inarg; int err; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 inode_lock(inode); @@ -771,7 +774,7 @@ static int fuse_readpage(struct file *fi int err; =20 err =3D -EIO; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) goto out; =20 err =3D fuse_do_readpage(file, page); @@ -898,7 +901,7 @@ static int fuse_readpages(struct file *f int nr_alloc =3D min_t(unsigned, nr_pages, FUSE_MAX_PAGES_PER_REQ); =20 err =3D -EIO; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) goto out; =20 data.file =3D file; @@ -928,6 +931,9 @@ static ssize_t fuse_file_read_iter(struc struct inode *inode =3D iocb->ki_filp->f_mapping->host; struct fuse_conn *fc =3D get_fuse_conn(inode); =20 + if (fuse_is_bad(inode)) + return -EIO; + /* * In auto invalidate mode, always update attributes on read. * Otherwise, only update if we attempt to read past EOF (to ensure @@ -1123,7 +1129,7 @@ static ssize_t fuse_perform_write(struct int err =3D 0; ssize_t res =3D 0; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 if (inode->i_size < pos + iov_iter_count(ii)) @@ -1180,6 +1186,9 @@ static ssize_t fuse_file_write_iter(stru ssize_t err; loff_t endbyte =3D 0; =20 + if (fuse_is_bad(inode)) + return -EIO; + if (get_fuse_conn(inode)->writeback_cache) { /* Update size (EOF optimization) and mode (SUID clearing) */ err =3D fuse_update_attributes(mapping->host, NULL, file, NULL); @@ -1415,7 +1424,7 @@ static ssize_t __fuse_direct_read(struct struct file *file =3D io->file; struct inode *inode =3D file_inode(file); =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 res =3D fuse_direct_io(io, iter, ppos, 0); @@ -1438,7 +1447,7 @@ static ssize_t fuse_direct_write_iter(st struct fuse_io_priv io =3D FUSE_IO_PRIV_SYNC(file); ssize_t res; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 /* Don't allow parallel writes to the same file */ @@ -1911,7 +1920,7 @@ static int fuse_writepages(struct addres int err; =20 err =3D -EIO; - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) goto out; =20 data.inode =3D inode; @@ -2687,7 +2696,7 @@ long fuse_ioctl_common(struct file *file if (!fuse_allow_current_process(fc)) return -EACCES; =20 - if (is_bad_inode(inode)) + if (fuse_is_bad(inode)) return -EIO; =20 return fuse_do_ioctl(file, cmd, arg, flags); --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -115,6 +115,8 @@ enum { FUSE_I_INIT_RDPLUS, /** An operation changing file size is in progress */ FUSE_I_SIZE_UNSTABLE, + /* Bad inode */ + FUSE_I_BAD, }; =20 struct fuse_conn; @@ -688,6 +690,16 @@ static inline u64 get_node_id(struct ino return get_fuse_inode(inode)->nodeid; } =20 +static inline void fuse_make_bad(struct inode *inode) +{ + set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state); +} + +static inline bool fuse_is_bad(struct inode *inode) +{ + return unlikely(test_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state)); +} + /** Device operations */ extern const struct file_operations fuse_dev_operations; =20 --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -316,7 +316,7 @@ struct inode *fuse_iget(struct super_blo unlock_new_inode(inode); } else if ((inode->i_mode ^ attr->mode) & S_IFMT) { /* Inode has changed type, any I/O on the old should fail */ - make_bad_inode(inode); + fuse_make_bad(inode); iput(inode); goto retry; } --- a/fs/fuse/xattr.c +++ b/fs/fuse/xattr.c @@ -113,6 +113,9 @@ ssize_t fuse_listxattr(struct dentry *en struct fuse_getxattr_out outarg; ssize_t ret; =20 + if (fuse_is_bad(inode)) + return -EIO; + if (!fuse_allow_current_process(fc)) return -EACCES; =20 @@ -178,6 +181,9 @@ static int fuse_xattr_get(const struct x struct dentry *dentry, struct inode *inode, const char *name, void *value, size_t size) { + if (fuse_is_bad(inode)) + return -EIO; + return fuse_getxattr(inode, name, value, size); } =20 @@ -186,6 +192,9 @@ static int fuse_xattr_set(const struct x const char *name, const void *value, size_t size, int flags) { + if (fuse_is_bad(inode)) + return -EIO; + if (!value) return fuse_removexattr(inode, name); =20 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5C832C433F5 for ; Mon, 24 Jan 2022 19:06:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346441AbiAXTFe (ORCPT ); Mon, 24 Jan 2022 14:05:34 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:59202 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345572AbiAXTAa (ORCPT ); Mon, 24 Jan 2022 14:00:30 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5CD7E609EE; Mon, 24 Jan 2022 19:00:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1F860C340E5; Mon, 24 Jan 2022 19:00:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050829; bh=8tY+An6URUoVV/3dDVrzPaBtt69kSBA3mgynBIRuVoU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t99amihwz5CPaIZEFMBJZlbW/mF1ZNISRA9BZUpd1qbqBt1YnCbHT+Nm3aGhGnoZm hs2OHFkFq7+PZeoRa/rfkcR9+uoMQXqNw9Q42fGgb8R9U6e+gvnoPBcAZHZf1p9vVh ZnXhfRPlmTDoC2dX2PhAvx0DHS7dvUh+jKs/anuU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Amir Goldstein , Miklos Szeredi , Ben Hutchings Subject: [PATCH 4.9 126/157] fuse: fix live lock in fuse_iget() Date: Mon, 24 Jan 2022 19:43:36 +0100 Message-Id: <20220124183936.775591737@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Amir Goldstein commit 775c5033a0d164622d9d10dd0f0a5531639ed3ed upstream. Commit 5d069dbe8aaf ("fuse: fix bad inode") replaced make_bad_inode() in fuse_iget() with a private implementation fuse_make_bad(). The private implementation fails to remove the bad inode from inode cache, so the retry loop with iget5_locked() finds the same bad inode and marks it bad forever. kmsg snip: [ ] rcu: INFO: rcu_sched self-detected stall on CPU ... [ ] ? bit_wait_io+0x50/0x50 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ? find_inode.isra.32+0x60/0xb0 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ilookup5_nowait+0x65/0x90 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ilookup5.part.36+0x2e/0x80 [ ] ? fuse_init_file_inode+0x70/0x70 [ ] ? fuse_inode_eq+0x20/0x20 [ ] iget5_locked+0x21/0x80 [ ] ? fuse_inode_eq+0x20/0x20 [ ] fuse_iget+0x96/0x1b0 Fixes: 5d069dbe8aaf ("fuse: fix bad inode") Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Amir Goldstein Signed-off-by: Miklos Szeredi Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- fs/fuse/fuse_i.h | 1 + 1 file changed, 1 insertion(+) --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -692,6 +692,7 @@ static inline u64 get_node_id(struct ino =20 static inline void fuse_make_bad(struct inode *inode) { + remove_inode_hash(inode); set_bit(FUSE_I_BAD, &get_fuse_inode(inode)->state); } =20 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C222C4167B for ; Mon, 24 Jan 2022 19:16:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240296AbiAXTQ2 (ORCPT ); Mon, 24 Jan 2022 14:16:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46598 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346253AbiAXTFO (ORCPT ); Mon, 24 Jan 2022 14:05:14 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D909CC0613EB; Mon, 24 Jan 2022 11:00:33 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7A68860010; Mon, 24 Jan 2022 19:00:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 62B76C340E5; Mon, 24 Jan 2022 19:00:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050832; bh=xc4nnjOqKkJyiHkaXw1RU+ZlPk2fOnql3U4DXhHAocM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qlve4r/ChbOINb2tLB6APbcZrLeEjCJ4zQ+k4jKXUFPiP9Tm0pJeWV7kvBwlGp5Xn u4tPjwmKco+/S6UjHfd8iene8HrXkSdy2xOCtD/hvVJqgFwFd1nNjrWx5hxDYDIAPB 2leCoi5xmmFY38hfWUUiy5PyGrCaJ4HE17PQUXm0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Christian=20K=C3=B6nig?= , Jan Stancek , Borislav Petkov , Alex Deucher Subject: [PATCH 4.9 127/157] drm/radeon: fix error handling in radeon_driver_open_kms Date: Mon, 24 Jan 2022 19:43:37 +0100 Message-Id: <20220124183936.808052553@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Christian K=C3=B6nig commit 4722f463896cc0ef1a6f1c3cb2e171e949831249 upstream. The return value was never initialized so the cleanup code executed when it isn't even necessary. Just add proper error handling. Fixes: ab50cb9df889 ("drm/radeon/radeon_kms: Fix a NULL pointer dereference= in radeon_driver_open_kms()") Signed-off-by: Christian K=C3=B6nig Tested-by: Jan Stancek Tested-by: Borislav Petkov Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/gpu/drm/radeon/radeon_kms.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) --- a/drivers/gpu/drm/radeon/radeon_kms.c +++ b/drivers/gpu/drm/radeon/radeon_kms.c @@ -648,18 +648,18 @@ int radeon_driver_open_kms(struct drm_de fpriv =3D kzalloc(sizeof(*fpriv), GFP_KERNEL); if (unlikely(!fpriv)) { r =3D -ENOMEM; - goto out_suspend; + goto err_suspend; } =20 if (rdev->accel_working) { vm =3D &fpriv->vm; r =3D radeon_vm_init(rdev, vm); if (r) - goto out_fpriv; + goto err_fpriv; =20 r =3D radeon_bo_reserve(rdev->ring_tmp_bo.bo, false); if (r) - goto out_vm_fini; + goto err_vm_fini; =20 /* map the ib pool buffer read only into * virtual address space */ @@ -667,7 +667,7 @@ int radeon_driver_open_kms(struct drm_de rdev->ring_tmp_bo.bo); if (!vm->ib_bo_va) { r =3D -ENOMEM; - goto out_vm_fini; + goto err_vm_fini; } =20 r =3D radeon_vm_bo_set_addr(rdev, vm->ib_bo_va, @@ -675,19 +675,21 @@ int radeon_driver_open_kms(struct drm_de RADEON_VM_PAGE_READABLE | RADEON_VM_PAGE_SNOOPED); if (r) - goto out_vm_fini; + goto err_vm_fini; } file_priv->driver_priv =3D fpriv; } =20 - if (!r) - goto out_suspend; + pm_runtime_mark_last_busy(dev->dev); + pm_runtime_put_autosuspend(dev->dev); + return 0; =20 -out_vm_fini: +err_vm_fini: radeon_vm_fini(rdev, vm); -out_fpriv: +err_fpriv: kfree(fpriv); -out_suspend: + +err_suspend: pm_runtime_mark_last_busy(dev->dev); pm_runtime_put_autosuspend(dev->dev); return r; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D32A2C433F5 for ; Mon, 24 Jan 2022 19:06:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344568AbiAXTFh (ORCPT ); Mon, 24 Jan 2022 14:05:37 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57612 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345594AbiAXTAi (ORCPT ); Mon, 24 Jan 2022 14:00:38 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2F04FB8122C; Mon, 24 Jan 2022 19:00:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8E4CDC340E5; Mon, 24 Jan 2022 19:00:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050835; bh=PgUbgX6ANUFRXQ8ngiqtS0bdZs9c8PBcaUhoUtYw8X4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TlGhDn4EMAUbnZTfbDAdkt9c4h1qJRofCXvjgYQq96TYIptJoJtWOsDf+Z7V0mbV+ KQkWBlXTPybIo9SlMxlwio73zG2XyH5AAsVxwOcmAYqpwbCuaUjKq2gdQ/CRd08o4h iPRWL8sXxGXsW6B8nhXhtjmJVDRtR9RDCRCyJ/Ug= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yixing Liu , Wenpeng Liang , Jason Gunthorpe Subject: [PATCH 4.9 128/157] RDMA/hns: Modify the mapping attribute of doorbell to device Date: Mon, 24 Jan 2022 19:43:38 +0100 Message-Id: <20220124183936.838628466@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yixing Liu commit 39d5534b1302189c809e90641ffae8cbdc42a8fc upstream. It is more general for ARM device drivers to use the device attribute to map PCI BAR spaces. Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Link: https://lore.kernel.org/r/20211206133652.27476-1-liangwenpeng@huawei.= com Signed-off-by: Yixing Liu Signed-off-by: Wenpeng Liang Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -556,7 +556,7 @@ static int hns_roce_mmap(struct ib_ucont return -EINVAL; =20 if (vma->vm_pgoff =3D=3D 0) { - vma->vm_page_prot =3D pgprot_noncached(vma->vm_page_prot); + vma->vm_page_prot =3D pgprot_device(vma->vm_page_prot); if (io_remap_pfn_range(vma, vma->vm_start, to_hr_ucontext(context)->uar.pfn, PAGE_SIZE, vma->vm_page_prot)) From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4DECC4332F for ; Mon, 24 Jan 2022 19:06:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229610AbiAXTFx (ORCPT ); Mon, 24 Jan 2022 14:05:53 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57686 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345608AbiAXTAl (ORCPT ); Mon, 24 Jan 2022 14:00:41 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 392A6B81239; Mon, 24 Jan 2022 19:00:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6D92FC340E5; Mon, 24 Jan 2022 19:00:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050839; bh=7MnhLEjkv5OmPQOjR5kPlUEAsHS1KKAq0CkG2/QiCQc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RBJ5kxq/aW8bXOgQ47/hhVIfQzd06gSM0tWEWXxeOtrcPuXivuTIsKeHdI1w14rxB ns+GYJE/D9TM+NgD16pBvcBrlTJtKJQyb6iEPIXaBvUjXZENgqSXsrvLZq4Jp4GfJy P9LF9T7hI9nPREVTEUsTlxf1XY7FnWzaoJza0yvA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengguang Xu , Zhu Yanjun , Bob Pearson , Jason Gunthorpe Subject: [PATCH 4.9 129/157] RDMA/rxe: Fix a typo in opcode name Date: Mon, 24 Jan 2022 19:43:39 +0100 Message-Id: <20220124183936.870235541@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengguang Xu commit 8d1cfb884e881efd69a3be4ef10772c71cb22216 upstream. There is a redundant ']' in the name of opcode IB_OPCODE_RC_SEND_MIDDLE, so just fix it. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20211218112320.3558770-1-cgxu519@mykernel.n= et Signed-off-by: Chengguang Xu Acked-by: Zhu Yanjun Reviewed-by: Bob Pearson Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/infiniband/sw/rxe/rxe_opcode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/infiniband/sw/rxe/rxe_opcode.c +++ b/drivers/infiniband/sw/rxe/rxe_opcode.c @@ -137,7 +137,7 @@ struct rxe_opcode_info rxe_opcode[RXE_NU } }, [IB_OPCODE_RC_SEND_MIDDLE] =3D { - .name =3D "IB_OPCODE_RC_SEND_MIDDLE]", + .name =3D "IB_OPCODE_RC_SEND_MIDDLE", .mask =3D RXE_PAYLOAD_MASK | RXE_REQ_MASK | RXE_SEND_MASK | RXE_MIDDLE_MASK, .length =3D RXE_BTH_BYTES, From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8757DC433EF for ; Mon, 24 Jan 2022 19:16:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234838AbiAXTQX (ORCPT ); Mon, 24 Jan 2022 14:16:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346254AbiAXTFO (ORCPT ); Mon, 24 Jan 2022 14:05:14 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 172DEC0613EC; Mon, 24 Jan 2022 11:00:43 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A8178608D4; Mon, 24 Jan 2022 19:00:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9A27DC340E5; Mon, 24 Jan 2022 19:00:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050842; bh=SqqKlmrkJD2ajJiHT7F53gMvsqqsiJfdubXqh3QjyAo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qPBcD5KGCssJ//76QRGd3RDtOQr4p6jdRd0ozCv4/HDgle9DL3S/DsCOld0sLdMUQ m7QBpukZ1AKo1cqcGH6l8iKVS7NABN8Sswi1Gjz+OsrXoXGWNcj4/0ktuC7g5+993i 4D9qDUQ7FFr+GTKtSAMrZh4bXhsCTo3EwXa3Npig= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tobias Waldekranz , Jakub Kicinski Subject: [PATCH 4.9 130/157] powerpc/fsl/dts: Enable WA for erratum A-009885 on fman3l MDIO buses Date: Mon, 24 Jan 2022 19:43:40 +0100 Message-Id: <20220124183936.908163451@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tobias Waldekranz commit 0d375d610fa96524e2ee2b46830a46a7bfa92a9f upstream. This block is used in (at least) T1024 and T1040, including their variants like T1023 etc. Fixes: d55ad2967d89 ("powerpc/mpc85xx: Create dts components for the FSL Qo= rIQ DPAA FMan") Signed-off-by: Tobias Waldekranz Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi +++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3l-0.dtsi @@ -78,6 +78,7 @@ fman0: fman@400000 { #size-cells =3D <0>; compatible =3D "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg =3D <0xfc000 0x1000>; + fsl,erratum-a009885; }; =20 xmdio0: mdio@fd000 { @@ -85,6 +86,7 @@ fman0: fman@400000 { #size-cells =3D <0>; compatible =3D "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg =3D <0xfd000 0x1000>; + fsl,erratum-a009885; }; =20 ptp_timer0: ptp-timer@fe000 { From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4199CC43217 for ; Mon, 24 Jan 2022 19:06:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346475AbiAXTGe (ORCPT ); Mon, 24 Jan 2022 14:06:34 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57212 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345644AbiAXTAr (ORCPT ); Mon, 24 Jan 2022 14:00:47 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6269BB81229; Mon, 24 Jan 2022 19:00:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 907AAC340E5; Mon, 24 Jan 2022 19:00:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050845; bh=SkxgkeQKtRzsXP4qhrbvLWmh+8iL7PKLaOqj4Z1DGOc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZpMdSy/SpIjTtP0dOW81bGT65ATdcNLUyrqq7CuFS5nAYIxB2f2LVIW52ZKDRrbg8 hOfZt2UZD3XHxmJW5DnlZytwEKVR7tNIV72l6bG8QJRWxiagrO+uDBAp6UABJjOs9o kLhqpd105EKImXUH7nzIjyHrsOfuEzPDnKZ3X0hI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tobias Waldekranz , Andrew Lunn , Jakub Kicinski Subject: [PATCH 4.9 131/157] net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module Date: Mon, 24 Jan 2022 19:43:41 +0100 Message-Id: <20220124183936.938138098@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tobias Waldekranz commit 3f7c239c7844d2044ed399399d97a5f1c6008e1b upstream. As reported by sparse: In the remove path, the driver would attempt to unmap its own priv pointer - instead of the io memory that it mapped in probe. Fixes: 9f35a7342cff ("net/fsl: introduce Freescale 10G MDIO driver") Signed-off-by: Tobias Waldekranz Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/ethernet/freescale/xgmac_mdio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/freescale/xgmac_mdio.c +++ b/drivers/net/ethernet/freescale/xgmac_mdio.c @@ -301,9 +301,10 @@ err_ioremap: static int xgmac_mdio_remove(struct platform_device *pdev) { struct mii_bus *bus =3D platform_get_drvdata(pdev); + struct mdio_fsl_priv *priv =3D bus->priv; =20 mdiobus_unregister(bus); - iounmap(bus->priv); + iounmap(priv->mdio_base); mdiobus_free(bus); =20 return 0; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84080C433EF for ; Mon, 24 Jan 2022 19:07:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346603AbiAXTHE (ORCPT ); Mon, 24 Jan 2022 14:07:04 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57774 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345676AbiAXTAy (ORCPT ); Mon, 24 Jan 2022 14:00:54 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D5A08B81238; Mon, 24 Jan 2022 19:00:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E114FC340E7; Mon, 24 Jan 2022 19:00:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050851; bh=sGOvretFgauqF2/LGbvj1iZr7JxVo+3umuYUrti16Ho=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h5khCtPti/6XMR/3WB6H+1EB5CMpD8XkH7Pn0WJGQGj5mNGEawyjAJMj3HC6SIDpQ h0j35m6NP6UK3q3EwfomJ9vSyPSgU+mL+IXMYNX5s1S7b+PfYCFzpyIZshNgwoVtN5 yqI/O2UWvMBJFLa7kN1tP0nd4x2kCB8+vC8QrpPY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Helge Deller Subject: [PATCH 4.9 132/157] parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries Date: Mon, 24 Jan 2022 19:43:42 +0100 Message-Id: <20220124183936.967542931@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Miaoqian Lin commit d24846a4246b6e61ecbd036880a4adf61681d241 upstream. kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add()=EF=BC=9A If this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object. Fix memory leak by calling kobject_put(). Fixes: 73f368cf679b ("Kobject: change drivers/parisc/pdc_stable.c to use ko= bject_init_and_add") Signed-off-by: Miaoqian Lin Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/parisc/pdc_stable.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/parisc/pdc_stable.c +++ b/drivers/parisc/pdc_stable.c @@ -992,8 +992,10 @@ pdcs_register_pathentries(void) entry->kobj.kset =3D paths_kset; err =3D kobject_init_and_add(&entry->kobj, &ktype_pdcspath, NULL, "%s", entry->name); - if (err) + if (err) { + kobject_put(&entry->kobj); return err; + } =20 /* kobject is now registered */ write_lock(&entry->rw_lock); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 006D0C433F5 for ; Mon, 24 Jan 2022 19:14:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344631AbiAXTOJ (ORCPT ); Mon, 24 Jan 2022 14:14:09 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46602 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346258AbiAXTFO (ORCPT ); Mon, 24 Jan 2022 14:05:14 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 25A3AC0613EE; Mon, 24 Jan 2022 11:00:57 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E2F02B81215; Mon, 24 Jan 2022 19:00:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1D190C340E5; Mon, 24 Jan 2022 19:00:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050854; bh=63F1nd3KDMNKL6yqbHKJOnOSr+qJ79dax9b58eVEicc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZHMtXeVsCfl75dzTfcZQZrmMf/E2OWQAOkk4kF5hyCjrt5j5eXglmVMlPwkeixusE yItzN+va/m4zeUTZC9G5Cgu949oVWycR1HbcVoiGcdw8FdT3U1RxQkGF/sMiewjLAs wucx52TYvyZenh4swkPjra11CbyYhIuVjQAy3dqU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , Jakub Kicinski Subject: [PATCH 4.9 133/157] af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress Date: Mon, 24 Jan 2022 19:43:43 +0100 Message-Id: <20220124183936.998303024@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 9d6d7f1cb67cdee15f1a0e85aacfb924e0e02435 upstream. wait_for_unix_gc() reads unix_tot_inflight & gc_in_progress without synchronization. Adds READ_ONCE()/WRITE_ONCE() and their associated comments to better document the intent. BUG: KCSAN: data-race in unix_inflight / wait_for_unix_gc write to 0xffffffff86e2b7c0 of 4 bytes by task 9380 on cpu 0: unix_inflight+0x1e8/0x260 net/unix/scm.c:63 unix_attach_fds+0x10c/0x1e0 net/unix/scm.c:121 unix_scm_to_skb net/unix/af_unix.c:1674 [inline] unix_dgram_sendmsg+0x679/0x16b0 net/unix/af_unix.c:1817 unix_seqpacket_sendmsg+0xcc/0x110 net/unix/af_unix.c:2258 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2409 ___sys_sendmsg net/socket.c:2463 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549 __do_sys_sendmmsg net/socket.c:2578 [inline] __se_sys_sendmmsg net/socket.c:2575 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffffffff86e2b7c0 of 4 bytes by task 9375 on cpu 1: wait_for_unix_gc+0x24/0x160 net/unix/garbage.c:196 unix_dgram_sendmsg+0x8e/0x16b0 net/unix/af_unix.c:1772 unix_seqpacket_sendmsg+0xcc/0x110 net/unix/af_unix.c:2258 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg net/socket.c:724 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2409 ___sys_sendmsg net/socket.c:2463 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549 __do_sys_sendmmsg net/socket.c:2578 [inline] __se_sys_sendmmsg net/socket.c:2575 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000002 -> 0x00000004 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 9375 Comm: syz-executor.1 Not tainted 5.16.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Fixes: 9915672d4127 ("af_unix: limit unix_tot_inflight") Signed-off-by: Eric Dumazet Reported-by: syzbot Link: https://lore.kernel.org/r/20220114164328.2038499-1-eric.dumazet@gmail= .com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- net/unix/garbage.c | 14 +++++++++++--- net/unix/scm.c | 6 ++++-- 2 files changed, 15 insertions(+), 5 deletions(-) --- a/net/unix/garbage.c +++ b/net/unix/garbage.c @@ -197,8 +197,11 @@ void wait_for_unix_gc(void) { /* If number of inflight sockets is insane, * force a garbage collect right now. + * Paired with the WRITE_ONCE() in unix_inflight(), + * unix_notinflight() and gc_in_progress(). */ - if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress) + if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC && + !READ_ONCE(gc_in_progress)) unix_gc(); wait_event(unix_gc_wait, gc_in_progress =3D=3D false); } @@ -218,7 +221,9 @@ void unix_gc(void) if (gc_in_progress) goto out; =20 - gc_in_progress =3D true; + /* Paired with READ_ONCE() in wait_for_unix_gc(). */ + WRITE_ONCE(gc_in_progress, true); + /* First, select candidates for garbage collection. Only * in-flight sockets are considered, and from those only ones * which don't have any external reference. @@ -304,7 +309,10 @@ void unix_gc(void) =20 /* All candidates should have been detached by now. */ BUG_ON(!list_empty(&gc_candidates)); - gc_in_progress =3D false; + + /* Paired with READ_ONCE() in wait_for_unix_gc(). */ + WRITE_ONCE(gc_in_progress, false); + wake_up(&unix_gc_wait); =20 out: --- a/net/unix/scm.c +++ b/net/unix/scm.c @@ -56,7 +56,8 @@ void unix_inflight(struct user_struct *u } else { BUG_ON(list_empty(&u->link)); } - unix_tot_inflight++; + /* Paired with READ_ONCE() in wait_for_unix_gc() */ + WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1); } user->unix_inflight++; spin_unlock(&unix_gc_lock); @@ -76,7 +77,8 @@ void unix_notinflight(struct user_struct =20 if (atomic_long_dec_and_test(&u->inflight)) list_del_init(&u->link); - unix_tot_inflight--; + /* Paired with READ_ONCE() in wait_for_unix_gc() */ + WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1); } user->unix_inflight--; spin_unlock(&unix_gc_lock); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5FB0C433FE for ; Mon, 24 Jan 2022 19:14:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344272AbiAXTOF (ORCPT ); Mon, 24 Jan 2022 14:14:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46604 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346259AbiAXTFO (ORCPT ); Mon, 24 Jan 2022 14:05:14 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5FB40C0613EF; Mon, 24 Jan 2022 11:01:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1EAA1B81215; Mon, 24 Jan 2022 19:00:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58EDCC340E5; Mon, 24 Jan 2022 19:00:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050857; bh=32uOvvkf5PwtZBQ1zKQge2AigcWs01gd5KpLT3qG+qQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iDScEU6juax4DqtQ9EK38rAhRgiwpp6908atMOQwgfeMmkhiMJ4hgKkZn/hXG25j1 UrQcXES4k8KgaTgPmhXp5gaUw4HARzpVHzRbMtAvFjcNlOn8IgFP9onrDHVRqgwlPp reIMGJnVtiDkN4rU14pV2YZii6rSz5QbvdHz6ap8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert Hancock , Andrew Lunn , "David S. Miller" Subject: [PATCH 4.9 134/157] net: axienet: Wait for PhyRstCmplt after core reset Date: Mon, 24 Jan 2022 19:43:44 +0100 Message-Id: <20220124183937.028790889@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Robert Hancock commit b400c2f4f4c53c86594dd57098970d97d488bfde upstream. When resetting the device, wait for the PhyRstCmplt bit to be set in the interrupt status register before continuing initialization, to ensure that the core is actually ready. When using an external PHY, this also ensures we do not start trying to access the PHY while it is still in reset. The PHY reset is initiated by the core reset which is triggered just above, but remains asserted for 5ms after the core is reset according to the documentation. The MgtRdy bit could also be waited for, but unfortunately when using 7-series devices, the bit does not appear to work as documented (it seems to behave as some sort of link state indication and not just an indication the transceiver is ready) so it can't really be relied on for this purpose. Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethern= et driver") Signed-off-by: Robert Hancock Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c @@ -278,6 +278,16 @@ static int axienet_dma_bd_init(struct ne axienet_dma_out32(lp, XAXIDMA_TX_CR_OFFSET, cr | XAXIDMA_CR_RUNSTOP_MASK); =20 + /* Wait for PhyRstCmplt bit to be set, indicating the PHY reset has finis= hed */ + ret =3D read_poll_timeout(axienet_ior, value, + value & XAE_INT_PHYRSTCMPLT_MASK, + DELAY_OF_ONE_MILLISEC, 50000, false, lp, + XAE_IS_OFFSET); + if (ret) { + dev_err(lp->dev, "%s: timeout waiting for PhyRstCmplt\n", __func__); + return ret; + } + return 0; out: axienet_dma_bd_release(ndev); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 469A6C433EF for ; Mon, 24 Jan 2022 19:14:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346646AbiAXTOU (ORCPT ); Mon, 24 Jan 2022 14:14:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346272AbiAXTFP (ORCPT ); Mon, 24 Jan 2022 14:05:15 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 90EA2C0613F0; Mon, 24 Jan 2022 11:01:03 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 59D0AB8123A; Mon, 24 Jan 2022 19:01:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8A1FEC340EA; Mon, 24 Jan 2022 19:01:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050861; bh=MAeeJZOxqn6EdjZ+yLTH/ZYr2Om5f/r9frQ/yzaDLFI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EcnbjoBdne6VWiGRW+dtQPPyMv20XLvMPB50APa4SBwSrgJaQfZY3vgmWvm5lc7YS 3LvdWeovlWvaotVnCFXcTrcOnTR8pe3qAvqWRt1gY3k8eRHCWPcZsjWsZnqkAkO4gO NUM8IlG0enuhAH0XQXHt1dop3AKkII7arnyZRvPI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert Hancock , "David S. Miller" Subject: [PATCH 4.9 135/157] net: axienet: fix number of TX ring slots for available check Date: Mon, 24 Jan 2022 19:43:45 +0100 Message-Id: <20220124183937.059128872@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Robert Hancock commit aba57a823d2985a2cc8c74a2535f3a88e68d9424 upstream. The check for the number of available TX ring slots was off by 1 since a slot is required for the skb header as well as each fragment. This could result in overwriting a TX ring slot that was still in use. Fixes: 8a3b7a252dca9 ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethern= et driver") Signed-off-by: Robert Hancock Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c @@ -680,7 +680,7 @@ axienet_start_xmit(struct sk_buff *skb, num_frag =3D skb_shinfo(skb)->nr_frags; cur_p =3D &lp->tx_bd_v[lp->tx_bd_tail]; =20 - if (axienet_check_tx_bd_space(lp, num_frag)) { + if (axienet_check_tx_bd_space(lp, num_frag + 1)) { if (netif_queue_stopped(ndev)) return NETDEV_TX_BUSY; =20 @@ -690,7 +690,7 @@ axienet_start_xmit(struct sk_buff *skb, smp_mb(); =20 /* Space might have just been freed - check again */ - if (axienet_check_tx_bd_space(lp, num_frag)) + if (axienet_check_tx_bd_space(lp, num_frag + 1)) return NETDEV_TX_BUSY; =20 netif_wake_queue(ndev); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 712AAC433FE for ; Mon, 24 Jan 2022 19:07:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236744AbiAXTHN (ORCPT ); Mon, 24 Jan 2022 14:07:13 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:59474 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345779AbiAXTBF (ORCPT ); Mon, 24 Jan 2022 14:01:05 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D860860915; Mon, 24 Jan 2022 19:01:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C96AC340E5; Mon, 24 Jan 2022 19:01:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050864; bh=Up43H3zYk3ZP2Hqn8ayRSbG3xGzWcLCx7omRLNqeFEY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v+glVPtiQ5nnr9QJKEPQckXmKaUF+tofXihrQ7HkpGmnt+6FKrGLIF72nxcnmWK98 hEo/T7zkYmsLDJoDE/vFzl+LUioWTo8GNMPBDK1r6LhxmIuBk56P0AKhBb/Nwx6zGe kmvV7+YnWL34ikaqXH8d1q0tsjvLWZsubswDJItc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , "Eric W. Biederman" , "David S. Miller" Subject: [PATCH 4.9 136/157] netns: add schedule point in ops_exit_list() Date: Mon, 24 Jan 2022 19:43:46 +0100 Message-Id: <20220124183937.090378830@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 2836615aa22de55b8fca5e32fe1b27a67cda625e upstream. When under stress, cleanup_net() can have to dismantle netns in big numbers. ops_exit_list() currently calls many helpers [1] that have no schedule point, and we can end up with soft lockups, particularly on hosts with many cpus. Even for moderate amount of netns processed by cleanup_net() this patch avoids latency spikes. [1] Some of these helpers like fib_sync_up() and fib_sync_down_dev() are very slow because net/ipv4/fib_semantics.c uses host-wide hash tables, and ifindex is used as the only input of two hash functions. ifindexes tend to be the same for all netns (lo.ifindex=3D=3D1 per inst= ance) This will be fixed in a separate patch. Fixes: 72ad937abd0a ("net: Add support for batching network namespace clean= ups") Signed-off-by: Eric Dumazet Cc: Eric W. Biederman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- net/core/net_namespace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/net/core/net_namespace.c +++ b/net/core/net_namespace.c @@ -132,8 +132,10 @@ static void ops_exit_list(const struct p { struct net *net; if (ops->exit) { - list_for_each_entry(net, net_exit_list, exit_list) + list_for_each_entry(net, net_exit_list, exit_list) { ops->exit(net); + cond_resched(); + } } if (ops->exit_batch) ops->exit_batch(net_exit_list); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA72DC433EF for ; Mon, 24 Jan 2022 19:07:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344182AbiAXTHh (ORCPT ); Mon, 24 Jan 2022 14:07:37 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:58270 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345828AbiAXTBJ (ORCPT ); Mon, 24 Jan 2022 14:01:09 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A1950B8121C; Mon, 24 Jan 2022 19:01:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C81FCC340E7; Mon, 24 Jan 2022 19:01:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050867; bh=DthYjh+AUf6U0msGHmNsk3EuOaLtsWRn1QyFhfakDLQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YFSCilqkMJHcSTX1pWHLZ3sz3II/V5twquvf8qj6nvjhBgB/ExhaS54Xm9dZW2ZOe DeDq+z64SvA3vO6TO2+VlJ51TYkW3bKraZL08AQ8GeeXRfCafSL3+fpds08lFH1dX/ JILezTZdUW6NFWi8hfdMsKA/gE83SLw+n8/ZOnHo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guillaume Nault , Jakub Kicinski Subject: [PATCH 4.9 137/157] libcxgb: Dont accidentally set RTO_ONLINK in cxgb_find_route() Date: Mon, 24 Jan 2022 19:43:47 +0100 Message-Id: <20220124183937.121091212@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Guillaume Nault commit a915deaa9abe4fb3a440312c954253a6a733608e upstream. Mask the ECN bits before calling ip_route_output_ports(). The tos variable might be passed directly from an IPv4 header, so it may have the last ECN bit set. This interferes with the route lookup process as ip_route_output_key_hash() interpretes this bit specially (to restrict the route scope). Found by code inspection, compile tested only. Fixes: 804c2f3e36ef ("libcxgb,iw_cxgb4,cxgbit: add cxgb_find_route()") Signed-off-by: Guillaume Nault Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c +++ b/drivers/net/ethernet/chelsio/libcxgb/libcxgb_cm.c @@ -32,6 +32,7 @@ =20 #include #include +#include #include #include =20 @@ -99,7 +100,7 @@ cxgb_find_route(struct cxgb4_lld_info *l =20 rt =3D ip_route_output_ports(&init_net, &fl4, NULL, peer_ip, local_ip, peer_port, local_port, IPPROTO_TCP, - tos, 0); + tos & ~INET_ECN_MASK, 0); if (IS_ERR(rt)) return NULL; n =3D dst_neigh_lookup(&rt->dst, &peer_ip); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 699A6C433EF for ; Mon, 24 Jan 2022 19:14:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344666AbiAXTOO (ORCPT ); Mon, 24 Jan 2022 14:14:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46122 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346273AbiAXTFP (ORCPT ); Mon, 24 Jan 2022 14:05:15 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E4122C061744; Mon, 24 Jan 2022 11:01:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id ACA13B8123D; Mon, 24 Jan 2022 19:01:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CAA5DC340E5; Mon, 24 Jan 2022 19:01:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050870; bh=7ZmSP83pnz/9ovn3uNxo/a+ALAEvGbkM4+KUbVVkoBY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uEqLlRADOLt8WnGScxr/0sn4E3BOmyXSEpaFG+ckm8wdvgc/NTNy40B0pc1OYnHeH 5HMRWPXFTNROV1jEznUqZUn6Fgt2u3UugO4wwB1l8S7T9LFRXeSBPCi/2GBBinQk09 U6frYjrkfneW0Iw0AD+kWO9DVolQHxksDTv20jXc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.9 138/157] dmaengine: at_xdmac: Dont start transactions at tx_submit level Date: Mon, 24 Jan 2022 19:43:48 +0100 Message-Id: <20220124183937.151234029@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit bccfb96b59179d4f96cbbd1ddff8fac6d335eae4 upstream. tx_submit is supposed to push the current transaction descriptor to a pending queue, waiting for issue_pending() to be called. issue_pending() must start the transfer, not tx_submit(), thus remove at_xdmac_start_xfer() from at_xdmac_tx_submit(). Clients of at_xdmac that assume that tx_submit() starts the transfer must be updated and call dma_async_issue_pending() if they miss to call it (one example is atmel_serial). As the at_xdmac_start_xfer() is now called only from at_xdmac_advance_work() when !at_xdmac_chan_is_enabled(), the at_xdmac_chan_is_enabled() check is no longer needed in at_xdmac_start_xfer(), thus remove it. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended D= MA Controller driver") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-2-tudor.ambarus@micro= chip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/dma/at_xdmac.c | 6 ------ 1 file changed, 6 deletions(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -345,9 +345,6 @@ static void at_xdmac_start_xfer(struct a =20 dev_vdbg(chan2dev(&atchan->chan), "%s: desc 0x%p\n", __func__, first); =20 - if (at_xdmac_chan_is_enabled(atchan)) - return; - /* Set transfer as active to not try to start it again. */ first->active_xfer =3D true; =20 @@ -431,9 +428,6 @@ static dma_cookie_t at_xdmac_tx_submit(s dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_lis= t\n", __func__, atchan, desc); list_add_tail(&desc->xfer_node, &atchan->xfers_list); - if (list_is_singular(&atchan->xfers_list)) - at_xdmac_start_xfer(atchan, desc); - spin_unlock_irqrestore(&atchan->lock, irqflags); return cookie; } From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BFB58C433EF for ; Mon, 24 Jan 2022 19:07:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346752AbiAXTH1 (ORCPT ); Mon, 24 Jan 2022 14:07:27 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:58834 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345881AbiAXTBO (ORCPT ); Mon, 24 Jan 2022 14:01:14 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4090F60917; Mon, 24 Jan 2022 19:01:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EE3D7C340E5; Mon, 24 Jan 2022 19:01:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050873; bh=28gUiN8z0/7XjkyiXCAPk6JN17+wymAYbKOfXAnxsLg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=V42SbJcCATKTCEezWbpqlzmN9ASjiPxhdDU9xqyloK9cPXRfUMjUKURLgnhoWiUNG 18lOSNcX/Utp1pQo7G+HLCcbXHXiz/VSEUxQErrMY50+9S0eGGIhMRoaRRxzHcciGI XfyHj8PH07L4Mk04mTYavIjZ44c0bNzlZ5eOWfFM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.9 139/157] dmaengine: at_xdmac: Print debug message after realeasing the lock Date: Mon, 24 Jan 2022 19:43:49 +0100 Message-Id: <20220124183937.180314167@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit 5edc24ac876a928f36f407a0fcdb33b94a3a210f upstream. It is desirable to do the prints without the lock held if possible, so move the print after the lock is released. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended D= MA Controller driver") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-4-tudor.ambarus@micro= chip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/dma/at_xdmac.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -425,10 +425,12 @@ static dma_cookie_t at_xdmac_tx_submit(s spin_lock_irqsave(&atchan->lock, irqflags); cookie =3D dma_cookie_assign(tx); =20 - dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_lis= t\n", - __func__, atchan, desc); list_add_tail(&desc->xfer_node, &atchan->xfers_list); spin_unlock_irqrestore(&atchan->lock, irqflags); + + dev_vdbg(chan2dev(tx->chan), "%s: atchan 0x%p, add desc 0x%p to xfers_lis= t\n", + __func__, atchan, desc); + return cookie; } =20 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 849CCC433EF for ; Mon, 24 Jan 2022 19:09:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347003AbiAXTJZ (ORCPT ); Mon, 24 Jan 2022 14:09:25 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57388 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343706AbiAXTBT (ORCPT ); Mon, 24 Jan 2022 14:01:19 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EEED5B81232; Mon, 24 Jan 2022 19:01:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0FE0EC340E5; Mon, 24 Jan 2022 19:01:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050876; bh=5Xvu8d/C0wWF0Z0O/hZRvCFnTmXcuejuftS0FbGyOM4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Yi1uho5+QbjOGPFWk3pZ27H9JwaZZktylyOJIdF/m0RRx8y4gs09VQIhQKi/DMhYK +d+xVPEfTb4LYDPFzeWdjEe+YGvxTjwrnTFM3ob4zsuPSUIuyp6pCzPTqfTtMdTpTt At3RVN4Z/t80gMpvgpeOg5BfBV4w/zfUcyJRck2A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.9 140/157] dmaengine: at_xdmac: Fix lld view setting Date: Mon, 24 Jan 2022 19:43:50 +0100 Message-Id: <20220124183937.210054947@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit 1385eb4d14d447cc5d744bc2ac34f43be66c9963 upstream. AT_XDMAC_CNDC_NDVIEW_NDV3 was set even for AT_XDMAC_MBR_UBC_NDV2, because of the wrong bit handling. Fix it. Fixes: ee0fe35c8dcd ("dmaengine: xdmac: Handle descriptor's view 3 register= s") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-10-tudor.ambarus@micr= ochip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/dma/at_xdmac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -100,6 +100,7 @@ #define AT_XDMAC_CNDC_NDE (0x1 << 0) /* Channel x Next Descriptor Enabl= e */ #define AT_XDMAC_CNDC_NDSUP (0x1 << 1) /* Channel x Next Descriptor Sou= rce Update */ #define AT_XDMAC_CNDC_NDDUP (0x1 << 2) /* Channel x Next Descriptor Des= tination Update */ +#define AT_XDMAC_CNDC_NDVIEW_MASK GENMASK(28, 27) #define AT_XDMAC_CNDC_NDVIEW_NDV0 (0x0 << 3) /* Channel x Next Descripto= r View 0 */ #define AT_XDMAC_CNDC_NDVIEW_NDV1 (0x1 << 3) /* Channel x Next Descripto= r View 1 */ #define AT_XDMAC_CNDC_NDVIEW_NDV2 (0x2 << 3) /* Channel x Next Descripto= r View 2 */ @@ -360,7 +361,8 @@ static void at_xdmac_start_xfer(struct a */ if (at_xdmac_chan_is_cyclic(atchan)) reg =3D AT_XDMAC_CNDC_NDVIEW_NDV1; - else if (first->lld.mbr_ubc & AT_XDMAC_MBR_UBC_NDV3) + else if ((first->lld.mbr_ubc & + AT_XDMAC_CNDC_NDVIEW_MASK) =3D=3D AT_XDMAC_MBR_UBC_NDV3) reg =3D AT_XDMAC_CNDC_NDVIEW_NDV3; else reg =3D AT_XDMAC_CNDC_NDVIEW_NDV2; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32B93C433F5 for ; Mon, 24 Jan 2022 19:16:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347712AbiAXTOe (ORCPT ); Mon, 24 Jan 2022 14:14:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46206 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343848AbiAXTFg (ORCPT ); Mon, 24 Jan 2022 14:05:36 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B25EDC061774; Mon, 24 Jan 2022 11:01:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5142160C17; Mon, 24 Jan 2022 19:01:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 29D4AC340E5; Mon, 24 Jan 2022 19:01:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050879; bh=/5CAYepTBiNKnuaUxeDRApQltX0ss9gMvwPaaxbIzC0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GLrPH7goNAJmkIZEIYtk1TWf2nhmJ0HTtLndcpD2ix5p/PMLOWFcONtoi/ifVHhKw UkVJEgbAq6rtInksyQOUdFRJMbtyq1LVIA0PYtQmlQvdFKMspTV1Z7Fudn7Lg4TMtq qE6BVtLy86wfoeBGFoghq/8C3XDAq8wfr9LUGnVA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Vinod Koul Subject: [PATCH 4.9 141/157] dmaengine: at_xdmac: Fix at_xdmac_lld struct definition Date: Mon, 24 Jan 2022 19:43:51 +0100 Message-Id: <20220124183937.241489893@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit 912f7c6f7fac273f40e621447cf17d14b50d6e5b upstream. The hardware channel next descriptor view structure contains just fields of 32 bits, while dma_addr_t can be of type u64 or u32 depending on CONFIG_ARCH_DMA_ADDR_T_64BIT. Force u32 to comply with what the hardware expects. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended D= MA Controller driver") Signed-off-by: Tudor Ambarus Link: https://lore.kernel.org/r/20211215110115.191749-11-tudor.ambarus@micr= ochip.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/dma/at_xdmac.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -233,15 +233,15 @@ struct at_xdmac { =20 /* Linked List Descriptor */ struct at_xdmac_lld { - dma_addr_t mbr_nda; /* Next Descriptor Member */ - u32 mbr_ubc; /* Microblock Control Member */ - dma_addr_t mbr_sa; /* Source Address Member */ - dma_addr_t mbr_da; /* Destination Address Member */ - u32 mbr_cfg; /* Configuration Register */ - u32 mbr_bc; /* Block Control Register */ - u32 mbr_ds; /* Data Stride Register */ - u32 mbr_sus; /* Source Microblock Stride Register */ - u32 mbr_dus; /* Destination Microblock Stride Register */ + u32 mbr_nda; /* Next Descriptor Member */ + u32 mbr_ubc; /* Microblock Control Member */ + u32 mbr_sa; /* Source Address Member */ + u32 mbr_da; /* Destination Address Member */ + u32 mbr_cfg; /* Configuration Register */ + u32 mbr_bc; /* Block Control Register */ + u32 mbr_ds; /* Data Stride Register */ + u32 mbr_sus; /* Source Microblock Stride Register */ + u32 mbr_dus; /* Destination Microblock Stride Register */ }; =20 /* 64-bit alignment needed to update CNDA and CUBC registers in an atomic = way. */ From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2CD5C433F5 for ; Mon, 24 Jan 2022 19:07:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238439AbiAXTHp (ORCPT ); Mon, 24 Jan 2022 14:07:45 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:59964 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343931AbiAXTB0 (ORCPT ); Mon, 24 Jan 2022 14:01:26 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 748EB6090A; Mon, 24 Jan 2022 19:01:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 54F45C340E5; Mon, 24 Jan 2022 19:01:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050885; bh=wPbWj41fVhAncbHUubc2p8HpbyvviYRKFxe/qjP5LuY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=otbGtsh06I1ifYrHM5wbt/nwDcwqoZgG4JJeQpw0jO1EKQweMF9bYy6SrPhEsUJGD MHSVFflZJ366+vzB4pOSM6XdOlO0qRY4eZlPWDrHLRgO6w4RP5PTISO3OA4aRdDviN FLK4ARpHcrhhPmSBIwtIjwkG9zupHicgoJLgczTA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kevin Bracey , Eric Dumazet , Jiri Pirko , Vimalkumar , Jakub Kicinski Subject: [PATCH 4.9 142/157] net_sched: restore "mpu xxx" handling Date: Mon, 24 Jan 2022 19:43:52 +0100 Message-Id: <20220124183937.272967858@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kevin Bracey commit fb80445c438c78b40b547d12b8d56596ce4ccfeb upstream. commit 56b765b79e9a ("htb: improved accuracy at high rates") broke "overhead X", "linklayer atm" and "mpu X" attributes. "overhead X" and "linklayer atm" have already been fixed. This restores the "mpu X" handling, as might be used by DOCSIS or Ethernet shaping: tc class add ... htb rate X overhead 4 mpu 64 The code being fixed is used by htb, tbf and act_police. Cake has its own mpu handling. qdisc_calculate_pkt_len still uses the size table containing values adjusted for mpu by user space. iproute2 tc has always passed mpu into the kernel via a tc_ratespec structure, but the kernel never directly acted on it, merely stored it so that it could be read back by `tc class show`. Rather, tc would generate length-to-time tables that included the mpu (and linklayer) in their construction, and the kernel used those tables. Since v3.7, the tables were no longer used. Along with "mpu", this also broke "overhead" and "linklayer" which were fixed in 01cb71d2d47b ("net_sched: restore "overhead xxx" handling", v3.10) and 8a8e3d84b171 ("net_sched: restore "linklayer atm" handling", v3.11). "overhead" was fixed by simply restoring use of tc_ratespec::overhead - this had originally been used by the kernel but was initially omitted from the new non-table-based calculations. "linklayer" had been handled in the table like "mpu", but the mode was not originally passed in tc_ratespec. The new implementation was made to handle it by getting new versions of tc to pass the mode in an extended tc_ratespec, and for older versions of tc the table contents were analysed at load time to deduce linklayer. As "mpu" has always been given to the kernel in tc_ratespec, accompanying the mpu-based table, we can restore system functionality with no userspace change by making the kernel act on the tc_ratespec value. Fixes: 56b765b79e9a ("htb: improved accuracy at high rates") Signed-off-by: Kevin Bracey Cc: Eric Dumazet Cc: Jiri Pirko Cc: Vimalkumar Link: https://lore.kernel.org/r/20220112170210.1014351-1-kevin@bracey.fi Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- include/net/sch_generic.h | 5 +++++ net/sched/sch_generic.c | 1 + 2 files changed, 6 insertions(+) --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -837,6 +837,7 @@ struct psched_ratecfg { u64 rate_bytes_ps; /* bytes per second */ u32 mult; u16 overhead; + u16 mpu; u8 linklayer; u8 shift; }; @@ -846,6 +847,9 @@ static inline u64 psched_l2t_ns(const st { len +=3D r->overhead; =20 + if (len < r->mpu) + len =3D r->mpu; + if (unlikely(r->linklayer =3D=3D TC_LINKLAYER_ATM)) return ((u64)(DIV_ROUND_UP(len,48)*53) * r->mult) >> r->shift; =20 @@ -868,6 +872,7 @@ static inline void psched_ratecfg_getrat res->rate =3D min_t(u64, r->rate_bytes_ps, ~0U); =20 res->overhead =3D r->overhead; + res->mpu =3D r->mpu; res->linklayer =3D (r->linklayer & TC_LINKLAYER_MASK); } =20 --- a/net/sched/sch_generic.c +++ b/net/sched/sch_generic.c @@ -996,6 +996,7 @@ void psched_ratecfg_precompute(struct ps { memset(r, 0, sizeof(*r)); r->overhead =3D conf->overhead; + r->mpu =3D conf->mpu; r->rate_bytes_ps =3D max_t(u64, conf->rate, rate64); r->linklayer =3D (conf->linklayer & TC_LINKLAYER_MASK); r->mult =3D 1; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EFBB7C433F5 for ; Mon, 24 Jan 2022 19:16:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345571AbiAXTPi (ORCPT ); Mon, 24 Jan 2022 14:15:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46042 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344186AbiAXTHE (ORCPT ); Mon, 24 Jan 2022 14:07:04 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 31D5FC0613A2; Mon, 24 Jan 2022 11:01:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E3352B8123A; Mon, 24 Jan 2022 19:01:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34A16C340E7; Mon, 24 Jan 2022 19:01:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050888; bh=YUTWzpfM84kbMmvjPcm2uVWgAWQ4ZG//iF8VVxDS8X4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YaAuGLszN3hIfkMuMET5XXkJMn1dK/mZRXkmAodIeskjpKtTL6AgnL7Q2/fIq0RfI H+TRJbnBZZ4lg8MS5QmnVKqCzbaj8BYiJjLVp9lzi6W0/EnLnuEzdKSd2V6o1sxuBl 2sXqAGVsL06Uvl04FnW5rWUnJlsnoOvKjSJL2leE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Florian Fainelli , "David S. Miller" Subject: [PATCH 4.9 143/157] bcmgenet: add WOL IRQ check Date: Mon, 24 Jan 2022 19:43:53 +0100 Message-Id: <20220124183937.303853809@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sergey Shtylyov commit 9deb48b53e7f4056c2eaa2dc2ee3338df619e4f6 upstream. The driver neglects to check the result of platform_get_irq_optional()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL. Stop calling devm_request_irq() with the invalid IRQ #s. Fixes: 8562056f267d ("net: bcmgenet: request Wake-on-LAN interrupt") Signed-off-by: Sergey Shtylyov Acked-by: Florian Fainelli Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -3358,10 +3358,12 @@ static int bcmgenet_probe(struct platfor =20 /* Request the WOL interrupt and advertise suspend if available */ priv->wol_irq_disabled =3D true; - err =3D devm_request_irq(&pdev->dev, priv->wol_irq, bcmgenet_wol_isr, 0, - dev->name, priv); - if (!err) - device_set_wakeup_capable(&pdev->dev, 1); + if (priv->wol_irq > 0) { + err =3D devm_request_irq(&pdev->dev, priv->wol_irq, + bcmgenet_wol_isr, 0, dev->name, priv); + if (!err) + device_set_wakeup_capable(&pdev->dev, 1); + } =20 /* Set the needed headroom to account for any possible * features enabling/disabling at runtime From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48C7BC433FE for ; Mon, 24 Jan 2022 19:17:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237425AbiAXTR2 (ORCPT ); Mon, 24 Jan 2022 14:17:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46056 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346627AbiAXTHH (ORCPT ); Mon, 24 Jan 2022 14:07:07 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2F1F4C0613A7; Mon, 24 Jan 2022 11:01:33 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C7E13B8123A; Mon, 24 Jan 2022 19:01:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F2B01C36AF5; Mon, 24 Jan 2022 19:01:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050891; bh=4vD56yFlgUBC5atksTz50D4Z2EyBrU/6DhqxbVI8tNM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tqI8XLMtfrAdozpQ3AFu04cvQywJ1iXapoo7GOnmBfpuzljkxDoDaVnZfvXr9OfXj sVxAVVvToWpDik6CSyaWDGYh9GsS/ocTNbjyzYGqzRjOWZPV0c1UzhfX5Wz9mne7ey igMXE4toGqyH4nrsaZhyrUYlUiqQGj8HVKSGLoWw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Matthias Schiffer , Frank Rowand , Rob Herring Subject: [PATCH 4.9 144/157] scripts/dtc: dtx_diff: remove broken example from help text Date: Mon, 24 Jan 2022 19:43:54 +0100 Message-Id: <20220124183937.334059306@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Matthias Schiffer commit d8adf5b92a9d2205620874d498c39923ecea8749 upstream. dtx_diff suggests to use <(...) syntax to pipe two inputs into it, but this has never worked: The /proc/self/fds/... paths passed by the shell will fail the `[ -f "${dtx}" ] && [ -r "${dtx}" ]` check in compile_to_dts, but even with this check removed, the function cannot work: hexdump will eat up the DTB magic, making the subsequent dtc call fail, as a pipe cannot be rewound. Simply remove this broken example, as there is already an alternative one that works fine. Fixes: 10eadc253ddf ("dtc: create tool to diff device trees") Signed-off-by: Matthias Schiffer Reviewed-by: Frank Rowand Signed-off-by: Rob Herring Link: https://lore.kernel.org/r/20220113081918.10387-1-matthias.schiffer@ew= .tq-group.com Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- scripts/dtc/dtx_diff | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) --- a/scripts/dtc/dtx_diff +++ b/scripts/dtc/dtx_diff @@ -56,12 +56,8 @@ Otherwise DTx is treated as a dts source or '/include/' to be processed. =20 If DTx_1 and DTx_2 are in different architectures, then this script - may not work since \${ARCH} is part of the include path. Two possible - workarounds: - - `basename $0` \\ - <(ARCH=3Darch_of_dtx_1 `basename $0` DTx_1) \\ - <(ARCH=3Darch_of_dtx_2 `basename $0` DTx_2) + may not work since \${ARCH} is part of the include path. The following + workaround can be used: =20 `basename $0` ARCH=3Darch_of_dtx_1 DTx_1 >tmp_dtx_1.dts `basename $0` ARCH=3Darch_of_dtx_2 DTx_2 >tmp_dtx_2.dts From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9D45FC433F5 for ; Mon, 24 Jan 2022 19:09:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345313AbiAXTJC (ORCPT ); Mon, 24 Jan 2022 14:09:02 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:57424 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344292AbiAXTBh (ORCPT ); Mon, 24 Jan 2022 14:01:37 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 16B2AB8124C; Mon, 24 Jan 2022 19:01:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3B1DEC36AE3; Mon, 24 Jan 2022 19:01:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050894; bh=/WuAenPvtHoOYxe2cLjzMTFFnpRHp7Hh7oLwX6A9/98=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VEAExKlJK+BY8HbC0FnodvMf8jWneI4MD0q3Lh71/s2VY7c3ghZLS8ys8OKgAHLXa UNndaEtCOYLHyR8FG6M3MNf3YP4dh9+dVPtaBT6PO5f1meY0JHfrBXgg527N8uRDeM YR3JkVMbIMr/dQcB8UlhNwHd1KWBfa6oOWCTkzrI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , "David S. Miller" Subject: [PATCH 4.9 145/157] lib82596: Fix IRQ check in sni_82596_probe Date: Mon, 24 Jan 2022 19:43:55 +0100 Message-Id: <20220124183937.364307472@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin commit 99218cbf81bf21355a3de61cd46a706d36e900e6 upstream. platform_get_irq() returns negative error number instead 0 on failure. And the doc of platform_get_irq() provides a usage example: int irq =3D platform_get_irq(pdev, 0); if (irq < 0) return irq; Fix the check of return value to catch errors correctly. Fixes: 115978859272 ("i825xx: Move the Intel 82586/82593/82596 based driver= s") Signed-off-by: Miaoqian Lin Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/ethernet/i825xx/sni_82596.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/i825xx/sni_82596.c +++ b/drivers/net/ethernet/i825xx/sni_82596.c @@ -122,9 +122,10 @@ static int sni_82596_probe(struct platfo netdevice->dev_addr[5] =3D readb(eth_addr + 0x06); iounmap(eth_addr); =20 - if (!netdevice->irq) { + if (netdevice->irq < 0) { printk(KERN_ERR "%s: IRQ not found for i82596 at 0x%lx\n", __FILE__, netdevice->base_addr); + retval =3D netdevice->irq; goto probe_failed; } =20 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CC2FAC2BA4C for ; Mon, 24 Jan 2022 19:15:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348453AbiAXTPY (ORCPT ); Mon, 24 Jan 2022 14:15:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46098 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344287AbiAXTHN (ORCPT ); Mon, 24 Jan 2022 14:07:13 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D8612C061392; Mon, 24 Jan 2022 11:01:38 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 75A7B6090C; Mon, 24 Jan 2022 19:01:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 501F9C340E5; Mon, 24 Jan 2022 19:01:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050897; bh=yHlKqiWYbJ3A9vWSHABg/J4O7uW1sFkJ2uhDLitDFL4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WIcgbhXTZkFqCYxaRTDwiGi5BFKCo2uuoI77z3fKXWXDfe1nzoCGibeMnYpj46JXZ khnztYd+VD+JcqAeqW5kFICIN6sF1GTuy7k09G8uSURbJ6gIFpnKLx8f1z5nIUI5Pt 5kdnUCWqRtl9tx/81Zf54z6A/nHWIdnp5jHINC7U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Suren Baghdasaryan , Ben Hutchings Subject: [PATCH 4.9 146/157] Revert "gup: document and work around "COW can break either way" issue" Date: Mon, 24 Jan 2022 19:43:56 +0100 Message-Id: <20220124183937.393297919@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ben Hutchings This reverts commit 9bbd42e79720122334226afad9ddcac1c3e6d373, which was commit 17839856fd588f4ab6b789f482ed3ffd7c403e1f upstream. The backport was incorrect and incomplete: * It forced the write flag on in the generic __get_user_pages_fast(), whereas only get_user_pages_fast() was supposed to do that. * It only fixed the generic RCU-based implementation used by arm, arm64, and powerpc. Before Linux 4.13, several other architectures had their own implementations: mips, s390, sparc, sh, and x86. This will be followed by a (hopefully) correct backport. Signed-off-by: Ben Hutchings Cc: Suren Baghdasaryan Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- mm/gup.c | 48 ++++++++---------------------------------------- mm/huge_memory.c | 7 ++++--- 2 files changed, 12 insertions(+), 43 deletions(-) --- a/mm/gup.c +++ b/mm/gup.c @@ -61,22 +61,13 @@ static int follow_pfn_pte(struct vm_area } =20 /* - * FOLL_FORCE or a forced COW break can write even to unwritable pte's, - * but only after we've gone through a COW cycle and they are dirty. + * FOLL_FORCE can write to even unwritable pte's, but only + * after we've gone through a COW cycle and they are dirty. */ static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) { - return pte_write(pte) || ((flags & FOLL_COW) && pte_dirty(pte)); -} - -/* - * A (separate) COW fault might break the page the other way and - * get_user_pages() would return the page from what is now the wrong - * VM. So we need to force a COW break at GUP time even for reads. - */ -static inline bool should_force_cow_break(struct vm_area_struct *vma, unsi= gned int flags) -{ - return is_cow_mapping(vma->vm_flags) && (flags & FOLL_GET); + return pte_write(pte) || + ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); } =20 static struct page *follow_page_pte(struct vm_area_struct *vma, @@ -586,18 +577,12 @@ static long __get_user_pages(struct task if (!vma || check_vma_flags(vma, gup_flags)) return i ? : -EFAULT; if (is_vm_hugetlb_page(vma)) { - if (should_force_cow_break(vma, foll_flags)) - foll_flags |=3D FOLL_WRITE; i =3D follow_hugetlb_page(mm, vma, pages, vmas, &start, &nr_pages, i, - foll_flags); + gup_flags); continue; } } - - if (should_force_cow_break(vma, foll_flags)) - foll_flags |=3D FOLL_WRITE; - retry: /* * If we have a pending SIGKILL, don't keep faulting pages and @@ -1518,10 +1503,6 @@ static int gup_pud_range(pgd_t pgd, unsi /* * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall b= ack to * the regular GUP. It will only return non-negative values. - * - * Careful, careful! COW breaking can go either way, so a non-write - * access can get ambiguous page results. If you call this function without - * 'write' set, you'd better be sure that you're ok with that ambiguity. */ int __get_user_pages_fast(unsigned long start, int nr_pages, int write, struct page **pages) @@ -1551,12 +1532,6 @@ int __get_user_pages_fast(unsigned long * * We do not adopt an rcu_read_lock(.) here as we also want to * block IPIs that come from THPs splitting. - * - * NOTE! We allow read-only gup_fast() here, but you'd better be - * careful about possible COW pages. You'll get _a_ COW page, but - * not necessarily the one you intended to get depending on what - * COW event happens after this. COW may break the page copy in a - * random direction. */ =20 local_irq_save(flags); @@ -1567,22 +1542,15 @@ int __get_user_pages_fast(unsigned long next =3D pgd_addr_end(addr, end); if (pgd_none(pgd)) break; - /* - * The FAST_GUP case requires FOLL_WRITE even for pure reads, - * because get_user_pages() may need to cause an early COW in - * order to avoid confusing the normal COW routines. So only - * targets that are already writable are safe to do by just - * looking at the page tables. - */ if (unlikely(pgd_huge(pgd))) { - if (!gup_huge_pgd(pgd, pgdp, addr, next, 1, + if (!gup_huge_pgd(pgd, pgdp, addr, next, write, pages, &nr)) break; } else if (unlikely(is_hugepd(__hugepd(pgd_val(pgd))))) { if (!gup_huge_pd(__hugepd(pgd_val(pgd)), addr, - PGDIR_SHIFT, next, 1, pages, &nr)) + PGDIR_SHIFT, next, write, pages, &nr)) break; - } else if (!gup_pud_range(pgd, addr, next, 1, pages, &nr)) + } else if (!gup_pud_range(pgd, addr, next, write, pages, &nr)) break; } while (pgdp++, addr =3D next, addr !=3D end); local_irq_restore(flags); --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1135,12 +1135,13 @@ out_unlock: } =20 /* - * FOLL_FORCE or a forced COW break can write even to unwritable pmd's, - * but only after we've gone through a COW cycle and they are dirty. + * FOLL_FORCE can write to even unwritable pmd's, but only + * after we've gone through a COW cycle and they are dirty. */ static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags) { - return pmd_write(pmd) || ((flags & FOLL_COW) && pmd_dirty(pmd)); + return pmd_write(pmd) || + ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd)); } =20 struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6BDF7C4332F for ; Mon, 24 Jan 2022 19:21:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349257AbiAXTUa (ORCPT ); Mon, 24 Jan 2022 14:20:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47966 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347758AbiAXTLI (ORCPT ); Mon, 24 Jan 2022 14:11:08 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8F70CC08E86F; Mon, 24 Jan 2022 11:02:37 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 28B1FB81235; Mon, 24 Jan 2022 19:02:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 28823C340E5; Mon, 24 Jan 2022 19:02:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050954; bh=DWyQ42JRtDs5K2IVsSqF2J4Srzipab1SqKuJVt+Cix8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tcrV0nKOD0cLWuDkPivsBRQDtk0OASr5I5MEP/WCLnC1xlUcLK8wFi2tCcyF5F4od wsVMM7rF1kyLKnnkseOXyTRjZRRoR81UTBXqHmfqC2Cf0quHRKSArnJr/QPpiaCuAg RtbHtMKLdyqfwyGcZU/8xACfAO+yqfQcws34ZSI4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Jann Horn , Christoph Hellwig , Oleg Nesterov , Kirill Shutemov , Jan Kara , Andrea Arcangeli , Matthew Wilcox , Linus Torvalds , Suren Baghdasaryan , Ben Hutchings Subject: [PATCH 4.9 147/157] gup: document and work around "COW can break either way" issue Date: Mon, 24 Jan 2022 19:43:57 +0100 Message-Id: <20220124183937.429525904@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Torvalds commit 9bbd42e79720122334226afad9ddcac1c3e6d373 upstream. Doing a "get_user_pages()" on a copy-on-write page for reading can be ambiguous: the page can be COW'ed at any time afterwards, and the direction of a COW event isn't defined. Yes, whoever writes to it will generally do the COW, but if the thread that did the get_user_pages() unmapped the page before the write (and that could happen due to memory pressure in addition to any outright action), the writer could also just take over the old page instead. End result: the get_user_pages() call might result in a page pointer that is no longer associated with the original VM, and is associated with - and controlled by - another VM having taken it over instead. So when doing a get_user_pages() on a COW mapping, the only really safe thing to do would be to break the COW when getting the page, even when only getting it for reading. At the same time, some users simply don't even care. For example, the perf code wants to look up the page not because it cares about the page, but because the code simply wants to look up the physical address of the access for informational purposes, and doesn't really care about races when a page might be unmapped and remapped elsewhere. This adds logic to force a COW event by setting FOLL_WRITE on any copy-on-write mapping when FOLL_GET (or FOLL_PIN) is used to get a page pointer as a result. The current semantics end up being: - __get_user_pages_fast(): no change. If you don't ask for a write, you won't break COW. You'd better know what you're doing. - get_user_pages_fast(): the fast-case "look it up in the page tables without anything getting mmap_sem" now refuses to follow a read-only page, since it might need COW breaking. Which happens in the slow path - the fast path doesn't know if the memory might be COW or not. - get_user_pages() (including the slow-path fallback for gup_fast()): for a COW mapping, turn on FOLL_WRITE for FOLL_GET/FOLL_PIN, with very similar semantics to FOLL_FORCE. If it turns out that we want finer granularity (ie "only break COW when it might actually matter" - things like the zero page are special and don't need to be broken) we might need to push these semantics deeper into the lookup fault path. So if people care enough, it's possible that we might end up adding a new internal FOLL_BREAK_COW flag to go with the internal FOLL_COW flag we already have for tracking "I had a COW". Alternatively, if it turns out that different callers might want to explicitly control the forced COW break behavior, we might even want to make such a flag visible to the users of get_user_pages() instead of using the above default semantics. But for now, this is mostly commentary on the issue (this commit message being a lot bigger than the patch, and that patch in turn is almost all comments), with that minimal "enable COW breaking early" logic using the existing FOLL_WRITE behavior. [ It might be worth noting that we've always had this ambiguity, and it could arguably be seen as a user-space issue. You only get private COW mappings that could break either way in situations where user space is doing cooperative things (ie fork() before an execve() etc), but it _is_ surprising and very subtle, and fork() is supposed to give you independent address spaces. So let's treat this as a kernel issue and make the semantics of get_user_pages() easier to understand. Note that obviously a true shared mapping will still get a page that can change under us, so this does _not_ mean that get_user_pages() somehow returns any "stable" page ] [surenb: backport notes Replaced (gup_flags | FOLL_WRITE) with write=3D1 in gup_pgd_range. Removed FOLL_PIN usage in should_force_cow_break since it's missing in the earlier kernels.] Reported-by: Jann Horn Tested-by: Christoph Hellwig Acked-by: Oleg Nesterov Acked-by: Kirill Shutemov Acked-by: Jan Kara Cc: Andrea Arcangeli Cc: Matthew Wilcox Signed-off-by: Linus Torvalds [surenb: backport to 4.19 kernel] Cc: stable@vger.kernel.org # 4.19.x Signed-off-by: Suren Baghdasaryan Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 4.9: - Generic get_user_pages_fast() calls __get_user_pages_fast() here, so make it pass write=3D1 - Various architectures have their own implementations of get_user_pages_fast(), so apply the corresponding change there - Adjust context] Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- arch/mips/mm/gup.c | 9 ++++++++- arch/s390/mm/gup.c | 9 ++++++++- arch/sh/mm/gup.c | 9 ++++++++- arch/sparc/mm/gup.c | 9 ++++++++- arch/x86/mm/gup.c | 9 ++++++++- mm/gup.c | 44 ++++++++++++++++++++++++++++++++++++++------ mm/huge_memory.c | 7 +++---- 7 files changed, 81 insertions(+), 15 deletions(-) --- a/arch/mips/mm/gup.c +++ b/arch/mips/mm/gup.c @@ -271,7 +271,14 @@ int get_user_pages_fast(unsigned long st next =3D pgd_addr_end(addr, end); if (pgd_none(pgd)) goto slow; - if (!gup_pud_range(pgd, addr, next, write, pages, &nr)) + /* + * The FAST_GUP case requires FOLL_WRITE even for pure reads, + * because get_user_pages() may need to cause an early COW in + * order to avoid confusing the normal COW routines. So only + * targets that are already writable are safe to do by just + * looking at the page tables. + */ + if (!gup_pud_range(pgd, addr, next, 1, pages, &nr)) goto slow; } while (pgdp++, addr =3D next, addr !=3D end); local_irq_enable(); --- a/arch/s390/mm/gup.c +++ b/arch/s390/mm/gup.c @@ -261,7 +261,14 @@ int get_user_pages_fast(unsigned long st =20 might_sleep(); start &=3D PAGE_MASK; - nr =3D __get_user_pages_fast(start, nr_pages, write, pages); + /* + * The FAST_GUP case requires FOLL_WRITE even for pure reads, + * because get_user_pages() may need to cause an early COW in + * order to avoid confusing the normal COW routines. So only + * targets that are already writable are safe to do by just + * looking at the page tables. + */ + nr =3D __get_user_pages_fast(start, nr_pages, 1, pages); if (nr =3D=3D nr_pages) return nr; =20 --- a/arch/sh/mm/gup.c +++ b/arch/sh/mm/gup.c @@ -239,7 +239,14 @@ int get_user_pages_fast(unsigned long st next =3D pgd_addr_end(addr, end); if (pgd_none(pgd)) goto slow; - if (!gup_pud_range(pgd, addr, next, write, pages, &nr)) + /* + * The FAST_GUP case requires FOLL_WRITE even for pure reads, + * because get_user_pages() may need to cause an early COW in + * order to avoid confusing the normal COW routines. So only + * targets that are already writable are safe to do by just + * looking at the page tables. + */ + if (!gup_pud_range(pgd, addr, next, 1, pages, &nr)) goto slow; } while (pgdp++, addr =3D next, addr !=3D end); local_irq_enable(); --- a/arch/sparc/mm/gup.c +++ b/arch/sparc/mm/gup.c @@ -218,7 +218,14 @@ int get_user_pages_fast(unsigned long st next =3D pgd_addr_end(addr, end); if (pgd_none(pgd)) goto slow; - if (!gup_pud_range(pgd, addr, next, write, pages, &nr)) + /* + * The FAST_GUP case requires FOLL_WRITE even for pure reads, + * because get_user_pages() may need to cause an early COW in + * order to avoid confusing the normal COW routines. So only + * targets that are already writable are safe to do by just + * looking at the page tables. + */ + if (!gup_pud_range(pgd, addr, next, 1, pages, &nr)) goto slow; } while (pgdp++, addr =3D next, addr !=3D end); =20 --- a/arch/x86/mm/gup.c +++ b/arch/x86/mm/gup.c @@ -454,7 +454,14 @@ int get_user_pages_fast(unsigned long st next =3D pgd_addr_end(addr, end); if (pgd_none(pgd)) goto slow; - if (!gup_pud_range(pgd, addr, next, write, pages, &nr)) + /* + * The FAST_GUP case requires FOLL_WRITE even for pure reads, + * because get_user_pages() may need to cause an early COW in + * order to avoid confusing the normal COW routines. So only + * targets that are already writable are safe to do by just + * looking at the page tables. + */ + if (!gup_pud_range(pgd, addr, next, 1, pages, &nr)) goto slow; } while (pgdp++, addr =3D next, addr !=3D end); local_irq_enable(); --- a/mm/gup.c +++ b/mm/gup.c @@ -61,13 +61,22 @@ static int follow_pfn_pte(struct vm_area } =20 /* - * FOLL_FORCE can write to even unwritable pte's, but only - * after we've gone through a COW cycle and they are dirty. + * FOLL_FORCE or a forced COW break can write even to unwritable pte's, + * but only after we've gone through a COW cycle and they are dirty. */ static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) { - return pte_write(pte) || - ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); + return pte_write(pte) || ((flags & FOLL_COW) && pte_dirty(pte)); +} + +/* + * A (separate) COW fault might break the page the other way and + * get_user_pages() would return the page from what is now the wrong + * VM. So we need to force a COW break at GUP time even for reads. + */ +static inline bool should_force_cow_break(struct vm_area_struct *vma, unsi= gned int flags) +{ + return is_cow_mapping(vma->vm_flags) && (flags & FOLL_GET); } =20 static struct page *follow_page_pte(struct vm_area_struct *vma, @@ -577,12 +586,18 @@ static long __get_user_pages(struct task if (!vma || check_vma_flags(vma, gup_flags)) return i ? : -EFAULT; if (is_vm_hugetlb_page(vma)) { + if (should_force_cow_break(vma, foll_flags)) + foll_flags |=3D FOLL_WRITE; i =3D follow_hugetlb_page(mm, vma, pages, vmas, &start, &nr_pages, i, - gup_flags); + foll_flags); continue; } } + + if (should_force_cow_break(vma, foll_flags)) + foll_flags |=3D FOLL_WRITE; + retry: /* * If we have a pending SIGKILL, don't keep faulting pages and @@ -1503,6 +1518,10 @@ static int gup_pud_range(pgd_t pgd, unsi /* * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall b= ack to * the regular GUP. It will only return non-negative values. + * + * Careful, careful! COW breaking can go either way, so a non-write + * access can get ambiguous page results. If you call this function without + * 'write' set, you'd better be sure that you're ok with that ambiguity. */ int __get_user_pages_fast(unsigned long start, int nr_pages, int write, struct page **pages) @@ -1532,6 +1551,12 @@ int __get_user_pages_fast(unsigned long * * We do not adopt an rcu_read_lock(.) here as we also want to * block IPIs that come from THPs splitting. + * + * NOTE! We allow read-only gup_fast() here, but you'd better be + * careful about possible COW pages. You'll get _a_ COW page, but + * not necessarily the one you intended to get depending on what + * COW event happens after this. COW may break the page copy in a + * random direction. */ =20 local_irq_save(flags); @@ -1580,7 +1605,14 @@ int get_user_pages_fast(unsigned long st int nr, ret; =20 start &=3D PAGE_MASK; - nr =3D __get_user_pages_fast(start, nr_pages, write, pages); + /* + * The FAST_GUP case requires FOLL_WRITE even for pure reads, + * because get_user_pages() may need to cause an early COW in + * order to avoid confusing the normal COW routines. So only + * targets that are already writable are safe to do by just + * looking at the page tables. + */ + nr =3D __get_user_pages_fast(start, nr_pages, 1, pages); ret =3D nr; =20 if (nr < nr_pages) { --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1135,13 +1135,12 @@ out_unlock: } =20 /* - * FOLL_FORCE can write to even unwritable pmd's, but only - * after we've gone through a COW cycle and they are dirty. + * FOLL_FORCE or a forced COW break can write even to unwritable pmd's, + * but only after we've gone through a COW cycle and they are dirty. */ static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags) { - return pmd_write(pmd) || - ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd)); + return pmd_write(pmd) || ((flags & FOLL_COW) && pmd_dirty(pmd)); } =20 struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD672C433EF for ; Mon, 24 Jan 2022 19:08:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344404AbiAXTIa (ORCPT ); Mon, 24 Jan 2022 14:08:30 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:59026 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236937AbiAXTCJ (ORCPT ); Mon, 24 Jan 2022 14:02:09 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E0912B81215; Mon, 24 Jan 2022 19:02:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0089BC340E5; Mon, 24 Jan 2022 19:02:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050923; bh=peYOOlMTmm+OyUGHt8OuEe9VzQ3EpRYmy3uRyqu9rOU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DWpuKXSfr/zvOv7+w+e6zyTRDQPMEVsfzK+RfHLOHiiTHnVxwZlkhd4FjTldcGO5C 6qxpYXJ+sjJSmln4IP6SSTvDYRTuXRRrPgDZ/QakDvBYxGyR2rjcyrRCk+HGpc6iwe UkvF6duSfqcrPoVtkj8wrnEsMBW1N/cCwsL9Zb90= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Christian=20K=C3=B6nig?= , Dave Airlie , Ben Hutchings Subject: [PATCH 4.9 148/157] drm/ttm/nouveau: dont call tt destroy callback on alloc failure. Date: Mon, 24 Jan 2022 19:43:58 +0100 Message-Id: <20220124183937.461801402@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dave Airlie commit 5de5b6ecf97a021f29403aa272cb4e03318ef586 upstream. This is confusing, and from my reading of all the drivers only nouveau got this right. Just make the API act under driver control of it's own allocation failing, and don't call destroy, if the page table fails to create there is nothing to cleanup here. (I'm willing to believe I've missed something here, so please review deeply). Reviewed-by: Christian K=C3=B6nig Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20200728041736.20689-1-= airlied@gmail.com [bwh: Backported to 4.14: - Drop change in ttm_sg_tt_init() - Adjust context] Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/gpu/drm/nouveau/nouveau_sgdma.c | 9 +++------ drivers/gpu/drm/ttm/ttm_tt.c | 2 -- 2 files changed, 3 insertions(+), 8 deletions(-) --- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c +++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c @@ -105,12 +105,9 @@ nouveau_sgdma_create_ttm(struct ttm_bo_d else nvbe->ttm.ttm.func =3D &nv50_sgdma_backend; =20 - if (ttm_dma_tt_init(&nvbe->ttm, bdev, size, page_flags, dummy_read_page)) - /* - * A failing ttm_dma_tt_init() will call ttm_tt_destroy() - * and thus our nouveau_sgdma_destroy() hook, so we don't need - * to free nvbe here. - */ + if (ttm_dma_tt_init(&nvbe->ttm, bdev, size, page_flags, dummy_read_page))= { + kfree(nvbe); return NULL; + } return &nvbe->ttm.ttm; } --- a/drivers/gpu/drm/ttm/ttm_tt.c +++ b/drivers/gpu/drm/ttm/ttm_tt.c @@ -195,7 +195,6 @@ int ttm_tt_init(struct ttm_tt *ttm, stru =20 ttm_tt_alloc_page_directory(ttm); if (!ttm->pages) { - ttm_tt_destroy(ttm); pr_err("Failed allocating page table\n"); return -ENOMEM; } @@ -228,7 +227,6 @@ int ttm_dma_tt_init(struct ttm_dma_tt *t INIT_LIST_HEAD(&ttm_dma->pages_list); ttm_dma_tt_alloc_page_directory(ttm_dma); if (!ttm->pages) { - ttm_tt_destroy(ttm); pr_err("Failed allocating page table\n"); return -ENOMEM; } From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0EA97C433F5 for ; Tue, 25 Jan 2022 02:22:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3419945AbiAYCVo (ORCPT ); Mon, 24 Jan 2022 21:21:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46582 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345378AbiAXTJO (ORCPT ); Mon, 24 Jan 2022 14:09:14 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2B10C08C5C8; Mon, 24 Jan 2022 11:02:10 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4270B60B88; Mon, 24 Jan 2022 19:02:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2BF9CC340E5; Mon, 24 Jan 2022 19:02:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050929; bh=QCtmgIcGnpfCyyzcV5Uihv/WnmLZGb5ICQw+jPbJ7zQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lfOllt7y4kt6cl8JiDFcmBh3RD8gXxTYUNJid4Je3l8LtVJFw8MQ00QzYYEi8PemF RWrAZTJfj5801+6xC66HOENXaqLwlucRaorV+1gmCOMqzMJ3sL6hOhvJOIQVleG6K0 b/o9yiMOfRupgMoIlUwX3w7UgMNOqsclc44l2KHI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Spencer , Jim Gruen , "David S. Miller" , Ben Hutchings Subject: [PATCH 4.9 149/157] gianfar: simplify FCS handling and fix memory leak Date: Mon, 24 Jan 2022 19:43:59 +0100 Message-Id: <20220124183937.491196016@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andy Spencer commit d903ec77118c09f93a610b384d83a6df33a64fe6 upstream. Previously, buffer descriptors containing only the frame check sequence (FCS) were skipped and not added to the skb. However, the page reference count was still incremented, leading to a memory leak. Fixing this inside gfar_add_rx_frag() is difficult due to reserved memory handling and page reuse. Instead, move the FCS handling to gfar_process_frame() and trim off the FCS before passing the skb up the networking stack. Signed-off-by: Andy Spencer Signed-off-by: Jim Gruen Signed-off-by: David S. Miller Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- drivers/net/ethernet/freescale/gianfar.c | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-) --- a/drivers/net/ethernet/freescale/gianfar.c +++ b/drivers/net/ethernet/freescale/gianfar.c @@ -2939,29 +2939,17 @@ static bool gfar_add_rx_frag(struct gfar { int size =3D lstatus & BD_LENGTH_MASK; struct page *page =3D rxb->page; - bool last =3D !!(lstatus & BD_LFLAG(RXBD_LAST)); - - /* Remove the FCS from the packet length */ - if (last) - size -=3D ETH_FCS_LEN; =20 if (likely(first)) { skb_put(skb, size); } else { /* the last fragments' length contains the full frame length */ - if (last) + if (lstatus & BD_LFLAG(RXBD_LAST)) size -=3D skb->len; =20 - /* Add the last fragment if it contains something other than - * the FCS, otherwise drop it and trim off any part of the FCS - * that was already received. - */ - if (size > 0) - skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, - rxb->page_offset + RXBUF_ALIGNMENT, - size, GFAR_RXB_TRUESIZE); - else if (size < 0) - pskb_trim(skb, skb->len + size); + skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, + rxb->page_offset + RXBUF_ALIGNMENT, + size, GFAR_RXB_TRUESIZE); } =20 /* try reuse page */ @@ -3074,6 +3062,9 @@ static void gfar_process_frame(struct ne if (priv->padding) skb_pull(skb, priv->padding); =20 + /* Trim off the FCS */ + pskb_trim(skb, skb->len - ETH_FCS_LEN); + if (ndev->features & NETIF_F_RXCSUM) gfar_rx_checksum(skb, fcb); =20 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 392CFC433FE for ; Mon, 24 Jan 2022 19:08:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245009AbiAXTIf (ORCPT ); Mon, 24 Jan 2022 14:08:35 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:60844 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344517AbiAXTCP (ORCPT ); Mon, 24 Jan 2022 14:02:15 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9132B60BAD; Mon, 24 Jan 2022 19:02:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 468ACC340E5; Mon, 24 Jan 2022 19:02:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050933; bh=iWOkdgPCQQjl1CePs+iFke75cLkjFCy3GlkrB5GhPvY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sNqmBylp0bo4jKIcD+k2r49JSTlyIFdNWTKK6lT99xalI1NuUnxKcgBANkY5ieUPR WUFDExrpAaS+QifRXqAqIi/JCtaG1QmQNv7o4zWNnxokfhWnlQgOQQfXr+Hj1nbLw8 RPmziA0DJkiaRptE5l1SYGOMSIpOeMuWpfAsvtAQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Braun , "David S. Miller" , Ben Hutchings Subject: [PATCH 4.9 150/157] gianfar: fix jumbo packets+napi+rx overrun crash Date: Mon, 24 Jan 2022 19:44:00 +0100 Message-Id: <20220124183937.520465560@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Braun commit d8861bab48b6c1fc3cdbcab8ff9d1eaea43afe7f upstream. When using jumbo packets and overrunning rx queue with napi enabled, the following sequence is observed in gfar_add_rx_frag: | lstatus | | skb | t | lstatus, size, flags | first | len, data_len, *ptr | Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan ---+--------------------------------------+-------+-----------------------+ 13 | 18002348, 9032, INTERRUPT LAST | 0 | 9600, 8000, f554c12e | 12 | 10000640, 1600, INTERRUPT | 0 | 8000, 6400, f554c12e | 11 | 10000640, 1600, INTERRUPT | 0 | 6400, 4800, f554c12e | 10 | 10000640, 1600, INTERRUPT | 0 | 4800, 3200, f554c12e | 09 | 10000640, 1600, INTERRUPT | 0 | 3200, 1600, f554c12e | 08 | 14000640, 1600, INTERRUPT FIRST | 0 | 1600, 0, f554c12e | 07 | 14000640, 1600, INTERRUPT FIRST | 1 | 0, 0, f554c12e | 06 | 1c000080, 128, INTERRUPT LAST FIRST | 1 | 0, 0, abf3bd6e | 05 | 18002348, 9032, INTERRUPT LAST | 0 | 8000, 6400, c5a57780 | 04 | 10000640, 1600, INTERRUPT | 0 | 6400, 4800, c5a57780 | 03 | 10000640, 1600, INTERRUPT | 0 | 4800, 3200, c5a57780 | 02 | 10000640, 1600, INTERRUPT | 0 | 3200, 1600, c5a57780 | 01 | 10000640, 1600, INTERRUPT | 0 | 1600, 0, c5a57780 | 00 | 14000640, 1600, INTERRUPT FIRST | 1 | 0, 0, c5a57780 | So at t=3D7 a new packets is started but not finished, probably due to rx overrun - but rx overrun is not indicated in the flags. Instead a new packets starts at t=3D8. This results in skb->len to exceed size for the LA= ST fragment at t=3D13 and thus a negative fragment size added to the skb. This then crashes: kernel BUG at include/linux/skbuff.h:2277! Oops: Exception in kernel mode, sig: 5 [#1] ... NIP [c04689f4] skb_pull+0x2c/0x48 LR [c03f62ac] gfar_clean_rx_ring+0x2e4/0x844 Call Trace: [ec4bfd38] [c06a84c4] _raw_spin_unlock_irqrestore+0x60/0x7c (unreliable) [ec4bfda8] [c03f6a44] gfar_poll_rx_sq+0x48/0xe4 [ec4bfdc8] [c048d504] __napi_poll+0x54/0x26c [ec4bfdf8] [c048d908] net_rx_action+0x138/0x2c0 [ec4bfe68] [c06a8f34] __do_softirq+0x3a4/0x4fc [ec4bfed8] [c0040150] run_ksoftirqd+0x58/0x70 [ec4bfee8] [c0066ecc] smpboot_thread_fn+0x184/0x1cc [ec4bff08] [c0062718] kthread+0x140/0x144 [ec4bff38] [c0012350] ret_from_kernel_thread+0x14/0x1c This patch fixes this by checking for computed LAST fragment size, so a negative sized fragment is never added. In order to prevent the newer rx frame from getting corrupted, the FIRST flag is checked to discard the incomplete older frame. Signed-off-by: Michael Braun Signed-off-by: David S. Miller Cc: Ben Hutchings Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/freescale/gianfar.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) --- a/drivers/net/ethernet/freescale/gianfar.c +++ b/drivers/net/ethernet/freescale/gianfar.c @@ -2947,6 +2947,10 @@ static bool gfar_add_rx_frag(struct gfar if (lstatus & BD_LFLAG(RXBD_LAST)) size -=3D skb->len; =20 + WARN(size < 0, "gianfar: rx fragment size underflow"); + if (size < 0) + return false; + skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, rxb->page_offset + RXBUF_ALIGNMENT, size, GFAR_RXB_TRUESIZE); @@ -3108,6 +3112,17 @@ int gfar_clean_rx_ring(struct gfar_priv_ if (lstatus & BD_LFLAG(RXBD_EMPTY)) break; =20 + /* lost RXBD_LAST descriptor due to overrun */ + if (skb && + (lstatus & BD_LFLAG(RXBD_FIRST))) { + /* discard faulty buffer */ + dev_kfree_skb(skb); + skb =3D NULL; + rx_queue->stats.rx_dropped++; + + /* can continue normally */ + } + /* order rx buffer descriptor reads */ rmb(); =20 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30090C433EF for ; Tue, 25 Jan 2022 02:27:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420183AbiAYCXI (ORCPT ); Mon, 24 Jan 2022 21:23:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46604 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345731AbiAXTJS (ORCPT ); Mon, 24 Jan 2022 14:09:18 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D430C061359; Mon, 24 Jan 2022 11:02:17 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9FA9460E8D; Mon, 24 Jan 2022 19:02:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D289C340E5; Mon, 24 Jan 2022 19:02:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050936; bh=/21cnJbkG4LiQeLMdTF15F+v5kVgRMWcxYcW/eO6v+4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oQuYxTqezyjmotmt6jGWhRbtTdZBbyWREdV5ZMMcOO61LeIwCRWWOsy1FgpO8cwCW FnkDg6xnw0/r8Enr5U469CWDvr+RAvqjCQ5DhcrzfLQacJcEa9ts4b/rS1ZkdfPZ93 7PzVo9EzwNZXNtmhtlGVKvqBiJKQng4bkgQ6u2Tg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Paul Moore , syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com, "David S. Miller" , Ben Hutchings Subject: [PATCH 4.9 151/157] cipso,calipso: resolve a number of problems with the DOI refcounts Date: Mon, 24 Jan 2022 19:44:01 +0100 Message-Id: <20220124183937.549864875@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paul Moore commit ad5d07f4a9cd671233ae20983848874731102c08 upstream. The current CIPSO and CALIPSO refcounting scheme for the DOI definitions is a bit flawed in that we: 1. Don't correctly match gets/puts in netlbl_cipsov4_list(). 2. Decrement the refcount on each attempt to remove the DOI from the DOI list, only removing it from the list once the refcount drops to zero. This patch fixes these problems by adding the missing "puts" to netlbl_cipsov4_list() and introduces a more conventional, i.e. not-buggy, refcounting mechanism to the DOI definitions. Upon the addition of a DOI to the DOI list, it is initialized with a refcount of one, removing a DOI from the list removes it from the list and drops the refcount by one; "gets" and "puts" behave as expected with respect to refcounts, increasing and decreasing the DOI's refcount by one. Fixes: b1edeb102397 ("netlabel: Replace protocol/NetLabel linking with refr= erence counts") Fixes: d7cce01504a0 ("netlabel: Add support for removing a CALIPSO DOI.") Reported-by: syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com Signed-off-by: Paul Moore Signed-off-by: David S. Miller [bwh: Backported to 4.9: adjust context] Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- net/ipv4/cipso_ipv4.c | 11 +---------- net/ipv6/calipso.c | 14 +++++--------- net/netlabel/netlabel_cipso_v4.c | 3 +++ 3 files changed, 9 insertions(+), 19 deletions(-) --- a/net/ipv4/cipso_ipv4.c +++ b/net/ipv4/cipso_ipv4.c @@ -534,16 +534,10 @@ int cipso_v4_doi_remove(u32 doi, struct ret_val =3D -ENOENT; goto doi_remove_return; } - if (!atomic_dec_and_test(&doi_def->refcount)) { - spin_unlock(&cipso_v4_doi_list_lock); - ret_val =3D -EBUSY; - goto doi_remove_return; - } list_del_rcu(&doi_def->list); spin_unlock(&cipso_v4_doi_list_lock); =20 - cipso_v4_cache_invalidate(); - call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu); + cipso_v4_doi_putdef(doi_def); ret_val =3D 0; =20 doi_remove_return: @@ -600,9 +594,6 @@ void cipso_v4_doi_putdef(struct cipso_v4 =20 if (!atomic_dec_and_test(&doi_def->refcount)) return; - spin_lock(&cipso_v4_doi_list_lock); - list_del_rcu(&doi_def->list); - spin_unlock(&cipso_v4_doi_list_lock); =20 cipso_v4_cache_invalidate(); call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu); --- a/net/ipv6/calipso.c +++ b/net/ipv6/calipso.c @@ -97,6 +97,9 @@ struct calipso_map_cache_entry { =20 static struct calipso_map_cache_bkt *calipso_cache; =20 +static void calipso_cache_invalidate(void); +static void calipso_doi_putdef(struct calipso_doi *doi_def); + /* Label Mapping Cache Functions */ =20 @@ -458,15 +461,10 @@ static int calipso_doi_remove(u32 doi, s ret_val =3D -ENOENT; goto doi_remove_return; } - if (!atomic_dec_and_test(&doi_def->refcount)) { - spin_unlock(&calipso_doi_list_lock); - ret_val =3D -EBUSY; - goto doi_remove_return; - } list_del_rcu(&doi_def->list); spin_unlock(&calipso_doi_list_lock); =20 - call_rcu(&doi_def->rcu, calipso_doi_free_rcu); + calipso_doi_putdef(doi_def); ret_val =3D 0; =20 doi_remove_return: @@ -522,10 +520,8 @@ static void calipso_doi_putdef(struct ca =20 if (!atomic_dec_and_test(&doi_def->refcount)) return; - spin_lock(&calipso_doi_list_lock); - list_del_rcu(&doi_def->list); - spin_unlock(&calipso_doi_list_lock); =20 + calipso_cache_invalidate(); call_rcu(&doi_def->rcu, calipso_doi_free_rcu); } =20 --- a/net/netlabel/netlabel_cipso_v4.c +++ b/net/netlabel/netlabel_cipso_v4.c @@ -587,6 +587,7 @@ list_start: =20 break; } + cipso_v4_doi_putdef(doi_def); rcu_read_unlock(); =20 genlmsg_end(ans_skb, data); @@ -595,12 +596,14 @@ list_start: list_retry: /* XXX - this limit is a guesstimate */ if (nlsze_mult < 4) { + cipso_v4_doi_putdef(doi_def); rcu_read_unlock(); kfree_skb(ans_skb); nlsze_mult *=3D 2; goto list_start; } list_failure_lock: + cipso_v4_doi_putdef(doi_def); rcu_read_unlock(); list_failure: kfree_skb(ans_skb); From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4193EC433FE for ; Mon, 24 Jan 2022 19:08:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344990AbiAXTIr (ORCPT ); Mon, 24 Jan 2022 14:08:47 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:59202 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344401AbiAXTCU (ORCPT ); Mon, 24 Jan 2022 14:02:20 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1220660B77; Mon, 24 Jan 2022 19:02:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91827C340EA; Mon, 24 Jan 2022 19:02:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050939; bh=Twcu7HJqRbI05jHuCpGu4Sqgln0sqf2CeKVvVXdvOM4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=x/K45fPvO8cHuTDim/lvUR2zTiBXP77ssK9PJHRqIj66UF8GdN2PigYDdI4KO45T9 yixh8r/Hp+SSIy2nvcDAdkjZwS61+SOO+IA/5XPeip+mOAr9VhrNhup60M/ANPcE9I NVZolFbAXCNwIxRbHMoiBqrQIT6qIdKhQ4QB1BdA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Davidlohr Bueso , Jan Kara , "Peter Zijlstra (Intel)" , Andrew Morton , Linus Torvalds , Ben Hutchings Subject: [PATCH 4.9 152/157] rbtree: cache leftmost node internally Date: Mon, 24 Jan 2022 19:44:02 +0100 Message-Id: <20220124183937.581136702@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Davidlohr Bueso commit cd9e61ed1eebbcd5dfad59475d41ec58d9b64b6a upstream. Patch series "rbtree: Cache leftmost node internally", v4. A series to extending rbtrees to internally cache the leftmost node such that we can have fast overlap check optimization for all interval tree users[1]. The benefits of this series are that: (i) Unify users that do internal leftmost node caching. (ii) Optimize all interval tree users. (iii) Convert at least two new users (epoll and procfs) to the new interfac= e. This patch (of 16): Red-black tree semantics imply that nodes with smaller or greater (or equal for duplicates) keys always be to the left and right, respectively. For the kernel this is extremely evident when considering our rb_first() semantics. Enabling lookups for the smallest node in the tree in O(1) can save a good chunk of cycles in not having to walk down the tree each time. To this end there are a few core users that explicitly do this, such as the scheduler and rtmutexes. There is also the desire for interval trees to have this optimization allowing faster overlap checking. This patch introduces a new 'struct rb_root_cached' which is just the root with a cached pointer to the leftmost node. The reason why the regular rb_root was not extended instead of adding a new structure was that this allows the user to have the choice between memory footprint and actual tree performance. The new wrappers on top of the regular rb_root calls are: - rb_first_cached(cached_root) -- which is a fast replacement for rb_first. - rb_insert_color_cached(node, cached_root, new) - rb_erase_cached(node, cached_root) In addition, augmented cached interfaces are also added for basic insertion and deletion operations; which becomes important for the interval tree changes. With the exception of the inserts, which adds a bool for updating the new leftmost, the interfaces are kept the same. To this end, porting rb users to the cached version becomes really trivial, and keeping current rbtree semantics for users that don't care about the optimization requires zero overhead. Link: http://lkml.kernel.org/r/20170719014603.19029-2-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Jan Kara Acked-by: Peter Zijlstra (Intel) Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- Documentation/rbtree.txt | 33 +++++++++++++++++++++++++++++++++ include/linux/rbtree.h | 21 +++++++++++++++++++++ include/linux/rbtree_augmented.h | 33 ++++++++++++++++++++++++++++++--- lib/rbtree.c | 34 +++++++++++++++++++++++++++++----- 4 files changed, 113 insertions(+), 8 deletions(-) --- a/Documentation/rbtree.txt +++ b/Documentation/rbtree.txt @@ -190,6 +190,39 @@ Example: for (node =3D rb_first(&mytree); node; node =3D rb_next(node)) printk("key=3D%s\n", rb_entry(node, struct mytype, node)->keystring); =20 +Cached rbtrees +-------------- + +Computing the leftmost (smallest) node is quite a common task for binary +search trees, such as for traversals or users relying on a the particular +order for their own logic. To this end, users can use 'struct rb_root_cach= ed' +to optimize O(logN) rb_first() calls to a simple pointer fetch avoiding +potentially expensive tree iterations. This is done at negligible runtime +overhead for maintanence; albeit larger memory footprint. + +Similar to the rb_root structure, cached rbtrees are initialized to be +empty via: + + struct rb_root_cached mytree =3D RB_ROOT_CACHED; + +Cached rbtree is simply a regular rb_root with an extra pointer to cache t= he +leftmost node. This allows rb_root_cached to exist wherever rb_root does, +which permits augmented trees to be supported as well as only a few extra +interfaces: + + struct rb_node *rb_first_cached(struct rb_root_cached *tree); + void rb_insert_color_cached(struct rb_node *, struct rb_root_cached *, b= ool); + void rb_erase_cached(struct rb_node *node, struct rb_root_cached *); + +Both insert and erase calls have their respective counterpart of augmented +trees: + + void rb_insert_augmented_cached(struct rb_node *node, struct rb_root_cac= hed *, + bool, struct rb_augment_callbacks *); + void rb_erase_augmented_cached(struct rb_node *, struct rb_root_cached *, + struct rb_augment_callbacks *); + + Support for Augmented rbtrees ----------------------------- =20 --- a/include/linux/rbtree.h +++ b/include/linux/rbtree.h @@ -44,10 +44,25 @@ struct rb_root { struct rb_node *rb_node; }; =20 +/* + * Leftmost-cached rbtrees. + * + * We do not cache the rightmost node based on footprint + * size vs number of potential users that could benefit + * from O(1) rb_last(). Just not worth it, users that want + * this feature can always implement the logic explicitly. + * Furthermore, users that want to cache both pointers may + * find it a bit asymmetric, but that's ok. + */ +struct rb_root_cached { + struct rb_root rb_root; + struct rb_node *rb_leftmost; +}; =20 #define rb_parent(r) ((struct rb_node *)((r)->__rb_parent_color & ~3)) =20 #define RB_ROOT (struct rb_root) { NULL, } +#define RB_ROOT_CACHED (struct rb_root_cached) { {NULL, }, NULL } #define rb_entry(ptr, type, member) container_of(ptr, type, member) =20 #define RB_EMPTY_ROOT(root) (READ_ONCE((root)->rb_node) =3D=3D NULL) @@ -69,6 +84,12 @@ extern struct rb_node *rb_prev(const str extern struct rb_node *rb_first(const struct rb_root *); extern struct rb_node *rb_last(const struct rb_root *); =20 +extern void rb_insert_color_cached(struct rb_node *, + struct rb_root_cached *, bool); +extern void rb_erase_cached(struct rb_node *node, struct rb_root_cached *); +/* Same as rb_first(), but O(1) */ +#define rb_first_cached(root) (root)->rb_leftmost + /* Postorder iteration - always visit the parent after its children */ extern struct rb_node *rb_first_postorder(const struct rb_root *); extern struct rb_node *rb_next_postorder(const struct rb_node *); --- a/include/linux/rbtree_augmented.h +++ b/include/linux/rbtree_augmented.h @@ -41,7 +41,9 @@ struct rb_augment_callbacks { void (*rotate)(struct rb_node *old, struct rb_node *new); }; =20 -extern void __rb_insert_augmented(struct rb_node *node, struct rb_root *ro= ot, +extern void __rb_insert_augmented(struct rb_node *node, + struct rb_root *root, + bool newleft, struct rb_node **leftmost, void (*augment_rotate)(struct rb_node *old, struct rb_node *new)); /* * Fixup the rbtree and update the augmented information when rebalancing. @@ -57,7 +59,16 @@ static inline void rb_insert_augmented(struct rb_node *node, struct rb_root *root, const struct rb_augment_callbacks *augment) { - __rb_insert_augmented(node, root, augment->rotate); + __rb_insert_augmented(node, root, false, NULL, augment->rotate); +} + +static inline void +rb_insert_augmented_cached(struct rb_node *node, + struct rb_root_cached *root, bool newleft, + const struct rb_augment_callbacks *augment) +{ + __rb_insert_augmented(node, &root->rb_root, + newleft, &root->rb_leftmost, augment->rotate); } =20 #define RB_DECLARE_CALLBACKS(rbstatic, rbname, rbstruct, rbfield, \ @@ -148,6 +159,7 @@ extern void __rb_erase_color(struct rb_n =20 static __always_inline struct rb_node * __rb_erase_augmented(struct rb_node *node, struct rb_root *root, + struct rb_node **leftmost, const struct rb_augment_callbacks *augment) { struct rb_node *child =3D node->rb_right; @@ -155,6 +167,9 @@ __rb_erase_augmented(struct rb_node *nod struct rb_node *parent, *rebalance; unsigned long pc; =20 + if (leftmost && node =3D=3D *leftmost) + *leftmost =3D rb_next(node); + if (!tmp) { /* * Case 1: node to erase has no more than 1 child (easy!) @@ -254,9 +269,21 @@ static __always_inline void rb_erase_augmented(struct rb_node *node, struct rb_root *root, const struct rb_augment_callbacks *augment) { - struct rb_node *rebalance =3D __rb_erase_augmented(node, root, augment); + struct rb_node *rebalance =3D __rb_erase_augmented(node, root, + NULL, augment); if (rebalance) __rb_erase_color(rebalance, root, augment->rotate); } =20 +static __always_inline void +rb_erase_augmented_cached(struct rb_node *node, struct rb_root_cached *roo= t, + const struct rb_augment_callbacks *augment) +{ + struct rb_node *rebalance =3D __rb_erase_augmented(node, &root->rb_root, + &root->rb_leftmost, + augment); + if (rebalance) + __rb_erase_color(rebalance, &root->rb_root, augment->rotate); +} + #endif /* _LINUX_RBTREE_AUGMENTED_H */ --- a/lib/rbtree.c +++ b/lib/rbtree.c @@ -95,10 +95,14 @@ __rb_rotate_set_parents(struct rb_node * =20 static __always_inline void __rb_insert(struct rb_node *node, struct rb_root *root, + bool newleft, struct rb_node **leftmost, void (*augment_rotate)(struct rb_node *old, struct rb_node *new)) { struct rb_node *parent =3D rb_red_parent(node), *gparent, *tmp; =20 + if (newleft) + *leftmost =3D node; + while (true) { /* * Loop invariant: node is red @@ -417,19 +421,38 @@ static const struct rb_augment_callbacks =20 void rb_insert_color(struct rb_node *node, struct rb_root *root) { - __rb_insert(node, root, dummy_rotate); + __rb_insert(node, root, false, NULL, dummy_rotate); } EXPORT_SYMBOL(rb_insert_color); =20 void rb_erase(struct rb_node *node, struct rb_root *root) { struct rb_node *rebalance; - rebalance =3D __rb_erase_augmented(node, root, &dummy_callbacks); + rebalance =3D __rb_erase_augmented(node, root, + NULL, &dummy_callbacks); if (rebalance) ____rb_erase_color(rebalance, root, dummy_rotate); } EXPORT_SYMBOL(rb_erase); =20 +void rb_insert_color_cached(struct rb_node *node, + struct rb_root_cached *root, bool leftmost) +{ + __rb_insert(node, &root->rb_root, leftmost, + &root->rb_leftmost, dummy_rotate); +} +EXPORT_SYMBOL(rb_insert_color_cached); + +void rb_erase_cached(struct rb_node *node, struct rb_root_cached *root) +{ + struct rb_node *rebalance; + rebalance =3D __rb_erase_augmented(node, &root->rb_root, + &root->rb_leftmost, &dummy_callbacks); + if (rebalance) + ____rb_erase_color(rebalance, &root->rb_root, dummy_rotate); +} +EXPORT_SYMBOL(rb_erase_cached); + /* * Augmented rbtree manipulation functions. * @@ -438,9 +461,10 @@ EXPORT_SYMBOL(rb_erase); */ =20 void __rb_insert_augmented(struct rb_node *node, struct rb_root *root, + bool newleft, struct rb_node **leftmost, void (*augment_rotate)(struct rb_node *old, struct rb_node *new)) { - __rb_insert(node, root, augment_rotate); + __rb_insert(node, root, newleft, leftmost, augment_rotate); } EXPORT_SYMBOL(__rb_insert_augmented); =20 @@ -485,7 +509,7 @@ struct rb_node *rb_next(const struct rb_ * as we can. */ if (node->rb_right) { - node =3D node->rb_right;=20 + node =3D node->rb_right; while (node->rb_left) node=3Dnode->rb_left; return (struct rb_node *)node; @@ -517,7 +541,7 @@ struct rb_node *rb_prev(const struct rb_ * as we can. */ if (node->rb_left) { - node =3D node->rb_left;=20 + node =3D node->rb_left; while (node->rb_right) node=3Dnode->rb_right; return (struct rb_node *)node; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67E4EC433EF for ; Mon, 24 Jan 2022 19:08:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344428AbiAXTIn (ORCPT ); Mon, 24 Jan 2022 14:08:43 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:32836 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237110AbiAXTCX (ORCPT ); Mon, 24 Jan 2022 14:02:23 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 353D260BFB; Mon, 24 Jan 2022 19:02:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0C3D5C340E5; Mon, 24 Jan 2022 19:02:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050942; bh=TpG7FVjmqICJYubPQPE/JrnyvkEd1i2n0LOWSOYT5vM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0g3rHd0qiKXPaWCF3wZwW5HuS2+oZz/P+aqB6VjFO/1Br6hm1A/BhrCYg6bhgZKlh jRV7ywqDGtYygjAAum8eYBI9ZJ1TescR6d4f/9hb3f2SbSJq7x+Xw394aEqYL0HDHT rd+11hZ0DaeqbQK+zvuh7uYDeOA48bzH3KSquxTM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Davidlohr Bueso , Thomas Gleixner , Ben Hutchings Subject: [PATCH 4.9 153/157] lib/timerqueue: Rely on rbtree semantics for next timer Date: Mon, 24 Jan 2022 19:44:03 +0100 Message-Id: <20220124183937.610181088@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Davidlohr Bueso commit 511885d7061eda3eb1faf3f57dcc936ff75863f1 upstream. Simplify the timerqueue code by using cached rbtrees and rely on the tree leftmost node semantics to get the timer with earliest expiration time. This is a drop in conversion, and therefore semantics remain untouched. The runtime overhead of cached rbtrees is be pretty much the same as the current head->next method, noting that when removing the leftmost node, a common operation for the timerqueue, the rb_next(leftmost) is O(1) as well, so the next timer will either be the right node or its parent. Therefore no extra pointer chasing. Finally, the size of the struct timerqueue_head remains the same. Passes several hours of rcutorture. Signed-off-by: Davidlohr Bueso Signed-off-by: Thomas Gleixner Link: https://lkml.kernel.org/r/20190724152323.bojciei3muvfxalm@linux-r8p5 [bwh: While this was supposed to be just refactoring, it also fixed a security flaw (CVE-2021-20317). Backported to 4.9: - Deleted code in timerqueue_del() is different before commit d852d39432f5 "timerqueue: Use rb_entry_safe() instead of open-coding it" - Adjust context] Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- include/linux/timerqueue.h | 13 ++++++------- lib/timerqueue.c | 31 ++++++++++++------------------- 2 files changed, 18 insertions(+), 26 deletions(-) --- a/include/linux/timerqueue.h +++ b/include/linux/timerqueue.h @@ -11,8 +11,7 @@ struct timerqueue_node { }; =20 struct timerqueue_head { - struct rb_root head; - struct timerqueue_node *next; + struct rb_root_cached rb_root; }; =20 =20 @@ -28,13 +27,14 @@ extern struct timerqueue_node *timerqueu * * @head: head of timerqueue * - * Returns a pointer to the timer node that has the - * earliest expiration time. + * Returns a pointer to the timer node that has the earliest expiration ti= me. */ static inline struct timerqueue_node *timerqueue_getnext(struct timerqueue_head *head) { - return head->next; + struct rb_node *leftmost =3D rb_first_cached(&head->rb_root); + + return rb_entry(leftmost, struct timerqueue_node, node); } =20 static inline void timerqueue_init(struct timerqueue_node *node) @@ -44,7 +44,6 @@ static inline void timerqueue_init(struc =20 static inline void timerqueue_init_head(struct timerqueue_head *head) { - head->head =3D RB_ROOT; - head->next =3D NULL; + head->rb_root =3D RB_ROOT_CACHED; } #endif /* _LINUX_TIMERQUEUE_H */ --- a/lib/timerqueue.c +++ b/lib/timerqueue.c @@ -38,9 +38,10 @@ */ bool timerqueue_add(struct timerqueue_head *head, struct timerqueue_node *= node) { - struct rb_node **p =3D &head->head.rb_node; + struct rb_node **p =3D &head->rb_root.rb_root.rb_node; struct rb_node *parent =3D NULL; - struct timerqueue_node *ptr; + struct timerqueue_node *ptr; + bool leftmost =3D true; =20 /* Make sure we don't add nodes that are already added */ WARN_ON_ONCE(!RB_EMPTY_NODE(&node->node)); @@ -48,19 +49,17 @@ bool timerqueue_add(struct timerqueue_he while (*p) { parent =3D *p; ptr =3D rb_entry(parent, struct timerqueue_node, node); - if (node->expires.tv64 < ptr->expires.tv64) + if (node->expires.tv64 < ptr->expires.tv64) { p =3D &(*p)->rb_left; - else + } else { p =3D &(*p)->rb_right; + leftmost =3D false; + } } rb_link_node(&node->node, parent, p); - rb_insert_color(&node->node, &head->head); + rb_insert_color_cached(&node->node, &head->rb_root, leftmost); =20 - if (!head->next || node->expires.tv64 < head->next->expires.tv64) { - head->next =3D node; - return true; - } - return false; + return leftmost; } EXPORT_SYMBOL_GPL(timerqueue_add); =20 @@ -76,16 +75,10 @@ bool timerqueue_del(struct timerqueue_he { WARN_ON_ONCE(RB_EMPTY_NODE(&node->node)); =20 - /* update next pointer */ - if (head->next =3D=3D node) { - struct rb_node *rbn =3D rb_next(&node->node); - - head->next =3D rbn ? - rb_entry(rbn, struct timerqueue_node, node) : NULL; - } - rb_erase(&node->node, &head->head); + rb_erase_cached(&node->node, &head->rb_root); RB_CLEAR_NODE(&node->node); - return head->next !=3D NULL; + + return !RB_EMPTY_ROOT(&head->rb_root.rb_root); } EXPORT_SYMBOL_GPL(timerqueue_del); =20 From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DE557C433FE for ; Tue, 25 Jan 2022 02:28:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S3420498AbiAYCYe (ORCPT ); Mon, 24 Jan 2022 21:24:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47376 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347571AbiAXTKs (ORCPT ); Mon, 24 Jan 2022 14:10:48 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4F310C03463E; Mon, 24 Jan 2022 11:02:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 15B05B8122C; Mon, 24 Jan 2022 19:02:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E62E0C340E7; Mon, 24 Jan 2022 19:02:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050945; bh=mDE0ClwtW2O8lpRVSIOlJWKWc50OV1v0NEJkz0QeRIo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WBO2fUWI5QVLmkMnxzk2Rl3mbMILm3H4QLVtRZvApSgxnYXZd6WtgUp/CG2aq6wff FMMqWLqwHqjIZdjX80zMvGP6ig0dHOmGp/jck7T3iDRsTGmB3QnlEPpCr4IkbTzdsN EgXYiLaghwlFjpopGjIauGrXhhOC+8HwbMYLZNqg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Ross Zwisler , Dave Hansen , Alexander Viro , Christoph Hellwig , Dan Williams , Dave Chinner , Jan Kara , Matthew Wilcox , Andrew Morton , Linus Torvalds , Ben Hutchings Subject: [PATCH 4.9 154/157] mm: add follow_pte_pmd() Date: Mon, 24 Jan 2022 19:44:04 +0100 Message-Id: <20220124183937.642327629@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ross Zwisler commit 097963959594c5eccaba42510f7033f703211bda upstream. Patch series "Write protect DAX PMDs in *sync path". Currently dax_mapping_entry_mkclean() fails to clean and write protect the pmd_t of a DAX PMD entry during an *sync operation. This can result in data loss, as detailed in patch 2. This series is based on Dan's "libnvdimm-pending" branch, which is the current home for Jan's "dax: Page invalidation fixes" series. You can find a working tree here: https://git.kernel.org/cgit/linux/kernel/git/zwisler/linux.git/log/?h=3Dd= ax_pmd_clean This patch (of 2): Similar to follow_pte(), follow_pte_pmd() allows either a PTE leaf or a huge page PMD leaf to be found and returned. Link: http://lkml.kernel.org/r/1482272586-21177-2-git-send-email-ross.zwisl= er@linux.intel.com Signed-off-by: Ross Zwisler Suggested-by: Dave Hansen Cc: Alexander Viro Cc: Christoph Hellwig Cc: Dan Williams Cc: Dave Chinner Cc: Jan Kara Cc: Matthew Wilcox Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds [bwh: Backported to 4.9: adjust context] Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- include/linux/mm.h | 2 ++ mm/memory.c | 37 ++++++++++++++++++++++++++++++------- 2 files changed, 32 insertions(+), 7 deletions(-) --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1269,6 +1269,8 @@ int copy_page_range(struct mm_struct *ds struct vm_area_struct *vma); void unmap_mapping_range(struct address_space *mapping, loff_t const holebegin, loff_t const holelen, int even_cows); +int follow_pte_pmd(struct mm_struct *mm, unsigned long address, + pte_t **ptepp, pmd_t **pmdpp, spinlock_t **ptlp); int follow_pfn(struct vm_area_struct *vma, unsigned long address, unsigned long *pfn); int follow_phys(struct vm_area_struct *vma, unsigned long address, --- a/mm/memory.c +++ b/mm/memory.c @@ -3780,8 +3780,8 @@ int __pmd_alloc(struct mm_struct *mm, pu } #endif /* __PAGETABLE_PMD_FOLDED */ =20 -static int __follow_pte(struct mm_struct *mm, unsigned long address, - pte_t **ptepp, spinlock_t **ptlp) +static int __follow_pte_pmd(struct mm_struct *mm, unsigned long address, + pte_t **ptepp, pmd_t **pmdpp, spinlock_t **ptlp) { pgd_t *pgd; pud_t *pud; @@ -3798,11 +3798,20 @@ static int __follow_pte(struct mm_struct =20 pmd =3D pmd_offset(pud, address); VM_BUG_ON(pmd_trans_huge(*pmd)); - if (pmd_none(*pmd) || unlikely(pmd_bad(*pmd))) - goto out; =20 - /* We cannot handle huge page PFN maps. Luckily they don't exist. */ - if (pmd_huge(*pmd)) + if (pmd_huge(*pmd)) { + if (!pmdpp) + goto out; + + *ptlp =3D pmd_lock(mm, pmd); + if (pmd_huge(*pmd)) { + *pmdpp =3D pmd; + return 0; + } + spin_unlock(*ptlp); + } + + if (pmd_none(*pmd) || unlikely(pmd_bad(*pmd))) goto out; =20 ptep =3D pte_offset_map_lock(mm, pmd, address, ptlp); @@ -3825,9 +3834,23 @@ static inline int follow_pte(struct mm_s =20 /* (void) is needed to make gcc happy */ (void) __cond_lock(*ptlp, - !(res =3D __follow_pte(mm, address, ptepp, ptlp))); + !(res =3D __follow_pte_pmd(mm, address, ptepp, NULL, + ptlp))); + return res; +} + +int follow_pte_pmd(struct mm_struct *mm, unsigned long address, + pte_t **ptepp, pmd_t **pmdpp, spinlock_t **ptlp) +{ + int res; + + /* (void) is needed to make gcc happy */ + (void) __cond_lock(*ptlp, + !(res =3D __follow_pte_pmd(mm, address, ptepp, pmdpp, + ptlp))); return res; } +EXPORT_SYMBOL(follow_pte_pmd); =20 /** * follow_pfn - look up PFN at a user virtual address From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4249CC433EF for ; Mon, 24 Jan 2022 19:08:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345248AbiAXTIy (ORCPT ); Mon, 24 Jan 2022 14:08:54 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:59288 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345003AbiAXTCb (ORCPT ); Mon, 24 Jan 2022 14:02:31 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2A3A1B8122C; Mon, 24 Jan 2022 19:02:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 36388C340E7; Mon, 24 Jan 2022 19:02:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050948; bh=QaK4PqTesDZysa0f8zUBvmQkPai+vOO0lmowdkVMUL0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=o2Eb4J0eLdwaZfd2Ns5P2lNx43B5GVA9lI7+2eUYpl6e4ceeM3kcG8tPsEAHQRYhJ hOHUwAvOZRELv3FaNi3Jso6S1NWQVlu9GVnY0OXZEm0bCuOsaE3yFFC+tgJFotAM0T gpy8UCjn4UnI6ANhW66vxygr5EVkStSfMT2yVFUc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , David Stevens , 3pvd@google.com, Jann Horn , Jason Gunthorpe , Paolo Bonzini , Ovidiu Panait , Ben Hutchings Subject: [PATCH 4.9 155/157] KVM: do not assume PTE is writable after follow_pfn Date: Mon, 24 Jan 2022 19:44:05 +0100 Message-Id: <20220124183937.673291168@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paolo Bonzini commit bd2fae8da794b55bf2ac02632da3a151b10e664c upstream. In order to convert an HVA to a PFN, KVM usually tries to use the get_user_pages family of functinso. This however is not possible for VM_IO vmas; in that case, KVM instead uses follow_pfn. In doing this however KVM loses the information on whether the PFN is writable. That is usually not a problem because the main use of VM_IO vmas with KVM is for BARs in PCI device assignment, however it is a bug. To fix it, use follow_pte and check pte_write while under the protection of the PTE lock. The information can be used to fail hva_to_pfn_remapped or passed back to the caller via *writable. Usage of follow_pfn was introduced in commit add6a0cd1c5b ("KVM: MMU: try t= o fix up page faults before giving up", 2016-07-05); however, even older version have the same issue, all the way back to commit 2e2e3738af33 ("KVM: Handle vma regions with no backing page", 2008-07-20), as they also did not check whether the PFN was writable. Fixes: 2e2e3738af33 ("KVM: Handle vma regions with no backing page") Reported-by: David Stevens Cc: 3pvd@google.com Cc: Jann Horn Cc: Jason Gunthorpe Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini [OP: backport to 4.19, adjust follow_pte() -> follow_pte_pmd()] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman [bwh: Backport to 4.9: follow_pte_pmd() does not take start or end parameters] Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- virt/kvm/kvm_main.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1519,9 +1519,11 @@ static int hva_to_pfn_remapped(struct vm kvm_pfn_t *p_pfn) { unsigned long pfn; + pte_t *ptep; + spinlock_t *ptl; int r; =20 - r =3D follow_pfn(vma, addr, &pfn); + r =3D follow_pte_pmd(vma->vm_mm, addr, &ptep, NULL, &ptl); if (r) { /* * get_user_pages fails for VM_IO and VM_PFNMAP vmas and does @@ -1536,14 +1538,19 @@ static int hva_to_pfn_remapped(struct vm if (r) return r; =20 - r =3D follow_pfn(vma, addr, &pfn); + r =3D follow_pte_pmd(vma->vm_mm, addr, &ptep, NULL, &ptl); if (r) return r; + } =20 + if (write_fault && !pte_write(*ptep)) { + pfn =3D KVM_PFN_ERR_RO_FAULT; + goto out; } =20 if (writable) - *writable =3D true; + *writable =3D pte_write(*ptep); + pfn =3D pte_pfn(*ptep); =20 /* * Get a reference here because callers of *hva_to_pfn* and @@ -1558,6 +1565,8 @@ static int hva_to_pfn_remapped(struct vm */=20 kvm_get_pfn(pfn); =20 +out: + pte_unmap_unlock(ptep, ptl); *p_pfn =3D pfn; return 0; } From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 847A7C35268 for ; Mon, 24 Jan 2022 19:21:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349291AbiAXTUc (ORCPT ); Mon, 24 Jan 2022 14:20:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47444 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347729AbiAXTLG (ORCPT ); Mon, 24 Jan 2022 14:11:06 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 03CB1C08E859; Mon, 24 Jan 2022 11:02:33 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9753660BA1; Mon, 24 Jan 2022 19:02:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4EC85C340E5; Mon, 24 Jan 2022 19:02:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050952; bh=lLizqx2R7dEZHunY5+u8UHZgY3PhUH6NOT0/2mmLldk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2GPPgn8T+zqhbrrJdteiZRalR3kG6OFIyyOBEcpe5N3BTN6bjIHxi/ce+A+VykPm8 VFunTvtr/g0UqRQuwrN1tXJkbMpIYQhjjq8t7L0Gbtg3Tc1WAvisId1xO2ZJ8Zz4ip y1S6vJXV57Pkema3aM4n0F2oPqmXrw4NVUK0kNlM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Sean Christopherson , Paolo Bonzini , Ben Hutchings Subject: [PATCH 4.9 156/157] KVM: Use kvm_pfn_t for local PFN variable in hva_to_pfn_remapped() Date: Mon, 24 Jan 2022 19:44:06 +0100 Message-Id: <20220124183937.704306868@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Sean Christopherson commit a9545779ee9e9e103648f6f2552e73cfe808d0f4 upstream. Use kvm_pfn_t, a.k.a. u64, for the local 'pfn' variable when retrieving a so called "remapped" hva/pfn pair. In theory, the hva could resolve to a pfn in high memory on a 32-bit kernel. This bug was inadvertantly exposed by commit bd2fae8da794 ("KVM: do not assume PTE is writable after follow_pfn"), which added an error PFN value to the mix, causing gcc to comlain about overflowing the unsigned long. arch/x86/kvm/../../../virt/kvm/kvm_main.c: In function =E2=80=98hva_to_pf= n_remapped=E2=80=99: include/linux/kvm_host.h:89:30: error: conversion from =E2=80=98long long= unsigned int=E2=80=99 to =E2=80=98long unsigned int=E2=80=99 ch= anges value from =E2=80=989218868437227405314=E2=80=99 to = =E2=80=982=E2=80=99 [-Werror=3Doverflow] 89 | #define KVM_PFN_ERR_RO_FAULT (KVM_PFN_ERR_MASK + 2) | ^ virt/kvm/kvm_main.c:1935:9: note: in expansion of macro =E2=80=98KVM_PFN_ER= R_RO_FAULT=E2=80=99 Cc: stable@vger.kernel.org Fixes: add6a0cd1c5b ("KVM: MMU: try to fix up page faults before giving up") Signed-off-by: Sean Christopherson Message-Id: <20210208201940.1258328-1-seanjc@google.com> Signed-off-by: Paolo Bonzini Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- virt/kvm/kvm_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1518,7 +1518,7 @@ static int hva_to_pfn_remapped(struct vm bool write_fault, bool *writable, kvm_pfn_t *p_pfn) { - unsigned long pfn; + kvm_pfn_t pfn; pte_t *ptep; spinlock_t *ptl; int r; From nobody Tue Jun 30 06:16:04 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D44ABC433EF for ; Mon, 24 Jan 2022 19:17:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345856AbiAXTRT (ORCPT ); Mon, 24 Jan 2022 14:17:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47502 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345122AbiAXTJL (ORCPT ); Mon, 24 Jan 2022 14:09:11 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2E948C08C5C5; Mon, 24 Jan 2022 11:02:09 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DF5E8B8119D; Mon, 24 Jan 2022 19:02:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1933BC340E5; Mon, 24 Jan 2022 19:02:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1643050926; bh=aDFoXBfXTkfoNdAUutnNPz0dvkoSMcKTMdxDWksInsE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q6e4S11eXMhSJCVmeaL4dOJIAAQf+7vvXJQZ4/EQCXTxvCZVTM9LWWZyHh0fENWqD /CXwRqw2rrTGfxCFsO/aV91cA6q7xz23a1pW6TJmduy7b/4ZJAJ+DfCslK4bO8QR47 5RZzFxA4QCkBiy1VDDs3foHhsI/AHC6g/8GPnoTw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Nicholas Piggin , Paolo Bonzini , Ben Hutchings Subject: [PATCH 4.9 157/157] KVM: do not allow mapping valid but non-reference-counted pages Date: Mon, 24 Jan 2022 19:44:07 +0100 Message-Id: <20220124183937.735989252@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20220124183932.787526760@linuxfoundation.org> References: <20220124183932.787526760@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nicholas Piggin commit f8be156be163a052a067306417cd0ff679068c97 upstream. It's possible to create a region which maps valid but non-refcounted pages (e.g., tail pages of non-compound higher order allocations). These host pages can then be returned by gfn_to_page, gfn_to_pfn, etc., family of APIs, which take a reference to the page, which takes it from 0 to 1. When the reference is dropped, this will free the page incorrectly. Fix this by only taking a reference on valid pages if it was non-zero, which indicates it is participating in normal refcounting (and can be released with put_page). This addresses CVE-2021-22543. Signed-off-by: Nicholas Piggin Tested-by: Paolo Bonzini Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman Reported-by: Linux Kernel Functional Testing Tested-by: Florian Fainelli Tested-by: Shuah Khan --- virt/kvm/kvm_main.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1513,6 +1513,13 @@ static bool vma_is_valid(struct vm_area_ return true; } =20 +static int kvm_try_get_pfn(kvm_pfn_t pfn) +{ + if (kvm_is_reserved_pfn(pfn)) + return 1; + return get_page_unless_zero(pfn_to_page(pfn)); +} + static int hva_to_pfn_remapped(struct vm_area_struct *vma, unsigned long addr, bool *async, bool write_fault, bool *writable, @@ -1562,13 +1569,21 @@ static int hva_to_pfn_remapped(struct vm * Whoever called remap_pfn_range is also going to call e.g. * unmap_mapping_range before the underlying pages are freed, * causing a call to our MMU notifier. + * + * Certain IO or PFNMAP mappings can be backed with valid + * struct pages, but be allocated without refcounting e.g., + * tail pages of non-compound higher order allocations, which + * would then underflow the refcount when the caller does the + * required put_page. Don't allow those pages here. */=20 - kvm_get_pfn(pfn); + if (!kvm_try_get_pfn(pfn)) + r =3D -EFAULT; =20 out: pte_unmap_unlock(ptep, ptl); *p_pfn =3D pfn; - return 0; + + return r; } =20 /*