From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E476C433EF for ; Mon, 7 Feb 2022 11:17:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350434AbiBGLNL (ORCPT ); Mon, 7 Feb 2022 06:13:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48908 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244455AbiBGLK2 (ORCPT ); Mon, 7 Feb 2022 06:10:28 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 008F1C043181; Mon, 7 Feb 2022 03:10:26 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 92A9E61388; Mon, 7 Feb 2022 11:10:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 73DF1C004E1; Mon, 7 Feb 2022 11:10:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232226; bh=u4195M9uifM8d22mIW+olg3HBt73pJGFVtNfQc0j3uU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZswFb9iNtEt+P1AduvXYk+WOy04ueQT+YY20JX9EELgmJJCfCW/kZbCGUvS3CE7NQ 9QCE3zepGE4t+sv5ZPjge44j3oUwQqGn+ShgaTE/THvw83WpJPxTjR3TwGPX62Md5K us48u4nYpwGj62zE9odCBv/SdpEXRNuxyd+KyaxM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brian Gix , Marcel Holtmann , syphyr Subject: [PATCH 4.14 01/69] Bluetooth: refactor malicious adv data check Date: Mon, 7 Feb 2022 12:05:23 +0100 Message-Id: <20220207103755.654351240@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Brian Gix commit 899663be5e75dc0174dc8bda0b5e6826edf0b29a upstream. Check for out-of-bound read was being performed at the end of while num_reports loop, and would fill journal with false positives. Added check to beginning of loop processing so that it doesn't get checked after ptr has been advanced. Signed-off-by: Brian Gix Signed-off-by: Marcel Holtmann Cc: syphyr Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- net/bluetooth/hci_event.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -4967,6 +4967,11 @@ static void hci_le_adv_report_evt(struct struct hci_ev_le_advertising_info *ev =3D ptr; s8 rssi; =20 + if (ptr > (void *)skb_tail_pointer(skb) - sizeof(*ev)) { + bt_dev_err(hdev, "Malicious advertising data."); + break; + } + if (ev->length <=3D HCI_MAX_AD_LENGTH && ev->data + ev->length <=3D skb_tail_pointer(skb)) { rssi =3D ev->data[ev->length]; @@ -4978,11 +4983,6 @@ static void hci_le_adv_report_evt(struct } =20 ptr +=3D sizeof(*ev) + ev->length + 1; - - if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) { - bt_dev_err(hdev, "Malicious advertising data. Stopping processing"); - break; - } } =20 hci_dev_unlock(hdev); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9CE53C43217 for ; Mon, 7 Feb 2022 11:17:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355388AbiBGLNO (ORCPT ); Mon, 7 Feb 2022 06:13:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48960 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343571AbiBGLKf (ORCPT ); Mon, 7 Feb 2022 06:10:35 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DFDADC043181; Mon, 7 Feb 2022 03:10:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1D9A3B80EE8; Mon, 7 Feb 2022 11:10:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4BBF2C004E1; Mon, 7 Feb 2022 11:10:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232231; bh=kvmeKDKq4ruE2gAqLGR7+eCTMNUXOvT8e/qFwT9YNBE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pesd8yStu6lwuuf85XKnP0NVeiPDREb/KvYXg+nkb29eOtovaxVpvVeJhncOGCIk4 mP0T+nBRty2MHSarWhil/OTapStGig2CMKV5LjcotpvM6qLWrtTsAluIHc60n6r7JF s8cxoF0SiRk+3EtYTz/Cpmes9vDM7Ie3Ug7OBfGM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gerald Schaefer , Vasily Gorbik Subject: [PATCH 4.14 02/69] s390/hypfs: include z/VM guests with access control group set Date: Mon, 7 Feb 2022 12:05:24 +0100 Message-Id: <20220207103755.685560536@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vasily Gorbik commit 663d34c8df98740f1e90241e78e456d00b3c6cad upstream. Currently if z/VM guest is allowed to retrieve hypervisor performance data globally for all guests (privilege class B) the query is formed in a way to include all guests but the group name is left empty. This leads to that z/VM guests which have access control group set not being included in the results (even local vm). Change the query group identifier from empty to "any" to retrieve information about all guests from any groups (or without a group set). Cc: stable@vger.kernel.org Fixes: 31cb4bd31a48 ("[S390] Hypervisor filesystem (s390_hypfs) for z/VM") Reviewed-by: Gerald Schaefer Signed-off-by: Vasily Gorbik Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- arch/s390/hypfs/hypfs_vm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/arch/s390/hypfs/hypfs_vm.c +++ b/arch/s390/hypfs/hypfs_vm.c @@ -20,6 +20,7 @@ =20 static char local_guest[] =3D " "; static char all_guests[] =3D "* "; +static char *all_groups =3D all_guests; static char *guest_query; =20 struct diag2fc_data { @@ -62,10 +63,11 @@ static int diag2fc(int size, char* query =20 memcpy(parm_list.userid, query, NAME_LEN); ASCEBC(parm_list.userid, NAME_LEN); - parm_list.addr =3D (unsigned long) addr ; + memcpy(parm_list.aci_grp, all_groups, NAME_LEN); + ASCEBC(parm_list.aci_grp, NAME_LEN); + parm_list.addr =3D (unsigned long)addr; parm_list.size =3D size; parm_list.fmt =3D 0x02; - memset(parm_list.aci_grp, 0x40, NAME_LEN); rc =3D -1; =20 diag_stat_inc(DIAG_STAT_X2FC); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AEC1FC4321E for ; Mon, 7 Feb 2022 11:17:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356620AbiBGLNS (ORCPT ); Mon, 7 Feb 2022 06:13:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48972 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348656AbiBGLKi (ORCPT ); Mon, 7 Feb 2022 06:10:38 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8FC11C043181; Mon, 7 Feb 2022 03:10:37 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 49B7DB81028; Mon, 7 Feb 2022 11:10:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 66FA2C004E1; Mon, 7 Feb 2022 11:10:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232235; bh=73BdNz4Hg5qLRQTfuS4+6Pt09s5QMlox2v1WqQLxkag=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VD6ci1587j2MyK0gBJCwUh4OuHmbrywKaxwkErtWv4rfw0qzcgeOWI0t/6ydz106b QW46ykAKX0I/HhAVIStLxFuDbTSPfX1h2CF88/JzzNx8meu+ZDH39vEK7CXPyfHeOX 1by+F/wVqcFAxAD67PjQSXpQsNMxO+QZXGYf7O9I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Benjamin Block , Steffen Maier , "Martin K. Petersen" Subject: [PATCH 4.14 03/69] scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices Date: Mon, 7 Feb 2022 12:05:25 +0100 Message-Id: <20220207103755.716473948@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Steffen Maier commit 8c9db6679be4348b8aae108e11d4be2f83976e30 upstream. Suppose we have an environment with a number of non-NPIV FCP devices (virtual HBAs / FCP devices / zfcp "adapter"s) sharing the same physical FCP channel (HBA port) and its I_T nexus. Plus a number of storage target ports zoned to such shared channel. Now one target port logs out of the fabric causing an RSCN. Zfcp reacts with an ADISC ELS and subsequent port recovery depending on the ADISC result. This happens on all such FCP devices (in different Linux images) concurrently as they all receive a copy of this RSCN. In the following we look at one of those FCP devices. Requests other than FSF_QTCB_FCP_CMND can be slow until they get a response. Depending on which requests are affected by slow responses, there are different recovery outcomes. Here we want to fix failed recoveries on port or adapter level by avoiding recovery requests that can be slow. We need the cached N_Port_ID for the remote port "link" test with ADISC. Just before sending the ADISC, we now intentionally forget the old cached N_Port_ID. The idea is that on receiving an RSCN for a port, we have to assume that any cached information about this port is stale. This forces a fresh new GID_PN [FC-GS] nameserver lookup on any subsequent recovery for the same port. Since we typically can still communicate with the nameserver efficiently, we now reach steady state quicker: Either the nameserver still does not know about the port so we stop recovery, or the nameserver already knows the port potentially with a new N_Port_ID and we can successfully and quickly perform open port recovery. For the one case, where ADISC returns successfully, we re-initialize port->d_id because that case does not involve any port recovery. This also solves a problem if the storage WWPN quickly logs into the fabric again but with a different N_Port_ID. Such as on virtual WWPN takeover during target NPIV failover. [https://www.redbooks.ibm.com/abstracts/redp5477.html] In that case the RSCN from the storage FDISC was ignored by zfcp and we could not successfully recover the failover. On some later failback on the storage, we could have been lucky if the virtual WWPN got the same old N_Port_ID from the SAN switch as we still had cached. Then the related RSCN triggered a successful port reopen recovery. However, there is no guarantee to get the same N_Port_ID on NPIV FDISC. Even though NPIV-enabled FCP devices are not affected by this problem, this code change optimizes recovery time for gone remote ports as a side effect. The timely drop of cached N_Port_IDs prevents unnecessary slow open port attempts. While the problem might have been in code before v2.6.32 commit 799b76d09aee ("[SCSI] zfcp: Decouple gid_pn requests from erp") this fix depends on the gid_pn_work introduced with that commit, so we mark it as culprit to satisfy fix dependencies. Note: Point-to-point remote port is already handled separately and gets its N_Port_ID from the cached peer_d_id. So resetting port->d_id in general does not affect PtP. Link: https://lore.kernel.org/r/20220118165803.3667947-1-maier@linux.ibm.com Fixes: 799b76d09aee ("[SCSI] zfcp: Decouple gid_pn requests from erp") Cc: #2.6.32+ Suggested-by: Benjamin Block Reviewed-by: Benjamin Block Signed-off-by: Steffen Maier Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/s390/scsi/zfcp_fc.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) --- a/drivers/s390/scsi/zfcp_fc.c +++ b/drivers/s390/scsi/zfcp_fc.c @@ -521,6 +521,8 @@ static void zfcp_fc_adisc_handler(void * goto out; } =20 + /* re-init to undo drop from zfcp_fc_adisc() */ + port->d_id =3D ntoh24(adisc_resp->adisc_port_id); /* port is good, unblock rport without going through erp */ zfcp_scsi_schedule_rport_register(port); out: @@ -534,6 +536,7 @@ static int zfcp_fc_adisc(struct zfcp_por struct zfcp_fc_req *fc_req; struct zfcp_adapter *adapter =3D port->adapter; struct Scsi_Host *shost =3D adapter->scsi_host; + u32 d_id; int ret; =20 fc_req =3D kmem_cache_zalloc(zfcp_fc_req_cache, GFP_ATOMIC); @@ -558,7 +561,15 @@ static int zfcp_fc_adisc(struct zfcp_por fc_req->u.adisc.req.adisc_cmd =3D ELS_ADISC; hton24(fc_req->u.adisc.req.adisc_port_id, fc_host_port_id(shost)); =20 - ret =3D zfcp_fsf_send_els(adapter, port->d_id, &fc_req->ct_els, + d_id =3D port->d_id; /* remember as destination for send els below */ + /* + * Force fresh GID_PN lookup on next port recovery. + * Must happen after request setup and before sending request, + * to prevent race with port->d_id re-init in zfcp_fc_adisc_handler(). + */ + port->d_id =3D 0; + + ret =3D zfcp_fsf_send_els(adapter, d_id, &fc_req->ct_els, ZFCP_FC_CTELS_TMO); if (ret) kmem_cache_free(zfcp_fc_req_cache, fc_req); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93616C433EF for ; Mon, 7 Feb 2022 11:18:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357121AbiBGLOL (ORCPT ); Mon, 7 Feb 2022 06:14:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48986 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231384AbiBGLKj (ORCPT ); Mon, 7 Feb 2022 06:10:39 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0578CC043181; Mon, 7 Feb 2022 03:10:39 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9627E61370; Mon, 7 Feb 2022 11:10:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6589DC004E1; Mon, 7 Feb 2022 11:10:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232238; bh=Q9a/NR6CCkrCfIyyMhl7MJzPq8ENrfsh9TBIGOR7dsc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eiiMeqefyJ401A/cHP1Hn4bvHnSu1QZjKkCIZr43p04MKtDw0VafQLHhxpGhrLYSc 7J9EULtdCIgyHVqvRZCd8MrqF4LuausLhcuG3fTvR5Z/G3mmRWlMZ5Z6v0lagajG1U NgvMp0tgzwuIFp/8ro5GJDHmM+FvuLPNhrFmAv5A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, butt3rflyh4ck , Christoph Hellwig , Jan Kara Subject: [PATCH 4.14 04/69] udf: Restore i_lenAlloc when inode expansion fails Date: Mon, 7 Feb 2022 12:05:26 +0100 Message-Id: <20220207103755.748378964@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jan Kara commit ea8569194b43f0f01f0a84c689388542c7254a1f upstream. When we fail to expand inode from inline format to a normal format, we restore inode to contain the original inline formatting but we forgot to set i_lenAlloc back. The mismatch between i_lenAlloc and i_size was then causing further problems such as warnings and lost data down the line. Reported-by: butt3rflyh4ck CC: stable@vger.kernel.org Fixes: 7e49b6f2480c ("udf: Convert UDF to new truncate calling sequence") Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- fs/udf/inode.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -311,6 +311,7 @@ int udf_expand_file_adinicb(struct inode unlock_page(page); iinfo->i_alloc_type =3D ICBTAG_FLAG_AD_IN_ICB; inode->i_data.a_ops =3D &udf_adinicb_aops; + iinfo->i_lenAlloc =3D inode->i_size; up_write(&iinfo->i_data_sem); } put_page(page); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D5E7C433F5 for ; Mon, 7 Feb 2022 11:18:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357079AbiBGLOJ (ORCPT ); Mon, 7 Feb 2022 06:14:09 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49000 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234936AbiBGLKn (ORCPT ); Mon, 7 Feb 2022 06:10:43 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 33269C043188; Mon, 7 Feb 2022 03:10:42 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B548F61370; Mon, 7 Feb 2022 11:10:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9008AC004E1; Mon, 7 Feb 2022 11:10:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232241; bh=djhrL4rw+Ch721ysSBP7ZmkRuMo00a3GMzPeylgxBT4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G2LCZE9bFWorElweQQXbjIy+edgS0QPD2p+LjDBoX9Xy7lPIbmMMDLOHiZTMVcZFH rUDa20OezvMs6xlVzbR2zDdbWMGE5uC3Wbd5tYgmfpiG134bVmriMsk2Pm8QnqbsmU W7pE6ETLNfib0vqroyKw9GnRrFyD9Gwgq1XGlH2M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, butt3rflyh4ck , Christoph Hellwig , Jan Kara Subject: [PATCH 4.14 05/69] udf: Fix NULL ptr deref when converting from inline format Date: Mon, 7 Feb 2022 12:05:27 +0100 Message-Id: <20220207103755.779967365@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jan Kara commit 7fc3b7c2981bbd1047916ade327beccb90994eee upstream. udf_expand_file_adinicb() calls directly ->writepage to write data expanded into a page. This however misses to setup inode for writeback properly and so we can crash on inode->i_wb dereference when submitting page for IO like: BUG: kernel NULL pointer dereference, address: 0000000000000158 #PF: supervisor read access in kernel mode ... __folio_start_writeback+0x2ac/0x350 __block_write_full_page+0x37d/0x490 udf_expand_file_adinicb+0x255/0x400 [udf] udf_file_write_iter+0xbe/0x1b0 [udf] new_sync_write+0x125/0x1c0 vfs_write+0x28e/0x400 Fix the problem by marking the page dirty and going through the standard writeback path to write the page. Strictly speaking we would not even have to write the page but we want to catch e.g. ENOSPC errors early. Reported-by: butt3rflyh4ck CC: stable@vger.kernel.org Fixes: 52ebea749aae ("writeback: make backing_dev_info host cgroup-specific= bdi_writebacks") Reviewed-by: Christoph Hellwig Signed-off-by: Jan Kara Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- fs/udf/inode.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -251,10 +251,6 @@ int udf_expand_file_adinicb(struct inode char *kaddr; struct udf_inode_info *iinfo =3D UDF_I(inode); int err; - struct writeback_control udf_wbc =3D { - .sync_mode =3D WB_SYNC_NONE, - .nr_to_write =3D 1, - }; =20 WARN_ON_ONCE(!inode_is_locked(inode)); if (!iinfo->i_lenAlloc) { @@ -298,8 +294,10 @@ int udf_expand_file_adinicb(struct inode iinfo->i_alloc_type =3D ICBTAG_FLAG_AD_LONG; /* from now on we have normal address_space methods */ inode->i_data.a_ops =3D &udf_aops; + set_page_dirty(page); + unlock_page(page); up_write(&iinfo->i_data_sem); - err =3D inode->i_data.a_ops->writepage(page, &udf_wbc); + err =3D filemap_fdatawrite(inode->i_mapping); if (err) { /* Restore everything back so that we don't lose data... */ lock_page(page); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F9BBC433F5 for ; Mon, 7 Feb 2022 11:17:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357065AbiBGLOG (ORCPT ); Mon, 7 Feb 2022 06:14:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49026 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235197AbiBGLKr (ORCPT ); Mon, 7 Feb 2022 06:10:47 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 32830C043189; Mon, 7 Feb 2022 03:10:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 889B4B80EE8; Mon, 7 Feb 2022 11:10:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 940E7C004E1; Mon, 7 Feb 2022 11:10:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232244; bh=fWA7+yWKegMS40cpvXEP1/eohdqQT4jfg/9bqF05LxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GaadPUriA8fZrnnPXJ6+/obK5xARRrwdbmgVrEVN58qgY0keA0atxY0k33AHjJCSp /xUUB+9ZbPMq9AQ/DcLkisTGeYcaSwdGaQFaHs7Bg8IV6GMAoLrj1vCwqQgcTwiIOB xwwdnxtq9Ttq3UnKVA8OIwZcULoCWcmfXoyTn+Wo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lee Jones , "Rafael J. Wysocki" Subject: [PATCH 4.14 06/69] PM: wakeup: simplify the output logic of pm_show_wakelocks() Date: Mon, 7 Feb 2022 12:05:28 +0100 Message-Id: <20220207103755.813910177@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Greg Kroah-Hartman commit c9d967b2ce40d71e968eb839f36c936b8a9cf1ea upstream. The buffer handling in pm_show_wakelocks() is tricky, and hopefully correct. Ensure it really is correct by using sysfs_emit_at() which handles all of the tricky string handling logic in a PAGE_SIZE buffer for us automatically as this is a sysfs file being read from. Reviewed-by: Lee Jones Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- kernel/power/wakelock.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) --- a/kernel/power/wakelock.c +++ b/kernel/power/wakelock.c @@ -39,23 +39,19 @@ ssize_t pm_show_wakelocks(char *buf, boo { struct rb_node *node; struct wakelock *wl; - char *str =3D buf; - char *end =3D buf + PAGE_SIZE; + int len =3D 0; =20 mutex_lock(&wakelocks_lock); =20 for (node =3D rb_first(&wakelocks_tree); node; node =3D rb_next(node)) { wl =3D rb_entry(node, struct wakelock, node); if (wl->ws.active =3D=3D show_active) - str +=3D scnprintf(str, end - str, "%s ", wl->name); + len +=3D sysfs_emit_at(buf, len, "%s ", wl->name); } - if (str > buf) - str--; - - str +=3D scnprintf(str, end - str, "\n"); + len +=3D sysfs_emit_at(buf, len, "\n"); =20 mutex_unlock(&wakelocks_lock); - return (str - buf); + return len; } =20 #if CONFIG_PM_WAKELOCKS_LIMIT > 0 From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3D64C4332F for ; Mon, 7 Feb 2022 11:18:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357613AbiBGLOY (ORCPT ); Mon, 7 Feb 2022 06:14:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49034 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235268AbiBGLKs (ORCPT ); Mon, 7 Feb 2022 06:10:48 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 59978C0401C0; Mon, 7 Feb 2022 03:10:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E789461388; Mon, 7 Feb 2022 11:10:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C76ECC004E1; Mon, 7 Feb 2022 11:10:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232247; bh=rVzw4I1cQMNBrWV6J20Z9Clp0NL/SBYy8ZU4O+vPCvo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0lq4yw0ZUnH8WSplyLsA9c09EGjUzFd+eyT6yGdoQW65rzEnKKpT0TkwJCwQlImdz 1QwTGRRqT+E64XBUaGtrb3UfUK3BTFlZR0oC/EhImEwxxue7BVsn0/Qot28d96JBmf ukq3Efg70QtyrqvoLKg+Nmiswz6fSztLhxer/P60= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pablo Neira Ayuso , Florian Westphal , Steffen Weinreich Subject: [PATCH 4.14 07/69] netfilter: nft_payload: do not update layer 4 checksum when mangling fragments Date: Mon, 7 Feb 2022 12:05:29 +0100 Message-Id: <20220207103755.853444766@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pablo Neira Ayuso commit 4e1860a3863707e8177329c006d10f9e37e097a8 upstream. IP fragments do not come with the transport header, hence skip bogus layer 4 checksum updates. Fixes: 1814096980bb ("netfilter: nft_payload: layer 4 checksum adjustment f= or pseudoheader fields") Reported-and-tested-by: Steffen Weinreich Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- net/netfilter/nft_payload.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/netfilter/nft_payload.c +++ b/net/netfilter/nft_payload.c @@ -194,6 +194,9 @@ static int nft_payload_l4csum_offset(con struct sk_buff *skb, unsigned int *l4csum_offset) { + if (pkt->xt.fragoff) + return -1; + switch (pkt->tprot) { case IPPROTO_TCP: *l4csum_offset =3D offsetof(struct tcphdr, check); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D46A7C433FE for ; Mon, 7 Feb 2022 11:18:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357832AbiBGLO1 (ORCPT ); Mon, 7 Feb 2022 06:14:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49076 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236277AbiBGLKx (ORCPT ); Mon, 7 Feb 2022 06:10:53 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E1AEBC043188; Mon, 7 Feb 2022 03:10:52 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A273EB80EE8; Mon, 7 Feb 2022 11:10:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C39CAC004E1; Mon, 7 Feb 2022 11:10:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232250; bh=pVidsFRwvfWJFQLvZpwUyJitFV+B3v0Ew0uHp1fIxC4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TkU6sL82DfQD2FgAwslIIWMlOynk94zBuv40S8qJDetbLnVglFa7+L8KG1EdC5hot Gqqm2vgxqWOg9YbIy/y/K6JdQOisMTrzM4zH0skT2fpW7cf4wos2phH/82xjkGYRjC AC+/cDtnNI4J4PGanCeczw+Tvzk6WfeyEHNoT2Y4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Erwan Le Ray , Valentin Caron Subject: [PATCH 4.14 08/69] serial: stm32: fix software flow control transfer Date: Mon, 7 Feb 2022 12:05:30 +0100 Message-Id: <20220207103755.885708425@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Valentin Caron commit 037b91ec7729524107982e36ec4b40f9b174f7a2 upstream. x_char is ignored by stm32_usart_start_tx() when xmit buffer is empty. Fix start_tx condition to allow x_char to be sent. Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") Cc: stable Signed-off-by: Erwan Le Ray Signed-off-by: Valentin Caron Link: https://lore.kernel.org/r/20220111164441.6178-3-valentin.caron@foss.s= t.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/tty/serial/stm32-usart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/tty/serial/stm32-usart.c +++ b/drivers/tty/serial/stm32-usart.c @@ -402,7 +402,7 @@ static void stm32_start_tx(struct uart_p { struct circ_buf *xmit =3D &port->state->xmit; =20 - if (uart_circ_empty(xmit)) + if (uart_circ_empty(xmit) && !port->x_char) return; =20 stm32_transmit_chars(port); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00536C43217 for ; Mon, 7 Feb 2022 11:18:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358102AbiBGLOd (ORCPT ); Mon, 7 Feb 2022 06:14:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49090 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236283AbiBGLK4 (ORCPT ); Mon, 7 Feb 2022 06:10:56 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 99F06C043189; Mon, 7 Feb 2022 03:10:55 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 54FABB80EE8; Mon, 7 Feb 2022 11:10:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 99378C004E1; Mon, 7 Feb 2022 11:10:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232253; bh=Ah7q0SidRjtwGRZkKQdwXV4dI21H3xhu6NXssBEZaoY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0A5STAfUfwfi/vkUGQQJ6O9XNzyV7E4X6DRn71LUoJTcyBHyTcyZanY3ollQ84P3Q SrOfNhVL0vNjWJO9goXbMJsZJwanReNzHjvwNv8wiiTk5QPwUx93p5q9wezWhiodPp Ac5DVax2Y8jAxLBcMPT59EGTpMLVLzfm9qG4SDE0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.14 09/69] tty: n_gsm: fix SW flow control encoding/handling Date: Mon, 7 Feb 2022 12:05:31 +0100 Message-Id: <20220207103755.918880700@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: daniel.starke@siemens.com commit 8838b2af23caf1ff0610caef2795d6668a013b2d upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.2.7.3 states that DC1 (XON) and DC3 (XOFF) are the control characters defined in ISO/IEC 646. These shall be quoted if seen in the data stream to avoid interpretation as flow control characters. ISO/IEC 646 refers to the set of ISO standards described as the ISO 7-bit coded character set for information interchange. Its final version is also known as ITU T.50. See https://www.itu.int/rec/T-REC-T.50-199209-I/en To abide the standard it is needed to quote DC1 and DC3 correctly if these are seen as data bytes and not as control characters. The current implementation already tries to enforce this but fails to catch all defined cases. 3GPP 27.010 chapter 5.2.7.3 clearly states that the most significant bit shall be ignored for DC1 and DC3 handling. The current implementation handles only the case with the most significant bit set 0. Cases in which DC1 and DC3 have the most significant bit set 1 are left unhandled. This patch fixes this by masking the data bytes with ISO_IEC_646_MASK (only the 7 least significant bits set 1) before comparing them with XON (a.k.a. DC1) and XOFF (a.k.a. DC3) when testing which byte values need quotation via byte stuffing. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220120101857.2509-1-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/tty/n_gsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -325,6 +325,7 @@ static struct tty_driver *gsm_tty_driver #define GSM1_ESCAPE_BITS 0x20 #define XON 0x11 #define XOFF 0x13 +#define ISO_IEC_646_MASK 0x7F =20 static const struct tty_port_operations gsm_port_ops; =20 @@ -543,7 +544,8 @@ static int gsm_stuff_frame(const u8 *inp int olen =3D 0; while (len--) { if (*input =3D=3D GSM1_SOF || *input =3D=3D GSM1_ESCAPE - || *input =3D=3D XON || *input =3D=3D XOFF) { + || (*input & ISO_IEC_646_MASK) =3D=3D XON + || (*input & ISO_IEC_646_MASK) =3D=3D XOFF) { *output++ =3D GSM1_ESCAPE; *output++ =3D *input++ ^ GSM1_ESCAPE_BITS; olen++; From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6DDC6C4332F for ; Mon, 7 Feb 2022 11:17:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351864AbiBGLNN (ORCPT ); Mon, 7 Feb 2022 06:13:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48926 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245457AbiBGLKa (ORCPT ); Mon, 7 Feb 2022 06:10:30 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 02F9EC043181; Mon, 7 Feb 2022 03:10:30 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9417661261; Mon, 7 Feb 2022 11:10:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6CB2FC004E1; Mon, 7 Feb 2022 11:10:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232229; bh=40TGlXvYU8HmwnD5uK4ogNUgHQ0LKk7pe54l57x2akE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L2MkOhkzVDxkCl9X1gTyNxxRmc0eD3z9f0y4uBA4RHVIuE6oEoD2g3BIjNjfAFzpS 8IEQG2XF/h0mC13n18/Jymc/DcEIx6Rv+REd7Hw7cRwQ3+eHi9Q8O2uGl4ITyovTKA YqfdbSX6owrpQBZhRcSHwcBnPcV9KUNNaDKeCsKI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Cameron Williams Subject: [PATCH 4.14 10/69] tty: Add support for Brainboxes UC cards. Date: Mon, 7 Feb 2022 12:05:32 +0100 Message-Id: <20220207103755.949344220@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Cameron Williams commit 152d1afa834c84530828ee031cf07a00e0fc0b8c upstream. This commit adds support for the some of the Brainboxes PCI range of cards, including the UC-101, UC-235/246, UC-257, UC-268, UC-275/279, UC-302, UC-310, UC-313, UC-320/324, UC-346, UC-357, UC-368 and UC-420/431. Signed-off-by: Cameron Williams Cc: stable Link: https://lore.kernel.org/r/AM5PR0202MB2564688493F7DD9B9C610827C45E9@AM= 5PR0202MB2564.eurprd02.prod.outlook.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/tty/serial/8250/8250_pci.c | 100 ++++++++++++++++++++++++++++++++= ++++- 1 file changed, 98 insertions(+), 2 deletions(-) --- a/drivers/tty/serial/8250/8250_pci.c +++ b/drivers/tty/serial/8250/8250_pci.c @@ -4808,8 +4808,30 @@ static const struct pci_device_id serial { PCI_VENDOR_ID_INTASHIELD, PCI_DEVICE_ID_INTASHIELD_IS400, PCI_ANY_ID, PCI_ANY_ID, 0, 0, /* 135a.0dc0 */ pbn_b2_4_115200 }, + /* Brainboxes Devices */ /* - * BrainBoxes UC-260 + * Brainboxes UC-101 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x0BA1, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_2_115200 }, + /* + * Brainboxes UC-235/246 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x0AA1, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_1_115200 }, + /* + * Brainboxes UC-257 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x0861, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_2_115200 }, + /* + * Brainboxes UC-260/271/701/756 */ { PCI_VENDOR_ID_INTASHIELD, 0x0D21, PCI_ANY_ID, PCI_ANY_ID, @@ -4817,7 +4839,81 @@ static const struct pci_device_id serial pbn_b2_4_115200 }, { PCI_VENDOR_ID_INTASHIELD, 0x0E34, PCI_ANY_ID, PCI_ANY_ID, - PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, + PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, + pbn_b2_4_115200 }, + /* + * Brainboxes UC-268 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x0841, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_4_115200 }, + /* + * Brainboxes UC-275/279 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x0881, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_8_115200 }, + /* + * Brainboxes UC-302 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x08E1, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_2_115200 }, + /* + * Brainboxes UC-310 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x08C1, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_2_115200 }, + /* + * Brainboxes UC-313 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x08A3, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_2_115200 }, + /* + * Brainboxes UC-320/324 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x0A61, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_1_115200 }, + /* + * Brainboxes UC-346 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x0B02, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_4_115200 }, + /* + * Brainboxes UC-357 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x0A81, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_2_115200 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0A83, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_2_115200 }, + /* + * Brainboxes UC-368 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x0C41, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, + pbn_b2_4_115200 }, + /* + * Brainboxes UC-420/431 + */ + { PCI_VENDOR_ID_INTASHIELD, 0x0921, + PCI_ANY_ID, PCI_ANY_ID, + 0, 0, pbn_b2_4_115200 }, /* * Perle PCI-RAS cards From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52DEDC43217 for ; Mon, 7 Feb 2022 11:16:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379795AbiBGLQZ (ORCPT ); Mon, 7 Feb 2022 06:16:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49870 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355720AbiBGLMo (ORCPT ); Mon, 7 Feb 2022 06:12:44 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3A322C043181; Mon, 7 Feb 2022 03:12:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 04340B81028; Mon, 7 Feb 2022 11:12:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 49850C004E1; Mon, 7 Feb 2022 11:12:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232361; bh=UMtfmC1/MsJ0EmiflofBXKsFTxo8ZPytFMJqH4w8PIg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eXJiNqAPvy+znqa+T3uNCeZ429rnq1gIWVKcooapOL6lXdFX8Qaanst5FIy7F1KCo JqVJcMB3J14F84c1H0+dnUVo/BnUd1TAbrkW3AAjpref5+X4jdEUtNetB6D68t8rGn ss7P5CAsovmCHoSg4DhzDQ7MXxFnxKVGQ3rLWM80= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, DocMAX , Alan Stern , =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Subject: [PATCH 4.14 11/69] usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge Date: Mon, 7 Feb 2022 12:05:33 +0100 Message-Id: <20220207103755.982253009@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Alan Stern commit 5b67b315037250a61861119683e7fcb509deea25 upstream. Two people have reported (and mentioned numerous other reports on the web) that VIA's VL817 USB-SATA bridge does not work with the uas driver. Typical log messages are: [ 3606.232149] sd 14:0:0:0: [sdg] tag#2 uas_zap_pending 0 uas-tag 1 infligh= t: CMD [ 3606.232154] sd 14:0:0:0: [sdg] tag#2 CDB: Write(16) 8a 00 00 00 00 00 18= 0c c9 80 00 00 00 80 00 00 [ 3606.306257] usb 4-4.4: reset SuperSpeed Plus Gen 2x1 USB device number 1= 1 using xhci_hcd [ 3606.328584] scsi host14: uas_eh_device_reset_handler success Surprisingly, the devices do seem to work okay for some other people. The cause of the differing behaviors is not known. In the hope of getting the devices to work for the most users, even at the possible cost of degraded performance for some, this patch adds an unusual_devs entry for the VL817 to block it from binding to the uas driver by default. Users will be able to override this entry by means of a module parameter, if they want. CC: Reported-by: DocMAX Reported-and-tested-by: Thomas Wei=C3=9Fschuh Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/Ye8IsK2sjlEv1rqU@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/usb/storage/unusual_devs.h | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/usb/storage/unusual_devs.h +++ b/drivers/usb/storage/unusual_devs.h @@ -2320,6 +2320,16 @@ UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init, US_FL_SCM_MULT_TARG ), =20 +/* + * Reported by DocMAX + * and Thomas Wei=C3=9Fschuh + */ +UNUSUAL_DEV( 0x2109, 0x0715, 0x9999, 0x9999, + "VIA Labs, Inc.", + "VL817 SATA Bridge", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_UAS), + UNUSUAL_DEV( 0x2116, 0x0320, 0x0001, 0x0001, "ST", "2A", From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46414C433FE for ; Mon, 7 Feb 2022 11:17:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356911AbiBGLOB (ORCPT ); Mon, 7 Feb 2022 06:14:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49122 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237060AbiBGLLC (ORCPT ); Mon, 7 Feb 2022 06:11:02 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7DA56C043181; Mon, 7 Feb 2022 03:11:01 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2EF0CB80EE8; Mon, 7 Feb 2022 11:11:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 64F40C004E1; Mon, 7 Feb 2022 11:10:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232259; bh=fUmpoc5Q7kPSh3lk2DSZ6dxRzwy8WuVR6z88Xi+OUNw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pz9xh9DBC7/x1Ph/34OFwyOjBxvbss3Wha9390I3bT5yKVUpY5JQ4GjpJWy94eoae 6lE3cqfn0zP59b/YhuPmVRDbrc1nmnidOkEP714l82UKGwlUzCNQSzSZys5uoFKeZ2 nQqfup1ll5LckON3KB91/Yb2HQinDLwfWkygcPS8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jon Hunter Subject: [PATCH 4.14 12/69] usb: common: ulpi: Fix crash in ulpi_match() Date: Mon, 7 Feb 2022 12:05:34 +0100 Message-Id: <20220207103756.018983504@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jon Hunter commit 2e3dd4a6246945bf84ea6f478365d116e661554c upstream. Commit 7495af930835 ("ARM: multi_v7_defconfig: Enable drivers for DragonBoard 410c") enables the CONFIG_PHY_QCOM_USB_HS for the ARM multi_v7_defconfig. Enabling this Kconfig is causing the kernel to crash on the Tegra20 Ventana platform in the ulpi_match() function. The Qualcomm USB HS PHY driver that is enabled by CONFIG_PHY_QCOM_USB_HS, registers a ulpi_driver but this driver does not provide an 'id_table', so when ulpi_match() is called on the Tegra20 Ventana platform, it crashes when attempting to deference the id_table pointer which is not valid. The Qualcomm USB HS PHY driver uses device-tree for matching the ULPI driver with the device and so fix this crash by using device-tree for matching if the id_table is not valid. Fixes: ef6a7bcfb01c ("usb: ulpi: Support device discovery via DT") Cc: stable Signed-off-by: Jon Hunter Link: https://lore.kernel.org/r/20220117150039.44058-1-jonathanh@nvidia.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/usb/common/ulpi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -42,8 +42,11 @@ static int ulpi_match(struct device *dev struct ulpi *ulpi =3D to_ulpi_dev(dev); const struct ulpi_device_id *id; =20 - /* Some ULPI devices don't have a vendor id so rely on OF match */ - if (ulpi->id.vendor =3D=3D 0) + /* + * Some ULPI devices don't have a vendor id + * or provide an id_table so rely on OF match. + */ + if (ulpi->id.vendor =3D=3D 0 || !drv->id_table) return of_driver_match_device(dev, driver); =20 for (id =3D drv->id_table; id->vendor; id++) From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4CC8C35271 for ; Mon, 7 Feb 2022 11:18:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359769AbiBGLPA (ORCPT ); Mon, 7 Feb 2022 06:15:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49434 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345973AbiBGLLg (ORCPT ); Mon, 7 Feb 2022 06:11:36 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 36B60C0401C0; Mon, 7 Feb 2022 03:11:35 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EFDA0B80EE8; Mon, 7 Feb 2022 11:11:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10280C004E1; Mon, 7 Feb 2022 11:11:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232292; bh=sQAKYqwJSmKj6ZF2oZqmaAeGNkm8va4f8ABQg75aHic=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iJNw19jWVPVs1cptEaDUYc6VL1dC15MeXv2I7nWXeSWWJmicrXk7FmD1ZJaWIx/5J lFAoqsg3YxZ9XKEfsY2S0Ukfvbv26X0G1YvdXxV+H3LtR92tuqP3aGYCsj5mm72+33 /iGtRcfvf0guHAJ8pkCE24rItJzoo9VvCnjfJgoo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavankumar Kondeti Subject: [PATCH 4.14 13/69] usb: gadget: f_sourcesink: Fix isoc transfer for USB_SPEED_SUPER_PLUS Date: Mon, 7 Feb 2022 12:05:35 +0100 Message-Id: <20220207103756.052722060@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavankumar Kondeti commit 904edf8aeb459697129be5fde847e2a502f41fd9 upstream. Currently when gadget enumerates in super speed plus, the isoc endpoint request buffer size is not calculated correctly. Fix this by checking the gadget speed against USB_SPEED_SUPER_PLUS and update the request buffer size. Fixes: 90c4d05780d4 ("usb: fix various gadgets null ptr deref on 10gbps cab= ling.") Cc: stable Signed-off-by: Pavankumar Kondeti Link: https://lore.kernel.org/r/1642820602-20619-1-git-send-email-quic_pkon= deti@quicinc.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/usb/gadget/function/f_sourcesink.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/gadget/function/f_sourcesink.c +++ b/drivers/usb/gadget/function/f_sourcesink.c @@ -587,6 +587,7 @@ static int source_sink_start_ep(struct f =20 if (is_iso) { switch (speed) { + case USB_SPEED_SUPER_PLUS: case USB_SPEED_SUPER: size =3D ss->isoc_maxpacket * (ss->isoc_mult + 1) * From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 590F6C4167E for ; Mon, 7 Feb 2022 11:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378108AbiBGLPo (ORCPT ); Mon, 7 Feb 2022 06:15:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49636 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353119AbiBGLMH (ORCPT ); Mon, 7 Feb 2022 06:12:07 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D724BC043189; Mon, 7 Feb 2022 03:12:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 72E2161380; Mon, 7 Feb 2022 11:12:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 44A14C004E1; Mon, 7 Feb 2022 11:12:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232325; bh=4jO7K2E2c5x+A9y9hULWt9uHAkK9NZL2YaHuUeXezB4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sixaUP5wZpPz0mEyAGBl8sJxOeMflkp5yxvHZ9IGhmKDNx3DBMcm2hwk/J31FHo+r whf35qiYQDCO7STKFdIwTOgxv/4o+r4xQyMg0R1aZ6/ElDwHzmrh4YfPT4vM7eTSea Eeo6QBcT7HIJ4MqJoaSr6zG98bCtqrLnosdGWtAA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , syzbot+76629376e06e2c2ad626@syzkaller.appspotmail.com Subject: [PATCH 4.14 14/69] USB: core: Fix hang in usb_kill_urb by adding memory barriers Date: Mon, 7 Feb 2022 12:05:36 +0100 Message-Id: <20220207103756.084594797@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 26fbe9772b8c459687930511444ce443011f86bf upstream. The syzbot fuzzer has identified a bug in which processes hang waiting for usb_kill_urb() to return. It turns out the issue is not unlinking the URB; that works just fine. Rather, the problem arises when the wakeup notification that the URB has completed is not received. The reason is memory-access ordering on SMP systems. In outline form, usb_kill_urb() and __usb_hcd_giveback_urb() operating concurrently on different CPUs perform the following actions: CPU 0 CPU 1 Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins ---------------------------- --------------------------------- usb_kill_urb(): __usb_hcd_giveback_urb(): ... ... atomic_inc(&urb->reject); atomic_dec(&urb->use_count); ... ... wait_event(usb_kill_urb_queue, atomic_read(&urb->use_count) =3D=3D 0); if (atomic_read(&urb->reject)) wake_up(&usb_kill_urb_queue); Confining your attention to urb->reject and urb->use_count, you can see that the overall pattern of accesses on CPU 0 is: write urb->reject, then read urb->use_count; whereas the overall pattern of accesses on CPU 1 is: write urb->use_count, then read urb->reject. This pattern is referred to in memory-model circles as SB (for "Store Buffering"), and it is well known that without suitable enforcement of the desired order of accesses -- in the form of memory barriers -- it is entirely possible for one or both CPUs to execute their reads ahead of their writes. The end result will be that sometimes CPU 0 sees the old un-decremented value of urb->use_count while CPU 1 sees the old un-incremented value of urb->reject. Consequently CPU 0 ends up on the wait queue and never gets woken up, leading to the observed hang in usb_kill_urb(). The same pattern of accesses occurs in usb_poison_urb() and the failure pathway of usb_hcd_submit_urb(). The problem is fixed by adding suitable memory barriers. To provide proper memory-access ordering in the SB pattern, a full barrier is required on both CPUs. The atomic_inc() and atomic_dec() accesses themselves don't provide any memory ordering, but since they are present, we can use the optimized smp_mb__after_atomic() memory barrier in the various routines to obtain the desired effect. This patch adds the necessary memory barriers. CC: Reported-and-tested-by: syzbot+76629376e06e2c2ad626@syzkaller.appspotmail.c= om Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/Ye8K0QYee0Q0Nna2@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/hcd.c | 14 ++++++++++++++ drivers/usb/core/urb.c | 12 ++++++++++++ 2 files changed, 26 insertions(+) --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -1679,6 +1679,13 @@ int usb_hcd_submit_urb (struct urb *urb, urb->hcpriv =3D NULL; INIT_LIST_HEAD(&urb->urb_list); atomic_dec(&urb->use_count); + /* + * Order the write of urb->use_count above before the read + * of urb->reject below. Pairs with the memory barriers in + * usb_kill_urb() and usb_poison_urb(). + */ + smp_mb__after_atomic(); + atomic_dec(&urb->dev->urbnum); if (atomic_read(&urb->reject)) wake_up(&usb_kill_urb_queue); @@ -1788,6 +1795,13 @@ static void __usb_hcd_giveback_urb(struc =20 usb_anchor_resume_wakeups(anchor); atomic_dec(&urb->use_count); + /* + * Order the write of urb->use_count above before the read + * of urb->reject below. Pairs with the memory barriers in + * usb_kill_urb() and usb_poison_urb(). + */ + smp_mb__after_atomic(); + if (unlikely(atomic_read(&urb->reject))) wake_up(&usb_kill_urb_queue); usb_put_urb(urb); --- a/drivers/usb/core/urb.c +++ b/drivers/usb/core/urb.c @@ -686,6 +686,12 @@ void usb_kill_urb(struct urb *urb) if (!(urb && urb->dev && urb->ep)) return; atomic_inc(&urb->reject); + /* + * Order the write of urb->reject above before the read + * of urb->use_count below. Pairs with the barriers in + * __usb_hcd_giveback_urb() and usb_hcd_submit_urb(). + */ + smp_mb__after_atomic(); =20 usb_hcd_unlink_urb(urb, -ENOENT); wait_event(usb_kill_urb_queue, atomic_read(&urb->use_count) =3D=3D 0); @@ -727,6 +733,12 @@ void usb_poison_urb(struct urb *urb) if (!urb) return; atomic_inc(&urb->reject); + /* + * Order the write of urb->reject above before the read + * of urb->use_count below. Pairs with the barriers in + * __usb_hcd_giveback_urb() and usb_hcd_submit_urb(). + */ + smp_mb__after_atomic(); =20 if (!urb->dev || !urb->ep) return; From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB874C4707A for ; Mon, 7 Feb 2022 11:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379088AbiBGLQD (ORCPT ); Mon, 7 Feb 2022 06:16:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49752 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354815AbiBGLM0 (ORCPT ); Mon, 7 Feb 2022 06:12:26 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EEC89C043188; Mon, 7 Feb 2022 03:12:24 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8B462611AA; Mon, 7 Feb 2022 11:12:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6BC7DC004E1; Mon, 7 Feb 2022 11:12:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232344; bh=FE2h/zvvcUjsME01AwRtBtnb1+6moFaXnxKmjhwCs3A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d7/ngxnbVgbeCX6qVlzE8O9AH4ps0gtGp6nlrlGQs2YMcGT5zfFqnonfebWn1yj0U sMjsyBmaxFVW1riW6xZT2ClV7wFswN6mTp6z4951DdVyS5+G+NFYMOeMQznijVTlem +gsI/UCf2NbQCp50STInFUh3gLB3aGECndjVhu/g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Heikki Krogerus , Badhri Jagan Sridharan Subject: [PATCH 4.14 15/69] usb: typec: tcpm: Do not disconnect while receiving VBUS off Date: Mon, 7 Feb 2022 12:05:37 +0100 Message-Id: <20220207103756.117211011@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Badhri Jagan Sridharan commit 90b8aa9f5b09edae6928c0561f933fec9f7a9987 upstream. With some chargers, vbus might momentarily raise above VSAFE5V and fall back to 0V before tcpm gets to read port->tcpc->get_vbus. This will will report a VBUS off event causing TCPM to transition to SNK_UNATTACHED where it should be waiting in either SNK_ATTACH_WAIT or SNK_DEBOUNCED state. This patch makes TCPM avoid vbus off events while in SNK_ATTACH_WAIT or SNK_DEBOUNCED state. Stub from the spec: "4.5.2.2.4.2 Exiting from AttachWait.SNK State A Sink shall transition to Unattached.SNK when the state of both the CC1 and CC2 pins is SNK.Open for at least tPDDebounce. A DRP shall transition to Unattached.SRC when the state of both the CC1 and CC2 pins is SNK.Open for at least tPDDebounce." [23.194131] CC1: 0 -> 0, CC2: 0 -> 5 [state SNK_UNATTACHED, polarity 0, con= nected] [23.201777] state change SNK_UNATTACHED -> SNK_ATTACH_WAIT [rev3 NONE_AMS] [23.209949] pending state change SNK_ATTACH_WAIT -> SNK_DEBOUNCED @ 170 ms = [rev3 NONE_AMS] [23.300579] VBUS off [23.300668] state change SNK_ATTACH_WAIT -> SNK_UNATTACHED [rev3 NONE_AMS] [23.301014] VBUS VSAFE0V [23.301111] Start toggling Fixes: f0690a25a140b8 ("staging: typec: USB Type-C Port Manager (tcpm)") Cc: stable@vger.kernel.org Acked-by: Heikki Krogerus Signed-off-by: Badhri Jagan Sridharan Link: https://lore.kernel.org/r/20220122015520.332507-1-badhri@google.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/staging/typec/tcpm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/staging/typec/tcpm.c +++ b/drivers/staging/typec/tcpm.c @@ -3103,7 +3103,8 @@ static void _tcpm_pd_vbus_off(struct tcp case SNK_TRYWAIT_DEBOUNCE: break; case SNK_ATTACH_WAIT: - tcpm_set_state(port, SNK_UNATTACHED, 0); + case SNK_DEBOUNCED: + /* Do nothing, as TCPM is still waiting for vbus to reaach VSAFE5V to co= nnect */ break; =20 case SNK_NEGOTIATE_CAPABILITIES: From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EAF54C35272 for ; Mon, 7 Feb 2022 11:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379269AbiBGLQK (ORCPT ); Mon, 7 Feb 2022 06:16:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49766 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354980AbiBGLM2 (ORCPT ); Mon, 7 Feb 2022 06:12:28 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C54D7C043181; Mon, 7 Feb 2022 03:12:27 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 633496113B; Mon, 7 Feb 2022 11:12:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 41AA1C004E1; Mon, 7 Feb 2022 11:12:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232346; bh=880A3N1m8uxGACnXvYZQDn0CmPaaXP1yPfGtSMIAMvY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AJHONb9SgBz3g0AXeP2RibuqhljC7qQkmyfFSiCtzxYdMHGONXz1j6AWLZeJuBPyI YSP1AC4JBSYqWO8/UIl5K6PfjjIcXpBTT1OfwXBYD5USt0bX6eEaNB0sa1wbFS0sc3 aDxnoRWI7sxIp4CFdMYQBiasnfKD5gb9jTfKK2Io= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Marek=20Beh=C3=BAn?= , "David S. Miller" Subject: [PATCH 4.14 16/69] net: sfp: ignore disabled SFP node Date: Mon, 7 Feb 2022 12:05:38 +0100 Message-Id: <20220207103756.148355340@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Marek Beh=C3=BAn commit 2148927e6ed43a1667baf7c2ae3e0e05a44b51a0 upstream. Commit ce0aa27ff3f6 ("sfp: add sfp-bus to bridge between network devices and sfp cages") added code which finds SFP bus DT node even if the node is disabled with status =3D "disabled". Because of this, when phylink is created, it ends with non-null .sfp_bus member, even though the SFP module is not probed (because the node is disabled). We need to ignore disabled SFP bus node. Fixes: ce0aa27ff3f6 ("sfp: add sfp-bus to bridge between network devices an= d sfp cages") Signed-off-by: Marek Beh=C3=BAn Cc: stable@vger.kernel.org # 2203cbf2c8b5 ("net: sfp: move fwnode parsing i= nto sfp-bus layer") Signed-off-by: David S. Miller [ backport to 4.14 ] Signed-off-by: Marek Beh=C3=BAn Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/net/phy/phylink.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/net/phy/phylink.c +++ b/drivers/net/phy/phylink.c @@ -514,6 +514,11 @@ static int phylink_register_sfp(struct p if (!sfp_np) return 0; =20 + if (!of_device_is_available(sfp_np)) { + of_node_put(sfp_np); + return 0; + } + pl->sfp_bus =3D sfp_register_upstream(sfp_np, pl->netdev, pl, &sfp_phylink_ops); if (!pl->sfp_bus) From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0CC1BC433EF for ; Mon, 7 Feb 2022 11:16:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379481AbiBGLQM (ORCPT ); Mon, 7 Feb 2022 06:16:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49804 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355150AbiBGLMe (ORCPT ); Mon, 7 Feb 2022 06:12:34 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4F2AEC043181; Mon, 7 Feb 2022 03:12:32 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0684CB80EC3; Mon, 7 Feb 2022 11:12:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2B862C004E1; Mon, 7 Feb 2022 11:12:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232349; bh=ut4pxxVPBaNxm0x7it6MGjCmGKfZhZPsmMbZw11adRA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v4RcnNdi+Rgy04pxdZELNoQMHEejGcvkeILoPUJZ/defqkwUUWL5AEWIJMMjoq6kG AsV2o6o3qFy/MdGQKS5y82PXW8IweCWDeyFs4oAVp+CtMZQ5ZjqOi7F3c5DofA+0x+ dCmCYbThCfcbjoII4+6Y6k7QU0dyPIEB+qAUk5Bk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Erhard Furtner , Christophe Leroy , Michael Ellerman Subject: [PATCH 4.14 17/69] powerpc/32: Fix boot failure with GCC latent entropy plugin Date: Mon, 7 Feb 2022 12:05:39 +0100 Message-Id: <20220207103756.185978501@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe Leroy commit bba496656a73fc1d1330b49c7f82843836e9feb1 upstream. Boot fails with GCC latent entropy plugin enabled. This is due to early boot functions trying to access 'latent_entropy' global data while the kernel is not relocated at its final destination yet. As there is no way to tell GCC to use PTRRELOC() to access it, disable latent entropy plugin in early_32.o and feature-fixups.o and code-patching.o Fixes: 38addce8b600 ("gcc-plugins: Add latent_entropy plugin") Cc: stable@vger.kernel.org # v4.9+ Reported-by: Erhard Furtner Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D215217 Link: https://lore.kernel.org/r/2bac55483b8daf5b1caa163a45fa5f9cdbe18be4.16= 40178426.git.christophe.leroy@csgroup.eu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- arch/powerpc/kernel/Makefile | 1 + arch/powerpc/lib/Makefile | 3 +++ 2 files changed, 4 insertions(+) --- a/arch/powerpc/kernel/Makefile +++ b/arch/powerpc/kernel/Makefile @@ -15,6 +15,7 @@ CFLAGS_prom_init.o +=3D -fPIC CFLAGS_btext.o +=3D -fPIC endif =20 +CFLAGS_setup_32.o +=3D $(DISABLE_LATENT_ENTROPY_PLUGIN) CFLAGS_cputable.o +=3D $(DISABLE_LATENT_ENTROPY_PLUGIN) CFLAGS_prom_init.o +=3D $(DISABLE_LATENT_ENTROPY_PLUGIN) CFLAGS_btext.o +=3D $(DISABLE_LATENT_ENTROPY_PLUGIN) --- a/arch/powerpc/lib/Makefile +++ b/arch/powerpc/lib/Makefile @@ -10,6 +10,9 @@ ccflags-$(CONFIG_PPC64) :=3D $(NO_MINIMAL_ CFLAGS_REMOVE_code-patching.o =3D $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_feature-fixups.o =3D $(CC_FLAGS_FTRACE) =20 +CFLAGS_code-patching.o +=3D $(DISABLE_LATENT_ENTROPY_PLUGIN) +CFLAGS_feature-fixups.o +=3D $(DISABLE_LATENT_ENTROPY_PLUGIN) + obj-y +=3D string.o alloc.o code-patching.o feature-fixups.o =20 obj-$(CONFIG_PPC32) +=3D div64.o copy_32.o crtsavres.o From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 165B2C4707E for ; Mon, 7 Feb 2022 11:19:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379353AbiBGLQL (ORCPT ); Mon, 7 Feb 2022 06:16:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355151AbiBGLMe (ORCPT ); Mon, 7 Feb 2022 06:12:34 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CA254C043189; Mon, 7 Feb 2022 03:12:33 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6817D6113B; Mon, 7 Feb 2022 11:12:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 45D1EC004E1; Mon, 7 Feb 2022 11:12:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232352; bh=hzkoA9RNpWPUPM85IJrLneKFeBBznv5bXMYnnru7KF4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OSKoToU2iqZpcRe9o/seR6yfnKeNvooL9EZB7flpJUmO6SrfhGd7tMU3bC/Mg379Z xu2g7MjoGBwXcDYNjSiY59dsGebNG339WQZGKqc/pUIBVqpxYKJenm0WCaDWr79+Am H6v7AvHFQrSI1WiFHDV8FjcQuA+DZhtjwYiBxats= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kees Cook , Arnd Bergmann , Nick Desaulniers , Nathan Chancellor , Christophe Leroy Subject: [PATCH 4.14 18/69] lkdtm: Fix content of section containing lkdtm_rodata_do_nothing() Date: Mon, 7 Feb 2022 12:05:40 +0100 Message-Id: <20220207103756.217159399@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe Leroy commit bc93a22a19eb2b68a16ecf04cdf4b2ed65aaf398 upstream. On a kernel without CONFIG_STRICT_KERNEL_RWX, running EXEC_RODATA test leads to "Illegal instruction" failure. Looking at the content of rodata_objcopy.o, we see that the function content zeroes only: Disassembly of section .rodata: 0000000000000000 <.lkdtm_rodata_do_nothing>: 0: 00 00 00 00 .long 0x0 Add the contents flag in order to keep the content of the section while renaming it. Disassembly of section .rodata: 0000000000000000 <.lkdtm_rodata_do_nothing>: 0: 4e 80 00 20 blr Fixes: e9e08a07385e ("lkdtm: support llvm-objcopy") Cc: stable@vger.kernel.org Cc: Kees Cook Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Nick Desaulniers Cc: Nathan Chancellor Signed-off-by: Christophe Leroy Reviewed-by: Nick Desaulniers Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/8900731fbc05fb8b0de18af7133a8fc07c3c53a1.16= 33712176.git.christophe.leroy@csgroup.eu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/misc/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/misc/Makefile +++ b/drivers/misc/Makefile @@ -69,7 +69,7 @@ KCOV_INSTRUMENT_lkdtm_rodata.o :=3D n =20 OBJCOPYFLAGS :=3D OBJCOPYFLAGS_lkdtm_rodata_objcopy.o :=3D \ - --rename-section .text=3D.rodata,alloc,readonly,load + --rename-section .text=3D.rodata,alloc,readonly,load,contents targets +=3D lkdtm_rodata.o lkdtm_rodata_objcopy.o $(obj)/lkdtm_rodata_objcopy.o: $(obj)/lkdtm_rodata.o FORCE $(call if_changed,objcopy) From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1D5DEC4332F for ; Mon, 7 Feb 2022 11:16:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379692AbiBGLQO (ORCPT ); Mon, 7 Feb 2022 06:16:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49836 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355533AbiBGLMj (ORCPT ); Mon, 7 Feb 2022 06:12:39 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 899CFC043181; Mon, 7 Feb 2022 03:12:38 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4203BB81158; Mon, 7 Feb 2022 11:12:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 59DC0C004E1; Mon, 7 Feb 2022 11:12:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232356; bh=vK+HZo3Tvyg460B+nkSpIbDOI1U1G+kuCUFZrEnEw/s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lsSeBqlfdfQqHiQCCbsYsDkxnsZaTpBjfQkBXL103xtVe/0F9o2LJzuJ1XYhWufqb iVD0dDuE2wfMXkE7MgEhXp8DSAj7DMxtstxunU4QJYqkfcO2COzWmQx43kQdN9z6JD p+UU4LUn2QJL46f+89v4QpRaal762GKci1Iq2tkw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arkadiusz Kubalewski , Jedrzej Jagielski , Gurucharan G , Tony Nguyen Subject: [PATCH 4.14 19/69] i40e: Increase delay to 1 s after global EMP reset Date: Mon, 7 Feb 2022 12:05:41 +0100 Message-Id: <20220207103756.247650210@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jedrzej Jagielski commit 9b13bd53134c9ddd544a790125199fdbdb505e67 upstream. Recently simplified i40e_rebuild causes that FW sometimes is not ready after NVM update, the ping does not return. Increase the delay in case of EMP reset. Old delay of 300 ms was introduced for specific cards for 710 series. Now it works for all the cards and delay was increased. Fixes: 1fa51a650e1d ("i40e: Add delay after EMP reset for firmware to recov= er") Signed-off-by: Arkadiusz Kubalewski Signed-off-by: Jedrzej Jagielski Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/net/ethernet/intel/i40e/i40e_main.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -7245,15 +7245,9 @@ static void i40e_rebuild(struct i40e_pf } i40e_get_oem_version(&pf->hw); =20 - if (test_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state) && - ((hw->aq.fw_maj_ver =3D=3D 4 && hw->aq.fw_min_ver <=3D 33) || - hw->aq.fw_maj_ver < 4) && hw->mac.type =3D=3D I40E_MAC_XL710) { - /* The following delay is necessary for 4.33 firmware and older - * to recover after EMP reset. 200 ms should suffice but we - * put here 300 ms to be sure that FW is ready to operate - * after reset. - */ - mdelay(300); + if (test_and_clear_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state)) { + /* The following delay is necessary for firmware update. */ + mdelay(1000); } =20 /* re-verify the eeprom if we just had an EMP reset */ From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C98DC433FE for ; Mon, 7 Feb 2022 11:16:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379756AbiBGLQT (ORCPT ); Mon, 7 Feb 2022 06:16:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49848 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355609AbiBGLMk (ORCPT ); Mon, 7 Feb 2022 06:12:40 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E4E48C043181; Mon, 7 Feb 2022 03:12:39 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 737C16113B; Mon, 7 Feb 2022 11:12:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 56CDDC004E1; Mon, 7 Feb 2022 11:12:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232358; bh=21GWfXvoGM3JfY9PBYB8efgCAL2zUuXUMcw97qztprY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F/Rv1sAF21vYsXTfvhjkCx8HThFmug5ZWCLlkwKZxliaG5Vt4Qe8rB4g2vaE+B4qc o7FTDbWfYygIIhDb0DsFPFYvfTSvXLIoSCTOEVZQ/qa80dsAr8rJaVpwI+Ysdric2e 1l+oU6rIYcB0509TgVL0pK4AkYZnuQTF6sQitOQM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joe Damato , kernel test robot , Gurucharan G , Tony Nguyen Subject: [PATCH 4.14 20/69] i40e: fix unsigned stat widths Date: Mon, 7 Feb 2022 12:05:42 +0100 Message-Id: <20220207103756.279586065@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joe Damato commit 3b8428b84539c78fdc8006c17ebd25afd4722d51 upstream. Change i40e_update_vsi_stats and struct i40e_vsi to use u64 fields to match the width of the stats counters in struct i40e_rx_queue_stats. Update debugfs code to use the correct format specifier for u64. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Joe Damato Reported-by: kernel test robot Tested-by: Gurucharan G Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/net/ethernet/intel/i40e/i40e.h | 8 ++++---- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++-- 3 files changed, 7 insertions(+), 7 deletions(-) --- a/drivers/net/ethernet/intel/i40e/i40e.h +++ b/drivers/net/ethernet/intel/i40e/i40e.h @@ -627,12 +627,12 @@ struct i40e_vsi { struct rtnl_link_stats64 net_stats_offsets; struct i40e_eth_stats eth_stats; struct i40e_eth_stats eth_stats_offsets; - u32 tx_restart; - u32 tx_busy; + u64 tx_restart; + u64 tx_busy; u64 tx_linearize; u64 tx_force_wb; - u32 rx_buf_failed; - u32 rx_page_failed; + u64 rx_buf_failed; + u64 rx_page_failed; =20 /* These are containers of ring pointers, allocated at run-time */ struct i40e_ring **rx_rings; --- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c @@ -259,7 +259,7 @@ static void i40e_dbg_dump_vsi_seid(struc (unsigned long int)vsi->net_stats_offsets.rx_compressed, (unsigned long int)vsi->net_stats_offsets.tx_compressed); dev_info(&pf->pdev->dev, - " tx_restart =3D %d, tx_busy =3D %d, rx_buf_failed =3D %d, rx_page_f= ailed =3D %d\n", + " tx_restart =3D %llu, tx_busy =3D %llu, rx_buf_failed =3D %llu, rx_= page_failed =3D %llu\n", vsi->tx_restart, vsi->tx_busy, vsi->rx_buf_failed, vsi->rx_page_failed); rcu_read_lock(); --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -778,9 +778,9 @@ static void i40e_update_vsi_stats(struct struct rtnl_link_stats64 *ns; /* netdev stats */ struct i40e_eth_stats *oes; struct i40e_eth_stats *es; /* device's eth stats */ - u32 tx_restart, tx_busy; + u64 tx_restart, tx_busy; struct i40e_ring *p; - u32 rx_page, rx_buf; + u64 rx_page, rx_buf; u64 bytes, packets; unsigned int start; u64 tx_linearize; From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE629C4167B for ; Mon, 7 Feb 2022 11:17:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345000AbiBGLN6 (ORCPT ); Mon, 7 Feb 2022 06:13:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49142 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237205AbiBGLLF (ORCPT ); Mon, 7 Feb 2022 06:11:05 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 477D4C0401C1; Mon, 7 Feb 2022 03:11:04 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0DF45B811A6; Mon, 7 Feb 2022 11:11:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 52ADBC004E1; Mon, 7 Feb 2022 11:11:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232261; bh=HoMyJXz97HdBTqBQY7JhzI1zoEnUBX8t+3RwFnC0Vw8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AK+SvVEgQR2UDX85yhSI/3KTfNdYecWBdhwuHtCssecbQPnzlYSW0YfCh3veKS/jb Y/SDOtVwHzQ5CMu6CiOrt6HYzJP2Z/D5jUVvIyW+3dyPr69wHYq/sfuhHVpqlzJveG OWxygg3eh8EdTiwpt1emHq3LYr/nVc8uEAe7e214= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sujit Kautkar , Matthias Kaehlcke , Mathieu Poirier , Bjorn Andersson , Stephen Boyd Subject: [PATCH 4.14 21/69] rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev Date: Mon, 7 Feb 2022 12:05:43 +0100 Message-Id: <20220207103756.312194100@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sujit Kautkar commit b7fb2dad571d1e21173c06cef0bced77b323990a upstream. struct rpmsg_ctrldev contains a struct cdev. The current code frees the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_ctrldev could be freed before the cdev is entirely released, as in the backtrace below. [ 93.625603] ODEBUG: free active (active state 0) object type: timer_list= hint: delayed_work_timer_fn+0x0/0x7c [ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_prin= t_object+0x13c/0x1b0 [ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif= _hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vma= lloc venus_enc venus_dec videobuf2_dma_contig hci_uart btandroid btqca snd_= soc_rt5682_i2c bluetooth qcom_spmi_temp_alarm snd_soc_rt5682v [ 93.715175] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B = 5.4.163-lockdep #26 [ 93.723855] Hardware name: Google Lazor (rev3 - 8) with LTE (DT) [ 93.730055] Workqueue: events kobject_delayed_cleanup [ 93.735271] pstate: 60c00009 (nZCv daif +PAN +UAO) [ 93.740216] pc : debug_print_object+0x13c/0x1b0 [ 93.744890] lr : debug_print_object+0x13c/0x1b0 [ 93.749555] sp : ffffffacf5bc7940 [ 93.752978] x29: ffffffacf5bc7940 x28: dfffffd000000000 [ 93.758448] x27: ffffffacdb11a800 x26: dfffffd000000000 [ 93.763916] x25: ffffffd0734f856c x24: dfffffd000000000 [ 93.769389] x23: 0000000000000000 x22: ffffffd0733c35b0 [ 93.774860] x21: ffffffd0751994a0 x20: ffffffd075ec27c0 [ 93.780338] x19: ffffffd075199100 x18: 00000000000276e0 [ 93.785814] x17: 0000000000000000 x16: dfffffd000000000 [ 93.791291] x15: ffffffffffffffff x14: 6e6968207473696c [ 93.796768] x13: 0000000000000000 x12: ffffffd075e2b000 [ 93.802244] x11: 0000000000000001 x10: 0000000000000000 [ 93.807723] x9 : d13400dff1921900 x8 : d13400dff1921900 [ 93.813200] x7 : 0000000000000000 x6 : 0000000000000000 [ 93.818676] x5 : 0000000000000080 x4 : 0000000000000000 [ 93.824152] x3 : ffffffd0732a0fa4 x2 : 0000000000000001 [ 93.829628] x1 : ffffffacf5bc7580 x0 : 0000000000000061 [ 93.835104] Call trace: [ 93.837644] debug_print_object+0x13c/0x1b0 [ 93.841963] __debug_check_no_obj_freed+0x25c/0x3c0 [ 93.846987] debug_check_no_obj_freed+0x18/0x20 [ 93.851669] slab_free_freelist_hook+0xbc/0x1e4 [ 93.856346] kfree+0xfc/0x2f4 [ 93.859416] rpmsg_ctrldev_release_device+0x78/0xb8 [ 93.864445] device_release+0x84/0x168 [ 93.868310] kobject_cleanup+0x12c/0x298 [ 93.872356] kobject_delayed_cleanup+0x10/0x18 [ 93.876948] process_one_work+0x578/0x92c [ 93.881086] worker_thread+0x804/0xcf8 [ 93.884963] kthread+0x2a8/0x314 [ 93.888303] ret_from_fork+0x10/0x18 The cdev_device_add/del() API was created to address this issue (see commit '233ed09d7fda ("chardev: add helper function to register char devs with a struct device")'), use it instead of cdev add/del(). Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface") Signed-off-by: Sujit Kautkar Signed-off-by: Matthias Kaehlcke Reviewed-by: Mathieu Poirier Reviewed-by: Bjorn Andersson Reviewed-by: Stephen Boyd Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220110104706.v6.1.Iaac908f3e3149a89190ce0= 06ba166e2d3fd247a3@changeid Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/rpmsg/rpmsg_char.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) --- a/drivers/rpmsg/rpmsg_char.c +++ b/drivers/rpmsg/rpmsg_char.c @@ -461,7 +461,6 @@ static void rpmsg_ctrldev_release_device =20 ida_simple_remove(&rpmsg_ctrl_ida, dev->id); ida_simple_remove(&rpmsg_minor_ida, MINOR(dev->devt)); - cdev_del(&ctrldev->cdev); kfree(ctrldev); } =20 @@ -496,19 +495,13 @@ static int rpmsg_chrdev_probe(struct rpm dev->id =3D ret; dev_set_name(&ctrldev->dev, "rpmsg_ctrl%d", ret); =20 - ret =3D cdev_add(&ctrldev->cdev, dev->devt, 1); + ret =3D cdev_device_add(&ctrldev->cdev, &ctrldev->dev); if (ret) goto free_ctrl_ida; =20 /* We can now rely on the release function for cleanup */ dev->release =3D rpmsg_ctrldev_release_device; =20 - ret =3D device_add(dev); - if (ret) { - dev_err(&rpdev->dev, "device_add failed: %d\n", ret); - put_device(dev); - } - dev_set_drvdata(&rpdev->dev, ctrldev); =20 return ret; @@ -534,7 +527,7 @@ static void rpmsg_chrdev_remove(struct r if (ret) dev_warn(&rpdev->dev, "failed to nuke endpoints: %d\n", ret); =20 - device_del(&ctrldev->dev); + cdev_device_del(&ctrldev->cdev, &ctrldev->dev); put_device(&ctrldev->dev); } =20 From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5E375C43219 for ; Mon, 7 Feb 2022 11:17:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357035AbiBGLOE (ORCPT ); Mon, 7 Feb 2022 06:14:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237446AbiBGLLI (ORCPT ); Mon, 7 Feb 2022 06:11:08 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 47724C0401C2; Mon, 7 Feb 2022 03:11:07 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CE395B80EE8; Mon, 7 Feb 2022 11:11:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 26689C004E1; Mon, 7 Feb 2022 11:11:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232264; bh=12+XRnUkK1YiZyIwooK5VNDKUbZ4JVlVTLRFQrsnyk0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ri2l2oEjTaXVyNVuexlg8EDC8P8ipwX/2Ei39Y29CsFuVUaXfdIJ4svRB9cIZHjE2 gqOSnkmpmdqCfOHh1OObSg9Gv3OlycVY2eaelHK7NvyRp5g+DvsnLEn+duGwcpYiVQ TCfZP91G533LANmP17xZM+TPJufAnJpT8gxG3JHI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bjorn Andersson , Matthias Kaehlcke , Mathieu Poirier , Stephen Boyd Subject: [PATCH 4.14 22/69] rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev Date: Mon, 7 Feb 2022 12:05:44 +0100 Message-Id: <20220207103756.343442688@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Matthias Kaehlcke commit 7a534ae89e34e9b51acb5a63dd0f88308178b46a upstream. struct rpmsg_eptdev contains a struct cdev. The current code frees the rpmsg_eptdev struct in rpmsg_eptdev_destroy(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_eptdev could be freed before the cdev is entirely released. The cdev_device_add/del() API was created to address this issue (see commit '233ed09d7fda ("chardev: add helper function to register char devs with a struct device")'), use it instead of cdev add/del(). Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface") Suggested-by: Bjorn Andersson Signed-off-by: Matthias Kaehlcke Reviewed-by: Mathieu Poirier Reviewed-by: Stephen Boyd Reviewed-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220110104706.v6.2.Idde68b05b88d4a2e6e5476= 6c653f3a6d9e419ce6@changeid Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/rpmsg/rpmsg_char.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) --- a/drivers/rpmsg/rpmsg_char.c +++ b/drivers/rpmsg/rpmsg_char.c @@ -100,7 +100,7 @@ static int rpmsg_eptdev_destroy(struct d /* wake up any blocked readers */ wake_up_interruptible(&eptdev->readq); =20 - device_del(&eptdev->dev); + cdev_device_del(&eptdev->cdev, &eptdev->dev); put_device(&eptdev->dev); =20 return 0; @@ -336,7 +336,6 @@ static void rpmsg_eptdev_release_device( =20 ida_simple_remove(&rpmsg_ept_ida, dev->id); ida_simple_remove(&rpmsg_minor_ida, MINOR(eptdev->dev.devt)); - cdev_del(&eptdev->cdev); kfree(eptdev); } =20 @@ -381,19 +380,13 @@ static int rpmsg_eptdev_create(struct rp dev->id =3D ret; dev_set_name(dev, "rpmsg%d", ret); =20 - ret =3D cdev_add(&eptdev->cdev, dev->devt, 1); + ret =3D cdev_device_add(&eptdev->cdev, &eptdev->dev); if (ret) goto free_ept_ida; =20 /* We can now rely on the release function for cleanup */ dev->release =3D rpmsg_eptdev_release_device; =20 - ret =3D device_add(dev); - if (ret) { - dev_err(dev, "device_add failed: %d\n", ret); - put_device(dev); - } - return ret; =20 free_ept_ida: From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A9EDC4167B for ; Mon, 7 Feb 2022 11:18:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358811AbiBGLOo (ORCPT ); Mon, 7 Feb 2022 06:14:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49174 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237603AbiBGLLK (ORCPT ); Mon, 7 Feb 2022 06:11:10 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D07F6C0401C3; Mon, 7 Feb 2022 03:11:08 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3ABA361370; Mon, 7 Feb 2022 11:11:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1487FC004E1; Mon, 7 Feb 2022 11:11:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232267; bh=zH6xjsjtDdjji8SvkgS/3Syp1wfIqw2wjB6Nj/YZb9I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X/bI4erCHzr5hweBKyiwpFoylDkP4gQK84OUCFRL7qQR4OAyl0UShgBXg/OUgVAvw HjRMHTGHan0T/EbVu10Fk2TOIcpk8PRiXljzqUQM4SaP+NeHAwsAyWP1bhEJoQnHZL YSP5OjKtT5ckigqPVvMGjCoyHAFxCEVfchpYJgFA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guangwu Zhang , Maurizio Lombardi , John Meneghini , "Martin K. Petersen" Subject: [PATCH 4.14 23/69] scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() Date: Mon, 7 Feb 2022 12:05:45 +0100 Message-Id: <20220207103756.375683399@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: John Meneghini commit 847f9ea4c5186fdb7b84297e3eeed9e340e83fce upstream. The bnx2fc_destroy() functions are removing the interface before calling destroy_work. This results multiple WARNings from sysfs_remove_group() as the controller rport device attributes are removed too early. Replace the fcoe_port's destroy_work queue. It's not needed. The problem is easily reproducible with the following steps. Example: $ dmesg -w & $ systemctl enable --now fcoe $ fipvlan -s -c ens2f1 $ fcoeadm -d ens2f1.802 [ 583.464488] host2: libfc: Link down on port (7500a1) [ 583.472651] bnx2fc: 7500a1 - rport not created Yet!! [ 583.490468] ------------[ cut here ]------------ [ 583.538725] sysfs group 'power' not found for kobject 'rport-2:0-0' [ 583.568814] WARNING: CPU: 3 PID: 192 at fs/sysfs/group.c:279 sysfs_rem= ove_group+0x6f/0x80 [ 583.607130] Modules linked in: dm_service_time 8021q garp mrp stp llc = bnx2fc cnic uio rpcsec_gss_krb5 auth_rpcgss nfsv4 ... [ 583.942994] CPU: 3 PID: 192 Comm: kworker/3:2 Kdump: loaded Not tainte= d 5.14.0-39.el9.x86_64 #1 [ 583.984105] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013 [ 584.016535] Workqueue: fc_wq_2 fc_rport_final_delete [scsi_transport_f= c] [ 584.050691] RIP: 0010:sysfs_remove_group+0x6f/0x80 [ 584.074725] Code: ff 5b 48 89 ef 5d 41 5c e9 ee c0 ff ff 48 89 ef e8 f= 6 b8 ff ff eb d1 49 8b 14 24 48 8b 33 48 c7 c7 ... [ 584.162586] RSP: 0018:ffffb567c15afdc0 EFLAGS: 00010282 [ 584.188225] RAX: 0000000000000000 RBX: ffffffff8eec4220 RCX: 000000000= 0000000 [ 584.221053] RDX: ffff8c1586ce84c0 RSI: ffff8c1586cd7cc0 RDI: ffff8c158= 6cd7cc0 [ 584.255089] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffb567c= 15afc00 [ 584.287954] R10: ffffb567c15afbf8 R11: ffffffff8fbe7f28 R12: ffff8c148= 6326400 [ 584.322356] R13: ffff8c1486326480 R14: ffff8c1483a4a000 R15: 000000000= 0000004 [ 584.355379] FS: 0000000000000000(0000) GS:ffff8c1586cc0000(0000) knlG= S:0000000000000000 [ 584.394419] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 584.421123] CR2: 00007fe95a6f7840 CR3: 0000000107674002 CR4: 000000000= 00606e0 [ 584.454888] Call Trace: [ 584.466108] device_del+0xb2/0x3e0 [ 584.481701] device_unregister+0x13/0x60 [ 584.501306] bsg_unregister_queue+0x5b/0x80 [ 584.522029] bsg_remove_queue+0x1c/0x40 [ 584.541884] fc_rport_final_delete+0xf3/0x1d0 [scsi_transport_fc] [ 584.573823] process_one_work+0x1e3/0x3b0 [ 584.592396] worker_thread+0x50/0x3b0 [ 584.609256] ? rescuer_thread+0x370/0x370 [ 584.628877] kthread+0x149/0x170 [ 584.643673] ? set_kthread_struct+0x40/0x40 [ 584.662909] ret_from_fork+0x22/0x30 [ 584.680002] ---[ end trace 53575ecefa942ece ]--- Link: https://lore.kernel.org/r/20220115040044.1013475-1-jmeneghi@redhat.com Fixes: 0cbf32e1681d ("[SCSI] bnx2fc: Avoid calling bnx2fc_if_destroy with u= nnecessary locks") Tested-by: Guangwu Zhang Co-developed-by: Maurizio Lombardi Signed-off-by: Maurizio Lombardi Signed-off-by: John Meneghini Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 20 +++++--------------- 1 file changed, 5 insertions(+), 15 deletions(-) --- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c @@ -80,7 +80,7 @@ static int bnx2fc_bind_pcidev(struct bnx static void bnx2fc_unbind_pcidev(struct bnx2fc_hba *hba); static struct fc_lport *bnx2fc_if_create(struct bnx2fc_interface *interfac= e, struct device *parent, int npiv); -static void bnx2fc_destroy_work(struct work_struct *work); +static void bnx2fc_port_destroy(struct fcoe_port *port); =20 static struct bnx2fc_hba *bnx2fc_hba_lookup(struct net_device *phys_dev); static struct bnx2fc_interface *bnx2fc_interface_lookup(struct net_device @@ -911,9 +911,6 @@ static void bnx2fc_indicate_netevent(voi __bnx2fc_destroy(interface); } mutex_unlock(&bnx2fc_dev_lock); - - /* Ensure ALL destroy work has been completed before return */ - flush_workqueue(bnx2fc_wq); return; =20 default: @@ -1220,8 +1217,8 @@ static int bnx2fc_vport_destroy(struct f mutex_unlock(&n_port->lp_mutex); bnx2fc_free_vport(interface->hba, port->lport); bnx2fc_port_shutdown(port->lport); + bnx2fc_port_destroy(port); bnx2fc_interface_put(interface); - queue_work(bnx2fc_wq, &port->destroy_work); return 0; } =20 @@ -1530,7 +1527,6 @@ static struct fc_lport *bnx2fc_if_create port->lport =3D lport; port->priv =3D interface; port->get_netdev =3D bnx2fc_netdev; - INIT_WORK(&port->destroy_work, bnx2fc_destroy_work); =20 /* Configure fcoe_port */ rc =3D bnx2fc_lport_config(lport); @@ -1658,8 +1654,8 @@ static void __bnx2fc_destroy(struct bnx2 bnx2fc_interface_cleanup(interface); bnx2fc_stop(interface); list_del(&interface->list); + bnx2fc_port_destroy(port); bnx2fc_interface_put(interface); - queue_work(bnx2fc_wq, &port->destroy_work); } =20 /** @@ -1700,15 +1696,12 @@ netdev_err: return rc; } =20 -static void bnx2fc_destroy_work(struct work_struct *work) +static void bnx2fc_port_destroy(struct fcoe_port *port) { - struct fcoe_port *port; struct fc_lport *lport; =20 - port =3D container_of(work, struct fcoe_port, destroy_work); lport =3D port->lport; - - BNX2FC_HBA_DBG(lport, "Entered bnx2fc_destroy_work\n"); + BNX2FC_HBA_DBG(lport, "Entered %s, destroying lport %p\n", __func__, lpor= t); =20 bnx2fc_if_destroy(lport); } @@ -2563,9 +2556,6 @@ static void bnx2fc_ulp_exit(struct cnic_ __bnx2fc_destroy(interface); mutex_unlock(&bnx2fc_dev_lock); =20 - /* Ensure ALL destroy work has been completed before return */ - flush_workqueue(bnx2fc_wq); - bnx2fc_ulp_stop(hba); /* unregister cnic device */ if (test_and_clear_bit(BNX2FC_CNIC_REGISTERED, &hba->reg_with_cnic)) From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B4E5C4167D for ; Mon, 7 Feb 2022 11:18:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358683AbiBGLOm (ORCPT ); Mon, 7 Feb 2022 06:14:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49190 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237608AbiBGLLN (ORCPT ); Mon, 7 Feb 2022 06:11:13 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1DACFC043189; Mon, 7 Feb 2022 03:11:11 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5903761261; Mon, 7 Feb 2022 11:11:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D566C004E1; Mon, 7 Feb 2022 11:11:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232270; bh=LofvoD++y0cI0rj6jzjMl5u28SoUraGudXV1rpHib6U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ci8z3U2QCysK7Lr2zO103DaOJfAqKdcpyiOIhwWM2AokZ7e0ToPkjnPx0fNepXj2S O2KpSWpbVKHu0gB4SETdq/10eqo5xdNmFY0ogGjKDKhZRczmlmmsHWSYtFtAlBFbhg hQZCxmmLYfOV84rFhIp+kycSeJ60ylWSa2ep9RRA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maksym Yaremchuk , Ido Schimmel , Amit Cohen , "David S. Miller" Subject: [PATCH 4.14 24/69] ipv6_tunnel: Rate limit warning messages Date: Mon, 7 Feb 2022 12:05:46 +0100 Message-Id: <20220207103756.407890470@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ido Schimmel commit 6cee105e7f2ced596373951d9ea08dacc3883c68 upstream. The warning messages can be invoked from the data path for every packet transmitted through an ip6gre netdev, leading to high CPU utilization. Fix that by rate limiting the messages. Fixes: 09c6bbf090ec ("[IPV6]: Do mandatory IPv6 tunnel endpoint checks in r= ealtime") Reported-by: Maksym Yaremchuk Tested-by: Maksym Yaremchuk Signed-off-by: Ido Schimmel Reviewed-by: Amit Cohen Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- net/ipv6/ip6_tunnel.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1008,12 +1008,12 @@ int ip6_tnl_xmit_ctl(struct ip6_tnl *t, ldev =3D dev_get_by_index_rcu(net, p->link); =20 if (unlikely(!ipv6_chk_addr(net, laddr, ldev, 0))) - pr_warn("%s xmit: Local address not yet configured!\n", - p->name); + pr_warn_ratelimited("%s xmit: Local address not yet configured!\n", + p->name); else if (!ipv6_addr_is_multicast(raddr) && unlikely(ipv6_chk_addr(net, raddr, NULL, 0))) - pr_warn("%s xmit: Routing loop! Remote address found on this node!\n", - p->name); + pr_warn_ratelimited("%s xmit: Routing loop! Remote address found on thi= s node!\n", + p->name); else ret =3D 1; rcu_read_unlock(); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25C1AC43219 for ; Mon, 7 Feb 2022 11:18:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358480AbiBGLOl (ORCPT ); Mon, 7 Feb 2022 06:14:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49218 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238560AbiBGLLP (ORCPT ); Mon, 7 Feb 2022 06:11:15 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E717BC0401C4; Mon, 7 Feb 2022 03:11:14 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 77C8561261; Mon, 7 Feb 2022 11:11:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A0F7C340EB; Mon, 7 Feb 2022 11:11:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232273; bh=sm5sbFHOTB/cW9HRgnuJ81rw67nPFJSlWPf3S0Er/qk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kkVNuTpI0qPRpVD1v15A+AWWPvhHgYi5X8MfoaFdzr08RPtlHdBsZcEj9kEryNujp PaIGrgwbtOWql672TwATEGjILh6Boa50eyVeBbbOctWjF7KCvsJQaoIAFtJVrxmpki NtpNQb2MedYCOpjkcPjqNoC6BPA/yipw0hmqOFbQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Congyu Liu , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 25/69] net: fix information leakage in /proc/net/ptype Date: Mon, 7 Feb 2022 12:05:47 +0100 Message-Id: <20220207103756.446972586@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Congyu Liu commit 47934e06b65637c88a762d9c98329ae6e3238888 upstream. In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_type` added by this packet socket by reading `/proc/net/ptype` file. This is minor information leakage as packet socket is namespace aware. Add a net pointer in `packet_type` to keep the net namespace of of corresponding packet socket. In `ptype_seq_show`, this net pointer must be checked when it is not NULL. Fixes: 2feb27dbe00c ("[NETNS]: Minor information leak via /proc/net/ptype f= ile.") Signed-off-by: Congyu Liu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- include/linux/netdevice.h | 1 + net/core/net-procfs.c | 3 ++- net/packet/af_packet.c | 2 ++ 3 files changed, 5 insertions(+), 1 deletion(-) --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -2206,6 +2206,7 @@ struct packet_type { struct net_device *); bool (*id_match)(struct packet_type *ptype, struct sock *sk); + struct net *af_packet_net; void *af_packet_priv; struct list_head list; }; --- a/net/core/net-procfs.c +++ b/net/core/net-procfs.c @@ -279,7 +279,8 @@ static int ptype_seq_show(struct seq_fil =20 if (v =3D=3D SEQ_START_TOKEN) seq_puts(seq, "Type Device Function\n"); - else if (pt->dev =3D=3D NULL || dev_net(pt->dev) =3D=3D seq_file_net(seq)= ) { + else if ((!pt->af_packet_net || net_eq(pt->af_packet_net, seq_file_net(se= q))) && + (!pt->dev || net_eq(dev_net(pt->dev), seq_file_net(seq)))) { if (pt->type =3D=3D htons(ETH_P_ALL)) seq_puts(seq, "ALL "); else --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1756,6 +1756,7 @@ static int fanout_add(struct sock *sk, u match->prot_hook.dev =3D po->prot_hook.dev; match->prot_hook.func =3D packet_rcv_fanout; match->prot_hook.af_packet_priv =3D match; + match->prot_hook.af_packet_net =3D read_pnet(&match->net); match->prot_hook.id_match =3D match_fanout_group; list_add(&match->list, &fanout_list); } @@ -3330,6 +3331,7 @@ static int packet_create(struct net *net po->prot_hook.func =3D packet_rcv_spkt; =20 po->prot_hook.af_packet_priv =3D sk; + po->prot_hook.af_packet_net =3D sock_net(sk); =20 if (proto) { po->prot_hook.type =3D proto; From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A6F0C41535 for ; Mon, 7 Feb 2022 11:18:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358966AbiBGLOr (ORCPT ); Mon, 7 Feb 2022 06:14:47 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49268 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241733AbiBGLLT (ORCPT ); Mon, 7 Feb 2022 06:11:19 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7985BC0401C1; Mon, 7 Feb 2022 03:11:19 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2AB91B80EE8; Mon, 7 Feb 2022 11:11:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5F04AC004E1; Mon, 7 Feb 2022 11:11:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232276; bh=YsRx6WK12xvS86SkETnSzshMl+yodYOA2OdexcTU104=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jYLJH1HvHx9SBAG0Obw8aPv0Zyqxhc423jbEFR6Fbb/I8Lt6FhWI5pCW/guHGZnt9 DpJrusd1vNthFOu/hzIGbWgwZnNYOJifWqa8yDGWg3hgPmfzJ6R9DP/PsfYnnrrigi 5sW0McmizOOeQ8g3S8nWM8ifwCiUroMhwzs1X8fk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangbin Liu , Xin Long , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 26/69] ping: fix the sk_bound_dev_if match in ping_lookup Date: Mon, 7 Feb 2022 12:05:48 +0100 Message-Id: <20220207103756.484887582@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xin Long commit 2afc3b5a31f9edf3ef0f374f5d70610c79c93a42 upstream. When 'ping' changes to use PING socket instead of RAW socket by: # sysctl -w net.ipv4.ping_group_range=3D"0 100" the selftests 'router_broadcast.sh' will fail, as such command # ip vrf exec vrf-h1 ping -I veth0 198.51.100.255 -b can't receive the response skb by the PING socket. It's caused by mismatch of sk_bound_dev_if and dif in ping_rcv() when looking up the PING socket, as dif is vrf-h1 if dif's master was set to vrf-h1. This patch is to fix this regression by also checking the sk_bound_dev_if against sdif so that the packets can stil be received even if the socket is not bound to the vrf device but to the real iif. Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind") Reported-by: Hangbin Liu Signed-off-by: Xin Long Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- net/ipv4/ping.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/ipv4/ping.c +++ b/net/ipv4/ping.c @@ -225,7 +225,8 @@ static struct sock *ping_lookup(struct n continue; } =20 - if (sk->sk_bound_dev_if && sk->sk_bound_dev_if !=3D dif) + if (sk->sk_bound_dev_if && sk->sk_bound_dev_if !=3D dif && + sk->sk_bound_dev_if !=3D inet_sdif(skb)) continue; =20 sock_hold(sk); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 800F4C4167E for ; Mon, 7 Feb 2022 11:18:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359246AbiBGLOt (ORCPT ); Mon, 7 Feb 2022 06:14:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49294 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244127AbiBGLLW (ORCPT ); Mon, 7 Feb 2022 06:11:22 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 18BD8C043188; Mon, 7 Feb 2022 03:11:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A228861388; Mon, 7 Feb 2022 11:11:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 61B1DC004E1; Mon, 7 Feb 2022 11:11:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232280; bh=Uy/xBrLc3Mn2iT8mVCcdW2XFCgcS+4RcXsgRvWliJ7Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZhfRwsSjL8kryVJsjIE1+t/2g0hkQeHilbt6sYAEq87PdneZl8EA+9LvD0imvVNWO l36Vsui64SBX4JYbjc0+2kG3RN66pBO/UxNfUZxejahzXhMGy5UFnDsxOtrtd841Ql QNB/Sp00mDdU/sC33vD0zzzmdLR8dAeg9uwK1td0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , David Ahern , Ray Che , Willy Tarreau , Jakub Kicinski Subject: [PATCH 4.14 27/69] ipv4: avoid using shared IP generator for connected sockets Date: Mon, 7 Feb 2022 12:05:49 +0100 Message-Id: <20220207103756.517075813@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 23f57406b82de51809d5812afd96f210f8b627f3 upstream. ip_select_ident_segs() has been very conservative about using the connected socket private generator only for packets with IP_DF set, claiming it was needed for some VJ compression implementations. As mentioned in this referenced document, this can be abused. (Ref: Off-Path TCP Exploits of the Mixed IPID Assignment) Before switching to pure random IPID generation and possibly hurt some workloads, lets use the private inet socket generator. Not only this will remove one vulnerability, this will also improve performance of TCP flows using pmtudisc=3D=3DIP_PMTUDISC_DONT Fixes: 73f156a6e8c1 ("inetpeer: get rid of ip_id_count") Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Reported-by: Ray Che Cc: Willy Tarreau Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- include/net/ip.h | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) --- a/include/net/ip.h +++ b/include/net/ip.h @@ -399,19 +399,18 @@ static inline void ip_select_ident_segs( { struct iphdr *iph =3D ip_hdr(skb); =20 + /* We had many attacks based on IPID, use the private + * generator as much as we can. + */ + if (sk && inet_sk(sk)->inet_daddr) { + iph->id =3D htons(inet_sk(sk)->inet_id); + inet_sk(sk)->inet_id +=3D segs; + return; + } if ((iph->frag_off & htons(IP_DF)) && !skb->ignore_df) { - /* This is only to work around buggy Windows95/2000 - * VJ compression implementations. If the ID field - * does not change, they drop every other packet in - * a TCP stream using header compression. - */ - if (sk && inet_sk(sk)->inet_daddr) { - iph->id =3D htons(inet_sk(sk)->inet_id); - inet_sk(sk)->inet_id +=3D segs; - } else { - iph->id =3D 0; - } + iph->id =3D 0; } else { + /* Unfortunately we need the big hammer to get a suitable IPID */ __ip_select_ident(net, iph, segs); } } From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 916B5C46467 for ; Mon, 7 Feb 2022 11:18:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359433AbiBGLOw (ORCPT ); Mon, 7 Feb 2022 06:14:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49336 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343595AbiBGLL0 (ORCPT ); Mon, 7 Feb 2022 06:11:26 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 994D3C043181; Mon, 7 Feb 2022 03:11:25 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 54CBDB80EC3; Mon, 7 Feb 2022 11:11:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77227C004E1; Mon, 7 Feb 2022 11:11:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232283; bh=vUVllwFVFBsSbxrgKrcpea+UkBuD/6BtF3/nSWDWPlQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rKOa0us9b+4DVWNAlZQFSJJm9h8a2nys09WHOq0GdjuldciughsUygZm1F98WKPYQ IpZ0vvGmXxTIlYL6op2wYsYZmYT3v4IwZS7i8pc9rsAZ8ip0pVz1lVPogVnxK4Wduw ldzF3dWHv2k4DjO3g7nq1jb1NX4M4H2udVUo2B8c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guenter Roeck , Sasha Levin Subject: [PATCH 4.14 28/69] hwmon: (lm90) Reduce maximum conversion rate for G781 Date: Mon, 7 Feb 2022 12:05:50 +0100 Message-Id: <20220207103756.549415962@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Guenter Roeck [ Upstream commit a66c5ed539277b9f2363bbace0dba88b85b36c26 ] According to its datasheet, G781 supports a maximum conversion rate value of 8 (62.5 ms). However, chips labeled G781 and G780 were found to only support a maximum conversion rate value of 7 (125 ms). On the other side, chips labeled G781-1 and G784 were found to support a conversion rate value of 8. There is no known means to distinguish G780 from G781 or G784; all chips report the same manufacturer ID and chip revision. Setting the conversion rate register value to 8 on chips not supporting it causes unexpected behavior since the real conversion rate is set to 0 (16 seconds) if a value of 8 is written into the conversion rate register. Limit the conversion rate register value to 7 for all G78x chips to avoid the problem. Fixes: ae544f64cc7b ("hwmon: (lm90) Add support for GMT G781") Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/hwmon/lm90.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/hwmon/lm90.c +++ b/drivers/hwmon/lm90.c @@ -359,7 +359,7 @@ static const struct lm90_params lm90_par .flags =3D LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_BROKEN_ALERT, .alert_alarms =3D 0x7c, - .max_convrate =3D 8, + .max_convrate =3D 7, }, [lm86] =3D { .flags =3D LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT, From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8CCCC3526C for ; Mon, 7 Feb 2022 11:18:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359487AbiBGLOy (ORCPT ); Mon, 7 Feb 2022 06:14:54 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49352 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343686AbiBGLL1 (ORCPT ); Mon, 7 Feb 2022 06:11:27 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 480DDC043181; Mon, 7 Feb 2022 03:11:27 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D9F0261380; Mon, 7 Feb 2022 11:11:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B1D58C004E1; Mon, 7 Feb 2022 11:11:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232286; bh=AZIGNPFfhItQhXw/IiZddg19DkJESQI6M1ZOK2QqI6c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SkUGFBcF/Kw6+SMW8BK60qTWwvRvpNFOGpLS6BNyGDa8E3E/whCiEiL40EmL3pCRw OK6MBrxuyhLGtO8S/vZRECnNvCmnbG47iEEBT+secd2jKGOn9aemcLtGdOjgsIOEjv MnWnEhb3TF0k3qkX1kbqv59CUqvkev2Otx42zaw8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lyu Tao , Trond Myklebust , Anna Schumaker Subject: [PATCH 4.14 29/69] NFSv4: Handle case where the lookup of a directory fails Date: Mon, 7 Feb 2022 12:05:51 +0100 Message-Id: <20220207103756.580477443@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Trond Myklebust commit ac795161c93699d600db16c1a8cc23a65a1eceaf upstream. If the application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() will punt to doing a regular lookup. If the server then returns a regular file, we will happily return a file descriptor with uninitialised open state. The fix is to return the expected ENOTDIR error in these cases. Reported-by: Lyu Tao Fixes: 0dd2b474d0b6 ("nfs: implement i_op->atomic_open()") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- fs/nfs/dir.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) --- a/fs/nfs/dir.c +++ b/fs/nfs/dir.c @@ -1607,6 +1607,19 @@ out: =20 no_open: res =3D nfs_lookup(dir, dentry, lookup_flags); + if (!res) { + inode =3D d_inode(dentry); + if ((lookup_flags & LOOKUP_DIRECTORY) && inode && + !S_ISDIR(inode->i_mode)) + res =3D ERR_PTR(-ENOTDIR); + } else if (!IS_ERR(res)) { + inode =3D d_inode(res); + if ((lookup_flags & LOOKUP_DIRECTORY) && inode && + !S_ISDIR(inode->i_mode)) { + dput(res); + res =3D ERR_PTR(-ENOTDIR); + } + } if (switched) { d_lookup_done(dentry); if (!res) From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE1FAC4707A for ; Mon, 7 Feb 2022 11:18:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359535AbiBGLO5 (ORCPT ); Mon, 7 Feb 2022 06:14:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49400 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343882AbiBGLLc (ORCPT ); Mon, 7 Feb 2022 06:11:32 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DCA5EC043181; Mon, 7 Feb 2022 03:11:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9DB09B80EE8; Mon, 7 Feb 2022 11:11:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E1CA3C004E1; Mon, 7 Feb 2022 11:11:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232289; bh=OKnCkyLU3qDEEgEn3emwG9Us2Es3B1OuFA9ZMv8oHJw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CzJ84KK5RMdlvVIINzl5sVhr0LwdefO3NZ8e2DA1ordyG/48fEdHCNwYQ8aj9kDLh iRGnF/HrUmiYhfk3NHzRPserOd2GbGOW01lSOcnb3ElceVo/KlK2GxJMkDhIEAtgdH 1MOBmlq9UbKz1dTPQeAXPcZ8FzmVX68FciB71ALY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Trond Myklebust , Anna Schumaker Subject: [PATCH 4.14 30/69] NFSv4: nfs_atomic_open() can race when looking up a non-regular file Date: Mon, 7 Feb 2022 12:05:52 +0100 Message-Id: <20220207103756.612765793@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Trond Myklebust commit 1751fc1db36f6f411709e143d5393f92d12137a9 upstream. If the file type changes back to being a regular file on the server between the failed OPEN and our LOOKUP, then we need to re-run the OPEN. Fixes: 0dd2b474d0b6 ("nfs: implement i_op->atomic_open()") Signed-off-by: Trond Myklebust Signed-off-by: Anna Schumaker Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- fs/nfs/dir.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/fs/nfs/dir.c +++ b/fs/nfs/dir.c @@ -1612,12 +1612,17 @@ no_open: if ((lookup_flags & LOOKUP_DIRECTORY) && inode && !S_ISDIR(inode->i_mode)) res =3D ERR_PTR(-ENOTDIR); + else if (inode && S_ISREG(inode->i_mode)) + res =3D ERR_PTR(-EOPENSTALE); } else if (!IS_ERR(res)) { inode =3D d_inode(res); if ((lookup_flags & LOOKUP_DIRECTORY) && inode && !S_ISDIR(inode->i_mode)) { dput(res); res =3D ERR_PTR(-ENOTDIR); + } else if (inode && S_ISREG(inode->i_mode)) { + dput(res); + res =3D ERR_PTR(-EOPENSTALE); } } if (switched) { From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA048C4707E for ; Mon, 7 Feb 2022 11:18:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376368AbiBGLPG (ORCPT ); Mon, 7 Feb 2022 06:15:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49442 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346602AbiBGLLh (ORCPT ); Mon, 7 Feb 2022 06:11:37 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A521AC043181; Mon, 7 Feb 2022 03:11:36 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 339E761380; Mon, 7 Feb 2022 11:11:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0FCA1C004E1; Mon, 7 Feb 2022 11:11:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232295; bh=2hFdd0xMDn5HK8j7fxPcaYKJ6tgdu/qrgj577VVnQKA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iu4lBDEks9cqopLV99xIpMACL0IDjAPoZhifL5TS/RpQE9q61AeerP8f1Uq/rZvu5 FKIeJetdGYqpJ2R07l8DMscyLd8j3dlA2AVNUJzWPmhWK0Q2KNTA/AEal60q9Q3PMh dWKP5JF6jDVoG2goFWx51XHpJ50YNOWs4j1vIGnk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jianguo Wu , "David S. Miller" Subject: [PATCH 4.14 31/69] net-procfs: show net devices bound packet types Date: Mon, 7 Feb 2022 12:05:53 +0100 Message-Id: <20220207103756.643500459@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jianguo Wu commit 1d10f8a1f40b965d449e8f2d5ed7b96a7c138b77 upstream. After commit:7866a621043f ("dev: add per net_device packet type chains"), we can not get packet types that are bound to a specified net device by /proc/net/ptype, this patch fix the regression. Run "tcpdump -i ens192 udp -nns0" Before and after apply this patch: Before: [root@localhost ~]# cat /proc/net/ptype Type Device Function 0800 ip_rcv 0806 arp_rcv 86dd ipv6_rcv After: [root@localhost ~]# cat /proc/net/ptype Type Device Function ALL ens192 tpacket_rcv 0800 ip_rcv 0806 arp_rcv 86dd ipv6_rcv v1 -> v2: - fix the regression rather than adding new /proc API as suggested by Stephen Hemminger. Fixes: 7866a621043f ("dev: add per net_device packet type chains") Signed-off-by: Jianguo Wu Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- net/core/net-procfs.c | 35 ++++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-) --- a/net/core/net-procfs.c +++ b/net/core/net-procfs.c @@ -209,12 +209,23 @@ static const struct file_operations soft .release =3D seq_release, }; =20 -static void *ptype_get_idx(loff_t pos) +static void *ptype_get_idx(struct seq_file *seq, loff_t pos) { + struct list_head *ptype_list =3D NULL; struct packet_type *pt =3D NULL; + struct net_device *dev; loff_t i =3D 0; int t; =20 + for_each_netdev_rcu(seq_file_net(seq), dev) { + ptype_list =3D &dev->ptype_all; + list_for_each_entry_rcu(pt, ptype_list, list) { + if (i =3D=3D pos) + return pt; + ++i; + } + } + list_for_each_entry_rcu(pt, &ptype_all, list) { if (i =3D=3D pos) return pt; @@ -235,22 +246,40 @@ static void *ptype_seq_start(struct seq_ __acquires(RCU) { rcu_read_lock(); - return *pos ? ptype_get_idx(*pos - 1) : SEQ_START_TOKEN; + return *pos ? ptype_get_idx(seq, *pos - 1) : SEQ_START_TOKEN; } =20 static void *ptype_seq_next(struct seq_file *seq, void *v, loff_t *pos) { + struct net_device *dev; struct packet_type *pt; struct list_head *nxt; int hash; =20 ++*pos; if (v =3D=3D SEQ_START_TOKEN) - return ptype_get_idx(0); + return ptype_get_idx(seq, 0); =20 pt =3D v; nxt =3D pt->list.next; + if (pt->dev) { + if (nxt !=3D &pt->dev->ptype_all) + goto found; + + dev =3D pt->dev; + for_each_netdev_continue_rcu(seq_file_net(seq), dev) { + if (!list_empty(&dev->ptype_all)) { + nxt =3D dev->ptype_all.next; + goto found; + } + } + + nxt =3D ptype_all.next; + goto ptype_all; + } + if (pt->type =3D=3D htons(ETH_P_ALL)) { +ptype_all: if (nxt !=3D &ptype_all) goto found; hash =3D 0; From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B2F5C4707F for ; Mon, 7 Feb 2022 11:18:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376709AbiBGLPO (ORCPT ); Mon, 7 Feb 2022 06:15:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49466 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347959AbiBGLLm (ORCPT ); Mon, 7 Feb 2022 06:11:42 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 66578C043181; Mon, 7 Feb 2022 03:11:41 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1ED38B80EE8; Mon, 7 Feb 2022 11:11:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 22E0EC004E1; Mon, 7 Feb 2022 11:11:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232298; bh=KpkVFOA124n7z4s6OxCkRoPCUJoOZOoncbjtNPXpGG4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wCOwA5m3B6gHwb/CLZpIjNPwvZv13I3frqmqJWGT5AekCjS2FEHT7PZMuCGxABSSu pdKy3JKGupIGgyRuvjVp9APr3U+33CARDSC8MQopj0PBfMMaFWZF63X6jAJ7ewFuc6 hgWSbNiuOqTPrYgRQzqYNKCl5U13+hVndKvlD1vM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xianting Tian , Dmitry Baryshkov , Sasha Levin Subject: [PATCH 4.14 32/69] drm/msm: Fix wrong size calculation Date: Mon, 7 Feb 2022 12:05:54 +0100 Message-Id: <20220207103756.685426698@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xianting Tian commit 0a727b459ee39bd4c5ced19d6024258ac87b6b2e upstream. For example, memory-region in .dts as below, reg =3D <0x0 0x50000000 0x0 0x20000000> We can get below values, struct resource r; r.start =3D 0x50000000; r.end =3D 0x6fffffff; So the size should be: size =3D r.end - r.start + 1 =3D 0x20000000 Signed-off-by: Xianting Tian Fixes: 072f1f9168ed ("drm/msm: add support for "stolen" mem") Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20220112123334.749776-1-xianting.tian@linux= .alibaba.com Signed-off-by: Dmitry Baryshkov Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/gpu/drm/msm/msm_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/msm/msm_drv.c +++ b/drivers/gpu/drm/msm/msm_drv.c @@ -321,7 +321,7 @@ static int msm_init_vram(struct drm_devi of_node_put(node); if (ret) return ret; - size =3D r.end - r.start; + size =3D r.end - r.start + 1; DRM_INFO("using VRAM carveout: %lx@%pa\n", size, &r.start); =20 /* if we have no IOMMU, then we need to use carveout allocator. From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05247C35272 for ; Mon, 7 Feb 2022 11:18:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376531AbiBGLPL (ORCPT ); Mon, 7 Feb 2022 06:15:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49474 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348918AbiBGLLn (ORCPT ); Mon, 7 Feb 2022 06:11:43 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E915FC043188; Mon, 7 Feb 2022 03:11:42 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6C01361261; Mon, 7 Feb 2022 11:11:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4724BC004E1; Mon, 7 Feb 2022 11:11:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232301; bh=SYEi1y8BNmjcAX9A5+V0ogtiPcy/9q3B6MvHlLxKGk0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WnZG1YgOErxbBF1Dk099t81pYIVEbDO5AJBkJlxJ+52i0b0AzB8Cn/Duu3bTEe44P mxsU/vXVoAmITbjQzqUsvSkRC9QqoBZ8C9wQCBaaqBVR56G5rh56UUgeldoml9HXcl DkwlRXKiqNgLkdsn2ebq/N2f9fJmZTmjZiKI2sL4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= , Dmitry Baryshkov Subject: [PATCH 4.14 33/69] drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable Date: Mon, 7 Feb 2022 12:05:55 +0100 Message-Id: <20220207103756.718127401@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jos=C3=A9 Exp=C3=B3sito commit 5e761a2287234bc402ba7ef07129f5103bcd775c upstream. The function performs a check on the "phy" input parameter, however, it is used before the check. Initialize the "dev" variable after the sanity check to avoid a possible NULL pointer dereference. Fixes: 5c8290284402b ("drm/msm/dsi: Split PHY drivers to separate files") Addresses-Coverity-ID: 1493860 ("Null pointer dereference") Signed-off-by: Jos=C3=A9 Exp=C3=B3sito Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20220116181844.7400-1-jose.exposito89@gmail= .com Signed-off-by: Dmitry Baryshkov Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c +++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c @@ -554,12 +554,14 @@ void __exit msm_dsi_phy_driver_unregiste int msm_dsi_phy_enable(struct msm_dsi_phy *phy, int src_pll_id, struct msm_dsi_phy_clk_request *clk_req) { - struct device *dev =3D &phy->pdev->dev; + struct device *dev; int ret; =20 if (!phy || !phy->cfg->ops.enable) return -EINVAL; =20 + dev =3D &phy->pdev->dev; + ret =3D dsi_phy_enable_resource(phy); if (ret) { dev_err(dev, "%s: resource enable failed, %d\n", From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A222FC433EF for ; Mon, 7 Feb 2022 11:19:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376891AbiBGLPQ (ORCPT ); Mon, 7 Feb 2022 06:15:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49502 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352055AbiBGLLs (ORCPT ); Mon, 7 Feb 2022 06:11:48 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 50558C043181; Mon, 7 Feb 2022 03:11:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E2FE2B80EC3; Mon, 7 Feb 2022 11:11:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3B46AC004E1; Mon, 7 Feb 2022 11:11:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232304; bh=XlE85Z5zOnoqCqnlZdZMCtne7tKQO+tuwpoBNZgBrK0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iFXLyhXNNbkH4etQXY2ZiCSa0mK1Lq2gD7d1qCWQ0XncyiJbxLW4m22n8gK/Z5p45 dSDRbGyo/M8xkzDwSedkwKBVjjzt6aOWpDF8sdtGSrVQUrFjw93HH8ej/HO8HjZQya NzTJG3GEC4dFARmP0S2gSUjjHwn6CyfruFc18YT0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sukadev Bhattiprolu , Dany Madden , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 34/69] ibmvnic: dont spin in tasklet Date: Mon, 7 Feb 2022 12:05:56 +0100 Message-Id: <20220207103756.750226254@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sukadev Bhattiprolu [ Upstream commit 48079e7fdd0269d66b1d7d66ae88bd03162464ad ] ibmvnic_tasklet() continuously spins waiting for responses to all capability requests. It does this to avoid encountering an error during initialization of the vnic. However if there is a bug in the VIOS and we do not receive a response to one or more queries the tasklet ends up spinning continuously leading to hard lock ups. If we fail to receive a message from the VIOS it is reasonable to timeout the login attempt rather than spin indefinitely in the tasklet. Fixes: 249168ad07cd ("ibmvnic: Make CRQ interrupt tasklet wait for all capa= bilities crqs") Signed-off-by: Sukadev Bhattiprolu Reviewed-by: Dany Madden Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/net/ethernet/ibm/ibmvnic.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/= ibmvnic.c index 4befc885efb8d..8d8eb9e2465ff 100644 --- a/drivers/net/ethernet/ibm/ibmvnic.c +++ b/drivers/net/ethernet/ibm/ibmvnic.c @@ -3691,12 +3691,6 @@ static void ibmvnic_tasklet(void *data) ibmvnic_handle_crq(crq, adapter); crq->generic.first =3D 0; } - - /* remain in tasklet until all - * capabilities responses are received - */ - if (!adapter->wait_capability) - done =3D true; } /* if capabilities CRQ's were sent in this tasklet, the following * tasklet must wait until all responses are received --=20 2.34.1 From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8132C433FE for ; Mon, 7 Feb 2022 11:19:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377055AbiBGLPU (ORCPT ); Mon, 7 Feb 2022 06:15:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49518 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352076AbiBGLLu (ORCPT ); Mon, 7 Feb 2022 06:11:50 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CFD99C043188; Mon, 7 Feb 2022 03:11:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 62D216126D; Mon, 7 Feb 2022 11:11:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 37737C004E1; Mon, 7 Feb 2022 11:11:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232307; bh=f3H77uUMGFs4fTJeeG45VvnQjw3uvXQUwO6qWw3d5xs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fD4bOKGzpPYBM58rKeKQ/ix9te4IZ/QAN87FpjhpqcsGw6xD2y0hv7lCjA4y3W6V1 S2ZOmk4l14ZEiClUN/+Ule3Lvn9bHwOKHhU5llYzGO8WQ/wE3JSP/SEJquLVOEd7Bl jneP+S5TOceiFfGJBML3ccSukeZVAFkCgDK4yWnQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangyu Hua , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 35/69] yam: fix a memory leak in yam_siocdevprivate() Date: Mon, 7 Feb 2022 12:05:57 +0100 Message-Id: <20220207103756.782049482@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua [ Upstream commit 29eb31542787e1019208a2e1047bb7c76c069536 ] ym needs to be free when ym->cmd !=3D SIOCYAMSMCS. Fixes: 0781168e23a2 ("yam: fix a missing-check bug") Signed-off-by: Hangyu Hua Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/net/hamradio/yam.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c index b74c735a423dd..3338e24b91a57 100644 --- a/drivers/net/hamradio/yam.c +++ b/drivers/net/hamradio/yam.c @@ -980,9 +980,7 @@ static int yam_ioctl(struct net_device *dev, struct ifr= eq *ifr, int cmd) sizeof(struct yamdrv_ioctl_mcs)); if (IS_ERR(ym)) return PTR_ERR(ym); - if (ym->cmd !=3D SIOCYAMSMCS) - return -EINVAL; - if (ym->bitrate > YAM_MAXBITRATE) { + if (ym->cmd !=3D SIOCYAMSMCS || ym->bitrate > YAM_MAXBITRATE) { kfree(ym); return -EINVAL; } --=20 2.34.1 From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9749C433F5 for ; Mon, 7 Feb 2022 11:19:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377112AbiBGLPX (ORCPT ); Mon, 7 Feb 2022 06:15:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49540 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352110AbiBGLLw (ORCPT ); Mon, 7 Feb 2022 06:11:52 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 11F4DC043188; Mon, 7 Feb 2022 03:11:52 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A4CAA6113B; Mon, 7 Feb 2022 11:11:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 81607C004E1; Mon, 7 Feb 2022 11:11:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232311; bh=Vcyy/cmLPqFA7zBx2oZ50VqQZKrAlADhGuLNEobL6M0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dB3tlQC2pI88XH58i58VDynXZ7NnE6q0/HH/i5m3fKy61Aa80d/GAJO3NoW5jrjtF bkeaMHBOLhWZSS9oHu8/3YwYNjyVxaOA+ym20uj/MGSPqZIBHu/HD4pSVaJDQN7IWE GjlbRjG4ZN2rSmoELJPz/ZY4OuUx6+3I8ADplRuw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 36/69] ipv4: raw: lock the socket in raw_bind() Date: Mon, 7 Feb 2022 12:05:58 +0100 Message-Id: <20220207103756.812573501@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 153a0d187e767c68733b8e9f46218eb1f41ab902 ] For some reason, raw_bind() forgot to lock the socket. BUG: KCSAN: data-race in __ip4_datagram_connect / raw_bind write to 0xffff8881170d4308 of 4 bytes by task 5466 on cpu 0: raw_bind+0x1b0/0x250 net/ipv4/raw.c:739 inet_bind+0x56/0xa0 net/ipv4/af_inet.c:443 __sys_bind+0x14b/0x1b0 net/socket.c:1697 __do_sys_bind net/socket.c:1708 [inline] __se_sys_bind net/socket.c:1706 [inline] __x64_sys_bind+0x3d/0x50 net/socket.c:1706 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff8881170d4308 of 4 bytes by task 5468 on cpu 1: __ip4_datagram_connect+0xb7/0x7b0 net/ipv4/datagram.c:39 ip4_datagram_connect+0x2a/0x40 net/ipv4/datagram.c:89 inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576 __sys_connect_file net/socket.c:1900 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1917 __do_sys_connect net/socket.c:1927 [inline] __se_sys_connect net/socket.c:1924 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:1924 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000000 -> 0x0003007f Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 5468 Comm: syz-executor.5 Not tainted 5.17.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- net/ipv4/raw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 261a9813b88cd..9c4b2c0dc68ae 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -721,6 +721,7 @@ static int raw_bind(struct sock *sk, struct sockaddr *u= addr, int addr_len) int ret =3D -EINVAL; int chk_addr_ret; =20 + lock_sock(sk); if (sk->sk_state !=3D TCP_CLOSE || addr_len < sizeof(struct sockaddr_in)) goto out; =20 @@ -740,7 +741,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *u= addr, int addr_len) inet->inet_saddr =3D 0; /* Use device */ sk_dst_reset(sk); ret =3D 0; -out: return ret; +out: + release_sock(sk); + return ret; } =20 /* --=20 2.34.1 From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EAA4EC4332F for ; Mon, 7 Feb 2022 11:19:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377251AbiBGLPZ (ORCPT ); Mon, 7 Feb 2022 06:15:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49562 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352312AbiBGLLz (ORCPT ); Mon, 7 Feb 2022 06:11:55 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1DEABC043181; Mon, 7 Feb 2022 03:11:55 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9AA4F61261; Mon, 7 Feb 2022 11:11:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 72027C004E1; Mon, 7 Feb 2022 11:11:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232314; bh=U+c9K6WdzIVH2IfFgZxIiSIM4vFtt9G9/lsDaGV6npA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xpI1Wu8/JKwPHbIU/B+ezkbKNJUD8pb5Z1Tv792mBg+hKRuXt+fmKjzog0BwDY06r pa845pk2dxyHoINpIPch3iHTAATBil6ekQ4ZigopKg9MgcCD0w771E549fKF8RTPbD IuUVVGXxj5aVn7imCLsbyBk2SM+CnUbcE95QhEHc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Ray Che , David Ahern , Geoff Alexander , Willy Tarreau , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.14 37/69] ipv4: tcp: send zero IPID in SYNACK messages Date: Mon, 7 Feb 2022 12:05:59 +0100 Message-Id: <20220207103756.844768923@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 970a5a3ea86da637471d3cd04d513a0755aba4bf ] In commit 431280eebed9 ("ipv4: tcp: send zero IPID for RST and ACK sent in SYN-RECV and TIME-WAIT state") we took care of some ctl packets sent by TCP. It turns out we need to use a similar strategy for SYNACK packets. By default, they carry IP_DF and IPID=3D=3D0, but there are ways to ask them to use the hashed IP ident generator and thus be used to build off-path attacks. (Ref: Off-Path TCP Exploits of the Mixed IPID Assignment) One of this way is to force (before listener is started) echo 1 >/proc/sys/net/ipv4/ip_no_pmtu_disc Another way is using forged ICMP ICMP_FRAG_NEEDED with a very small MTU (like 68) to force a false return from ip_dont_fragment() In this patch, ip_build_and_send_pkt() uses the following heuristics. 1) Most SYNACK packets are smaller than IPV4_MIN_MTU and therefore can use IP_DF regardless of the listener or route pmtu setting. 2) In case the SYNACK packet is bigger than IPV4_MIN_MTU, we use prandom_u32() generator instead of the IPv4 hashed ident one. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reported-by: Ray Che Reviewed-by: David Ahern Cc: Geoff Alexander Cc: Willy Tarreau Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- net/ipv4/ip_output.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -160,12 +160,19 @@ int ip_build_and_send_pkt(struct sk_buff iph->daddr =3D (opt && opt->opt.srr ? opt->opt.faddr : daddr); iph->saddr =3D saddr; iph->protocol =3D sk->sk_protocol; - if (ip_dont_fragment(sk, &rt->dst)) { + /* Do not bother generating IPID for small packets (eg SYNACK) */ + if (skb->len <=3D IPV4_MIN_MTU || ip_dont_fragment(sk, &rt->dst)) { iph->frag_off =3D htons(IP_DF); iph->id =3D 0; } else { iph->frag_off =3D 0; - __ip_select_ident(net, iph, 1); + /* TCP packets here are SYNACK with fat IPv4/TCP options. + * Avoid using the hashed IP ident generator. + */ + if (sk->sk_protocol =3D=3D IPPROTO_TCP) + iph->id =3D (__force __be16)prandom_u32(); + else + __ip_select_ident(net, iph, 1); } =20 if (opt && opt->opt.optlen) { From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C311C43219 for ; Mon, 7 Feb 2022 11:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377410AbiBGLP0 (ORCPT ); Mon, 7 Feb 2022 06:15:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49586 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352740AbiBGLMA (ORCPT ); Mon, 7 Feb 2022 06:12:00 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 71A83C043181; Mon, 7 Feb 2022 03:11:59 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2EADCB80EE8; Mon, 7 Feb 2022 11:11:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 73327C340F0; Mon, 7 Feb 2022 11:11:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232317; bh=A0RU8r+l+8sVWeobTgW/MCLtGu7DGf8IPAqtA1vxPvw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YLIPIm/POsby5w19PVfnC+Z7om8M3SQp1hG4I58wCYoNb2pbcMeCyyZHR9mE2sfoN xCjDO8HOtYaru6fYgP0i9IUgTdvNHVKPFSX3AaSUEi/g6bZypIvMolRLRQZc+rZSzj 8+VoGyMoAIdg9Yr402Wh3b+Vk8gA9da7x8zDdxYU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Borkmann , Martin KaFai Lau , Alexei Starovoitov , Alessio Balsini , Thadeu Lima de Souza Cascardo Subject: [PATCH 4.14 38/69] bpf: fix truncated jump targets on heavy expansions Date: Mon, 7 Feb 2022 12:06:00 +0100 Message-Id: <20220207103756.875238153@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Borkmann commit 050fad7c4534c13c8eb1d9c2ba66012e014773cb upstream. Recently during testing, I ran into the following panic: [ 207.892422] Internal error: Accessing user space memory outside uacces= s.h routines: 96000004 [#1] SMP [ 207.901637] Modules linked in: binfmt_misc [...] [ 207.966530] CPU: 45 PID: 2256 Comm: test_verifier Tainted: G W = 4.17.0-rc3+ #7 [ 207.974956] Hardware name: FOXCONN R2-1221R-A4/C2U4N_MB, BIOS G31FB18A= 03/31/2017 [ 207.982428] pstate: 60400005 (nZCv daif +PAN -UAO) [ 207.987214] pc : bpf_skb_load_helper_8_no_cache+0x34/0xc0 [ 207.992603] lr : 0xffff000000bdb754 [ 207.996080] sp : ffff000013703ca0 [ 207.999384] x29: ffff000013703ca0 x28: 0000000000000001 [ 208.004688] x27: 0000000000000001 x26: 0000000000000000 [ 208.009992] x25: ffff000013703ce0 x24: ffff800fb4afcb00 [ 208.015295] x23: ffff00007d2f5038 x22: ffff00007d2f5000 [ 208.020599] x21: fffffffffeff2a6f x20: 000000000000000a [ 208.025903] x19: ffff000009578000 x18: 0000000000000a03 [ 208.031206] x17: 0000000000000000 x16: 0000000000000000 [ 208.036510] x15: 0000ffff9de83000 x14: 0000000000000000 [ 208.041813] x13: 0000000000000000 x12: 0000000000000000 [ 208.047116] x11: 0000000000000001 x10: ffff0000089e7f18 [ 208.052419] x9 : fffffffffeff2a6f x8 : 0000000000000000 [ 208.057723] x7 : 000000000000000a x6 : 00280c6160000000 [ 208.063026] x5 : 0000000000000018 x4 : 0000000000007db6 [ 208.068329] x3 : 000000000008647a x2 : 19868179b1484500 [ 208.073632] x1 : 0000000000000000 x0 : ffff000009578c08 [ 208.078938] Process test_verifier (pid: 2256, stack limit =3D 0x000000= 0049ca7974) [ 208.086235] Call trace: [ 208.088672] bpf_skb_load_helper_8_no_cache+0x34/0xc0 [ 208.093713] 0xffff000000bdb754 [ 208.096845] bpf_test_run+0x78/0xf8 [ 208.100324] bpf_prog_test_run_skb+0x148/0x230 [ 208.104758] sys_bpf+0x314/0x1198 [ 208.108064] el0_svc_naked+0x30/0x34 [ 208.111632] Code: 91302260 f9400001 f9001fa1 d2800001 (29500680) [ 208.117717] ---[ end trace 263cb8a59b5bf29f ]--- The program itself which caused this had a long jump over the whole instruction sequence where all of the inner instructions required heavy expansions into multiple BPF instructions. Additionally, I also had BPF hardening enabled which requires once more rewrites of all constant values in order to blind them. Each time we rewrite insns, bpf_adj_branches() would need to potentially adjust branch targets which cross the patchlet boundary to accommodate for the additional delta. Eventually that lead to the case where the target offset could not fit into insn->off's upper 0x7fff limit anymore where then offset wraps around becoming negative (in s16 universe), or vice versa depending on the jump direction. Therefore it becomes necessary to detect and reject any such occasions in a generic way for native eBPF and cBPF to eBPF migrations. For the latter we can simply check bounds in the bpf_convert_filter()'s BPF_EMIT_JMP helper macro and bail out once we surpass limits. The bpf_patch_insn_single() for native eBPF (and cBPF to eBPF in case of subsequent hardening) is a bit more complex in that we need to detect such truncations before hitting the bpf_prog_realloc(). Thus the latter is split into an extra pass to probe problematic offsets on the original program in order to fail early. With that in place and carefully tested I no longer hit the panic and the rewrites are rejected properly. The above example panic I've seen on bpf-next, though the issue itself is generic in that a guard against this issue in bpf seems more appropriate in this case. Signed-off-by: Daniel Borkmann Acked-by: Martin KaFai Lau Signed-off-by: Alexei Starovoitov [ab: Dropped BPF_PSEUDO_CALL hardening, introoduced in 4.16] Signed-off-by: Alessio Balsini Acked-by: Thadeu Lima de Souza Cascardo Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- kernel/bpf/core.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++---= ----- net/core/filter.c | 11 ++++++++-- 2 files changed, 60 insertions(+), 10 deletions(-) --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -228,27 +228,57 @@ static bool bpf_is_jmp_and_has_target(co BPF_OP(insn->code) !=3D BPF_EXIT; } =20 -static void bpf_adj_branches(struct bpf_prog *prog, u32 pos, u32 delta) +static int bpf_adj_delta_to_off(struct bpf_insn *insn, u32 pos, u32 delta, + u32 curr, const bool probe_pass) { + const s32 off_min =3D S16_MIN, off_max =3D S16_MAX; + s32 off =3D insn->off; + + if (curr < pos && curr + off + 1 > pos) + off +=3D delta; + else if (curr > pos + delta && curr + off + 1 <=3D pos + delta) + off -=3D delta; + if (off < off_min || off > off_max) + return -ERANGE; + if (!probe_pass) + insn->off =3D off; + return 0; +} + +static int bpf_adj_branches(struct bpf_prog *prog, u32 pos, u32 delta, + const bool probe_pass) +{ + u32 i, insn_cnt =3D prog->len + (probe_pass ? delta : 0); struct bpf_insn *insn =3D prog->insnsi; - u32 i, insn_cnt =3D prog->len; + int ret =3D 0; =20 for (i =3D 0; i < insn_cnt; i++, insn++) { + /* In the probing pass we still operate on the original, + * unpatched image in order to check overflows before we + * do any other adjustments. Therefore skip the patchlet. + */ + if (probe_pass && i =3D=3D pos) { + i +=3D delta + 1; + insn++; + } + if (!bpf_is_jmp_and_has_target(insn)) continue; =20 - /* Adjust offset of jmps if we cross boundaries. */ - if (i < pos && i + insn->off + 1 > pos) - insn->off +=3D delta; - else if (i > pos + delta && i + insn->off + 1 <=3D pos + delta) - insn->off -=3D delta; + /* Adjust offset of jmps if we cross patch boundaries. */ + ret =3D bpf_adj_delta_to_off(insn, pos, delta, i, probe_pass); + if (ret) + break; } + + return ret; } =20 struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off, const struct bpf_insn *patch, u32 len) { u32 insn_adj_cnt, insn_rest, insn_delta =3D len - 1; + const u32 cnt_max =3D S16_MAX; struct bpf_prog *prog_adj; =20 /* Since our patchlet doesn't expand the image, we're done. */ @@ -259,6 +289,15 @@ struct bpf_prog *bpf_patch_insn_single(s =20 insn_adj_cnt =3D prog->len + insn_delta; =20 + /* Reject anything that would potentially let the insn->off + * target overflow when we have excessive program expansions. + * We need to probe here before we do any reallocation where + * we afterwards may not fail anymore. + */ + if (insn_adj_cnt > cnt_max && + bpf_adj_branches(prog, off, insn_delta, true)) + return NULL; + /* Several new instructions need to be inserted. Make room * for them. Likely, there's no need for a new allocation as * last page could have large enough tailroom. @@ -284,7 +323,11 @@ struct bpf_prog *bpf_patch_insn_single(s sizeof(*patch) * insn_rest); memcpy(prog_adj->insnsi + off, patch, sizeof(*patch) * len); =20 - bpf_adj_branches(prog_adj, off, insn_delta); + /* We are guaranteed to not fail at this point, otherwise + * the ship has sailed to reverse to the original state. An + * overflow cannot happen at this point. + */ + BUG_ON(bpf_adj_branches(prog_adj, off, insn_delta, false)); =20 return prog_adj; } --- a/net/core/filter.c +++ b/net/core/filter.c @@ -472,11 +472,18 @@ do_pass: =20 #define BPF_EMIT_JMP \ do { \ + const s32 off_min =3D S16_MIN, off_max =3D S16_MAX; \ + s32 off; \ + \ if (target >=3D len || target < 0) \ goto err; \ - insn->off =3D addrs ? addrs[target] - addrs[i] - 1 : 0; \ + off =3D addrs ? addrs[target] - addrs[i] - 1 : 0; \ /* Adjust pc relative offset for 2nd or 3rd insn. */ \ - insn->off -=3D insn - tmp_insns; \ + off -=3D insn - tmp_insns; \ + /* Reject anything not fitting into insn->off. */ \ + if (off < off_min || off > off_max) \ + goto err; \ + insn->off =3D off; \ } while (0) =20 case BPF_JMP | BPF_JA: From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1CBDBC4321E for ; Mon, 7 Feb 2022 11:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377673AbiBGLPd (ORCPT ); Mon, 7 Feb 2022 06:15:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49596 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352845AbiBGLMB (ORCPT ); Mon, 7 Feb 2022 06:12:01 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F3AB9C043181; Mon, 7 Feb 2022 03:12:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 91E4261314; Mon, 7 Feb 2022 11:12:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6BBD2C004E1; Mon, 7 Feb 2022 11:11:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232320; bh=GVclLUpV5I6fB7xF9BnCi/GSDE4G3lqHd2p6FC+z9kA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=alyJOE3b5xqHbSZpa1jkGOLntMxsLlgZl2If0NiAKD8UoQv5EMX0vtXT/SJ7YsyFn dyxFmrtWWu5Su/ucnxg97VWOZC1ZojnMRfeC0Bx4hmar1rYXOH24PzHiT7CpLiSws6 rYPpowzxDJve1HPXJ/3h32pxC40nUpkipoOUrFbc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Florian Westphal , Pablo Neira Ayuso Subject: [PATCH 4.14 39/69] netfilter: nat: remove l4 protocol port rovers Date: Mon, 7 Feb 2022 12:06:01 +0100 Message-Id: <20220207103756.914150863@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal commit 6ed5943f8735e2b778d92ea4d9805c0a1d89bc2b upstream. This is a leftover from days where single-cpu systems were common: Store last port used to resolve a clash to use it as a starting point when the next conflict needs to be resolved. When we have parallel attempt to connect to same address:port pair, its likely that both cores end up computing the same "available" port, as both use same starting port, and newly used ports won't become visible to other cores until the conntrack gets confirmed later. One of the cores then has to drop the packet at insertion time because the chosen new tuple turns out to be in use after all. Lets simplify this: remove port rover and use a pseudo-random starting point. Note that this doesn't make netfilter default to 'fully random' mode; the 'rover' was only used if NAT could not reuse source port as-is. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- include/net/netfilter/nf_nat_l4proto.h | 2 +- net/netfilter/nf_nat_proto_common.c | 7 ++----- net/netfilter/nf_nat_proto_dccp.c | 5 +---- net/netfilter/nf_nat_proto_sctp.c | 5 +---- net/netfilter/nf_nat_proto_tcp.c | 5 +---- net/netfilter/nf_nat_proto_udp.c | 10 ++-------- 6 files changed, 8 insertions(+), 26 deletions(-) --- a/include/net/netfilter/nf_nat_l4proto.h +++ b/include/net/netfilter/nf_nat_l4proto.h @@ -74,7 +74,7 @@ void nf_nat_l4proto_unique_tuple(const s struct nf_conntrack_tuple *tuple, const struct nf_nat_range *range, enum nf_nat_manip_type maniptype, - const struct nf_conn *ct, u16 *rover); + const struct nf_conn *ct); =20 int nf_nat_l4proto_nlattr_to_range(struct nlattr *tb[], struct nf_nat_range *range); --- a/net/netfilter/nf_nat_proto_common.c +++ b/net/netfilter/nf_nat_proto_common.c @@ -38,8 +38,7 @@ void nf_nat_l4proto_unique_tuple(const s struct nf_conntrack_tuple *tuple, const struct nf_nat_range *range, enum nf_nat_manip_type maniptype, - const struct nf_conn *ct, - u16 *rover) + const struct nf_conn *ct) { unsigned int range_size, min, max, i; __be16 *portptr; @@ -84,15 +83,13 @@ void nf_nat_l4proto_unique_tuple(const s } else if (range->flags & NF_NAT_RANGE_PROTO_RANDOM_FULLY) { off =3D prandom_u32(); } else { - off =3D *rover; + off =3D prandom_u32(); } =20 for (i =3D 0; ; ++off) { *portptr =3D htons(min + off % range_size); if (++i !=3D range_size && nf_nat_used_tuple(tuple, ct)) continue; - if (!(range->flags & NF_NAT_RANGE_PROTO_RANDOM_ALL)) - *rover =3D off; return; } } --- a/net/netfilter/nf_nat_proto_dccp.c +++ b/net/netfilter/nf_nat_proto_dccp.c @@ -18,8 +18,6 @@ #include #include =20 -static u_int16_t dccp_port_rover; - static void dccp_unique_tuple(const struct nf_nat_l3proto *l3proto, struct nf_conntrack_tuple *tuple, @@ -27,8 +25,7 @@ dccp_unique_tuple(const struct nf_nat_l3 enum nf_nat_manip_type maniptype, const struct nf_conn *ct) { - nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct, - &dccp_port_rover); + nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct); } =20 static bool --- a/net/netfilter/nf_nat_proto_sctp.c +++ b/net/netfilter/nf_nat_proto_sctp.c @@ -12,8 +12,6 @@ =20 #include =20 -static u_int16_t nf_sctp_port_rover; - static void sctp_unique_tuple(const struct nf_nat_l3proto *l3proto, struct nf_conntrack_tuple *tuple, @@ -21,8 +19,7 @@ sctp_unique_tuple(const struct nf_nat_l3 enum nf_nat_manip_type maniptype, const struct nf_conn *ct) { - nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct, - &nf_sctp_port_rover); + nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct); } =20 static bool --- a/net/netfilter/nf_nat_proto_tcp.c +++ b/net/netfilter/nf_nat_proto_tcp.c @@ -18,8 +18,6 @@ #include #include =20 -static u16 tcp_port_rover; - static void tcp_unique_tuple(const struct nf_nat_l3proto *l3proto, struct nf_conntrack_tuple *tuple, @@ -27,8 +25,7 @@ tcp_unique_tuple(const struct nf_nat_l3p enum nf_nat_manip_type maniptype, const struct nf_conn *ct) { - nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct, - &tcp_port_rover); + nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct); } =20 static bool --- a/net/netfilter/nf_nat_proto_udp.c +++ b/net/netfilter/nf_nat_proto_udp.c @@ -17,8 +17,6 @@ #include #include =20 -static u16 udp_port_rover; - static void udp_unique_tuple(const struct nf_nat_l3proto *l3proto, struct nf_conntrack_tuple *tuple, @@ -26,8 +24,7 @@ udp_unique_tuple(const struct nf_nat_l3p enum nf_nat_manip_type maniptype, const struct nf_conn *ct) { - nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct, - &udp_port_rover); + nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct); } =20 static void @@ -78,8 +75,6 @@ static bool udp_manip_pkt(struct sk_buff } =20 #ifdef CONFIG_NF_NAT_PROTO_UDPLITE -static u16 udplite_port_rover; - static bool udplite_manip_pkt(struct sk_buff *skb, const struct nf_nat_l3proto *l3proto, unsigned int iphdroff, unsigned int hdroff, @@ -103,8 +98,7 @@ udplite_unique_tuple(const struct nf_nat enum nf_nat_manip_type maniptype, const struct nf_conn *ct) { - nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct, - &udplite_port_rover); + nf_nat_l4proto_unique_tuple(l3proto, tuple, range, maniptype, ct); } =20 const struct nf_nat_l4proto nf_nat_l4proto_udplite =3D { From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 31C2CC43217 for ; Mon, 7 Feb 2022 11:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377737AbiBGLPh (ORCPT ); Mon, 7 Feb 2022 06:15:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49610 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352941AbiBGLME (ORCPT ); Mon, 7 Feb 2022 06:12:04 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DAF2AC043181; Mon, 7 Feb 2022 03:12:03 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 77A906113B; Mon, 7 Feb 2022 11:12:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4F0A4C004E1; Mon, 7 Feb 2022 11:12:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232322; bh=Dr/oqwKZmKDG/VA5BzwU4pmOBq2enCPRaqg163lA1Ng=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=es+1mmidnQ3ToH096x2eSdMhcZF02QccanfjVvpr06GzAmACncABsME/2X3F+6nRf DWYq1SQOX+IZyxY/kdsKrWkaq0OdESv4QaLgPSNbLVgyvrcUuCZ6XkDpGYdfd4hm6t j9XG4eehogeBseaWaBol5rVdRE2GxsOwqbNsmH0k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Florian Westphal , Pablo Neira Ayuso , Vimal Agrawal Subject: [PATCH 4.14 40/69] netfilter: nat: limit port clash resolution attempts Date: Mon, 7 Feb 2022 12:06:02 +0100 Message-Id: <20220207103756.945579357@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal commit a504b703bb1da526a01593da0e4be2af9d9f5fa8 upstream. In case almost or all available ports are taken, clash resolution can take a very long time, resulting in soft lockup. This can happen when many to-be-natted hosts connect to same destination:port (e.g. a proxy) and all connections pass the same SNAT. Pick a random offset in the acceptable range, then try ever smaller number of adjacent port numbers, until either the limit is reached or a useable port was found. This results in at most 248 attempts (128 + 64 + 32 + 16 + 8, i.e. 4 restarts with new search offset) instead of 64000+, Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Vimal Agrawal Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- net/netfilter/nf_nat_proto_common.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) --- a/net/netfilter/nf_nat_proto_common.c +++ b/net/netfilter/nf_nat_proto_common.c @@ -40,9 +40,10 @@ void nf_nat_l4proto_unique_tuple(const s enum nf_nat_manip_type maniptype, const struct nf_conn *ct) { - unsigned int range_size, min, max, i; + unsigned int range_size, min, max, i, attempts; __be16 *portptr; - u_int16_t off; + u16 off; + static const unsigned int max_attempts =3D 128; =20 if (maniptype =3D=3D NF_NAT_MANIP_SRC) portptr =3D &tuple->src.u.all; @@ -86,12 +87,28 @@ void nf_nat_l4proto_unique_tuple(const s off =3D prandom_u32(); } =20 - for (i =3D 0; ; ++off) { + attempts =3D range_size; + if (attempts > max_attempts) + attempts =3D max_attempts; + + /* We are in softirq; doing a search of the entire range risks + * soft lockup when all tuples are already used. + * + * If we can't find any free port from first offset, pick a new + * one and try again, with ever smaller search window. + */ +another_round: + for (i =3D 0; i < attempts; i++, off++) { *portptr =3D htons(min + off % range_size); - if (++i !=3D range_size && nf_nat_used_tuple(tuple, ct)) - continue; - return; + if (!nf_nat_used_tuple(tuple, ct)) + return; } + + if (attempts >=3D range_size || attempts < 16) + return; + attempts /=3D 2; + off =3D prandom_u32(); + goto another_round; } EXPORT_SYMBOL_GPL(nf_nat_l4proto_unique_tuple); =20 From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F1B9C4167D for ; Mon, 7 Feb 2022 11:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378204AbiBGLPq (ORCPT ); Mon, 7 Feb 2022 06:15:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49674 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353415AbiBGLMM (ORCPT ); Mon, 7 Feb 2022 06:12:12 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5C631C043181; Mon, 7 Feb 2022 03:12:11 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 07092B80EC3; Mon, 7 Feb 2022 11:12:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 49C6EC004E1; Mon, 7 Feb 2022 11:12:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232328; bh=X4zAEnAPt4ZfgCA3lUjOmtemiVM22+id6pT04M2vi+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y5gWCGaDOst3b7q1cdks+/bwwWc2vj8aS2mP0vl3TuqvARN0BvBfdcWy7mD9stn00 XW2drShBdmc+3ULFKPBvCwytcnJVXIvmku51n5GfeZUK/vO5OUB1OwROc/i2pqjTT/ zPCy4bPdUvM8BcBaVFbsCLsDKd7EQ8Ako4D1FNVs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Georgi Valkov , Jan Kiszka , Jakub Kicinski Subject: [PATCH 4.14 41/69] ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback Date: Mon, 7 Feb 2022 12:06:03 +0100 Message-Id: <20220207103756.978764692@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Georgi Valkov commit 63e4b45c82ed1bde979da7052229a4229ce9cabf upstream. When rx_buf is allocated we need to account for IPHETH_IP_ALIGN, which reduces the usable size by 2 bytes. Otherwise we have 1512 bytes usable instead of 1514, and if we receive more than 1512 bytes, ipheth_rcvbulk_callback is called with status -EOVERFLOW, after which the driver malfunctiones and all communication stops. Resolves ipheth 2-1:4.2: ipheth_rcvbulk_callback: urb status: -75 Fixes: f33d9e2b48a3 ("usbnet: ipheth: fix connectivity with iOS 14") Signed-off-by: Georgi Valkov Tested-by: Jan Kiszka Link: https://lore.kernel.org/all/B60B8A4B-92A0-49B3-805D-809A2433B46C@abv.= bg/ Link: https://lore.kernel.org/all/24851bd2769434a5fc24730dce8e8a984c5a4505.= 1643699778.git.jan.kiszka@siemens.com/ Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/net/usb/ipheth.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -173,7 +173,7 @@ static int ipheth_alloc_urbs(struct iphe if (tx_buf =3D=3D NULL) goto free_rx_urb; =20 - rx_buf =3D usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE, + rx_buf =3D usb_alloc_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_A= LIGN, GFP_KERNEL, &rx_urb->transfer_dma); if (rx_buf =3D=3D NULL) goto free_tx_buf; @@ -198,7 +198,7 @@ error_nomem: =20 static void ipheth_free_urbs(struct ipheth_device *iphone) { - usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf, + usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, iphone= ->rx_buf, iphone->rx_urb->transfer_dma); usb_free_coherent(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf, iphone->tx_urb->transfer_dma); @@ -371,7 +371,7 @@ static int ipheth_rx_submit(struct iphet =20 usb_fill_bulk_urb(dev->rx_urb, udev, usb_rcvbulkpipe(udev, dev->bulk_in), - dev->rx_buf, IPHETH_BUF_SIZE, + dev->rx_buf, IPHETH_BUF_SIZE + IPHETH_IP_ALIGN, ipheth_rcvbulk_callback, dev); dev->rx_urb->transfer_flags |=3D URB_NO_TRANSFER_DMA_MAP; From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F130C41535 for ; Mon, 7 Feb 2022 11:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378299AbiBGLPt (ORCPT ); Mon, 7 Feb 2022 06:15:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49682 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353438AbiBGLMN (ORCPT ); Mon, 7 Feb 2022 06:12:13 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0447BC043181; Mon, 7 Feb 2022 03:12:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8BEF261261; Mon, 7 Feb 2022 11:12:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 62D8EC004E1; Mon, 7 Feb 2022 11:12:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232332; bh=D4HgBqFSauzWnvviuzxEObdZ74nhubp33ocUfuSYRzw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I1QE0ZtHyMstXyY7dF/DNjFqyBASjh1DcGJ95akvO6FUC431XI0z4pZIbthAoqVXL Z4Z4GS5lXUr76lR7YO8mWfV4kdknxq+hgc5ksEAY0fNIkWhRhHuQq9IHjtU6XBkrp9 Bl/Q2bVmGG0ad7C/B0LQaPm1HVCKKdSuq6GQ1eL4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sudheesh Mavila , Raju Rangoju , Tom Lendacky , Jakub Kicinski Subject: [PATCH 4.14 42/69] net: amd-xgbe: ensure to reset the tx_timer_active flag Date: Mon, 7 Feb 2022 12:06:04 +0100 Message-Id: <20220207103757.008711261@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Raju Rangoju commit 7674b7b559b683478c3832527c59bceb169e701d upstream. Ensure to reset the tx_timer_active flag in xgbe_stop(), otherwise a port restart may result in tx timeout due to uncleared flag. Fixes: c635eaacbf77 ("amd-xgbe: Remove Tx coalescing") Co-developed-by: Sudheesh Mavila Signed-off-by: Sudheesh Mavila Signed-off-by: Raju Rangoju Acked-by: Tom Lendacky Link: https://lore.kernel.org/r/20220127060222.453371-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c @@ -724,7 +724,9 @@ static void xgbe_stop_timers(struct xgbe if (!channel->tx_ring) break; =20 + /* Deactivate the Tx timer */ del_timer_sync(&channel->tx_timer); + channel->tx_timer_active =3D 0; } } =20 From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9D903C3526C for ; Mon, 7 Feb 2022 11:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378462AbiBGLPw (ORCPT ); Mon, 7 Feb 2022 06:15:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49706 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354078AbiBGLMS (ORCPT ); Mon, 7 Feb 2022 06:12:18 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 92B70C043181; Mon, 7 Feb 2022 03:12:17 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 513F6B80EE8; Mon, 7 Feb 2022 11:12:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8DF2DC340EB; Mon, 7 Feb 2022 11:12:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232335; bh=t1mDbYUz5ncUHrgoorpW5ZuOdFGpnnHi3xKn5xv1gsw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ndk2yByGpknPOtX9p3VTcsNfkizELBPmkhGzeuqFFDGWB9qfXjMP8phwI1JLY29yj utO1enj46KOyvSIQhUkLT3UKz4CINQ+gLvgHTfGCAzcn1SJAfxttHb9+qneAGukuC4 8zjBFdcZQW1N0JvcCT5W3Gw5/ziZw8iErfbGYhh4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Lendacky , Shyam Sundar S K , Jakub Kicinski Subject: [PATCH 4.14 43/69] net: amd-xgbe: Fix skb data length underflow Date: Mon, 7 Feb 2022 12:06:05 +0100 Message-Id: <20220207103757.041725409@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Shyam Sundar S K commit 5aac9108a180fc06e28d4e7fb00247ce603b72ee upstream. There will be BUG_ON() triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix this by dropping the packet if such length underflows are seen because of inconsistencies in the hardware descriptors. Fixes: 622c36f143fc ("amd-xgbe: Fix jumbo MTU processing on newer hardware") Suggested-by: Tom Lendacky Signed-off-by: Shyam Sundar S K Acked-by: Tom Lendacky Link: https://lore.kernel.org/r/20220127092003.2812745-1-Shyam-sundar.S-k@a= md.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/net/ethernet/amd/xgbe/xgbe-drv.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c @@ -2722,6 +2722,14 @@ read_again: buf2_len =3D xgbe_rx_buf2_len(rdata, packet, len); len +=3D buf2_len; =20 + if (buf2_len > rdata->rx.buf.dma_len) { + /* Hardware inconsistency within the descriptors + * that has resulted in a length underflow. + */ + error =3D 1; + goto skip_data; + } + if (!skb) { skb =3D xgbe_create_skb(pdata, napi, rdata, buf1_len); @@ -2751,8 +2759,10 @@ skip_data: if (!last || context_next) goto read_again; =20 - if (!skb) + if (!skb || error) { + dev_kfree_skb(skb); goto next_packet; + } =20 /* Be sure we don't exceed the configured MTU */ max_len =3D netdev->mtu + ETH_HLEN; From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD216C46467 for ; Mon, 7 Feb 2022 11:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378798AbiBGLP4 (ORCPT ); Mon, 7 Feb 2022 06:15:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49722 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354429AbiBGLMV (ORCPT ); Mon, 7 Feb 2022 06:12:21 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D19FEC043181; Mon, 7 Feb 2022 03:12:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8D0A4B81028; Mon, 7 Feb 2022 11:12:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A4498C340EB; Mon, 7 Feb 2022 11:12:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232338; bh=AYafRmXmyRXCNqMdkz7flGgefQH/FAXI5WkNagMnnZQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VsSazAiFSty20+didcZyvDfYVOYld+PhkE6OKGOdaEXM/mmNxawsnAjQLlh1I+suu p7nR7iLYHhjqXLgSAexmJDellN6UEPEk8BDI87Dl1Fq+OBGS37+T23oXVU9LvK7UbT 1Lvb9vRerhmitT5bf+RuLsWmmIlwWANsjN5H3Vss= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Jiri Pirko , Jakub Kicinski Subject: [PATCH 4.14 44/69] rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() Date: Mon, 7 Feb 2022 12:06:06 +0100 Message-Id: <20220207103757.078634102@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit c6f6f2444bdbe0079e41914a35081530d0409963 upstream. While looking at one unrelated syzbot bug, I found the replay logic in __rtnl_newlink() to potentially trigger use-after-free. It is better to clear master_dev and m_ops inside the loop, in case we have to replay it. Fixes: ba7d49b1f0f8 ("rtnetlink: provide api for getting and setting slave = info") Signed-off-by: Eric Dumazet Cc: Jiri Pirko Link: https://lore.kernel.org/r/20220201012106.216495-1-eric.dumazet@gmail.= com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- net/core/rtnetlink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -2523,9 +2523,9 @@ static int rtnl_newlink(struct sk_buff * { struct net *net =3D sock_net(skb->sk); const struct rtnl_link_ops *ops; - const struct rtnl_link_ops *m_ops =3D NULL; + const struct rtnl_link_ops *m_ops; struct net_device *dev; - struct net_device *master_dev =3D NULL; + struct net_device *master_dev; struct ifinfomsg *ifm; char kind[MODULE_NAME_LEN]; char ifname[IFNAMSIZ]; @@ -2556,6 +2556,8 @@ replay: dev =3D NULL; } =20 + master_dev =3D NULL; + m_ops =3D NULL; if (dev) { master_dev =3D netdev_master_upper_dev_get(dev); if (master_dev) From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CC537C35271 for ; Mon, 7 Feb 2022 11:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379044AbiBGLQA (ORCPT ); Mon, 7 Feb 2022 06:16:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49740 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354800AbiBGLMY (ORCPT ); Mon, 7 Feb 2022 06:12:24 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B12F4C043181; Mon, 7 Feb 2022 03:12:23 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 70BBAB81158; Mon, 7 Feb 2022 11:12:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9A80BC004E1; Mon, 7 Feb 2022 11:12:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232341; bh=0U6ln+mci2a4SV4DbDK3nR+s6trUK/xFJvJqzsqX7oU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p9I6WxE8EHD8Ip371UbYNFtaAsaacdl/hukAGss8j7RsLsGAcS9Ptq6FJ29mIgdZ7 jN4YE/ABW2B/g4onvS2YO7wqCy0fssBY78oL6Dzf8VsPv5bSxAfHWL1AZx+Y/YjKrr PjA3XoYIdILe+Xcrmp5RJP32gWzMkWroiTN+Lsrg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Willem de Bruijn , syzbot , Jakub Kicinski Subject: [PATCH 4.14 45/69] af_packet: fix data-race in packet_setsockopt / packet_setsockopt Date: Mon, 7 Feb 2022 12:06:07 +0100 Message-Id: <20220207103757.109325470@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit e42e70ad6ae2ae511a6143d2e8da929366e58bd9 upstream. When packet_setsockopt( PACKET_FANOUT_DATA ) reads po->fanout, no lock is held, meaning that another thread can change po->fanout. Given that po->fanout can only be set once during the socket lifetime (it is only cleared from fanout_release()), we can use READ_ONCE()/WRITE_ONCE() to document the race. BUG: KCSAN: data-race in packet_setsockopt / packet_setsockopt write to 0xffff88813ae8e300 of 8 bytes by task 14653 on cpu 0: fanout_add net/packet/af_packet.c:1791 [inline] packet_setsockopt+0x22fe/0x24a0 net/packet/af_packet.c:3931 __sys_setsockopt+0x209/0x2a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff88813ae8e300 of 8 bytes by task 14654 on cpu 1: packet_setsockopt+0x691/0x24a0 net/packet/af_packet.c:3935 __sys_setsockopt+0x209/0x2a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x0000000000000000 -> 0xffff888106f8c000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 14654 Comm: syz-executor.3 Not tainted 5.16.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Fixes: 47dceb8ecdc1 ("packet: add classic BPF fanout mode") Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Reported-by: syzbot Link: https://lore.kernel.org/r/20220201022358.330621-1-eric.dumazet@gmail.= com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- net/packet/af_packet.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1770,7 +1770,10 @@ static int fanout_add(struct sock *sk, u err =3D -ENOSPC; if (refcount_read(&match->sk_ref) < PACKET_FANOUT_MAX) { __dev_remove_pack(&po->prot_hook); - po->fanout =3D match; + + /* Paired with packet_setsockopt(PACKET_FANOUT_DATA) */ + WRITE_ONCE(po->fanout, match); + po->rollover =3D rollover; rollover =3D NULL; refcount_set(&match->sk_ref, refcount_read(&match->sk_ref) + 1); @@ -3915,7 +3918,8 @@ packet_setsockopt(struct socket *sock, i } case PACKET_FANOUT_DATA: { - if (!po->fanout) + /* Paired with the WRITE_ONCE() in fanout_add() */ + if (!READ_ONCE(po->fanout)) return -EINVAL; =20 return fanout_set_data(po, optval, optlen); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5AA1BC47080 for ; Mon, 7 Feb 2022 11:19:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343803AbiBGLQu (ORCPT ); Mon, 7 Feb 2022 06:16:50 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50528 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240051AbiBGLN4 (ORCPT ); Mon, 7 Feb 2022 06:13:56 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7616DC043181; Mon, 7 Feb 2022 03:13:55 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 06752611AA; Mon, 7 Feb 2022 11:13:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D5DE1C004E1; Mon, 7 Feb 2022 11:13:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232434; bh=6Zh7jCNt9Cw8yt9T1v996Y2BQCPeVng+cR4IQ7nstWU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1aTTt4vaFeK73WruS9Q1fLVKVOcMFqCw2Nw7xCk8OEVaWsBvfCYj3v7Tqfm3KWHAG fxIky29XWMzqq8ghsQMyv4K2dcFMUTiwdgi9RFvBDY5+threSfA/gRGc+3bpc2xb9u YFatrxXApxys141rMNXTvyyxhYdMOrAGmp1KY8OU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gaosheng Cui , Richard Guy Briggs , Paul Moore Subject: [PATCH 4.14 46/69] audit: improve audit queue handling when "audit=1" on cmdline Date: Mon, 7 Feb 2022 12:06:08 +0100 Message-Id: <20220207103757.140200063@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paul Moore commit f26d04331360d42dbd6b58448bd98e4edbfbe1c5 upstream. When an admin enables audit at early boot via the "audit=3D1" kernel command line the audit queue behavior is slightly different; the audit subsystem goes to greater lengths to avoid dropping records, which unfortunately can result in problems when the audit daemon is forcibly stopped for an extended period of time. This patch makes a number of changes designed to improve the audit queuing behavior so that leaving the audit daemon in a stopped state for an extended period does not cause a significant impact to the system. - kauditd_send_queue() is now limited to looping through the passed queue only once per call. This not only prevents the function from looping indefinitely when records are returned to the current queue, it also allows any recovery handling in kauditd_thread() to take place when kauditd_send_queue() returns. - Transient netlink send errors seen as -EAGAIN now cause the record to be returned to the retry queue instead of going to the hold queue. The intention of the hold queue is to store, perhaps for an extended period of time, the events which led up to the audit daemon going offline. The retry queue remains a temporary queue intended to protect against transient issues between the kernel and the audit daemon. - The retry queue is now limited by the audit_backlog_limit setting, the same as the other queues. This allows admins to bound the size of all of the audit queues on the system. - kauditd_rehold_skb() now returns records to the end of the hold queue to ensure ordering is preserved in the face of recent changes to kauditd_send_queue(). Cc: stable@vger.kernel.org Fixes: 5b52330bbfe63 ("audit: fix auditd/kernel connection state tracking") Fixes: f4b3ee3c85551 ("audit: improve robustness of the audit queue handlin= g") Reported-by: Gaosheng Cui Tested-by: Gaosheng Cui Reviewed-by: Richard Guy Briggs Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- kernel/audit.c | 62 +++++++++++++++++++++++++++++++++++++++-------------= ----- 1 file changed, 43 insertions(+), 19 deletions(-) --- a/kernel/audit.c +++ b/kernel/audit.c @@ -509,20 +509,22 @@ static void kauditd_printk_skb(struct sk /** * kauditd_rehold_skb - Handle a audit record send failure in the hold que= ue * @skb: audit record + * @error: error code (unused) * * Description: * This should only be used by the kauditd_thread when it fails to flush t= he * hold queue. */ -static void kauditd_rehold_skb(struct sk_buff *skb) +static void kauditd_rehold_skb(struct sk_buff *skb, __always_unused int er= ror) { - /* put the record back in the queue at the same place */ - skb_queue_head(&audit_hold_queue, skb); + /* put the record back in the queue */ + skb_queue_tail(&audit_hold_queue, skb); } =20 /** * kauditd_hold_skb - Queue an audit record, waiting for auditd * @skb: audit record + * @error: error code * * Description: * Queue the audit record, waiting for an instance of auditd. When this @@ -532,19 +534,31 @@ static void kauditd_rehold_skb(struct sk * and queue it, if we have room. If we want to hold on to the record, bu= t we * don't have room, record a record lost message. */ -static void kauditd_hold_skb(struct sk_buff *skb) +static void kauditd_hold_skb(struct sk_buff *skb, int error) { /* at this point it is uncertain if we will ever send this to auditd so * try to send the message via printk before we go any further */ kauditd_printk_skb(skb); =20 /* can we just silently drop the message? */ - if (!audit_default) { - kfree_skb(skb); - return; + if (!audit_default) + goto drop; + + /* the hold queue is only for when the daemon goes away completely, + * not -EAGAIN failures; if we are in a -EAGAIN state requeue the + * record on the retry queue unless it's full, in which case drop it + */ + if (error =3D=3D -EAGAIN) { + if (!audit_backlog_limit || + skb_queue_len(&audit_retry_queue) < audit_backlog_limit) { + skb_queue_tail(&audit_retry_queue, skb); + return; + } + audit_log_lost("kauditd retry queue overflow"); + goto drop; } =20 - /* if we have room, queue the message */ + /* if we have room in the hold queue, queue the message */ if (!audit_backlog_limit || skb_queue_len(&audit_hold_queue) < audit_backlog_limit) { skb_queue_tail(&audit_hold_queue, skb); @@ -553,24 +567,32 @@ static void kauditd_hold_skb(struct sk_b =20 /* we have no other options - drop the message */ audit_log_lost("kauditd hold queue overflow"); +drop: kfree_skb(skb); } =20 /** * kauditd_retry_skb - Queue an audit record, attempt to send again to aud= itd * @skb: audit record + * @error: error code (unused) * * Description: * Not as serious as kauditd_hold_skb() as we still have a connected audit= d, * but for some reason we are having problems sending it audit records so * queue the given record and attempt to resend. */ -static void kauditd_retry_skb(struct sk_buff *skb) +static void kauditd_retry_skb(struct sk_buff *skb, __always_unused int err= or) { - /* NOTE: because records should only live in the retry queue for a - * short period of time, before either being sent or moved to the hold - * queue, we don't currently enforce a limit on this queue */ - skb_queue_tail(&audit_retry_queue, skb); + if (!audit_backlog_limit || + skb_queue_len(&audit_retry_queue) < audit_backlog_limit) { + skb_queue_tail(&audit_retry_queue, skb); + return; + } + + /* we have to drop the record, send it via printk as a last effort */ + kauditd_printk_skb(skb); + audit_log_lost("kauditd retry queue overflow"); + kfree_skb(skb); } =20 /** @@ -608,7 +630,7 @@ static void auditd_reset(const struct au /* flush the retry queue to the hold queue, but don't touch the main * queue since we need to process that normally for multicast */ while ((skb =3D skb_dequeue(&audit_retry_queue))) - kauditd_hold_skb(skb); + kauditd_hold_skb(skb, -ECONNREFUSED); } =20 /** @@ -682,16 +704,18 @@ static int kauditd_send_queue(struct soc struct sk_buff_head *queue, unsigned int retry_limit, void (*skb_hook)(struct sk_buff *skb), - void (*err_hook)(struct sk_buff *skb)) + void (*err_hook)(struct sk_buff *skb, int error)) { int rc =3D 0; - struct sk_buff *skb; + struct sk_buff *skb =3D NULL; + struct sk_buff *skb_tail; unsigned int failed =3D 0; =20 /* NOTE: kauditd_thread takes care of all our locking, we just use * the netlink info passed to us (e.g. sk and portid) */ =20 - while ((skb =3D skb_dequeue(queue))) { + skb_tail =3D skb_peek_tail(queue); + while ((skb !=3D skb_tail) && (skb =3D skb_dequeue(queue))) { /* call the skb_hook for each skb we touch */ if (skb_hook) (*skb_hook)(skb); @@ -699,7 +723,7 @@ static int kauditd_send_queue(struct soc /* can we send to anyone via unicast? */ if (!sk) { if (err_hook) - (*err_hook)(skb); + (*err_hook)(skb, -ECONNREFUSED); continue; } =20 @@ -713,7 +737,7 @@ retry: rc =3D=3D -ECONNREFUSED || rc =3D=3D -EPERM) { sk =3D NULL; if (err_hook) - (*err_hook)(skb); + (*err_hook)(skb, rc); if (rc =3D=3D -EAGAIN) rc =3D 0; /* continue to drain the queue */ From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 64485C4321E for ; Mon, 7 Feb 2022 11:16:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379953AbiBGLQ3 (ORCPT ); Mon, 7 Feb 2022 06:16:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49880 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355803AbiBGLMq (ORCPT ); Mon, 7 Feb 2022 06:12:46 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AC3FEC043181; Mon, 7 Feb 2022 03:12:45 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 49906611AA; Mon, 7 Feb 2022 11:12:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A1FEC340F0; Mon, 7 Feb 2022 11:12:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232364; bh=vkO4ua145R0keyih7o+xMQabayYOpPFOejC9Fq+jX6o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Pvz4UL5///FmJVnv4psJCqvR5kU9L2y7KugLqrNt3WzxyJkdjAuXpwk49azjb+/AB 0D+oSP3TRzjxSZ1DqGmbkEzivQfxCp9U+gBt59Stk/6KmTkg2obqqTlYzo8H6Dplx5 /OFMLAhGGSGFHAguxBEzV4IQVxlY2hb39mIHkT+I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Brown Subject: [PATCH 4.14 47/69] ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() Date: Mon, 7 Feb 2022 12:06:09 +0100 Message-Id: <20220207103757.171298534@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mark Brown commit 817f7c9335ec01e0f5e8caffc4f1dcd5e458a4c0 upstream. We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and reject any values that are out of range. Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220124153253.3548853-2-broonie@kernel.org Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- sound/soc/soc-ops.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -327,13 +327,27 @@ int snd_soc_put_volsw(struct snd_kcontro if (sign_bit) mask =3D BIT(sign_bit + 1) - 1; =20 - val =3D ((ucontrol->value.integer.value[0] + min) & mask); + val =3D ucontrol->value.integer.value[0]; + if (mc->platform_max && val > mc->platform_max) + return -EINVAL; + if (val > max - min) + return -EINVAL; + if (val < 0) + return -EINVAL; + val =3D (val + min) & mask; if (invert) val =3D max - val; val_mask =3D mask << shift; val =3D val << shift; if (snd_soc_volsw_is_stereo(mc)) { - val2 =3D ((ucontrol->value.integer.value[1] + min) & mask); + val2 =3D ucontrol->value.integer.value[1]; + if (mc->platform_max && val2 > mc->platform_max) + return -EINVAL; + if (val2 > max - min) + return -EINVAL; + if (val2 < 0) + return -EINVAL; + val2 =3D (val2 + min) & mask; if (invert) val2 =3D max - val2; if (reg =3D=3D reg2) { From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 988E1C43219 for ; Mon, 7 Feb 2022 11:23:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382134AbiBGLSW (ORCPT ); Mon, 7 Feb 2022 06:18:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50312 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356734AbiBGLNU (ORCPT ); Mon, 7 Feb 2022 06:13:20 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8088CC043189; Mon, 7 Feb 2022 03:13:18 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7A565611AA; Mon, 7 Feb 2022 11:13:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 591F4C004E1; Mon, 7 Feb 2022 11:13:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232397; bh=pb9YFJqK6DzbsQ+nfYREskx+GD9DBVbjajIsy4tiFoo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SK4/z2x0cWp6NpAkx0VBRybfIGsvgbZkI2tdzJCkelLlqLgPDHCmtXkROnCR7S1AJ xMTDn/hakY7ZDGCiWSag/dOL2/iHDeTZhQD3nyWujFH1nmWaynK3XFaKzeAABp1CvI 5KgXrV+QJGFBtPHx0nhRg3OJAnyzUvHeef+s0rGk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Brown Subject: [PATCH 4.14 48/69] ASoC: ops: Reject out of bounds values in snd_soc_put_volsw_sx() Date: Mon, 7 Feb 2022 12:06:10 +0100 Message-Id: <20220207103757.202568011@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mark Brown commit 4f1e50d6a9cf9c1b8c859d449b5031cacfa8404e upstream. We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and reject any values that are out of range. Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220124153253.3548853-3-broonie@kernel.org Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- sound/soc/soc-ops.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -441,8 +441,15 @@ int snd_soc_put_volsw_sx(struct snd_kcon int err =3D 0; unsigned int val, val_mask, val2 =3D 0; =20 + val =3D ucontrol->value.integer.value[0]; + if (mc->platform_max && val > mc->platform_max) + return -EINVAL; + if (val > max - min) + return -EINVAL; + if (val < 0) + return -EINVAL; val_mask =3D mask << shift; - val =3D (ucontrol->value.integer.value[0] + min) & mask; + val =3D (val + min) & mask; val =3D val << shift; =20 err =3D snd_soc_component_update_bits(component, reg, val_mask, val); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24B41C46467 for ; Mon, 7 Feb 2022 11:23:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382332AbiBGLSw (ORCPT ); Mon, 7 Feb 2022 06:18:52 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50408 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356772AbiBGLNe (ORCPT ); Mon, 7 Feb 2022 06:13:34 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 24AF8C043181; Mon, 7 Feb 2022 03:13:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B484761261; Mon, 7 Feb 2022 11:13:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 705C9C004E1; Mon, 7 Feb 2022 11:13:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232413; bh=5BpweckNW7B3BwuG682SSTlFp9irHuo441A8c/1H8aQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SCiF5xdoF0FrHB+OSoKKUZeOk+4/O1xFL5k3UTJIGq8T3uaXTr+LLjlx87UpcRW9q 5vfE831eiSp6K7RT4jI8125BS48ps3Zbml+dK0PIKE64Hmf4aZqH/KHXEajmmeUNf6 dWiJ5Ngc1wbFuwoGIYnNIhbgAioSdw7NOuku8a3w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Brown Subject: [PATCH 4.14 49/69] ASoC: ops: Reject out of bounds values in snd_soc_put_xr_sx() Date: Mon, 7 Feb 2022 12:06:11 +0100 Message-Id: <20220207103757.233024892@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mark Brown commit 4cf28e9ae6e2e11a044be1bcbcfa1b0d8675fe4d upstream. We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and reject any values that are out of range. Signed-off-by: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220124153253.3548853-4-broonie@kernel.org Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- sound/soc/soc-ops.c | 2 ++ 1 file changed, 2 insertions(+) --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -915,6 +915,8 @@ int snd_soc_put_xr_sx(struct snd_kcontro unsigned int i, regval, regmask; int err; =20 + if (val < mc->min || val > mc->max) + return -EINVAL; if (invert) val =3D max - val; val &=3D mask; From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34166C35271 for ; Mon, 7 Feb 2022 11:23:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382343AbiBGLSy (ORCPT ); Mon, 7 Feb 2022 06:18:54 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50430 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356773AbiBGLNj (ORCPT ); Mon, 7 Feb 2022 06:13:39 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E0F7EC043181; Mon, 7 Feb 2022 03:13:38 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9BC10B81028; Mon, 7 Feb 2022 11:13:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AB364C340EB; Mon, 7 Feb 2022 11:13:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232416; bh=JE/jV0p/vLig4xTmzfQk4lQFfn7O51vh4mZW9DF20YE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kQcSr5MpVqbDy3GqbOnE9nO1Y0k50aW0sPOcNYPj0+ioDz7arrLIYXc9TfeadGLtm ubiucvHIcHrMpL8ZPVRm7Q/571Bb2nqmfWk8sV0YKZOgXhdk3BtCjLUUM0ua/v1V2P Qle22nk3r3KVETsUqlcLWZn/IwaMig1GUjFa0hXQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nick Lopez , Ilia Mirkin , Karol Herbst Subject: [PATCH 4.14 50/69] drm/nouveau: fix off by one in BIOS boundary checking Date: Mon, 7 Feb 2022 12:06:12 +0100 Message-Id: <20220207103757.267256930@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nick Lopez commit 1b777d4d9e383d2744fc9b3a09af6ec1893c8b1a upstream. Bounds checking when parsing init scripts embedded in the BIOS reject access to the last byte. This causes driver initialization to fail on Apple eMac's with GeForce 2 MX GPUs, leaving the system with no working console. This is probably only seen on OpenFirmware machines like PowerPC Macs because the BIOS image provided by OF is only the used parts of the ROM, not a power-of-two blocks read from PCI directly so PCs always have empty bytes at the end that are never accessed. Signed-off-by: Nick Lopez Fixes: 4d4e9907ff572 ("drm/nouveau/bios: guard against out-of-bounds access= es to image") Cc: # v4.10+ Reviewed-by: Ilia Mirkin Reviewed-by: Karol Herbst Signed-off-by: Karol Herbst Link: https://patchwork.freedesktop.org/patch/msgid/20220122081906.2633061-= 1-github@glowingmonkey.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c @@ -38,7 +38,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 *addr +=3D bios->imaged_addr; } =20 - if (unlikely(*addr + size >=3D bios->size)) { + if (unlikely(*addr + size > bios->size)) { nvkm_error(&bios->subdev, "OOB %d %08x %08x\n", size, p, *addr); return false; } From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 438CEC4707A for ; Mon, 7 Feb 2022 11:23:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382364AbiBGLS5 (ORCPT ); Mon, 7 Feb 2022 06:18:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50444 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356779AbiBGLNk (ORCPT ); Mon, 7 Feb 2022 06:13:40 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6A40DC043181; Mon, 7 Feb 2022 03:13:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 06A2561380; Mon, 7 Feb 2022 11:13:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CC782C340F0; Mon, 7 Feb 2022 11:13:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232419; bh=FiHCycypaGmh6ZE4s8cl9YhCQrEHuZt+aoReo8QuKOE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FsOU274KnPthb7p/JThL3bC3EeakbNcOa7Qysx6RMznk4MIhA891UbwWUS4Mp5cCr KK87AnVV9C3AV/tbdufNQwRx8ClkQZN9T/oHPaeI3BRjBrxrjKCkBLQ79331gQMlV8 67P+dWKIvEpcHqG+EXdJzFn4TClZT+ZVUrv92URM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Monakhov , Dmitry Ivanov , Alexey Lyashkov , "Martin K. Petersen" , Jens Axboe Subject: [PATCH 4.14 51/69] block: bio-integrity: Advance seed correctly for larger interval sizes Date: Mon, 7 Feb 2022 12:06:13 +0100 Message-Id: <20220207103757.299374694@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Martin K. Petersen commit b13e0c71856817fca67159b11abac350e41289f5 upstream. Commit 309a62fa3a9e ("bio-integrity: bio_integrity_advance must update integrity seed") added code to update the integrity seed value when advancing a bio. However, it failed to take into account that the integrity interval might be larger than the 512-byte block layer sector size. This broke bio splitting on PI devices with 4KB logical blocks. The seed value should be advanced by bio_integrity_intervals() and not the number of sectors. Cc: Dmitry Monakhov Cc: stable@vger.kernel.org Fixes: 309a62fa3a9e ("bio-integrity: bio_integrity_advance must update inte= grity seed") Tested-by: Dmitry Ivanov Reported-by: Alexey Lyashkov Signed-off-by: Martin K. Petersen Link: https://lore.kernel.org/r/20220204034209.4193-1-martin.petersen@oracl= e.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- block/bio-integrity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/block/bio-integrity.c +++ b/block/bio-integrity.c @@ -417,7 +417,7 @@ void bio_integrity_advance(struct bio *b struct blk_integrity *bi =3D blk_get_integrity(bio->bi_disk); unsigned bytes =3D bio_integrity_bytes(bi, bytes_done >> 9); =20 - bip->bip_iter.bi_sector +=3D bytes_done >> 9; + bip->bip_iter.bi_sector +=3D bio_integrity_intervals(bi, bytes_done >> 9); bvec_iter_advance(bip->bip_vec, &bip->bip_iter, bytes); } EXPORT_SYMBOL(bio_integrity_advance); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 53748C35272 for ; Mon, 7 Feb 2022 11:23:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382382AbiBGLTB (ORCPT ); Mon, 7 Feb 2022 06:19:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50468 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356783AbiBGLNp (ORCPT ); Mon, 7 Feb 2022 06:13:45 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 01816C043181; Mon, 7 Feb 2022 03:13:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B012BB80EC3; Mon, 7 Feb 2022 11:13:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA3ACC004E1; Mon, 7 Feb 2022 11:13:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232422; bh=3hXgbhO+YSOZhDR0x7tGN3e0CeUh1NYxSuTNjjlVmOA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=o8za7HjalpyErx3IVuSEbRpBXqAtcVln60hu3213ivzQgtecyoMEWNV2OE1LAZ3so pAL4CUkcR/vBuj1pY3gsAvGVbn/9/PzwKW2xdUf4anUw8aFUs/vODmj3msvp9ZlTuy TnNZzKVE2V0bUnIRPDv7IlmcShUOVyXC+aJOUfxg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Leon Romanovsky , =?UTF-8?q?H=C3=A5kon=20Bugge?= , Jason Gunthorpe Subject: [PATCH 4.14 52/69] RDMA/mlx4: Dont continue event handler after memory allocation failure Date: Mon, 7 Feb 2022 12:06:14 +0100 Message-Id: <20220207103757.332346102@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Leon Romanovsky commit f3136c4ce7acf64bee43135971ca52a880572e32 upstream. The failure to allocate memory during MLX4_DEV_EVENT_PORT_MGMT_CHANGE event handler will cause skip the assignment logic, but ib_dispatch_event() will be called anyway. Fix it by calling to return instead of break after memory allocation failure. Fixes: 00f5ce99dc6e ("mlx4: Use port management change event instead of smp= _snoop") Link: https://lore.kernel.org/r/12a0e83f18cfad4b5f62654f141e240d04915e10.16= 43622264.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky Reviewed-by: H=C3=A5kon Bugge Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/infiniband/hw/mlx4/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/infiniband/hw/mlx4/main.c +++ b/drivers/infiniband/hw/mlx4/main.c @@ -3346,7 +3346,7 @@ static void mlx4_ib_event(struct mlx4_de case MLX4_DEV_EVENT_PORT_MGMT_CHANGE: ew =3D kmalloc(sizeof *ew, GFP_ATOMIC); if (!ew) - break; + return; =20 INIT_WORK(&ew->work, handle_port_mgmt_change_event); memcpy(&ew->ib_eqe, eqe, sizeof *eqe); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6AB2DC4707E for ; Mon, 7 Feb 2022 11:23:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382394AbiBGLTD (ORCPT ); Mon, 7 Feb 2022 06:19:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50482 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356786AbiBGLNs (ORCPT ); Mon, 7 Feb 2022 06:13:48 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E0F68C043181; Mon, 7 Feb 2022 03:13:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A293CB80EC3; Mon, 7 Feb 2022 11:13:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CB078C004E1; Mon, 7 Feb 2022 11:13:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232425; bh=8RcvJ0iNpGXd9hhP8foxR5IlHZdwD/RWOBg4L/G1cj0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=unSfOZvWdfI7vcrAE+xWFPxD/RGcRJjHDRjNezuQ0js+ERbRI7rtkJFhdmOp9ZsC+ m6iUoJjyLhN7RgtdDnIK2zBc5CbnZEWZ2+JsV4p+NTX7rLgZGvCuRiUX/FH3Tb99Ty 1GGwSTSVycUXtFr1OqWrOQv2cGR0a/Gk81rLz3hg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lu Baolu , Guoqing Jiang , Joerg Roedel Subject: [PATCH 4.14 53/69] iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() Date: Mon, 7 Feb 2022 12:06:15 +0100 Message-Id: <20220207103757.363053239@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Guoqing Jiang commit 99e675d473eb8cf2deac1376a0f840222fc1adcf upstream. After commit e3beca48a45b ("irqdomain/treewide: Keep firmware node unconditionally allocated"). For tear down scenario, fn is only freed after fail to allocate ir_domain, though it also should be freed in case dmar_enable_qi returns error. Besides free fn, irq_domain and ir_msi_domain need to be removed as well if intel_setup_irq_remapping fails to enable queued invalidation. Improve the rewinding path by add out_free_ir_domain and out_free_fwnode lables per Baolu's suggestion. Fixes: e3beca48a45b ("irqdomain/treewide: Keep firmware node unconditionall= y allocated") Suggested-by: Lu Baolu Signed-off-by: Guoqing Jiang Link: https://lore.kernel.org/r/20220119063640.16864-1-guoqing.jiang@linux.= dev Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20220128031002.2219155-3-baolu.lu@linux.int= el.com Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/iommu/intel_irq_remapping.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) --- a/drivers/iommu/intel_irq_remapping.c +++ b/drivers/iommu/intel_irq_remapping.c @@ -543,9 +543,8 @@ static int intel_setup_irq_remapping(str fn, &intel_ir_domain_ops, iommu); if (!iommu->ir_domain) { - irq_domain_free_fwnode(fn); pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id); - goto out_free_bitmap; + goto out_free_fwnode; } iommu->ir_msi_domain =3D arch_create_remap_msi_irq_domain(iommu->ir_domain, @@ -569,7 +568,7 @@ static int intel_setup_irq_remapping(str =20 if (dmar_enable_qi(iommu)) { pr_err("Failed to enable queued invalidation\n"); - goto out_free_bitmap; + goto out_free_ir_domain; } } =20 @@ -593,6 +592,14 @@ static int intel_setup_irq_remapping(str =20 return 0; =20 +out_free_ir_domain: + if (iommu->ir_msi_domain) + irq_domain_remove(iommu->ir_msi_domain); + iommu->ir_msi_domain =3D NULL; + irq_domain_remove(iommu->ir_domain); + iommu->ir_domain =3D NULL; +out_free_fwnode: + irq_domain_free_fwnode(fn); out_free_bitmap: kfree(bitmap); out_free_pages: From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A1EBC35273 for ; Mon, 7 Feb 2022 11:23:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382423AbiBGLTG (ORCPT ); Mon, 7 Feb 2022 06:19:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50494 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356787AbiBGLNt (ORCPT ); Mon, 7 Feb 2022 06:13:49 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 50806C043181; Mon, 7 Feb 2022 03:13:49 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E1D58611AA; Mon, 7 Feb 2022 11:13:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BD96CC004E1; Mon, 7 Feb 2022 11:13:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232428; bh=a+EmcVf2PwbBHz+WoJH1x244FSXlRy0azDAIny1NlSE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nVcBvQihHGWtOEwGW/KIdV/amHO0My1hKFDr3aYja49xMigUYbOp0eDY8OW6lQh2E kkC21IS6LUMq3silyJJ7MOhQ6oyCxwWTCE+wyqDQhMK4Bt5mFbungd047U2gJT1sx0 6tXQNYL2hQNjmIoAyvCQ9ImoYKVBAJyS6h/2V/eE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joerg Roedel Subject: [PATCH 4.14 54/69] iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() Date: Mon, 7 Feb 2022 12:06:16 +0100 Message-Id: <20220207103757.395843352@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joerg Roedel commit 9b45a7738eec52bf0f5d8d3d54e822962781c5f2 upstream. The polling loop for the register change in iommu_ga_log_enable() needs to have a udelay() in it. Otherwise the CPU might be faster than the IOMMU hardware and wrongly trigger the WARN_ON() further down the code stream. Use a 10us for udelay(), has there is some hardware where activation of the GA log can take more than a 100ms. A future optimization should move the activation check of the GA log to the point where it gets used for the first time. But that is a bigger change and not suitable for a fix. Fixes: 8bda0cfbdc1a ("iommu/amd: Detect and initialize guest vAPIC log") Signed-off-by: Joerg Roedel Link: https://lore.kernel.org/r/20220204115537.3894-1-joro@8bytes.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/iommu/amd_iommu_init.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/iommu/amd_iommu_init.c +++ b/drivers/iommu/amd_iommu_init.c @@ -30,6 +30,7 @@ #include #include #include +#include #include #include #include @@ -770,6 +771,7 @@ static int iommu_ga_log_enable(struct am status =3D readl(iommu->mmio_base + MMIO_STATUS_OFFSET); if (status & (MMIO_STATUS_GALOG_RUN_MASK)) break; + udelay(10); } =20 if (i >=3D LOOP_TIMEOUT) From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8FA58C4707F for ; Mon, 7 Feb 2022 11:23:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382441AbiBGLTK (ORCPT ); Mon, 7 Feb 2022 06:19:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50510 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356790AbiBGLNw (ORCPT ); Mon, 7 Feb 2022 06:13:52 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 45545C043181; Mon, 7 Feb 2022 03:13:52 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D87086113B; Mon, 7 Feb 2022 11:13:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C100CC004E1; Mon, 7 Feb 2022 11:13:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232431; bh=ZgHTpfB1Lw6sGk4se2ymlqSay6WE68L2OOWNGliZFQs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MCg9vfW/nCXMZbj8CimTM7fgGcwXooQyK5hgepe6WYAWWjMD8EH3bl77/JmRcbcsK 0G8kDBi49VprOzqp+KiXLEmq0Mh19A+F0C83b3mgdvpCBGR1+Q/ILLTweq+7lrIYut sdqztYHjn9Jwbbak/6eOlC/VTlyZqU0fVf1sldKc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kamal Dasu , Florian Fainelli , Mark Brown Subject: [PATCH 4.14 55/69] spi: bcm-qspi: check for valid cs before applying chip select Date: Mon, 7 Feb 2022 12:06:17 +0100 Message-Id: <20220207103757.433746148@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kamal Dasu commit 2cbd27267ffe020af1442b95ec57f59a157ba85c upstream. Apply only valid chip select value. This change fixes case where chip select is set to initial value of '-1' during probe and PM supend and subsequent resume can try to use the value with undefined behaviour. Also in case where gpio based chip select, the check in bcm_qspi_chip_select() shall prevent undefined behaviour on resume. Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver") Signed-off-by: Kamal Dasu Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20220127185359.27322-1-kdasu.kdev@gmail.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/spi/spi-bcm-qspi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/spi/spi-bcm-qspi.c +++ b/drivers/spi/spi-bcm-qspi.c @@ -522,7 +522,7 @@ static void bcm_qspi_chip_select(struct u32 rd =3D 0; u32 wr =3D 0; =20 - if (qspi->base[CHIP_SELECT]) { + if (cs >=3D 0 && qspi->base[CHIP_SELECT]) { rd =3D bcm_qspi_read(qspi, CHIP_SELECT, 0); wr =3D (rd & ~0xff) | (1 << cs); if (rd =3D=3D wr) From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83BCEC43219 for ; Mon, 7 Feb 2022 11:16:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1380048AbiBGLQc (ORCPT ); Mon, 7 Feb 2022 06:16:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49896 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355932AbiBGLMt (ORCPT ); Mon, 7 Feb 2022 06:12:49 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A4E39C043181; Mon, 7 Feb 2022 03:12:48 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 25DA16126D; Mon, 7 Feb 2022 11:12:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 08E4DC340F1; Mon, 7 Feb 2022 11:12:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232367; bh=0Lx6J+nW1j3Xe69Ss/RmZp3ltqUDCKWoqBjjFqSPDh4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JOg89JilsRXqOaQ2TDQLPM2ASEa0zmne5+Q3KGlYzvjP2CGrzLec8WS0Oi+HphA4Y 6BOCHIrBkLVZMSX/b7MHUyGMLq2HPlQ7cYZvdcZ5q3r50LZHUAYO9ue7mxY0ldXwGS Q5qZz28aZlMrUVAw2I7s6DxAA/q56DVN0eiOHJts= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Benjamin Gaignard , Mark Brown Subject: [PATCH 4.14 56/69] spi: mediatek: Avoid NULL pointer crash in interrupt Date: Mon, 7 Feb 2022 12:06:18 +0100 Message-Id: <20220207103757.465440538@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Benjamin Gaignard commit f83a96e5f033fbbd21764705cb9c04234b96218e upstream. In some case, like after a transfer timeout, master->cur_msg pointer is NULL which led to a kernel crash when trying to use master->cur_msg->spi. mtk_spi_can_dma(), pointed by master->can_dma, doesn't use this parameter avoid the problem by setting NULL as second parameter. Fixes: a568231f46322 ("spi: mediatek: Add spi bus for Mediatek MT8173") Signed-off-by: Benjamin Gaignard Link: https://lore.kernel.org/r/20220131141708.888710-1-benjamin.gaignard@c= ollabora.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/spi/spi-mt65xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/spi/spi-mt65xx.c +++ b/drivers/spi/spi-mt65xx.c @@ -498,7 +498,7 @@ static irqreturn_t mtk_spi_interrupt(int else mdata->state =3D MTK_SPI_IDLE; =20 - if (!master->can_dma(master, master->cur_msg->spi, trans)) { + if (!master->can_dma(master, NULL, trans)) { if (trans->rx_buf) { cnt =3D mdata->xfer_len / 4; ioread32_rep(mdata->base + SPI_RX_DATA_REG, From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2880C4167D for ; Mon, 7 Feb 2022 11:16:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1380168AbiBGLQf (ORCPT ); Mon, 7 Feb 2022 06:16:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49914 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356059AbiBGLMw (ORCPT ); Mon, 7 Feb 2022 06:12:52 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9B3A9C043188; Mon, 7 Feb 2022 03:12:51 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 27D246126D; Mon, 7 Feb 2022 11:12:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0EF9CC004E1; Mon, 7 Feb 2022 11:12:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232370; bh=Fi5FmP3vg78vf+vuAoyI4qaqL8RRmG0PE5bYYQm08KI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ruD6xfzn5ZN/FrlNPTLwvuYk9ks65CBieudKhqQbZuwldKDwPcHZSc+qviBM2VQcv JLm1heTWBt0X2xFk78JyLGBqXQSrfiuWB9EdGqeZ5dwI5FlHpBS/lUUh4Ys7wKp8xC BqpzNgZWvb2dDc8aqNUI1ueZOHtU0IRHJIjz5z7A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Mark Brown Subject: [PATCH 4.14 57/69] spi: meson-spicc: add IRQ check in meson_spicc_probe Date: Mon, 7 Feb 2022 12:06:19 +0100 Message-Id: <20220207103757.496713566@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin commit e937440f7fc444a3e3f1fb75ea65292d6f433a44 upstream. This check misses checking for platform_get_irq()'s call and may passes the negative error codes to devm_request_irq(), which takes unsigned IRQ #, causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with invalid IRQ #s. Fixes: 454fa271bc4e ("spi: Add Meson SPICC driver") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220126110447.24549-1-linmq006@gmail.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/spi/spi-meson-spicc.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/spi/spi-meson-spicc.c +++ b/drivers/spi/spi-meson-spicc.c @@ -529,6 +529,11 @@ static int meson_spicc_probe(struct plat writel_relaxed(0, spicc->base + SPICC_INTREG); =20 irq =3D platform_get_irq(pdev, 0); + if (irq < 0) { + ret =3D irq; + goto out_master; + } + ret =3D devm_request_irq(&pdev->dev, irq, meson_spicc_irq, 0, NULL, spicc); if (ret) { From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C291CC4167B for ; Mon, 7 Feb 2022 11:16:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1380243AbiBGLQh (ORCPT ); Mon, 7 Feb 2022 06:16:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49942 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356132AbiBGLM5 (ORCPT ); Mon, 7 Feb 2022 06:12:57 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2E1ACC043181; Mon, 7 Feb 2022 03:12:56 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E1F6AB80EE8; Mon, 7 Feb 2022 11:12:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 08292C004E1; Mon, 7 Feb 2022 11:12:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232373; bh=P0lrcZEgh8hsPsHCOTaIbX26/xGUq6E+ZqOZeIfDWz0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p1m+6/51DW64MMNzC3sGjzvdOEhnZHv4qISnmSbH4xNs1uVAhFU3RfuyPcMlL17/J QHO/7BRkcPjeG46UuAWuRwUC+o5ZKVkr7thx47FS9pXi8q0T37IGo3eIGsJVYXYuwG q/NGuJsMWmFlRtKA15msZSBJuTsSueHftvd0yd3w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miquel Raynal , Alexander Aring , Stefan Schmidt Subject: [PATCH 4.14 58/69] net: ieee802154: ca8210: Stop leaking skbs Date: Mon, 7 Feb 2022 12:06:20 +0100 Message-Id: <20220207103757.527269805@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miquel Raynal commit 621b24b09eb61c63f262da0c9c5f0e93348897e5 upstream. Upon error the ieee802154_xmit_complete() helper is not called. Only ieee802154_wake_queue() is called manually. We then leak the skb structure. Free the skb structure upon error before returning. Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") Signed-off-by: Miquel Raynal Acked-by: Alexander Aring Link: https://lore.kernel.org/r/20220125121426.848337-5-miquel.raynal@bootl= in.com Signed-off-by: Stefan Schmidt Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/net/ieee802154/ca8210.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/ieee802154/ca8210.c +++ b/drivers/net/ieee802154/ca8210.c @@ -1770,6 +1770,7 @@ static int ca8210_async_xmit_complete( status ); if (status !=3D MAC_TRANSACTION_OVERFLOW) { + dev_kfree_skb_any(priv->tx_skb); ieee802154_wake_queue(priv->hw); return 0; } From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E1B98C41535 for ; Mon, 7 Feb 2022 11:16:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1380361AbiBGLQi (ORCPT ); Mon, 7 Feb 2022 06:16:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49952 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356169AbiBGLM6 (ORCPT ); Mon, 7 Feb 2022 06:12:58 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8CA4DC043181; Mon, 7 Feb 2022 03:12:57 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 150F86113B; Mon, 7 Feb 2022 11:12:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0C32C004E1; Mon, 7 Feb 2022 11:12:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232376; bh=2O89AtN1vHXWRPyZpiZKazpXQfHZV1cQsQ/RlhYK4Bw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=01Y8/iCE1OZEdHxXYRJRhdnFyk/WJK2r6GCoWXYzalWSKOr/TbVWBdwSskPesDitC QeQR65v8kxaLH98ELuPZajnIzhiiibxJdagLZ1qFuak01uQ0jetWAFzfF+8FsQw/T9 uG19l6yHQg9ztNL0cMzdRs+5JixnWfu5XLOOGExE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miquel Raynal , Alexander Aring , Stefan Schmidt Subject: [PATCH 4.14 59/69] net: ieee802154: Return meaningful error codes from the netlink helpers Date: Mon, 7 Feb 2022 12:06:21 +0100 Message-Id: <20220207103757.565190211@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miquel Raynal commit 79c37ca73a6e9a33f7b2b7783ba6af07a448c8a9 upstream. Returning -1 does not indicate anything useful. Use a standard and meaningful error code instead. Fixes: a26c5fd7622d ("nl802154: add support for security layer") Signed-off-by: Miquel Raynal Acked-by: Alexander Aring Link: https://lore.kernel.org/r/20220125121426.848337-6-miquel.raynal@bootl= in.com Signed-off-by: Stefan Schmidt Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- net/ieee802154/nl802154.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/net/ieee802154/nl802154.c +++ b/net/ieee802154/nl802154.c @@ -1459,7 +1459,7 @@ static int nl802154_send_key(struct sk_b =20 hdr =3D nl802154hdr_put(msg, portid, seq, flags, cmd); if (!hdr) - return -1; + return -ENOBUFS; =20 if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) goto nla_put_failure; @@ -1650,7 +1650,7 @@ static int nl802154_send_device(struct s =20 hdr =3D nl802154hdr_put(msg, portid, seq, flags, cmd); if (!hdr) - return -1; + return -ENOBUFS; =20 if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) goto nla_put_failure; @@ -1828,7 +1828,7 @@ static int nl802154_send_devkey(struct s =20 hdr =3D nl802154hdr_put(msg, portid, seq, flags, cmd); if (!hdr) - return -1; + return -ENOBUFS; =20 if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) goto nla_put_failure; @@ -2005,7 +2005,7 @@ static int nl802154_send_seclevel(struct =20 hdr =3D nl802154hdr_put(msg, portid, seq, flags, cmd); if (!hdr) - return -1; + return -ENOBUFS; =20 if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) goto nla_put_failure; From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0F06C4167E for ; Mon, 7 Feb 2022 11:16:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1380416AbiBGLQm (ORCPT ); Mon, 7 Feb 2022 06:16:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49968 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356374AbiBGLNB (ORCPT ); Mon, 7 Feb 2022 06:13:01 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF226C043181; Mon, 7 Feb 2022 03:13:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 68C696126D; Mon, 7 Feb 2022 11:13:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2AD47C004E1; Mon, 7 Feb 2022 11:12:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232379; bh=eVnM4/vWa5RlrsKSZ9YEG2ii+6AgOF8vjc0ymH0k7qA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fqiONOXMNzP+APf21135WvfNLiYG3b02AC6gkANx8VzN/Puq+zOW2+RNGE5Cfx5v4 1jJH5cgz/oHXDDNlN+PS8cJutEjJ8IoJSNdVBA8tDmWv62CAd/WK6kli0sv8jNGyOO ErLuXyc2QOYuWXEpeT8lWIoyxD/9ZYt6oVultNok= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lior Nahmanson , Raed Salem , Jakub Kicinski Subject: [PATCH 4.14 60/69] net: macsec: Verify that send_sci is on when setting Tx sci explicitly Date: Mon, 7 Feb 2022 12:06:22 +0100 Message-Id: <20220207103757.598605103@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lior Nahmanson commit d0cfa548dbde354de986911d3913897b5448faad upstream. When setting Tx sci explicit, the Rx side is expected to use this sci and not recalculate it from the packet.However, in case of Tx sci is explicit and send_sci is off, the receiver is wrongly recalculate the sci from the source MAC address which most likely be different than the explicit sci. Fix by preventing such configuration when macsec newlink is established and return EINVAL error code on such cases. Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") Signed-off-by: Lior Nahmanson Reviewed-by: Raed Salem Signed-off-by: Raed Salem Link: https://lore.kernel.org/r/1643542672-29403-1-git-send-email-raeds@nvi= dia.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/net/macsec.c | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/drivers/net/macsec.c +++ b/drivers/net/macsec.c @@ -3230,6 +3230,15 @@ static int macsec_newlink(struct net *ne =20 macsec->real_dev =3D real_dev; =20 + /* send_sci must be set to true when transmit sci explicitly is set */ + if ((data && data[IFLA_MACSEC_SCI]) && + (data && data[IFLA_MACSEC_INC_SCI])) { + u8 send_sci =3D !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]); + + if (!send_sci) + return -EINVAL; + } + if (data && data[IFLA_MACSEC_ICV_LEN]) icv_len =3D nla_get_u8(data[IFLA_MACSEC_ICV_LEN]); mtu =3D real_dev->mtu - icv_len - macsec_extra_len(true); From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3109BC4332F for ; Mon, 7 Feb 2022 11:23:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1380423AbiBGLSE (ORCPT ); Mon, 7 Feb 2022 06:18:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50010 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241405AbiBGLNI (ORCPT ); Mon, 7 Feb 2022 06:13:08 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3C694C0401C0; Mon, 7 Feb 2022 03:13:05 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F0838B80EC3; Mon, 7 Feb 2022 11:13:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4110BC004E1; Mon, 7 Feb 2022 11:13:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232382; bh=ij99Pji2hIjLQvYzmWEb7WMoAGwF9oR2PxtnVYAvycM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=itk6Mbu/0Ll/+xavgu++2ahO+R+zJF6/Q98O8rz4AiJvPFtP0kkBOGCcYW6VtZ2iu QJm4+oXUbNH9vT1sp4e6D8Bzixn1NdgfOBTZCjJhDhMsg7AHoc1U2zBe4jXcCfTmoq eN7d1RzYJb9thsd933PD/BkGLpJLPEKspJ8WfXhk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= , Tvrtko Ursulin Subject: [PATCH 4.14 61/69] drm/i915/overlay: Prevent divide by zero bugs in scaling Date: Mon, 7 Feb 2022 12:06:23 +0100 Message-Id: <20220207103757.629393379@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dan Carpenter commit 90a3d22ff02b196d5884e111f39271a1d4ee8e3e upstream. Smatch detected a divide by zero bug in check_overlay_scaling(). drivers/gpu/drm/i915/display/intel_overlay.c:976 check_overlay_scaling() error: potential divide by zero bug '/ rec->dst_height'. drivers/gpu/drm/i915/display/intel_overlay.c:980 check_overlay_scaling() error: potential divide by zero bug '/ rec->dst_width'. Prevent this by ensuring that the dst height and width are non-zero. Fixes: 02e792fbaadb ("drm/i915: implement drmmode overlay support v4") Signed-off-by: Dan Carpenter Signed-off-by: Ville Syrj=C3=A4l=C3=A4 Link: https://patchwork.freedesktop.org/patch/msgid/20220124122409.GA31673@= kili (cherry picked from commit cf5b64f7f10b28bebb9b7c9d25e7aee5cbe43918) Signed-off-by: Tvrtko Ursulin Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/gpu/drm/i915/intel_overlay.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/gpu/drm/i915/intel_overlay.c +++ b/drivers/gpu/drm/i915/intel_overlay.c @@ -965,6 +965,9 @@ static int check_overlay_dst(struct inte const struct intel_crtc_state *pipe_config =3D overlay->crtc->config; =20 + if (rec->dst_height =3D=3D 0 || rec->dst_width =3D=3D 0) + return -EINVAL; + if (rec->dst_x < pipe_config->pipe_src_w && rec->dst_x + rec->dst_width <=3D pipe_config->pipe_src_w && rec->dst_y < pipe_config->pipe_src_h && From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11707C433F5 for ; Mon, 7 Feb 2022 11:23:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379567AbiBGLSB (ORCPT ); Mon, 7 Feb 2022 06:18:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50036 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243241AbiBGLNI (ORCPT ); Mon, 7 Feb 2022 06:13:08 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 44C4CC0401C2; Mon, 7 Feb 2022 03:13:08 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DF155B81028; Mon, 7 Feb 2022 11:13:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A7EFC004E1; Mon, 7 Feb 2022 11:13:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232385; bh=hqkNVBOY0nLILtHUbF7Ph3I2L0K2QYQl+6SqV0lpEbs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rwo/fP3cJqSR+xd1d8XH46MMWBPuw1gypVmkLrrsOjLC7rqe9ReU6bpi+2sfZ7Uyf FfAOQgFb5X0gydS+sJdqcTWwQudRssVqBfJFEy8w7gVyOhf2KT7rsizi2TqRJ2zZXG n9WoUJmuSx/S0YQTQ42bed84fcXJ65f2Fpp1V7NU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Mark Brown Subject: [PATCH 4.14 62/69] ASoC: fsl: Add missing error handling in pcm030_fabric_probe Date: Mon, 7 Feb 2022 12:06:24 +0100 Message-Id: <20220207103757.661545761@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin commit fb25621da5702c104ce0a48de5b174ced09e5b4e upstream. Add the missing platform_device_put() and platform_device_del() before return from pcm030_fabric_probe in the error handling case. Fixes: c912fa913446 ("ASoC: fsl: register the wm9712-codec") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220127131336.30214-1-linmq006@gmail.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- sound/soc/fsl/pcm030-audio-fabric.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/sound/soc/fsl/pcm030-audio-fabric.c +++ b/sound/soc/fsl/pcm030-audio-fabric.c @@ -90,16 +90,21 @@ static int pcm030_fabric_probe(struct pl dev_err(&op->dev, "platform_device_alloc() failed\n"); =20 ret =3D platform_device_add(pdata->codec_device); - if (ret) + if (ret) { dev_err(&op->dev, "platform_device_add() failed: %d\n", ret); + platform_device_put(pdata->codec_device); + } =20 ret =3D snd_soc_register_card(card); - if (ret) + if (ret) { dev_err(&op->dev, "snd_soc_register_card() failed: %d\n", ret); + platform_device_del(pdata->codec_device); + platform_device_put(pdata->codec_device); + } =20 platform_set_drvdata(op, pdata); - return ret; + } =20 static int pcm030_fabric_remove(struct platform_device *op) From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46990C433FE for ; Mon, 7 Feb 2022 11:23:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1381982AbiBGLSJ (ORCPT ); Mon, 7 Feb 2022 06:18:09 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50136 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355313AbiBGLNO (ORCPT ); Mon, 7 Feb 2022 06:13:14 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6A0F2C0401C2; Mon, 7 Feb 2022 03:13:11 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0DC23B81028; Mon, 7 Feb 2022 11:13:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31AD7C004E1; Mon, 7 Feb 2022 11:13:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232388; bh=VluB2J+kIM9oj76n7AMWSOUEqAaEMZUSLTxgMykkH/4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IB5+No0gWpwHES6b9B/pZ/24IyovExD18kLhyJH3ulU/zAdHB3CY2aFH0BGYf2SSx Eh6Y4NoiQt2g/wkQRdXzKfGDHGdBaJ8iZuST/oKHzr6qWjC9N+tz45Y4HPqNssDdW3 euKVQn/2ajf/Z0CAHuZuORXbgDPXSIbDdokxy84o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guangwu Zhang , Saurav Kashyap , John Meneghini , "Martin K. Petersen" Subject: [PATCH 4.14 63/69] scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe Date: Mon, 7 Feb 2022 12:06:25 +0100 Message-Id: <20220207103757.692843408@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: John Meneghini commit 936bd03405fc83ba039d42bc93ffd4b88418f1d3 upstream. Running tests with a debug kernel shows that bnx2fc_recv_frame() is modifying the per_cpu lport stats counters in a non-mpsafe way. Just boot a debug kernel and run the bnx2fc driver with the hardware enabled. [ 1391.699147] BUG: using smp_processor_id() in preemptible [00000000] code= : bnx2fc_ [ 1391.699160] caller is bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc] [ 1391.699174] CPU: 2 PID: 4355 Comm: bnx2fc_l2_threa Kdump: loaded Tainted= : G B [ 1391.699180] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013 [ 1391.699183] Call Trace: [ 1391.699188] dump_stack_lvl+0x57/0x7d [ 1391.699198] check_preemption_disabled+0xc8/0xd0 [ 1391.699205] bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc] [ 1391.699215] ? do_raw_spin_trylock+0xb5/0x180 [ 1391.699221] ? bnx2fc_npiv_create_vports.isra.0+0x4e0/0x4e0 [bnx2fc] [ 1391.699229] ? bnx2fc_l2_rcv_thread+0xb7/0x3a0 [bnx2fc] [ 1391.699240] bnx2fc_l2_rcv_thread+0x1af/0x3a0 [bnx2fc] [ 1391.699250] ? bnx2fc_ulp_init+0xc0/0xc0 [bnx2fc] [ 1391.699258] kthread+0x364/0x420 [ 1391.699263] ? _raw_spin_unlock_irq+0x24/0x50 [ 1391.699268] ? set_kthread_struct+0x100/0x100 [ 1391.699273] ret_from_fork+0x22/0x30 Restore the old get_cpu/put_cpu code with some modifications to reduce the size of the critical section. Link: https://lore.kernel.org/r/20220124145110.442335-1-jmeneghi@redhat.com Fixes: d576a5e80cd0 ("bnx2fc: Improve stats update mechanism") Tested-by: Guangwu Zhang Acked-by: Saurav Kashyap Signed-off-by: John Meneghini Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) --- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c @@ -515,7 +515,8 @@ static int bnx2fc_l2_rcv_thread(void *ar =20 static void bnx2fc_recv_frame(struct sk_buff *skb) { - u32 fr_len; + u64 crc_err; + u32 fr_len, fr_crc; struct fc_lport *lport; struct fcoe_rcv_info *fr; struct fc_stats *stats; @@ -549,6 +550,11 @@ static void bnx2fc_recv_frame(struct sk_ skb_pull(skb, sizeof(struct fcoe_hdr)); fr_len =3D skb->len - sizeof(struct fcoe_crc_eof); =20 + stats =3D per_cpu_ptr(lport->stats, get_cpu()); + stats->RxFrames++; + stats->RxWords +=3D fr_len / FCOE_WORD_TO_BYTE; + put_cpu(); + fp =3D (struct fc_frame *)skb; fc_frame_init(fp); fr_dev(fp) =3D lport; @@ -631,16 +637,15 @@ static void bnx2fc_recv_frame(struct sk_ return; } =20 - stats =3D per_cpu_ptr(lport->stats, smp_processor_id()); - stats->RxFrames++; - stats->RxWords +=3D fr_len / FCOE_WORD_TO_BYTE; + fr_crc =3D le32_to_cpu(fr_crc(fp)); =20 - if (le32_to_cpu(fr_crc(fp)) !=3D - ~crc32(~0, skb->data, fr_len)) { - if (stats->InvalidCRCCount < 5) + if (unlikely(fr_crc !=3D ~crc32(~0, skb->data, fr_len))) { + stats =3D per_cpu_ptr(lport->stats, get_cpu()); + crc_err =3D (stats->InvalidCRCCount++); + put_cpu(); + if (crc_err < 5) printk(KERN_WARNING PFX "dropping frame with " "CRC error\n"); - stats->InvalidCRCCount++; kfree_skb(skb); return; } From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59331C43217 for ; Mon, 7 Feb 2022 11:23:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382066AbiBGLSN (ORCPT ); Mon, 7 Feb 2022 06:18:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50138 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355058AbiBGLNO (ORCPT ); Mon, 7 Feb 2022 06:13:14 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C0DB6C043189; Mon, 7 Feb 2022 03:13:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5A7006113B; Mon, 7 Feb 2022 11:13:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 36A75C004E1; Mon, 7 Feb 2022 11:13:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232391; bh=2Q1dbn0eLfIe61aVuyBIXRjIkZTDLb8UPYbVbrGLcCY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KXWuJwPpR6etHoPS1pSoBS2DhzrXfXMxUDs+AecCIMIJUZouz39Bv5zgtEE5EY6W1 MIFFfk4CqfPVGbkMvFGl/+3qXAJFOGWtuvF7Omiv2HWgO7IZM9ur3tkpMGWDk/5Qs7 IgIrKKtgBGgeMkBygjpjziRliskd0EtpYVs40HSg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dai Ngo , Chuck Lever , Bruce Fields Subject: [PATCH 4.14 64/69] nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. Date: Mon, 7 Feb 2022 12:06:26 +0100 Message-Id: <20220207103757.728793877@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dai Ngo commit ab451ea952fe9d7afefae55ddb28943a148247fe upstream. >From RFC 7530 Section 16.34.5: o The server has not recorded an unconfirmed { v, x, c, *, * } and has recorded a confirmed { v, x, c, *, s }. If the principals of the record and of SETCLIENTID_CONFIRM do not match, the server returns NFS4ERR_CLID_INUSE without removing any relevant leased client state, and without changing recorded callback and callback_ident values for client { x }. The current code intends to do what the spec describes above but it forgot to set 'old' to NULL resulting to the confirmed client to be expired. Fixes: 2b63482185e6 ("nfsd: fix clid_inuse on mount with security change") Signed-off-by: Dai Ngo Signed-off-by: Chuck Lever Reviewed-by: Bruce Fields Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- fs/nfsd/nfs4state.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -3423,8 +3423,10 @@ nfsd4_setclientid_confirm(struct svc_rqs status =3D nfserr_clid_inuse; if (client_has_state(old) && !same_creds(&unconf->cl_cred, - &old->cl_cred)) + &old->cl_cred)) { + old =3D NULL; goto out; + } status =3D mark_client_expired_locked(old); if (status) { old =3D NULL; From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7994CC4321E for ; Mon, 7 Feb 2022 11:23:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382095AbiBGLSR (ORCPT ); Mon, 7 Feb 2022 06:18:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50198 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356609AbiBGLNR (ORCPT ); Mon, 7 Feb 2022 06:13:17 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D39B8C0401C1; Mon, 7 Feb 2022 03:13:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 87409611AA; Mon, 7 Feb 2022 11:13:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 56FE1C004E1; Mon, 7 Feb 2022 11:13:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232395; bh=j8GhDE5h8Hapt122YqavWtJP8vnPRrRx5qAl5rxzYAk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=A53nI1wLLh6JPpqCGr2QA02XIpUUaEiuFJdz0TZZlyobyUlSZ/nQt1HLftngzHv18 q9dLtAAfIV+uL1SL4+eJOjJsTeF8yFuisUKkCFamJw1XVlQWw/YdNvm/EeVE3GQaS/ Bnd5u+KyNAq5QRd+nqfwiCSRkyHp4k2O8D5TvSt0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Muhammad Usama Anjum , =?UTF-8?q?Andr=C3=A9=20Almeida?= , Shuah Khan Subject: [PATCH 4.14 65/69] selftests: futex: Use variable MAKE instead of make Date: Mon, 7 Feb 2022 12:06:27 +0100 Message-Id: <20220207103757.767977963@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Muhammad Usama Anjum commit b9199181a9ef8252e47e207be8c23e1f50662620 upstream. Recursive make commands should always use the variable MAKE, not the explicit command name =E2=80=98make=E2=80=99. This has benefits and removes= the following warning when multiple jobs are used for the build: make[2]: warning: jobserver unavailable: using -j1. Add '+' to parent make= rule. Fixes: a8ba798bc8ec ("selftests: enable O and KBUILD_OUTPUT") Signed-off-by: Muhammad Usama Anjum Reviewed-by: Andr=C3=A9 Almeida Signed-off-by: Shuah Khan Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- tools/testing/selftests/futex/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/tools/testing/selftests/futex/Makefile +++ b/tools/testing/selftests/futex/Makefile @@ -11,7 +11,7 @@ all: @for DIR in $(SUBDIRS); do \ BUILD_TARGET=3D$(OUTPUT)/$$DIR; \ mkdir $$BUILD_TARGET -p; \ - make OUTPUT=3D$$BUILD_TARGET -C $$DIR $@;\ + $(MAKE) OUTPUT=3D$$BUILD_TARGET -C $$DIR $@;\ if [ -e $$DIR/$(TEST_PROGS) ]; then \ rsync -a $$DIR/$(TEST_PROGS) $$BUILD_TARGET/; \ fi \ @@ -40,6 +40,6 @@ override define CLEAN @for DIR in $(SUBDIRS); do \ BUILD_TARGET=3D$(OUTPUT)/$$DIR; \ mkdir $$BUILD_TARGET -p; \ - make OUTPUT=3D$$BUILD_TARGET -C $$DIR $@;\ + $(MAKE) OUTPUT=3D$$BUILD_TARGET -C $$DIR $@;\ done endef From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DCD1DC4167E for ; Mon, 7 Feb 2022 11:23:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382283AbiBGLSq (ORCPT ); Mon, 7 Feb 2022 06:18:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50354 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356748AbiBGLN0 (ORCPT ); Mon, 7 Feb 2022 06:13:26 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 60D6DC0401C0; Mon, 7 Feb 2022 03:13:23 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1FA95B81028; Mon, 7 Feb 2022 11:13:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5F15AC004E1; Mon, 7 Feb 2022 11:13:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232401; bh=VmPwG06BoYxolGXfIBhJmLsdJiUdT/22gIzJPpO0ABE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KikeQzjgGhawUDfVYpygf6skTb3bNLDW1Mhtbtzyx2qTqkgodIX3sioTWtu1FpR/y Fz2HCaUoLVQSnQKP9W2hfI7p+fs0Ej78dS3G0DQEgVM1O/8zsq3UEkBU51RdOpk8Lu isSg0tllrw7yLy8Xt8/2/mOQUZ89o0auRcpgKEgs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Riwen Lu , Eric Wong , =?UTF-8?q?Mateusz=20Jo=C5=84czyk?= , Alexandre Belloni Subject: [PATCH 4.14 66/69] rtc: cmos: Evaluate century appropriate Date: Mon, 7 Feb 2022 12:06:28 +0100 Message-Id: <20220207103757.798785618@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Riwen Lu commit ff164ae39b82ee483b24579c8e22a13a8ce5bd04 upstream. There's limiting the year to 2069. When setting the rtc year to 2070, reading it returns 1970. Evaluate century starting from 19 to count the correct year. $ sudo date -s 20700106 Mon 06 Jan 2070 12:00:00 AM CST $ sudo hwclock -w $ sudo hwclock -r 1970-01-06 12:00:49.604968+08:00 Fixes: 2a4daadd4d3e5071 ("rtc: cmos: ignore bogus century byte") Signed-off-by: Riwen Lu Acked-by: Eric Wong Reviewed-by: Mateusz Jo=C5=84czyk Signed-off-by: Alexandre Belloni Link: https://lore.kernel.org/r/20220106084609.1223688-1-luriwen@kylinos.cn Signed-off-by: Mateusz Jo=C5=84czyk # preparation for s= table Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/rtc/rtc-mc146818-lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/rtc/rtc-mc146818-lib.c +++ b/drivers/rtc/rtc-mc146818-lib.c @@ -82,7 +82,7 @@ unsigned int mc146818_get_time(struct rt time->tm_year +=3D real_year - 72; #endif =20 - if (century > 20) + if (century > 19) time->tm_year +=3D (century - 19) * 100; =20 /* From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7314C4167B for ; Mon, 7 Feb 2022 11:23:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382249AbiBGLSl (ORCPT ); Mon, 7 Feb 2022 06:18:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50362 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356753AbiBGLN1 (ORCPT ); Mon, 7 Feb 2022 06:13:27 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 71F57C0401C1; Mon, 7 Feb 2022 03:13:26 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 28634B80EE8; Mon, 7 Feb 2022 11:13:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 60EF1C004E1; Mon, 7 Feb 2022 11:13:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232404; bh=+Nxyqn9HuoEQlzbKhHgVB+8w/+IoiYP/Q9se7acyhjk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OO0YOA07XVGLndpJ+zoDEf6daFXhZoZPkeLQQRTeB4puZ09jPFD/Dk7kA3Lc4A3EJ GmRdcyObjPVFyY1IQ0OF18RHkVSgADV/h0LDWYUkRv3bZc7EeHXw74KSrtG85p4B/N 0mwiV7gJEnPtgO5lTtzR2Q/QT3H2gMcixb4+yHfA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Borislav Petkov , Dinh Nguyen Subject: [PATCH 4.14 67/69] EDAC/altera: Fix deferred probing Date: Mon, 7 Feb 2022 12:06:29 +0100 Message-Id: <20220207103757.836504837@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sergey Shtylyov commit 279eb8575fdaa92c314a54c0d583c65e26229107 upstream. The driver overrides the error codes returned by platform_get_irq() to -ENODEV for some strange reason, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the proper error codes to platform driver code upwards. [ bp: Massage commit message. ] Fixes: 71bcada88b0f ("edac: altera: Add Altera SDRAM EDAC support") Signed-off-by: Sergey Shtylyov Signed-off-by: Borislav Petkov Acked-by: Dinh Nguyen Cc: Link: https://lore.kernel.org/r/20220124185503.6720-2-s.shtylyov@omp.ru Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/edac/altera_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/edac/altera_edac.c +++ b/drivers/edac/altera_edac.c @@ -357,7 +357,7 @@ static int altr_sdram_probe(struct platf if (irq < 0) { edac_printk(KERN_ERR, EDAC_MC, "No irq %d in DT\n", irq); - return -ENODEV; + return irq; } =20 /* Arria10 has a 2nd IRQ */ From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2E7BC41535 for ; Mon, 7 Feb 2022 11:23:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382303AbiBGLSs (ORCPT ); Mon, 7 Feb 2022 06:18:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50382 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356758AbiBGLNa (ORCPT ); Mon, 7 Feb 2022 06:13:30 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C9507C043181; Mon, 7 Feb 2022 03:13:29 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 70E86B80EC3; Mon, 7 Feb 2022 11:13:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 88423C004E1; Mon, 7 Feb 2022 11:13:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232407; bh=3BnQTiy1lYRjKYs33OvlOJ3AUlWRFB7XgubtblS7lzg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FOj69oZqfyWpAhx1IcEsX3ZStBSW2wL7cvzXvJP+svxfWoWnHWdZdZqkMmVv3zAfa ezGVdbSjlJxiSBehOupKHR3oemnGMadhB0lDSXPi/Ap3j2Gs07xMiaqtjxcVDCasJ9 6q7Y54QVOWIdCk9tQNfaR7vlTW4jsl2udTciy+Q4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Borislav Petkov Subject: [PATCH 4.14 68/69] EDAC/xgene: Fix deferred probing Date: Mon, 7 Feb 2022 12:06:30 +0100 Message-Id: <20220207103757.869276090@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sergey Shtylyov commit dfd0dfb9a7cc04acf93435b440dd34c2ca7b4424 upstream. The driver overrides error codes returned by platform_get_irq_optional() to -EINVAL for some strange reason, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the proper error codes to platform driver code upwards. [ bp: Massage commit message. ] Fixes: 0d4429301c4a ("EDAC: Add APM X-Gene SoC EDAC driver") Signed-off-by: Sergey Shtylyov Signed-off-by: Borislav Petkov Cc: Link: https://lore.kernel.org/r/20220124185503.6720-3-s.shtylyov@omp.ru Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- drivers/edac/xgene_edac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/edac/xgene_edac.c +++ b/drivers/edac/xgene_edac.c @@ -1934,7 +1934,7 @@ static int xgene_edac_probe(struct platf irq =3D platform_get_irq(pdev, i); if (irq < 0) { dev_err(&pdev->dev, "No IRQ resource\n"); - rc =3D -EINVAL; + rc =3D irq; goto out_err; } rc =3D devm_request_irq(&pdev->dev, irq, From nobody Mon Jun 29 16:42:26 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15E16C3526C for ; Mon, 7 Feb 2022 11:23:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382318AbiBGLSu (ORCPT ); Mon, 7 Feb 2022 06:18:50 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50390 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356765AbiBGLNb (ORCPT ); Mon, 7 Feb 2022 06:13:31 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0F930C043181; Mon, 7 Feb 2022 03:13:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 97A3D6113B; Mon, 7 Feb 2022 11:13:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7E14BC004E1; Mon, 7 Feb 2022 11:13:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1644232410; bh=F/QbNNqba+0/d9ALbVKqMbAb5lEPbTxyul6cv0u1oBU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HIplAB+n4W5AryFsJUYSZdfut2Jm8K4yzThaXlUxZCvwvfmo7jTDW2Nqj9LU0WaNd fDAJ7tkYpRjpFysTCVl4GL+SzocCcRhTD+I5uC0SXmsxXhYMgdeVKiD9xCUDfYuBSQ cXx60vhmzI+cH4J1M+NqLnfNttupah/RZdx7Lef4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Whitney , Ritesh Harjani , Jan Kara , Theodore Tso , stable@kernel.org Subject: [PATCH 4.14 69/69] ext4: fix error handling in ext4_restore_inline_data() Date: Mon, 7 Feb 2022 12:06:31 +0100 Message-Id: <20220207103757.901552040@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220207103755.604121441@linuxfoundation.org> References: <20220207103755.604121441@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ritesh Harjani commit 897026aaa73eb2517dfea8d147f20ddb0b813044 upstream. While running "./check -I 200 generic/475" it sometimes gives below kernel BUG(). Ideally we should not call ext4_write_inline_data() if ext4_create_inline_data() has failed. [73131.453234] kernel BUG at fs/ext4/inline.c:223! 212 static void ext4_write_inline_data(struct inode *inode, struct ext4_il= oc *iloc, 213 void *buffer, loff_t pos, unsigned = int len) 214 { <...> 223 BUG_ON(!EXT4_I(inode)->i_inline_off); 224 BUG_ON(pos + len > EXT4_I(inode)->i_inline_size); This patch handles the error and prints out a emergency msg saying potential data loss for the given inode (since we couldn't restore the original inline_data due to some previous error). [ 9571.070313] EXT4-fs (dm-0): error restoring inline_data for inode -- pot= ential data loss! (inode 1703982, error -30) Reported-by: Eric Whitney Signed-off-by: Ritesh Harjani Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/9f4cd7dfd54fa58ff27270881823d94ddf78dd07.16= 42416995.git.riteshh@linux.ibm.com Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Slade Watkins --- fs/ext4/inline.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -1131,7 +1131,15 @@ static void ext4_restore_inline_data(han struct ext4_iloc *iloc, void *buf, int inline_size) { - ext4_create_inline_data(handle, inode, inline_size); + int ret; + + ret =3D ext4_create_inline_data(handle, inode, inline_size); + if (ret) { + ext4_msg(inode->i_sb, KERN_EMERG, + "error restoring inline_data for inode -- potential data loss! (inode %= lu, error %d)", + inode->i_ino, ret); + return; + } ext4_write_inline_data(inode, iloc, buf, 0, inline_size); ext4_set_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA); }