From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3537C4332F for ; Mon, 7 Mar 2022 09:23:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236655AbiCGJYS (ORCPT ); Mon, 7 Mar 2022 04:24:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50300 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236886AbiCGJXJ (ORCPT ); Mon, 7 Mar 2022 04:23:09 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9E50A66FB9; Mon, 7 Mar 2022 01:21:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2876361073; Mon, 7 Mar 2022 09:21:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D2F0C340E9; Mon, 7 Mar 2022 09:21:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644879; bh=wT/OAu37EqYZIJyAlH+JSI0vsA40Aomyp+lsmvaj4WE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=clRG4Mr8lo+H6FK6ILYGY+Ytbod9yGOcN2k85nhAUw7FMv1Nfrram29EM5UL94ZuP jqUfkyboNtiJ+BhIiZOKE0zujSol5E9lSnmE4DPpSLYNjPc8hlRdfhcxND1KFqQzb+ vrUXzN7hkThzWrdwUXgEMpJc/ZtZmyiQenRv+/Js= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Benjamin Beichler , Johannes Berg , Sasha Levin Subject: [PATCH 4.14 01/42] mac80211_hwsim: report NOACK frames in tx_status Date: Mon, 7 Mar 2022 10:18:35 +0100 Message-Id: <20220307091636.190343061@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Benjamin Beichler [ Upstream commit 42a79960ffa50bfe9e0bf5d6280be89bf563a5dd ] Add IEEE80211_TX_STAT_NOACK_TRANSMITTED to tx_status flags to have proper statistics for non-acked frames. Signed-off-by: Benjamin Beichler Link: https://lore.kernel.org/r/20220111221327.1499881-1-benjamin.beichler@= uni-rostock.de Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- drivers/net/wireless/mac80211_hwsim.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/m= ac80211_hwsim.c index a8ec5b2c5abb3..b19d19c4be272 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -2983,6 +2983,10 @@ static int hwsim_tx_info_frame_received_nl(struct sk= _buff *skb_2, } txi->flags |=3D IEEE80211_TX_STAT_ACK; } + + if (hwsim_flags & HWSIM_TX_CTL_NO_ACK) + txi->flags |=3D IEEE80211_TX_STAT_NOACK_TRANSMITTED; + ieee80211_tx_status_irqsafe(data2->hw, skb); return 0; out: --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54B1DC433F5 for ; Mon, 7 Mar 2022 09:26:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237062AbiCGJ1N (ORCPT ); Mon, 7 Mar 2022 04:27:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52472 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237143AbiCGJX1 (ORCPT ); Mon, 7 Mar 2022 04:23:27 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 67A81674F0; Mon, 7 Mar 2022 01:21:55 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 09A40B81054; Mon, 7 Mar 2022 09:21:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 49482C340E9; Mon, 7 Mar 2022 09:21:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644912; bh=UgKQ9cNGkty3xwnvfNTkiGfr/Fg+lnlS4rwHrsaA3To=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=s27szqTzWomqTfZziKFlAR8Ot9qLkg1HNoUtfe89g2e/TYkBQtkPshalKHA2V0+4M y9wkzXlgjsUhUrmX5uQQdDZQ88d2maR6iG8v8AkHT38K4JNJiWeZ9Nt7LJAaeshG7y kYigk6+6/KJ+mhJjmSy0ZyoFGJR+/mmXJ/25oeL0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, JaeMan Park , Johannes Berg , Sasha Levin Subject: [PATCH 4.14 02/42] mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work Date: Mon, 7 Mar 2022 10:18:36 +0100 Message-Id: <20220307091636.219436504@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: JaeMan Park [ Upstream commit cacfddf82baf1470e5741edeecb187260868f195 ] In mac80211_hwsim, the probe_req frame is created and sent while scanning. It is sent with ieee80211_tx_info which is not initialized. Uninitialized ieee80211_tx_info can cause problems when using mac80211_hwsim with wmediumd. wmediumd checks the tx_rates field of ieee80211_tx_info and doesn't relay probe_req frame to other clients even if it is a broadcasting message. Call ieee80211_tx_prepare_skb() to initialize ieee80211_tx_info for the probe_req that is created by hw_scan_work in mac80211_hwsim. Signed-off-by: JaeMan Park Link: https://lore.kernel.org/r/20220113060235.546107-1-jaeman@google.com [fix memory leak] Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- drivers/net/wireless/mac80211_hwsim.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/m= ac80211_hwsim.c index b19d19c4be272..ee1eb14ae8fc9 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -2025,6 +2025,15 @@ static void hw_scan_work(struct work_struct *work) if (req->ie_len) skb_put_data(probe, req->ie, req->ie_len); =20 + if (!ieee80211_tx_prepare_skb(hwsim->hw, + hwsim->hw_scan_vif, + probe, + hwsim->tmp_chan->band, + NULL)) { + kfree_skb(probe); + continue; + } + local_bh_disable(); mac80211_hwsim_tx_frame(hwsim->hw, probe, hwsim->tmp_chan); --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A919C433EF for ; Mon, 7 Mar 2022 09:24:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236782AbiCGJZB (ORCPT ); Mon, 7 Mar 2022 04:25:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52610 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237171AbiCGJX3 (ORCPT ); Mon, 7 Mar 2022 04:23:29 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1FF4551327; Mon, 7 Mar 2022 01:22:01 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D9367B810BC; Mon, 7 Mar 2022 09:21:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 524E1C340E9; Mon, 7 Mar 2022 09:21:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644918; bh=p3NpOOloCl+up0CATJ/0J6lmGf3pYfYwJI3ux1MhqfE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IoftWsXUwxzLimZdYJC4r9IZ1Dp7TqXZaMGhd+jT4NEZpxLnAsLnXPbOVr3b5WoD8 WczGHKkCOZXyJ80xRocgnquHJmuFwGVzGnK9keUqjyEwKJkG9r6qgZGCdKPoWj/H6J v/KHBGKHqz1eJ8SRAuY6UUe3/n5EzmBFQ3lKfRaA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Anholt , Stefan Wahren , Wolfram Sang , Sasha Levin Subject: [PATCH 4.14 03/42] i2c: bcm2835: Avoid clock stretching timeouts Date: Mon, 7 Mar 2022 10:18:37 +0100 Message-Id: <20220307091636.248501558@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Anholt [ Upstream commit 9495b9b31abe525ebd93da58de2c88b9f66d3a0e ] The CLKT register contains at poweron 0x40, which at our typical 100kHz bus rate means .64ms. But there is no specified limit to how long devices should be able to stretch the clocks, so just disable the timeout. We still have a timeout wrapping the entire transfer. Signed-off-by: Eric Anholt Signed-off-by: Stefan Wahren BugLink: https://github.com/raspberrypi/linux/issues/3064 Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- drivers/i2c/busses/i2c-bcm2835.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2= 835.c index 4d19254f78c8a..db1ab9ccc30e7 100644 --- a/drivers/i2c/busses/i2c-bcm2835.c +++ b/drivers/i2c/busses/i2c-bcm2835.c @@ -28,6 +28,11 @@ #define BCM2835_I2C_FIFO 0x10 #define BCM2835_I2C_DIV 0x14 #define BCM2835_I2C_DEL 0x18 +/* + * 16-bit field for the number of SCL cycles to wait after rising SCL + * before deciding the slave is not responding. 0 disables the + * timeout detection. + */ #define BCM2835_I2C_CLKT 0x1c =20 #define BCM2835_I2C_C_READ BIT(0) @@ -398,6 +403,12 @@ static int bcm2835_i2c_probe(struct platform_device *p= dev) adap->dev.of_node =3D pdev->dev.of_node; adap->quirks =3D &bcm2835_i2c_quirks; =20 + /* + * Disable the hardware clock stretching timeout. SMBUS + * specifies a limit for how long the device can stretch the + * clock, but core I2C doesn't. + */ + bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_CLKT, 0); bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, 0); =20 ret =3D i2c_add_adapter(adap); --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E14BC433FE for ; Mon, 7 Mar 2022 09:24:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236705AbiCGJZE (ORCPT ); Mon, 7 Mar 2022 04:25:04 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50370 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237196AbiCGJXa (ORCPT ); Mon, 7 Mar 2022 04:23:30 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 45CDD522C6; Mon, 7 Mar 2022 01:22:04 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D8544B810C5; Mon, 7 Mar 2022 09:22:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D099C340E9; Mon, 7 Mar 2022 09:22:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644921; bh=YcUfRZgWEGpn1g4IoP0l5BsEI6IBAvoQlVrFxmlIMIg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=T3itxYFMs5u56QAyiDW2/yd/C6vQJO/RbflT4EEa6qCFzKcRyvMi+CGMa5hhIh+J3 QflWWYnrtIVHf4X0K2/oSvrde9sWT8HeGlS8nu7FABC4P2Not9Rd05e0DwPMXaz4Ap VKyqtvLFg+/isI1WqgXJ3l/NcMHccMaMqYd1Qx5w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peter Hutterer , Benjamin Tissoires , Jiri Kosina , =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= , Dmitry Torokhov , Sasha Levin Subject: [PATCH 4.14 04/42] Input: clear BTN_RIGHT/MIDDLE on buttonpads Date: Mon, 7 Mar 2022 10:18:38 +0100 Message-Id: <20220307091636.276904052@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jos=C3=A9 Exp=C3=B3sito [ Upstream commit 37ef4c19b4c659926ce65a7ac709ceaefb211c40 ] Buttonpads are expected to map the INPUT_PROP_BUTTONPAD property bit and the BTN_LEFT key bit. As explained in the specification, where a device has a button type value of 0 (click-pad) or 1 (pressure-pad) there should not be discrete buttons: https://docs.microsoft.com/en-us/windows-hardware/design/component-guidelin= es/touchpad-windows-precision-touchpad-collection#device-capabilities-featu= re-report However, some drivers map the BTN_RIGHT and/or BTN_MIDDLE key bits even though the device is a buttonpad and therefore does not have those buttons. This behavior has forced userspace applications like libinput to implement different workarounds and quirks to detect buttonpads and offer to the user the right set of features and configuration options. For more information: https://gitlab.freedesktop.org/libinput/libinput/-/merge_requests/726 In order to avoid this issue clear the BTN_RIGHT and BTN_MIDDLE key bits when the input device is register if the INPUT_PROP_BUTTONPAD property bit is set. Notice that this change will not affect udev because it does not check for buttons. See systemd/src/udev/udev-builtin-input_id.c. List of known affected hardware: - Chuwi AeroBook Plus - Chuwi Gemibook - Framework Laptop - GPD Win Max - Huawei MateBook 2020 - Prestigio Smartbook 141 C2 - Purism Librem 14v1 - StarLite Mk II - AMI firmware - StarLite Mk II - Coreboot firmware - StarLite Mk III - AMI firmware - StarLite Mk III - Coreboot firmware - StarLabTop Mk IV - AMI firmware - StarLabTop Mk IV - Coreboot firmware - StarBook Mk V Acked-by: Peter Hutterer Acked-by: Benjamin Tissoires Acked-by: Jiri Kosina Signed-off-by: Jos=C3=A9 Exp=C3=B3sito Link: https://lore.kernel.org/r/20220208174806.17183-1-jose.exposito89@gmai= l.com Signed-off-by: Dmitry Torokhov Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- drivers/input/input.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/input/input.c b/drivers/input/input.c index cadb368be8eff..cb8ff919ba82b 100644 --- a/drivers/input/input.c +++ b/drivers/input/input.c @@ -2120,6 +2120,12 @@ int input_register_device(struct input_dev *dev) /* KEY_RESERVED is not supposed to be transmitted to userspace. */ __clear_bit(KEY_RESERVED, dev->keybit); =20 + /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */ + if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) { + __clear_bit(BTN_RIGHT, dev->keybit); + __clear_bit(BTN_MIDDLE, dev->keybit); + } + /* Make sure that bitmasks not mentioned in dev->evbit are clean. */ input_cleanse_bitmasks(dev); =20 --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 91C5DC433EF for ; Mon, 7 Mar 2022 09:26:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237022AbiCGJ0x (ORCPT ); Mon, 7 Mar 2022 04:26:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52358 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237206AbiCGJXc (ORCPT ); Mon, 7 Mar 2022 04:23:32 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 496D152E21; Mon, 7 Mar 2022 01:22:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DFB93B81054; Mon, 7 Mar 2022 09:22:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E89BC340F3; Mon, 7 Mar 2022 09:22:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644924; bh=N2eSg4cBpi7JwxNmSliSC4Pe8EBDIBV8CNUL9/bYicI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z/8rF6npHyfMziy9t0b269kgI8nxUGZ2kpXtyikmyjLOQa4mbUbWk9Bqp/OWZxRcJ 28J6pnA+AGs47myQINp5cEjVrZLKu/89QqBfDPVVYMDy7aalRIl0Q3OzyHk/q3bYKd WgpO9QbBr0JNdS2u+fen+cTymO6+iA3cwgAfilZY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shyam Prasad N , Ronnie Sahlberg , Steve French , Sasha Levin Subject: [PATCH 4.14 05/42] cifs: fix double free race when mount fails in cifs_get_root() Date: Mon, 7 Mar 2022 10:18:39 +0100 Message-Id: <20220307091636.306297212@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ronnie Sahlberg [ Upstream commit 3d6cc9898efdfb062efb74dc18cfc700e082f5d5 ] When cifs_get_root() fails during cifs_smb3_do_mount() we call deactivate_locked_super() which eventually will call delayed_free() which will free the context. In this situation we should not proceed to enter the out: section in cifs_smb3_do_mount() and free the same resources a second time. [Thu Feb 10 12:59:06 2022] BUG: KASAN: use-after-free in rcu_cblist_dequeue= +0x32/0x60 [Thu Feb 10 12:59:06 2022] Read of size 8 at addr ffff888364f4d110 by task = swapper/1/0 [Thu Feb 10 12:59:06 2022] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G = OE 5.17.0-rc3+ #4 [Thu Feb 10 12:59:06 2022] Hardware name: Microsoft Corporation Virtual Mac= hine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019 [Thu Feb 10 12:59:06 2022] Call Trace: [Thu Feb 10 12:59:06 2022] [Thu Feb 10 12:59:06 2022] dump_stack_lvl+0x5d/0x78 [Thu Feb 10 12:59:06 2022] print_address_description.constprop.0+0x24/0x150 [Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] kasan_report.cold+0x7d/0x117 [Thu Feb 10 12:59:06 2022] ? rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] __asan_load8+0x86/0xa0 [Thu Feb 10 12:59:06 2022] rcu_cblist_dequeue+0x32/0x60 [Thu Feb 10 12:59:06 2022] rcu_core+0x547/0xca0 [Thu Feb 10 12:59:06 2022] ? call_rcu+0x3c0/0x3c0 [Thu Feb 10 12:59:06 2022] ? __this_cpu_preempt_check+0x13/0x20 [Thu Feb 10 12:59:06 2022] ? lock_is_held_type+0xea/0x140 [Thu Feb 10 12:59:06 2022] rcu_core_si+0xe/0x10 [Thu Feb 10 12:59:06 2022] __do_softirq+0x1d4/0x67b [Thu Feb 10 12:59:06 2022] __irq_exit_rcu+0x100/0x150 [Thu Feb 10 12:59:06 2022] irq_exit_rcu+0xe/0x30 [Thu Feb 10 12:59:06 2022] sysvec_hyperv_stimer0+0x9d/0xc0 ... [Thu Feb 10 12:59:07 2022] Freed by task 58179: [Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50 [Thu Feb 10 12:59:07 2022] kasan_set_track+0x25/0x30 [Thu Feb 10 12:59:07 2022] kasan_set_free_info+0x24/0x40 [Thu Feb 10 12:59:07 2022] ____kasan_slab_free+0x137/0x170 [Thu Feb 10 12:59:07 2022] __kasan_slab_free+0x12/0x20 [Thu Feb 10 12:59:07 2022] slab_free_freelist_hook+0xb3/0x1d0 [Thu Feb 10 12:59:07 2022] kfree+0xcd/0x520 [Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0x149/0xbe0 [cifs] [Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs] [Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140 [Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0 [Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210 [Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0 [Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae [Thu Feb 10 12:59:07 2022] Last potentially related work creation: [Thu Feb 10 12:59:07 2022] kasan_save_stack+0x26/0x50 [Thu Feb 10 12:59:07 2022] __kasan_record_aux_stack+0xb6/0xc0 [Thu Feb 10 12:59:07 2022] kasan_record_aux_stack_noalloc+0xb/0x10 [Thu Feb 10 12:59:07 2022] call_rcu+0x76/0x3c0 [Thu Feb 10 12:59:07 2022] cifs_umount+0xce/0xe0 [cifs] [Thu Feb 10 12:59:07 2022] cifs_kill_sb+0xc8/0xe0 [cifs] [Thu Feb 10 12:59:07 2022] deactivate_locked_super+0x5d/0xd0 [Thu Feb 10 12:59:07 2022] cifs_smb3_do_mount+0xab9/0xbe0 [cifs] [Thu Feb 10 12:59:07 2022] smb3_get_tree+0x1a0/0x2e0 [cifs] [Thu Feb 10 12:59:07 2022] vfs_get_tree+0x52/0x140 [Thu Feb 10 12:59:07 2022] path_mount+0x635/0x10c0 [Thu Feb 10 12:59:07 2022] __x64_sys_mount+0x1bf/0x210 [Thu Feb 10 12:59:07 2022] do_syscall_64+0x5c/0xc0 [Thu Feb 10 12:59:07 2022] entry_SYSCALL_64_after_hwframe+0x44/0xae Reported-by: Shyam Prasad N Reviewed-by: Shyam Prasad N Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- fs/cifs/cifsfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c index 74f405a05efc3..dba0d12c3db19 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -753,6 +753,7 @@ cifs_do_mount(struct file_system_type *fs_type, =20 out_super: deactivate_locked_super(sb); + return root; out: cifs_cleanup_volume_info(volume_info); return root; --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63D98C4332F for ; Mon, 7 Mar 2022 09:24:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236772AbiCGJY5 (ORCPT ); Mon, 7 Mar 2022 04:24:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52656 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237218AbiCGJXe (ORCPT ); Mon, 7 Mar 2022 04:23:34 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EB34553702; Mon, 7 Mar 2022 01:22:09 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AE336B810C3; Mon, 7 Mar 2022 09:22:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21ACBC340E9; Mon, 7 Mar 2022 09:22:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644927; bh=z26jdcz8ETQiT0yMjJkEpAN2tFFILIDjhzcZj/5HSQU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VfarMTS+Rb2OMsXAMoQ6IS7KdDAZJxaPt3tYfOTUGExexJpc6vydk+24zzxFpfOPh abOoIpp+EeJsNnKfpr8RQ6+RfxwVyB08NUjD/whzFKnm//0b7RoiNmC+MvSvxpgCfE BioIQ1eeX7UUw/RB34z8vg1CCpkbCGjdoFVjLOvc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yongzhi Liu , Vinod Koul , Sasha Levin Subject: [PATCH 4.14 06/42] dmaengine: shdma: Fix runtime PM imbalance on error Date: Mon, 7 Mar 2022 10:18:40 +0100 Message-Id: <20220307091636.335953428@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yongzhi Liu [ Upstream commit 455896c53d5b803733ddd84e1bf8a430644439b6 ] pm_runtime_get_() increments the runtime PM usage counter even when it returns an error code, thus a matching decrement is needed on the error handling path to keep the counter balanced. Signed-off-by: Yongzhi Liu Link: https://lore.kernel.org/r/1642311296-87020-1-git-send-email-lyz_cs@pk= u.edu.cn Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- drivers/dma/sh/shdma-base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c index 12fa48e380cf5..4f8dfe77da3c5 100644 --- a/drivers/dma/sh/shdma-base.c +++ b/drivers/dma/sh/shdma-base.c @@ -118,8 +118,10 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_t= x_descriptor *tx) ret =3D pm_runtime_get(schan->dev); =20 spin_unlock_irq(&schan->chan_lock); - if (ret < 0) + if (ret < 0) { dev_err(schan->dev, "%s(): GET =3D %d\n", __func__, ret); + pm_runtime_put(schan->dev); + } =20 pm_runtime_barrier(schan->dev); =20 --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7710CC433FE for ; Mon, 7 Mar 2022 09:26:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236991AbiCGJ1C (ORCPT ); Mon, 7 Mar 2022 04:27:02 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52512 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237239AbiCGJXf (ORCPT ); Mon, 7 Mar 2022 04:23:35 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 830CF53E2F; Mon, 7 Mar 2022 01:22:11 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0F1A56103D; Mon, 7 Mar 2022 09:22:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0451CC340E9; Mon, 7 Mar 2022 09:22:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644930; bh=94F1j0DiZ7qJpTyWsfI+MmjhV156Q0ciHj/koAEnTgk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1r7a3Y32YbpL5/NHS62mQLjOnlcGl5PgkhWEVnASBu3Uqn3OmQQ3WwCXAdBzvuuMP GyMtwb0vC7v+qea3oXW7tu1ONlBD8YI4TZB6jFwb7utQ1+yI4HXHQ14MlSO9wQ5TQO l62vcutigLZi1qPKf6SsEKAnUep0dDODSjfhEIVk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wolfram Sang , Michal Simek , Sasha Levin Subject: [PATCH 4.14 07/42] i2c: cadence: allow COMPILE_TEST Date: Mon, 7 Mar 2022 10:18:41 +0100 Message-Id: <20220307091636.364610917@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wolfram Sang [ Upstream commit 0b0dcb3882c8f08bdeafa03adb4487e104d26050 ] Driver builds fine with COMPILE_TEST. Enable it for wider test coverage and easier maintenance. Signed-off-by: Wolfram Sang Acked-by: Michal Simek Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- drivers/i2c/busses/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig index c457f65136f83..ab9c7f2f1f79b 100644 --- a/drivers/i2c/busses/Kconfig +++ b/drivers/i2c/busses/Kconfig @@ -459,7 +459,7 @@ config I2C_BLACKFIN_TWI_CLK_KHZ =20 config I2C_CADENCE tristate "Cadence I2C Controller" - depends on ARCH_ZYNQ || ARM64 || XTENSA + depends on ARCH_ZYNQ || ARM64 || XTENSA || COMPILE_TEST help Say yes here to select Cadence I2C Host Controller. This controller is e.g. used by Xilinx Zynq. --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7485EC433FE for ; Mon, 7 Mar 2022 09:25:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236846AbiCGJ0h (ORCPT ); Mon, 7 Mar 2022 04:26:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52402 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237265AbiCGJXh (ORCPT ); Mon, 7 Mar 2022 04:23:37 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D1696522C5; Mon, 7 Mar 2022 01:22:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8CD4AB810BC; Mon, 7 Mar 2022 09:22:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D684DC340F3; Mon, 7 Mar 2022 09:22:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644933; bh=nB+IriusxrNw8RVnFBG5j8tEtcqp3hdPm/KX5tASSSg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yR77wSL7yJFXtVrXe96j8lVscRYPDxbW6HU7O47ICZr0NTDUzoymNsTmzWISKn/+K kiOC/MJ/vRtBU4neQ767UO1U/lx0yXOn8/HFSeoXoc6g7c6YRKCTwoHGjyiZBwiQxk LdwiqhHR71qGxuNtUbBLq4N495gvSRgEE9+I0ELE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wolfram Sang , Sasha Levin Subject: [PATCH 4.14 08/42] i2c: qup: allow COMPILE_TEST Date: Mon, 7 Mar 2022 10:18:42 +0100 Message-Id: <20220307091636.393518294@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wolfram Sang [ Upstream commit 5de717974005fcad2502281e9f82e139ca91f4bb ] Driver builds fine with COMPILE_TEST. Enable it for wider test coverage and easier maintenance. Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- drivers/i2c/busses/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig index ab9c7f2f1f79b..2619f1dc095aa 100644 --- a/drivers/i2c/busses/Kconfig +++ b/drivers/i2c/busses/Kconfig @@ -836,7 +836,7 @@ config I2C_PXA_SLAVE =20 config I2C_QUP tristate "Qualcomm QUP based I2C controller" - depends on ARCH_QCOM + depends on ARCH_QCOM || COMPILE_TEST help If you say yes to this option, support will be included for the built-in I2C interface on the Qualcomm SoCs. --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90BD4C433EF for ; Mon, 7 Mar 2022 09:24:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236693AbiCGJZO (ORCPT ); Mon, 7 Mar 2022 04:25:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53024 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237271AbiCGJXi (ORCPT ); Mon, 7 Mar 2022 04:23:38 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3E489541AA; Mon, 7 Mar 2022 01:22:17 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AE31761027; Mon, 7 Mar 2022 09:22:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BDF13C340F4; Mon, 7 Mar 2022 09:22:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644936; bh=VKj7xlrRFbcxioWHBRFh2u0Z7Dc86o9b0hoFi2dJGaI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pAjnhV4eIOiOt3IQtWfq49BPuSdkOT1RwCfJHcjGjOpKYldtlSzXybwGhNNDmkn1j rMjzXUWrT42lKvM4wxMPS7gET1SPUlzQsVcUEevQX8TVrVgibFizCiwZJAjLVhbtmA MlWmJy+kwDmW+0snbQIbM4tTRoINoo9DdBFUaC/o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniele Palmas , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 09/42] net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 Date: Mon, 7 Mar 2022 10:18:43 +0100 Message-Id: <20220307091636.422467160@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniele Palmas [ Upstream commit 21e8a96377e6b6debae42164605bf9dcbe5720c5 ] Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit FN990 0x1071 composition in order to avoid bind error. Signed-off-by: Daniele Palmas Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- drivers/net/usb/cdc_mbim.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c index cdd1b193fd4fe..41bac861ca99d 100644 --- a/drivers/net/usb/cdc_mbim.c +++ b/drivers/net/usb/cdc_mbim.c @@ -660,6 +660,11 @@ static const struct usb_device_id mbim_devs[] =3D { .driver_info =3D (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, }, =20 + /* Telit FN990 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1071, USB_CLASS_COMM, USB_CDC_S= UBCLASS_MBIM, USB_CDC_PROTO_NONE), + .driver_info =3D (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, + }, + /* default entry */ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO= _NONE), .driver_info =3D (unsigned long)&cdc_mbim_info_zlp, --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9E90C433F5 for ; Mon, 7 Mar 2022 09:26:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237050AbiCGJ1H (ORCPT ); Mon, 7 Mar 2022 04:27:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52636 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236918AbiCGJXL (ORCPT ); Mon, 7 Mar 2022 04:23:11 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 606D865794; Mon, 7 Mar 2022 01:21:25 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 154F6B810BC; Mon, 7 Mar 2022 09:21:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 622ECC340E9; Mon, 7 Mar 2022 09:21:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644882; bh=rEQmAFSM5skYf2Cxsh8HavJvc5jurQZGsLq/sl+SbUI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z8uuX6T/vCWB9HZim4GRQs/PMf2LoH4j1ZZZL8cAOoiHvu23CcZFHTNYi7sQlNtIY ogaUhdRaKtLq/Yvh6pv9UYWuZXz2wmwt3qbBOFVYRsVzNi6ZMeZIjJjdv1bnuwH61h Sq0cl3eFO61Ya/86386HiwxP3DpLPc29cUCp+WnA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Hangyu Hua Subject: [PATCH 4.14 10/42] usb: gadget: dont release an existing dev->buf Date: Mon, 7 Mar 2022 10:18:44 +0100 Message-Id: <20220307091636.450594266@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua commit 89f3594d0de58e8a57d92d497dea9fee3d4b9cda upstream. dev->buf does not need to be released if it already exists before executing dev_config. Acked-by: Alan Stern Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20211231172138.7993-2-hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/usb/gadget/legacy/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1833,8 +1833,9 @@ dev_config (struct file *fd, const char spin_lock_irq (&dev->lock); value =3D -EINVAL; if (dev->buf) { + spin_unlock_irq(&dev->lock); kfree(kbuf); - goto fail; + return value; } dev->buf =3D kbuf; From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ACD0CC433EF for ; Mon, 7 Mar 2022 09:25:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236905AbiCGJ0H (ORCPT ); Mon, 7 Mar 2022 04:26:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52656 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236950AbiCGJXP (ORCPT ); Mon, 7 Mar 2022 04:23:15 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8343865830; Mon, 7 Mar 2022 01:21:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3D470B810BD; Mon, 7 Mar 2022 09:21:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B826C340F5; Mon, 7 Mar 2022 09:21:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644885; bh=0Q2WVn2wAh2H+CtyxAHWdQFdZ4PNcyjRU4u5dhDfKhU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oFlIO2VGTvSeTK6qui5Ra5ww1tkxwwLO8pgmr7HnUxM4nwdZTadfT/YqOzUmgv/eI HYtwWpwz/OnMjOdlHCGh9fDy/u4ryRZXjdOJAgz2/6Q1iAK1UscS6ExarhQyR9LRop mO51fuXefVgwmLZkOs0+18OqIUIJXVgSmZm6fJk4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Hangyu Hua Subject: [PATCH 4.14 11/42] usb: gadget: clear related members when goto fail Date: Mon, 7 Mar 2022 10:18:45 +0100 Message-Id: <20220307091636.478364799@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua commit 501e38a5531efbd77d5c73c0ba838a889bfc1d74 upstream. dev->config and dev->hs_config and dev->dev need to be cleaned if dev_config fails to avoid UAF. Acked-by: Alan Stern Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20211231172138.7993-3-hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/usb/gadget/legacy/inode.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1882,8 +1882,8 @@ dev_config (struct file *fd, const char =20 value =3D usb_gadget_probe_driver(&gadgetfs_driver); if (value !=3D 0) { - kfree (dev->buf); - dev->buf =3D NULL; + spin_lock_irq(&dev->lock); + goto fail; } else { /* at this point "good" hardware has for the first time * let the USB the host see us. alternatively, if users @@ -1900,6 +1900,9 @@ dev_config (struct file *fd, const char return value; =20 fail: + dev->config =3D NULL; + dev->hs_config =3D NULL; + dev->dev =3D NULL; spin_unlock_irq (&dev->lock); pr_debug ("%s: %s fail %zd, %p\n", shortname, __func__, value, dev); kfree (dev->buf); From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9EE93C433EF for ; Mon, 7 Mar 2022 09:25:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236783AbiCGJ03 (ORCPT ); Mon, 7 Mar 2022 04:26:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52670 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236951AbiCGJXP (ORCPT ); Mon, 7 Mar 2022 04:23:15 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 043CA65D3D; Mon, 7 Mar 2022 01:21:29 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7E0F1610A3; Mon, 7 Mar 2022 09:21:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 79A42C340F3; Mon, 7 Mar 2022 09:21:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644888; bh=8r8xQxUYIAElm/cXRBDz/i3qLnpZQ+9y3zYzdXn6jMU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m+t2ldCZwxVAAz3L2s1S6mqsPqmbXt7yYS5/WaYiNAt5Fqony5Yi6PvC5tNfqejQd XtkiutdvoVSGdUGwfadydAKAjzY2SHiZd0Ioa1YDI7zqaSqljmfyeLUB5UAFFNgWs9 z48g9c5P1d+8xWE6ONbjTxACDjr7X6x8erHiyt74= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Damien Le Moal , Sasha Levin Subject: [PATCH 4.14 12/42] ata: pata_hpt37x: fix PCI clock detection Date: Mon, 7 Mar 2022 10:18:46 +0100 Message-Id: <20220307091636.507674209@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sergey Shtylyov [ Upstream commit 5f6b0f2d037c8864f20ff15311c695f65eb09db5 ] The f_CNT register (at the PCI config. address 0x78) is 16-bit, not 8-bit! The bug was there from the very start... :-( Signed-off-by: Sergey Shtylyov Fixes: 669a5db411d8 ("[libata] Add a bunch of PATA drivers.") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- drivers/ata/pata_hpt37x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c index 821fc1f2324c8..44cc02afaa8bd 100644 --- a/drivers/ata/pata_hpt37x.c +++ b/drivers/ata/pata_hpt37x.c @@ -964,14 +964,14 @@ static int hpt37x_init_one(struct pci_dev *dev, const= struct pci_device_id *id) =20 if ((freq >> 12) !=3D 0xABCDE) { int i; - u8 sr; + u16 sr; u32 total =3D 0; =20 pr_warn("BIOS has not set timing clocks\n"); =20 /* This is the process the HPT371 BIOS is reported to use */ for (i =3D 0; i < 128; i++) { - pci_read_config_byte(dev, 0x78, &sr); + pci_read_config_word(dev, 0x78, &sr); total +=3D sr & 0x1FF; udelay(15); } --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A72DDC433F5 for ; Mon, 7 Mar 2022 09:24:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236721AbiCGJZt (ORCPT ); Mon, 7 Mar 2022 04:25:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50420 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236954AbiCGJXP (ORCPT ); Mon, 7 Mar 2022 04:23:15 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3477366FAD; Mon, 7 Mar 2022 01:21:33 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BA13361073; Mon, 7 Mar 2022 09:21:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A60B7C340F3; Mon, 7 Mar 2022 09:21:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644892; bh=IENnOzCQlJp+UBCrUtJmV2Qib/MihkklYG372lOJDsY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yc7a62zEZJwo29iOfi+jJwqSH5MfKJLLsYeG0VOFDv2ABCUKhYtXsmcUt26nfCS/r WtrRwhRIJUMNQb/AJVdDQdzAMUq//HIFa2pG4awTdHK32+XJPxckjyjSZSOdasKxpW 2LvptpIKJUJc5BWZkK5wWjlN2mLKfcHszJYJHcdI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhen Ni , Takashi Iwai Subject: [PATCH 4.14 13/42] ALSA: intel_hdmi: Fix reference to PCM buffer address Date: Mon, 7 Mar 2022 10:18:47 +0100 Message-Id: <20220307091636.537139158@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhen Ni commit 0aa6b294b312d9710804679abd2c0c8ca52cc2bc upstream. PCM buffers might be allocated dynamically when the buffer preallocation failed or a larger buffer is requested, and it's not guaranteed that substream->dma_buffer points to the actually used buffer. The driver needs to refer to substream->runtime->dma_addr instead for the buffer address. Signed-off-by: Zhen Ni Cc: Link: https://lore.kernel.org/r/20220302074241.30469-1-nizhen@uniontech.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- sound/x86/intel_hdmi_audio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/x86/intel_hdmi_audio.c +++ b/sound/x86/intel_hdmi_audio.c @@ -1308,7 +1308,7 @@ static int had_pcm_mmap(struct snd_pcm_s { vma->vm_page_prot =3D pgprot_noncached(vma->vm_page_prot); return remap_pfn_range(vma, vma->vm_start, - substream->dma_buffer.addr >> PAGE_SHIFT, + substream->runtime->dma_addr >> PAGE_SHIFT, vma->vm_end - vma->vm_start, vma->vm_page_prot); } From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B680FC4167B for ; Mon, 7 Mar 2022 09:23:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236666AbiCGJYV (ORCPT ); Mon, 7 Mar 2022 04:24:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50270 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237002AbiCGJXR (ORCPT ); Mon, 7 Mar 2022 04:23:17 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B7944673FE; Mon, 7 Mar 2022 01:21:37 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7113AB810BC; Mon, 7 Mar 2022 09:21:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA493C340E9; Mon, 7 Mar 2022 09:21:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644895; bh=FiohOt7NoQYLxo5ix/ERErfoSi8NWtSUiMdB3zj+G9Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TzUVpcfCxhpRKiRBd8h6WNDE0QZpV1O+3g3J+ujfM1pvt7x+RNuwGB0Z0447+DMys Vsds+bSVeKchDK1Zdvs9fSFCBXP7v2VnaswPNGneAHgvRG20tObYItnAVDzfwAqGZV Z3AyH00aDsJXOp8aS/edlvwpHmQPnXYkfWEWKSKQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marek Vasut , Mark Brown Subject: [PATCH 4.14 14/42] ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min Date: Mon, 7 Mar 2022 10:18:48 +0100 Message-Id: <20220307091636.565053278@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marek Vasut commit 9bdd10d57a8807dba0003af0325191f3cec0f11c upstream. While the $val/$val2 values passed in from userspace are always >=3D 0 integers, the limits of the control can be signed integers and the $min can be non-zero and less than zero. To correctly validate $val/$val2 against platform_max, add the $min offset to val first. Fixes: 817f7c9335ec0 ("ASoC: ops: Reject out of bounds values in snd_soc_pu= t_volsw()") Signed-off-by: Marek Vasut Cc: Mark Brown Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220215130645.164025-1-marex@denx.de Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- sound/soc/soc-ops.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/sound/soc/soc-ops.c +++ b/sound/soc/soc-ops.c @@ -328,7 +328,7 @@ int snd_soc_put_volsw(struct snd_kcontro mask =3D BIT(sign_bit + 1) - 1; =20 val =3D ucontrol->value.integer.value[0]; - if (mc->platform_max && val > mc->platform_max) + if (mc->platform_max && ((int)val + min) > mc->platform_max) return -EINVAL; if (val > max - min) return -EINVAL; @@ -341,7 +341,7 @@ int snd_soc_put_volsw(struct snd_kcontro val =3D val << shift; if (snd_soc_volsw_is_stereo(mc)) { val2 =3D ucontrol->value.integer.value[1]; - if (mc->platform_max && val2 > mc->platform_max) + if (mc->platform_max && ((int)val2 + min) > mc->platform_max) return -EINVAL; if (val2 > max - min) return -EINVAL; From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EF518C433EF for ; Mon, 7 Mar 2022 09:24:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236845AbiCGJZo (ORCPT ); Mon, 7 Mar 2022 04:25:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53066 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237013AbiCGJXS (ORCPT ); Mon, 7 Mar 2022 04:23:18 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 37B2D66607; Mon, 7 Mar 2022 01:21:39 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9E90361015; Mon, 7 Mar 2022 09:21:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A7197C340E9; Mon, 7 Mar 2022 09:21:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644898; bh=fk3To6U2sEeYyO5t87ziffhXrEXeFLqFNumAxEt63ig=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MwtOd/9+GJLaFacQFi41cHK0vxJF/ri8GcP9B4e/5EURUib3ZHB2o9BUQ08oSTB2F UlyLhTz+HOp6CEB0b8JSGqgnc0j/gnRWxKAfLXS+xwDoKMIppu/4amvpXIUPMFxphk f1qokUMKk70wMr/XTHWDh68KE/xoROHwV4u9I+iQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiri Bohac , Steffen Klassert Subject: [PATCH 4.14 15/42] xfrm: fix MTU regression Date: Mon, 7 Mar 2022 10:18:49 +0100 Message-Id: <20220307091636.593984884@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiri Bohac commit 6596a0229541270fb8d38d989f91b78838e5e9da upstream. Commit 749439bfac6e1a2932c582e2699f91d329658196 ("ipv6: fix udpv6 sendmsg crash caused by too small MTU") breaks PMTU for xfrm. A Packet Too Big ICMPv6 message received in response to an ESP packet will prevent all further communication through the tunnel if the reported MTU minus the ESP overhead is smaller than 1280. E.g. in a case of a tunnel-mode ESP with sha256/aes the overhead is 92 bytes. Receiving a PTB with MTU of 1371 or less will result in all further packets in the tunnel dropped. A ping through the tunnel fails with "ping: sendmsg: Invalid argument". Apparently the MTU on the xfrm route is smaller than 1280 and fails the check inside ip6_setup_cork() added by 749439bf. We found this by debugging USGv6/ipv6ready failures. Failing tests are: "Phase-2 Interoperability Test Scenario IPsec" / 5.3.11 and 5.4.11 (Tunnel Mode: Fragmentation). Commit b515d2637276a3810d6595e10ab02c13bfd0b63a ("xfrm: xfrm_state_mtu should return at least 1280 for ipv6") attempted to fix this but caused another regression in TCP MSS calculations and had to be reverted. The patch below fixes the situation by dropping the MTU check and instead checking for the underflows described in the 749439bf commit message. Signed-off-by: Jiri Bohac Fixes: 749439bfac6e ("ipv6: fix udpv6 sendmsg crash caused by too small MTU= ") Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- net/ipv6/ip6_output.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1266,8 +1266,6 @@ static int ip6_setup_cork(struct sock *s if (np->frag_size) mtu =3D np->frag_size; } - if (mtu < IPV6_MIN_MTU) - return -EINVAL; cork->base.fragsize =3D mtu; if (dst_allfrag(rt->dst.path)) cork->base.flags |=3D IPCORK_ALLFRAG; @@ -1316,8 +1314,6 @@ static int __ip6_append_data(struct sock =20 fragheaderlen =3D sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len + (opt ? opt->opt_nflen : 0); - maxfraglen =3D ((mtu - fragheaderlen) & ~7) + fragheaderlen - - sizeof(struct frag_hdr); =20 headersize =3D sizeof(struct ipv6hdr) + (opt ? opt->opt_flen + opt->opt_nflen : 0) + @@ -1325,6 +1321,13 @@ static int __ip6_append_data(struct sock sizeof(struct frag_hdr) : 0) + rt->rt6i_nfheader_len; =20 + if (mtu < fragheaderlen || + ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr= )) + goto emsgsize; + + maxfraglen =3D ((mtu - fragheaderlen) & ~7) + fragheaderlen - + sizeof(struct frag_hdr); + /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit * the first fragment */ From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 591F2C433EF for ; Mon, 7 Mar 2022 09:24:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236741AbiCGJZ1 (ORCPT ); Mon, 7 Mar 2022 04:25:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52482 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237044AbiCGJXU (ORCPT ); Mon, 7 Mar 2022 04:23:20 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7B266527C7; Mon, 7 Mar 2022 01:21:43 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2ABB1B810B2; Mon, 7 Mar 2022 09:21:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6572CC340E9; Mon, 7 Mar 2022 09:21:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644900; bh=LDLbxVW01HG22SAbfX+zS+GmVV2jM0oTEeD1nau4TPE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zNg4HHEpNjoVBI4TN8DW2MyDg4cwK6RTH5LNX5dARZIXuJeI+TRaRR0K4u2ebQ+4Y 3J0xoazTsowvFLL4d/1X4jHdvwSHMYeX/ckdrAKVzhhMSb64C7gHnSSSn00s17Bm2z cKxIiwOdXeWq8T1cHbr7AehWgbytzB9bFkph4+tE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , Florian Westphal , Pablo Neira Ayuso Subject: [PATCH 4.14 16/42] netfilter: fix use-after-free in __nf_register_net_hook() Date: Mon, 7 Mar 2022 10:18:50 +0100 Message-Id: <20220307091636.623427323@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 56763f12b0f02706576a088e85ef856deacc98a0 upstream. We must not dereference @new_hooks after nf_hook_mutex has been released, because other threads might have freed our allocated hooks already. BUG: KASAN: use-after-free in nf_hook_entries_get_hook_ops include/linux/ne= tfilter.h:130 [inline] BUG: KASAN: use-after-free in hooks_validate net/netfilter/core.c:171 [inli= ne] BUG: KASAN: use-after-free in __nf_register_net_hook+0x77a/0x820 net/netfil= ter/core.c:438 Read of size 2 at addr ffff88801c1a8000 by task syz-executor237/4430 CPU: 1 PID: 4430 Comm: syz-executor237 Not tainted 5.17.0-rc5-syzkaller-003= 06-g2293be58d6a1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 nf_hook_entries_get_hook_ops include/linux/netfilter.h:130 [inline] hooks_validate net/netfilter/core.c:171 [inline] __nf_register_net_hook+0x77a/0x820 net/netfilter/core.c:438 nf_register_net_hook+0x114/0x170 net/netfilter/core.c:571 nf_register_net_hooks+0x59/0xc0 net/netfilter/core.c:587 nf_synproxy_ipv6_init+0x85/0xe0 net/netfilter/nf_synproxy_core.c:1218 synproxy_tg6_check+0x30d/0x560 net/ipv6/netfilter/ip6t_SYNPROXY.c:81 xt_check_target+0x26c/0x9e0 net/netfilter/x_tables.c:1038 check_target net/ipv6/netfilter/ip6_tables.c:530 [inline] find_check_entry.constprop.0+0x7f1/0x9e0 net/ipv6/netfilter/ip6_tables.c:5= 73 translate_table+0xc8b/0x1750 net/ipv6/netfilter/ip6_tables.c:735 do_replace net/ipv6/netfilter/ip6_tables.c:1153 [inline] do_ip6t_set_ctl+0x56e/0xb90 net/ipv6/netfilter/ip6_tables.c:1639 nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1024 rawv6_setsockopt+0xd3/0x6a0 net/ipv6/raw.c:1084 __sys_setsockopt+0x2db/0x610 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f65a1ace7d9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 71 15 00 00 90 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f65a1a7f308 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f65a1ace7d9 RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003 RBP: 00007f65a1b574c8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000020000000 R11: 0000000000000246 R12: 00007f65a1b55130 R13: 00007f65a1b574c0 R14: 00007f65a1b24090 R15: 0000000000022000 The buggy address belongs to the page: page:ffffea0000706a00 refcount:0 mapcount:0 mapping:0000000000000000 index:= 0x0 pfn:0x1c1a8 flags: 0xfff00000000000(node=3D0|zone=3D1|lastcpupid=3D0x7ff) raw: 00fff00000000000 ffffea0001c1b108 ffffea000046dd08 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52dc0(GF= P_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 4430, ts 10= 61781545818, free_ts 1061791488993 prep_new_page mm/page_alloc.c:2434 [inline] get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4165 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389 __alloc_pages_node include/linux/gfp.h:572 [inline] alloc_pages_node include/linux/gfp.h:595 [inline] kmalloc_large_node+0x62/0x130 mm/slub.c:4438 __kmalloc_node+0x35a/0x4a0 mm/slub.c:4454 kmalloc_node include/linux/slab.h:604 [inline] kvmalloc_node+0x97/0x100 mm/util.c:580 kvmalloc include/linux/slab.h:731 [inline] kvzalloc include/linux/slab.h:739 [inline] allocate_hook_entries_size net/netfilter/core.c:61 [inline] nf_hook_entries_grow+0x140/0x780 net/netfilter/core.c:128 __nf_register_net_hook+0x144/0x820 net/netfilter/core.c:429 nf_register_net_hook+0x114/0x170 net/netfilter/core.c:571 nf_register_net_hooks+0x59/0xc0 net/netfilter/core.c:587 nf_synproxy_ipv6_init+0x85/0xe0 net/netfilter/nf_synproxy_core.c:1218 synproxy_tg6_check+0x30d/0x560 net/ipv6/netfilter/ip6t_SYNPROXY.c:81 xt_check_target+0x26c/0x9e0 net/netfilter/x_tables.c:1038 check_target net/ipv6/netfilter/ip6_tables.c:530 [inline] find_check_entry.constprop.0+0x7f1/0x9e0 net/ipv6/netfilter/ip6_tables.c:5= 73 translate_table+0xc8b/0x1750 net/ipv6/netfilter/ip6_tables.c:735 do_replace net/ipv6/netfilter/ip6_tables.c:1153 [inline] do_ip6t_set_ctl+0x56e/0xb90 net/ipv6/netfilter/ip6_tables.c:1639 nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1352 [inline] free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1404 free_unref_page_prepare mm/page_alloc.c:3325 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3404 kvfree+0x42/0x50 mm/util.c:613 rcu_do_batch kernel/rcu/tree.c:2527 [inline] rcu_core+0x7b1/0x1820 kernel/rcu/tree.c:2778 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 Memory state around the buggy address: ffff88801c1a7f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88801c1a7f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88801c1a8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88801c1a8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88801c1a8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Fixes: 2420b79f8c18 ("netfilter: debug: check for sorted array") Signed-off-by: Eric Dumazet Reported-by: syzbot Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- net/netfilter/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -276,14 +276,15 @@ int nf_register_net_hook(struct net *net p =3D nf_entry_dereference(*pp); new_hooks =3D nf_hook_entries_grow(p, reg); =20 - if (!IS_ERR(new_hooks)) + if (!IS_ERR(new_hooks)) { + hooks_validate(new_hooks); rcu_assign_pointer(*pp, new_hooks); + } =20 mutex_unlock(&nf_hook_mutex); if (IS_ERR(new_hooks)) return PTR_ERR(new_hooks); =20 - hooks_validate(new_hooks); #ifdef CONFIG_NETFILTER_INGRESS if (reg->pf =3D=3D NFPROTO_NETDEV && reg->hooknum =3D=3D NF_NETDEV_INGRES= S) net_inc_ingress_queue(); From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66AABC433EF for ; Mon, 7 Mar 2022 09:24:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233182AbiCGJZc (ORCPT ); Mon, 7 Mar 2022 04:25:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237059AbiCGJXW (ORCPT ); Mon, 7 Mar 2022 04:23:22 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5325C6662A; Mon, 7 Mar 2022 01:21:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F080FB810C0; Mon, 7 Mar 2022 09:21:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6482AC340F6; Mon, 7 Mar 2022 09:21:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644903; bh=zu22j3tHmE8fVI+T7JaCdg1E5egrF7AQyc/FiqQy8Qg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SSPn1nOc4013KRM2/+xI7OyHDS0DAMb2A8iZlf3wAo/M+ZtiJMfhrXdSYHAW833dg FczabSDWvFVyS7a4ngHrUiEh3l87zI6lKXDj3xpQdgWGTEFOOjQv6EaHlWzwDlGRb4 cSCrDBSiK7WfkTxy8jQOtaw7UuZUnLuGFt+HclX0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Leon Romanovsky , Steffen Klassert Subject: [PATCH 4.14 17/42] xfrm: enforce validity of offload input flags Date: Mon, 7 Mar 2022 10:18:51 +0100 Message-Id: <20220307091636.652610016@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Leon Romanovsky commit 7c76ecd9c99b6e9a771d813ab1aa7fa428b3ade1 upstream. struct xfrm_user_offload has flags variable that received user input, but kernel didn't check if valid bits were provided. It caused a situation where not sanitized input was forwarded directly to the drivers. For example, XFRM_OFFLOAD_IPV6 define that was exposed, was used by strongswan, but not implemented in the kernel at all. As a solution, check and sanitize input flags to forward XFRM_OFFLOAD_INBOUND to the drivers. Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") Signed-off-by: Leon Romanovsky Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- include/uapi/linux/xfrm.h | 6 ++++++ net/xfrm/xfrm_device.c | 6 +++++- 2 files changed, 11 insertions(+), 1 deletion(-) --- a/include/uapi/linux/xfrm.h +++ b/include/uapi/linux/xfrm.h @@ -501,6 +501,12 @@ struct xfrm_user_offload { int ifindex; __u8 flags; }; +/* This flag was exposed without any kernel code that supporting it. + * Unfortunately, strongswan has the code that uses sets this flag, + * which makes impossible to reuse this bit. + * + * So leave it here to make sure that it won't be reused by mistake. + */ #define XFRM_OFFLOAD_IPV6 1 #define XFRM_OFFLOAD_INBOUND 2 =20 --- a/net/xfrm/xfrm_device.c +++ b/net/xfrm/xfrm_device.c @@ -69,6 +69,9 @@ int xfrm_dev_state_add(struct net *net, if (x->encap || x->tfcpad || (x->props.flags & XFRM_STATE_ESN)) return 0; =20 + if (xuo->flags & ~(XFRM_OFFLOAD_IPV6 | XFRM_OFFLOAD_INBOUND)) + return -EINVAL; + dev =3D dev_get_by_index(net, xuo->ifindex); if (!dev) { if (!(xuo->flags & XFRM_OFFLOAD_INBOUND)) { @@ -98,7 +101,8 @@ int xfrm_dev_state_add(struct net *net, =20 xso->dev =3D dev; xso->num_exthdrs =3D 1; - xso->flags =3D xuo->flags; + /* Don't forward bit that is not implemented */ + xso->flags =3D xuo->flags & ~XFRM_OFFLOAD_IPV6; =20 err =3D dev->xfrmdev_ops->xdo_dev_state_add(x); if (err) { From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6459C433EF for ; Mon, 7 Mar 2022 09:25:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236887AbiCGJZ7 (ORCPT ); Mon, 7 Mar 2022 04:25:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53022 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237091AbiCGJXY (ORCPT ); Mon, 7 Mar 2022 04:23:24 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8C85B66AD3; Mon, 7 Mar 2022 01:21:49 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 33168B810CB; Mon, 7 Mar 2022 09:21:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 888EFC340F7; Mon, 7 Mar 2022 09:21:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644907; bh=SMjhGzvyBQIr5ixAIOlOYHqg0n+x4DBNfeHbKsz0Z7E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=blArTWqRzd+57tZJW5/YqkY3yCs6VgxczWU05uStvhDQoLmXFF0cwKAX174treJjA ayNglEa2nzGpdii2wGfjd72RC+QcopySFeXlF7c48xsPRv3KBzrcPg9u2ShJOmKZb2 Rz8yLBoORtm/TG0jhXNM2+96QEHtSBbDOCkl3LyI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oleksandr Natalenko , Florian Westphal Subject: [PATCH 4.14 18/42] netfilter: nf_queue: dont assume sk is full socket Date: Mon, 7 Mar 2022 10:18:52 +0100 Message-Id: <20220307091636.681038579@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal commit 747670fd9a2d1b7774030dba65ca022ba442ce71 upstream. There is no guarantee that state->sk refers to a full socket. If refcount transitions to 0, sock_put calls sk_free which then ends up with garbage fields. I'd like to thank Oleksandr Natalenko and Jiri Benc for considerable debug work and pointing out state->sk oddities. Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instea= d of listener") Tested-by: Oleksandr Natalenko Signed-off-by: Florian Westphal Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- net/netfilter/nf_queue.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) --- a/net/netfilter/nf_queue.c +++ b/net/netfilter/nf_queue.c @@ -44,6 +44,15 @@ void nf_unregister_queue_handler(struct } EXPORT_SYMBOL(nf_unregister_queue_handler); =20 +static void nf_queue_sock_put(struct sock *sk) +{ +#ifdef CONFIG_INET + sock_gen_put(sk); +#else + sock_put(sk); +#endif +} + void nf_queue_entry_release_refs(struct nf_queue_entry *entry) { struct nf_hook_state *state =3D &entry->state; @@ -54,7 +63,7 @@ void nf_queue_entry_release_refs(struct if (state->out) dev_put(state->out); if (state->sk) - sock_put(state->sk); + nf_queue_sock_put(state->sk); #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) if (entry->skb->nf_bridge) { struct net_device *physdev; From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46FABC433F5 for ; Mon, 7 Mar 2022 09:25:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236841AbiCGJ0s (ORCPT ); Mon, 7 Mar 2022 04:26:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50274 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237098AbiCGJXZ (ORCPT ); Mon, 7 Mar 2022 04:23:25 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C063B65821; Mon, 7 Mar 2022 01:21:50 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4823E61027; Mon, 7 Mar 2022 09:21:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5915DC340F3; Mon, 7 Mar 2022 09:21:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644909; bh=Fi3GZLIsbutc8SXukSmt00AA/xd56Py1HYugwVIKGAg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KrLqE4V9wxPTSV4IRlyFmYMdluadsHOIgaGg1SNS+taPXettuL6bg+78rdx9Pea9i STZBrQmVxzK0Ma9WsHPVjyvOBgL3DcZdTiswHTBLxtRTAaEQou4oBf24q+FDvb4+ON c++xJJeDPf9UPLZkwx9HT4zoOX11r5gJUb8q1YrA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Eric Dumazet , Florian Westphal Subject: [PATCH 4.14 19/42] netfilter: nf_queue: fix possible use-after-free Date: Mon, 7 Mar 2022 10:18:53 +0100 Message-Id: <20220307091636.710014074@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal commit c3873070247d9e3c7a6b0cf9bf9b45e8018427b1 upstream. Eric Dumazet says: The sock_hold() side seems suspect, because there is no guarantee that sk_refcnt is not already 0. On failure, we cannot queue the packet and need to indicate an error. The packet will be dropped by the caller. v2: split skb prefetch hunk into separate change Fixes: 271b72c7fa82c ("udp: RCU handling for Unicast packets.") Reported-by: Eric Dumazet Reviewed-by: Eric Dumazet Signed-off-by: Florian Westphal Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- include/net/netfilter/nf_queue.h | 2 +- net/netfilter/nf_queue.c | 12 ++++++++++-- net/netfilter/nfnetlink_queue.c | 12 +++++++++--- 3 files changed, 20 insertions(+), 6 deletions(-) --- a/include/net/netfilter/nf_queue.h +++ b/include/net/netfilter/nf_queue.h @@ -32,7 +32,7 @@ void nf_register_queue_handler(struct ne void nf_unregister_queue_handler(struct net *net); void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict); =20 -void nf_queue_entry_get_refs(struct nf_queue_entry *entry); +bool nf_queue_entry_get_refs(struct nf_queue_entry *entry); void nf_queue_entry_release_refs(struct nf_queue_entry *entry); =20 static inline void init_hashrandom(u32 *jhash_initval) --- a/net/netfilter/nf_queue.c +++ b/net/netfilter/nf_queue.c @@ -80,10 +80,13 @@ void nf_queue_entry_release_refs(struct EXPORT_SYMBOL_GPL(nf_queue_entry_release_refs); =20 /* Bump dev refs so they don't vanish while packet is out */ -void nf_queue_entry_get_refs(struct nf_queue_entry *entry) +bool nf_queue_entry_get_refs(struct nf_queue_entry *entry) { struct nf_hook_state *state =3D &entry->state; =20 + if (state->sk && !refcount_inc_not_zero(&state->sk->sk_refcnt)) + return false; + if (state->in) dev_hold(state->in); if (state->out) @@ -102,6 +105,7 @@ void nf_queue_entry_get_refs(struct nf_q dev_hold(physdev); } #endif + return true; } EXPORT_SYMBOL_GPL(nf_queue_entry_get_refs); =20 @@ -159,7 +163,11 @@ static int __nf_queue(struct sk_buff *sk .size =3D sizeof(*entry) + afinfo->route_key_size, }; =20 - nf_queue_entry_get_refs(entry); + if (!nf_queue_entry_get_refs(entry)) { + kfree(entry); + return -ENOTCONN; + } + afinfo->saveroute(skb, entry); status =3D qh->outfn(entry, queuenum); =20 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -693,9 +693,15 @@ static struct nf_queue_entry * nf_queue_entry_dup(struct nf_queue_entry *e) { struct nf_queue_entry *entry =3D kmemdup(e, e->size, GFP_ATOMIC); - if (entry) - nf_queue_entry_get_refs(entry); - return entry; + + if (!entry) + return NULL; + + if (nf_queue_entry_get_refs(entry)) + return entry; + + kfree(entry); + return NULL; } =20 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B470C433F5 for ; Mon, 7 Mar 2022 09:25:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236932AbiCGJ0o (ORCPT ); Mon, 7 Mar 2022 04:26:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50586 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237156AbiCGJX2 (ORCPT ); Mon, 7 Mar 2022 04:23:28 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4D2FD66ADE; Mon, 7 Mar 2022 01:21:58 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E76A1B810C0; Mon, 7 Mar 2022 09:21:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3548EC340FC; Mon, 7 Mar 2022 09:21:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644915; bh=7CwRksKJml/9QpQn0cdYH6brkoQJtb4mCcNbBsPHmvw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KSYa9elC87gzUm5uKrw/S6N4DG60Z9zdX/19St3oyOe+qLmhmiThFktVuocxOkjC2 teP+DawSQy9fRDxmcJDggkv+MpkTBr7VnATcxEq4it6+DEhmRBBqCT8LD310fpQX9Z x289XK3BQ503hP3DiL1PQdn/wkkCHYeM1Yj6Sp6w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sven Eckelmann , Simon Wunderlich Subject: [PATCH 4.14 20/42] batman-adv: Request iflink once in batadv-on-batadv check Date: Mon, 7 Mar 2022 10:18:54 +0100 Message-Id: <20220307091636.738398248@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sven Eckelmann commit 690bb6fb64f5dc7437317153902573ecad67593d upstream. There is no need to call dev_get_iflink multiple times for the same net_device in batadv_is_on_batman_iface. And since some of the .ndo_get_iflink callbacks are dynamic (for example via RCUs like in vxcan_get_iflink), it could easily happen that the returned values are not stable. The pre-checks before __dev_get_by_index are then of course bogus. Fixes: b7eddd0b3950 ("batman-adv: prevent using any virtual device created = on batman-adv as hard-interface") Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- net/batman-adv/hard-interface.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/net/batman-adv/hard-interface.c +++ b/net/batman-adv/hard-interface.c @@ -155,22 +155,23 @@ static bool batadv_is_on_batman_iface(co struct net *net =3D dev_net(net_dev); struct net_device *parent_dev; struct net *parent_net; + int iflink; bool ret; =20 /* check if this is a batman-adv mesh interface */ if (batadv_softif_is_valid(net_dev)) return true; =20 + iflink =3D dev_get_iflink(net_dev); + /* no more parents..stop recursion */ - if (dev_get_iflink(net_dev) =3D=3D 0 || - dev_get_iflink(net_dev) =3D=3D net_dev->ifindex) + if (iflink =3D=3D 0 || iflink =3D=3D net_dev->ifindex) return false; =20 parent_net =3D batadv_getlink_net(net_dev, net); =20 /* recurse over the parent device */ - parent_dev =3D __dev_get_by_index((struct net *)parent_net, - dev_get_iflink(net_dev)); + parent_dev =3D __dev_get_by_index((struct net *)parent_net, iflink); /* if we got a NULL parent_dev there is something broken.. */ if (!parent_dev) { pr_err("Cannot find parent device\n"); From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2FE6FC433EF for ; Mon, 7 Mar 2022 09:26:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237102AbiCGJ1d (ORCPT ); Mon, 7 Mar 2022 04:27:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35434 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236715AbiCGJYZ (ORCPT ); Mon, 7 Mar 2022 04:24:25 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 06C4A58E63; Mon, 7 Mar 2022 01:23:27 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 880F66113A; Mon, 7 Mar 2022 09:23:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 93F6BC340E9; Mon, 7 Mar 2022 09:23:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646645007; bh=DIaHoi5DTOYTWJey/z9WUzcDdY/AoO2Svz+OcqnU0/U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UQTKCXhpRWE6LjSFLxzeWVZ9FvL2PwFC1fz4lbD7H0b1yIUbmLlhftNh1ZAZX8kTL z+UvUs/lBQlI7Gzi+FTq6SbRehEH3D9qrlaegyaut58PKOoPxKesJOwAElbD1oq9aP qe+PxoWtJPPCV13Xp1v+nBamBWXQEPtmUnQP1IEo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sven Eckelmann , Simon Wunderlich Subject: [PATCH 4.14 21/42] batman-adv: Request iflink once in batadv_get_real_netdevice Date: Mon, 7 Mar 2022 10:18:55 +0100 Message-Id: <20220307091636.766654593@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sven Eckelmann commit 6116ba09423f7d140f0460be6a1644dceaad00da upstream. There is no need to call dev_get_iflink multiple times for the same net_device in batadv_get_real_netdevice. And since some of the ndo_get_iflink callbacks are dynamic (for example via RCUs like in vxcan_get_iflink), it could easily happen that the returned values are not stable. The pre-checks before __dev_get_by_index are then of course bogus. Fixes: 5ed4a460a1d3 ("batman-adv: additional checks for virtual interfaces = on top of WiFi") Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- net/batman-adv/hard-interface.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/net/batman-adv/hard-interface.c +++ b/net/batman-adv/hard-interface.c @@ -221,14 +221,16 @@ static struct net_device *batadv_get_rea struct net_device *real_netdev =3D NULL; struct net *real_net; struct net *net; - int ifindex; + int iflink; =20 ASSERT_RTNL(); =20 if (!netdev) return NULL; =20 - if (netdev->ifindex =3D=3D dev_get_iflink(netdev)) { + iflink =3D dev_get_iflink(netdev); + + if (netdev->ifindex =3D=3D iflink) { dev_hold(netdev); return netdev; } @@ -238,9 +240,8 @@ static struct net_device *batadv_get_rea goto out; =20 net =3D dev_net(hard_iface->soft_iface); - ifindex =3D dev_get_iflink(netdev); real_net =3D batadv_getlink_net(netdev, net); - real_netdev =3D dev_get_by_index(real_net, ifindex); + real_netdev =3D dev_get_by_index(real_net, iflink); =20 out: if (hard_iface) From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1237C4332F for ; Mon, 7 Mar 2022 09:23:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236490AbiCGJYM (ORCPT ); Mon, 7 Mar 2022 04:24:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52358 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237298AbiCGJXj (ORCPT ); Mon, 7 Mar 2022 04:23:39 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3BCD451E47; Mon, 7 Mar 2022 01:22:23 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C48C860F63; Mon, 7 Mar 2022 09:22:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AB0A9C340E9; Mon, 7 Mar 2022 09:22:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644942; bh=8hpKamfxg1T8JN9vzi7VHlfE8PZstfB+AUhGlZlHYc4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1IF8x0qHVMYgiesb3RR+ynhplGGS/tFYDc+ymZ2Uejf++BFnLaHoi9gcrJ8nlk4q2 aFUmEsLBj34JNqtrzeJ0svUPEPAVIqRk9OP5xeLRFxx6SpzgzYoCea5raR7tQx1E4D EjqqMqbivuKepJorBBzSUh7VTeDk9q8Ef9NIrcfk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sabrina Dubroca , Sven Eckelmann , Simon Wunderlich Subject: [PATCH 4.14 22/42] batman-adv: Dont expect inter-netns unique iflink indices Date: Mon, 7 Mar 2022 10:18:56 +0100 Message-Id: <20220307091636.796307669@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sven Eckelmann commit 6c1f41afc1dbe59d9d3c8bb0d80b749c119aa334 upstream. The ifindex doesn't have to be unique for multiple network namespaces on the same machine. $ ip netns add test1 $ ip -net test1 link add dummy1 type dummy $ ip netns add test2 $ ip -net test2 link add dummy2 type dummy $ ip -net test1 link show dev dummy1 6: dummy1: mtu 1500 qdisc noop state DOWN mode DEFAULT = group default qlen 1000 link/ether 96:81:55:1e:dd:85 brd ff:ff:ff:ff:ff:ff $ ip -net test2 link show dev dummy2 6: dummy2: mtu 1500 qdisc noop state DOWN mode DEFAULT = group default qlen 1000 link/ether 5a:3c:af:35:07:c3 brd ff:ff:ff:ff:ff:ff But the batman-adv code to walk through the various layers of virtual interfaces uses this assumption because dev_get_iflink handles it internally and doesn't return the actual netns of the iflink. And dev_get_iflink only documents the situation where ifindex =3D=3D iflink for physical devices. But only checking for dev->netdev_ops->ndo_get_iflink is also not an option because ipoib_get_iflink implements it even when it sometimes returns an iflink !=3D ifindex and sometimes iflink =3D=3D ifindex. The caller must therefore make sure itself to check both netns and iflink + ifindex for equality. Only when they are equal, a "physical" interface was detected which should stop the traversal. On the other hand, vxcan_get_iflink can also return 0 in case there was currently no valid peer. In this case, it is still necessary to stop. Fixes: b7eddd0b3950 ("batman-adv: prevent using any virtual device created = on batman-adv as hard-interface") Fixes: 5ed4a460a1d3 ("batman-adv: additional checks for virtual interfaces = on top of WiFi") Reported-by: Sabrina Dubroca Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- net/batman-adv/hard-interface.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) --- a/net/batman-adv/hard-interface.c +++ b/net/batman-adv/hard-interface.c @@ -163,13 +163,15 @@ static bool batadv_is_on_batman_iface(co return true; =20 iflink =3D dev_get_iflink(net_dev); - - /* no more parents..stop recursion */ - if (iflink =3D=3D 0 || iflink =3D=3D net_dev->ifindex) + if (iflink =3D=3D 0) return false; =20 parent_net =3D batadv_getlink_net(net_dev, net); =20 + /* iflink to itself, most likely physical device */ + if (net =3D=3D parent_net && iflink =3D=3D net_dev->ifindex) + return false; + /* recurse over the parent device */ parent_dev =3D __dev_get_by_index((struct net *)parent_net, iflink); /* if we got a NULL parent_dev there is something broken.. */ @@ -229,8 +231,7 @@ static struct net_device *batadv_get_rea return NULL; =20 iflink =3D dev_get_iflink(netdev); - - if (netdev->ifindex =3D=3D iflink) { + if (iflink =3D=3D 0) { dev_hold(netdev); return netdev; } @@ -241,6 +242,14 @@ static struct net_device *batadv_get_rea =20 net =3D dev_net(hard_iface->soft_iface); real_net =3D batadv_getlink_net(netdev, net); + + /* iflink to itself, most likely physical device */ + if (net =3D=3D real_net && netdev->ifindex =3D=3D iflink) { + real_netdev =3D netdev; + dev_hold(real_netdev); + goto out; + } + real_netdev =3D dev_get_by_index(real_net, iflink); =20 out: From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D258EC433F5 for ; Mon, 7 Mar 2022 09:26:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236914AbiCGJ1F (ORCPT ); Mon, 7 Mar 2022 04:27:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60842 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237362AbiCGJXv (ORCPT ); Mon, 7 Mar 2022 04:23:51 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6950D52B25; Mon, 7 Mar 2022 01:22:57 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DF4496112D; Mon, 7 Mar 2022 09:22:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E9B46C340E9; Mon, 7 Mar 2022 09:22:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644976; bh=aCBeWPp7bnSby4Ti1baDZe/W50GUMgCuhTNjb9FNlsA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t+vKloSwGXTo4t31DgeU5h1kvgDTei8y1IRyVDWJjAXcw6LlctyFH3lI3Jnz8mqxu YtlxcyufoawAkfQ0N7evZfZ8nUMLV32PBC2kPxCamFYuNXPH7MaYtKxPI8A0wF6620 ek6emdPGQytNfQfkutB5liqzG1lulzhdapWYyNJ4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vladimir Oltean , "David S. Miller" Subject: [PATCH 4.14 23/42] net: dcb: flush lingering app table entries for unregistered devices Date: Mon, 7 Mar 2022 10:18:57 +0100 Message-Id: <20220307091636.826709536@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vladimir Oltean commit 91b0383fef06f20b847fa9e4f0e3054ead0b1a1b upstream. If I'm not mistaken (and I don't think I am), the way in which the dcbnl_ops work is that drivers call dcb_ieee_setapp() and this populates the application table with dynamically allocated struct dcb_app_type entries that are kept in the module-global dcb_app_list. However, nobody keeps exact track of these entries, and although dcb_ieee_delapp() is supposed to remove them, nobody does so when the interface goes away (example: driver unbinds from device). So the dcb_app_list will contain lingering entries with an ifindex that no longer matches any device in dcb_app_lookup(). Reclaim the lost memory by listening for the NETDEV_UNREGISTER event and flushing the app table entries of interfaces that are now gone. In fact something like this used to be done as part of the initial commit (blamed below), but it was done in dcbnl_exit() -> dcb_flushapp(), essentially at module_exit time. That became dead code after commit 7a6b6f515f77 ("DCB: fix kconfig option") which essentially merged "tristate config DCB" and "bool config DCBNL" into a single "bool config DCB", so net/dcb/dcbnl.c could not be built as a module anymore. Commit 36b9ad8084bd ("net/dcb: make dcbnl.c explicitly non-modular") recognized this and deleted dcbnl_exit() and dcb_flushapp() altogether, leaving us with the version we have today. Since flushing application table entries can and should be done as soon as the netdevice disappears, fundamentally the commit that is to blame is the one that introduced the design of this API. Fixes: 9ab933ab2cc8 ("dcbnl: add appliction tlv handlers") Signed-off-by: Vladimir Oltean Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- net/dcb/dcbnl.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) --- a/net/dcb/dcbnl.c +++ b/net/dcb/dcbnl.c @@ -1939,10 +1939,54 @@ int dcb_ieee_delapp(struct net_device *d } EXPORT_SYMBOL(dcb_ieee_delapp); =20 +static void dcbnl_flush_dev(struct net_device *dev) +{ + struct dcb_app_type *itr, *tmp; + + spin_lock(&dcb_lock); + + list_for_each_entry_safe(itr, tmp, &dcb_app_list, list) { + if (itr->ifindex =3D=3D dev->ifindex) { + list_del(&itr->list); + kfree(itr); + } + } + + spin_unlock(&dcb_lock); +} + +static int dcbnl_netdevice_event(struct notifier_block *nb, + unsigned long event, void *ptr) +{ + struct net_device *dev =3D netdev_notifier_info_to_dev(ptr); + + switch (event) { + case NETDEV_UNREGISTER: + if (!dev->dcbnl_ops) + return NOTIFY_DONE; + + dcbnl_flush_dev(dev); + + return NOTIFY_OK; + default: + return NOTIFY_DONE; + } +} + +static struct notifier_block dcbnl_nb __read_mostly =3D { + .notifier_call =3D dcbnl_netdevice_event, +}; + static int __init dcbnl_init(void) { + int err; + INIT_LIST_HEAD(&dcb_app_list); =20 + err =3D register_netdevice_notifier(&dcbnl_nb); + if (err) + return err; + rtnl_register(PF_UNSPEC, RTM_GETDCB, dcb_doit, NULL, 0); rtnl_register(PF_UNSPEC, RTM_SETDCB, dcb_doit, NULL, 0); From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59B84C433EF for ; Mon, 7 Mar 2022 09:24:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236716AbiCGJZI (ORCPT ); Mon, 7 Mar 2022 04:25:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33376 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237420AbiCGJX7 (ORCPT ); Mon, 7 Mar 2022 04:23:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5706155777; Mon, 7 Mar 2022 01:23:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BBD2460C00; Mon, 7 Mar 2022 09:23:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C3A54C340E9; Mon, 7 Mar 2022 09:23:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644985; bh=+/Uc3Sdp0v0Q53xaBBvjihDFMyurghmuwZ8ogDXLmdk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GmlMndw/TSB8COpN25uNr9BQ4LJFV7TWGoRDYdE5eJDCdvY4i+LzRdRW1ENTrAWL0 kmwP6AycA9AcKIX41ablnoRPr6wMkYQQYMkqJHm5iGhLS0sdPf9qtJxr0zLt9fQLrE KQLrMHT0S+vnHVHHs9FV/9D12+LQ/bXoSYoBS6ng= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "D. Wythe" , "David S. Miller" Subject: [PATCH 4.14 24/42] net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client Date: Mon, 7 Mar 2022 10:18:58 +0100 Message-Id: <20220307091636.855596273@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: D. Wythe commit 0537f0a2151375dcf90c1bbfda6a0aaf57164e89 upstream. The main reason for this unexpected SMC_CLC_DECL_ERR_REGRMB in client dues to following execution sequence: Server Conn A: Server Conn B: Client Conn B: smc_lgr_unregister_conn smc_lgr_register_conn smc_clc_send_accept -> smc_rtoken_add smcr_buf_unuse -> Client Conn A: smc_rtoken_delete smc_lgr_unregister_conn() makes current link available to assigned to new incoming connection, while smcr_buf_unuse() has not executed yet, which means that smc_rtoken_add may fail because of insufficient rtoken_entry, reversing their execution order will avoid this problem. Fixes: 3e034725c0d8 ("net/smc: common functions for RMBs and send buffers") Signed-off-by: D. Wythe Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- net/smc/smc_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/smc/smc_core.c +++ b/net/smc/smc_core.c @@ -239,8 +239,8 @@ void smc_conn_free(struct smc_connection if (!lgr) return; smc_cdc_tx_dismiss_slots(conn); - smc_lgr_unregister_conn(conn); smc_buf_unuse(conn); + smc_lgr_unregister_conn(conn); } =20 static void smc_link_clear(struct smc_link *lnk) From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9DC6C433FE for ; Mon, 7 Mar 2022 09:25:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236948AbiCGJ0K (ORCPT ); Mon, 7 Mar 2022 04:26:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33754 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237447AbiCGJYE (ORCPT ); Mon, 7 Mar 2022 04:24:04 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A139A56410; Mon, 7 Mar 2022 01:23:10 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 54DB5B810AC; Mon, 7 Mar 2022 09:23:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A4110C340F3; Mon, 7 Mar 2022 09:23:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644988; bh=BFFp1pVHCDEv00xgtl+NWNa9vFm2290tTNvwIjg8F74=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CJI5bqOZI18Fl74/qctSfVTSIQKVr2HSv8DWPYRY6XVFzG9Jn0xBw0iYvCzCyAnbI DwFX73mIAYV9rbFReE9S56nofZLtgu21z9cX+vbdsV3BXZjbFzriLAGu+eWRIlAib9 aKnJ8LSmX685TqWsG9ZnegNkp6Pu/lqVfhlCUZjQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "D. Wythe" , "David S. Miller" Subject: [PATCH 4.14 25/42] net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server Date: Mon, 7 Mar 2022 10:18:59 +0100 Message-Id: <20220307091636.884201563@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: D. Wythe commit 4940a1fdf31c39f0806ac831cde333134862030b upstream. The problem of SMC_CLC_DECL_ERR_REGRMB on the server is very clear. Based on the fact that whether a new SMC connection can be accepted or not depends on not only the limit of conn nums, but also the available entries of rtoken. Since the rtoken release is trigger by peer, while the conn nums is decrease by local, tons of thing can happen in this time difference. This only thing that needs to be mentioned is that now all connection creations are completely protected by smc_server_lgr_pending lock, it's enough to check only the available entries in rtokens_used_mask. Fixes: cd6851f30386 ("smc: remote memory buffers (RMBs)") Signed-off-by: D. Wythe Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- net/smc/smc_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/smc/smc_core.c +++ b/net/smc/smc_core.c @@ -428,7 +428,8 @@ int smc_conn_create(struct smc_sock *smc (lgr->role =3D=3D role) && (lgr->vlan_id =3D=3D vlan_id) && ((role =3D=3D SMC_CLNT) || - (lgr->conns_num < SMC_RMBS_PER_LGR_MAX))) { + (lgr->conns_num < SMC_RMBS_PER_LGR_MAX && + !bitmap_full(lgr->rtokens_used_mask, SMC_RMBS_PER_LGR_MAX)))) { /* link group found */ local_contact =3D SMC_REUSE_CONTACT; conn->lgr =3D lgr; From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C5D8C433EF for ; Mon, 7 Mar 2022 09:25:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236850AbiCGJ0W (ORCPT ); Mon, 7 Mar 2022 04:26:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33846 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237454AbiCGJYF (ORCPT ); Mon, 7 Mar 2022 04:24:05 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 60A3256759; Mon, 7 Mar 2022 01:23:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DD7C06112D; Mon, 7 Mar 2022 09:23:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E23B2C340F3; Mon, 7 Mar 2022 09:23:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644991; bh=EKlNeRm8n7rn3wTopxpaOhV7jlkMIUFOoC8L4W+BktQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aFbEAFw3ToRxea5sbOl8ly7vNtPJ1vzn118uOFPxmxRvCZs5yfMm9fV54lZO2RHiN xBYSOP2LlKBxa9pgvHAi7qmHM7XQKCwAz7M5g9NF53c9qZajJshL4vVn/ipZcCJduj u50lNdvya0YQo3X/gQ0Y6e6F+J5wR6o8Ru02GAQk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qiushi Wu , "Michael S. Tsirkin" , Sudip Mukherjee Subject: [PATCH 4.14 26/42] firmware: Fix a reference count leak. Date: Mon, 7 Mar 2022 10:19:00 +0100 Message-Id: <20220307091636.913759960@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Qiushi Wu commit fe3c60684377d5ad9b0569b87ed3e26e12c8173b upstream. kobject_init_and_add() takes reference even when it fails. If this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object. Callback function fw_cfg_sysfs_release_entry() in kobject_put() can handle the pointer "entry" properly. Signed-off-by: Qiushi Wu Link: https://lore.kernel.org/r/20200613190533.15712-1-wu000273@umn.edu Signed-off-by: Michael S. Tsirkin [sudip: adjust context] Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/firmware/qemu_fw_cfg.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/firmware/qemu_fw_cfg.c +++ b/drivers/firmware/qemu_fw_cfg.c @@ -461,8 +461,10 @@ static int fw_cfg_register_file(const st /* register entry under "/sys/firmware/qemu_fw_cfg/by_key/" */ err =3D kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype, fw_cfg_sel_ko, "%d", entry->f.select); - if (err) - goto err_register; + if (err) { + kobject_put(&entry->kobj); + return err; + } =20 /* add raw binary content access */ err =3D sysfs_create_bin_file(&entry->kobj, &fw_cfg_sysfs_attr_raw); @@ -478,7 +480,6 @@ static int fw_cfg_register_file(const st =20 err_add_raw: kobject_del(&entry->kobj); -err_register: kfree(entry); return err; } From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6C2DC433F5 for ; Mon, 7 Mar 2022 09:26:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235699AbiCGJ1W (ORCPT ); Mon, 7 Mar 2022 04:27:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34238 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236436AbiCGJYL (ORCPT ); Mon, 7 Mar 2022 04:24:11 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 387B3574A0; Mon, 7 Mar 2022 01:23:17 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D310BB810B2; Mon, 7 Mar 2022 09:23:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 22DC0C340E9; Mon, 7 Mar 2022 09:23:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644994; bh=wghIGJkzpuodDEQFADyhIM+kLpXkawWG1rofmq3dkMY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qnWpyyOHp8ddj50uFnkoMEw4un7lRkeH2wxaCepTUt7ruSOFwXYp8lrzKltDHjuqY VaCfqw7bAu1d85bcxqPGP3N1jTb2MgVVHyJiB8Y18hOECPnPrqJm1eyS88vuSEPjf0 9O7H2KsBg2+DwddyOYV9kKjajKy2e3AyVi6T6jvk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gabriel Somlo , Johan Hovold , Sudip Mukherjee Subject: [PATCH 4.14 27/42] firmware: qemu_fw_cfg: fix kobject leak in probe error path Date: Mon, 7 Mar 2022 10:19:01 +0100 Message-Id: <20220307091636.941846628@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 47a1db8e797da01a1309bf42e0c0d771d4e4d4f3 upstream. An initialised kobject must be freed using kobject_put() to avoid leaking associated resources (e.g. the object name). Commit fe3c60684377 ("firmware: Fix a reference count leak.") "fixed" the leak in the first error path of the file registration helper but left the second one unchanged. This "fix" would however result in a NULL pointer dereference due to the release function also removing the never added entry from the fw_cfg_entry_cache list. This has now been addressed. Fix the remaining kobject leak by restoring the common error path and adding the missing kobject_put(). Fixes: 75f3e8e47f38 ("firmware: introduce sysfs driver for QEMU's fw_cfg de= vice") Cc: stable@vger.kernel.org # 4.6 Cc: Gabriel Somlo Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20211201132528.30025-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman [sudip: adjust context] Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/firmware/qemu_fw_cfg.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) --- a/drivers/firmware/qemu_fw_cfg.c +++ b/drivers/firmware/qemu_fw_cfg.c @@ -461,15 +461,13 @@ static int fw_cfg_register_file(const st /* register entry under "/sys/firmware/qemu_fw_cfg/by_key/" */ err =3D kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype, fw_cfg_sel_ko, "%d", entry->f.select); - if (err) { - kobject_put(&entry->kobj); - return err; - } + if (err) + goto err_put_entry; =20 /* add raw binary content access */ err =3D sysfs_create_bin_file(&entry->kobj, &fw_cfg_sysfs_attr_raw); if (err) - goto err_add_raw; + goto err_del_entry; =20 /* try adding "/sys/firmware/qemu_fw_cfg/by_name/" symlink */ fw_cfg_build_symlink(fw_cfg_fname_kset, &entry->kobj, entry->f.name); @@ -478,9 +476,10 @@ static int fw_cfg_register_file(const st fw_cfg_sysfs_cache_enlist(entry); return 0; =20 -err_add_raw: +err_del_entry: kobject_del(&entry->kobj); - kfree(entry); +err_put_entry: + kobject_put(&entry->kobj); return err; } From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2FE1FC433F5 for ; Mon, 7 Mar 2022 09:26:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236971AbiCGJ10 (ORCPT ); Mon, 7 Mar 2022 04:27:26 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34534 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235906AbiCGJYY (ORCPT ); Mon, 7 Mar 2022 04:24:24 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 56360580CB; Mon, 7 Mar 2022 01:23:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0B4F4B80E70; Mon, 7 Mar 2022 09:23:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4A5C7C340F3; Mon, 7 Mar 2022 09:23:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644997; bh=U+Dj2hBlrheb83UZAlhZx5uzVl4V2xZS06Hq45i0zKM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OOEvl3P/RgZpBHPLP/fVCT2Pxl944bJ+fwsN2zmrzT0aXmlCRd6QGV8BKhQlwy4VF Mif2P5R2WRy//5uSLKNJYe3sUMGooFByu2BMieX3FdmPbXtfwsuSL5MZly8GMAoliw e8yWRQ3JMsMseNsZetA9lqEeQdoWK3FJEekK6a1Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Remi Pommarel , Nicolas Escande , Johannes Berg Subject: [PATCH 4.14 28/42] mac80211: fix forwarded mesh frames AC & queue selection Date: Mon, 7 Mar 2022 10:19:02 +0100 Message-Id: <20220307091636.972016857@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nicolas Escande commit 859ae7018316daa4adbc496012dcbbb458d7e510 upstream. There are two problems with the current code that have been highlighted with the AQL feature that is now enbaled by default. First problem is in ieee80211_rx_h_mesh_fwding(), ieee80211_select_queue_80211() is used on received packets to choose the sending AC queue of the forwarding packet although this function should only be called on TX packet (it uses ieee80211_tx_info). This ends with forwarded mesh packets been sent on unrelated random AC queue. To fix that, AC queue can directly be infered from skb->priority which has been extracted from QOS info (see ieee80211_parse_qos()). Second problem is the value of queue_mapping set on forwarded mesh frames via skb_set_queue_mapping() is not the AC of the packet but a hardware queue index. This may or may not work depending on AC to HW queue mapping which is driver specific. Both of these issues lead to improper AC selection while forwarding mesh packets but more importantly due to improper airtime accounting (which is done on a per STA, per AC basis) caused traffic stall with the introduction of AQL. Fixes: cf44012810cc ("mac80211: fix unnecessary frame drops in mesh fwding") Fixes: d3c1597b8d1b ("mac80211: fix forwarded mesh frame queue mapping") Co-developed-by: Remi Pommarel Signed-off-by: Remi Pommarel Signed-off-by: Nicolas Escande Link: https://lore.kernel.org/r/20220214173214.368862-1-nico.escande@gmail.= com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- net/mac80211/rx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -2631,13 +2631,13 @@ ieee80211_rx_h_mesh_fwding(struct ieee80 ether_addr_equal(sdata->vif.addr, hdr->addr3)) return RX_CONTINUE; =20 - ac =3D ieee80211_select_queue_80211(sdata, skb, hdr); + ac =3D ieee802_1d_to_ac[skb->priority]; q =3D sdata->vif.hw_queue[ac]; if (ieee80211_queue_stopped(&local->hw, q)) { IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); return RX_DROP_MONITOR; } - skb_set_queue_mapping(skb, q); + skb_set_queue_mapping(skb, ac); =20 if (!--mesh_hdr->ttl) { if (!is_multicast_ether_addr(hdr->addr1)) From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EBF95C433EF for ; Mon, 7 Mar 2022 09:26:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237041AbiCGJ1j (ORCPT ); Mon, 7 Mar 2022 04:27:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34684 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236650AbiCGJYR (ORCPT ); Mon, 7 Mar 2022 04:24:17 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 00C8258382; Mon, 7 Mar 2022 01:23:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 622866113A; Mon, 7 Mar 2022 09:23:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69319C340F7; Mon, 7 Mar 2022 09:23:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646645000; bh=z6HjUXSLau7wzFifNIWNvi+IufkwGy+566WAkZsMxDA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KnFFv1RkqxZwa+LuyBx37MpDmrOeN5rDFR14hl1oU7k7G6e74mR8J5vnvfm+XtKu5 F0jxp3wAXjAhoNRiNNIYJc9UNlIU3uJCoDsaG7Wirhy0cn8C7fcjf8KHK64m140Cqh exaSLjKTssZN5n6xbAbYZu8RwoIiB1XoF4epSpm4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Igor Zhbanov , Giuseppe Cavallaro , Alexandre Torgue , Jose Abreu , Jakub Kicinski Subject: [PATCH 4.14 29/42] net: stmmac: fix return value of __setup handler Date: Mon, 7 Mar 2022 10:19:03 +0100 Message-Id: <20220307091637.001107391@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap commit e01b042e580f1fbf4fd8da467442451da00c7a90 upstream. __setup() handlers should return 1 on success, i.e., the parameter has been handled. A return of 0 causes the "option=3Dvalue" string to be added to init's environment strings, polluting it. Fixes: 47dd7a540b8a ("net: add support for STMicroelectronics Ethernet cont= rollers.") Fixes: f3240e2811f0 ("stmmac: remove warning when compile as built-in (V2)") Signed-off-by: Randy Dunlap Reported-by: Igor Zhbanov Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Cc: Giuseppe Cavallaro Cc: Alexandre Torgue Cc: Jose Abreu Link: https://lore.kernel.org/r/20220224033536.25056-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -4550,7 +4550,7 @@ static int __init stmmac_cmdline_opt(cha char *opt; =20 if (!str || !*str) - return -EINVAL; + return 1; while ((opt =3D strsep(&str, ",")) !=3D NULL) { if (!strncmp(opt, "debug:", 6)) { if (kstrtoint(opt + 6, 0, &debug)) @@ -4581,11 +4581,11 @@ static int __init stmmac_cmdline_opt(cha goto err; } } - return 0; + return 1; =20 err: pr_err("%s: ERROR broken module parameter conversion", __func__); - return -EINVAL; + return 1; } =20 __setup("stmmaceth=3D", stmmac_cmdline_opt); From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A9034C433F5 for ; Mon, 7 Mar 2022 09:26:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237088AbiCGJ12 (ORCPT ); Mon, 7 Mar 2022 04:27:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34686 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236699AbiCGJYZ (ORCPT ); Mon, 7 Mar 2022 04:24:25 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 09DDD58806; Mon, 7 Mar 2022 01:23:24 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 56FB761146; Mon, 7 Mar 2022 09:23:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5AFE2C340F4; Mon, 7 Mar 2022 09:23:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646645003; bh=SaOWSdfpn9CGBVS1B4toCBOUU00mGD5nHWoK8cA+Qkk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fGVjRV11OoUlkfUXarpi689VxaNlTTBfYVtd2b0NBRLPGzmQlU5tSMLtUmP2G+Ctm bczT877njZRnxi78HnmFXHdjEUK58YVJcTypwNb3lzU4vRmE84S6oYZnJNAw9PCmWS FvQ/KVRUQ5Mg2IOzDUlSCVmA1FxDpY0WI2xvWXRQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Igor Zhbanov , Siva Reddy , Girish K S , Byungho An , Jakub Kicinski Subject: [PATCH 4.14 30/42] net: sxgbe: fix return value of __setup handler Date: Mon, 7 Mar 2022 10:19:04 +0100 Message-Id: <20220307091637.029989429@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap commit 50e06ddceeea263f57fe92baa677c638ecd65bb6 upstream. __setup() handlers should return 1 on success, i.e., the parameter has been handled. A return of 0 causes the "option=3Dvalue" string to be added to init's environment strings, polluting it. Fixes: acc18c147b22 ("net: sxgbe: add EEE(Energy Efficient Ethernet) for Sa= msung sxgbe") Fixes: 1edb9ca69e8a ("net: sxgbe: add basic framework for Samsung 10Gb ethe= rnet driver") Signed-off-by: Randy Dunlap Reported-by: Igor Zhbanov Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Cc: Siva Reddy Cc: Girish K S Cc: Byungho An Link: https://lore.kernel.org/r/20220224033528.24640-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c +++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c @@ -2282,18 +2282,18 @@ static int __init sxgbe_cmdline_opt(char char *opt; =20 if (!str || !*str) - return -EINVAL; + return 1; while ((opt =3D strsep(&str, ",")) !=3D NULL) { if (!strncmp(opt, "eee_timer:", 10)) { if (kstrtoint(opt + 10, 0, &eee_timer)) goto err; } } - return 0; + return 1; =20 err: pr_err("%s: ERROR broken module parameter conversion\n", __func__); - return -EINVAL; + return 1; } =20 __setup("sxgbeeth=3D", sxgbe_cmdline_opt); From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7FE0C433FE for ; Mon, 7 Mar 2022 09:26:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236958AbiCGJ1L (ORCPT ); Mon, 7 Mar 2022 04:27:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50736 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237305AbiCGJXm (ORCPT ); Mon, 7 Mar 2022 04:23:42 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 028A1264B; Mon, 7 Mar 2022 01:22:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B98D6B81054; Mon, 7 Mar 2022 09:22:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EBDC2C340E9; Mon, 7 Mar 2022 09:22:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644945; bh=JmT9QfBOyZJcBBwWxnPYAC63NAd5BxcKK3R707o9fKY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oKV2aksphvMiW+MSf2LMgWASp+L58l8lFJ3pS4DS2F6c7q7kCqxOR07BUVrdubhFr 57Avw/fJOACLoedrLkYI5t/NTilMRCJSP6cQqODSlSuGl0AXCgMM9K1UNw4fR6nCUJ 7xv259Cx5kHkU6fucSD032M5SN3xLJc5tY5zGg6k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , "David S. Miller" Subject: [PATCH 4.14 31/42] net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() Date: Mon, 7 Mar 2022 10:19:05 +0100 Message-Id: <20220307091637.058914754@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma commit bd6f1fd5d33dfe5d1b4f2502d3694a7cc13f166d upstream. During driver initialization, the pointer of card info, i.e. the variable 'ci' is required. However, the definition of 'com20020pci_id_table' reveals that this field is empty for some devices, which will cause null pointer dereference when initializing these devices. The following log reveals it: [ 3.973806] KASAN: null-ptr-deref in range [0x0000000000000028-0x0000000= 00000002f] [ 3.973819] RIP: 0010:com20020pci_probe+0x18d/0x13e0 [com20020_pci] [ 3.975181] Call Trace: [ 3.976208] local_pci_probe+0x13f/0x210 [ 3.977248] pci_device_probe+0x34c/0x6d0 [ 3.977255] ? pci_uevent+0x470/0x470 [ 3.978265] really_probe+0x24c/0x8d0 [ 3.978273] __driver_probe_device+0x1b3/0x280 [ 3.979288] driver_probe_device+0x50/0x370 Fix this by checking whether the 'ci' is a null pointer first. Fixes: 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata") Signed-off-by: Zheyu Ma Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/net/arcnet/com20020-pci.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/net/arcnet/com20020-pci.c +++ b/drivers/net/arcnet/com20020-pci.c @@ -136,6 +136,9 @@ static int com20020pci_probe(struct pci_ return -ENOMEM; =20 ci =3D (struct com20020_pci_card_info *)id->driver_data; + if (!ci) + return -EINVAL; + priv->ci =3D ci; mm =3D &ci->misc_map; From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 904B9C433F5 for ; Mon, 7 Mar 2022 09:25:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234127AbiCGJZx (ORCPT ); Mon, 7 Mar 2022 04:25:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52670 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237311AbiCGJXm (ORCPT ); Mon, 7 Mar 2022 04:23:42 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4A9B011151; Mon, 7 Mar 2022 01:22:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EF132B810BC; Mon, 7 Mar 2022 09:22:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 37887C340E9; Mon, 7 Mar 2022 09:22:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644948; bh=EWQa5r9e93SJmy+EJGlMIbPR/OtWqdd39e8vMt+MA2E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HFGTXmPhSHpI5gGzWSeKZendeYLeRXY+e1AOGKHoEo1Hj+DW0MUTHeq+jLE187p/r 8oJGiGVY3Eumlu91a29wzzcEhgX5hv38TyaP/OFwE4MoHx/kf2qIb4w0AP/rXYhwF/ Cz2ehwBklrpfaYV89bpdomz70c3d2JDgS1BqWqLE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jann Horn , Ard Biesheuvel Subject: [PATCH 4.14 32/42] efivars: Respect "block" flag in efivar_entry_set_safe() Date: Mon, 7 Mar 2022 10:19:06 +0100 Message-Id: <20220307091637.087868801@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jann Horn commit 258dd902022cb10c83671176688074879517fd21 upstream. When the "block" flag is false, the old code would sometimes still call check_var_size(), which wrongly tells ->query_variable_store() that it can block. As far as I can tell, this can't really materialize as a bug at the moment, because ->query_variable_store only does something on X86 with generic EFI, and in that configuration we always take the efivar_entry_set_nonblocking() path. Fixes: ca0e30dcaa53 ("efi: Add nonblocking option to efi_query_variable_sto= re()") Signed-off-by: Jann Horn Signed-off-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20220218180559.1432559-1-jannh@google.com Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/firmware/efi/vars.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/firmware/efi/vars.c +++ b/drivers/firmware/efi/vars.c @@ -763,6 +763,7 @@ int efivar_entry_set_safe(efi_char16_t * { const struct efivar_operations *ops; efi_status_t status; + unsigned long varsize; =20 if (!__efivars) return -EINVAL; @@ -785,15 +786,17 @@ int efivar_entry_set_safe(efi_char16_t * return efivar_entry_set_nonblocking(name, vendor, attributes, size, data); =20 + varsize =3D size + ucs2_strsize(name, 1024); if (!block) { if (down_trylock(&efivars_lock)) return -EBUSY; + status =3D check_var_size_nonblocking(attributes, varsize); } else { if (down_interruptible(&efivars_lock)) return -EINTR; + status =3D check_var_size(attributes, varsize); } =20 - status =3D check_var_size(attributes, size + ucs2_strsize(name, 1024)); if (status !=3D EFI_SUCCESS) { up(&efivars_lock); return -ENOSPC; From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6017EC433FE for ; Mon, 7 Mar 2022 09:25:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236980AbiCGJ0v (ORCPT ); Mon, 7 Mar 2022 04:26:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237317AbiCGJXn (ORCPT ); Mon, 7 Mar 2022 04:23:43 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3C0DF2AE05; Mon, 7 Mar 2022 01:22:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EF99CB810B2; Mon, 7 Mar 2022 09:22:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C9C3C340E9; Mon, 7 Mar 2022 09:22:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644951; bh=9w7wfwKPGRpK9zkIDgGWdhu9dqbToz0KVbzKdvjnBHc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v6K6d/cLjyOW4L2o1c5a1iajs0ww3I5R60fLNb+3VwwyOuvBiuybuahbsbp3w2KGP QNtQLyD9nbVp/xlnpWTT0C9PDeKwYUgiUFDAfJYH/o2cYMT5/6nwQTqvXz90HA3Hr/ WDex5rUoTnhtfJ9WARxyFwSY7yFKThb4tQwrPzT8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vincent Mailhol , Marc Kleine-Budde Subject: [PATCH 4.14 33/42] can: gs_usb: change active_channelss type from atomic_t to u8 Date: Mon, 7 Mar 2022 10:19:07 +0100 Message-Id: <20220307091637.116146846@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vincent Mailhol commit 035b0fcf02707d3c9c2890dc1484b11aa5335eb1 upstream. The driver uses an atomic_t variable: gs_usb:active_channels to keep track of the number of opened channels in order to only allocate memory for the URBs when this count changes from zero to one. However, the driver does not decrement the counter when an error occurs in gs_can_open(). This issue is fixed by changing the type from atomic_t to u8 and by simplifying the logic accordingly. It is safe to use an u8 here because the network stack big kernel lock (a.k.a. rtnl_mutex) is being hold. For details, please refer to [1]. [1] https://lore.kernel.org/linux-can/CAMZ6Rq+sHpiw34ijPsmp7vbUpDtJwvVtdV7C= vRZJsLixjAFfrg@mail.gmail.com/T/#t Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices= ") Link: https://lore.kernel.org/all/20220214234814.1321599-1-mailhol.vincent@= wanadoo.fr Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/net/can/usb/gs_usb.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -198,8 +198,8 @@ struct gs_can { struct gs_usb { struct gs_can *canch[GS_MAX_INTF]; struct usb_anchor rx_submitted; - atomic_t active_channels; struct usb_device *udev; + u8 active_channels; }; =20 /* 'allocate' a tx context. @@ -596,7 +596,7 @@ static int gs_can_open(struct net_device if (rc) return rc; =20 - if (atomic_add_return(1, &parent->active_channels) =3D=3D 1) { + if (!parent->active_channels) { for (i =3D 0; i < GS_MAX_RX_URBS; i++) { struct urb *urb; u8 *buf; @@ -697,6 +697,7 @@ static int gs_can_open(struct net_device =20 dev->can.state =3D CAN_STATE_ERROR_ACTIVE; =20 + parent->active_channels++; if (!(dev->can.ctrlmode & CAN_CTRLMODE_LISTENONLY)) netif_start_queue(netdev); =20 @@ -712,7 +713,8 @@ static int gs_can_close(struct net_devic netif_stop_queue(netdev); =20 /* Stop polling */ - if (atomic_dec_and_test(&parent->active_channels)) + parent->active_channels--; + if (!parent->active_channels) usb_kill_anchored_urbs(&parent->rx_submitted); =20 /* Stop sending URBs */ @@ -991,8 +993,6 @@ static int gs_usb_probe(struct usb_inter =20 init_usb_anchor(&dev->rx_submitted); =20 - atomic_set(&dev->active_channels, 0); - usb_set_intfdata(intf, dev); dev->udev =3D interface_to_usbdev(intf); From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA951C433EF for ; Mon, 7 Mar 2022 09:26:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237029AbiCGJ04 (ORCPT ); Mon, 7 Mar 2022 04:26:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52780 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237321AbiCGJXo (ORCPT ); Mon, 7 Mar 2022 04:23:44 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A28AA35861; Mon, 7 Mar 2022 01:22:37 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4E772B810B2; Mon, 7 Mar 2022 09:22:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 72116C340E9; Mon, 7 Mar 2022 09:22:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644954; bh=AhXUlbjfx1RQm61Vv2Eqw9hgtDpyAwoe9JDwySpQJVg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=udkNNWhVFcbSR/LBsl2ggoj1gRMYdD7bWt8119pQcqCRk5Lbz3QofdaTuvCBBMMQ/ Mji3fyUf+FwC2aqmtGgxvMqX2eWljgt5zYd2zwXKvyz2CzjF4t+bwpDh7tfAScnbPD VvcXzRlxWrWi7/9f+e18Zs+6OmqSk9AbBWTW2qG0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Igor Zhbanov , =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= , linux-arm-kernel@lists.infradead.org, patches@armlinux.org.uk, "Russell King (Oracle)" Subject: [PATCH 4.14 34/42] ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions Date: Mon, 7 Mar 2022 10:19:08 +0100 Message-Id: <20220307091637.144590799@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Randy Dunlap commit 7b83299e5b9385943a857d59e15cba270df20d7e upstream. early_param() handlers should return 0 on success. __setup() handlers should return 1 on success, i.e., the parameter has been handled. A return of 0 would cause the "option=3Dvalue" string to be added to init's environment strings, polluting it. ../arch/arm/mm/mmu.c: In function 'test_early_cachepolicy': ../arch/arm/mm/mmu.c:215:1: error: no return statement in function returnin= g non-void [-Werror=3Dreturn-type] ../arch/arm/mm/mmu.c: In function 'test_noalign_setup': ../arch/arm/mm/mmu.c:221:1: error: no return statement in function returnin= g non-void [-Werror=3Dreturn-type] Fixes: b849a60e0903 ("ARM: make cr_alignment read-only #ifndef CONFIG_CPU_C= P15") Signed-off-by: Randy Dunlap Reported-by: Igor Zhbanov Cc: Uwe Kleine-K=C3=B6nig Cc: linux-arm-kernel@lists.infradead.org Cc: patches@armlinux.org.uk Signed-off-by: Russell King (Oracle) Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- arch/arm/mm/mmu.c | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/arm/mm/mmu.c +++ b/arch/arm/mm/mmu.c @@ -230,12 +230,14 @@ early_param("ecc", early_ecc); static int __init early_cachepolicy(char *p) { pr_warn("cachepolicy kernel parameter not supported without cp15\n"); + return 0; } early_param("cachepolicy", early_cachepolicy); =20 static int __init noalign_setup(char *__unused) { pr_warn("noalign kernel parameter not supported without cp15\n"); + return 1; } __setup("noalign", noalign_setup); =20 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 682BBC433EF for ; Mon, 7 Mar 2022 09:25:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236895AbiCGJ0D (ORCPT ); Mon, 7 Mar 2022 04:26:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52472 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237325AbiCGJXo (ORCPT ); Mon, 7 Mar 2022 04:23:44 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F1B7E3AA63; Mon, 7 Mar 2022 01:22:38 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 845E261027; Mon, 7 Mar 2022 09:22:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8EC55C340F3; Mon, 7 Mar 2022 09:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644958; bh=8HVQ0bK50UVVZlUYGGpvPde5Jchndo2Q57B4WADFTzI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jT4a5GEADtID+u7evbBD1QQojYcW/jdnQaRYP1hHCjp9FpbbtfW0P0LTXWoJ4qyt5 SsqVxcbPPU3UOIB91vIlYNabFC4Bj+8po45kCwhV4+Htmjp4d06Ev6kl9goSpSzg1R UR3Eyc/wIQ6myr5ePmBxWfP0jlYdpp5Hbpq2IKuU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Li Yang , Sasha Levin Subject: [PATCH 4.14 35/42] soc: fsl: qe: Check of ioremap return value Date: Mon, 7 Mar 2022 10:19:09 +0100 Message-Id: <20220307091637.174000208@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit a222fd8541394b36b13c89d1698d9530afd59a9c ] As the possible failure of the ioremap(), the par_io could be NULL. Therefore it should be better to check it and return error in order to guarantee the success of the initiation. But, I also notice that all the caller like mpc85xx_qe_par_io_init() in `arch/powerpc/platforms/85xx/common.c` don't check the return value of the par_io_init(). Actually, par_io_init() needs to check to handle the potential error. I will submit another patch to fix that. Anyway, par_io_init() itsely should be fixed. Fixes: 7aa1aa6ecec2 ("QE: Move QE from arch/powerpc to drivers/soc") Signed-off-by: Jiasheng Jiang Signed-off-by: Li Yang Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- drivers/soc/fsl/qe/qe_io.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/soc/fsl/qe/qe_io.c b/drivers/soc/fsl/qe/qe_io.c index 7ae59abc7863..127a4a836e67 100644 --- a/drivers/soc/fsl/qe/qe_io.c +++ b/drivers/soc/fsl/qe/qe_io.c @@ -41,6 +41,8 @@ int par_io_init(struct device_node *np) if (ret) return ret; par_io =3D ioremap(res.start, resource_size(&res)); + if (!par_io) + return -ENOMEM; =20 num_ports =3D of_get_property(np, "num-ports", NULL); if (num_ports) --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A071C433F5 for ; Mon, 7 Mar 2022 09:26:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236963AbiCGJ1Q (ORCPT ); Mon, 7 Mar 2022 04:27:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237329AbiCGJXo (ORCPT ); Mon, 7 Mar 2022 04:23:44 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C166C44760; Mon, 7 Mar 2022 01:22:41 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 564FA60F63; Mon, 7 Mar 2022 09:22:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 630FEC340E9; Mon, 7 Mar 2022 09:22:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644960; bh=H4TVj+cf/uNrpTzIJj6dLxFemyB75Dl783yOAYEYQhQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hlDYGFNmZsiPqoWUXJ3QDT9Fl9IFgc4F8RO+P/CaeoA+5s8iGQbaWRevR/ShHvu7U oUpixdKCyCw9Ve2sKNNrc1NqYppIOIZQ+W/OjbVEuRl1hVYeublyzAg+GZ0O8W7ZBy 7Y9ITU2LpGoBCNPuKhG0F9vtPzMmkphWC+DMs9q0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, TOTE Robot , Jia-Ju Bai , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 36/42] net: chelsio: cxgb3: check the return value of pci_find_capability() Date: Mon, 7 Mar 2022 10:19:10 +0100 Message-Id: <20220307091637.203299930@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jia-Ju Bai [ Upstream commit 767b9825ed1765894e569a3d698749d40d83762a ] The function pci_find_capability() in t3_prep_adapter() can fail, so its return value should be checked. Fixes: 4d22de3e6cc4 ("Add support for the latest 1G/10G Chelsio adapter, T3= ") Reported-by: TOTE Robot Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/chelsio/cxgb3/t3_hw.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c b/drivers/net/ether= net/chelsio/cxgb3/t3_hw.c index a89721fad633..29220141e4e4 100644 --- a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c +++ b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c @@ -3677,6 +3677,8 @@ int t3_prep_adapter(struct adapter *adapter, const st= ruct adapter_info *ai, MAC_STATS_ACCUM_SECS : (MAC_STATS_ACCUM_SECS * 10); adapter->params.pci.vpd_cap_addr =3D pci_find_capability(adapter->pdev, PCI_CAP_ID_VPD); + if (!adapter->params.pci.vpd_cap_addr) + return -ENODEV; ret =3D get_vpd_params(adapter, &adapter->params.vpd); if (ret < 0) return ret; --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13D62C433F5 for ; Mon, 7 Mar 2022 09:24:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236821AbiCGJZk (ORCPT ); Mon, 7 Mar 2022 04:25:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50336 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237331AbiCGJXp (ORCPT ); Mon, 7 Mar 2022 04:23:45 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D252B41F9D; Mon, 7 Mar 2022 01:22:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6BF196112D; Mon, 7 Mar 2022 09:22:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77235C340F3; Mon, 7 Mar 2022 09:22:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644963; bh=21DyHoJWypXmQyJ2NJWEq5dGsoSvsOayLI1yONg1z8Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m1m6OR+sVgJ6O1u9FISdd4AjMFO8o+JZZ/Jw3oXU9urE2AidLJSaNR55N2lu/b5hJ 6SrpXtFX9kASdvUIuQ8t+fkJqL8KaYEg7iNhUe0NuHTj3G/YyJlDfGy8K7h6bQPzAV 9kW4YEE7uw85gnwevKz0EhEdibcQWqf+GF5H2lfg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Johannes Berg , Sasha Levin Subject: [PATCH 4.14 37/42] nl80211: Handle nla_memdup failures in handle_nan_filter Date: Mon, 7 Mar 2022 10:19:11 +0100 Message-Id: <20220307091637.232978926@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 6ad27f522cb3b210476daf63ce6ddb6568c0508b ] As there's potential for failure of the nla_memdup(), check the return value. Fixes: a442b761b24b ("cfg80211: add add_nan_func / del_nan_func") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20220301100020.3801187-1-jiasheng@iscas.ac.= cn Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- net/wireless/nl80211.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index f630fa2e3164..bbc3c876a5d8 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -11257,6 +11257,9 @@ static int handle_nan_filter(struct nlattr *attr_fi= lter, i =3D 0; nla_for_each_nested(attr, attr_filter, rem) { filter[i].filter =3D nla_memdup(attr, GFP_KERNEL); + if (!filter[i].filter) + goto err; + filter[i].len =3D nla_len(attr); i++; } @@ -11269,6 +11272,15 @@ static int handle_nan_filter(struct nlattr *attr_f= ilter, } =20 return 0; + +err: + i =3D 0; + nla_for_each_nested(attr, attr_filter, rem) { + kfree(filter[i].filter); + i++; + } + kfree(filter); + return -ENOMEM; } =20 static int nl80211_nan_add_func(struct sk_buff *skb, --=20 2.34.1 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1967C433F5 for ; Mon, 7 Mar 2022 09:24:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236762AbiCGJZW (ORCPT ); Mon, 7 Mar 2022 04:25:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52516 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237330AbiCGJXp (ORCPT ); Mon, 7 Mar 2022 04:23:45 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C991647381; Mon, 7 Mar 2022 01:22:49 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 71C38B810AC; Mon, 7 Mar 2022 09:22:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BD5C9C340F5; Mon, 7 Mar 2022 09:22:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644967; bh=Fx8sxKDlicv+ZHV+t6h5Trdm0xpJq9j4m2GOhUsmSgM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cm1qYX7w1N0f7iyoliVdDKkgjgy2t21RTalM2X1NjU9rjI76Z0OMvgbjDtd8j5z18 9r+qBjdkINqJCBrsgBXVktZUHMGukO2uz9pQFsfSg4HqEVOq1EoXtOeJeIP4acFUDK Z/awxcKWS3VNzErgKCDN25Qq8BzlnKzbHj3bYBSE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hans de Goede , Dmitry Torokhov Subject: [PATCH 4.14 38/42] Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() Date: Mon, 7 Mar 2022 10:19:12 +0100 Message-Id: <20220307091637.262135849@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hans de Goede commit 81a36d8ce554b82b0a08e2b95d0bd44fcbff339b upstream. elan_disable_power() is called conditionally on suspend, where as elan_enable_power() is always called on resume. This leads to an imbalance in the regulator's enable count. Move the regulator_[en|dis]able() calls out of elan_[en|dis]able_power() in preparation of fixing this. No functional changes intended. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220131135436.29638-1-hdegoede@redhat.com [dtor: consolidate elan_[en|dis]able() into elan_set_power()] Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/input/mouse/elan_i2c_core.c | 62 ++++++++++++-------------------= ----- 1 file changed, 22 insertions(+), 40 deletions(-) --- a/drivers/input/mouse/elan_i2c_core.c +++ b/drivers/input/mouse/elan_i2c_core.c @@ -137,55 +137,21 @@ static int elan_get_fwinfo(u16 ic_type, return 0; } =20 -static int elan_enable_power(struct elan_tp_data *data) +static int elan_set_power(struct elan_tp_data *data, bool on) { int repeat =3D ETP_RETRY_COUNT; int error; =20 - error =3D regulator_enable(data->vcc); - if (error) { - dev_err(&data->client->dev, - "failed to enable regulator: %d\n", error); - return error; - } - do { - error =3D data->ops->power_control(data->client, true); + error =3D data->ops->power_control(data->client, on); if (error >=3D 0) return 0; =20 msleep(30); } while (--repeat > 0); =20 - dev_err(&data->client->dev, "failed to enable power: %d\n", error); - return error; -} - -static int elan_disable_power(struct elan_tp_data *data) -{ - int repeat =3D ETP_RETRY_COUNT; - int error; - - do { - error =3D data->ops->power_control(data->client, false); - if (!error) { - error =3D regulator_disable(data->vcc); - if (error) { - dev_err(&data->client->dev, - "failed to disable regulator: %d\n", - error); - /* Attempt to power the chip back up */ - data->ops->power_control(data->client, true); - break; - } - - return 0; - } - - msleep(30); - } while (--repeat > 0); - - dev_err(&data->client->dev, "failed to disable power: %d\n", error); + dev_err(&data->client->dev, "failed to set power %s: %d\n", + on ? "on" : "off", error); return error; } =20 @@ -1206,9 +1172,19 @@ static int __maybe_unused elan_suspend(s /* Enable wake from IRQ */ data->irq_wake =3D (enable_irq_wake(client->irq) =3D=3D 0); } else { - ret =3D elan_disable_power(data); + ret =3D elan_set_power(data, false); + if (ret) + goto err; + + ret =3D regulator_disable(data->vcc); + if (ret) { + dev_err(dev, "error %d disabling regulator\n", ret); + /* Attempt to power the chip back up */ + elan_set_power(data, true); + } } =20 +err: mutex_unlock(&data->sysfs_mutex); return ret; } @@ -1224,7 +1200,13 @@ static int __maybe_unused elan_resume(st data->irq_wake =3D false; } =20 - error =3D elan_enable_power(data); + error =3D regulator_enable(data->vcc); + if (error) { + dev_err(dev, "error %d enabling regulator\n", error); + goto err; + } + + error =3D elan_set_power(data, true); if (error) { dev_err(dev, "power up when resuming failed: %d\n", error); goto err; From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05652C433F5 for ; Mon, 7 Mar 2022 09:24:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236806AbiCGJZL (ORCPT ); Mon, 7 Mar 2022 04:25:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52634 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237342AbiCGJXr (ORCPT ); Mon, 7 Mar 2022 04:23:47 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0D7752E21; Mon, 7 Mar 2022 01:22:52 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6A6A8B810B9; Mon, 7 Mar 2022 09:22:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9CA58C340F4; Mon, 7 Mar 2022 09:22:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644970; bh=Wn8ULIxJQkYh/HLpNVlOqhHrSl1FCYL7i/ThgofIHgU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mur4AuBql/TJtLMoC4iFp2tws+lkFOHlG1TULNyeDlDiVuzjJjBCBqPwRlOEJ8OYK ls1W0JUi3MRuqrynsFPSGgrznuIGrQLf49kd0f5FC0M9515pg51z5TxonQT5PD32KS V1v6nWgtq6fed9RkQAib28JKVE4OYWmxyakbE4rU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hans de Goede , Dmitry Torokhov Subject: [PATCH 4.14 39/42] Input: elan_i2c - fix regulator enable count imbalance after suspend/resume Date: Mon, 7 Mar 2022 10:19:13 +0100 Message-Id: <20220307091637.291336452@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hans de Goede commit 04b7762e37c95d9b965d16bb0e18dbd1fa2e2861 upstream. Before these changes elan_suspend() would only disable the regulator when device_may_wakeup() returns false; whereas elan_resume() would unconditionally enable it, leading to an enable count imbalance when device_may_wakeup() returns true. This triggers the "WARN_ON(regulator->enable_count)" in regulator_put() when the elan_i2c driver gets unbound, this happens e.g. with the hot-plugable dock with Elan I2C touchpad for the Asus TF103C 2-in-1. Fix this by making the regulator_enable() call also be conditional on device_may_wakeup() returning false. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220131135436.29638-2-hdegoede@redhat.com Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/input/mouse/elan_i2c_core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) --- a/drivers/input/mouse/elan_i2c_core.c +++ b/drivers/input/mouse/elan_i2c_core.c @@ -1195,17 +1195,17 @@ static int __maybe_unused elan_resume(st struct elan_tp_data *data =3D i2c_get_clientdata(client); int error; =20 - if (device_may_wakeup(dev) && data->irq_wake) { + if (!device_may_wakeup(dev)) { + error =3D regulator_enable(data->vcc); + if (error) { + dev_err(dev, "error %d enabling regulator\n", error); + goto err; + } + } else if (data->irq_wake) { disable_irq_wake(client->irq); data->irq_wake =3D false; } =20 - error =3D regulator_enable(data->vcc); - if (error) { - dev_err(dev, "error %d enabling regulator\n", error); - goto err; - } - error =3D elan_set_power(data, true); if (error) { dev_err(dev, "power up when resuming failed: %d\n", error); From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BDC6CC433FE for ; Mon, 7 Mar 2022 09:25:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232385AbiCGJ0d (ORCPT ); Mon, 7 Mar 2022 04:26:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50378 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237346AbiCGJXs (ORCPT ); Mon, 7 Mar 2022 04:23:48 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2530753702; Mon, 7 Mar 2022 01:22:54 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B40D26112D; Mon, 7 Mar 2022 09:22:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C186CC340E9; Mon, 7 Mar 2022 09:22:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644973; bh=2hD2Zy8q0u/gvLIiemZem1RJ9k1fcEV26TC5ytos6DE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t8s+1UfFUXPEs9CfGCyN4eh6+UWwIKh6dD3YF6L18CjHVU3fnWNsCoLSQlf4fPLe6 vTPmeM1DHCusR50t/8rAfebjPvpLsj5fUZB2Rd2PSyUIt2dz9oz1ZABA+iJ7nTQfa0 SUN7uKmBvHowQo3VQ7ddDii03zVzTiahGzWI1KwA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, William Mahon , Benjamin Tissoires , Dmitry Torokhov Subject: [PATCH 4.14 40/42] HID: add mapping for KEY_ALL_APPLICATIONS Date: Mon, 7 Mar 2022 10:19:14 +0100 Message-Id: <20220307091637.319648176@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: William Mahon commit 327b89f0acc4c20a06ed59e4d9af7f6d804dc2e2 upstream. This patch adds a new key definition for KEY_ALL_APPLICATIONS and aliases KEY_DASHBOARD to it. It also maps the 0x0c/0x2a2 usage code to KEY_ALL_APPLICATIONS. Signed-off-by: William Mahon Acked-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20220303035618.1.I3a7746ad05d270161a18334ae= 06e3b6db1a1d339@changeid Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/hid/hid-debug.c | 4 +++- drivers/hid/hid-input.c | 2 ++ include/uapi/linux/input-event-codes.h | 3 ++- 3 files changed, 7 insertions(+), 2 deletions(-) --- a/drivers/hid/hid-debug.c +++ b/drivers/hid/hid-debug.c @@ -835,7 +835,9 @@ static const char *keys[KEY_MAX + 1] =3D { [KEY_F22] =3D "F22", [KEY_F23] =3D "F23", [KEY_F24] =3D "F24", [KEY_PLAYCD] =3D "PlayCD", [KEY_PAUSECD] =3D "PauseCD", [KEY_PROG3] =3D "Prog3", - [KEY_PROG4] =3D "Prog4", [KEY_SUSPEND] =3D "Suspend", + [KEY_PROG4] =3D "Prog4", + [KEY_ALL_APPLICATIONS] =3D "AllApplications", + [KEY_SUSPEND] =3D "Suspend", [KEY_CLOSE] =3D "Close", [KEY_PLAY] =3D "Play", [KEY_FASTFORWARD] =3D "FastForward", [KEY_BASSBOOST] =3D "BassBoost", [KEY_PRINT] =3D "Print", [KEY_HP] =3D "HP", --- a/drivers/hid/hid-input.c +++ b/drivers/hid/hid-input.c @@ -1026,6 +1026,8 @@ static void hidinput_configure_usage(str case 0x28b: map_key_clear(KEY_FORWARDMAIL); break; case 0x28c: map_key_clear(KEY_SEND); break; =20 + case 0x2a2: map_key_clear(KEY_ALL_APPLICATIONS); break; + case 0x2c7: map_key_clear(KEY_KBDINPUTASSIST_PREV); break; case 0x2c8: map_key_clear(KEY_KBDINPUTASSIST_NEXT); break; case 0x2c9: map_key_clear(KEY_KBDINPUTASSIST_PREVGROUP); break; --- a/include/uapi/linux/input-event-codes.h +++ b/include/uapi/linux/input-event-codes.h @@ -278,7 +278,8 @@ #define KEY_PAUSECD 201 #define KEY_PROG3 202 #define KEY_PROG4 203 -#define KEY_DASHBOARD 204 /* AL Dashboard */ +#define KEY_ALL_APPLICATIONS 204 /* AC Desktop Show All Applications */ +#define KEY_DASHBOARD KEY_ALL_APPLICATIONS #define KEY_SUSPEND 205 #define KEY_CLOSE 206 /* AC Close */ #define KEY_PLAY 207 From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 296B8C433EF for ; Mon, 7 Mar 2022 09:23:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235255AbiCGJYo (ORCPT ); Mon, 7 Mar 2022 04:24:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237385AbiCGJXz (ORCPT ); Mon, 7 Mar 2022 04:23:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8C64654F89; Mon, 7 Mar 2022 01:23:01 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 48749B80E70; Mon, 7 Mar 2022 09:23:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7747BC340E9; Mon, 7 Mar 2022 09:22:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644979; bh=9k9TnfFJxozCmdGaI4LQIZC5djFmfCDCM4ic8RTYkgs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TdmY04xYnW6AyTlJuJHq6eyNKYR9jVYEHG13iLjHc5nZMqMn55R63uCYiu7eF3T1e fiHMhcnAJWQoPDc3uxfspxxLfFTkjVCI7EkcJfCon0VuokGG8O50ro7JdHZPq8cUJj sP52WxhiQ6QvLgF4lYqBtE1a1yRyzrZu6lqjl9m0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hugh Dickins , Zeal Robot , wangyong , Mike Kravetz , "Matthew Wilcox (Oracle)" , CGEL ZTE , "Kirill A. Shutemov" , Song Liu , Yang Yang , Andrew Morton , Linus Torvalds Subject: [PATCH 4.14 41/42] memfd: fix F_SEAL_WRITE after shmem huge page allocated Date: Mon, 7 Mar 2022 10:19:15 +0100 Message-Id: <20220307091637.348617653@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hugh Dickins commit f2b277c4d1c63a85127e8aa2588e9cc3bd21cb99 upstream. Wangyong reports: after enabling tmpfs filesystem to support transparent hugepage with the following command: echo always > /sys/kernel/mm/transparent_hugepage/shmem_enabled the docker program tries to add F_SEAL_WRITE through the following command, but it fails unexpectedly with errno EBUSY: fcntl(5, F_ADD_SEALS, F_SEAL_WRITE) =3D -1. That is because memfd_tag_pins() and memfd_wait_for_pins() were never updated for shmem huge pages: checking page_mapcount() against page_count() is hopeless on THP subpages - they need to check total_mapcount() against page_count() on THP heads only. Make memfd_tag_pins() (compared > 1) as strict as memfd_wait_for_pins() (compared !=3D 1): either can be justified, but given the non-atomic total_mapcount() calculation, it is better now to be strict. Bear in mind that total_mapcount() itself scans all of the THP subpages, when choosing to take an XA_CHECK_SCHED latency break. Also fix the unlikely xa_is_value() case in memfd_wait_for_pins(): if a page has been swapped out since memfd_tag_pins(), then its refcount must have fallen, and so it can safely be untagged. Link: https://lkml.kernel.org/r/a4f79248-df75-2c8c-3df-ba3317ccb5da@google.= com Signed-off-by: Hugh Dickins Reported-by: Zeal Robot Reported-by: wangyong Cc: Mike Kravetz Cc: Matthew Wilcox (Oracle) Cc: CGEL ZTE Cc: Kirill A. Shutemov Cc: Song Liu Cc: Yang Yang Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- mm/shmem.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/mm/shmem.c +++ b/mm/shmem.c @@ -2689,7 +2689,8 @@ static void shmem_tag_pins(struct addres slot =3D radix_tree_iter_retry(&iter); continue; } - } else if (page_count(page) - page_mapcount(page) > 1) { + } else if (!PageTail(page) && page_count(page) !=3D + hpage_nr_pages(page) + total_mapcount(page)) { radix_tree_tag_set(&mapping->page_tree, iter.index, SHMEM_TAG_PINNED); } @@ -2749,8 +2750,8 @@ static int shmem_wait_for_pins(struct ad page =3D NULL; } =20 - if (page && - page_count(page) - page_mapcount(page) !=3D 1) { + if (page && page_count(page) !=3D + hpage_nr_pages(page) + total_mapcount(page)) { if (scan < LAST_SCAN) goto continue_resched; From nobody Tue Jun 23 11:09:29 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 969C8C4332F for ; Mon, 7 Mar 2022 09:24:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236731AbiCGJZZ (ORCPT ); Mon, 7 Mar 2022 04:25:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33076 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237397AbiCGJX4 (ORCPT ); Mon, 7 Mar 2022 04:23:56 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3F59B55233; Mon, 7 Mar 2022 01:23:03 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B8E9260C00; Mon, 7 Mar 2022 09:23:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C7637C340E9; Mon, 7 Mar 2022 09:23:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646644982; bh=li4VFgSXIxIex/M7aBlSQHnZ6KUc29ZHO1DTJscQqks=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=k9b//4Yup6X9MKeHTuc4JNO+PU2d4NAE6/HAiD2AZdUs+0jQMoHFXi0aI5dI+vOQh gUoXG1yi9eJOmhcOk/smPjxD+aJZImlvpE+gP36ayM19pAGCtAfrGLwaXLjGbM4Q8r SRUyeqVj4vx/l2F00FCbzpY2IDQaF1c4oYm95EL0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ido Schimmel , Vladimir Oltean , Jakub Kicinski Subject: [PATCH 4.14 42/42] net: dcb: disable softirqs in dcbnl_flush_dev() Date: Mon, 7 Mar 2022 10:19:16 +0100 Message-Id: <20220307091637.378320738@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220307091636.146155347@linuxfoundation.org> References: <20220307091636.146155347@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vladimir Oltean commit 10b6bb62ae1a49ee818fc479cf57b8900176773e upstream. Ido Schimmel points out that since commit 52cff74eef5d ("dcbnl : Disable software interrupts before taking dcb_lock"), the DCB API can be called by drivers from softirq context. One such in-tree example is the chelsio cxgb4 driver: dcb_rpl -> cxgb4_dcb_handle_fw_update -> dcb_ieee_setapp If the firmware for this driver happened to send an event which resulted in a call to dcb_ieee_setapp() at the exact same time as another DCB-enabled interface was unregistering on the same CPU, the softirq would deadlock, because the interrupted process was already holding the dcb_lock in dcbnl_flush_dev(). Fix this unlikely event by using spin_lock_bh() in dcbnl_flush_dev() as in the rest of the dcbnl code. Fixes: 91b0383fef06 ("net: dcb: flush lingering app table entries for unreg= istered devices") Reported-by: Ido Schimmel Signed-off-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220302193939.1368823-1-vladimir.oltean@nx= p.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- net/dcb/dcbnl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/dcb/dcbnl.c +++ b/net/dcb/dcbnl.c @@ -1943,7 +1943,7 @@ static void dcbnl_flush_dev(struct net_d { struct dcb_app_type *itr, *tmp; =20 - spin_lock(&dcb_lock); + spin_lock_bh(&dcb_lock); =20 list_for_each_entry_safe(itr, tmp, &dcb_app_list, list) { if (itr->ifindex =3D=3D dev->ifindex) { @@ -1952,7 +1952,7 @@ static void dcbnl_flush_dev(struct net_d } } =20 - spin_unlock(&dcb_lock); + spin_unlock_bh(&dcb_lock); } =20 static int dcbnl_netdevice_event(struct notifier_block *nb,