From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D0DC7C433F5 for ; Mon, 21 Mar 2022 13:51:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348093AbiCUNxS (ORCPT ); Mon, 21 Mar 2022 09:53:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35562 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232974AbiCUNxR (ORCPT ); Mon, 21 Mar 2022 09:53:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 01ABC90CF6; Mon, 21 Mar 2022 06:51:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A4EDEB81675; Mon, 21 Mar 2022 13:51:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F3FB8C340E8; Mon, 21 Mar 2022 13:51:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870709; bh=vUJhJg6ldXz1gDP6tMqmE7OSEel0kuH3BqZO7brjH5I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GqGTgLmgjtCe+eOBSBlmTzGE1qAtFx20ln8WyIyXF3p+ISXyRdpmGf8kiUCnzR0a8 2p7tGGnr7hzEPPU4dtTy+f6EflwOkgDZXWCTYeeoZURqZmqSuUl6OD9N2jW09x2g4o 6HR6ygGMp9THKA29/PpjXcJBjc+ZMXEEypcFF4aw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yan Yan , Steffen Klassert , Sasha Levin Subject: [PATCH 4.9 01/16] xfrm: Fix xfrm migrate issues when address family changes Date: Mon, 21 Mar 2022 14:51:31 +0100 Message-Id: <20220321133216.693646575@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yan Yan [ Upstream commit e03c3bba351f99ad932e8f06baa9da1afc418e02 ] xfrm_migrate cannot handle address family change of an xfrm_state. The symptons are the xfrm_state will be migrated to a wrong address, and sending as well as receiving packets wil be broken. This commit fixes it by breaking the original xfrm_state_clone method into two steps so as to update the props.family before running xfrm_init_state. As the result, xfrm_state's inner mode, outer mode, type and IP header length in xfrm_state_migrate can be updated with the new address family. Tested with additions to Android's kernel unit test suite: https://android-review.googlesource.com/c/kernel/tests/+/1885354 Signed-off-by: Yan Yan Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/xfrm/xfrm_state.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 4d19f2ff6e05..73b4e7c0d336 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1238,9 +1238,6 @@ static struct xfrm_state *xfrm_state_clone(struct xfr= m_state *orig) =20 memcpy(&x->mark, &orig->mark, sizeof(x->mark)); =20 - if (xfrm_init_state(x) < 0) - goto error; - x->props.flags =3D orig->props.flags; x->props.extra_flags =3D orig->props.extra_flags; =20 @@ -1317,6 +1314,11 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_st= ate *x, if (!xc) return NULL; =20 + xc->props.family =3D m->new_family; + + if (xfrm_init_state(xc) < 0) + goto error; + memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr)); memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); =20 --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F5C0C433EF for ; Mon, 21 Mar 2022 13:52:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244815AbiCUNyP (ORCPT ); Mon, 21 Mar 2022 09:54:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37366 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348179AbiCUNxv (ORCPT ); Mon, 21 Mar 2022 09:53:51 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7C05A165A88; Mon, 21 Mar 2022 06:52:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B6A82B81678; Mon, 21 Mar 2022 13:52:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0C592C340E8; Mon, 21 Mar 2022 13:52:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870737; bh=StJD6HhQKaIGM1vNZ+XgYbCaVxO/g95cVkOWPhqPyWA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Gqyqe4/O3+QKF25dv4jwfsIm0OcTv06opiXunw1Dfyk3xMlstYUuThbsqx45oLVum YlNgD3Xyv9tJfEZPbl1z9pHUk/zhB5Q6HO3FuKKNnzKiRL17Jnv7qzpglUxGC4xl1B PgRFRBedY6s8omai1g5184yYN4iUzJXCB+RihkOg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Corentin Labbe , Krzysztof Kozlowski , Heiko Stuebner , Sasha Levin Subject: [PATCH 4.9 02/16] ARM: dts: rockchip: fix a typo on rk3288 crypto-controller Date: Mon, 21 Mar 2022 14:51:32 +0100 Message-Id: <20220321133216.722084574@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Corentin Labbe [ Upstream commit 3916c3619599a3970d3e6f98fb430b7c46266ada ] crypto-controller had a typo, fix it. In the same time, rename it to just crypto Signed-off-by: Corentin Labbe Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220209120355.1985707-1-clabbe@baylibre.com Signed-off-by: Heiko Stuebner Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/arm/boot/dts/rk3288.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi index 7b727d738b69..4702aa980ef8 100644 --- a/arch/arm/boot/dts/rk3288.dtsi +++ b/arch/arm/boot/dts/rk3288.dtsi @@ -918,7 +918,7 @@ status =3D "disabled"; }; =20 - crypto: cypto-controller@ff8a0000 { + crypto: crypto@ff8a0000 { compatible =3D "rockchip,rk3288-crypto"; reg =3D <0xff8a0000 0x4000>; interrupts =3D ; --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7E19C433EF for ; Mon, 21 Mar 2022 13:52:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348170AbiCUNyV (ORCPT ); Mon, 21 Mar 2022 09:54:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38100 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348157AbiCUNxv (ORCPT ); Mon, 21 Mar 2022 09:53:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8260F15DAA3; Mon, 21 Mar 2022 06:52:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C0B5861277; Mon, 21 Mar 2022 13:52:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF00AC340E8; Mon, 21 Mar 2022 13:52:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870740; bh=h8MGq341q8/Z+xKsS+lRE3qSygmPpW7BPADoRRa1EJY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2iFun6o57jwzTNB0xzZLKEosEdjw0hbUVRudtNepPsWpQU9fxR9Zzs0q/vV6GXBip vLYSVr3tudxcGqkZCZnJCzNzD2Lb9NzYo3ltDqsseWLdoiTkHSEHQi0NUj6pIBjutC X9ekQ7nurJSl9uwswUsmQMhDgXzqV7O1ePG8ogKA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Lobakin , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.9 03/16] MIPS: smp: fill in sibling and core maps earlier Date: Mon, 21 Mar 2022 14:51:33 +0100 Message-Id: <20220321133216.751451056@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Alexander Lobakin [ Upstream commit f2703def339c793674010cc9f01bfe4980231808 ] After enabling CONFIG_SCHED_CORE (landed during 5.14 cycle), 2-core 2-thread-per-core interAptiv (CPS-driven) started emitting the following: [ 0.025698] CPU1 revision is: 0001a120 (MIPS interAptiv (multi)) [ 0.048183] ------------[ cut here ]------------ [ 0.048187] WARNING: CPU: 1 PID: 0 at kernel/sched/core.c:6025 sched_cor= e_cpu_starting+0x198/0x240 [ 0.048220] Modules linked in: [ 0.048233] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.17.0-rc3+ #35 b7= b319f24073fd9a3c2aa7ad15fb7993eec0b26f [ 0.048247] Stack : 817f0000 00000004 327804c8 810eb050 00000000 0000000= 4 00000000 c314fdd1 [ 0.048278] 830cbd64 819c0000 81800000 817f0000 83070bf4 0000000= 1 830cbd08 00000000 [ 0.048307] 00000000 00000000 815fcbc4 00000000 00000000 0000000= 0 00000000 00000000 [ 0.048334] 00000000 00000000 00000000 00000000 817f0000 0000000= 0 00000000 817f6f34 [ 0.048361] 817f0000 818a3c00 817f0000 00000004 00000000 0000000= 0 4dc33260 0018c933 [ 0.048389] ... [ 0.048396] Call Trace: [ 0.048399] [<8105a7bc>] show_stack+0x3c/0x140 [ 0.048424] [<8131c2a0>] dump_stack_lvl+0x60/0x80 [ 0.048440] [<8108b5c0>] __warn+0xc0/0xf4 [ 0.048454] [<8108b658>] warn_slowpath_fmt+0x64/0x10c [ 0.048467] [<810bd418>] sched_core_cpu_starting+0x198/0x240 [ 0.048483] [<810c6514>] sched_cpu_starting+0x14/0x80 [ 0.048497] [<8108c0f8>] cpuhp_invoke_callback_range+0x78/0x140 [ 0.048510] [<8108d914>] notify_cpu_starting+0x94/0x140 [ 0.048523] [<8106593c>] start_secondary+0xbc/0x280 [ 0.048539] [ 0.048543] ---[ end trace 0000000000000000 ]--- [ 0.048636] Synchronize counters for CPU 1: done. ...for each but CPU 0/boot. Basic debug printks right before the mentioned line say: [ 0.048170] CPU: 1, smt_mask: So smt_mask, which is sibling mask obviously, is empty when entering the function. This is critical, as sched_core_cpu_starting() calculates core-scheduling parameters only once per CPU start, and it's crucial to have all the parameters filled in at that moment (at least it uses cpu_smt_mask() which in fact is `&cpu_sibling_map[cpu]` on MIPS). A bit of debugging led me to that set_cpu_sibling_map() performing the actual map calculation, was being invocated after notify_cpu_start(), and exactly the latter function starts CPU HP callback round (sched_core_cpu_starting() is basically a CPU HP callback). While the flow is same on ARM64 (maps after the notifier, although before calling set_cpu_online()), x86 started calculating sibling maps earlier than starting the CPU HP callbacks in Linux 4.14 (see [0] for the reference). Neither me nor my brief tests couldn't find any potential caveats in calculating the maps right after performing delay calibration, but the WARN splat is now gone. The very same debug prints now yield exactly what I expected from them: [ 0.048433] CPU: 1, smt_mask: 0-1 [0] https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?= id=3D76ce7cfe35ef Signed-off-by: Alexander Lobakin Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/mips/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c index 95ba4271af6a..01aa8d6da4b9 100644 --- a/arch/mips/kernel/smp.c +++ b/arch/mips/kernel/smp.c @@ -369,6 +369,9 @@ asmlinkage void start_secondary(void) cpu =3D smp_processor_id(); cpu_data[cpu].udelay_val =3D loops_per_jiffy; =20 + set_cpu_sibling_map(cpu); + set_cpu_core_map(cpu); + cpumask_set_cpu(cpu, &cpu_coherent_mask); notify_cpu_starting(cpu); =20 @@ -380,9 +383,6 @@ asmlinkage void start_secondary(void) /* The CPU is running and counters synchronised, now mark it online */ set_cpu_online(cpu, true); =20 - set_cpu_sibling_map(cpu); - set_cpu_core_map(cpu); - calculate_cpu_foreign_map(); =20 /* --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46A5CC433F5 for ; Mon, 21 Mar 2022 13:53:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348205AbiCUNyY (ORCPT ); Mon, 21 Mar 2022 09:54:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37886 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348199AbiCUNx6 (ORCPT ); Mon, 21 Mar 2022 09:53:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B980C15DAAF; Mon, 21 Mar 2022 06:52:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 50D6BB8167A; Mon, 21 Mar 2022 13:52:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 958A8C340E8; Mon, 21 Mar 2022 13:52:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870742; bh=fpwEGy7qyqIzw/EoLzTzCh+MYouUTid2kizSLm3pK2g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Jk48Xqe8wVin9P+ue7JLKqDDfK7lP+Yr3XQYe5ECHSaidniw3Gc4qQ3E+fk/tJTaM ormPzcOIKnxQWuWQHfHI/OE8vbnQN0Lm3+v4f/1P8MhP8I2/9hSpkCKtmF9nUDwdQO Rr2hmDxRwyArmmLMLar0Gic6SS0ll4ywUdr72qHo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julian Braha , "Russell King (Oracle)" , Sasha Levin Subject: [PATCH 4.9 04/16] ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE Date: Mon, 21 Mar 2022 14:51:34 +0100 Message-Id: <20220321133216.779243669@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julian Braha [ Upstream commit 11c57c3ba94da74c3446924260e34e0b1950b5d7 ] Resending this to properly add it to the patch tracker - thanks for letting me know, Arnd :) When ARM is enabled, and BITREVERSE is disabled, Kbuild gives the following warning: WARNING: unmet direct dependencies detected for HAVE_ARCH_BITREVERSE Depends on [n]: BITREVERSE [=3Dn] Selected by [y]: - ARM [=3Dy] && (CPU_32v7M [=3Dn] || CPU_32v7 [=3Dy]) && !CPU_32v6 [=3Dn] This is because ARM selects HAVE_ARCH_BITREVERSE without selecting BITREVERSE, despite HAVE_ARCH_BITREVERSE depending on BITREVERSE. This unmet dependency bug was found by Kismet, a static analysis tool for Kconfig. Please advise if this is not the appropriate solution. Signed-off-by: Julian Braha Signed-off-by: Russell King (Oracle) Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- lib/Kconfig | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/Kconfig b/lib/Kconfig index 260a80e313b9..600759707ffe 100644 --- a/lib/Kconfig +++ b/lib/Kconfig @@ -16,7 +16,6 @@ config BITREVERSE config HAVE_ARCH_BITREVERSE bool default n - depends on BITREVERSE help This option enables the use of hardware bit-reversal instructions on architectures which support such operations. --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81AD0C433F5 for ; Mon, 21 Mar 2022 13:53:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348221AbiCUNy3 (ORCPT ); Mon, 21 Mar 2022 09:54:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37880 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348204AbiCUNx7 (ORCPT ); Mon, 21 Mar 2022 09:53:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E21AF15DAB0; Mon, 21 Mar 2022 06:52:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6748E6127C; Mon, 21 Mar 2022 13:52:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77666C340E8; Mon, 21 Mar 2022 13:52:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870745; bh=fEVgwXk1c1lGMS8hGbRJ0s5ynNwtkHpZ8UedaFiEplo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2Dn692k/pdcNP2M6mQvsX7Y6Wmbk+aW1O6Z0O/7AEY7Xr3ofDA9Wz4E+6n1uDkPAD euuA9bhcCZkF6TxiBmpWyniTrCKy7wxzM6tRbwkd73l9Cz3LhrQityfND09yivtrbj A/ZEqguqIFUyCYVSkQMEN8umUI1130pv+XVNUItE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Machek , Lad Prabhakar , Ulrich Hecht , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.9 05/16] can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready Date: Mon, 21 Mar 2022 14:51:35 +0100 Message-Id: <20220321133216.808677401@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lad Prabhakar [ Upstream commit c5048a7b2c23ab589f3476a783bd586b663eda5b ] Register the CAN device only when all the necessary initialization is completed. This patch makes sure all the data structures and locks are initialized before registering the CAN device. Link: https://lore.kernel.org/all/20220221225935.12300-1-prabhakar.mahadev-= lad.rj@bp.renesas.com Reported-by: Pavel Machek Signed-off-by: Lad Prabhakar Reviewed-by: Pavel Machek Reviewed-by: Ulrich Hecht Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/can/rcar/rcar_canfd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_= canfd.c index 43cdd5544b0c..a127c853a4e9 100644 --- a/drivers/net/can/rcar/rcar_canfd.c +++ b/drivers/net/can/rcar/rcar_canfd.c @@ -1601,15 +1601,15 @@ static int rcar_canfd_channel_probe(struct rcar_can= fd_global *gpriv, u32 ch, =20 netif_napi_add(ndev, &priv->napi, rcar_canfd_rx_poll, RCANFD_NAPI_WEIGHT); + spin_lock_init(&priv->tx_lock); + devm_can_led_init(ndev); + gpriv->ch[priv->channel] =3D priv; err =3D register_candev(ndev); if (err) { dev_err(&pdev->dev, "register_candev() failed, error %d\n", err); goto fail_candev; } - spin_lock_init(&priv->tx_lock); - devm_can_led_init(ndev); - gpriv->ch[priv->channel] =3D priv; dev_info(&pdev->dev, "device registered (channel %u)\n", priv->channel); return 0; =20 --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C84CAC4332F for ; Mon, 21 Mar 2022 13:54:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348254AbiCUNzj (ORCPT ); Mon, 21 Mar 2022 09:55:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38152 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348368AbiCUNzL (ORCPT ); Mon, 21 Mar 2022 09:55:11 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0B7F5B69; Mon, 21 Mar 2022 06:53:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A473FB81598; Mon, 21 Mar 2022 13:53:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13CDBC340E8; Mon, 21 Mar 2022 13:53:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870819; bh=IAO/tvgrD7m/QtcNZol25+fTlHitELFYA+SELj892+A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IYyi/qF7eB3jCkx93s30EUjzZPcuIfLqrW0t0NM11wjoJf2wbo/7/qDZuGMaXnUMg 1R4GefRgxF3ANVyQ/MFRC6O+X//AVd3yLoVQsiMhFTHOKCyuFsVD555tLkzjFUECWO PkULfi+xwE5G333zvsMjrdop2sJa1lzdBwVHooZ8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, TOTE Robot , Jia-Ju Bai , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 06/16] atm: firestream: check the return value of ioremap() in fs_init() Date: Mon, 21 Mar 2022 14:51:36 +0100 Message-Id: <20220321133216.837289788@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jia-Ju Bai [ Upstream commit d4e26aaea7f82ba884dcb4acfe689406bc092dc3 ] The function ioremap() in fs_init() can fail, so its return value should be checked. Reported-by: TOTE Robot Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/atm/firestream.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c index 7cb2b863e653..7d74b7e1a837 100644 --- a/drivers/atm/firestream.c +++ b/drivers/atm/firestream.c @@ -1692,6 +1692,8 @@ static int fs_init(struct fs_dev *dev) dev->hw_base =3D pci_resource_start(pci_dev, 0); =20 dev->base =3D ioremap(dev->hw_base, 0x1000); + if (!dev->base) + return 1; =20 reset_chip (dev); =20 --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D084CC433FE for ; Mon, 21 Mar 2022 13:54:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348321AbiCUNzb (ORCPT ); Mon, 21 Mar 2022 09:55:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38964 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348367AbiCUNzL (ORCPT ); Mon, 21 Mar 2022 09:55:11 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3605710CC; Mon, 21 Mar 2022 06:53:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C6C5A611F4; Mon, 21 Mar 2022 13:53:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DA876C340E8; Mon, 21 Mar 2022 13:53:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870822; bh=KnxeRE+Le/zxu/bcAkRRacwhz4IT1ZtXf1iBhjipU6c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Jrk5ro8UV15hmQiH+AByUabHhtvqK84+Wtkf0xZ1NaQm5SVWaBn0Qc1hTcqTWf+8Y ugRlU5LQ5CV+oaK2xhucjhhR5e8ccQoy2BVMYTVX6u+UyxN2IuimBosOknup9ylJTC m6CAbX5bLxzR18ZazX3pZtPyLMJN3DhJQssrx3Pw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sreeramya Soratkal , Johannes Berg , Sasha Levin Subject: [PATCH 4.9 07/16] nl80211: Update bss channel on channel switch for P2P_CLIENT Date: Mon, 21 Mar 2022 14:51:37 +0100 Message-Id: <20220321133216.867138847@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sreeramya Soratkal [ Upstream commit e50b88c4f076242358b66ddb67482b96947438f2 ] The wdev channel information is updated post channel switch only for the station mode and not for the other modes. Due to this, the P2P client still points to the old value though it moved to the new channel when the channel change is induced from the P2P GO. Update the bss channel after CSA channel switch completion for P2P client interface as well. Signed-off-by: Sreeramya Soratkal Link: https://lore.kernel.org/r/1646114600-31479-1-git-send-email-quic_ssra= mya@quicinc.com Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/wireless/nl80211.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index ab8bca39afa3..562e138deba2 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -14068,7 +14068,8 @@ void cfg80211_ch_switch_notify(struct net_device *d= ev, wdev->chandef =3D *chandef; wdev->preset_chandef =3D *chandef; =20 - if (wdev->iftype =3D=3D NL80211_IFTYPE_STATION && + if ((wdev->iftype =3D=3D NL80211_IFTYPE_STATION || + wdev->iftype =3D=3D NL80211_IFTYPE_P2P_CLIENT) && !WARN_ON(!wdev->current_bss)) wdev->current_bss->pub.channel =3D chandef->chan; =20 --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 853CEC433FE for ; Mon, 21 Mar 2022 13:54:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348325AbiCUNz0 (ORCPT ); Mon, 21 Mar 2022 09:55:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38832 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343789AbiCUNzN (ORCPT ); Mon, 21 Mar 2022 09:55:13 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A9DD3102A; Mon, 21 Mar 2022 06:53:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 52430B81677; Mon, 21 Mar 2022 13:53:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9A21DC340E8; Mon, 21 Mar 2022 13:53:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870825; bh=Ma9ZQqofYHwDllZwZnYHjVafCmSXbxa84QLGIPjvGLs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PJmY1E+/HJdxKcqGuiuRi8c+LXSTMdcnuRQuOofaNjThi3/ENj4qS+LtLfSS57ltC eFx1K7C4u8TwTNrRFw2WFxKUXlgskO7F15CAyTt+rVfkrOAkTEbNAI9Nc5kjL1yR5+ zQXwr4b7DteddFkWOE+m4fjpPbmZIXBouZksHYc8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , John Fastabend , Jakub Sitnicki , Daniel Borkmann , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.9 08/16] tcp: make tcp_read_sock() more robust Date: Mon, 21 Mar 2022 14:51:38 +0100 Message-Id: <20220321133216.895955622@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit e3d5ea2c011ecb16fb94c56a659364e6b30fac94 ] If recv_actor() returns an incorrect value, tcp_read_sock() might loop forever. Instead, issue a one time warning and make sure to make progress. Signed-off-by: Eric Dumazet Acked-by: John Fastabend Acked-by: Jakub Sitnicki Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20220302161723.3910001-2-eric.dumazet@gmail= .com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/ipv4/tcp.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index aeda018e4c49..6dfb964e1ad8 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1561,11 +1561,13 @@ int tcp_read_sock(struct sock *sk, read_descriptor_= t *desc, if (!copied) copied =3D used; break; - } else if (used <=3D len) { - seq +=3D used; - copied +=3D used; - offset +=3D used; } + if (WARN_ON_ONCE(used > len)) + used =3D len; + seq +=3D used; + copied +=3D used; + offset +=3D used; + /* If recv_actor drops the lock (e.g. TCP splice * receive) the skb pointer might be invalid when * getting here: tcp_collapse might have deleted it --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 503BAC433EF for ; Mon, 21 Mar 2022 13:54:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348245AbiCUNzg (ORCPT ); Mon, 21 Mar 2022 09:55:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38474 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347775AbiCUNzO (ORCPT ); Mon, 21 Mar 2022 09:55:14 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CE5905F64; Mon, 21 Mar 2022 06:53:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6A9116129D; Mon, 21 Mar 2022 13:53:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7CD96C340F2; Mon, 21 Mar 2022 13:53:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870827; bh=ORgOXrbErGzG4bsiU02n8K34kQWixB1gzAnSuiyDSKY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DQwgQAqYwBh+T99J1ZjMnbjfltY38PIIMDojZegJVhA4+f4+rUotsSXU0GVs93idf wu4x7vkHZ3wej3MPx6M2wpqPPAszPIA/vZgpcgv+KsCTWRwcKVFh7ba1E/dma5HZGK H69jBm/F6tR2PwSZf7uSwEOBQgmVEBiaD5PPufXU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Niels Dossche , Martin Habets , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 09/16] sfc: extend the locking on mcdi->seqno Date: Mon, 21 Mar 2022 14:51:39 +0100 Message-Id: <20220321133216.925997549@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Niels Dossche [ Upstream commit f1fb205efb0ccca55626fd4ef38570dd16b44719 ] seqno could be read as a stale value outside of the lock. The lock is already acquired to protect the modification of seqno against a possible race condition. Place the reading of this value also inside this locking to protect it against a possible race condition. Signed-off-by: Niels Dossche Acked-by: Martin Habets Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/ethernet/sfc/mcdi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcd= i.c index 241520943ada..221798499e24 100644 --- a/drivers/net/ethernet/sfc/mcdi.c +++ b/drivers/net/ethernet/sfc/mcdi.c @@ -162,9 +162,9 @@ static void efx_mcdi_send_request(struct efx_nic *efx, = unsigned cmd, /* Serialise with efx_mcdi_ev_cpl() and efx_mcdi_ev_death() */ spin_lock_bh(&mcdi->iface_lock); ++mcdi->seqno; + seqno =3D mcdi->seqno & SEQ_MASK; spin_unlock_bh(&mcdi->iface_lock); =20 - seqno =3D mcdi->seqno & SEQ_MASK; xflags =3D 0; if (mcdi->mode =3D=3D MCDI_MODE_EVENTS) xflags |=3D MCDI_HEADER_XFLAGS_EVREQ; --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F035FC433EF for ; Mon, 21 Mar 2022 13:52:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348110AbiCUNxd (ORCPT ); Mon, 21 Mar 2022 09:53:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36238 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348103AbiCUNxZ (ORCPT ); Mon, 21 Mar 2022 09:53:25 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 959D7145986; Mon, 21 Mar 2022 06:51:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2B8A9B81675; Mon, 21 Mar 2022 13:51:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6E9C2C340E8; Mon, 21 Mar 2022 13:51:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870716; bh=lFLXRhW34vfFCOIYngRiWETJjhBV4ONwtADOaPDllds=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ryoHmOEjFdeR5SOppw0ky5WGTFGVrtJCy73eGbRe0LaZRmMLqiI04eP/5W9W+B4tN Jvo7fSv3SCGFE8bc3HBdrl8AY4cTWyffVG8ZF90G5Q2vUsHt1zc4N9IukQ/o/ity6q KgBNYcNZ7Lk0H8Zsiaq+GqGG1eVUBbnxBGoxbnWM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengming Zhou , Shuah Khan , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH 4.9 10/16] kselftest/vm: fix tests build with old libc Date: Mon, 21 Mar 2022 14:51:40 +0100 Message-Id: <20220321133216.955615999@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengming Zhou [ Upstream commit b773827e361952b3f53ac6fa4c4e39ccd632102e ] The error message when I build vm tests on debian10 (GLIBC 2.28): userfaultfd.c: In function `userfaultfd_pagemap_test': userfaultfd.c:1393:37: error: `MADV_PAGEOUT' undeclared (first use in this function); did you mean `MADV_RANDOM'? if (madvise(area_dst, test_pgsize, MADV_PAGEOUT)) ^~~~~~~~~~~~ MADV_RANDOM This patch includes these newer definitions from UAPI linux/mman.h, is useful to fix tests build on systems without these definitions in glibc sys/mman.h. Link: https://lkml.kernel.org/r/20220227055330.43087-2-zhouchengming@byteda= nce.com Signed-off-by: Chengming Zhou Reviewed-by: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- tools/testing/selftests/vm/userfaultfd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selft= ests/vm/userfaultfd.c index d77ed41b2094..1f89d3dd8295 100644 --- a/tools/testing/selftests/vm/userfaultfd.c +++ b/tools/testing/selftests/vm/userfaultfd.c @@ -60,6 +60,7 @@ #include #include #include +#include #include #include #include --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61435C433EF for ; Mon, 21 Mar 2022 13:52:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348125AbiCUNxh (ORCPT ); Mon, 21 Mar 2022 09:53:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36514 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348115AbiCUNx2 (ORCPT ); Mon, 21 Mar 2022 09:53:28 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D687615DA91; Mon, 21 Mar 2022 06:52:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5E19C6125C; Mon, 21 Mar 2022 13:52:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6E83DC340E8; Mon, 21 Mar 2022 13:51:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870719; bh=SBnrSzmZi9VtvJcA7vI5yIsQi0dybMaBTBAxM9wYWXQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BpI4dT1u21se8D7n5e/AFzH8YF2rdiHqn/IbaGNK2dVqpixq3EqPFfM0ttaJ1HxL5 9ANkZ2IVkK/H/MhaENyWE6j9r/q6THz7WBe8bCecNu+dlLa0QfMUKDVUqVpqoFJGAO Bxu3091X1oEf3aDQ1Txi5xZAYn3brT+Cgrg2zUzU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lucas Wei Subject: [PATCH 4.9 11/16] fs: sysfs_emit: Remove PAGE_SIZE alignment check Date: Mon, 21 Mar 2022 14:51:41 +0100 Message-Id: <20220321133216.984022688@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lucas Wei For kernel releases older than 4.20, using the SLUB alloctor will cause this alignment check to fail as that allocator did NOT align kmalloc allocations on a PAGE_SIZE boundry. Remove the check for these older kernels as it is a false-positive and causes problems on many devices. Signed-off-by: Lucas Wei Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- fs/sysfs/file.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/fs/sysfs/file.c +++ b/fs/sysfs/file.c @@ -565,8 +565,7 @@ int sysfs_emit(char *buf, const char *fm va_list args; int len; =20 - if (WARN(!buf || offset_in_page(buf), - "invalid sysfs_emit: buf:%p\n", buf)) + if (WARN(!buf, "invalid sysfs_emit: buf:%p\n", buf)) return 0; =20 va_start(args, fmt); From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B322C433EF for ; Mon, 21 Mar 2022 13:52:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348141AbiCUNxm (ORCPT ); Mon, 21 Mar 2022 09:53:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36766 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348107AbiCUNxb (ORCPT ); Mon, 21 Mar 2022 09:53:31 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E8C81459A8; Mon, 21 Mar 2022 06:52:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 20DD4B81674; Mon, 21 Mar 2022 13:52:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 62CB6C340F2; Mon, 21 Mar 2022 13:52:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870722; bh=eNpTu/EL7cyclaAk+KggbJ090IfVQLSwA5Uf3oSwuJ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=x+5JCkZ+ei9FykKa8nc8Y+7J5qvmuhRG3EnDPtzC41vlLDwkSbCcs5Iv303RAaHiY nygO4BcNaOmeVbgMUyb8pd1THv/NAEhqF5Gewd1m4stF4sfLGThc2KqXv/UmtjkFgO vOO3Ta4RgSDWcA0KTQPN6CJgY3lKcKI97eoXlFCQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.9 12/16] net/packet: fix slab-out-of-bounds access in packet_recvmsg() Date: Mon, 21 Mar 2022 14:51:42 +0100 Message-Id: <20220321133217.014039825@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit c700525fcc06b05adfea78039de02628af79e07a ] syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH and mmap operations, tpacket_rcv() is queueing skbs with garbage in skb->cb[], triggering a too big copy [1] Presumably, users of af_packet using mmap() already gets correct metadata from the mapped buffer, we can simply make sure to clear 12 bytes that might be copied to user space later. BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:22= 5 [inline] BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/a= f_packet.c:3489 Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631 CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-023= 96-g0b3660695e80 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:225 [inline] packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_recvmsg net/socket.c:962 [inline] ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fdfd5954c29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005 RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60 R13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54 addr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at o= ffset 32 in frame: ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246 this frame has 1 object: [32, 160) 'addr' Memory state around the buggy address: ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 >ffffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 ^ ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.") Signed-off-by: Eric Dumazet Reported-by: syzbot Link: https://lore.kernel.org/r/20220312232958.3535620-1-eric.dumazet@gmail= .com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/packet/af_packet.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 8e62b05efe29..e79d6881a97e 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -2244,8 +2244,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct n= et_device *dev, copy_skb =3D skb_get(skb); skb_head =3D skb->data; } - if (copy_skb) + if (copy_skb) { + memset(&PACKET_SKB_CB(copy_skb)->sa.ll, 0, + sizeof(PACKET_SKB_CB(copy_skb)->sa.ll)); skb_set_owner_r(copy_skb, sk); + } } snaplen =3D po->rx_ring.frame_size - macoff; if ((int)snaplen < 0) { @@ -3422,6 +3425,8 @@ static int packet_recvmsg(struct socket *sock, struct= msghdr *msg, size_t len, sock_recv_ts_and_drops(msg, sk, skb); =20 if (msg->msg_name) { + const size_t max_len =3D min(sizeof(skb->cb), + sizeof(struct sockaddr_storage)); int copy_len; =20 /* If the address length field is there to be filled @@ -3444,6 +3449,10 @@ static int packet_recvmsg(struct socket *sock, struc= t msghdr *msg, size_t len, msg->msg_namelen =3D sizeof(struct sockaddr_ll); } } + if (WARN_ON_ONCE(copy_len > max_len)) { + copy_len =3D max_len; + msg->msg_namelen =3D copy_len; + } memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len); } =20 --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ADC85C433EF for ; Mon, 21 Mar 2022 13:52:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348147AbiCUNxp (ORCPT ); Mon, 21 Mar 2022 09:53:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37004 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348126AbiCUNxe (ORCPT ); Mon, 21 Mar 2022 09:53:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9CC1F15DA95; Mon, 21 Mar 2022 06:52:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2CE29B81661; Mon, 21 Mar 2022 13:52:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 64536C340E8; Mon, 21 Mar 2022 13:52:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870725; bh=9MPR+HdyfQwLj/pKL6CCDEl6aEBKU61hJqbpnBNoqQg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DZZzNFyiWSOV2YuwUpfe77HdoY98ViLLWHzvMA+06DtzeejuoUTrCqyDyY8phusHt k6NDH/714nFUpfUIoAmiqmaTIAvu6iKgpw37muyw2W14ZCUqY+SN/miEspqvasOHmd NOCGDSeUFOyUSo5sYxv9uqLqmpiLknnBvJm3fyY8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 13/16] atm: eni: Add check for dma_map_single Date: Mon, 21 Mar 2022 14:51:43 +0100 Message-Id: <20220321133217.043816524@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 0f74b29a4f53627376cf5a5fb7b0b3fa748a0b2b ] As the potential failure of the dma_map_single(), it should be better to check it and return error if fails. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jiasheng Jiang Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/atm/eni.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c index 2b7786cd548f..0ec52fb2b7fc 100644 --- a/drivers/atm/eni.c +++ b/drivers/atm/eni.c @@ -1114,6 +1114,8 @@ DPRINTK("iovcnt =3D %d\n",skb_shinfo(skb)->nr_frags); } paddr =3D dma_map_single(&eni_dev->pci_dev->dev,skb->data,skb->len, DMA_TO_DEVICE); + if (dma_mapping_error(&eni_dev->pci_dev->dev, paddr)) + return enq_next; ENI_PRV_PADDR(skb) =3D paddr; /* prepare DMA queue entries */ j =3D 0; --=20 2.34.1 From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8981C433EF for ; Mon, 21 Mar 2022 13:52:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348118AbiCUNxt (ORCPT ); Mon, 21 Mar 2022 09:53:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37008 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348119AbiCUNxf (ORCPT ); Mon, 21 Mar 2022 09:53:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BA1B015DAA6; Mon, 21 Mar 2022 06:52:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3326061261; Mon, 21 Mar 2022 13:52:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 42E13C340E8; Mon, 21 Mar 2022 13:52:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870728; bh=N+NlLnEfVlFkeG3akY42dpb6DERXaGMYwvWEpiWjiMQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=b7z41JgXt/OC0XGrjC9rHFZzoy4Yj4VvDbqZZCcWztP6/nwNmFXHD/omdPL9jElaz pFRRMyPzASIKvqd5fE5dXiQNXeKR2/fVvk8nf6bUtDzGwD0ZSP9KIpUKv2ADwwme8l O4kLQmzydg5h+H+FDkbUJmofO+Reozxc32T5zPpo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Dan Carpenter Subject: [PATCH 4.9 14/16] usb: gadget: rndis: prevent integer overflow in rndis_set_response() Date: Mon, 21 Mar 2022 14:51:44 +0100 Message-Id: <20220321133217.072447221@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit 65f3324f4b6fed78b8761c3b74615ecf0ffa81fa upstream. If "BufOffset" is very large the "BufOffset + 8" operation can have an integer overflow. Cc: stable@kernel.org Fixes: 38ea1eac7d88 ("usb: gadget: rndis: check size of RNDIS_MSG_SET comma= nd") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20220301080424.GA17208@kili Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/gadget/function/rndis.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/gadget/function/rndis.c +++ b/drivers/usb/gadget/function/rndis.c @@ -645,6 +645,7 @@ static int rndis_set_response(struct rnd BufLength =3D le32_to_cpu(buf->InformationBufferLength); BufOffset =3D le32_to_cpu(buf->InformationBufferOffset); if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || + (BufOffset > RNDIS_MAX_TOTAL_SIZE) || (BufOffset + 8 >=3D RNDIS_MAX_TOTAL_SIZE)) return -EINVAL; From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40C03C433EF for ; Mon, 21 Mar 2022 13:52:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348148AbiCUNx5 (ORCPT ); Mon, 21 Mar 2022 09:53:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37886 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348152AbiCUNxq (ORCPT ); Mon, 21 Mar 2022 09:53:46 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D13B15DAAF; Mon, 21 Mar 2022 06:52:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B57A6B81676; Mon, 21 Mar 2022 13:52:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 08DF8C340E8; Mon, 21 Mar 2022 13:52:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870731; bh=G+VFBqG7q4lwb2VB2x7Ca2f8r0VCZcoQv5l7T+Cnosk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RshB49YamUQ6yAVIpjJNAleVcKzCN7EbxbEjKkdowd4f+X29M0+COd43GLyV2fB8R WlBfrDRadAzGKE8ekFO/Dk0lJ1lkWG82SOp/RtGIRZUY54XoalbCXa5gHvkUMxyY0g sSFlgOpp5MwB1w6gvGwzZm6Hd2UbdEaFXUy0r8b8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , syzbot+348b571beb5eeb70a582@syzkaller.appspotmail.com Subject: [PATCH 4.9 15/16] usb: gadget: Fix use-after-free bug by not setting udc->dev.driver Date: Mon, 21 Mar 2022 14:51:45 +0100 Message-Id: <20220321133217.101397866@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 16b1941eac2bd499f065a6739a40ce0011a3d740 upstream. The syzbot fuzzer found a use-after-free bug: BUG: KASAN: use-after-free in dev_uevent+0x712/0x780 drivers/base/core.c:23= 20 Read of size 8 at addr ffff88802b934098 by task udevd/3689 CPU: 2 PID: 3689 Comm: udevd Not tainted 5.17.0-rc4-syzkaller-00229-g4f12b7= 42eb2b #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 dev_uevent+0x712/0x780 drivers/base/core.c:2320 uevent_show+0x1b8/0x380 drivers/base/core.c:2391 dev_attr_show+0x4b/0x90 drivers/base/core.c:2094 Although the bug manifested in the driver core, the real cause was a race with the gadget core. dev_uevent() does: if (dev->driver) add_uevent_var(env, "DRIVER=3D%s", dev->driver->name); and between the test and the dereference of dev->driver, the gadget core sets dev->driver to NULL. The race wouldn't occur if the gadget core registered its devices on a real bus, using the standard synchronization techniques of the driver core. However, it's not necessary to make such a large change in order to fix this bug; all we need to do is make sure that udc->dev.driver is always NULL. In fact, there is no reason for udc->dev.driver ever to be set to anything, let alone to the value it currently gets: the address of the gadget's driver. After all, a gadget driver only knows how to manage a gadget, not how to manage a UDC. This patch simply removes the statements in the gadget core that touch udc->dev.driver. Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class") CC: Reported-and-tested-by: syzbot+348b571beb5eeb70a582@syzkaller.appspotmail.c= om Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YiQgukfFFbBnwJ/9@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/gadget/udc/core.c | 3 --- 1 file changed, 3 deletions(-) --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -1253,7 +1253,6 @@ static void usb_gadget_remove_driver(str usb_gadget_udc_stop(udc); =20 udc->driver =3D NULL; - udc->dev.driver =3D NULL; udc->gadget->dev.driver =3D NULL; } =20 @@ -1301,7 +1300,6 @@ static int udc_bind_to_driver(struct usb driver->function); =20 udc->driver =3D driver; - udc->dev.driver =3D &driver->driver; udc->gadget->dev.driver =3D &driver->driver; =20 ret =3D driver->bind(udc->gadget, driver); @@ -1321,7 +1319,6 @@ err1: dev_err(&udc->dev, "failed to start %s: %d\n", udc->driver->function, ret); udc->driver =3D NULL; - udc->dev.driver =3D NULL; udc->gadget->dev.driver =3D NULL; return ret; } From nobody Mon Jun 22 15:38:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D912C433F5 for ; Mon, 21 Mar 2022 13:52:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348161AbiCUNyI (ORCPT ); Mon, 21 Mar 2022 09:54:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37010 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348167AbiCUNxr (ORCPT ); Mon, 21 Mar 2022 09:53:47 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 22A92160140; Mon, 21 Mar 2022 06:52:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BE398B81661; Mon, 21 Mar 2022 13:52:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 15929C340E8; Mon, 21 Mar 2022 13:52:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870734; bh=gXKDcqYLKYE2K5j8zlHjN7E6uqE22CiflRKziJavWcc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2AOV2+cJNROu2jzdxVGt7+VMweQpcAtOo6N/+mK7gZ9MtaU9qNIXUXdKD8hMWtmtN lEOMCwCQL7BsZe3aPaP0spIl4zVVuVPmW7dQHIsx3cyegP0AOgjxI1h5p5sRJQcYBN SbgXmSzpKD5yBq905Rck9q9AnvhNWTKo00s3TyIc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Dmitry Torokhov , syzbot+75cccf2b7da87fb6f84b@syzkaller.appspotmail.com Subject: [PATCH 4.9 16/16] Input: aiptek - properly check endpoint type Date: Mon, 21 Mar 2022 14:51:46 +0100 Message-Id: <20220321133217.130534920@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133216.648316863@linuxfoundation.org> References: <20220321133216.648316863@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin commit 5600f6986628dde8881734090588474f54a540a8 upstream. Syzbot reported warning in usb_submit_urb() which is caused by wrong endpoint type. There was a check for the number of endpoints, but not for the type of endpoint. Fix it by replacing old desc.bNumEndpoints check with usb_find_common_endpoints() helper for finding endpoints Fail log: usb 5-1: BOGUS urb xfer, pipe 1 !=3D type 3 WARNING: CPU: 2 PID: 48 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/= 0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU: 2 PID: 48 Comm: kworker/2:2 Not tainted 5.17.0-rc6-syzkaller-00226-g07= ebd38a0da2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Workqueue: usb_hub_wq hub_event ... Call Trace: aiptek_open+0xd5/0x130 drivers/input/tablet/aiptek.c:830 input_open_device+0x1bb/0x320 drivers/input/input.c:629 kbd_connect+0xfe/0x160 drivers/tty/vt/keyboard.c:1593 Fixes: 8e20cf2bce12 ("Input: aiptek - fix crash on detecting device without= endpoints") Reported-and-tested-by: syzbot+75cccf2b7da87fb6f84b@syzkaller.appspotmail.c= om Signed-off-by: Pavel Skripkin Link: https://lore.kernel.org/r/20220308194328.26220-1-paskripkin@gmail.com Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/input/tablet/aiptek.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) --- a/drivers/input/tablet/aiptek.c +++ b/drivers/input/tablet/aiptek.c @@ -1821,15 +1821,13 @@ aiptek_probe(struct usb_interface *intf, input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_M= AX, 0, 0); input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_= MAX - 1, 0, 0); =20 - /* Verify that a device really has an endpoint */ - if (intf->cur_altsetting->desc.bNumEndpoints < 1) { + err =3D usb_find_common_endpoints(intf->cur_altsetting, + NULL, NULL, &endpoint, NULL); + if (err) { dev_err(&intf->dev, - "interface has %d endpoints, but must have minimum 1\n", - intf->cur_altsetting->desc.bNumEndpoints); - err =3D -EINVAL; + "interface has no int in endpoints, but must have minimum 1\n"); goto fail3; } - endpoint =3D &intf->cur_altsetting->endpoint[0].desc; =20 /* Go set up our URB, which is called when the tablet receives * input.