From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6BBC3C433FE for ; Mon, 21 Mar 2022 13:54:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348183AbiCUNzv (ORCPT ); Mon, 21 Mar 2022 09:55:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41988 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348135AbiCUNzR (ORCPT ); Mon, 21 Mar 2022 09:55:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E91975F8E; Mon, 21 Mar 2022 06:53:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8561961267; Mon, 21 Mar 2022 13:53:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 74E47C340E8; Mon, 21 Mar 2022 13:53:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870831; bh=vAZQ/M/BRQUB0ww01IQhGrI7lVL38SEwnRRbfblinfI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PG2cmmSCNQyxvIGqQAVw1l+spMTNXaGJZNpIK1yjn0M/rEJvGjR52GyBCBwL40nwf WcW0lhqhLhpciEar6n+yIVPHBDEPcmZbZs3Q2tr6z6uezCyGvLnuZxQIK8jyuaEY97 XsAzjz6QvXsfLa3u3w1QijajxM3cYjXIpNeAsUYY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xin Long , Marcelo Ricardo Leitner , Jakub Kicinski , Ovidiu Panait Subject: [PATCH 4.14 01/22] sctp: fix the processing for INIT chunk Date: Mon, 21 Mar 2022 14:51:32 +0100 Message-Id: <20220321133217.647673628@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xin Long commit eae5783908042a762c24e1bd11876edb91d314b1 upstream. This patch fixes the problems below: 1. In non-shutdown_ack_sent states: in sctp_sf_do_5_1B_init() and sctp_sf_do_5_2_2_dupinit(): chunk length check should be done before any checks that may cause to send abort, as making packet for abort will access the init_tag from init_hdr in sctp_ootb_pkt_new(). 2. In shutdown_ack_sent state: in sctp_sf_do_9_2_reshutack(): The same checks as does in sctp_sf_do_5_2_2_dupinit() is needed for sctp_sf_do_9_2_reshutack(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sctp/sm_statefuns.c | 71 +++++++++++++++++++++++++++++++------------= ----- 1 file changed, 46 insertions(+), 25 deletions(-) --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -161,6 +161,12 @@ static enum sctp_disposition __sctp_sf_d void *arg, struct sctp_cmd_seq *commands); =20 +static enum sctp_disposition +__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, + const struct sctp_association *asoc, + const union sctp_subtype type, void *arg, + struct sctp_cmd_seq *commands); + /* Small helper function that checks if the chunk length * is of the appropriate length. The 'required_length' argument * is set to be the size of a specific chunk we are testing. @@ -337,6 +343,14 @@ enum sctp_disposition sctp_sf_do_5_1B_in if (!chunk->singleton) return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); =20 + /* Make sure that the INIT chunk has a valid length. + * Normally, this would cause an ABORT with a Protocol Violation + * error, but since we don't have an association, we'll + * just discard the packet. + */ + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); + /* If the packet is an OOTB packet which is temporarily on the * control endpoint, respond with an ABORT. */ @@ -351,14 +365,6 @@ enum sctp_disposition sctp_sf_do_5_1B_in if (chunk->sctp_hdr->vtag !=3D 0) return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); =20 - /* Make sure that the INIT chunk has a valid length. - * Normally, this would cause an ABORT with a Protocol Violation - * error, but since we don't have an association, we'll - * just discard the packet. - */ - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); - /* If the INIT is coming toward a closing socket, we'll send back * and ABORT. Essentially, this catches the race of INIT being * backloged to the socket at the same time as the user isses close(). @@ -1460,19 +1466,16 @@ static enum sctp_disposition sctp_sf_do_ if (!chunk->singleton) return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); =20 + /* Make sure that the INIT chunk has a valid length. */ + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); + /* 3.1 A packet containing an INIT chunk MUST have a zero Verification * Tag. */ if (chunk->sctp_hdr->vtag !=3D 0) return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); =20 - /* Make sure that the INIT chunk has a valid length. - * In this case, we generate a protocol violation since we have - * an association established. - */ - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, - commands); /* Grab the INIT header. */ chunk->subh.init_hdr =3D (struct sctp_inithdr *)chunk->skb->data; =20 @@ -1787,9 +1790,9 @@ static enum sctp_disposition sctp_sf_do_ * its peer. */ if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) { - disposition =3D sctp_sf_do_9_2_reshutack(net, ep, asoc, - SCTP_ST_CHUNK(chunk->chunk_hdr->type), - chunk, commands); + disposition =3D __sctp_sf_do_9_2_reshutack(net, ep, asoc, + SCTP_ST_CHUNK(chunk->chunk_hdr->type), + chunk, commands); if (SCTP_DISPOSITION_NOMEM =3D=3D disposition) goto nomem; =20 @@ -2847,13 +2850,11 @@ enum sctp_disposition sctp_sf_do_9_2_shu * that belong to this association, it should discard the INIT chunk and * retransmit the SHUTDOWN ACK chunk. */ -enum sctp_disposition sctp_sf_do_9_2_reshutack( - struct net *net, - const struct sctp_endpoint *ep, - const struct sctp_association *asoc, - const union sctp_subtype type, - void *arg, - struct sctp_cmd_seq *commands) +static enum sctp_disposition +__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, + const struct sctp_association *asoc, + const union sctp_subtype type, void *arg, + struct sctp_cmd_seq *commands) { struct sctp_chunk *chunk =3D arg; struct sctp_chunk *reply; @@ -2887,6 +2888,26 @@ nomem: return SCTP_DISPOSITION_NOMEM; } =20 +enum sctp_disposition +sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, + const struct sctp_association *asoc, + const union sctp_subtype type, void *arg, + struct sctp_cmd_seq *commands) +{ + struct sctp_chunk *chunk =3D arg; + + if (!chunk->singleton) + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); + + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); + + if (chunk->sctp_hdr->vtag !=3D 0) + return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); + + return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands); +} + /* * sctp_sf_do_ecn_cwr * From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33E51C4332F for ; Mon, 21 Mar 2022 13:55:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344007AbiCUN4r (ORCPT ); Mon, 21 Mar 2022 09:56:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43594 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348288AbiCUNzt (ORCPT ); Mon, 21 Mar 2022 09:55:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5E2DE1AD87; Mon, 21 Mar 2022 06:54:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EF3856125C; Mon, 21 Mar 2022 13:54:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0938AC340ED; Mon, 21 Mar 2022 13:54:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870862; bh=2R5EdeFliltwruAyLjLbDPZfvDIF2S8mV0+QpoUR9Jk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Vxq/ZkvOrbgfgdwdZG+kPsVbMdy2epY9NA6Z3lVmCZ1HJx+zKxKgR5k+o2XcXveu7 RkNdFeSPrZDIjAe9GvtKXeNJf1zaVQw0+NHKEiwMMr36n+NIbm23ncBL4Q3HfCVdJd 73USDoF/mYnz3+bIUmBzbHTFxV4E2t2fYlVIqLoo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xin Long , Marcelo Ricardo Leitner , Jakub Kicinski , Ovidiu Panait Subject: [PATCH 4.14 02/22] sctp: fix the processing for INIT_ACK chunk Date: Mon, 21 Mar 2022 14:51:33 +0100 Message-Id: <20220321133217.676409404@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xin Long commit 438b95a7c98f77d51cbf4db021f41b602d750a3f upstream. Currently INIT_ACK chunk in non-cookie_echoed state is processed in sctp_sf_discard_chunk() to send an abort with the existent asoc's vtag if the chunk length is not valid. But the vtag in the chunk's sctphdr is not verified, which may be exploited by one to cook a malicious chunk to terminal a SCTP asoc. sctp_sf_discard_chunk() also is called in many other places to send an abort, and most of those have this problem. This patch is to fix it by sending abort with the existent asoc's vtag only if the vtag from the chunk's sctphdr is verified in sctp_sf_discard_chunk(). Note on sctp_sf_do_9_1_abort() and sctp_sf_shutdown_pending_abort(), the chunk length has been verified before sctp_sf_discard_chunk(), so replace it with sctp_sf_discard(). On sctp_sf_do_asconf_ack() and sctp_sf_do_asconf(), move the sctp_chunk_length_valid check ahead of sctp_sf_discard_chunk(), then replace it with sctp_sf_discard(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: Jakub Kicinski Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sctp/sm_statefuns.c | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -2221,7 +2221,7 @@ enum sctp_disposition sctp_sf_shutdown_p */ if (SCTP_ADDR_DEL =3D=3D sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); =20 if (!sctp_err_chunk_valid(chunk)) return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); @@ -2267,7 +2267,7 @@ enum sctp_disposition sctp_sf_shutdown_s */ if (SCTP_ADDR_DEL =3D=3D sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); =20 if (!sctp_err_chunk_valid(chunk)) return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); @@ -2537,7 +2537,7 @@ enum sctp_disposition sctp_sf_do_9_1_abo */ if (SCTP_ADDR_DEL =3D=3D sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest)) - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands); + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); =20 if (!sctp_err_chunk_valid(chunk)) return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); @@ -3702,6 +3702,11 @@ enum sctp_disposition sctp_sf_do_asconf( return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); } =20 + /* Make sure that the ASCONF ADDIP chunk has a valid length. */ + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk))) + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, + commands); + /* ADD-IP: Section 4.1.1 * This chunk MUST be sent in an authenticated way by using * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk @@ -3709,13 +3714,7 @@ enum sctp_disposition sctp_sf_do_asconf( * described in [I-D.ietf-tsvwg-sctp-auth]. */ if (!net->sctp.addip_noauth && !chunk->auth) - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, - commands); - - /* Make sure that the ASCONF ADDIP chunk has a valid length. */ - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk))) - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, - commands); + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); =20 hdr =3D (struct sctp_addiphdr *)chunk->skb->data; serial =3D ntohl(hdr->serial); @@ -3844,6 +3843,12 @@ enum sctp_disposition sctp_sf_do_asconf_ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); } =20 + /* Make sure that the ADDIP chunk has a valid length. */ + if (!sctp_chunk_length_valid(asconf_ack, + sizeof(struct sctp_addip_chunk))) + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, + commands); + /* ADD-IP, Section 4.1.2: * This chunk MUST be sent in an authenticated way by using * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk @@ -3851,14 +3856,7 @@ enum sctp_disposition sctp_sf_do_asconf_ * described in [I-D.ietf-tsvwg-sctp-auth]. */ if (!net->sctp.addip_noauth && !asconf_ack->auth) - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, - commands); - - /* Make sure that the ADDIP chunk has a valid length. */ - if (!sctp_chunk_length_valid(asconf_ack, - sizeof(struct sctp_addip_chunk))) - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, - commands); + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); =20 addip_hdr =3D (struct sctp_addiphdr *)asconf_ack->skb->data; rcvd_serial =3D ntohl(addip_hdr->serial); @@ -4435,6 +4433,9 @@ enum sctp_disposition sctp_sf_discard_ch { struct sctp_chunk *chunk =3D arg; =20 + if (asoc && !sctp_vtag_verify(chunk, asoc)) + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); + /* Make sure that the chunk has a valid length. * Since we don't know the chunk type, we use a general * chunkhdr structure to make a comparison. From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97029C433EF for ; Mon, 21 Mar 2022 13:55:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348347AbiCUN5I (ORCPT ); Mon, 21 Mar 2022 09:57:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44934 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348316AbiCUN4L (ORCPT ); Mon, 21 Mar 2022 09:56:11 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A002B37A9E; Mon, 21 Mar 2022 06:54:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 374C26125C; Mon, 21 Mar 2022 13:54:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 42A32C340F2; Mon, 21 Mar 2022 13:54:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870873; bh=F4/YiigTOpulnpghrf0n/n9Hmkg+iZYZBi052GhOdxs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Dwht4DD+NzP5XGnexHKLo1XWByMlbXTylvaBe9JP3kgDBVYX3uOVRYyVzYT90HSzA l1mVCJqPDHwfvoRg+0rwemjadIZQLGV9PRf8g8z8IbOvTsyJUZDS0d/k/Hwpp7mJAo kFIC1/s4t3divEoTWAtz5K66sLKRkAS0KHfAwHvY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yan Yan , Steffen Klassert , Sasha Levin Subject: [PATCH 4.14 03/22] xfrm: Fix xfrm migrate issues when address family changes Date: Mon, 21 Mar 2022 14:51:34 +0100 Message-Id: <20220321133217.705223500@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yan Yan [ Upstream commit e03c3bba351f99ad932e8f06baa9da1afc418e02 ] xfrm_migrate cannot handle address family change of an xfrm_state. The symptons are the xfrm_state will be migrated to a wrong address, and sending as well as receiving packets wil be broken. This commit fixes it by breaking the original xfrm_state_clone method into two steps so as to update the props.family before running xfrm_init_state. As the result, xfrm_state's inner mode, outer mode, type and IP header length in xfrm_state_migrate can be updated with the new address family. Tested with additions to Android's kernel unit test suite: https://android-review.googlesource.com/c/kernel/tests/+/1885354 Signed-off-by: Yan Yan Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/xfrm/xfrm_state.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c index 5164dfe0aa09..2c17fbdd2366 100644 --- a/net/xfrm/xfrm_state.c +++ b/net/xfrm/xfrm_state.c @@ -1421,9 +1421,6 @@ static struct xfrm_state *xfrm_state_clone(struct xfr= m_state *orig, =20 memcpy(&x->mark, &orig->mark, sizeof(x->mark)); =20 - if (xfrm_init_state(x) < 0) - goto error; - x->props.flags =3D orig->props.flags; x->props.extra_flags =3D orig->props.extra_flags; =20 @@ -1501,6 +1498,11 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_st= ate *x, if (!xc) return NULL; =20 + xc->props.family =3D m->new_family; + + if (xfrm_init_state(xc) < 0) + goto error; + memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr)); memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); =20 --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18EE3C433FE for ; Mon, 21 Mar 2022 13:56:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348371AbiCUN51 (ORCPT ); Mon, 21 Mar 2022 09:57:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46098 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348328AbiCUN4M (ORCPT ); Mon, 21 Mar 2022 09:56:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 589E6167DC; Mon, 21 Mar 2022 06:54:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E7CF96126E; Mon, 21 Mar 2022 13:54:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 07723C340E8; Mon, 21 Mar 2022 13:54:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870876; bh=s316ygrdqc1xWuck3n4IO4eDMiOmMRS+C0SCMzq6M5s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AZ5tPpgEurU+aDYxNESB3aFrb3ehBYsMjEDtZ+Y9xO+MRI9p+3OgOSSOH1V7YPV92 NcN94sZWueE3/YTrRbwsS9HdJnTuVNobhzEX1V2HAsfpAmYXKShToJf0P0tB5OShIk 1TvIW6Ou7orb3nOlPqJwQugqqGUtph5JuRc/q0d4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Quentin Schulz , Jakob Unterwurzacher , Quentin Schulz , Heiko Stuebner , Sasha Levin Subject: [PATCH 4.14 04/22] arm64: dts: rockchip: fix rk3399-puma eMMC HS400 signal integrity Date: Mon, 21 Mar 2022 14:51:35 +0100 Message-Id: <20220321133217.734580952@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jakob Unterwurzacher [ Upstream commit 62966cbdda8a92f82d966a45aa671e788b2006f7 ] There are signal integrity issues running the eMMC at 200MHz on Puma RK3399-Q7. Similar to the work-around found for RK3399 Gru boards, lowering the frequency to 100MHz made the eMMC much more stable, so let's lower the frequency to 100MHz. It might be possible to run at 150MHz as on RK3399 Gru boards but only 100MHz was extensively tested. Cc: Quentin Schulz Signed-off-by: Jakob Unterwurzacher Signed-off-by: Quentin Schulz Link: https://lore.kernel.org/r/20220119134948.1444965-1-quentin.schulz@the= obroma-systems.com Signed-off-by: Heiko Stuebner Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boo= t/dts/rockchip/rk3399-puma.dtsi index 0d5679380b2a..70fe6013d17c 100644 --- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi @@ -484,6 +484,12 @@ }; =20 &sdhci { + /* + * Signal integrity isn't great at 200MHz but 100MHz has proven stable + * enough. + */ + max-frequency =3D <100000000>; + bus-width =3D <8>; mmc-hs400-1_8v; mmc-hs400-enhanced-strobe; --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51E14C433EF for ; Mon, 21 Mar 2022 13:55:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348232AbiCUN5U (ORCPT ); Mon, 21 Mar 2022 09:57:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43660 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348336AbiCUN4M (ORCPT ); Mon, 21 Mar 2022 09:56:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 20F3A222BE; Mon, 21 Mar 2022 06:54:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B2E78612AB; Mon, 21 Mar 2022 13:54:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C5D14C340E8; Mon, 21 Mar 2022 13:54:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870879; bh=gIKyQ4lODdq50ZAH5HM9SrfFIo5Lm1+4KheztKKW6EQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MPJcqyBNxUzvUYC9Kd8YErxObn+mdOU3cxfboMpdNJst2NTZmDypXXdNDY4X91Vl4 WWN73g0fIC2EAORJTPPHXVtAu9vUIIGQMMJ7iknpVd6ZpZtmz9U1cWct0/MlXZKzYY nB8kVuzhbgS7JuR0Vk+oDvXUqxq56tsQqsHoh1jA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Corentin Labbe , Krzysztof Kozlowski , Heiko Stuebner , Sasha Levin Subject: [PATCH 4.14 05/22] ARM: dts: rockchip: fix a typo on rk3288 crypto-controller Date: Mon, 21 Mar 2022 14:51:36 +0100 Message-Id: <20220321133217.764480370@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Corentin Labbe [ Upstream commit 3916c3619599a3970d3e6f98fb430b7c46266ada ] crypto-controller had a typo, fix it. In the same time, rename it to just crypto Signed-off-by: Corentin Labbe Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220209120355.1985707-1-clabbe@baylibre.com Signed-off-by: Heiko Stuebner Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/boot/dts/rk3288.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi index 9adb58930c08..872e4e690beb 100644 --- a/arch/arm/boot/dts/rk3288.dtsi +++ b/arch/arm/boot/dts/rk3288.dtsi @@ -943,7 +943,7 @@ status =3D "disabled"; }; =20 - crypto: cypto-controller@ff8a0000 { + crypto: crypto@ff8a0000 { compatible =3D "rockchip,rk3288-crypto"; reg =3D <0x0 0xff8a0000 0x0 0x4000>; interrupts =3D ; --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1148EC433EF for ; Mon, 21 Mar 2022 13:56:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348382AbiCUN5a (ORCPT ); Mon, 21 Mar 2022 09:57:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45346 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348295AbiCUN4R (ORCPT ); Mon, 21 Mar 2022 09:56:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 841EB1697B4; Mon, 21 Mar 2022 06:54:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2BF0BB81644; Mon, 21 Mar 2022 13:54:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7FB0AC340E8; Mon, 21 Mar 2022 13:54:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870881; bh=lxc51a9WGlcODxMTggxCemPJQV294ZWZabUBLDqn77Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=w/MHzJOdAUlZ6N9+kvDwONDfaHP1owoP935rpxbL8hzM2Wsvt3G7OEjDWf/vKQhBo hACzz3JEIbS9dSircUyIQUFrZMqRhTNR7b4aGP3EcDW/YXL6riVHTow2Z4gxe3r3Rp fRjepJkaUHonFOjmVsIWSeFh9UPLeWk1lmJ2pIAM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Lobakin , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.14 06/22] MIPS: smp: fill in sibling and core maps earlier Date: Mon, 21 Mar 2022 14:51:37 +0100 Message-Id: <20220321133217.794437377@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Alexander Lobakin [ Upstream commit f2703def339c793674010cc9f01bfe4980231808 ] After enabling CONFIG_SCHED_CORE (landed during 5.14 cycle), 2-core 2-thread-per-core interAptiv (CPS-driven) started emitting the following: [ 0.025698] CPU1 revision is: 0001a120 (MIPS interAptiv (multi)) [ 0.048183] ------------[ cut here ]------------ [ 0.048187] WARNING: CPU: 1 PID: 0 at kernel/sched/core.c:6025 sched_cor= e_cpu_starting+0x198/0x240 [ 0.048220] Modules linked in: [ 0.048233] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.17.0-rc3+ #35 b7= b319f24073fd9a3c2aa7ad15fb7993eec0b26f [ 0.048247] Stack : 817f0000 00000004 327804c8 810eb050 00000000 0000000= 4 00000000 c314fdd1 [ 0.048278] 830cbd64 819c0000 81800000 817f0000 83070bf4 0000000= 1 830cbd08 00000000 [ 0.048307] 00000000 00000000 815fcbc4 00000000 00000000 0000000= 0 00000000 00000000 [ 0.048334] 00000000 00000000 00000000 00000000 817f0000 0000000= 0 00000000 817f6f34 [ 0.048361] 817f0000 818a3c00 817f0000 00000004 00000000 0000000= 0 4dc33260 0018c933 [ 0.048389] ... [ 0.048396] Call Trace: [ 0.048399] [<8105a7bc>] show_stack+0x3c/0x140 [ 0.048424] [<8131c2a0>] dump_stack_lvl+0x60/0x80 [ 0.048440] [<8108b5c0>] __warn+0xc0/0xf4 [ 0.048454] [<8108b658>] warn_slowpath_fmt+0x64/0x10c [ 0.048467] [<810bd418>] sched_core_cpu_starting+0x198/0x240 [ 0.048483] [<810c6514>] sched_cpu_starting+0x14/0x80 [ 0.048497] [<8108c0f8>] cpuhp_invoke_callback_range+0x78/0x140 [ 0.048510] [<8108d914>] notify_cpu_starting+0x94/0x140 [ 0.048523] [<8106593c>] start_secondary+0xbc/0x280 [ 0.048539] [ 0.048543] ---[ end trace 0000000000000000 ]--- [ 0.048636] Synchronize counters for CPU 1: done. ...for each but CPU 0/boot. Basic debug printks right before the mentioned line say: [ 0.048170] CPU: 1, smt_mask: So smt_mask, which is sibling mask obviously, is empty when entering the function. This is critical, as sched_core_cpu_starting() calculates core-scheduling parameters only once per CPU start, and it's crucial to have all the parameters filled in at that moment (at least it uses cpu_smt_mask() which in fact is `&cpu_sibling_map[cpu]` on MIPS). A bit of debugging led me to that set_cpu_sibling_map() performing the actual map calculation, was being invocated after notify_cpu_start(), and exactly the latter function starts CPU HP callback round (sched_core_cpu_starting() is basically a CPU HP callback). While the flow is same on ARM64 (maps after the notifier, although before calling set_cpu_online()), x86 started calculating sibling maps earlier than starting the CPU HP callbacks in Linux 4.14 (see [0] for the reference). Neither me nor my brief tests couldn't find any potential caveats in calculating the maps right after performing delay calibration, but the WARN splat is now gone. The very same debug prints now yield exactly what I expected from them: [ 0.048433] CPU: 1, smt_mask: 0-1 [0] https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?= id=3D76ce7cfe35ef Signed-off-by: Alexander Lobakin Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/mips/kernel/smp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c index 88be966d3e61..f057b0c34844 100644 --- a/arch/mips/kernel/smp.c +++ b/arch/mips/kernel/smp.c @@ -372,6 +372,9 @@ asmlinkage void start_secondary(void) cpu =3D smp_processor_id(); cpu_data[cpu].udelay_val =3D loops_per_jiffy; =20 + set_cpu_sibling_map(cpu); + set_cpu_core_map(cpu); + cpumask_set_cpu(cpu, &cpu_coherent_mask); notify_cpu_starting(cpu); =20 @@ -383,9 +386,6 @@ asmlinkage void start_secondary(void) /* The CPU is running and counters synchronised, now mark it online */ set_cpu_online(cpu, true); =20 - set_cpu_sibling_map(cpu); - set_cpu_core_map(cpu); - calculate_cpu_foreign_map(); =20 /* --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CED20C433F5 for ; Mon, 21 Mar 2022 13:56:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244257AbiCUN5i (ORCPT ); Mon, 21 Mar 2022 09:57:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46380 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348355AbiCUN4R (ORCPT ); Mon, 21 Mar 2022 09:56:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 657CE16F04C; Mon, 21 Mar 2022 06:54:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0393AB816CA; Mon, 21 Mar 2022 13:54:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6239CC340E8; Mon, 21 Mar 2022 13:54:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870884; bh=qkttfvUkMX8pixr/UYRauWVmlsHrV8EzgM73QaxlJqM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mqc4ZUOBdHtPgx2/96/RYNwhOfbfdJmVJvFfIYb4m8MwVsPyrK/NJJfgbWlaM6BV0 1iAI4XxQcdfjGy5r14KV+5gScsvmv/RLzTajaaxkG2mRVq5iwrBujfaUoY5HY9hxGW AM5FbMQJT5XddhOI27QnyOJ6xTkKEvZuJjOV+Jvc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Julian Braha , "Russell King (Oracle)" , Sasha Levin Subject: [PATCH 4.14 07/22] ARM: 9178/1: fix unmet dependency on BITREVERSE for HAVE_ARCH_BITREVERSE Date: Mon, 21 Mar 2022 14:51:38 +0100 Message-Id: <20220321133217.823471072@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Julian Braha [ Upstream commit 11c57c3ba94da74c3446924260e34e0b1950b5d7 ] Resending this to properly add it to the patch tracker - thanks for letting me know, Arnd :) When ARM is enabled, and BITREVERSE is disabled, Kbuild gives the following warning: WARNING: unmet direct dependencies detected for HAVE_ARCH_BITREVERSE Depends on [n]: BITREVERSE [=3Dn] Selected by [y]: - ARM [=3Dy] && (CPU_32v7M [=3Dn] || CPU_32v7 [=3Dy]) && !CPU_32v6 [=3Dn] This is because ARM selects HAVE_ARCH_BITREVERSE without selecting BITREVERSE, despite HAVE_ARCH_BITREVERSE depending on BITREVERSE. This unmet dependency bug was found by Kismet, a static analysis tool for Kconfig. Please advise if this is not the appropriate solution. Signed-off-by: Julian Braha Signed-off-by: Russell King (Oracle) Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- lib/Kconfig | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/Kconfig b/lib/Kconfig index 8396c4cfa1ab..1a33e9365951 100644 --- a/lib/Kconfig +++ b/lib/Kconfig @@ -16,7 +16,6 @@ config BITREVERSE config HAVE_ARCH_BITREVERSE bool default n - depends on BITREVERSE help This option enables the use of hardware bit-reversal instructions on architectures which support such operations. --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF35AC4321E for ; Mon, 21 Mar 2022 13:58:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348727AbiCUN6M (ORCPT ); Mon, 21 Mar 2022 09:58:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43654 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348307AbiCUN4T (ORCPT ); Mon, 21 Mar 2022 09:56:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 78A5810FE4; Mon, 21 Mar 2022 06:54:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 11B036126A; Mon, 21 Mar 2022 13:54:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 26379C340E8; Mon, 21 Mar 2022 13:54:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870887; bh=nJtRHfaLe5NTL07RaKpu2Xj7ndP+2DVwsE9w+qaCDaI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BmZrkjGVFIUAlDeKWeQiTGkKcZwZPYP8g6rUWaCx95gO3OrrfdleMRN5czMFzG5dZ RhyeBYRXGYmTf8OHr/k4cSMCoybCbTmr00vEsMd9Lgwa2zbZ1ycuYjondA890S3g83 mwdGx+ai0Lja5Dp7XwjtDlgeWFqsodS/LFSi2FGI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Machek , Lad Prabhakar , Ulrich Hecht , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.14 08/22] can: rcar_canfd: rcar_canfd_channel_probe(): register the CAN device when fully ready Date: Mon, 21 Mar 2022 14:51:39 +0100 Message-Id: <20220321133217.853178761@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lad Prabhakar [ Upstream commit c5048a7b2c23ab589f3476a783bd586b663eda5b ] Register the CAN device only when all the necessary initialization is completed. This patch makes sure all the data structures and locks are initialized before registering the CAN device. Link: https://lore.kernel.org/all/20220221225935.12300-1-prabhakar.mahadev-= lad.rj@bp.renesas.com Reported-by: Pavel Machek Signed-off-by: Lad Prabhakar Reviewed-by: Pavel Machek Reviewed-by: Ulrich Hecht Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/rcar/rcar_canfd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_= canfd.c index 786d852a70d5..a1634834b640 100644 --- a/drivers/net/can/rcar/rcar_canfd.c +++ b/drivers/net/can/rcar/rcar_canfd.c @@ -1602,15 +1602,15 @@ static int rcar_canfd_channel_probe(struct rcar_can= fd_global *gpriv, u32 ch, =20 netif_napi_add(ndev, &priv->napi, rcar_canfd_rx_poll, RCANFD_NAPI_WEIGHT); + spin_lock_init(&priv->tx_lock); + devm_can_led_init(ndev); + gpriv->ch[priv->channel] =3D priv; err =3D register_candev(ndev); if (err) { dev_err(&pdev->dev, "register_candev() failed, error %d\n", err); goto fail_candev; } - spin_lock_init(&priv->tx_lock); - devm_can_led_init(ndev); - gpriv->ch[priv->channel] =3D priv; dev_info(&pdev->dev, "device registered (channel %u)\n", priv->channel); return 0; =20 --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 679FCC433F5 for ; Mon, 21 Mar 2022 13:56:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348390AbiCUN5l (ORCPT ); Mon, 21 Mar 2022 09:57:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44934 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348312AbiCUN4U (ORCPT ); Mon, 21 Mar 2022 09:56:20 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 350D52FE59; Mon, 21 Mar 2022 06:54:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C3AC3612A1; Mon, 21 Mar 2022 13:54:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DA596C340E8; Mon, 21 Mar 2022 13:54:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870890; bh=dORWSbmUuQnkXIifjMZm1D83BGzCjw0RGmaor/Jk/98=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DYHB2wvKHo7CegzHzApCwxsWoNU65KITdNtBC6wW+Xg2eAEiUIW3oQXZl9aZzmQAF WY2c/BZ5YFA0DxtJM16pTdJ3PdsXvwQJ4C+naLDa+AJFzuTftAa6DKD6tOjY/PYkse hLda+14kMmRHdHPsLYvBXFHvtRiw9LRg1icgP4nI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, TOTE Robot , Jia-Ju Bai , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 09/22] atm: firestream: check the return value of ioremap() in fs_init() Date: Mon, 21 Mar 2022 14:51:40 +0100 Message-Id: <20220321133217.881927008@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jia-Ju Bai [ Upstream commit d4e26aaea7f82ba884dcb4acfe689406bc092dc3 ] The function ioremap() in fs_init() can fail, so its return value should be checked. Reported-by: TOTE Robot Signed-off-by: Jia-Ju Bai Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/atm/firestream.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c index e7cffd0cc361..3557ff9ecd82 100644 --- a/drivers/atm/firestream.c +++ b/drivers/atm/firestream.c @@ -1692,6 +1692,8 @@ static int fs_init(struct fs_dev *dev) dev->hw_base =3D pci_resource_start(pci_dev, 0); =20 dev->base =3D ioremap(dev->hw_base, 0x1000); + if (!dev->base) + return 1; =20 reset_chip (dev); =20 --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2F6EC433EF for ; Mon, 21 Mar 2022 13:54:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348214AbiCUNz7 (ORCPT ); Mon, 21 Mar 2022 09:55:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42082 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348216AbiCUNzV (ORCPT ); Mon, 21 Mar 2022 09:55:21 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7890EDF3; Mon, 21 Mar 2022 06:53:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 13DD06125C; Mon, 21 Mar 2022 13:53:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0EA3FC340E8; Mon, 21 Mar 2022 13:53:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870834; bh=K3FO2TWXO6pAN8KGOhYItbIUmKhC+J+Tj77X8skAVOI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TFTCbxID9ZRQurubENROskTOTjROhvudKIEsTGBiqMEMHua+dmP13N+nQJ6cVuCSu DoHgaCV09BUVZqmGL9QLGmigdR7uoj0KmCfqdlAAn8zUtV7Cxj6RD8iKt/hJeaAcp3 mv5m5EBAH0BPXzyXf2d3tw67z6QCC3uer8HSfDQ0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sreeramya Soratkal , Johannes Berg , Sasha Levin Subject: [PATCH 4.14 10/22] nl80211: Update bss channel on channel switch for P2P_CLIENT Date: Mon, 21 Mar 2022 14:51:41 +0100 Message-Id: <20220321133217.911595127@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sreeramya Soratkal [ Upstream commit e50b88c4f076242358b66ddb67482b96947438f2 ] The wdev channel information is updated post channel switch only for the station mode and not for the other modes. Due to this, the P2P client still points to the old value though it moved to the new channel when the channel change is induced from the P2P GO. Update the bss channel after CSA channel switch completion for P2P client interface as well. Signed-off-by: Sreeramya Soratkal Link: https://lore.kernel.org/r/1646114600-31479-1-git-send-email-quic_ssra= mya@quicinc.com Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/wireless/nl80211.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index bbc3c876a5d8..7085c54e6e50 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -14777,7 +14777,8 @@ void cfg80211_ch_switch_notify(struct net_device *d= ev, wdev->chandef =3D *chandef; wdev->preset_chandef =3D *chandef; =20 - if (wdev->iftype =3D=3D NL80211_IFTYPE_STATION && + if ((wdev->iftype =3D=3D NL80211_IFTYPE_STATION || + wdev->iftype =3D=3D NL80211_IFTYPE_P2P_CLIENT) && !WARN_ON(!wdev->current_bss)) wdev->current_bss->pub.channel =3D chandef->chan; =20 --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9022EC433EF for ; Mon, 21 Mar 2022 13:54:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348256AbiCUN4E (ORCPT ); Mon, 21 Mar 2022 09:56:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42184 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348282AbiCUNzX (ORCPT ); Mon, 21 Mar 2022 09:55:23 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7158510CC; Mon, 21 Mar 2022 06:53:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0DEFF6126A; Mon, 21 Mar 2022 13:53:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 007CCC340E8; Mon, 21 Mar 2022 13:53:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870837; bh=9UTHSdHsMxTSqtDc4h9uay8BvRiMDiW4mvc8DvxMn4Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rjK5gVyjI4ZT6/rw11byOHc7CX+MaC6H3+5JyrnSH9XqQY6sro9Bm/ylMR9r9+ORw /JbGQtcMiO/HIm2N7/eBA/4f57X7/jsdKtizo/44t8P+LMVAZ7gYGQa6eciuXfDpWX s78R7cHDxT9jp1frco/4qKRzW38/9ZxaG64TThjU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , John Fastabend , Jakub Sitnicki , Daniel Borkmann , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.14 11/22] tcp: make tcp_read_sock() more robust Date: Mon, 21 Mar 2022 14:51:42 +0100 Message-Id: <20220321133217.940648621@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit e3d5ea2c011ecb16fb94c56a659364e6b30fac94 ] If recv_actor() returns an incorrect value, tcp_read_sock() might loop forever. Instead, issue a one time warning and make sure to make progress. Signed-off-by: Eric Dumazet Acked-by: John Fastabend Acked-by: Jakub Sitnicki Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20220302161723.3910001-2-eric.dumazet@gmail= .com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv4/tcp.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index c9f6f28e54f3..a0fd9ef2d2c6 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1657,11 +1657,13 @@ int tcp_read_sock(struct sock *sk, read_descriptor_= t *desc, if (!copied) copied =3D used; break; - } else if (used <=3D len) { - seq +=3D used; - copied +=3D used; - offset +=3D used; } + if (WARN_ON_ONCE(used > len)) + used =3D len; + seq +=3D used; + copied +=3D used; + offset +=3D used; + /* If recv_actor drops the lock (e.g. TCP splice * receive) the skb pointer might be invalid when * getting here: tcp_collapse might have deleted it --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66024C433FE for ; Mon, 21 Mar 2022 13:54:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348286AbiCUN4H (ORCPT ); Mon, 21 Mar 2022 09:56:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42462 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348320AbiCUNz2 (ORCPT ); Mon, 21 Mar 2022 09:55:28 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D76665F8E; Mon, 21 Mar 2022 06:54:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7A635B816C8; Mon, 21 Mar 2022 13:54:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DFC7DC340E8; Mon, 21 Mar 2022 13:53:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870840; bh=QCLclt6Podyl2puOmDCwjqlOCtweKVJusbddgI3eqP4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2eKWnxcU89B1q21FI2jPdLSOTQg4P1dsqK5L7TCn0miT7n86FUxSWy6bwua5INuWC VGkZvZ2I6ZG3/ynMsxbYU4vfAbFT9+DIaus3KTvzdoi4jxxapYIuiH3RpS9vaAP0pn QgVxYPTKM87UaKUeko3Y+BzwzsvfZB0gr0qr5PkE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Niels Dossche , Martin Habets , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 12/22] sfc: extend the locking on mcdi->seqno Date: Mon, 21 Mar 2022 14:51:43 +0100 Message-Id: <20220321133217.970199472@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Niels Dossche [ Upstream commit f1fb205efb0ccca55626fd4ef38570dd16b44719 ] seqno could be read as a stale value outside of the lock. The lock is already acquired to protect the modification of seqno against a possible race condition. Place the reading of this value also inside this locking to protect it against a possible race condition. Signed-off-by: Niels Dossche Acked-by: Martin Habets Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/sfc/mcdi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcd= i.c index 3df872f56289..040b52affe19 100644 --- a/drivers/net/ethernet/sfc/mcdi.c +++ b/drivers/net/ethernet/sfc/mcdi.c @@ -167,9 +167,9 @@ static void efx_mcdi_send_request(struct efx_nic *efx, = unsigned cmd, /* Serialise with efx_mcdi_ev_cpl() and efx_mcdi_ev_death() */ spin_lock_bh(&mcdi->iface_lock); ++mcdi->seqno; + seqno =3D mcdi->seqno & SEQ_MASK; spin_unlock_bh(&mcdi->iface_lock); =20 - seqno =3D mcdi->seqno & SEQ_MASK; xflags =3D 0; if (mcdi->mode =3D=3D MCDI_MODE_EVENTS) xflags |=3D MCDI_HEADER_XFLAGS_EVREQ; --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A80B3C433EF for ; Mon, 21 Mar 2022 13:54:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348323AbiCUN4L (ORCPT ); Mon, 21 Mar 2022 09:56:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42536 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348267AbiCUNz2 (ORCPT ); Mon, 21 Mar 2022 09:55:28 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E1DFA6178; Mon, 21 Mar 2022 06:54:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7D7986125C; Mon, 21 Mar 2022 13:54:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8DEBEC340E8; Mon, 21 Mar 2022 13:54:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870842; bh=wEoJkZLmzdMrIsHPFU3oRk0kM0mMwx+PzxnxITksLjg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iOpYSlYddAj6rXmuIDzLvDeQdDzzHo2F5Os1cEZ09xSdBOzNlCkYzNZu4fmnrDRsJ Ye3p/7wVscUHDO0eLzjCeurAJ8flP4LDNZuswavr9PTt/bSGz6mdUTY2mR57Ry3v45 n60Ah0OyY7f04sfR8GU9N1in9lguwUeYGBKA1mQU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengming Zhou , Shuah Khan , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH 4.14 13/22] kselftest/vm: fix tests build with old libc Date: Mon, 21 Mar 2022 14:51:44 +0100 Message-Id: <20220321133217.999321675@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengming Zhou [ Upstream commit b773827e361952b3f53ac6fa4c4e39ccd632102e ] The error message when I build vm tests on debian10 (GLIBC 2.28): userfaultfd.c: In function `userfaultfd_pagemap_test': userfaultfd.c:1393:37: error: `MADV_PAGEOUT' undeclared (first use in this function); did you mean `MADV_RANDOM'? if (madvise(area_dst, test_pgsize, MADV_PAGEOUT)) ^~~~~~~~~~~~ MADV_RANDOM This patch includes these newer definitions from UAPI linux/mman.h, is useful to fix tests build on systems without these definitions in glibc sys/mman.h. Link: https://lkml.kernel.org/r/20220227055330.43087-2-zhouchengming@byteda= nce.com Signed-off-by: Chengming Zhou Reviewed-by: Shuah Khan Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- tools/testing/selftests/vm/userfaultfd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selft= ests/vm/userfaultfd.c index 1963440f6725..b2c7043c0c30 100644 --- a/tools/testing/selftests/vm/userfaultfd.c +++ b/tools/testing/selftests/vm/userfaultfd.c @@ -60,6 +60,7 @@ #include #include #include +#include #include #include #include --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3048C433EF for ; Mon, 21 Mar 2022 13:54:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348268AbiCUN4P (ORCPT ); Mon, 21 Mar 2022 09:56:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42846 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348172AbiCUNzd (ORCPT ); Mon, 21 Mar 2022 09:55:33 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 330AB6178; Mon, 21 Mar 2022 06:54:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DF33FB816CB; Mon, 21 Mar 2022 13:54:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B548C36AEC; Mon, 21 Mar 2022 13:54:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870845; bh=SBnrSzmZi9VtvJcA7vI5yIsQi0dybMaBTBAxM9wYWXQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ozWCr/8l1fRK8Mv9A/t8b53Y9xV0mpbAU/Y+EZzlu4PhpDn55GmBNHlgVz+ekhkAE 3fyhxKgIujK8mb/HNOAL4BqJXKcR1agi3ifqE0mMko2885udCwctDvtjjhsG9ktXXC R9q7Se6msa7i0B5Qdu3lqP4U1YMHp3xX2wIhXZ8s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lucas Wei Subject: [PATCH 4.14 14/22] fs: sysfs_emit: Remove PAGE_SIZE alignment check Date: Mon, 21 Mar 2022 14:51:45 +0100 Message-Id: <20220321133218.028484709@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lucas Wei For kernel releases older than 4.20, using the SLUB alloctor will cause this alignment check to fail as that allocator did NOT align kmalloc allocations on a PAGE_SIZE boundry. Remove the check for these older kernels as it is a false-positive and causes problems on many devices. Signed-off-by: Lucas Wei Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/sysfs/file.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/fs/sysfs/file.c +++ b/fs/sysfs/file.c @@ -565,8 +565,7 @@ int sysfs_emit(char *buf, const char *fm va_list args; int len; =20 - if (WARN(!buf || offset_in_page(buf), - "invalid sysfs_emit: buf:%p\n", buf)) + if (WARN(!buf, "invalid sysfs_emit: buf:%p\n", buf)) return 0; =20 va_start(args, fmt); From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E18D4C433EF for ; Mon, 21 Mar 2022 13:54:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348297AbiCUN4T (ORCPT ); Mon, 21 Mar 2022 09:56:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348152AbiCUNzh (ORCPT ); Mon, 21 Mar 2022 09:55:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F20229FC6; Mon, 21 Mar 2022 06:54:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A6FF8B816C8; Mon, 21 Mar 2022 13:54:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1C88C340E8; Mon, 21 Mar 2022 13:54:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870848; bh=gLeSm+kYDTDJwYvsRbW95g1ycycVjdO+9MYwfDntsOw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kGdAsvk2hQPL/bep8UjCFAhwwcB/E/fIRmbK47YLfHMJPlZUCs1oGvjcAgxEzY94o LjBRVaDvyDlwyI09/W/mvDNRC2uMkN1xJ2S9LpVo/26I+R0GLRhufTFwLE6xLMbjHx WMFom5nnFB3CJOFN53nbo4qIecDpqHZ+CPnD4bMo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Igor Zhbanov , Ard Biesheuvel , linux-efi@vger.kernel.org, Lukas Wunner , Octavian Purdila , "Rafael J. Wysocki" , Matt Fleming , Sasha Levin Subject: [PATCH 4.14 15/22] efi: fix return value of __setup handlers Date: Mon, 21 Mar 2022 14:51:46 +0100 Message-Id: <20220321133218.057138436@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 9feaf8b387ee0ece9c1d7add308776b502a35d0c ] When "dump_apple_properties" is used on the kernel boot command line, it causes an Unknown parameter message and the string is added to init's argument strings: Unknown kernel command line parameters "dump_apple_properties BOOT_IMAGE=3D/boot/bzImage-517rc6 efivar_ssdt=3Dnewcpu_ssdt", will be passed to user space. Run /sbin/init as init process with arguments: /sbin/init dump_apple_properties with environment: HOME=3D/ TERM=3Dlinux BOOT_IMAGE=3D/boot/bzImage-517rc6 efivar_ssdt=3Dnewcpu_ssdt Similarly when "efivar_ssdt=3Dsomestring" is used, it is added to the Unknown parameter message and to init's environment strings, polluting them (see examples above). Change the return value of the __setup functions to 1 to indicate that the __setup options have been handled. Fixes: 58c5475aba67 ("x86/efi: Retrieve and assign Apple device properties") Fixes: 475fb4e8b2f4 ("efi / ACPI: load SSTDs from EFI variables") Signed-off-by: Randy Dunlap Reported-by: Igor Zhbanov Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Cc: Ard Biesheuvel Cc: linux-efi@vger.kernel.org Cc: Lukas Wunner Cc: Octavian Purdila Cc: "Rafael J. Wysocki" Cc: Matt Fleming Link: https://lore.kernel.org/r/20220301041851.12459-1-rdunlap@infradead.org Signed-off-by: Ard Biesheuvel Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/firmware/efi/apple-properties.c | 2 +- drivers/firmware/efi/efi.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/efi/apple-properties.c b/drivers/firmware/efi= /apple-properties.c index 9f6bcf173b0e..aa42d228762f 100644 --- a/drivers/firmware/efi/apple-properties.c +++ b/drivers/firmware/efi/apple-properties.c @@ -30,7 +30,7 @@ static bool dump_properties __initdata; static int __init dump_properties_enable(char *arg) { dump_properties =3D true; - return 0; + return 1; } =20 __setup("dump_apple_properties", dump_properties_enable); diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c index a3dc6cb7326a..24365601fbbf 100644 --- a/drivers/firmware/efi/efi.c +++ b/drivers/firmware/efi/efi.c @@ -230,7 +230,7 @@ static int __init efivar_ssdt_setup(char *str) memcpy(efivar_ssdt, str, strlen(str)); else pr_warn("efivar_ssdt: name too long: %s\n", str); - return 0; + return 1; } __setup("efivar_ssdt=3D", efivar_ssdt_setup); =20 --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1F22C433F5 for ; Mon, 21 Mar 2022 13:54:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348230AbiCUN4X (ORCPT ); Mon, 21 Mar 2022 09:56:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43078 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347775AbiCUNzh (ORCPT ); Mon, 21 Mar 2022 09:55:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0BA92DF3; Mon, 21 Mar 2022 06:54:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9CD1B612A5; Mon, 21 Mar 2022 13:54:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A7997C340E8; Mon, 21 Mar 2022 13:54:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870851; bh=Fd3GNLBWLpAQg28E20Y5JU8ZhkbdqyTX5nf57xBq0O4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G96mgvT+CnCl2SgxqoknjEWlLFjIDR/IYMVfJPgKB1zVbspBX+5wOCF4XyLGsF0J/ w1ogzYmgHCW68pTf1DaqxBf16KzakWP1n3IQa4yJVPLn120KQxsrEHx2DPxOam3C8P mmB6Uv3I5/z1fbGTFbTWV2CKbA5/PoxiKphJ5bB4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.14 16/22] net/packet: fix slab-out-of-bounds access in packet_recvmsg() Date: Mon, 21 Mar 2022 14:51:47 +0100 Message-Id: <20220321133218.086482158@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit c700525fcc06b05adfea78039de02628af79e07a ] syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH and mmap operations, tpacket_rcv() is queueing skbs with garbage in skb->cb[], triggering a too big copy [1] Presumably, users of af_packet using mmap() already gets correct metadata from the mapped buffer, we can simply make sure to clear 12 bytes that might be copied to user space later. BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:22= 5 [inline] BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x56c/0x1150 net/packet/a= f_packet.c:3489 Write of size 165 at addr ffffc9000385fb78 by task syz-executor233/3631 CPU: 0 PID: 3631 Comm: syz-executor233 Not tainted 5.17.0-rc7-syzkaller-023= 96-g0b3660695e80 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xf/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 memcpy+0x39/0x60 mm/kasan/shadow.c:66 memcpy include/linux/fortify-string.h:225 [inline] packet_recvmsg+0x56c/0x1150 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_recvmsg net/socket.c:962 [inline] ____sys_recvmsg+0x2c4/0x600 net/socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fdfd5954c29 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8e71e48 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fdfd5954c29 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005 RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcf8e71e60 R13: 00000000000f4240 R14: 000000000000c1ff R15: 00007ffcf8e71e54 addr ffffc9000385fb78 is located in stack of task syz-executor233/3631 at o= ffset 32 in frame: ____sys_recvmsg+0x0/0x600 include/linux/uio.h:246 this frame has 1 object: [32, 160) 'addr' Memory state around the buggy address: ffffc9000385fa80: 00 04 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 ffffc9000385fb00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 >ffffc9000385fb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f3 ^ ffffc9000385fc00: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 ffffc9000385fc80: f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.") Signed-off-by: Eric Dumazet Reported-by: syzbot Link: https://lore.kernel.org/r/20220312232958.3535620-1-eric.dumazet@gmail= .com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/packet/af_packet.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 1381bfcb3cf0..92394595920c 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -2285,8 +2285,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct n= et_device *dev, copy_skb =3D skb_get(skb); skb_head =3D skb->data; } - if (copy_skb) + if (copy_skb) { + memset(&PACKET_SKB_CB(copy_skb)->sa.ll, 0, + sizeof(PACKET_SKB_CB(copy_skb)->sa.ll)); skb_set_owner_r(copy_skb, sk); + } } snaplen =3D po->rx_ring.frame_size - macoff; if ((int)snaplen < 0) { @@ -3442,6 +3445,8 @@ static int packet_recvmsg(struct socket *sock, struct= msghdr *msg, size_t len, sock_recv_ts_and_drops(msg, sk, skb); =20 if (msg->msg_name) { + const size_t max_len =3D min(sizeof(skb->cb), + sizeof(struct sockaddr_storage)); int copy_len; =20 /* If the address length field is there to be filled @@ -3464,6 +3469,10 @@ static int packet_recvmsg(struct socket *sock, struc= t msghdr *msg, size_t len, msg->msg_namelen =3D sizeof(struct sockaddr_ll); } } + if (WARN_ON_ONCE(copy_len > max_len)) { + copy_len =3D max_len; + msg->msg_namelen =3D copy_len; + } memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len); } =20 --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC8F6C433EF for ; Mon, 21 Mar 2022 13:55:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348378AbiCUN43 (ORCPT ); Mon, 21 Mar 2022 09:56:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43390 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348251AbiCUNzj (ORCPT ); Mon, 21 Mar 2022 09:55:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C1707E0DE; Mon, 21 Mar 2022 06:54:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 529E1612A8; Mon, 21 Mar 2022 13:54:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 63BD3C340ED; Mon, 21 Mar 2022 13:54:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870853; bh=7zMcjgTn2NOtoAuQKIzw5cpS2d/zarf2aApGV8JU4jw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TiLGlkY30Nw22wOe5fI9bFgU9Aw6Mx1svpFxGlyfq43QMzgXXg4EI8e2UovrjCv7H OGNWxPsJ+XThKoCq6clVM/BTAflap1g0U9He45j3Cm2UPuZ/bp2qVAU07n9Xc7LmIq EjzTMPKZ4YrrzP5cT6O4gbUzY90pc6Msv9opdqno= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 17/22] atm: eni: Add check for dma_map_single Date: Mon, 21 Mar 2022 14:51:48 +0100 Message-Id: <20220321133218.114769298@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 0f74b29a4f53627376cf5a5fb7b0b3fa748a0b2b ] As the potential failure of the dma_map_single(), it should be better to check it and return error if fails. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jiasheng Jiang Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/atm/eni.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c index ffe519663687..e88fad45241f 100644 --- a/drivers/atm/eni.c +++ b/drivers/atm/eni.c @@ -1114,6 +1114,8 @@ DPRINTK("iovcnt =3D %d\n",skb_shinfo(skb)->nr_frags); } paddr =3D dma_map_single(&eni_dev->pci_dev->dev,skb->data,skb->len, DMA_TO_DEVICE); + if (dma_mapping_error(&eni_dev->pci_dev->dev, paddr)) + return enq_next; ENI_PRV_PADDR(skb) =3D paddr; /* prepare DMA queue entries */ j =3D 0; --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68B8CC433F5 for ; Mon, 21 Mar 2022 13:55:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348338AbiCUN4d (ORCPT ); Mon, 21 Mar 2022 09:56:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43454 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348189AbiCUNzr (ORCPT ); Mon, 21 Mar 2022 09:55:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AC483BC28; Mon, 21 Mar 2022 06:54:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3F26E612A5; Mon, 21 Mar 2022 13:54:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 41DD4C340E8; Mon, 21 Mar 2022 13:54:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870856; bh=hEddR5WDs0ROdOM2QtSZh8aTJbRN9Q96gt3rSu+JXPM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BcAFPM9GAt1Wp0Dh1t0DwcADlpgeJVIIckDJQE665sg3vXRo/8ErpG/MmgM4C1Mze IvsozNLlDrPeKIGfs75QDZIKgjAwaSsti88APDMv7/WlMxF63B7iyXOoQbbuA6sl/x IxmNbpZjQo7P4iavwEcJLuDzEJgmFIInnK7n1Y6c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nicolas Dichtel , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.14 18/22] net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit() Date: Mon, 21 Mar 2022 14:51:49 +0100 Message-Id: <20220321133218.143322755@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nicolas Dichtel [ Upstream commit 4ee06de7729d795773145692e246a06448b1eb7a ] This kind of interface doesn't have a mac header. This patch fixes bpf_redirect() to a PIM interface. Fixes: 27b29f63058d ("bpf: add bpf_redirect() helper") Signed-off-by: Nicolas Dichtel Link: https://lore.kernel.org/r/20220315092008.31423-1-nicolas.dichtel@6win= d.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/linux/if_arp.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h index 4125f60ee53b..a9b09c7c2ce0 100644 --- a/include/linux/if_arp.h +++ b/include/linux/if_arp.h @@ -55,6 +55,7 @@ static inline bool dev_is_mac_header_xmit(const struct ne= t_device *dev) case ARPHRD_VOID: case ARPHRD_NONE: case ARPHRD_RAWIP: + case ARPHRD_PIMREG: return false; default: return true; --=20 2.34.1 From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4F6E8C433F5 for ; Mon, 21 Mar 2022 13:55:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348345AbiCUN4l (ORCPT ); Mon, 21 Mar 2022 09:56:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44046 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345041AbiCUNzs (ORCPT ); Mon, 21 Mar 2022 09:55:48 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 86C90764C; Mon, 21 Mar 2022 06:54:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 238C1612A4; Mon, 21 Mar 2022 13:54:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A721C340E8; Mon, 21 Mar 2022 13:54:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870859; bh=4l1eZtJRxcq+KHy0ubD44xMbgLdCnr8lSB3D266hihc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0WGqR417UBCcGcBd0jWd82zjmmOTAIXwLlZdCb3jIDxS1c1imT5L2w0ZdeXUQAQvN 8b5qHNAHjBlLtmGOgumcu+MwK2yK1MK53oDTvTECaGDbzrSbdGGrIRK8iGq8AKM7kh wLo49u/tlN/2TEBP6Ix71Rcnb7Agn8Xvj8PC5vsE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Dan Carpenter Subject: [PATCH 4.14 19/22] usb: gadget: rndis: prevent integer overflow in rndis_set_response() Date: Mon, 21 Mar 2022 14:51:50 +0100 Message-Id: <20220321133218.172738467@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit 65f3324f4b6fed78b8761c3b74615ecf0ffa81fa upstream. If "BufOffset" is very large the "BufOffset + 8" operation can have an integer overflow. Cc: stable@kernel.org Fixes: 38ea1eac7d88 ("usb: gadget: rndis: check size of RNDIS_MSG_SET comma= nd") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20220301080424.GA17208@kili Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/gadget/function/rndis.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/gadget/function/rndis.c +++ b/drivers/usb/gadget/function/rndis.c @@ -643,6 +643,7 @@ static int rndis_set_response(struct rnd BufLength =3D le32_to_cpu(buf->InformationBufferLength); BufOffset =3D le32_to_cpu(buf->InformationBufferOffset); if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || + (BufOffset > RNDIS_MAX_TOTAL_SIZE) || (BufOffset + 8 >=3D RNDIS_MAX_TOTAL_SIZE)) return -EINVAL; From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7C4EC433F5 for ; Mon, 21 Mar 2022 13:55:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347292AbiCUN4w (ORCPT ); Mon, 21 Mar 2022 09:56:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44038 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348234AbiCUN4B (ORCPT ); Mon, 21 Mar 2022 09:56:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 308A810FE4; Mon, 21 Mar 2022 06:54:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B03F56125C; Mon, 21 Mar 2022 13:54:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0F92C340F3; Mon, 21 Mar 2022 13:54:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870865; bh=9vMNZb62DYdqoeF4bjRFvp+m4QYksmbaQVFf/bdLHdY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cOJ9dH2I6W1S70aYbeHTxlM44qbipHTbWfGv3icGd66hcTlSpUwQ2iwBnyWUxxAqC tT1IzWhprOQzvs1U9C4RQrcXMyrleVSba2iEr5NrJesz7GWhHUvMKJiQYiwI124C6F 981v5mrflGqobD6fjbcsy6JDgvdwYV7zunb7pHZU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , syzbot+348b571beb5eeb70a582@syzkaller.appspotmail.com Subject: [PATCH 4.14 20/22] usb: gadget: Fix use-after-free bug by not setting udc->dev.driver Date: Mon, 21 Mar 2022 14:51:51 +0100 Message-Id: <20220321133218.201616182@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 16b1941eac2bd499f065a6739a40ce0011a3d740 upstream. The syzbot fuzzer found a use-after-free bug: BUG: KASAN: use-after-free in dev_uevent+0x712/0x780 drivers/base/core.c:23= 20 Read of size 8 at addr ffff88802b934098 by task udevd/3689 CPU: 2 PID: 3689 Comm: udevd Not tainted 5.17.0-rc4-syzkaller-00229-g4f12b7= 42eb2b #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 dev_uevent+0x712/0x780 drivers/base/core.c:2320 uevent_show+0x1b8/0x380 drivers/base/core.c:2391 dev_attr_show+0x4b/0x90 drivers/base/core.c:2094 Although the bug manifested in the driver core, the real cause was a race with the gadget core. dev_uevent() does: if (dev->driver) add_uevent_var(env, "DRIVER=3D%s", dev->driver->name); and between the test and the dereference of dev->driver, the gadget core sets dev->driver to NULL. The race wouldn't occur if the gadget core registered its devices on a real bus, using the standard synchronization techniques of the driver core. However, it's not necessary to make such a large change in order to fix this bug; all we need to do is make sure that udc->dev.driver is always NULL. In fact, there is no reason for udc->dev.driver ever to be set to anything, let alone to the value it currently gets: the address of the gadget's driver. After all, a gadget driver only knows how to manage a gadget, not how to manage a UDC. This patch simply removes the statements in the gadget core that touch udc->dev.driver. Fixes: 2ccea03a8f7e ("usb: gadget: introduce UDC Class") CC: Reported-and-tested-by: syzbot+348b571beb5eeb70a582@syzkaller.appspotmail.c= om Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YiQgukfFFbBnwJ/9@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/gadget/udc/core.c | 3 --- 1 file changed, 3 deletions(-) --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -1284,7 +1284,6 @@ static void usb_gadget_remove_driver(str usb_gadget_udc_stop(udc); =20 udc->driver =3D NULL; - udc->dev.driver =3D NULL; udc->gadget->dev.driver =3D NULL; } =20 @@ -1333,7 +1332,6 @@ static int udc_bind_to_driver(struct usb driver->function); =20 udc->driver =3D driver; - udc->dev.driver =3D &driver->driver; udc->gadget->dev.driver =3D &driver->driver; =20 usb_gadget_udc_set_speed(udc, driver->max_speed); @@ -1355,7 +1353,6 @@ err1: dev_err(&udc->dev, "failed to start %s: %d\n", udc->driver->function, ret); udc->driver =3D NULL; - udc->dev.driver =3D NULL; udc->gadget->dev.driver =3D NULL; return ret; } From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C050C433F5 for ; Mon, 21 Mar 2022 13:55:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348353AbiCUN47 (ORCPT ); Mon, 21 Mar 2022 09:56:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44040 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348238AbiCUN4B (ORCPT ); Mon, 21 Mar 2022 09:56:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E9A4E2FE4E; Mon, 21 Mar 2022 06:54:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 863D261291; Mon, 21 Mar 2022 13:54:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 966CFC340E8; Mon, 21 Mar 2022 13:54:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870868; bh=gXKDcqYLKYE2K5j8zlHjN7E6uqE22CiflRKziJavWcc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SmhjWkKvJ7KKuxdozjWVBATw0eoFyrce1YVmUx/82NVnBT7MXrK8z54Tb41Kucu0w SAvnI8fJeeC681WcXKcTlruC9+EUIIMDfM61cE/K9jkkuRGIca1aeAmhHTeKYzPoYd +vB6fRn9dPUzx94uiaEcRM7UDAAvmP0a9EBPnY1o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Dmitry Torokhov , syzbot+75cccf2b7da87fb6f84b@syzkaller.appspotmail.com Subject: [PATCH 4.14 21/22] Input: aiptek - properly check endpoint type Date: Mon, 21 Mar 2022 14:51:52 +0100 Message-Id: <20220321133218.230889115@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavel Skripkin commit 5600f6986628dde8881734090588474f54a540a8 upstream. Syzbot reported warning in usb_submit_urb() which is caused by wrong endpoint type. There was a check for the number of endpoints, but not for the type of endpoint. Fix it by replacing old desc.bNumEndpoints check with usb_find_common_endpoints() helper for finding endpoints Fail log: usb 5-1: BOGUS urb xfer, pipe 1 !=3D type 3 WARNING: CPU: 2 PID: 48 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/= 0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU: 2 PID: 48 Comm: kworker/2:2 Not tainted 5.17.0-rc6-syzkaller-00226-g07= ebd38a0da2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Workqueue: usb_hub_wq hub_event ... Call Trace: aiptek_open+0xd5/0x130 drivers/input/tablet/aiptek.c:830 input_open_device+0x1bb/0x320 drivers/input/input.c:629 kbd_connect+0xfe/0x160 drivers/tty/vt/keyboard.c:1593 Fixes: 8e20cf2bce12 ("Input: aiptek - fix crash on detecting device without= endpoints") Reported-and-tested-by: syzbot+75cccf2b7da87fb6f84b@syzkaller.appspotmail.c= om Signed-off-by: Pavel Skripkin Link: https://lore.kernel.org/r/20220308194328.26220-1-paskripkin@gmail.com Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/input/tablet/aiptek.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) --- a/drivers/input/tablet/aiptek.c +++ b/drivers/input/tablet/aiptek.c @@ -1821,15 +1821,13 @@ aiptek_probe(struct usb_interface *intf, input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_M= AX, 0, 0); input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_= MAX - 1, 0, 0); =20 - /* Verify that a device really has an endpoint */ - if (intf->cur_altsetting->desc.bNumEndpoints < 1) { + err =3D usb_find_common_endpoints(intf->cur_altsetting, + NULL, NULL, &endpoint, NULL); + if (err) { dev_err(&intf->dev, - "interface has %d endpoints, but must have minimum 1\n", - intf->cur_altsetting->desc.bNumEndpoints); - err =3D -EINVAL; + "interface has no int in endpoints, but must have minimum 1\n"); goto fail3; } - endpoint =3D &intf->cur_altsetting->endpoint[0].desc; =20 /* Go set up our URB, which is called when the tablet receives * input. From nobody Mon Jun 22 15:38:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00E55C433FE for ; Mon, 21 Mar 2022 13:55:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348216AbiCUN5O (ORCPT ); Mon, 21 Mar 2022 09:57:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44980 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348315AbiCUN4L (ORCPT ); Mon, 21 Mar 2022 09:56:11 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A5945366A9; Mon, 21 Mar 2022 06:54:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 30339B81598; Mon, 21 Mar 2022 13:54:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6E191C340E8; Mon, 21 Mar 2022 13:54:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1647870870; bh=gSfgLPapIDKi4AvNo7RkyNdwPynnYRvGBh1tgWpe270=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kGl/uUWl9UtZEKA4Vdl/twX7E4/SvTId2qX3NvIz97/Yp1rQ+qfo9iB1YOaslq2kn INJGQzm4hEz3+yhIg4yocTdoyXsUTvO4PNzXrbVwZ/zHDDkURtYSJ0CnNGgXYPHmf1 Yyq03wQIxXCqqdCY+7KR7NM3bfME6VXbJk/oAsg4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Petlan , Athira Jajeev , Jiri Olsa , Kajol Jain , Madhavan Srinivasan , Arnaldo Carvalho de Melo Subject: [PATCH 4.14 22/22] perf symbols: Fix symbol size calculation condition Date: Mon, 21 Mar 2022 14:51:53 +0100 Message-Id: <20220321133218.258881747@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220321133217.602054917@linuxfoundation.org> References: <20220321133217.602054917@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Petlan commit 3cf6a32f3f2a45944dd5be5c6ac4deb46bcd3bee upstream. Before this patch, the symbol end address fixup to be called, needed two conditions being met: if (prev->end =3D=3D prev->start && prev->end !=3D curr->start) Where "prev->end =3D=3D prev->start" means that prev is zero-long (and thus needs a fixup) and "prev->end !=3D curr->start" means that fixup hasn't been applied yet However, this logic is incorrect in the following situation: *curr =3D {rb_node =3D {__rb_parent_color =3D 278218928, rb_right =3D 0x0, rb_left =3D 0x0}, start =3D 0xc000000000062354, end =3D 0xc000000000062354, namelen =3D 40, type =3D 2 '\002', binding =3D 0 '\000', idle =3D 0 '\000', ignore =3D 0 '\000', inlined =3D 0 '\000', arch_sym =3D 0 '\000', annotate2 =3D false, name =3D 0x1159739e "kprobe_optinsn_page\t[__builtin__kprobes]"} *prev =3D {rb_node =3D {__rb_parent_color =3D 278219041, rb_right =3D 0x109548b0, rb_left =3D 0x109547c0}, start =3D 0xc000000000062354, end =3D 0xc000000000062354, namelen =3D 12, type =3D 2 '\002', binding =3D 1 '\001', idle =3D 0 '\000', ignore =3D 0 '\000', inlined =3D 0 '\000', arch_sym =3D 0 '\000', annotate2 =3D false, name =3D 0x1095486e "optinsn_slot"} In this case, prev->start =3D=3D prev->end =3D=3D curr->start =3D=3D curr->= end, thus the condition above thinks that "we need a fixup due to zero length of prev symbol, but it has been probably done, since the prev->end =3D=3D curr->start", which is wrong. After the patch, the execution path proceeds to arch__symbols__fixup_end function which fixes up the size of prev symbol by adding page_size to its end offset. Fixes: 3b01a413c196c910 ("perf symbols: Improve kallsyms symbol end addr ca= lculation") Signed-off-by: Michael Petlan Cc: Athira Jajeev Cc: Jiri Olsa Cc: Kajol Jain Cc: Madhavan Srinivasan Link: http://lore.kernel.org/lkml/20220317135536.805-1-mpetlan@redhat.com Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- tools/perf/util/symbol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/tools/perf/util/symbol.c +++ b/tools/perf/util/symbol.c @@ -224,7 +224,7 @@ void symbols__fixup_end(struct rb_root * prev =3D curr; curr =3D rb_entry(nd, struct symbol, rb_node); =20 - if (prev->end =3D=3D prev->start && prev->end !=3D curr->start) + if (prev->end =3D=3D prev->start || prev->end !=3D curr->start) arch__symbols__fixup_end(prev, curr); }