From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5EE20C433F5 for ; Fri, 25 Mar 2022 15:26:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356837AbiCYP1l (ORCPT ); Fri, 25 Mar 2022 11:27:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60304 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376875AbiCYPX3 (ORCPT ); Fri, 25 Mar 2022 11:23:29 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E0D078C7E2; Fri, 25 Mar 2022 08:16:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0DB6DB827DC; Fri, 25 Mar 2022 15:16:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6EAC0C340E9; Fri, 25 Mar 2022 15:16:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221394; bh=Qd4MdwtuOgC2V367/SvCDpDbMUxLTjY6JfrjWW1A8Ao=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qUcM7UExn7OxP7X9RUT6W8BZUVeqKSQggelgtEeoQjAi7DQswL+KG2bH1y6yhZop4 8gTiQElmOiQNS+ABsbE6nP1Jw7OSzLJknz2iP0SAp3SH5tWKSzRXjMwN939jofXxuD u6qN/RXLQJ7VUlxdlJQ2NGolV0anqTbQoae3VbVg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helmut Grohne , Marcel Holtmann , Ismael Ferreras Morezuelas Subject: [PATCH 5.16 01/37] Bluetooth: btusb: Add another Realtek 8761BU Date: Fri, 25 Mar 2022 16:14:11 +0100 Message-Id: <20220325150420.091343100@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helmut Grohne commit 6dfbe29f45fb0bde29213dbd754a79e8bfc6ecef upstream. This device is sometimes wrapped with a label "EDUP". T: Bus=3D01 Lev=3D02 Prnt=3D02 Port=3D02 Cnt=3D03 Dev#=3D107 Spd=3D12 Mx= Ch=3D 0 D: Ver=3D 1.10 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D2550 ProdID=3D8761 Rev=3D 2.00 S: Manufacturer=3DRealtek S: Product=3DBluetooth Radio S: SerialNumber=3D00E04C239987 C:* #Ifs=3D 2 Cfg#=3D 1 Atr=3De0 MxPwr=3D500mA I:* If#=3D 0 Alt=3D 0 #EPs=3D 3 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver= =3Dbtusb E: Ad=3D81(I) Atr=3D03(Int.) MxPS=3D 16 Ivl=3D1ms E: Ad=3D02(O) Atr=3D02(Bulk) MxPS=3D 64 Ivl=3D0ms E: Ad=3D82(I) Atr=3D02(Bulk) MxPS=3D 64 Ivl=3D0ms I:* If#=3D 1 Alt=3D 0 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver= =3Dbtusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 0 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 0 Ivl=3D1ms I: If#=3D 1 Alt=3D 1 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver= =3Dbtusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 9 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 9 Ivl=3D1ms I: If#=3D 1 Alt=3D 2 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver= =3Dbtusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 17 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 17 Ivl=3D1ms I: If#=3D 1 Alt=3D 3 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver= =3Dbtusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 25 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 25 Ivl=3D1ms I: If#=3D 1 Alt=3D 4 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver= =3Dbtusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 33 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 33 Ivl=3D1ms I: If#=3D 1 Alt=3D 5 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver= =3Dbtusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 49 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 49 Ivl=3D1ms Signed-off-by: Helmut Grohne Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1955351 Signed-off-by: Marcel Holtmann Cc: Ismael Ferreras Morezuelas Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -481,6 +481,8 @@ static const struct usb_device_id blackl /* Additional Realtek 8761BU Bluetooth devices */ { USB_DEVICE(0x0b05, 0x190e), .driver_info =3D BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x2550, 0x8761), .driver_info =3D BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, =20 /* Additional Realtek 8821AE Bluetooth devices */ { USB_DEVICE(0x0b05, 0x17dc), .driver_info =3D BTUSB_REALTEK }, From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D74FDC433FE for ; Fri, 25 Mar 2022 15:26:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376574AbiCYP1s (ORCPT ); Fri, 25 Mar 2022 11:27:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42676 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376899AbiCYPXa (ORCPT ); Fri, 25 Mar 2022 11:23:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 04039931AF; Fri, 25 Mar 2022 08:16:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 22048B828F6; Fri, 25 Mar 2022 15:16:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6AB3FC340E9; Fri, 25 Mar 2022 15:16:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221415; bh=tHJ0fvPCozzdBu+3vz3vvpVBOjJkkaJqoVH44eGv5JY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MboxMNUtRY1bpX+sDtxJOIFp3+OfMcyQSCDiHQXeQx6Z/alWCWdB1d3OjOClha+Vu WmI4YuwYwuisez1j88hj74tXLljfRgcBUgl2T596BbfGkCGDjw9YzZj/67qOrtkgpF bX7SBWPJOteTtt866L/DUH+NXdMR/q/GqoZLVP+U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , =?UTF-8?q?=E8=B5=B5=E5=AD=90=E8=BD=A9?= , Stoyan Manolov , Jakub Kicinski Subject: [PATCH 5.16 02/37] llc: fix netdevice reference leaks in llc_ui_bind() Date: Fri, 25 Mar 2022 16:14:12 +0100 Message-Id: <20220325150420.119473739@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Dumazet commit 764f4eb6846f5475f1244767d24d25dd86528a4a upstream. Whenever llc_ui_bind() and/or llc_ui_autobind() took a reference on a netdevice but subsequently fail, they must properly release their reference or risk the infamous message from unregister_netdevice() at device dismantle. unregister_netdevice: waiting for eth0 to become free. Usage count =3D 3 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet Reported-by: =E8=B5=B5=E5=AD=90=E8=BD=A9 Reported-by: Stoyan Manolov Link: https://lore.kernel.org/r/20220323004147.1990845-1-eric.dumazet@gmail= .com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- net/llc/af_llc.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -310,6 +310,10 @@ static int llc_ui_autobind(struct socket sock_reset_flag(sk, SOCK_ZAPPED); rc =3D 0; out: + if (rc) { + dev_put(llc->dev); + llc->dev =3D NULL; + } return rc; } =20 @@ -407,6 +411,10 @@ static int llc_ui_bind(struct socket *so out_put: llc_sap_put(sap); out: + if (rc) { + dev_put(llc->dev); + llc->dev =3D NULL; + } release_sock(sk); return rc; } From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5905BC433FE for ; Fri, 25 Mar 2022 15:27:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376946AbiCYP2P (ORCPT ); Fri, 25 Mar 2022 11:28:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34450 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376951AbiCYPXd (ORCPT ); Fri, 25 Mar 2022 11:23:33 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6FC1B9D06D; Fri, 25 Mar 2022 08:17:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 575A060C86; Fri, 25 Mar 2022 15:16:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D8AEC340E9; Fri, 25 Mar 2022 15:16:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221418; bh=bOkJy+mMiLrQcWXHlmJVF/rdsYha53wcln9168+rGTw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zFchtC3onO8nblxevVfGwueYpyWgIFsK3ePQxmEKrLJ/xanavqtEK70d/zBnjsKuy ZkKDMQLq/Q75A99cWyPRaDj2h7gO02EA8x6cQ1oI5U4KJ4ofrB2764RJPLiLaOGM0z Es+mpoFasJivkdtTJ6sZDCauS1CkVNZmD7m9Cm1k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Palmer , Arnaud POULIQUEN , Takashi Iwai , Arnaud Pouliquen , Mark Brown Subject: [PATCH 5.16 03/37] ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call Date: Fri, 25 Mar 2022 16:14:13 +0100 Message-Id: <20220325150420.147141772@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 455c5653f50e10b4f460ef24e99f0044fbe3401c upstream. This is essentially a revert of the commit dc865fb9e7c2 ("ASoC: sti: Use snd_pcm_stop_xrun() helper"), which converted the manual snd_pcm_stop() calls with snd_pcm_stop_xrun(). The commit above introduced a deadlock as snd_pcm_stop_xrun() itself takes the PCM stream lock while the caller already holds it. Since the conversion was done only for consistency reason and the open-call with snd_pcm_stop() to the XRUN state is a correct usage, let's revert the commit back as the fix. Fixes: dc865fb9e7c2 ("ASoC: sti: Use snd_pcm_stop_xrun() helper") Reported-by: Daniel Palmer Cc: Arnaud POULIQUEN Cc: Link: https://lore.kernel.org/r/20220315091319.3351522-1-daniel@0x0f.com Signed-off-by: Takashi Iwai Reviewed-by: Arnaud Pouliquen Link: https://lore.kernel.org/r/20220315164158.19804-1-tiwai@suse.de Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/soc/sti/uniperif_player.c | 6 +++--- sound/soc/sti/uniperif_reader.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) --- a/sound/soc/sti/uniperif_player.c +++ b/sound/soc/sti/uniperif_player.c @@ -91,7 +91,7 @@ static irqreturn_t uni_player_irq_handle SET_UNIPERIF_ITM_BCLR_FIFO_ERROR(player); =20 /* Stop the player */ - snd_pcm_stop_xrun(player->substream); + snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); } =20 ret =3D IRQ_HANDLED; @@ -105,7 +105,7 @@ static irqreturn_t uni_player_irq_handle SET_UNIPERIF_ITM_BCLR_DMA_ERROR(player); =20 /* Stop the player */ - snd_pcm_stop_xrun(player->substream); + snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); =20 ret =3D IRQ_HANDLED; } @@ -138,7 +138,7 @@ static irqreturn_t uni_player_irq_handle dev_err(player->dev, "Underflow recovery failed\n"); =20 /* Stop the player */ - snd_pcm_stop_xrun(player->substream); + snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); =20 ret =3D IRQ_HANDLED; } --- a/sound/soc/sti/uniperif_reader.c +++ b/sound/soc/sti/uniperif_reader.c @@ -65,7 +65,7 @@ static irqreturn_t uni_reader_irq_handle if (unlikely(status & UNIPERIF_ITS_FIFO_ERROR_MASK(reader))) { dev_err(reader->dev, "FIFO error detected\n"); =20 - snd_pcm_stop_xrun(reader->substream); + snd_pcm_stop(reader->substream, SNDRV_PCM_STATE_XRUN); =20 ret =3D IRQ_HANDLED; } From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 778E5C4321E for ; Fri, 25 Mar 2022 15:27:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376739AbiCYP16 (ORCPT ); Fri, 25 Mar 2022 11:27:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58742 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376968AbiCYPXf (ORCPT ); Fri, 25 Mar 2022 11:23:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9D6B6A5EAB; Fri, 25 Mar 2022 08:17:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D068EB8288D; Fri, 25 Mar 2022 15:17:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2EF80C340E9; Fri, 25 Mar 2022 15:17:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221421; bh=+K+8ORVeew4aVIzDkKIXqrFRlhb+qisqa78eUU2k22Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lImYnvu25m9ASG8kDIT7me/fqDoD0L9xfOeX4jITgTwauDJteirrg30tFkWRgEVi4 m9NY1EVZjb8n+driaLWvqjxcXbcbf6xMIts4SNrU6W4zoClvIsFxYOv/VenZLYuP/E Yq6iDR3tXuGVGe9jP/pwphuEwh098Vbt0ae6mxOQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+72732c532ac1454eeee9@syzkaller.appspotmail.com, Linus Torvalds , Takashi Iwai Subject: [PATCH 5.16 04/37] ALSA: oss: Fix PCM OSS buffer allocation overflow Date: Fri, 25 Mar 2022 16:14:14 +0100 Message-Id: <20220325150420.175382831@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit efb6402c3c4a7c26d97c92d70186424097b6e366 upstream. We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the restrictions to input parameters, it's based only on the hw_params of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INT_MAX, hence it hits WARN_ON(). This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated. In addition, the driver uses array_size() and array3_size() for multiplications to catch overflows for the converted period size and buffer bytes. Reported-by: syzbot+72732c532ac1454eeee9@syzkaller.appspotmail.com Suggested-by: Linus Torvalds Cc: Link: https://lore.kernel.org/r/00000000000085b1b305da5a66f3@google.com Link: https://lore.kernel.org/r/20220318082036.29699-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/core/oss/pcm_oss.c | 12 ++++++++---- sound/core/oss/pcm_plugin.c | 5 ++++- 2 files changed, 12 insertions(+), 5 deletions(-) --- a/sound/core/oss/pcm_oss.c +++ b/sound/core/oss/pcm_oss.c @@ -774,6 +774,11 @@ static int snd_pcm_oss_period_size(struc =20 if (oss_period_size < 16) return -EINVAL; + + /* don't allocate too large period; 1MB period must be enough */ + if (oss_period_size > 1024 * 1024) + return -ENOMEM; + runtime->oss.period_bytes =3D oss_period_size; runtime->oss.period_frames =3D 1; runtime->oss.periods =3D oss_periods; @@ -1043,10 +1048,9 @@ static int snd_pcm_oss_change_params_loc goto failure; } #endif - oss_period_size *=3D oss_frame_size; - - oss_buffer_size =3D oss_period_size * runtime->oss.periods; - if (oss_buffer_size < 0) { + oss_period_size =3D array_size(oss_period_size, oss_frame_size); + oss_buffer_size =3D array_size(oss_period_size, runtime->oss.periods); + if (oss_buffer_size <=3D 0) { err =3D -EINVAL; goto failure; } --- a/sound/core/oss/pcm_plugin.c +++ b/sound/core/oss/pcm_plugin.c @@ -62,7 +62,10 @@ static int snd_pcm_plugin_alloc(struct s width =3D snd_pcm_format_physical_width(format->format); if (width < 0) return width; - size =3D frames * format->channels * width; + size =3D array3_size(frames, format->channels, width); + /* check for too large period size once again */ + if (size > 1024 * 1024) + return -ENOMEM; if (snd_BUG_ON(size % 8)) return -ENXIO; size /=3D 8; From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77C2BC43219 for ; Fri, 25 Mar 2022 15:27:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376846AbiCYP2F (ORCPT ); Fri, 25 Mar 2022 11:28:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40546 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376978AbiCYPXg (ORCPT ); Fri, 25 Mar 2022 11:23:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C94E6A889B; Fri, 25 Mar 2022 08:17:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E671660DE3; Fri, 25 Mar 2022 15:17:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 03BF2C340E9; Fri, 25 Mar 2022 15:17:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221424; bh=lDlR75JvmdZGL+svX2rl8FjKN1R23T2mQOr7DGXMt1M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=y9RIekzx0Rw6X61LG+cyBvEzLIDWdMN6iLOfu7A8ZkL54nprYIjwZetOX86qtr/sS /xkkv0a/iO6oD3TJHl/ygZY0u4Iv6eR9L2iQr2RBITikHU4YJIChUM0bAuyOUlNZp/ jSyGhka2a2YhyWgHVA2h7NCOBrPoNrcUPwLzIPzM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Reza Jahanbakhshi , Takashi Iwai Subject: [PATCH 5.16 05/37] ALSA: usb-audio: add mapping for new Corsair Virtuoso SE Date: Fri, 25 Mar 2022 16:14:15 +0100 Message-Id: <20220325150420.203130693@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Reza Jahanbakhshi commit cd94df1795418056a19ff4cb44eadfc18ac99a57 upstream. New device id for Corsair Virtuoso SE RGB Wireless that currently is not in the mixer_map. This entry in the mixer_map is necessary in order to label its mixer appropriately and allow userspace to pick the correct volume controls. For instance, my own Corsair Virtuoso SE RGB Wireless headset has this new ID and consequently, the sidetone and volume are not working correctly without this change. > sudo lsusb -v | grep -i corsair Bus 007 Device 011: ID 1b1c:0a40 Corsair CORSAIR VIRTUOSO SE Wireless Gam idVendor 0x1b1c Corsair iManufacturer 1 Corsair iProduct 2 CORSAIR VIRTUOSO SE Wireless Gaming Headset Signed-off-by: Reza Jahanbakhshi Cc: Link: https://lore.kernel.org/r/20220304212303.195949-1-reza.jahanbakhshi@g= mail.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/usb/mixer_maps.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/sound/usb/mixer_maps.c +++ b/sound/usb/mixer_maps.c @@ -537,6 +537,16 @@ static const struct usbmix_ctl_map usbmi .map =3D corsair_virtuoso_map, }, { + /* Corsair Virtuoso SE Latest (wired mode) */ + .id =3D USB_ID(0x1b1c, 0x0a3f), + .map =3D corsair_virtuoso_map, + }, + { + /* Corsair Virtuoso SE Latest (wireless mode) */ + .id =3D USB_ID(0x1b1c, 0x0a40), + .map =3D corsair_virtuoso_map, + }, + { /* Corsair Virtuoso (wireless mode) */ .id =3D USB_ID(0x1b1c, 0x0a42), .map =3D corsair_virtuoso_map, From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E517C4321E for ; Fri, 25 Mar 2022 15:34:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377498AbiCYPdc (ORCPT ); Fri, 25 Mar 2022 11:33:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40578 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376979AbiCYPXg (ORCPT ); Fri, 25 Mar 2022 11:23:36 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B5BB0AA025; Fri, 25 Mar 2022 08:17:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6A454B827DC; Fri, 25 Mar 2022 15:17:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BAB6AC340EE; Fri, 25 Mar 2022 15:17:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221427; bh=mP46NGclR+A2sd923ECiEZHIGvMHnYtwMt4wYo9DlsY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=srhofAz2NdNtL4XFKPEVhV/7dQMwezCiYgRaG0rZlvDHJlpUDxT/VCtKfQRCE024R kg7vQvzWmuqsbhAidORp51XySuhzTVFc6tO3dcT+5eDfFJVwPaKhyvsWocUQU/jV7n wN5/qICFDqqiSs1GMQgiyxKtuLUiwJvoCulLmRLc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tim Crawford , Takashi Iwai Subject: [PATCH 5.16 06/37] ALSA: hda/realtek: Add quirk for Clevo NP70PNJ Date: Fri, 25 Mar 2022 16:14:16 +0100 Message-Id: <20220325150420.231371851@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tim Crawford commit 0c20fce13e6e111463e3a15ce3cf6713fe518388 upstream. Fixes headset detection on Clevo NP70PNJ. Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20220304170840.3351-1-tcrawford@system76.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -8949,6 +8949,7 @@ static const struct snd_pci_quirk alc269 SND_PCI_QUIRK(0x1558, 0x8561, "Clevo NH[57][0-9][ER][ACDH]Q", ALC269_FIXU= P_HEADSET_MIC), SND_PCI_QUIRK(0x1558, 0x8562, "Clevo NH[57][0-9]RZ[Q]", ALC269_FIXUP_DMIC= ), SND_PCI_QUIRK(0x1558, 0x8668, "Clevo NP50B[BE]", ALC293_FIXUP_SYSTEM76_MI= C_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x867d, "Clevo NP7[01]PN[HJK]", ALC256_FIXUP_SYSTEM= 76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x8680, "Clevo NJ50LU", ALC293_FIXUP_SYSTEM76_MIC_N= O_PRESENCE), SND_PCI_QUIRK(0x1558, 0x8686, "Clevo NH50[CZ]U", ALC256_FIXUP_MIC_NO_PRES= ENCE_AND_RESUME), SND_PCI_QUIRK(0x1558, 0x8a20, "Clevo NH55DCQ-Y", ALC293_FIXUP_SYSTEM76_MI= C_NO_PRESENCE), From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C248C433EF for ; Fri, 25 Mar 2022 15:27:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376884AbiCYP2L (ORCPT ); Fri, 25 Mar 2022 11:28:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42592 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376983AbiCYPXg (ORCPT ); Fri, 25 Mar 2022 11:23:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8ABD4AC05A; Fri, 25 Mar 2022 08:17:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6BB9360C7E; Fri, 25 Mar 2022 15:17:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7DE72C340E9; Fri, 25 Mar 2022 15:17:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221429; bh=sBRSy/K4NYbEkSC5pIhpeUNtZ96qOrHsEIsb0xOoY5Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TnPGXRWFWxr6x+FgtwYNAprVQXbk5HJDwv9nLkB6CMpP870Pe7K1C1oxNQcAPo7Ww O2vhDzeTMhW9ZeCHRnVQvO/VndjqNeeauzY21g1UOXNH8P2tuw9m5Ofmc+OH9gdoLb nFyuESVoSOLYkSRBbhvgAEiV3kFoZMvfJAnv9jGs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tim Crawford , Takashi Iwai Subject: [PATCH 5.16 07/37] ALSA: hda/realtek: Add quirk for Clevo NP50PNJ Date: Fri, 25 Mar 2022 16:14:17 +0100 Message-Id: <20220325150420.259119064@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tim Crawford commit 9cb727506704b5323998047789fc871e64a6aa14 upstream. Fixes headset detection on Clevo NP50PNJ. Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20220307193229.5141-1-tcrawford@system76.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -8949,6 +8949,7 @@ static const struct snd_pci_quirk alc269 SND_PCI_QUIRK(0x1558, 0x8561, "Clevo NH[57][0-9][ER][ACDH]Q", ALC269_FIXU= P_HEADSET_MIC), SND_PCI_QUIRK(0x1558, 0x8562, "Clevo NH[57][0-9]RZ[Q]", ALC269_FIXUP_DMIC= ), SND_PCI_QUIRK(0x1558, 0x8668, "Clevo NP50B[BE]", ALC293_FIXUP_SYSTEM76_MI= C_NO_PRESENCE), + SND_PCI_QUIRK(0x1558, 0x866d, "Clevo NP5[05]PN[HJK]", ALC256_FIXUP_SYSTEM= 76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x867d, "Clevo NP7[01]PN[HJK]", ALC256_FIXUP_SYSTEM= 76_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x1558, 0x8680, "Clevo NJ50LU", ALC293_FIXUP_SYSTEM76_MIC_N= O_PRESENCE), SND_PCI_QUIRK(0x1558, 0x8686, "Clevo NH50[CZ]U", ALC256_FIXUP_MIC_NO_PRES= ENCE_AND_RESUME), From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7E806C433FE for ; Fri, 25 Mar 2022 15:27:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377009AbiCYP2S (ORCPT ); Fri, 25 Mar 2022 11:28:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377025AbiCYPXj (ORCPT ); Fri, 25 Mar 2022 11:23:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B6ED9BD2E7; Fri, 25 Mar 2022 08:17:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DC795B828F6; Fri, 25 Mar 2022 15:17:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 52D6DC340F3; Fri, 25 Mar 2022 15:17:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221432; bh=WgkLrivE4MY8nQ0slwpeeCm7CLtn2UTdPAeDBIvyKs4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SeclibeOfJ4j28Qwa3aI3w0D2IblOkpWAeRXFCzVVlZaUq3GcAunYOi7s5zfgF8B1 Ch/Yga18dEu899InY0UzeW9xirUp4dijlIpgWRHtAy61QldQghWVqxOdhIyA0i8sQN k7/hyXkvuG1ui8GejzXpflZvYWP6OPzexer38EA0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, huangwenhui , Takashi Iwai Subject: [PATCH 5.16 08/37] ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671 Date: Fri, 25 Mar 2022 16:14:18 +0100 Message-Id: <20220325150420.286957306@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: huangwenhui commit 882bd07f564f97fca6e42ce6ce627ce24ce1ef5a upstream. On a HP 288 Pro G8, the front mic could not be detected.In order to get it working, the pin configuration needs to be set correctly, and the ALC671_FIXUP_HP_HEADSET_MIC2 fixup needs to be applied. Signed-off-by: huangwenhui Cc: Link: https://lore.kernel.org/r/20220311093836.20754-1-huangwenhuia@unionte= ch.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -10911,6 +10911,7 @@ static const struct snd_pci_quirk alc662 SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2), + SND_PCI_QUIRK(0x103c, 0x885f, "HP 288 Pro G8", ALC671_FIXUP_HP_HEADSET_MI= C2), SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE), SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50), SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50), From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4AC2C433EF for ; Fri, 25 Mar 2022 15:28:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377172AbiCYP2a (ORCPT ); Fri, 25 Mar 2022 11:28:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54194 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377048AbiCYPXk (ORCPT ); Fri, 25 Mar 2022 11:23:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1C7DDD082C; Fri, 25 Mar 2022 08:17:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A640FB827E0; Fri, 25 Mar 2022 15:17:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1CCE3C340E9; Fri, 25 Mar 2022 15:17:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221435; bh=lwiHfOehWKXv8eUEDCyQ+9klfyRweBv4MSzqlgnHU8o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0fxk3YIMw2GdetlVTKTuZ7xPqZmcQdjHrd67/6jRzy4peQiyE0kTvInspWPPNJu9w rOkkwb8xmOZgB2YSV9GlaL6DgsipStt5jzII47ncfzHg7oRE5ButMjplYyiSBnVkUw 4/Tg1QlGAuqxYI9uXEP+As2he62WOMTZPoKFLRO4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jason Zheng , Takashi Iwai Subject: [PATCH 5.16 09/37] ALSA: hda/realtek: Add quirk for ASUS GA402 Date: Fri, 25 Mar 2022 16:14:19 +0100 Message-Id: <20220325150420.314693498@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason Zheng commit b7557267c233b55d8e8d7ba4c68cf944fe2ec02c upstream. ASUS GA402 requires a workaround to manage the routing of its 4 speakers like the other ASUS models. Add a corresponding quirk entry to fix it. Signed-off-by: Jason Zheng Cc: Link: https://lore.kernel.org/r/20220313092216.29858-1-jasonzheng2004@gmail= .com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -8866,6 +8866,7 @@ static const struct snd_pci_quirk alc269 SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU50= 2_PINS), SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA40= 1), SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA40= 1), + SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS= _GA401), SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2= ), SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23ABBC4332F for ; Fri, 25 Mar 2022 15:34:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377442AbiCYPd2 (ORCPT ); Fri, 25 Mar 2022 11:33:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60350 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376894AbiCYPXa (ORCPT ); Fri, 25 Mar 2022 11:23:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3FD4D92D3D; Fri, 25 Mar 2022 08:16:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E1837B827B7; Fri, 25 Mar 2022 15:16:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43260C340E9; Fri, 25 Mar 2022 15:16:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221397; bh=q4yisZHCankKIcaEBoaOV+QCs/SEnOGaAYxROdpfo3g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=x6selMHBkKUnfnXN3P9Q7c8WR5OtG+tDjEVNXKf5vF/7ZDez6T1sStsJgEu4DSvGU mpTAieW/ArriGD5YC3iruDW/aU53CjdPx4+14fwCwKEcf8dM5VG9WQdSqSCdbGspsj FTerypWyGn8MWlW0s+nbXaSKGP81uvQYxHza7MM8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hu Jiahui , Jaroslav Kysela , Takashi Iwai Subject: [PATCH 5.16 10/37] ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Date: Fri, 25 Mar 2022 16:14:20 +0100 Message-Id: <20220325150420.342932007@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 92ee3c60ec9fe64404dc035e7c41277d74aa26cb upstream. Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock can't be used for protecting the whole ioctl operations, we need a new mutex to protect those racy calls. This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free ioctl code paths. Along with it, the both functions are slightly modified (the mmap_count check is moved into the state-check block) for code simplicity. Reported-by: Hu Jiahui Cc: Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20220322170720.3529-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- include/sound/pcm.h | 1=20 sound/core/pcm.c | 2 + sound/core/pcm_native.c | 61 ++++++++++++++++++++++++++++++-------------= ----- 3 files changed, 42 insertions(+), 22 deletions(-) --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -398,6 +398,7 @@ struct snd_pcm_runtime { wait_queue_head_t tsleep; /* transfer sleep */ struct fasync_struct *fasync; bool stop_operating; /* sync_stop will be called */ + struct mutex buffer_mutex; /* protect for buffer changes */ =20 /* -- private section -- */ void *private_data; --- a/sound/core/pcm.c +++ b/sound/core/pcm.c @@ -969,6 +969,7 @@ int snd_pcm_attach_substream(struct snd_ init_waitqueue_head(&runtime->tsleep); =20 runtime->status->state =3D SNDRV_PCM_STATE_OPEN; + mutex_init(&runtime->buffer_mutex); =20 substream->runtime =3D runtime; substream->private_data =3D pcm->private_data; @@ -1002,6 +1003,7 @@ void snd_pcm_detach_substream(struct snd } else { substream->runtime =3D NULL; } + mutex_destroy(&runtime->buffer_mutex); kfree(runtime); put_pid(substream->pid); substream->pid =3D NULL; --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -672,33 +672,40 @@ static int snd_pcm_hw_params_choose(stru return 0; } =20 +#if IS_ENABLED(CONFIG_SND_PCM_OSS) +#define is_oss_stream(substream) ((substream)->oss.oss) +#else +#define is_oss_stream(substream) false +#endif + static int snd_pcm_hw_params(struct snd_pcm_substream *substream, struct snd_pcm_hw_params *params) { struct snd_pcm_runtime *runtime; - int err, usecs; + int err =3D 0, usecs; unsigned int bits; snd_pcm_uframes_t frames; =20 if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime =3D substream->runtime; + mutex_lock(&runtime->buffer_mutex); snd_pcm_stream_lock_irq(substream); switch (runtime->status->state) { case SNDRV_PCM_STATE_OPEN: case SNDRV_PCM_STATE_SETUP: case SNDRV_PCM_STATE_PREPARED: + if (!is_oss_stream(substream) && + atomic_read(&substream->mmap_count)) + err =3D -EBADFD; break; default: - snd_pcm_stream_unlock_irq(substream); - return -EBADFD; + err =3D -EBADFD; + break; } snd_pcm_stream_unlock_irq(substream); -#if IS_ENABLED(CONFIG_SND_PCM_OSS) - if (!substream->oss.oss) -#endif - if (atomic_read(&substream->mmap_count)) - return -EBADFD; + if (err) + goto unlock; =20 snd_pcm_sync_stop(substream, true); =20 @@ -786,16 +793,21 @@ static int snd_pcm_hw_params(struct snd_ if (usecs >=3D 0) cpu_latency_qos_add_request(&substream->latency_pm_qos_req, usecs); - return 0; + err =3D 0; _error: - /* hardware might be unusable from this time, - so we force application to retry to set - the correct hardware parameter settings */ - snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN); - if (substream->ops->hw_free !=3D NULL) - substream->ops->hw_free(substream); - if (substream->managed_buffer_alloc) - snd_pcm_lib_free_pages(substream); + if (err) { + /* hardware might be unusable from this time, + * so we force application to retry to set + * the correct hardware parameter settings + */ + snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN); + if (substream->ops->hw_free !=3D NULL) + substream->ops->hw_free(substream); + if (substream->managed_buffer_alloc) + snd_pcm_lib_free_pages(substream); + } + unlock: + mutex_unlock(&runtime->buffer_mutex); return err; } =20 @@ -835,26 +847,31 @@ static int do_hw_free(struct snd_pcm_sub static int snd_pcm_hw_free(struct snd_pcm_substream *substream) { struct snd_pcm_runtime *runtime; - int result; + int result =3D 0; =20 if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime =3D substream->runtime; + mutex_lock(&runtime->buffer_mutex); snd_pcm_stream_lock_irq(substream); switch (runtime->status->state) { case SNDRV_PCM_STATE_SETUP: case SNDRV_PCM_STATE_PREPARED: + if (atomic_read(&substream->mmap_count)) + result =3D -EBADFD; break; default: - snd_pcm_stream_unlock_irq(substream); - return -EBADFD; + result =3D -EBADFD; + break; } snd_pcm_stream_unlock_irq(substream); - if (atomic_read(&substream->mmap_count)) - return -EBADFD; + if (result) + goto unlock; result =3D do_hw_free(substream); snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN); cpu_latency_qos_remove_request(&substream->latency_pm_qos_req); + unlock: + mutex_unlock(&runtime->buffer_mutex); return result; } From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C25EDC433EF for ; Fri, 25 Mar 2022 15:27:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376587AbiCYP1x (ORCPT ); Fri, 25 Mar 2022 11:27:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42344 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376896AbiCYPXa (ORCPT ); Fri, 25 Mar 2022 11:23:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3FE6192D3E; Fri, 25 Mar 2022 08:16:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C9A7BB828FF; Fri, 25 Mar 2022 15:16:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31CA3C340E9; Fri, 25 Mar 2022 15:16:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221400; bh=tgEkpY98C6OTEYG4vogZevvzNca7fU5s/7C33kqAar0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vZrcUGsNjwbm9TcYVhLw3KMSzZKfeWA9eYAEYlxFsYpBzVx/p1uk90XSZxItHfuGO 6yppzrMczho8y7RWNrsR8YyudUGB+7FmDWiWZ0zkTNCHnT7dcyPP18jMdxctzqEqtA XvEBEgdEcuX1ItYc9Im0yVAiLq+5e4JyWye1zqqA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jaroslav Kysela , Takashi Iwai Subject: [PATCH 5.16 11/37] ALSA: pcm: Fix races among concurrent read/write and buffer changes Date: Fri, 25 Mar 2022 16:14:21 +0100 Message-Id: <20220325150420.370767468@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit dca947d4d26dbf925a64a6cfb2ddbc035e831a3d upstream. In the current PCM design, the read/write syscalls (as well as the equivalent ioctls) are allowed before the PCM stream is running, that is, at PCM PREPARED state. Meanwhile, we also allow to re-issue hw_params and hw_free ioctl calls at the PREPARED state that may change or free the buffers, too. The problem is that there is no protection against those mix-ups. This patch applies the previously introduced runtime->buffer_mutex to the read/write operations so that the concurrent hw_params or hw_free call can no longer interfere during the operation. The mutex is unlocked before scheduling, so we don't take it too long. Cc: Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20220322170720.3529-3-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/core/pcm_lib.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/sound/core/pcm_lib.c +++ b/sound/core/pcm_lib.c @@ -1906,9 +1906,11 @@ static int wait_for_avail(struct snd_pcm if (avail >=3D runtime->twake) break; snd_pcm_stream_unlock_irq(substream); + mutex_unlock(&runtime->buffer_mutex); =20 tout =3D schedule_timeout(wait_time); =20 + mutex_lock(&runtime->buffer_mutex); snd_pcm_stream_lock_irq(substream); set_current_state(TASK_INTERRUPTIBLE); switch (runtime->status->state) { @@ -2202,6 +2204,7 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(str =20 nonblock =3D !!(substream->f_flags & O_NONBLOCK); =20 + mutex_lock(&runtime->buffer_mutex); snd_pcm_stream_lock_irq(substream); err =3D pcm_accessible_state(runtime); if (err < 0) @@ -2293,6 +2296,7 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(str if (xfer > 0 && err >=3D 0) snd_pcm_update_state(substream, runtime); snd_pcm_stream_unlock_irq(substream); + mutex_unlock(&runtime->buffer_mutex); return xfer > 0 ? (snd_pcm_sframes_t)xfer : err; } EXPORT_SYMBOL(__snd_pcm_lib_xfer); From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ABCB8C4332F for ; Fri, 25 Mar 2022 15:26:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352970AbiCYP1q (ORCPT ); Fri, 25 Mar 2022 11:27:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42660 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376893AbiCYPXa (ORCPT ); Fri, 25 Mar 2022 11:23:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BE31F931AC; Fri, 25 Mar 2022 08:16:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 02CA360ABA; Fri, 25 Mar 2022 15:16:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1238EC340E9; Fri, 25 Mar 2022 15:16:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221403; bh=/nQyJ9yza8EvDjTUufYTyMFLKSsxxl3K2gQ/ytm00+c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mfxPzao/NFdDlTug1ohXNvyvKOYGlGak+oes/U26G8NQQhESo1vsQDBGk5CRmX7yO IYLVzAi21D4yNQoRRS9tcweFL2zCZ39KRF5IaEK+AQ3OhqM+PE+jI4bmBM9etYyn7c 9X2qOiRp0WR6KLsyiPWbQsu5G0ZFvXW041HLlaKU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jordy Zomer , Krzysztof Kozlowski , "David S. Miller" , Denis Efremov Subject: [PATCH 5.16 12/37] nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION Date: Fri, 25 Mar 2022 16:14:22 +0100 Message-Id: <20220325150420.399016057@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jordy Zomer commit 4fbcc1a4cb20fe26ad0225679c536c80f1648221 upstream. It appears that there are some buffer overflows in EVT_TRANSACTION. This happens because the length parameters that are passed to memcpy come directly from skb->data and are not guarded in any way. Signed-off-by: Jordy Zomer Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller Signed-off-by: Denis Efremov Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/nfc/st21nfca/se.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/nfc/st21nfca/se.c +++ b/drivers/nfc/st21nfca/se.c @@ -316,6 +316,11 @@ int st21nfca_connectivity_event_received return -ENOMEM; =20 transaction->aid_len =3D skb->data[1]; + + /* Checking if the length of the AID is valid */ + if (transaction->aid_len > sizeof(transaction->aid)) + return -EINVAL; + memcpy(transaction->aid, &skb->data[2], transaction->aid_len); =20 @@ -325,6 +330,11 @@ int st21nfca_connectivity_event_received return -EPROTO; =20 transaction->params_len =3D skb->data[transaction->aid_len + 3]; + + /* Total size is allocated (skb->len - 2) minus fixed array members */ + if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_tr= ansaction))) + return -EINVAL; + memcpy(transaction->params, skb->data + transaction->aid_len + 4, transaction->params_len); From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65D9CC43217 for ; Fri, 25 Mar 2022 15:26:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357029AbiCYP1d (ORCPT ); Fri, 25 Mar 2022 11:27:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57778 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376819AbiCYPX0 (ORCPT ); Fri, 25 Mar 2022 11:23:26 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 91E6D7B57E; Fri, 25 Mar 2022 08:16:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DCD1AB828FA; Fri, 25 Mar 2022 15:16:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ED0F8C340E9; Fri, 25 Mar 2022 15:16:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221406; bh=gp++YkMIsw/KZrl9yQMpWARrfRqXAx+5PgIOyaJUvSQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lApX5J3SXHsGZKVJyfj0hnQp6Y3K9qPmvjqFg3hgIvpllOf4I+avb13XxoTtjM4K4 gtmiq9s5nJX9mTY90iHnCPQZ4pqLTDECYfy8nL0IV/Y6xfuuA/C+IjNTKFzA8GIqek whEPKjGLWhwGUK+0ZchgRD4q2S16m5TyIB69+SpQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com, Tadeusz Struk , Willem de Bruijn , Jakub Kicinski Subject: [PATCH 5.16 13/37] net: ipv6: fix skb_over_panic in __ip6_append_data Date: Fri, 25 Mar 2022 16:14:23 +0100 Message-Id: <20220325150420.426763970@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tadeusz Struk commit 5e34af4142ffe68f01c8a9acae83300f8911e20c upstream. Syzbot found a kernel bug in the ipv6 stack: LINK: https://syzkaller.appspot.com/bug?id=3D205d6f11d72329ab8d62a610c44c5e= 7e25415580 The reproducer triggers it by sending a crafted message via sendmmsg() call, which triggers skb_over_panic, and crashes the kernel: skbuff: skb_over_panic: text:ffffffff84647fb4 len:65575 put:65575 head:ffff888109ff0000 data:ffff888109ff0088 tail:0x100af end:0xfec0 dev: Update the check that prevents an invalid packet with MTU equal to the fregment header size to eat up all the space for payload. The reproducer can be found here: LINK: https://syzkaller.appspot.com/text?tag=3DReproC&x=3D1648c83fb00000 Reported-by: syzbot+e223cf47ec8ae183f2a0@syzkaller.appspotmail.com Signed-off-by: Tadeusz Struk Acked-by: Willem de Bruijn Link: https://lore.kernel.org/r/20220310232538.1044947-1-tadeusz.struk@lina= ro.org Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- net/ipv6/ip6_output.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1476,8 +1476,8 @@ static int __ip6_append_data(struct sock sizeof(struct frag_hdr) : 0) + rt->rt6i_nfheader_len; =20 - if (mtu < fragheaderlen || - ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr= )) + if (mtu <=3D fragheaderlen || + ((mtu - fragheaderlen) & ~7) + fragheaderlen <=3D sizeof(struct frag_= hdr)) goto emsgsize; =20 maxfraglen =3D ((mtu - fragheaderlen) & ~7) + fragheaderlen - From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B39C4C4167B for ; Fri, 25 Mar 2022 15:34:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378725AbiCYPfh (ORCPT ); Fri, 25 Mar 2022 11:35:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34164 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376822AbiCYPX1 (ORCPT ); Fri, 25 Mar 2022 11:23:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2CB7EE1247; Fri, 25 Mar 2022 08:16:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0D11C60DE3; Fri, 25 Mar 2022 15:16:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F75DC340E9; Fri, 25 Mar 2022 15:16:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221409; bh=8SAhyuG4jGlA+wi+EXKjrX7dlF5Y3pT/GEqS0lcPxAM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L9IjlYw3W0l28TqXxJCl7XRnXwPhNaZTgt9JFUkZ2vaQ+yTAtzZKt+5jkJCQAtucE GRusRpJrUMHOaDVybkiSR+Eh2RrNQIId5jatdIWEPttOjKQ+TL1DQOQMT1q5PLOxJW LdnhGHAxHXzQpfwzQBhIFLvGDHfsHyD+UiUPVBlc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jarkko Sakkinen , Jason Gunthorpe , linux-integrity@vger.kernel.org, Tadeusz Struk , Tadeusz Struk Subject: [PATCH 5.16 14/37] tpm: Fix error handling in async work Date: Fri, 25 Mar 2022 16:14:24 +0100 Message-Id: <20220325150420.455042317@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tadeusz Struk commit 2e8e4c8f6673247e22efc7985ce5497accd16f88 upstream. When an invalid (non existing) handle is used in a TPM command, that uses the resource manager interface (/dev/tpmrm0) the resource manager tries to load it from its internal cache, but fails and the tpm_dev_transmit returns an -EINVAL error to the caller. The existing async handler doesn't handle these error cases currently and the condition in the poll handler never returns mask with EPOLLIN set. The result is that the poll call blocks and the application gets stuck until the user_read_timer wakes it up after 120 sec. Change the tpm_dev_async_work function to handle error conditions returned from tpm_dev_transmit they are also reflected in the poll mask and a correct error code could passed back to the caller. Cc: Jarkko Sakkinen Cc: Jason Gunthorpe Cc: Cc: Cc: Fixes: 9e1b74a63f77 ("tpm: add support for nonblocking operation") Tested-by: Jarkko Sakkinen Signed-off-by: Tadeusz Struk Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen Cc: Tadeusz Struk Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/char/tpm/tpm-dev-common.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/drivers/char/tpm/tpm-dev-common.c +++ b/drivers/char/tpm/tpm-dev-common.c @@ -69,7 +69,13 @@ static void tpm_dev_async_work(struct wo ret =3D tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer, sizeof(priv->data_buffer)); tpm_put_ops(priv->chip); - if (ret > 0) { + + /* + * If ret is > 0 then tpm_dev_transmit returned the size of the + * response. If ret is < 0 then tpm_dev_transmit failed and + * returned an error code. + */ + if (ret !=3D 0) { priv->response_length =3D ret; mod_timer(&priv->user_read_timer, jiffies + (120 * HZ)); } From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 31D8CC43219 for ; Fri, 25 Mar 2022 15:27:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377070AbiCYP2Y (ORCPT ); Fri, 25 Mar 2022 11:28:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57778 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376917AbiCYPXb (ORCPT ); Fri, 25 Mar 2022 11:23:31 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A8067972B2; Fri, 25 Mar 2022 08:17:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DBBE860C7E; Fri, 25 Mar 2022 15:16:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ED0F8C340E9; Fri, 25 Mar 2022 15:16:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221412; bh=kicBNNucxakRS3E2qZE8FCkVQHqIfvzJ9ucZuCzm7a4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LPKjeRozUxgbVdVevDgIB76EZqAJ6kqQahTCJQyUUkADSOqTm34zkr1M931+NL9Ba hGBGzQFpHJ8srn0/r6x5vFrTlDZaijq7LxnULJUKhtshqS+IqWO8RKCunWTCjl3I/3 VtA2KjBOnXiYTOERNJZMiazkMWGRXfY+qiL8cvSE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jaroslav Kysela , Takashi Iwai Subject: [PATCH 5.16 15/37] ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls Date: Fri, 25 Mar 2022 16:14:25 +0100 Message-Id: <20220325150420.483429814@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 3c3201f8c7bb77eb53b08a3ca8d9a4ddc500b4c0 upstream. Like the previous fixes to hw_params and hw_free ioctl races, we need to paper over the concurrent prepare ioctl calls against hw_params and hw_free, too. This patch implements the locking with the existing runtime->buffer_mutex for prepare ioctls. Unlike the previous case for snd_pcm_hw_hw_params() and snd_pcm_hw_free(), snd_pcm_prepare() is performed to the linked streams, hence the lock can't be applied simply on the top. For tracking the lock in each linked substream, we modify snd_pcm_action_group() slightly and apply the buffer_mutex for the case stream_lock=3Dfalse (formerly there was no lock applied) there. Cc: Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20220322170720.3529-4-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/core/pcm_native.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -1177,15 +1177,17 @@ struct action_ops { static int snd_pcm_action_group(const struct action_ops *ops, struct snd_pcm_substream *substream, snd_pcm_state_t state, - bool do_lock) + bool stream_lock) { struct snd_pcm_substream *s =3D NULL; struct snd_pcm_substream *s1; int res =3D 0, depth =3D 1; =20 snd_pcm_group_for_each_entry(s, substream) { - if (do_lock && s !=3D substream) { - if (s->pcm->nonatomic) + if (s !=3D substream) { + if (!stream_lock) + mutex_lock_nested(&s->runtime->buffer_mutex, depth); + else if (s->pcm->nonatomic) mutex_lock_nested(&s->self_group.mutex, depth); else spin_lock_nested(&s->self_group.lock, depth); @@ -1213,18 +1215,18 @@ static int snd_pcm_action_group(const st ops->post_action(s, state); } _unlock: - if (do_lock) { - /* unlock streams */ - snd_pcm_group_for_each_entry(s1, substream) { - if (s1 !=3D substream) { - if (s1->pcm->nonatomic) - mutex_unlock(&s1->self_group.mutex); - else - spin_unlock(&s1->self_group.lock); - } - if (s1 =3D=3D s) /* end */ - break; + /* unlock streams */ + snd_pcm_group_for_each_entry(s1, substream) { + if (s1 !=3D substream) { + if (!stream_lock) + mutex_unlock(&s1->runtime->buffer_mutex); + else if (s1->pcm->nonatomic) + mutex_unlock(&s1->self_group.mutex); + else + spin_unlock(&s1->self_group.lock); } + if (s1 =3D=3D s) /* end */ + break; } return res; } @@ -1354,10 +1356,12 @@ static int snd_pcm_action_nonatomic(cons =20 /* Guarantee the group members won't change during non-atomic action */ down_read(&snd_pcm_link_rwsem); + mutex_lock(&substream->runtime->buffer_mutex); if (snd_pcm_stream_linked(substream)) res =3D snd_pcm_action_group(ops, substream, state, false); else res =3D snd_pcm_action_single(ops, substream, state); + mutex_unlock(&substream->runtime->buffer_mutex); up_read(&snd_pcm_link_rwsem); return res; } From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB8FBC433F5 for ; Fri, 25 Mar 2022 15:34:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378089AbiCYPeW (ORCPT ); Fri, 25 Mar 2022 11:34:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42864 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377625AbiCYPYX (ORCPT ); Fri, 25 Mar 2022 11:24:23 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C7252DD96F; Fri, 25 Mar 2022 08:18:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6422EB827DC; Fri, 25 Mar 2022 15:18:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CAA52C340E9; Fri, 25 Mar 2022 15:18:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221501; bh=5rCFA85s5S+qiRWrhD5HCF9nWwgiP1x6tSx3WyKd6t0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lehHPUHPcM2HmzqfuaBuAqp0rjeyuAchPpG3rbdnQZRo3Y4jXTymeLF6wJ2skA1Qr JBWqV2y0zSzQikKr5JhbANkkl18yzLIegx7pm4P6V49oAcTi53qvvBjvwOgX3pJyjT HLVx3D21dLs3ZpeuWmcX5/JPPDj4xHgW+EpgxlLI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jaroslav Kysela , Takashi Iwai Subject: [PATCH 5.16 16/37] ALSA: pcm: Fix races among concurrent prealloc proc writes Date: Fri, 25 Mar 2022 16:14:26 +0100 Message-Id: <20220325150420.511592283@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 69534c48ba8ce552ce383b3dfdb271ffe51820c3 upstream. We have no protection against concurrent PCM buffer preallocation changes via proc files, and it may potentially lead to UAF or some weird problem. This patch applies the PCM open_mutex to the proc write operation for avoiding the racy proc writes and the PCM stream open (and further operations). Cc: Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20220322170720.3529-5-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/core/pcm_memory.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) --- a/sound/core/pcm_memory.c +++ b/sound/core/pcm_memory.c @@ -163,19 +163,20 @@ static void snd_pcm_lib_preallocate_proc size_t size; struct snd_dma_buffer new_dmab; =20 + mutex_lock(&substream->pcm->open_mutex); if (substream->runtime) { buffer->error =3D -EBUSY; - return; + goto unlock; } if (!snd_info_get_line(buffer, line, sizeof(line))) { snd_info_get_str(str, line, sizeof(str)); size =3D simple_strtoul(str, NULL, 10) * 1024; if ((size !=3D 0 && size < 8192) || size > substream->dma_max) { buffer->error =3D -EINVAL; - return; + goto unlock; } if (substream->dma_buffer.bytes =3D=3D size) - return; + goto unlock; memset(&new_dmab, 0, sizeof(new_dmab)); new_dmab.dev =3D substream->dma_buffer.dev; if (size > 0) { @@ -189,7 +190,7 @@ static void snd_pcm_lib_preallocate_proc substream->pcm->card->number, substream->pcm->device, substream->stream ? 'c' : 'p', substream->number, substream->pcm->name, size); - return; + goto unlock; } substream->buffer_bytes_max =3D size; } else { @@ -201,6 +202,8 @@ static void snd_pcm_lib_preallocate_proc } else { buffer->error =3D -EINVAL; } + unlock: + mutex_unlock(&substream->pcm->open_mutex); } =20 static inline void preallocate_info_init(struct snd_pcm_substream *substre= am) From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6BFA1C43217 for ; Fri, 25 Mar 2022 15:27:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377237AbiCYP2f (ORCPT ); Fri, 25 Mar 2022 11:28:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60410 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377093AbiCYPXr (ORCPT ); Fri, 25 Mar 2022 11:23:47 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 08778E541A; Fri, 25 Mar 2022 08:17:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9921BB827DC; Fri, 25 Mar 2022 15:17:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E728BC340F3; Fri, 25 Mar 2022 15:17:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221441; bh=ZL+8ydCMGRKhWsfFAPutnN1aOnRs3fe+7ylbkThUBKE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X+Hl4cTnn/TZvlAIv5m6iO/Mbob13xWxjpWZwj/HnV1ZJw5h8tXx7E8VT2G7aJf6V SPDQwAh88ZTZYF4UhoTVLSls5Q4hgPuXXfsNniuhiMGlKdLYpvFh/JZ5QcQuv2/9pE 4H973lBfTPTRw2rF1aexEOQ+7ErQkqy6mMYqW2rQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jaroslav Kysela , Takashi Iwai Subject: [PATCH 5.16 17/37] ALSA: pcm: Add stream lock during PCM reset ioctl operations Date: Fri, 25 Mar 2022 16:14:27 +0100 Message-Id: <20220325150420.538975999@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 1f68915b2efd0d6bfd6e124aa63c94b3c69f127c upstream. snd_pcm_reset() is a non-atomic operation, and it's allowed to run during the PCM stream running. It implies that the manipulation of hw_ptr and other parameters might be racy. This patch adds the PCM stream lock at appropriate places in snd_pcm_*_reset() actions for covering that. Cc: Reviewed-by: Jaroslav Kysela Link: https://lore.kernel.org/r/20220322171325.4355-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/core/pcm_native.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -1851,11 +1851,13 @@ static int snd_pcm_do_reset(struct snd_p int err =3D snd_pcm_ops_ioctl(substream, SNDRV_PCM_IOCTL1_RESET, NULL); if (err < 0) return err; + snd_pcm_stream_lock_irq(substream); runtime->hw_ptr_base =3D 0; runtime->hw_ptr_interrupt =3D runtime->status->hw_ptr - runtime->status->hw_ptr % runtime->period_size; runtime->silence_start =3D runtime->status->hw_ptr; runtime->silence_filled =3D 0; + snd_pcm_stream_unlock_irq(substream); return 0; } =20 @@ -1863,10 +1865,12 @@ static void snd_pcm_post_reset(struct sn snd_pcm_state_t state) { struct snd_pcm_runtime *runtime =3D substream->runtime; + snd_pcm_stream_lock_irq(substream); runtime->control->appl_ptr =3D runtime->status->hw_ptr; if (substream->stream =3D=3D SNDRV_PCM_STREAM_PLAYBACK && runtime->silence_size > 0) snd_pcm_playback_silence(substream, ULONG_MAX); + snd_pcm_stream_unlock_irq(substream); } =20 static const struct action_ops snd_pcm_action_reset =3D { From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4DA2CC433FE for ; Fri, 25 Mar 2022 15:31:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376724AbiCYPcn (ORCPT ); Fri, 25 Mar 2022 11:32:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42676 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377410AbiCYPYI (ORCPT ); Fri, 25 Mar 2022 11:24:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 499C56A00C; Fri, 25 Mar 2022 08:17:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E3698B827E0; Fri, 25 Mar 2022 15:17:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5B0EDC340E9; Fri, 25 Mar 2022 15:17:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221472; bh=xdY4I81YJ/lcJTydX2z5QiXTyr0xfg7lp1PlCRneQis=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v8Sd2/2nwdaMGsNsa6ClJORRy87QQOju/x1S1xzBwx+cil2iSAfGggIuoiTgKKCaF KkdUu97uc5ppXE1odVEjavtOZ1LaSG4fnln+bPEW2hCL2z03vhU5tnnufvEvYAPqLU tfP9zutNI9T6o698oGa+MyfGjKjKbYryqIr4AkJk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars-Peter Clausen , Takashi Iwai Subject: [PATCH 5.16 18/37] ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB Date: Fri, 25 Mar 2022 16:14:28 +0100 Message-Id: <20220325150420.567067829@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lars-Peter Clausen commit 0f306cca42fe879694fb5e2382748c43dc9e0196 upstream. For the RODE NT-USB the lowest Playback mixer volume setting mutes the audio output. But it is not reported as such causing e.g. PulseAudio to accidentally mute the device when selecting a low volume. Fix this by applying the existing quirk for this kind of issue when the device is detected. Signed-off-by: Lars-Peter Clausen Cc: Link: https://lore.kernel.org/r/20220311201400.235892-1-lars@metafoo.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/usb/mixer_quirks.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/sound/usb/mixer_quirks.c +++ b/sound/usb/mixer_quirks.c @@ -3362,9 +3362,10 @@ void snd_usb_mixer_fu_apply_quirk(struct if (unitid =3D=3D 7 && cval->control =3D=3D UAC_FU_VOLUME) snd_dragonfly_quirk_db_scale(mixer, cval, kctl); break; - /* lowest playback value is muted on C-Media devices */ - case USB_ID(0x0d8c, 0x000c): - case USB_ID(0x0d8c, 0x0014): + /* lowest playback value is muted on some devices */ + case USB_ID(0x0d8c, 0x000c): /* C-Media */ + case USB_ID(0x0d8c, 0x0014): /* C-Media */ + case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */ if (strstr(kctl->id.name, "Playback")) cval->min_mute =3D 1; break; From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93000C433EF for ; Fri, 25 Mar 2022 15:28:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376537AbiCYP3i (ORCPT ); Fri, 25 Mar 2022 11:29:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40546 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377465AbiCYPYM (ORCPT ); Fri, 25 Mar 2022 11:24:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 13D63DEA3; Fri, 25 Mar 2022 08:18:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AE226B827DC; Fri, 25 Mar 2022 15:18:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 07766C340EE; Fri, 25 Mar 2022 15:18:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221481; bh=dlt1A1biLcVDgMxTU/Y7y85mBaY6WRz6rpXrh1D3VB0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0hhstwjCKrg7Lzh69/uqFyJqudTRbJD0eu8W+Cm6XAvzZ0K4WdS9zQeWxRlo2eyJj 4sl6xsJ0M0+gXxJ6xe4L8MB4MGxr/nOaKnx8gpUM6L/SGFP/O4DykFfFr6MMvcR42s 3aasYRC+ArXYbvA18EzpzW0TX+B2mICFDVqZR2oA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Teh , Takashi Iwai Subject: [PATCH 5.16 19/37] ALSA: cmipci: Restore aux vol on suspend/resume Date: Fri, 25 Mar 2022 16:14:29 +0100 Message-Id: <20220325150420.595406186@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jonathan Teh commit c14231cc04337c2c2a937db084af342ce704dbde upstream. Save and restore CM_REG_AUX_VOL instead of register 0x24 twice on suspend/resume. Tested on CMI8738LX. Fixes: cb60e5f5b2b1 ("[ALSA] cmipci - Add PM support") Signed-off-by: Jonathan Teh Cc: Link: https://lore.kernel.org/r/DBAPR04MB7366CB3EA9C8521C35C56E8B920E9@DBAP= R04MB7366.eurprd04.prod.outlook.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/pci/cmipci.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/sound/pci/cmipci.c +++ b/sound/pci/cmipci.c @@ -298,7 +298,6 @@ MODULE_PARM_DESC(joystick_port, "Joystic #define CM_MICGAINZ 0x01 /* mic boost */ #define CM_MICGAINZ_SHIFT 0 =20 -#define CM_REG_MIXER3 0x24 #define CM_REG_AUX_VOL 0x26 #define CM_VAUXL_MASK 0xf0 #define CM_VAUXR_MASK 0x0f @@ -3265,7 +3264,7 @@ static int snd_cmipci_probe(struct pci_d */ static const unsigned char saved_regs[] =3D { CM_REG_FUNCTRL1, CM_REG_CHFORMAT, CM_REG_LEGACY_CTRL, CM_REG_MISC_CTRL, - CM_REG_MIXER0, CM_REG_MIXER1, CM_REG_MIXER2, CM_REG_MIXER3, CM_REG_PLL, + CM_REG_MIXER0, CM_REG_MIXER1, CM_REG_MIXER2, CM_REG_AUX_VOL, CM_REG_PLL, CM_REG_CH0_FRAME1, CM_REG_CH0_FRAME2, CM_REG_CH1_FRAME1, CM_REG_CH1_FRAME2, CM_REG_EXT_MISC, CM_REG_INT_STATUS, CM_REG_INT_HLDCLR, CM_REG_FUNCTRL0, From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA4F2C3527A for ; Fri, 25 Mar 2022 15:34:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377848AbiCYPeL (ORCPT ); Fri, 25 Mar 2022 11:34:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58956 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377481AbiCYPYM (ORCPT ); Fri, 25 Mar 2022 11:24:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E0C3627B08; Fri, 25 Mar 2022 08:18:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AFE1D60A1B; Fri, 25 Mar 2022 15:18:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF2B1C340E9; Fri, 25 Mar 2022 15:18:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221484; bh=JCOVLHohscIa00QIH1ZFiQHu3Zt5Fac47pp88wkyeaI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wzuzrd1mMtm6ShMlINRBcSejd/ky1INO+WpnL597n+3Aq8vqPwGy8k1qoRH37Z/jo FGwL+YE0ZbPfKX04Yvpjn6tGgcogSsYuR4OESVchG6gwF2fmviLViBr0hSLRC+q3vy rWgiwDltRZrVFnBJFgjyoE4HdpxfW3qWjr+gBoyM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Giacomo Guiduzzi , Paolo Valente , Takashi Iwai Subject: [PATCH 5.16 20/37] ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec Date: Fri, 25 Mar 2022 16:14:30 +0100 Message-Id: <20220325150420.623331887@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Giacomo Guiduzzi commit 17aaf0193392cb3451bf0ac75ba396ec4cbded6e upstream. Tests 72 and 78 for ALSA in kselftest fail due to reading inconsistent values from some devices on a VirtualBox Virtual Machine using the snd_intel8x0 driver for the AC'97 Audio Controller device. Taking for example test number 72, this is what the test reports: "Surround Playback Volume.0 expected 1 but read 0, is_volatile 0" "Surround Playback Volume.1 expected 0 but read 1, is_volatile 0" These errors repeat for each value from 0 to 31. Taking a look at these error messages it is possible to notice that the written values are read back swapped. When the write is performed, these values are initially stored in an array used to sanity-check them and write them in the pcmreg array. To write them, the two one-byte values are packed together in a two-byte variable through bitwise operations: the first value is shifted left by one byte and the second value is stored in the right byte through a bitwise OR. When reading the values back, right shifts are performed to retrieve the previously stored bytes. These shifts are executed in the wrong order, thus reporting the values swapped as shown above. This patch fixes this mistake by reversing the read operations' order. Signed-off-by: Giacomo Guiduzzi Signed-off-by: Paolo Valente Cc: Link: https://lore.kernel.org/r/20220322200653.15862-1-guiduzzi.giacomo@gma= il.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- sound/pci/ac97/ac97_codec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/sound/pci/ac97/ac97_codec.c +++ b/sound/pci/ac97/ac97_codec.c @@ -938,8 +938,8 @@ static int snd_ac97_ad18xx_pcm_get_volum int codec =3D kcontrol->private_value & 3; =09 mutex_lock(&ac97->page_mutex); - ucontrol->value.integer.value[0] =3D 31 - ((ac97->spec.ad18xx.pcmreg[code= c] >> 0) & 31); - ucontrol->value.integer.value[1] =3D 31 - ((ac97->spec.ad18xx.pcmreg[code= c] >> 8) & 31); + ucontrol->value.integer.value[0] =3D 31 - ((ac97->spec.ad18xx.pcmreg[code= c] >> 8) & 31); + ucontrol->value.integer.value[1] =3D 31 - ((ac97->spec.ad18xx.pcmreg[code= c] >> 0) & 31); mutex_unlock(&ac97->page_mutex); return 0; } From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC05AC433EF for ; Fri, 25 Mar 2022 15:27:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376669AbiCYP3X (ORCPT ); Fri, 25 Mar 2022 11:29:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33038 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377494AbiCYPYN (ORCPT ); Fri, 25 Mar 2022 11:24:13 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BF271606EF; Fri, 25 Mar 2022 08:18:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 34DFCB828F6; Fri, 25 Mar 2022 15:18:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9D573C340EE; Fri, 25 Mar 2022 15:18:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221487; bh=cm0RYyJQcXqUnVI7HNk8immc7/DDIPAlvRgVNobGzO0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=l3LYNGfOnBrolFZz6Wh+ht05zncb9GlGyauSp8WRNyeywxWUoy2OM8tD2SiXhWX3X dhy6fJgSQ9qaGuiSAfkefeYcisa4QCEnSXUn3PnxSvunMWJFDOva1W5l4ImmTzmicm qpgfm+woE2ijIpqM5VLCjiaTGTtlOUYINOTa4pOE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stephane Graber , Jakub Kicinski Subject: [PATCH 5.16 21/37] drivers: net: xgene: Fix regression in CRC stripping Date: Fri, 25 Mar 2022 16:14:31 +0100 Message-Id: <20220325150420.651376257@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Stephane Graber commit e9e6faeafaa00da1851bcf47912b0f1acae666b4 upstream. All packets on ingress (except for jumbo) are terminated with a 4-bytes CRC checksum. It's the responsability of the driver to strip those 4 bytes. Unfortunately a change dating back to March 2017 re-shuffled some code and made the CRC stripping code effectively dead. This change re-orders that part a bit such that the datalen is immediately altered if needed. Fixes: 4902a92270fb ("drivers: net: xgene: Add workaround for errata 10GE_8= /ENET_11") Cc: stable@vger.kernel.org Signed-off-by: Stephane Graber Tested-by: Stephane Graber Link: https://lore.kernel.org/r/20220322224205.752795-1-stgraber@ubuntu.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) --- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c @@ -696,6 +696,12 @@ static int xgene_enet_rx_frame(struct xg buf_pool->rx_skb[skb_index] =3D NULL; =20 datalen =3D xgene_enet_get_data_len(le64_to_cpu(raw_desc->m1)); + + /* strip off CRC as HW isn't doing this */ + nv =3D GET_VAL(NV, le64_to_cpu(raw_desc->m0)); + if (!nv) + datalen -=3D 4; + skb_put(skb, datalen); prefetch(skb->data - NET_IP_ALIGN); skb->protocol =3D eth_type_trans(skb, ndev); @@ -717,12 +723,8 @@ static int xgene_enet_rx_frame(struct xg } } =20 - nv =3D GET_VAL(NV, le64_to_cpu(raw_desc->m0)); - if (!nv) { - /* strip off CRC as HW isn't doing this */ - datalen -=3D 4; + if (!nv) goto skip_jumbo; - } =20 slots =3D page_pool->slots - 1; head =3D page_pool->head; From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7693CC433EF for ; Fri, 25 Mar 2022 15:27:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376721AbiCYP33 (ORCPT ); Fri, 25 Mar 2022 11:29:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54192 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377540AbiCYPYQ (ORCPT ); Fri, 25 Mar 2022 11:24:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 851A1654AC; Fri, 25 Mar 2022 08:18:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 19452B828FF; Fri, 25 Mar 2022 15:18:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 81F89C340E9; Fri, 25 Mar 2022 15:18:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221489; bh=YOKp3do8vELpQwkoJRceq2v3z9rJ/hm84CFhL8nDedI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rGqWsmB3qtw0eEkhN32Ey40inxMtAxOB2J3dXColTxZ0wk8UzNhBTnHSGMThyqLBw o2EbWdgx7cbyVFPtWQAwZQoSdHq8ld1r9Bty4HioEkxvWUiQW1HmCNo/0tvz22jlei 1p1yi7vtYpK9PsCfyuEmACviNPORxT3WF7i5iulo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pablo Neira Ayuso Subject: [PATCH 5.16 22/37] netfilter: nf_tables: initialize registers in nft_do_chain() Date: Fri, 25 Mar 2022 16:14:32 +0100 Message-Id: <20220325150420.679540216@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pablo Neira Ayuso commit 4c905f6740a365464e91467aa50916555b28213d upstream. Initialize registers to avoid stack leak into userspace. Fixes: 96518518cc41 ("netfilter: add nftables") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- net/netfilter/nf_tables_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/netfilter/nf_tables_core.c +++ b/net/netfilter/nf_tables_core.c @@ -162,7 +162,7 @@ nft_do_chain(struct nft_pktinfo *pkt, vo struct nft_rule *const *rules; const struct nft_rule *rule; const struct nft_expr *expr, *last; - struct nft_regs regs; + struct nft_regs regs =3D {}; unsigned int stackptr =3D 0; struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE]; bool genbit =3D READ_ONCE(net->nft.gencursor); From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CB6BAC433EF for ; Fri, 25 Mar 2022 15:34:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377912AbiCYPeO (ORCPT ); Fri, 25 Mar 2022 11:34:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58742 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377548AbiCYPYQ (ORCPT ); Fri, 25 Mar 2022 11:24:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3F1F16A048; Fri, 25 Mar 2022 08:18:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5A1D860AB7; Fri, 25 Mar 2022 15:18:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 667D7C340E9; Fri, 25 Mar 2022 15:18:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221492; bh=RtcrWv71LawqW2gb4kXuopo9Py0Hrh53bhUlN+ns+ms=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0v3k+Y2r4774wkYZRDJm+KcLWPElMtfg0nkkIICRBtPEYjJ2jbrvYL0HR3JSimA0/ xipdqWmfK3K073YyhROKaN3XDAZ2FTWSk5pMnsltgjfF7PmmeNBhezH/UEmJZXMQB8 VqEF59nTC84kEp6Dg50xyNxx6Ah5y51Wv5Yo7KI4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pablo Neira Ayuso Subject: [PATCH 5.16 23/37] netfilter: nf_tables: validate registers coming from userspace. Date: Fri, 25 Mar 2022 16:14:33 +0100 Message-Id: <20220325150420.707230869@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pablo Neira Ayuso commit 6e1acfa387b9ff82cfc7db8cc3b6959221a95851 upstream. Bail out in case userspace uses unsupported registers. Fixes: 49499c3e6e18 ("netfilter: nf_tables: switch registers to 32 bit addr= essing") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- net/netfilter/nf_tables_api.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -9208,17 +9208,23 @@ int nft_parse_u32_check(const struct nla } EXPORT_SYMBOL_GPL(nft_parse_u32_check); =20 -static unsigned int nft_parse_register(const struct nlattr *attr) +static unsigned int nft_parse_register(const struct nlattr *attr, u32 *pre= g) { unsigned int reg; =20 reg =3D ntohl(nla_get_be32(attr)); switch (reg) { case NFT_REG_VERDICT...NFT_REG_4: - return reg * NFT_REG_SIZE / NFT_REG32_SIZE; + *preg =3D reg * NFT_REG_SIZE / NFT_REG32_SIZE; + break; + case NFT_REG32_00...NFT_REG32_15: + *preg =3D reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; + break; default: - return reg + NFT_REG_SIZE / NFT_REG32_SIZE - NFT_REG32_00; + return -ERANGE; } + + return 0; } =20 /** @@ -9260,7 +9266,10 @@ int nft_parse_register_load(const struct u32 reg; int err; =20 - reg =3D nft_parse_register(attr); + err =3D nft_parse_register(attr, ®); + if (err < 0) + return err; + err =3D nft_validate_register_load(reg, len); if (err < 0) return err; @@ -9315,7 +9324,10 @@ int nft_parse_register_store(const struc int err; u32 reg; =20 - reg =3D nft_parse_register(attr); + err =3D nft_parse_register(attr, ®); + if (err < 0) + return err; + err =3D nft_validate_register_store(ctx, reg, data, type, len); if (err < 0) return err; From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63DF2C433EF for ; Fri, 25 Mar 2022 15:28:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1359405AbiCYP3e (ORCPT ); Fri, 25 Mar 2022 11:29:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40566 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377556AbiCYPYQ (ORCPT ); Fri, 25 Mar 2022 11:24:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9F17AADD68; Fri, 25 Mar 2022 08:18:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1E45060A1B; Fri, 25 Mar 2022 15:18:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2E7A4C340E9; Fri, 25 Mar 2022 15:18:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221495; bh=wbVzCmsC9GRDSscRfLJ+281cXygqPHZB/gvOOdKZGuM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sZfKKp5pgB+nv6D/J6RJ1hSykcFJO/b4xk8W6OGdLBhEeveZjQRiXv5UegLGXIZYl BRvW9J2nI/g0TDPCg0eR26b+5qyB7eKJRBQb7gIThwQ7pZGrjCdBiRvh/RSfbyyToM SOV2li4Sv6Dr/O3zMshJmHYjqt1G5r4WBKAerHA8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Cilissen , Hans de Goede , "Rafael J. Wysocki" Subject: [PATCH 5.16 24/37] ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board Date: Fri, 25 Mar 2022 16:14:34 +0100 Message-Id: <20220325150420.735456228@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mark Cilissen commit e702196bf85778f2c5527ca47f33ef2e2fca8297 upstream. On this board the ACPI RSDP structure points to both a RSDT and an XSDT, but the XSDT points to a truncated FADT. This causes all sorts of trouble and usually a complete failure to boot after the following error occurs: ACPI Error: Unsupported address space: 0x20 (*/hwregs-*) ACPI Error: AE_SUPPORT, Unable to initialize fixed events (*/evevent-*) ACPI: Unable to start ACPI Interpreter This leaves the ACPI implementation in such a broken state that subsequent kernel subsystem initialisations go wrong, resulting in among others mismapped PCI memory, SATA and USB enumeration failures, and freezes. As this is an older embedded platform that will likely never see any BIOS updates to address this issue and its default shipping OS only complies to ACPI 1.0, work around this by forcing `acpi=3Drsdt`. This patch, applied on top of Linux 5.10.102, was confirmed on real hardware to fix the issue. Signed-off-by: Mark Cilissen Cc: All applicable Reviewed-by: Hans de Goede Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- arch/x86/kernel/acpi/boot.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) --- a/arch/x86/kernel/acpi/boot.c +++ b/arch/x86/kernel/acpi/boot.c @@ -1328,6 +1328,17 @@ static int __init disable_acpi_pci(const return 0; } =20 +static int __init disable_acpi_xsdt(const struct dmi_system_id *d) +{ + if (!acpi_force) { + pr_notice("%s detected: force use of acpi=3Drsdt\n", d->ident); + acpi_gbl_do_not_use_xsdt =3D TRUE; + } else { + pr_notice("Warning: DMI blacklist says broken, but acpi XSDT forced\n"); + } + return 0; +} + static int __init dmi_disable_acpi(const struct dmi_system_id *d) { if (!acpi_force) { @@ -1451,6 +1462,19 @@ static const struct dmi_system_id acpi_d DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"), }, }, + /* + * Boxes that need ACPI XSDT use disabled due to corrupted tables + */ + { + .callback =3D disable_acpi_xsdt, + .ident =3D "Advantech DAC-BJ01", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "NEC"), + DMI_MATCH(DMI_PRODUCT_NAME, "Bearlake CRB Board"), + DMI_MATCH(DMI_BIOS_VERSION, "V1.12"), + DMI_MATCH(DMI_BIOS_DATE, "02/01/2011"), + }, + }, {} }; From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 49A2FC43219 for ; Fri, 25 Mar 2022 15:34:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377971AbiCYPeR (ORCPT ); Fri, 25 Mar 2022 11:34:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42680 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377585AbiCYPYR (ORCPT ); Fri, 25 Mar 2022 11:24:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D7F3DFF8A; Fri, 25 Mar 2022 08:18:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D0CC360ABA; Fri, 25 Mar 2022 15:18:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E2DE1C340E9; Fri, 25 Mar 2022 15:18:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221498; bh=yQdpvEhL5AoioDf0png7mIvxiUMoS5mudv/r7pfJOUc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vjESTfk+NUpuWF4/Y8wq6uJQLbupcswoi9S/uX4u5sxXAAf62MrnI9a7VSHA66k2A wRYSswCqkLuKxWPl9Mm1hWNs7Hbnqc7R5mw4+cLq4lSWsqGl3KUQFwa9QxruFsSZXa jtOvHQnQD+yqOLIjSxJa5xtxaI0ztzQum5g1rvfE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maximilian Luz , "Rafael J. Wysocki" Subject: [PATCH 5.16 25/37] ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 Date: Fri, 25 Mar 2022 16:14:35 +0100 Message-Id: <20220325150420.764126922@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maximilian Luz commit 7dacee0b9efc8bd061f097b1a8d4daa6591af0c6 upstream. For some reason, the Microsoft Surface Go 3 uses the standard ACPI interface for battery information, but does not use the standard PNP0C0A HID. Instead it uses MSHW0146 as identifier. Add that ID to the driver as this seems to work well. Additionally, the power state is not updated immediately after the AC has been (un-)plugged, so add the respective quirk for that. Signed-off-by: Maximilian Luz Cc: All applicable Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/acpi/battery.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -60,6 +60,10 @@ MODULE_PARM_DESC(cache_time, "cache time =20 static const struct acpi_device_id battery_device_ids[] =3D { {"PNP0C0A", 0}, + + /* Microsoft Surface Go 3 */ + {"MSHW0146", 0}, + {"", 0}, }; =20 @@ -1177,6 +1181,14 @@ static const struct dmi_system_id bat_dm DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad"), }, }, + { + /* Microsoft Surface Go 3 */ + .callback =3D battery_notification_delay_quirk, + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"), + DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 3"), + }, + }, {}, }; From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34AE3C4167B for ; Fri, 25 Mar 2022 15:34:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377613AbiCYPdm (ORCPT ); Fri, 25 Mar 2022 11:33:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57780 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377119AbiCYPXs (ORCPT ); Fri, 25 Mar 2022 11:23:48 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2DD1EE5428; Fri, 25 Mar 2022 08:17:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C229260EFF; Fri, 25 Mar 2022 15:17:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CD3C5C340E9; Fri, 25 Mar 2022 15:17:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221444; bh=zqWpNrrPY0nsyl7sPfMigEYjaB0XH7axnEL01bL8SVc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dMwz5sdbxLQhIL54J3NOMokF5/DD1BKWBZRjDmRz24dt0GBnXEKzHhx/KcqqO4TmP 6IIRAju5oZcdNeK9xOahcb+WvYQuJQLuD3Wths/hgJUQcZn6emRFA7RAxKaxm2I8CZ Vxhc1euJE9Xy82DSHgMddTqyrLdc4P6BS3i0KKRw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Werner Sembach , "Rafael J. Wysocki" Subject: [PATCH 5.16 26/37] ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU Date: Fri, 25 Mar 2022 16:14:36 +0100 Message-Id: <20220325150420.792474878@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Werner Sembach commit c844d22fe0c0b37dc809adbdde6ceb6462c43acf upstream. Clevo NL5xRU and NL5xNU/TUXEDO Aura 15 Gen1 and Gen2 have both a working native and video interface. However the default detection mechanism first registers the video interface before unregistering it again and switching to the native interface during boot. This results in a dangling SBIOS request for backlight change for some reason, causing the backlight to switch to ~2% once per boot on the first power cord connect or disconnect event. Setting the native interface explicitly circumvents this buggy behaviour by avoiding the unregistering process. Signed-off-by: Werner Sembach Cc: All applicable Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/acpi/video_detect.c | 75 +++++++++++++++++++++++++++++++++++++++= +++++ 1 file changed, 75 insertions(+) --- a/drivers/acpi/video_detect.c +++ b/drivers/acpi/video_detect.c @@ -417,6 +417,81 @@ static const struct dmi_system_id video_ DMI_MATCH(DMI_PRODUCT_NAME, "GA503"), }, }, + /* + * Clevo NL5xRU and NL5xNU/TUXEDO Aura 15 Gen1 and Gen2 have both a + * working native and video interface. However the default detection + * mechanism first registers the video interface before unregistering + * it again and switching to the native interface during boot. This + * results in a dangling SBIOS request for backlight change for some + * reason, causing the backlight to switch to ~2% once per boot on the + * first power cord connect or disconnect event. Setting the native + * interface explicitly circumvents this buggy behaviour, by avoiding + * the unregistering process. + */ + { + .callback =3D video_detect_force_native, + .ident =3D "Clevo NL5xRU", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), + DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "Clevo NL5xRU", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), + DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "Clevo NL5xRU", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), + DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "Clevo NL5xRU", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), + DMI_MATCH(DMI_BOARD_NAME, "AURA1501"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "Clevo NL5xRU", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), + DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "Clevo NL5xNU", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), + DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "Clevo NL5xNU", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), + DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "Clevo NL5xNU", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), + DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), + }, + }, =20 /* * Desktops which falsely report a backlight and which our heuristics From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62977C4167E for ; Fri, 25 Mar 2022 15:34:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377728AbiCYPdw (ORCPT ); Fri, 25 Mar 2022 11:33:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58956 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377164AbiCYPXy (ORCPT ); Fri, 25 Mar 2022 11:23:54 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 975C5DCE16; Fri, 25 Mar 2022 08:17:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2D4A3B827B7; Fri, 25 Mar 2022 15:17:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9A163C340E9; Fri, 25 Mar 2022 15:17:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221447; bh=xB09mWxvdIPI9n6hFFKfaWkT0NX9SojhxvqtWd6DOqc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=leHuUiYsBPArlR0aeqWAhBcjf2By2RMbKLlyWpva0rdJiuFqcR3FSJAL1zVUn8+MX XVCKNHcGa/9Y9gDEYoU4x61ZeMzwi2x4Oxfw8EOoobc3Mx9j55QAbm+3gtg2wDdiEL htzC5ONRh7QBzOnReHuP5K7fFAn7f+C9U464wosk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Giovanni Cabiddu , Herbert Xu Subject: [PATCH 5.16 27/37] crypto: qat - disable registration of algorithms Date: Fri, 25 Mar 2022 16:14:37 +0100 Message-Id: <20220325150420.820942655@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Giovanni Cabiddu commit 8893d27ffcaf6ec6267038a177cb87bcde4dd3de upstream. The implementations of aead and skcipher in the QAT driver do not support properly requests with the CRYPTO_TFM_REQ_MAY_BACKLOG flag set. If the HW queue is full, the driver returns -EBUSY but does not enqueue the request. This can result in applications like dm-crypt waiting indefinitely for a completion of a request that was never submitted to the hardware. To avoid this problem, disable the registration of all crypto algorithms in the QAT driver by setting the number of crypto instances to 0 at configuration time. Cc: stable@vger.kernel.org Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/crypto/qat/qat_4xxx/adf_drv.c | 7 +++++++ drivers/crypto/qat/qat_common/qat_crypto.c | 7 +++++++ 2 files changed, 14 insertions(+) --- a/drivers/crypto/qat/qat_4xxx/adf_drv.c +++ b/drivers/crypto/qat/qat_4xxx/adf_drv.c @@ -52,6 +52,13 @@ static int adf_crypto_dev_config(struct if (ret) goto err; =20 + /* Temporarily set the number of crypto instances to zero to avoid + * registering the crypto algorithms. + * This will be removed when the algorithms will support the + * CRYPTO_TFM_REQ_MAY_BACKLOG flag + */ + instances =3D 0; + for (i =3D 0; i < instances; i++) { val =3D i; bank =3D i * 2; --- a/drivers/crypto/qat/qat_common/qat_crypto.c +++ b/drivers/crypto/qat/qat_common/qat_crypto.c @@ -136,6 +136,13 @@ int qat_crypto_dev_config(struct adf_acc if (ret) goto err; =20 + /* Temporarily set the number of crypto instances to zero to avoid + * registering the crypto algorithms. + * This will be removed when the algorithms will support the + * CRYPTO_TFM_REQ_MAY_BACKLOG flag + */ + instances =3D 0; + for (i =3D 0; i < instances; i++) { val =3D i; snprintf(key, sizeof(key), ADF_CY "%d" ADF_RING_ASYM_BANK_NUM, i); From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 334F3C43217 for ; Fri, 25 Mar 2022 15:34:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377704AbiCYPdt (ORCPT ); Fri, 25 Mar 2022 11:33:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40546 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377176AbiCYPXz (ORCPT ); Fri, 25 Mar 2022 11:23:55 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF53CDCE3F; Fri, 25 Mar 2022 08:17:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 56C2D60AB7; Fri, 25 Mar 2022 15:17:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69210C340EE; Fri, 25 Mar 2022 15:17:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221449; bh=WrWSpHQKs2LWw4pFtyVYqhrUO6MaZemAfI/UgjZvB6o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RjW4Vyu5hRbqvVSACxeuumErQSG1iHg1NNkWOpWlE+NVG0+lNWS6hmFgJ/b8vlGke UGUVc05dBMYYmVyd2TBfiLg81Y7LptqMvlMx344nlTWnlTURa5y6O/6sylY3vA6/+J OxTEyI1DByESts/ThP44G9c5XOa9IfjXgQsCcfeQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Larry Finger , Marcel Holtmann Subject: [PATCH 5.16 28/37] Bluetooth: btusb: Add one more Bluetooth part for the Realtek RTL8852AE Date: Fri, 25 Mar 2022 16:14:38 +0100 Message-Id: <20220325150420.849901125@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Larry Finger commit 2e7b4a328ed6ea57d22853939e69bc86c560996d upstream. This Realtek device has both wifi and BT components. The latter reports a USB ID of 0bda:2852, which is not in the table. BT device description in /sys/kernel/debug/usb/devices contains the followi= ng entries: T: Bus=3D01 Lev=3D01 Prnt=3D01 Port=3D03 Cnt=3D02 Dev#=3D 3 Spd=3D12 MxCh= =3D 0 D: Ver=3D 1.00 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D0bda ProdID=3D2852 Rev=3D 0.00 S: Manufacturer=3DRealtek S: Product=3DBluetooth Radio S: SerialNumber=3D00e04c000001 C:* #Ifs=3D 2 Cfg#=3D 1 Atr=3De0 MxPwr=3D500mA I:* If#=3D 0 Alt=3D 0 #EPs=3D 3 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver= =3Dbtusb E: Ad=3D81(I) Atr=3D03(Int.) MxPS=3D 16 Ivl=3D1ms E: Ad=3D02(O) Atr=3D02(Bulk) MxPS=3D 64 Ivl=3D0ms E: Ad=3D82(I) Atr=3D02(Bulk) MxPS=3D 64 Ivl=3D0ms I:* If#=3D 1 Alt=3D 0 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver= =3Dbtusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 0 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 0 Ivl=3D1ms I: If#=3D 1 Alt=3D 1 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver=3D= btusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 9 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 9 Ivl=3D1ms I: If#=3D 1 Alt=3D 2 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver=3D= btusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 17 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 17 Ivl=3D1ms I: If#=3D 1 Alt=3D 3 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver=3D= btusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 25 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 25 Ivl=3D1ms I: If#=3D 1 Alt=3D 4 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver=3D= btusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 33 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 33 Ivl=3D1ms I: If#=3D 1 Alt=3D 5 #EPs=3D 2 Cls=3De0(wlcon) Sub=3D01 Prot=3D01 Driver=3D= btusb E: Ad=3D03(O) Atr=3D01(Isoc) MxPS=3D 49 Ivl=3D1ms E: Ad=3D83(I) Atr=3D01(Isoc) MxPS=3D 49 Ivl=3D1ms The missing USB_ID was reported by user trius65 at https://github.com/lwfin= ger/rtw89/issues/122 Signed-off-by: Larry Finger Cc: stable@vger.kernel.org Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -404,6 +404,8 @@ static const struct usb_device_id blackl BTUSB_WIDEBAND_SPEECH }, =20 /* Realtek 8852AE Bluetooth devices */ + { USB_DEVICE(0x0bda, 0x2852), .driver_info =3D BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0bda, 0xc852), .driver_info =3D BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0bda, 0x385a), .driver_info =3D BTUSB_REALTEK | From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8AF07C4332F for ; Fri, 25 Mar 2022 15:27:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237046AbiCYP2k (ORCPT ); Fri, 25 Mar 2022 11:28:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33110 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377201AbiCYPX4 (ORCPT ); Fri, 25 Mar 2022 11:23:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8DEDEDE0BA; Fri, 25 Mar 2022 08:17:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 208B160F13; Fri, 25 Mar 2022 15:17:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3066EC340EE; Fri, 25 Mar 2022 15:17:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221452; bh=bYSefRWEQBGZ6V7g4qvKgTV4xvV30nsyFbO/KZhTytQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FP7SFj4lVyFtyifP4GkAXiCdjs3MUYda8OpUGuluTIiHw0zwd2kBRvaB9Brphbkii ewXYNKXsXyYyzcpj+eC7E5D76LqawWnefpyRU28QjGKEzXfM9NxuM2eRYgpSiDxcX3 owMdY98ieTKO44V3vF/jyntrvu3qjoZAHAbYySDs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wen Gong , Brian Norris , Kalle Valo Subject: [PATCH 5.16 29/37] Revert "ath: add support for special 0x0 regulatory domain" Date: Fri, 25 Mar 2022 16:14:39 +0100 Message-Id: <20220325150420.878755867@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Brian Norris commit 1ec7ed5163c70a0d040150d2279f932c7e7c143f upstream. This reverts commit 2dc016599cfa9672a147528ca26d70c3654a5423. Users are reporting regressions in regulatory domain detection and channel availability. The problem this was trying to resolve was fixed in firmware anyway: QCA6174 hw3.0: sdio-4.4.1: add firmware.bin_WLAN.RMH.4.4.1-00042 https://github.com/kvalo/ath10k-firmware/commit/4d382787f0efa77dba40394= e0bc604f8eff82552 Link: https://bbs.archlinux.org/viewtopic.php?id=3D254535 Link: http://lists.infradead.org/pipermail/ath10k/2020-April/014871.html Link: http://lists.infradead.org/pipermail/ath10k/2020-May/015152.html Link: https://lore.kernel.org/all/1c160dfb-6ccc-b4d6-76f6-4364e0adb6dd@reox= .at/ Fixes: 2dc016599cfa ("ath: add support for special 0x0 regulatory domain") Cc: Cc: Wen Gong Signed-off-by: Brian Norris Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200527165718.129307-1-briannorris@chromiu= m.org Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/net/wireless/ath/regd.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/drivers/net/wireless/ath/regd.c +++ b/drivers/net/wireless/ath/regd.c @@ -667,14 +667,14 @@ ath_regd_init_wiphy(struct ath_regulator =20 /* * Some users have reported their EEPROM programmed with - * 0x8000 or 0x0 set, this is not a supported regulatory - * domain but since we have more than one user with it we - * need a solution for them. We default to 0x64, which is - * the default Atheros world regulatory domain. + * 0x8000 set, this is not a supported regulatory domain + * but since we have more than one user with it we need + * a solution for them. We default to 0x64, which is the + * default Atheros world regulatory domain. */ static void ath_regd_sanitize(struct ath_regulatory *reg) { - if (reg->current_rd !=3D COUNTRY_ERD_FLAG && reg->current_rd !=3D 0) + if (reg->current_rd !=3D COUNTRY_ERD_FLAG) return; printk(KERN_DEBUG "ath: EEPROM regdomain sanitized\n"); reg->current_rd =3D 0x64; From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56374C35274 for ; Fri, 25 Mar 2022 15:27:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376469AbiCYP2s (ORCPT ); Fri, 25 Mar 2022 11:28:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34156 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377236AbiCYPX6 (ORCPT ); Fri, 25 Mar 2022 11:23:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF321E6145; Fri, 25 Mar 2022 08:17:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8B4ECB827DC; Fri, 25 Mar 2022 15:17:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EE319C340E9; Fri, 25 Mar 2022 15:17:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221455; bh=PVvpZe0gwx7cCv7/Tokda8oeLwGKuYAWw5qH3QerL9w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vAZ7R7b5UxI0bzI4afgGpK1u0snm6sQ8KnMZlWMGL28IDp46REU2oZ0BNnke4h7hD HPFFVMd1JLgdqptmVe7ck+ideGEBtkXfryMJN1G+dyVv9KfpV8fsIP17gD8R4UI8X0 2Wex4JHxRufWYmq8SSrlbQZad/xEQW0iX7ZyyiKg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Roberto Sassu , syzbot+e9072e90624a31dfa85f@syzkaller.appspotmail.com, Gerd Hoffmann Subject: [PATCH 5.16 30/37] drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() Date: Fri, 25 Mar 2022 16:14:40 +0100 Message-Id: <20220325150420.907849037@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Roberto Sassu commit 6b79f96f4a23846516e5e6e4dd37fc06f43a60dd upstream. If virtio_gpu_object_shmem_init() fails (e.g. due to fault injection, as it happened in the bug report by syzbot), virtio_gpu_array_put_free() could be called with objs equal to NULL. Ensure that objs is not NULL in virtio_gpu_array_put_free(), or otherwise return from the function. Cc: stable@vger.kernel.org # 5.13.x Signed-off-by: Roberto Sassu Reported-by: syzbot+e9072e90624a31dfa85f@syzkaller.appspotmail.com Fixes: 377f8331d0565 ("drm/virtio: fix possible leak/unlock virtio_gpu_obje= ct_array") Link: http://patchwork.freedesktop.org/patch/msgid/20211213183122.838119-1-= roberto.sassu@huawei.com Signed-off-by: Gerd Hoffmann Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/gpu/drm/virtio/virtgpu_gem.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/gpu/drm/virtio/virtgpu_gem.c +++ b/drivers/gpu/drm/virtio/virtgpu_gem.c @@ -248,6 +248,9 @@ void virtio_gpu_array_put_free(struct vi { u32 i; =20 + if (!objs) + return; + for (i =3D 0; i < objs->nents; i++) drm_gem_object_put(objs->objs[i]); virtio_gpu_array_free(objs); From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71CF8C46467 for ; Fri, 25 Mar 2022 15:34:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377756AbiCYPdz (ORCPT ); Fri, 25 Mar 2022 11:33:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38906 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377265AbiCYPYA (ORCPT ); Fri, 25 Mar 2022 11:24:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 16F5AE615D; Fri, 25 Mar 2022 08:17:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 604FF60A1B; Fri, 25 Mar 2022 15:17:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DACB4C340E9; Fri, 25 Mar 2022 15:17:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221458; bh=ZGqHvFAw8zYFl5sKx0Vfl0zk5smIKUztTYJffKlRplU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IDTe1Dh/1TXT3b5oN5AUy0XX0hEohF/NgWiY578DGU5WsXUm1V4UHsRee8ATaR3Cr +8EPbMQbZksyXx3UybqzX3RvQrAZ/2d9aAdvuG1CkhoQPDJRYl5JK5jxomvurBGUlf L4ZsdPQzRNdEJYE/OaKV3iBrqrUz/C6cIdVRCoek= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tim Murray , Joel Fernandes , Neeraj Upadhyay , "Uladzislau Rezki (Sony)" , Todd Kjos , Sandeep Patil , "Paul E. McKenney" Subject: [PATCH 5.16 31/37] rcu: Dont deboost before reporting expedited quiescent state Date: Fri, 25 Mar 2022 16:14:41 +0100 Message-Id: <20220325150420.936440042@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paul E. McKenney commit 10c535787436d62ea28156a4b91365fd89b5a432 upstream. Currently rcu_preempt_deferred_qs_irqrestore() releases rnp->boost_mtx before reporting the expedited quiescent state. Under heavy real-time load, this can result in this function being preempted before the quiescent state is reported, which can in turn prevent the expedited grace period from completing. Tim Murray reports that the resulting expedited grace periods can take hundreds of milliseconds and even more than one second, when they should normally complete in less than a millisecond. This was fine given that there were no particular response-time constraints for synchronize_rcu_expedited(), as it was designed for throughput rather than latency. However, some users now need sub-100-millisecond response-time constratints. This patch therefore follows Neeraj's suggestion (seconded by Tim and by Uladzislau Rezki) of simply reversing the two operations. Reported-by: Tim Murray Reported-by: Joel Fernandes Reported-by: Neeraj Upadhyay Reviewed-by: Neeraj Upadhyay Reviewed-by: Uladzislau Rezki (Sony) Tested-by: Tim Murray Cc: Todd Kjos Cc: Sandeep Patil Cc: # 5.4.x Signed-off-by: Paul E. McKenney Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- kernel/rcu/tree_plugin.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/kernel/rcu/tree_plugin.h +++ b/kernel/rcu/tree_plugin.h @@ -554,16 +554,16 @@ rcu_preempt_deferred_qs_irqrestore(struc raw_spin_unlock_irqrestore_rcu_node(rnp, flags); } =20 - /* Unboost if we were boosted. */ - if (IS_ENABLED(CONFIG_RCU_BOOST) && drop_boost_mutex) - rt_mutex_futex_unlock(&rnp->boost_mtx.rtmutex); - /* * If this was the last task on the expedited lists, * then we need to report up the rcu_node hierarchy. */ if (!empty_exp && empty_exp_now) rcu_report_exp_rnp(rnp, true); + + /* Unboost if we were boosted. */ + if (IS_ENABLED(CONFIG_RCU_BOOST) && drop_boost_mutex) + rt_mutex_futex_unlock(&rnp->boost_mtx.rtmutex); } else { local_irq_restore(flags); } From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82D6DC35274 for ; Fri, 25 Mar 2022 15:34:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377796AbiCYPd7 (ORCPT ); Fri, 25 Mar 2022 11:33:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34054 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377313AbiCYPYD (ORCPT ); Fri, 25 Mar 2022 11:24:03 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D33B3E617F; Fri, 25 Mar 2022 08:17:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F043CB82865; Fri, 25 Mar 2022 15:17:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 40202C340E9; Fri, 25 Mar 2022 15:17:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221461; bh=IINwPm1bqspPgPbPUx/hYBYPSojwwZV9QAGEwMdrTTc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qQwSw33N8LNEwAILOvtPD31yp+Kba9LIE5+LFrpGJJ31h58NqkCsZcmrm015zPL7n yTrZM3lUuBH4cZCrztEHpOvCHvddANaaIFcuGNwisZS5rph5lwrs2+55NXKMLXiuQ8 bmMpzZlPi4hS7U9fYW/+dx6t211+SbXDUShtgrKI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Laight , Christoph Hellwig , Arnd Bergmann Subject: [PATCH 5.16 32/37] uaccess: fix integer overflow on access_ok() Date: Fri, 25 Mar 2022 16:14:42 +0100 Message-Id: <20220325150420.965492022@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arnd Bergmann commit 222ca305c9fd39e5ed8104da25c09b2b79a516a8 upstream. Three architectures check the end of a user access against the address limit without taking a possible overflow into account. Passing a negative length or another overflow in here returns success when it should not. Use the most common correct implementation here, which optimizes for a constant 'size' argument, and turns the common case into a single comparison. Cc: stable@vger.kernel.org Fixes: da551281947c ("csky: User access") Fixes: f663b60f5215 ("microblaze: Fix uaccess_ok macro") Fixes: 7567746e1c0d ("Hexagon: Add user access functions") Reported-by: David Laight Reviewed-by: Christoph Hellwig Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- arch/csky/include/asm/uaccess.h | 7 +++---- arch/hexagon/include/asm/uaccess.h | 18 +++++++++--------- arch/microblaze/include/asm/uaccess.h | 19 ++++--------------- 3 files changed, 16 insertions(+), 28 deletions(-) --- a/arch/csky/include/asm/uaccess.h +++ b/arch/csky/include/asm/uaccess.h @@ -3,14 +3,13 @@ #ifndef __ASM_CSKY_UACCESS_H #define __ASM_CSKY_UACCESS_H =20 -#define user_addr_max() \ - (uaccess_kernel() ? KERNEL_DS.seg : get_fs().seg) +#define user_addr_max() (current_thread_info()->addr_limit.seg) =20 static inline int __access_ok(unsigned long addr, unsigned long size) { - unsigned long limit =3D current_thread_info()->addr_limit.seg; + unsigned long limit =3D user_addr_max(); =20 - return ((addr < limit) && ((addr + size) < limit)); + return (size <=3D limit) && (addr <=3D (limit - size)); } #define __access_ok __access_ok =20 --- a/arch/hexagon/include/asm/uaccess.h +++ b/arch/hexagon/include/asm/uaccess.h @@ -25,17 +25,17 @@ * Returns true (nonzero) if the memory block *may* be valid, false (zero) * if it is definitely invalid. * - * User address space in Hexagon, like x86, goes to 0xbfffffff, so the - * simple MSB-based tests used by MIPS won't work. Some further - * optimization is probably possible here, but for now, keep it - * reasonably simple and not *too* slow. After all, we've got the - * MMU for backup. */ +#define uaccess_kernel() (get_fs().seg =3D=3D KERNEL_DS.seg) +#define user_addr_max() (uaccess_kernel() ? ~0UL : TASK_SIZE) =20 -#define __access_ok(addr, size) \ - ((get_fs().seg =3D=3D KERNEL_DS.seg) || \ - (((unsigned long)addr < get_fs().seg) && \ - (unsigned long)size < (get_fs().seg - (unsigned long)addr))) +static inline int __access_ok(unsigned long addr, unsigned long size) +{ + unsigned long limit =3D TASK_SIZE; + + return (size <=3D limit) && (addr <=3D (limit - size)); +} +#define __access_ok __access_ok =20 /* * When a kernel-mode page fault is taken, the faulting instruction --- a/arch/microblaze/include/asm/uaccess.h +++ b/arch/microblaze/include/asm/uaccess.h @@ -39,24 +39,13 @@ =20 # define uaccess_kernel() (get_fs().seg =3D=3D KERNEL_DS.seg) =20 -static inline int access_ok(const void __user *addr, unsigned long size) +static inline int __access_ok(unsigned long addr, unsigned long size) { - if (!size) - goto ok; + unsigned long limit =3D user_addr_max(); =20 - if ((get_fs().seg < ((unsigned long)addr)) || - (get_fs().seg < ((unsigned long)addr + size - 1))) { - pr_devel("ACCESS fail at 0x%08x (size 0x%x), seg 0x%08x\n", - (__force u32)addr, (u32)size, - (u32)get_fs().seg); - return 0; - } -ok: - pr_devel("ACCESS OK at 0x%08x (size 0x%x), seg 0x%08x\n", - (__force u32)addr, (u32)size, - (u32)get_fs().seg); - return 1; + return (size <=3D limit) && (addr <=3D (limit - size)); } +#define access_ok(addr, size) __access_ok((unsigned long)addr, size) =20 # define __FIXUP_SECTION ".section .fixup,\"ax\"\n" # define __EX_TABLE_SECTION ".section __ex_table,\"a\"\n" From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7401AC433EF for ; Fri, 25 Mar 2022 15:27:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376599AbiCYP3C (ORCPT ); Fri, 25 Mar 2022 11:29:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34166 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377331AbiCYPYE (ORCPT ); Fri, 25 Mar 2022 11:24:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E9086E6C52; Fri, 25 Mar 2022 08:17:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 92866B8288D; Fri, 25 Mar 2022 15:17:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E0FD5C340E9; Fri, 25 Mar 2022 15:17:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221464; bh=tdXfN3dVELg7WjnAzE0xfkgquffdF7QCQ8MnLKjaJPU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hDFZtOPC2KuNDClJKpv8Bu4JCJzcBYMvsw2OnpiR6fxR5F3LNhD7qVTLPr5bO71hF baOAXNfBryr5wf/Bg0ZJQiDPCXo9gWaObvqeHpUNG8jQPbKqzmru/ON20jKISGu9OU EetOxm3s5bwh1hEtXeQYXzDezbb2gMQvTDH4Kimc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Matthias Kretschmer , =?UTF-8?q?Linus=20L=C3=BCssing?= , Johannes Berg Subject: [PATCH 5.16 33/37] mac80211: fix potential double free on mesh join Date: Fri, 25 Mar 2022 16:14:43 +0100 Message-Id: <20220325150420.993855180@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Linus L=C3=BCssing commit 4a2d4496e15ea5bb5c8e83b94ca8ca7fb045e7d3 upstream. While commit 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh") fixed a memory leak on mesh leave / teardown it introduced a potential memory corruption caused by a double free when rejoining the mesh: ieee80211_leave_mesh() -> kfree(sdata->u.mesh.ie); ... ieee80211_join_mesh() -> copy_mesh_setup() -> old_ie =3D ifmsh->ie; -> kfree(old_ie); This double free / kernel panics can be reproduced by using wpa_supplicant with an encrypted mesh (if set up without encryption via "iw" then ifmsh->ie is always NULL, which avoids this issue). And then calling: $ iw dev mesh0 mesh leave $ iw dev mesh0 mesh join my-mesh Note that typically these commands are not used / working when using wpa_supplicant. And it seems that wpa_supplicant or wpa_cli are going through a NETDEV_DOWN/NETDEV_UP cycle between a mesh leave and mesh join where the NETDEV_UP resets the mesh.ie to NULL via a memcpy of default_mesh_setup in cfg80211_netdev_notifier_call, which then avoids the memory corruption, too. The issue was first observed in an application which was not using wpa_supplicant but "Senf" instead, which implements its own calls to nl80211. Fixing the issue by removing the kfree()'ing of the mesh IE in the mesh join function and leaving it solely up to the mesh leave to free the mesh IE. Cc: stable@vger.kernel.org Fixes: 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh") Reported-by: Matthias Kretschmer Signed-off-by: Linus L=C3=BCssing Tested-by: Mathias Kretschmer Link: https://lore.kernel.org/r/20220310183513.28589-1-linus.luessing@c0d3.= blue Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- net/mac80211/cfg.c | 3 --- 1 file changed, 3 deletions(-) --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -2148,14 +2148,12 @@ static int copy_mesh_setup(struct ieee80 const struct mesh_setup *setup) { u8 *new_ie; - const u8 *old_ie; struct ieee80211_sub_if_data *sdata =3D container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh); int i; =20 /* allocate information elements */ new_ie =3D NULL; - old_ie =3D ifmsh->ie; =20 if (setup->ie_len) { new_ie =3D kmemdup(setup->ie, setup->ie_len, @@ -2165,7 +2163,6 @@ static int copy_mesh_setup(struct ieee80 } ifmsh->ie_len =3D setup->ie_len; ifmsh->ie =3D new_ie; - kfree(old_ie); =20 /* now copy the rest of the setup parameters */ ifmsh->mesh_id_len =3D setup->mesh_id_len; From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A25A3C4707A for ; Fri, 25 Mar 2022 15:34:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1377829AbiCYPeG (ORCPT ); Fri, 25 Mar 2022 11:34:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42866 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377341AbiCYPYF (ORCPT ); Fri, 25 Mar 2022 11:24:05 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 73C35E6C5D; Fri, 25 Mar 2022 08:17:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D308D60F13; Fri, 25 Mar 2022 15:17:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6028C340E9; Fri, 25 Mar 2022 15:17:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221467; bh=bLyHvRHuwpHkVvuattikF0PH4TZTbUXMmVmmup3vp7E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pvF6L+QcgsONNIR1IawW9a7IJ6ZkQ+tzrf48mQPSw+MNPl9cXtZ3wYboGNJg/MCzi xRG0jf5FCln4UdG5eDzEXDjHYVv0kaN6+pj8Dg/YidYRWMUkQSJ91SyB1EulIKqT6J bT+2vfVDyBFaT3Qf4YUCgkBv98eq8pGdZv51e+/M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, James Bottomley , Jarkko Sakkinen Subject: [PATCH 5.16 34/37] tpm: use try_get_ops() in tpm-space.c Date: Fri, 25 Mar 2022 16:14:44 +0100 Message-Id: <20220325150421.022289955@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: James Bottomley commit fb5abce6b2bb5cb3d628aaa63fa821da8c4600f9 upstream. As part of the series conversion to remove nested TPM operations: https://lore.kernel.org/all/20190205224723.19671-1-jarkko.sakkinen@linux.in= tel.com/ exposure of the chip->tpm_mutex was removed from much of the upper level code. In this conversion, tpm2_del_space() was missed. This didn't matter much because it's usually called closely after a converted operation, so there's only a very tiny race window where the chip can be removed before the space flushing is done which causes a NULL deref on the mutex. However, there are reports of this window being hit in practice, so fix this by converting tpm2_del_space() to use tpm_try_get_ops(), which performs all the teardown checks before acquring the mutex. Cc: stable@vger.kernel.org # 5.4.x Signed-off-by: James Bottomley Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/char/tpm/tpm2-space.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/char/tpm/tpm2-space.c +++ b/drivers/char/tpm/tpm2-space.c @@ -58,12 +58,12 @@ int tpm2_init_space(struct tpm_space *sp =20 void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space) { - mutex_lock(&chip->tpm_mutex); - if (!tpm_chip_start(chip)) { + + if (tpm_try_get_ops(chip) =3D=3D 0) { tpm2_flush_sessions(chip, space); - tpm_chip_stop(chip); + tpm_put_ops(chip); } - mutex_unlock(&chip->tpm_mutex); + kfree(space->context_buf); kfree(space->session_buf); } From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 849FBC433EF for ; Fri, 25 Mar 2022 15:34:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378694AbiCYPfb (ORCPT ); Fri, 25 Mar 2022 11:35:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54200 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377360AbiCYPYG (ORCPT ); Fri, 25 Mar 2022 11:24:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F27EBE6C6E; Fri, 25 Mar 2022 08:17:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 86FED60A1B; Fri, 25 Mar 2022 15:17:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 98D9AC340E9; Fri, 25 Mar 2022 15:17:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221470; bh=FQ1u8yPWxi0An71a6D9PM9mhOZjP8Swoix1nujNZoeM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=f6A1EMKL4SC0vSZNZ0Zx+FdLUEAvDGmz63t2WswyISON5sW8V6BhfPnu7mqc0k2G6 3yalkomspoPPXb1fnMV/PmAWcx0w52a2TNjpigXEUUZmXRWX/4y0yo6nTtRDo1z+ki 0RMVj4IBtm80VbM6FHLR/cq118ACLbm8xm973V/s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bryan ODonoghue , Loic Poulain , Kalle Valo Subject: [PATCH 5.16 35/37] wcn36xx: Differentiate wcn3660 from wcn3620 Date: Fri, 25 Mar 2022 16:14:45 +0100 Message-Id: <20220325150421.050879289@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bryan O'Donoghue commit 98d504a82cc75840bec8e3c6ae0e4f411921962b upstream. The spread of capability between the three WiFi silicon parts wcn36xx supports is: wcn3620 - 802.11 a/b/g wcn3660 - 802.11 a/b/g/n wcn3680 - 802.11 a/b/g/n/ac We currently treat wcn3660 as wcn3620 thus limiting it to 2GHz channels. Fix this regression by ensuring we differentiate between all three parts. Fixes: 8490987bdb9a ("wcn36xx: Hook and identify RF_IRIS_WCN3680") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue Reviewed-by: Loic Poulain Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220125004046.4058284-1-bryan.odonoghue@li= naro.org Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- drivers/net/wireless/ath/wcn36xx/main.c | 3 +++ drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 + 2 files changed, 4 insertions(+) --- a/drivers/net/wireless/ath/wcn36xx/main.c +++ b/drivers/net/wireless/ath/wcn36xx/main.c @@ -1483,6 +1483,9 @@ static int wcn36xx_platform_get_resource if (iris_node) { if (of_device_is_compatible(iris_node, "qcom,wcn3620")) wcn->rf_id =3D RF_IRIS_WCN3620; + if (of_device_is_compatible(iris_node, "qcom,wcn3660") || + of_device_is_compatible(iris_node, "qcom,wcn3660b")) + wcn->rf_id =3D RF_IRIS_WCN3660; if (of_device_is_compatible(iris_node, "qcom,wcn3680")) wcn->rf_id =3D RF_IRIS_WCN3680; of_node_put(iris_node); --- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h +++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h @@ -97,6 +97,7 @@ enum wcn36xx_ampdu_state { =20 #define RF_UNKNOWN 0x0000 #define RF_IRIS_WCN3620 0x3620 +#define RF_IRIS_WCN3660 0x3660 #define RF_IRIS_WCN3680 0x3680 =20 static inline void buff_to_be(u32 *buf, size_t len) From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 87BC8C433EF for ; Fri, 25 Mar 2022 15:34:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378676AbiCYPf2 (ORCPT ); Fri, 25 Mar 2022 11:35:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40578 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377385AbiCYPYG (ORCPT ); Fri, 25 Mar 2022 11:24:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2853DFD6E; Fri, 25 Mar 2022 08:17:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3407F60AD0; Fri, 25 Mar 2022 15:17:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 42BADC340E9; Fri, 25 Mar 2022 15:17:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221475; bh=2Y7SEJ45GUxU9Jc1FeEiiIgPS7sVZVqp/nNW4EwEPk4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hDnG8asAjKW1J5W3sjgsZcrsEKYJ+37uqh4GjfB2XxQc0N365grZsdAmNlHMrBGnT EWKhxzVT1kOfZvZxWmWIkoTvmNMv/eoBhX/RW7Rct/mVwUYS6xWaMU8e75sE9uqlG0 8cGL5igEZuETJcAm/tlHtwmmSJyyO6HDZTJMdGfA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoph Hellwig , Arnd Bergmann Subject: [PATCH 5.16 36/37] m68k: fix access_ok for coldfire Date: Fri, 25 Mar 2022 16:14:46 +0100 Message-Id: <20220325150421.078633953@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arnd Bergmann commit 26509034bef198525d5936c116cbd0c3fa491c0b upstream. While most m68k platforms use separate address spaces for user and kernel space, at least coldfire does not, and the other ones have a TASK_SIZE that is less than the entire 4GB address range. Using the default implementation of __access_ok() stops coldfire user space from trivially accessing kernel memory. Reviewed-by: Christoph Hellwig Cc: stable@vger.kernel.org Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- arch/m68k/include/asm/uaccess.h | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) --- a/arch/m68k/include/asm/uaccess.h +++ b/arch/m68k/include/asm/uaccess.h @@ -12,14 +12,17 @@ #include =20 /* We let the MMU do all checking */ -static inline int access_ok(const void __user *addr, +static inline int access_ok(const void __user *ptr, unsigned long size) { - /* - * XXX: for !CONFIG_CPU_HAS_ADDRESS_SPACES this really needs to check - * for TASK_SIZE! - */ - return 1; + unsigned long limit =3D TASK_SIZE; + unsigned long addr =3D (unsigned long)ptr; + + if (IS_ENABLED(CONFIG_CPU_HAS_ADDRESS_SPACES) || + !IS_ENABLED(CONFIG_MMU)) + return 1; + + return (size <=3D limit) && (addr <=3D (limit - size)); } =20 /* From nobody Sat Jun 20 00:52:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50CA3C433EF for ; Fri, 25 Mar 2022 15:27:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229817AbiCYP3O (ORCPT ); Fri, 25 Mar 2022 11:29:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42866 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1377444AbiCYPYK (ORCPT ); Fri, 25 Mar 2022 11:24:10 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D1469E7299; Fri, 25 Mar 2022 08:18:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 25FCBCE2A45; Fri, 25 Mar 2022 15:18:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3731EC340E9; Fri, 25 Mar 2022 15:17:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1648221478; bh=3snGlK3kA7ZUY+R0MwdxzWSgKKQaA0DAwJcsXL42dfk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YtBfHu5j/UOVSk9k2g9ixAFOYRaF93W9i6wafbqaoz8iD68LYUKITk6nRoTJEhREr gck8wjvQJVHJwVIeVpOiryfrFnG3JsfnyLoIVKGqjjEfe/mgqAqtMGMU6aK+xgBt+A ru4lUJdnJ1aRAIfw2FoRZYJeeTwMdRAuH8/WSX1M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoph Hellwig , Arnd Bergmann Subject: [PATCH 5.16 37/37] nds32: fix access_ok() checks in get/put_user Date: Fri, 25 Mar 2022 16:14:47 +0100 Message-Id: <20220325150421.106820241@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220325150420.046488912@linuxfoundation.org> References: <20220325150420.046488912@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Arnd Bergmann commit 8926d88ced46700bf6117ceaf391480b943ea9f4 upstream. The get_user()/put_user() functions are meant to check for access_ok(), while the __get_user()/__put_user() functions don't. This broke in 4.19 for nds32, when it gained an extraneous check in __get_user(), but lost the check it needs in __put_user(). Fixes: 487913ab18c2 ("nds32: Extract the checking and getting pointer to a = macro") Cc: stable@vger.kernel.org @ v4.19+ Reviewed-by: Christoph Hellwig Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Guenter Roeck Tested-by: Jeffrin Jose T Tested-by: Justin M. Forbes Tested-by: Linux Kernel Functional Testing Tested-by: Ron Economos Tested-by: Shuah Khan --- arch/nds32/include/asm/uaccess.h | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) --- a/arch/nds32/include/asm/uaccess.h +++ b/arch/nds32/include/asm/uaccess.h @@ -70,9 +70,7 @@ static inline void set_fs(mm_segment_t f * versions are void (ie, don't return a value as such). */ =20 -#define get_user __get_user \ - -#define __get_user(x, ptr) \ +#define get_user(x, ptr) \ ({ \ long __gu_err =3D 0; \ __get_user_check((x), (ptr), __gu_err); \ @@ -85,6 +83,14 @@ static inline void set_fs(mm_segment_t f (void)0; \ }) =20 +#define __get_user(x, ptr) \ +({ \ + long __gu_err =3D 0; \ + const __typeof__(*(ptr)) __user *__p =3D (ptr); \ + __get_user_err((x), __p, (__gu_err)); \ + __gu_err; \ +}) + #define __get_user_check(x, ptr, err) \ ({ \ const __typeof__(*(ptr)) __user *__p =3D (ptr); \ @@ -165,12 +171,18 @@ do { \ : "r"(addr), "i"(-EFAULT) \ : "cc") =20 -#define put_user __put_user \ +#define put_user(x, ptr) \ +({ \ + long __pu_err =3D 0; \ + __put_user_check((x), (ptr), __pu_err); \ + __pu_err; \ +}) =20 #define __put_user(x, ptr) \ ({ \ long __pu_err =3D 0; \ - __put_user_err((x), (ptr), __pu_err); \ + __typeof__(*(ptr)) __user *__p =3D (ptr); \ + __put_user_err((x), __p, __pu_err); \ __pu_err; \ })