From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3783EC433EF for ; Tue, 10 May 2022 13:11:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242273AbiEJNOz (ORCPT ); Tue, 10 May 2022 09:14:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57856 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235563AbiEJNOr (ORCPT ); Tue, 10 May 2022 09:14:47 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C3556DE8F; Tue, 10 May 2022 06:10:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 83483B81D7C; Tue, 10 May 2022 13:10:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A571CC385C2; Tue, 10 May 2022 13:10:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188243; bh=U5+FmEaWhhVakEBQ0TGM8mSVymqqCpM+PuY9LZVZOBY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MtxSMJttT6Q1RqnefoDLKcA04LPV8ixDP4YYzmjBiN3jmgS/Xe0A8GteKb+BR9itE lTrsta0esC/jsIh8g7cSffyiVwfini0lOiN85KCx5SkJGsY/ynt2vB+N0boncU+Hiu gjBzkNe9fwVzbk6vPmafJybKiYRskLjO8s6AVyxA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Minh Yuan , syzbot+8e8958586909d62b6840@syzkaller.appspotmail.com, cruise k , Kyungtae Kim , Linus Torvalds , Denis Efremov , Willy Tarreau , Linus Torvalds Subject: [PATCH 4.9 01/66] floppy: disable FDRAWCMD by default Date: Tue, 10 May 2022 15:06:51 +0200 Message-Id: <20220510130729.806574432@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Willy Tarreau commit 233087ca063686964a53c829d547c7571e3f67bf upstream. Minh Yuan reported a concurrency use-after-free issue in the floppy code between raw_cmd_ioctl and seek_interrupt. [ It turns out this has been around, and that others have reported the KASAN splats over the years, but Minh Yuan had a reproducer for it and so gets primary credit for reporting it for this fix - Linus ] The problem is, this driver tends to break very easily and nowadays, nobody is expected to use FDRAWCMD anyway since it was used to manipulate non-standard formats. The risk of breaking the driver is higher than the risk presented by this race, and accessing the device requires privileges anyway. Let's just add a config option to completely disable this ioctl and leave it disabled by default. Distros shouldn't use it, and only those running on antique hardware might need to enable it. Link: https://lore.kernel.org/all/000000000000b71cdd05d703f6bf@google.com/ Link: https://lore.kernel.org/lkml/CAKcFiNC=3DMfYVW-Jt9A3=3DFPJpTwCD2PL_ULN= CpsCVE5s8ZeBQgQ@mail.gmail.com Link: https://lore.kernel.org/all/CAEAjamu1FRhz6StCe_55XY5s389ZP_xmCF69k987= En+1z53=3Deg@mail.gmail.com Reported-by: Minh Yuan Reported-by: syzbot+8e8958586909d62b6840@syzkaller.appspotmail.com Reported-by: cruise k Reported-by: Kyungtae Kim Suggested-by: Linus Torvalds Tested-by: Denis Efremov Signed-off-by: Willy Tarreau Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/block/Kconfig | 16 ++++++++++++++++ drivers/block/floppy.c | 43 ++++++++++++++++++++++++++++++++----------- 2 files changed, 48 insertions(+), 11 deletions(-) --- a/drivers/block/Kconfig +++ b/drivers/block/Kconfig @@ -33,6 +33,22 @@ config BLK_DEV_FD To compile this driver as a module, choose M here: the module will be called floppy. =20 +config BLK_DEV_FD_RAWCMD + bool "Support for raw floppy disk commands (DEPRECATED)" + depends on BLK_DEV_FD + help + If you want to use actual physical floppies and expect to do + special low-level hardware accesses to them (access and use + non-standard formats, for example), then enable this. + + Note that the code enabled by this option is rarely used and + might be unstable or insecure, and distros should not enable it. + + Note: FDRAWCMD is deprecated and will be removed from the kernel + in the near future. + + If unsure, say N. + config AMIGA_FLOPPY tristate "Amiga floppy support" depends on AMIGA --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -3016,6 +3016,8 @@ static const char *drive_name(int type, return "(null)"; } =20 +#ifdef CONFIG_BLK_DEV_FD_RAWCMD + /* raw commands */ static void raw_cmd_done(int flag) { @@ -3227,6 +3229,35 @@ static int raw_cmd_ioctl(int cmd, void _ return ret; } =20 +static int floppy_raw_cmd_ioctl(int type, int drive, int cmd, + void __user *param) +{ + int ret; + + pr_warn_once("Note: FDRAWCMD is deprecated and will be removed from the k= ernel in the near future.\n"); + + if (type) + return -EINVAL; + if (lock_fdc(drive)) + return -EINTR; + set_floppy(drive); + ret =3D raw_cmd_ioctl(cmd, param); + if (ret =3D=3D -EINTR) + return -EINTR; + process_fd_request(); + return ret; +} + +#else /* CONFIG_BLK_DEV_FD_RAWCMD */ + +static int floppy_raw_cmd_ioctl(int type, int drive, int cmd, + void __user *param) +{ + return -EOPNOTSUPP; +} + +#endif + static int invalidate_drive(struct block_device *bdev) { /* invalidate the buffer track to force a reread */ @@ -3414,7 +3445,6 @@ static int fd_locked_ioctl(struct block_ { int drive =3D (long)bdev->bd_disk->private_data; int type =3D ITYPE(UDRS->fd_device); - int i; int ret; int size; union inparam { @@ -3565,16 +3595,7 @@ static int fd_locked_ioctl(struct block_ outparam =3D UDRWE; break; case FDRAWCMD: - if (type) - return -EINVAL; - if (lock_fdc(drive)) - return -EINTR; - set_floppy(drive); - i =3D raw_cmd_ioctl(cmd, (void __user *)param); - if (i =3D=3D -EINTR) - return -EINTR; - process_fd_request(); - return i; + return floppy_raw_cmd_ioctl(type, drive, cmd, (void __user *)param); case FDTWADDLE: if (lock_fdc(drive)) return -EINTR; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A2A6C433FE for ; Tue, 10 May 2022 13:12:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242356AbiEJNQU (ORCPT ); Tue, 10 May 2022 09:16:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59726 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242366AbiEJNPd (ORCPT ); Tue, 10 May 2022 09:15:33 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF2323BA65; Tue, 10 May 2022 06:11:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 83C41B81D7A; Tue, 10 May 2022 13:11:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D341EC385C2; Tue, 10 May 2022 13:11:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188276; bh=sh06TBAH1ezWV6utqcJE5j/Qf8oUhesqUDZWGeWV1Jc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wt0zqS77w+fpNJVxPW1PEk7G2qOwswmUoutYycHWx69mCGogZbat5MRCwbuwgK5QG sbq65Qo3Vv0/oNji/Cb8eRvqFb1sg3ASyCgH5hDREwtTMFK05Z8myBcz0ur1AK+6rw LVaRD4gMbNvYnreac1nuS0dlQwo09yguG4bOu0Uk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Machek , Dinh Nguyen , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 02/66] Revert "net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link" Date: Tue, 10 May 2022 15:06:52 +0200 Message-Id: <20220510130729.835099538@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" This reverts commit edba120f094394454f5b9511d04abd7e8c2c31ee which is commit a6aaa00324240967272b451bfa772547bd576ee6 upstream. Pavel reports that it causes boot issues, so revert it for now. Link: https://lore.kernel.org/r/20220429074341.GB1423@amd Reported-by: Pavel Machek Cc: Dinh Nguyen Cc: David S. Miller Cc: Sasha Levin Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c | 8 ++++++++ drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h | 4 ---- drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 13 ++++++++----- 3 files changed, 16 insertions(+), 9 deletions(-) --- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c +++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c @@ -68,6 +68,10 @@ #define TSE_PCS_USE_SGMII_ENA BIT(0) #define TSE_PCS_IF_USE_SGMII 0x03 =20 +#define SGMII_ADAPTER_CTRL_REG 0x00 +#define SGMII_ADAPTER_DISABLE 0x0001 +#define SGMII_ADAPTER_ENABLE 0x0000 + #define AUTONEGO_LINK_TIMER 20 =20 static int tse_pcs_reset(void __iomem *base, struct tse_pcs *pcs) @@ -211,8 +215,12 @@ void tse_pcs_fix_mac_speed(struct tse_pc unsigned int speed) { void __iomem *tse_pcs_base =3D pcs->tse_pcs_base; + void __iomem *sgmii_adapter_base =3D pcs->sgmii_adapter_base; u32 val; =20 + writew(SGMII_ADAPTER_ENABLE, + sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); + pcs->autoneg =3D phy_dev->autoneg; =20 if (phy_dev->autoneg =3D=3D AUTONEG_ENABLE) { --- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h +++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h @@ -21,10 +21,6 @@ #include #include =20 -#define SGMII_ADAPTER_CTRL_REG 0x00 -#define SGMII_ADAPTER_ENABLE 0x0000 -#define SGMII_ADAPTER_DISABLE 0x0001 - struct tse_pcs { struct device *dev; void __iomem *tse_pcs_base; --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c @@ -29,6 +29,9 @@ =20 #include "altr_tse_pcs.h" =20 +#define SGMII_ADAPTER_CTRL_REG 0x00 +#define SGMII_ADAPTER_DISABLE 0x0001 + #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII 0x0 #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RGMII 0x1 #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RMII 0x2 @@ -62,14 +65,16 @@ static void socfpga_dwmac_fix_mac_speed( { struct socfpga_dwmac *dwmac =3D (struct socfpga_dwmac *)priv; void __iomem *splitter_base =3D dwmac->splitter_base; + void __iomem *tse_pcs_base =3D dwmac->pcs.tse_pcs_base; void __iomem *sgmii_adapter_base =3D dwmac->pcs.sgmii_adapter_base; struct device *dev =3D dwmac->dev; struct net_device *ndev =3D dev_get_drvdata(dev); struct phy_device *phy_dev =3D ndev->phydev; u32 val; =20 - writew(SGMII_ADAPTER_DISABLE, - sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); + if ((tse_pcs_base) && (sgmii_adapter_base)) + writew(SGMII_ADAPTER_DISABLE, + sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); =20 if (splitter_base) { val =3D readl(splitter_base + EMAC_SPLITTER_CTRL_REG); @@ -91,9 +96,7 @@ static void socfpga_dwmac_fix_mac_speed( writel(val, splitter_base + EMAC_SPLITTER_CTRL_REG); } =20 - writew(SGMII_ADAPTER_ENABLE, - sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); - if (phy_dev) + if (tse_pcs_base && sgmii_adapter_base) tse_pcs_fix_mac_speed(&dwmac->pcs, phy_dev, speed); } From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28D62C433EF for ; Tue, 10 May 2022 13:12:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242466AbiEJNQs (ORCPT ); Tue, 10 May 2022 09:16:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60850 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242349AbiEJNPw (ORCPT ); Tue, 10 May 2022 09:15:52 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D6374488B6; Tue, 10 May 2022 06:11:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 237FACE1EE2; Tue, 10 May 2022 13:11:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 306AEC385A6; Tue, 10 May 2022 13:11:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188288; bh=nbW0eEsimMVjlHNbmfDsIhmqa2VhhW8vzws7CUyZMzo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LhWFqe5N8TAi74IIKrE7SgEY3PDQRytbiOhMUrwz25qsEc6mzga2zauo4/44D0Yoz EzotzOiTrHgAUzpUc8Bc+bviw7nQszen5gcIsc9ybUAxN2rO+SGpEZ8BSfKJYQyEo4 4aDEEVPalMppjLJRb7hfVdbdTchNULlcbA0TsyWo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoph Hellwig , =?UTF-8?q?Matias=20Bj=C3=B8rling?= , =?UTF-8?q?Javier=20Gonz=C3=A1lez?= , Jens Axboe Subject: [PATCH 4.9 03/66] lightnvm: disable the subsystem Date: Tue, 10 May 2022 15:06:53 +0200 Message-Id: <20220510130729.862939629@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In commit 9ea9b9c48387 ("remove the lightnvm subsystem") the lightnvm subsystem was removed as there is no hardware in the wild for it, and the code is known to have problems. This should also be disabled for older LTS kernels as well to prevent anyone from accidentally using it. Cc: Christoph Hellwig Cc: Matias Bj=C3=B8rling Cc: Javier Gonz=C3=A1lez Cc: Jens Axboe Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/lightnvm/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/lightnvm/Kconfig +++ b/drivers/lightnvm/Kconfig @@ -4,7 +4,7 @@ =20 menuconfig NVM bool "Open-Channel SSD target support" - depends on BLOCK && HAS_DMA + depends on BLOCK && HAS_DMA && BROKEN help Say Y here to get to enable Open-channel SSDs. =20 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E837AC433EF for ; Tue, 10 May 2022 13:15:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242632AbiEJNTj (ORCPT ); Tue, 10 May 2022 09:19:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60938 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242396AbiEJNPx (ORCPT ); Tue, 10 May 2022 09:15:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 67D5A48E40; Tue, 10 May 2022 06:11:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0378361532; Tue, 10 May 2022 13:11:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0FB76C385A6; Tue, 10 May 2022 13:11:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188291; bh=q+s6FJfbA7d6EcGsRe441ZZ2FTLTaNIUc3UIe2otjyk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hjkgiv0H8CRQQie/S6VS6QjL/YYVlx41kvS4gTf43jOGHSOvsAOIDRKxYn7sRDlEa izMEj7tlHTAFpm4xIb4e74OalYQbfcMRELeJTkcaydGGj5h4vjJ445yJuuSgtl6rbk n3jOzBTC2Xba49RNLg5Wb7qNiyS4zY6sjKCbZjPo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum Subject: [PATCH 4.9 04/66] USB: quirks: add a Realtek card reader Date: Tue, 10 May 2022 15:06:54 +0200 Message-Id: <20220510130729.891962151@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Neukum commit 2a7ccf6bb6f147f64c025ad68f4255d8e1e0ce6d upstream. This device is reported to stall when enummerated. Cc: stable Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20220414110209.30924-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/core/quirks.c +++ b/drivers/usb/core/quirks.c @@ -243,6 +243,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0b05, 0x17e0), .driver_info =3D USB_QUIRK_IGNORE_REMOTE_WAKEUP }, =20 + /* Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader)*/ + { USB_DEVICE(0x0bda, 0x0151), .driver_info =3D USB_QUIRK_CONFIG_INTF_STRI= NGS }, + /* Realtek hub in Dell WD19 (Type-C) */ { USB_DEVICE(0x0bda, 0x0487), .driver_info =3D USB_QUIRK_NO_LPM }, { USB_DEVICE(0x0bda, 0x5487), .driver_info =3D USB_QUIRK_RESET_RESUME }, From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BFD1C433F5 for ; Tue, 10 May 2022 13:15:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235168AbiEJNTq (ORCPT ); Tue, 10 May 2022 09:19:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34382 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242423AbiEJNP6 (ORCPT ); Tue, 10 May 2022 09:15:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 471963D1C6; Tue, 10 May 2022 06:11:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D9295615C5; Tue, 10 May 2022 13:11:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E8ED5C385C2; Tue, 10 May 2022 13:11:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188294; bh=0Zsa4+gxXS41nEdbiCUhpnQgdG82KClTrqpYIttuWFc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ILdDDkXTGli8ZQxqk01FG7UOio1gzve9BcSymazzbub1xzZhPxOvcNFXZ0QGDnpJw rA6AID+cxFD1fQ2yrgxcGt3q08/ulWhNvMI6Q3J04W9OL/demMbgwEJLfQCW/4FJ2+ PEwPiYIUeAxqTj1CJNYV2EXX4rPzt59v5HBBizY8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum Subject: [PATCH 4.9 05/66] USB: quirks: add STRING quirk for VCOM device Date: Tue, 10 May 2022 15:06:55 +0200 Message-Id: <20220510130729.920049390@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Neukum commit ec547af8a9ea6441864bad34172676b5652ceb96 upstream. This has been reported to stall if queried Cc: stable Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20220414123152.1700-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/core/quirks.c +++ b/drivers/usb/core/quirks.c @@ -328,6 +328,9 @@ static const struct usb_device_id usb_qu /* DJI CineSSD */ { USB_DEVICE(0x2ca3, 0x0031), .driver_info =3D USB_QUIRK_NO_LPM }, =20 + /* VCOM device */ + { USB_DEVICE(0x4296, 0x7570), .driver_info =3D USB_QUIRK_CONFIG_INTF_STRI= NGS }, + /* INTEL VALUE SSD */ { USB_DEVICE(0x8086, 0xf1a5), .driver_info =3D USB_QUIRK_RESET_RESUME }, From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 837CAC433FE for ; Tue, 10 May 2022 13:13:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242438AbiEJNQz (ORCPT ); Tue, 10 May 2022 09:16:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60850 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242424AbiEJNP7 (ORCPT ); Tue, 10 May 2022 09:15:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 57681396A3; Tue, 10 May 2022 06:11:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D5A73615FE; Tue, 10 May 2022 13:11:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E78FCC385D2; Tue, 10 May 2022 13:11:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188297; bh=4kzENMZz9lzHqiKlT2tYJDJzG0vuYCBxT1iApVxZoxQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=f8xD0xUXWmGT2gfRk2Cd6A73S9zJquIf3pznva+CqlbeP5QAkZHDWQoggHw0xP9VT XNtffHZbb4m0wnl/WVsei9J2qFBIK9ndjGf43cFfnhsh1XsG6arxW5rWNvJtPJX+c6 k1VuPp6rKXpN6YxXoL71xFiOYZ6XzpKT4WIFlUn4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Kees Cook , Johan Hovold Subject: [PATCH 4.9 06/66] USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS Date: Tue, 10 May 2022 15:06:56 +0200 Message-Id: <20220510130729.950176234@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kees Cook commit e23e50e7acc8d8f16498e9c129db33e6a00e80eb upstream. The sizeof(struct whitehat_dr_info) can be 4 bytes under CONFIG_AEABI=3Dn due to "-mabi=3Dapcs-gnu", even though it has a single u8: whiteheat_private { __u8 mcr; /* 0 1 */ /* size: 4, cachelines: 1, members: 1 */ /* padding: 3 */ /* last cacheline: 4 bytes */ }; The result is technically harmless, as both the source and the destinations are currently the same allocation size (4 bytes) and don't use their padding, but if anything were to ever be added after the "mcr" member in "struct whiteheat_private", it would be overwritten. The structs both have a single u8 "mcr" member, but are 4 bytes in padded size. The memcpy() destination was explicitly targeting the u8 member (size 1) with the length of the whole structure (size 4), triggering the memcpy buffer overflow warning: In file included from include/linux/string.h:253, from include/linux/bitmap.h:11, from include/linux/cpumask.h:12, from include/linux/smp.h:13, from include/linux/lockdep.h:14, from include/linux/spinlock.h:62, from include/linux/mmzone.h:8, from include/linux/gfp.h:6, from include/linux/slab.h:15, from drivers/usb/serial/whiteheat.c:17: In function 'fortify_memcpy_chk', inlined from 'firm_send_command' at drivers/usb/serial/whiteheat.c:587:= 4: include/linux/fortify-string.h:328:25: warning: call to '__write_overflow_f= ield' declared with attribute warning: detected write beyond size of field = (1st parameter); maybe use struct_group()? [-Wattribute-warning] 328 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Instead, just assign the one byte directly. Reported-by: kernel test robot Link: https://lore.kernel.org/lkml/202204142318.vDqjjSFn-lkp@intel.com Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220421001234.2421107-1-keescook@chromium.= org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/serial/whiteheat.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/drivers/usb/serial/whiteheat.c +++ b/drivers/usb/serial/whiteheat.c @@ -644,9 +644,8 @@ static int firm_send_command(struct usb_ switch (command) { case WHITEHEAT_GET_DTR_RTS: info =3D usb_get_serial_port_data(port); - memcpy(&info->mcr, command_info->result_buffer, - sizeof(struct whiteheat_dr_info)); - break; + info->mcr =3D command_info->result_buffer[0]; + break; } } exit: From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8710EC433F5 for ; Tue, 10 May 2022 13:13:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242473AbiEJNRL (ORCPT ); Tue, 10 May 2022 09:17:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34914 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242456AbiEJNQF (ORCPT ); Tue, 10 May 2022 09:16:05 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D41449CBC; Tue, 10 May 2022 06:11:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B881361601; Tue, 10 May 2022 13:11:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C7FF7C385C2; Tue, 10 May 2022 13:11:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188300; bh=3Ii+zVJBBJqPS/UXZOnbbU6C3QsOInDSgnahpire11Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yV/HYHTduYrbtJC0yNfkJCRZPtQey4oLesGL6vq2lNYrpO5OjHR38wT/yXBkOev/W r5Dh0suGGapPI8i4131G81uRUuVA8F4zZLoiEr3PfW0SFCc9J1GLqUo+ja8fh4ZId7 sT5Ka2xQ7IHjMbtlZpoEzdLxuqZnxG3YbDAMQXPE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bruno Thomsen , Johan Hovold Subject: [PATCH 4.9 07/66] USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader Date: Tue, 10 May 2022 15:06:57 +0200 Message-Id: <20220510130729.976708515@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bruno Thomsen commit 35a923a0b329c343e9e81d79518e2937eba06fcd upstream. Wireless reading of water and heat meters using 868 MHz wM-Bus mode C1. The two different product IDs allow detection of dongle antenna solution: - Internal antenna - External antenna using SMA connector https://www.kamstrup.com/en-en/water-solutions/water-meter-reading/usb-mete= r-reader Signed-off-by: Bruno Thomsen Link: https://lore.kernel.org/r/20220414081202.5591-1-bruno.thomsen@gmail.c= om Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/serial/cp210x.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/serial/cp210x.c +++ b/drivers/usb/serial/cp210x.c @@ -192,6 +192,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Contro= l, Monitoring and Data Logger */ { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */ { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */ + { USB_DEVICE(0x17A8, 0x0101) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter R= eader (Int Ant) */ + { USB_DEVICE(0x17A8, 0x0102) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter R= eader (Ext Ant) */ { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79828C433F5 for ; Tue, 10 May 2022 13:13:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242495AbiEJNRR (ORCPT ); Tue, 10 May 2022 09:17:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35026 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242462AbiEJNQG (ORCPT ); Tue, 10 May 2022 09:16:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2808249F18; Tue, 10 May 2022 06:11:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A519A61574; Tue, 10 May 2022 13:11:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2120C385C2; Tue, 10 May 2022 13:11:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188303; bh=A/JRDkuq2cNykGWSuoZt6p3ZN9nfI+Zo+Gq7fBTW8h8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BxuY2JwaTgm/shgeWSPVF0rlepxZ6Rg70rMs7Pep5f9xk9sq1qCpxjM0HE8LkI//e 7m80zuKRzZZJt4jCMQnXujmd20j2/0EwPl4KYapXsRymKsa+z1JG6pCwptWu+eXKEP gnZ4LhwXhAohagzD/KvDC2N2i0Vm+vBMQDCV0z2U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Slark Xiao , Johan Hovold Subject: [PATCH 4.9 08/66] USB: serial: option: add support for Cinterion MV32-WA/MV32-WB Date: Tue, 10 May 2022 15:06:58 +0200 Message-Id: <20220510130730.014747979@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Slark Xiao commit b4a64ed6e7b857317070fcb9d87ff5d4a73be3e8 upstream. Add support for Cinterion device MV32-WA/MV32-WB. MV32-WA PID is 0x00F1, and MV32-WB PID is 0x00F2. Test evidence as below: T: Bus=3D04 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 4 Spd=3D5000 Mx= Ch=3D 0 D: Ver=3D 3.20 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D 9 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f1 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F1 USB Mobile Broadband S: SerialNumber=3D78ada8c4 C: #Ifs=3D 6 Cfg#=3D 1 Atr=3Da0 MxPwr=3D896mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 1 Cls=3D02(commc) Sub=3D0e Prot=3D00 Driver= =3Dcdc_mbim I: If#=3D0x1 Alt=3D 1 #EPs=3D 2 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 1 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3D(none) I: If#=3D0x4 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D60 Driver= =3Doption I: If#=3D0x5 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption T: Bus=3D04 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 3 Spd=3D5000 Mx= Ch=3D 0 D: Ver=3D 3.20 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D 9 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f2 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F2 USB Mobile Broadband S: SerialNumber=3Dcdd06a78 C: #Ifs=3D 6 Cfg#=3D 1 Atr=3Da0 MxPwr=3D896mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 1 Cls=3D02(commc) Sub=3D0e Prot=3D00 Driver= =3Dcdc_mbim I: If#=3D0x1 Alt=3D 1 #EPs=3D 2 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 1 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3D(none) I: If#=3D0x4 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D60 Driver= =3Doption I: If#=3D0x5 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption Interface 0&1: MBIM, 2:Modem, 3: GNSS, 4: NMEA, 5: Diag GNSS port don't use serial driver. Signed-off-by: Slark Xiao Link: https://lore.kernel.org/r/20220414074434.5699-1-slark_xiao@163.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -430,6 +430,8 @@ static void option_instat_callback(struc #define CINTERION_PRODUCT_CLS8 0x00b0 #define CINTERION_PRODUCT_MV31_MBIM 0x00b3 #define CINTERION_PRODUCT_MV31_RMNET 0x00b7 +#define CINTERION_PRODUCT_MV32_WA 0x00f1 +#define CINTERION_PRODUCT_MV32_WB 0x00f2 =20 /* Olivetti products */ #define OLIVETTI_VENDOR_ID 0x0b3c @@ -1945,6 +1947,10 @@ static const struct usb_device_id option .driver_info =3D RSVD(3)}, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_= RMNET, 0xff), .driver_info =3D RSVD(0)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WA, 0xff), + .driver_info =3D RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WB, 0xff), + .driver_info =3D RSVD(3)}, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), .driver_info =3D RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F08C0C433F5 for ; Tue, 10 May 2022 13:13:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242507AbiEJNR3 (ORCPT ); Tue, 10 May 2022 09:17:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35074 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242468AbiEJNQG (ORCPT ); Tue, 10 May 2022 09:16:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 43B564A916; Tue, 10 May 2022 06:11:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 79FB5615FC; Tue, 10 May 2022 13:11:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7FC22C385C6; Tue, 10 May 2022 13:11:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188305; bh=KrmrHxN/MRgGZte1TsTRlM3hbo4IwWi9CTaTAqB81dM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MV6nTm+4OIdAeIH6fTVn3IcDlr7uNieJsX6RgRA2Nz89hqP/i8tfLCemMv6+MXJUl A0fQtwAgzBc8VhnLUVxLiA6SlxUpEPWeommKjPMs7VUNarxesqpxUDsnDXxsu1MGiN UvMKhTw1UliAzGVY67BWyYpK94EhaFUMDtrIBY/w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniele Palmas , Johan Hovold Subject: [PATCH 4.9 09/66] USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions Date: Tue, 10 May 2022 15:06:59 +0200 Message-Id: <20220510130730.042978438@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniele Palmas commit f32c5a0423400e01f4d7c607949fa3a1f006e8fa upstream. Add support for the following Telit FN980 and FN990 compositions: 0x1057: tty, adb, rmnet, tty, tty, tty, tty, tty 0x1058: tty, adb, tty, tty, tty, tty, tty 0x1075: adb, tty Signed-off-by: Daniele Palmas Link: https://lore.kernel.org/r/20220406141408.580669-1-dnlplm@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1195,6 +1195,10 @@ static const struct usb_device_id option .driver_info =3D NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD9= 80 */ .driver_info =3D NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1057, 0xff), /* Telit FN9= 80 */ + .driver_info =3D NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1058, 0xff), /* Telit FN9= 80 (PCIe) */ + .driver_info =3D NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN9= 20 (rmnet) */ .driver_info =3D NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN9= 20 (MBIM) */ @@ -1211,6 +1215,8 @@ static const struct usb_device_id option .driver_info =3D NCTRL(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN9= 90 (ECM) */ .driver_info =3D NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN9= 90 (PCIe) */ + .driver_info =3D RSVD(0) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info =3D NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8E4FC4332F for ; Tue, 10 May 2022 13:10:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242256AbiEJNOu (ORCPT ); Tue, 10 May 2022 09:14:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57880 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241947AbiEJNOr (ORCPT ); Tue, 10 May 2022 09:14:47 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 557A711A05; Tue, 10 May 2022 06:10:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id A1ADFCE1EE2; Tue, 10 May 2022 13:10:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 936DCC385A6; Tue, 10 May 2022 13:10:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188245; bh=cJmHsdcBC+rr0n3Or8etT+0FElCdwbVFWr4uzPO5Tp8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xOTWjlRqzpvOJAuMzhc+yr4yjhXcP7krJVRJQ+3GLSJan6+KKdhfec03SQlDig5pV 2de7KhIbgne9aApGO1OTtsIjnpVVP97yxpOJ6OWb5/1uRP1F4oijSu6Bf2VSqlr9lZ nKwgM4J7Gp3qBao/UeReKeEetR/zguwPuLZReTpo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Henry Lin , Mathias Nyman Subject: [PATCH 4.9 10/66] xhci: stop polling roothubs after shutdown Date: Tue, 10 May 2022 15:07:00 +0200 Message-Id: <20220510130730.071761272@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Henry Lin commit dc92944a014cd6a6f6c94299aaa36164dd2c238a upstream. While rebooting, XHCI controller and its bus device will be shut down in order by .shutdown callback. Stopping roothubs polling in xhci_shutdown() can prevent XHCI driver from accessing port status after its bus device shutdown. Take PCIe XHCI controller as example, if XHCI driver doesn't stop roothubs polling, XHCI driver may access PCIe BAR register for port status after parent PCIe root port driver is shutdown and cause PCIe bus error. [check shared hcd exist before stopping its roothub polling -Mathias] Cc: stable@vger.kernel.org Signed-off-by: Henry Lin Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220408134823.2527272-3-mathias.nyman@linu= x.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/host/xhci.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -746,6 +746,17 @@ void xhci_shutdown(struct usb_hcd *hcd) if (xhci->quirks & XHCI_SPURIOUS_REBOOT) usb_disable_xhci_ports(to_pci_dev(hcd->self.controller)); =20 + /* Don't poll the roothubs after shutdown. */ + xhci_dbg(xhci, "%s: stopping usb%d port polling.\n", + __func__, hcd->self.busnum); + clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); + del_timer_sync(&hcd->rh_timer); + + if (xhci->shared_hcd) { + clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); + del_timer_sync(&xhci->shared_hcd->rh_timer); + } + spin_lock_irq(&xhci->lock); xhci_halt(xhci); /* Workaround for spurious wakeups at shutdown with HSW */ From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B68A6C433EF for ; Tue, 10 May 2022 13:11:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242283AbiEJNPA (ORCPT ); Tue, 10 May 2022 09:15:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242259AbiEJNOt (ORCPT ); Tue, 10 May 2022 09:14:49 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E5BC0DE8F; Tue, 10 May 2022 06:10:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8BAF1B81DA0; Tue, 10 May 2022 13:10:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C26ABC385A6; Tue, 10 May 2022 13:10:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188249; bh=ycpbxAto+dh1Mn2Va8iL5uowbHR53RqJ38c0L1VvIxE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=URNxyDP+XrT2qf7w6hqOjkc0oKQH381Bq91RZsxjIa96c0SOmYCE9w2dXs8c8nPyd FQa2hD0CwQ+2EyvD91jNkbq9hyGJfZRlbfbEAgqdNoJP07JT4Q6BHPrTbVyq9i4wli SylvSzf57ueBog5+wkDmrGm1PecFADvLtjA4+ZS0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zizhuang Deng , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.9 11/66] iio: dac: ad5592r: Fix the missing return value. Date: Tue, 10 May 2022 15:07:01 +0200 Message-Id: <20220510130730.100058610@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zizhuang Deng commit b55b38f7cc12da3b9ef36e7a3b7f8f96737df4d5 upstream. The third call to `fwnode_property_read_u32` did not record the return value, resulting in `channel_offstate` possibly being assigned the wrong value. Fixes: 56ca9db862bf ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DA= Cs") Signed-off-by: Zizhuang Deng Link: https://lore.kernel.org/r/20220310125450.4164164-1-sunsetdzz@gmail.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/iio/dac/ad5592r-base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/dac/ad5592r-base.c +++ b/drivers/iio/dac/ad5592r-base.c @@ -532,7 +532,7 @@ static int ad5592r_alloc_channels(struct if (!ret) st->channel_modes[reg] =3D tmp; =20 - fwnode_property_read_u32(child, "adi,off-state", &tmp); + ret =3D fwnode_property_read_u32(child, "adi,off-state", &tmp); if (!ret) st->channel_offstate[reg] =3D tmp; } From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F9B9C433F5 for ; Tue, 10 May 2022 13:11:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242290AbiEJNPF (ORCPT ); Tue, 10 May 2022 09:15:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58078 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242257AbiEJNOu (ORCPT ); Tue, 10 May 2022 09:14:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 37AA8140BE; Tue, 10 May 2022 06:10:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BF164615F2; Tue, 10 May 2022 13:10:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CB49FC385C2; Tue, 10 May 2022 13:10:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188252; bh=LlaNvZNC6zMQ2YYn7Jimy2RhtIUwN/GT9NAOZ5adIg8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jCWpGNEhzV+GVbvCYiO2bCjKNQfn1uiBxN+0fesTyhIAJx0UcrMw6CD3QrV0DsHap NPXxxUzXJs1arn07c07iULE8WKmyFARqtBUWaz2ymmxtrXj6GYS/qTkQeQGnnhff4O JQZuTiMRdffIZ95mvc3Lqn509Ca5/Q+bQejb7LAE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Hennerich , =?UTF-8?q?Nuno=20S=C3=A1?= , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.9 12/66] iio: dac: ad5446: Fix read_raw not returning set value Date: Tue, 10 May 2022 15:07:02 +0200 Message-Id: <20220510130730.128964573@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Michael Hennerich commit 89a01cd688d3c0ac983ef0b0e5f40018ab768317 upstream. read_raw should return the un-scaled value. Fixes: 5e06bdfb46e8b ("staging:iio:dac:ad5446: Return cached value for 'raw= ' attribute") Signed-off-by: Michael Hennerich Reviewed-by: Nuno S=C3=A1 Link: https://lore.kernel.org/r/20220406105620.1171340-1-michael.hennerich@= analog.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/iio/dac/ad5446.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/dac/ad5446.c +++ b/drivers/iio/dac/ad5446.c @@ -171,7 +171,7 @@ static int ad5446_read_raw(struct iio_de =20 switch (m) { case IIO_CHAN_INFO_RAW: - *val =3D st->cached_val; + *val =3D st->cached_val >> chan->scan_type.shift; return IIO_VAL_INT; case IIO_CHAN_INFO_SCALE: *val =3D st->vref_mv; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 98798C433EF for ; Tue, 10 May 2022 13:11:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242269AbiEJNPK (ORCPT ); Tue, 10 May 2022 09:15:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58400 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235563AbiEJNOz (ORCPT ); Tue, 10 May 2022 09:14:55 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A84C539689; Tue, 10 May 2022 06:10:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5D717B81DA1; Tue, 10 May 2022 13:10:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E45BC385A6; Tue, 10 May 2022 13:10:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188255; bh=Za0+Kg0GzcGKimpUtf0svjSHqpztZKZgkSCW3XGCFmU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yhftq2DkOVkP2eFev8B8t9wKHUy+MQqxjAj+5W9H06zlsX9T0Jwhtoi4cuJBC+GFd MWoALJM8ZVmOGahgl5rQXXkwyryyo98lPoZ9bbrIy3kz5m5YqRSQh7q3ya5Jcfg9Qb f3rbBLMJdBiPtkw75e0JzsYlDxuIYgmfKQi1lwmM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.9 13/66] iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() Date: Tue, 10 May 2022 15:07:03 +0200 Message-Id: <20220510130730.158089604@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma commit 3a26787dacf04257a68b16315c984eb2c340bc5e upstream. When the driver fails to enable the regulator 'vid', we will get the following splat: [ 79.955610] WARNING: CPU: 5 PID: 441 at drivers/regulator/core.c:2257 _r= egulator_put+0x3ec/0x4e0 [ 79.959641] RIP: 0010:_regulator_put+0x3ec/0x4e0 [ 79.967570] Call Trace: [ 79.967773] [ 79.967951] regulator_put+0x1f/0x30 [ 79.968254] devres_release_group+0x319/0x3d0 [ 79.968608] i2c_device_probe+0x766/0x940 Fix this by disabling the 'vdd' regulator when failing to enable 'vid' regulator. Signed-off-by: Zheyu Ma Link: https://lore.kernel.org/r/20220409034849.3717231-2-zheyuma97@gmail.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/iio/magnetometer/ak8975.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/iio/magnetometer/ak8975.c +++ b/drivers/iio/magnetometer/ak8975.c @@ -404,6 +404,7 @@ static int ak8975_power_on(const struct if (ret) { dev_warn(&data->client->dev, "Failed to enable specified Vid supply\n"); + regulator_disable(data->vdd); return ret; } /* From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F9E4C433EF for ; Tue, 10 May 2022 13:11:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242299AbiEJNPU (ORCPT ); Tue, 10 May 2022 09:15:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58440 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242279AbiEJNO4 (ORCPT ); Tue, 10 May 2022 09:14:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1211A39B8C; Tue, 10 May 2022 06:10:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A3F62612E4; Tue, 10 May 2022 13:10:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 99E35C385C2; Tue, 10 May 2022 13:10:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188258; bh=hnQrCi18EPXnNAEpTvcEcN8OpIE6HhfqnRYesWkdhVE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BOsvCImA0BTyja897BPuf/ruCyajaEe42bHjDtIQ4HGiqlSY5g+4nF69k4C84H+Et 0zhvGojwKB/E8eXnoNDvzj4RFWOIqANqbTQes6MM5f1EiOlOc7hRQ533gRPa/e5C37 9NTWyn4P0EiH8YPCKQu8BlJonaUNgNaMl0S/7Db8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Dongliang Mu , Hangyu Hua Subject: [PATCH 4.9 14/66] usb: misc: fix improper handling of refcount in uss720_probe() Date: Tue, 10 May 2022 15:07:04 +0200 Message-Id: <20220510130730.185569358@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua commit 0a96fa640dc928da9eaa46a22c46521b037b78ad upstream. usb_put_dev shouldn't be called when uss720_probe succeeds because of priv->usbdev. At the same time, priv->usbdev shouldn't be set to NULL before destroy_priv in uss720_disconnect because usb_put_dev is in destroy_priv. Fix this by moving priv->usbdev =3D NULL after usb_put_dev. Fixes: dcb4b8ad6a44 ("misc/uss720: fix memory leak in uss720_probe") Cc: stable Reviewed-by: Dongliang Mu Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20220407024001.11761-1-hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/misc/uss720.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/drivers/usb/misc/uss720.c +++ b/drivers/usb/misc/uss720.c @@ -87,6 +87,7 @@ static void destroy_priv(struct kref *kr =20 dev_dbg(&priv->usbdev->dev, "destroying priv datastructure\n"); usb_put_dev(priv->usbdev); + priv->usbdev =3D NULL; kfree(priv); } =20 @@ -750,7 +751,6 @@ static int uss720_probe(struct usb_inter parport_announce_port(pp); =20 usb_set_intfdata(intf, pp); - usb_put_dev(usbdev); return 0; =20 probe_abort: @@ -770,7 +770,6 @@ static void uss720_disconnect(struct usb if (pp) { priv =3D pp->private_data; usbdev =3D priv->usbdev; - priv->usbdev =3D NULL; priv->pp =3D NULL; dev_dbg(&intf->dev, "parport_remove_port\n"); parport_remove_port(pp); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47631C433F5 for ; Tue, 10 May 2022 13:11:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242317AbiEJNP2 (ORCPT ); Tue, 10 May 2022 09:15:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59258 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242257AbiEJNPG (ORCPT ); Tue, 10 May 2022 09:15:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 173793968F; Tue, 10 May 2022 06:11:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6539B615DD; Tue, 10 May 2022 13:11:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 76E29C385C6; Tue, 10 May 2022 13:11:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188260; bh=23NIjSuIAxDr+YqpEEABu2BsmOfakhswdhx5AG3Xwb4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oUbYpZeJIW/d6hDLfAbwrq9ecQWrLx8H0dAmQOwhHAEGmCjGMLNpGcDU0OKaPSuz+ NK0bVi6/THICHkpuJY+9KTnRkOEWXJYMQb6G/TmdDUqexhfMRpbEFGjbO31CNf+yHi 8LcbPPYL8f4toR1/BRkdPuBCxDZfWDiz0EMwxDSg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Vacura Subject: [PATCH 4.9 15/66] usb: gadget: uvc: Fix crash when encoding data for usb request Date: Tue, 10 May 2022 15:07:05 +0200 Message-Id: <20220510130730.213554487@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Vacura commit 71d471e3faf90c9674cadc7605ac719e82cb7fac upstream. During the uvcg_video_pump() process, if an error occurs and uvcg_queue_cancel() is called, the buffer queue will be cleared out, but the current marker (queue->buf_used) of the active buffer (no longer active) is not reset. On the next iteration of uvcg_video_pump() the stale buf_used count will be used and the logic of min((unsigned int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a nbytes size, causing an invalid memory access. [80802.185460][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. [80802.185519][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. ... uvcg_queue_cancel() is called and the queue is cleared out, but the marker queue->buf_used is not reset. ... [80802.262328][ T8682] Unable to handle kernel paging request at virtual address ffffffc03af9f000 ... ... [80802.263138][ T8682] Call trace: [80802.263146][ T8682] __memcpy+0x12c/0x180 [80802.263155][ T8682] uvcg_video_pump+0xcc/0x1e0 [80802.263165][ T8682] process_one_work+0x2cc/0x568 [80802.263173][ T8682] worker_thread+0x28c/0x518 [80802.263181][ T8682] kthread+0x160/0x170 [80802.263188][ T8682] ret_from_fork+0x10/0x18 [80802.263198][ T8682] Code: a8c12829 a88130cb a8c130 Fixes: d692522577c0 ("usb: gadget/uvc: Port UVC webcam gadget to use videob= uf2 framework") Cc: Signed-off-by: Dan Vacura Link: https://lore.kernel.org/r/20220331184024.23918-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/gadget/function/uvc_queue.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/gadget/function/uvc_queue.c +++ b/drivers/usb/gadget/function/uvc_queue.c @@ -246,6 +246,8 @@ void uvcg_queue_cancel(struct uvc_video_ buf->state =3D UVC_BUF_STATE_ERROR; vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR); } + queue->buf_used =3D 0; + /* This must be protected by the irqlock spinlock to avoid race * conditions between uvc_queue_buffer and the disconnection event that * could result in an interruptible wait in uvc_dequeue_buffer. Do not From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A68C2C4332F for ; Tue, 10 May 2022 13:11:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242369AbiEJNPh (ORCPT ); Tue, 10 May 2022 09:15:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59720 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242311AbiEJNPM (ORCPT ); Tue, 10 May 2022 09:15:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 04E963BBCC; Tue, 10 May 2022 06:11:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 72CEEB81DA0; Tue, 10 May 2022 13:11:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B4BD1C385A6; Tue, 10 May 2022 13:11:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188264; bh=OxnQB7/QxrTZahRDC9oFBGORMX0uRlChmyDd5jW8Gq4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2sBGzvDH8t2qMxrt0hx72zyVQED9xinlleXNpn8tUVwDL8Z1J7HPzcLP8c5QJeNz7 f5GCRzadnzHeMq1E85Nh0gzFThPnGBmQIzeUvAuLe65DzlDus+EGUiu4bso36Hq/kH jpBzCF/dltKnoVy1cNQnl8OA1hNvIdSj2x4UwD4M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vijayavardhan Vennapusa , Dan Vacura , stable Subject: [PATCH 4.9 16/66] usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() Date: Tue, 10 May 2022 15:07:06 +0200 Message-Id: <20220510130730.241763536@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vijayavardhan Vennapusa commit bf95c4d4630c7a2c16e7b424fdea5177d9ce0864 upstream. If any function like UVC is deactivating gadget as part of composition switch which results in not calling pullup enablement, it is not getting enabled after switch to new composition due to this deactivation flag not cleared. This results in USB enumeration not happening after switch to new USB composition. Hence clear deactivation flag inside gadget structure in configfs_composite_unbind() before switch to new USB composition. Signed-off-by: Vijayavardhan Vennapusa Signed-off-by: Dan Vacura Cc: stable Link: https://lore.kernel.org/r/20220413211038.72797-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/usb/gadget/configfs.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -1409,6 +1409,8 @@ static void configfs_composite_unbind(st usb_ep_autoconfig_reset(cdev->gadget); spin_lock_irqsave(&gi->spinlock, flags); cdev->gadget =3D NULL; + cdev->deactivations =3D 0; + gadget->deactivated =3D false; set_gadget_data(gadget, NULL); spin_unlock_irqrestore(&gi->spinlock, flags); } From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F610C433EF for ; Tue, 10 May 2022 13:11:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242378AbiEJNPq (ORCPT ); Tue, 10 May 2022 09:15:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59726 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242326AbiEJNPN (ORCPT ); Tue, 10 May 2022 09:15:13 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A83433DDD9; Tue, 10 May 2022 06:11:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 434CCB81DA0; Tue, 10 May 2022 13:11:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9B9D6C385C2; Tue, 10 May 2022 13:11:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188267; bh=wIUgrLEUksX9+NwqoM4BF9drXj5Mvgc4IuLnlnE4xjA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bBktyjuw1dDL7j2ZeiQnmrbV0kAZAaqenGQoUlZ5aENFOYHhMHaBHLt7uN+YvWSNO HTiJhctnL0NoDXIc9JlJcT7Bbrnlsbv/kkeh0osen1gfdgcFlOiO7fY3OYO4/UkoTe ODjA8CcYpBPTxUSRVREfEdj8HAocVNYMKkccKS0I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Maciej W. Rozycki" , Andy Shevchenko Subject: [PATCH 4.9 17/66] serial: 8250: Also set sticky MCR bits in console restoration Date: Tue, 10 May 2022 15:07:07 +0200 Message-Id: <20220510130730.270859477@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maciej W. Rozycki commit 6e6eebdf5e2455f089ccd000754a0deaeb79af82 upstream. Sticky MCR bits are lost in console restoration if console suspending has been disabled. This currently affects the AFE bit, which works in combination with RTS which we set, so we want to make sure the UART retains control of its FIFO where previously requested. Also specific drivers may need other bits in the future. Signed-off-by: Maciej W. Rozycki Fixes: 4516d50aabed ("serial: 8250: Use canary to restart console after sus= pend") Cc: stable@vger.kernel.org # v4.0+ Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181518490.9383@angie.or= cam.me.uk Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/tty/serial/8250/8250_port.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/tty/serial/8250/8250_port.c +++ b/drivers/tty/serial/8250/8250_port.c @@ -3150,7 +3150,7 @@ static void serial8250_console_restore(s =20 serial8250_set_divisor(port, baud, quot, frac); serial_port_out(port, UART_LCR, up->lcr); - serial8250_out_MCR(up, UART_MCR_DTR | UART_MCR_RTS); + serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS); } =20 /* From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84EF3C433EF for ; Tue, 10 May 2022 13:11:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242372AbiEJNPm (ORCPT ); Tue, 10 May 2022 09:15:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60338 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242304AbiEJNPW (ORCPT ); Tue, 10 May 2022 09:15:22 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8B29C3EAAF; Tue, 10 May 2022 06:11:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3D807B81D7C; Tue, 10 May 2022 13:11:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 95164C385C2; Tue, 10 May 2022 13:11:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188269; bh=DGQ7jVZyhgmwAFlPWHfag//rhR+MqULuSCpSlE56/uk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dLFANLw4naMY1XtmE7pDyu5YmhlxgEXmgcdsjTBldIOrSa4eQHOkef2W6PNSsZIE+ X7BbVK/7YM3781+ZJNzOkTuriX1xgiAQPnXX915KHCyV0c52JnlXXkxJA2za6dQVrw DPL/4/gMW/xhR4awGfj1Y2NU0ry8H2fQ2QmE2R/k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Maciej W. Rozycki" , stable , Andy Shevchenko Subject: [PATCH 4.9 18/66] serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device Date: Tue, 10 May 2022 15:07:08 +0200 Message-Id: <20220510130730.299292864@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maciej W. Rozycki commit 637674fa40059cddcc3ad2212728965072f62ea3 upstream. The EndRun PTP/1588 dual serial port device is based on the Oxford Semiconductor OXPCIe952 UART device with the PCI vendor:device ID set for EndRun Technologies and is therefore driven by a fixed 62.5MHz clock input derived from the 100MHz PCI Express clock. The clock rate is divided by the oversampling rate of 16 as it is supplied to the baud rate generator, yielding the baud base of 3906250. Replace the incorrect baud base of 4000000 with the right value of 3906250 then, complementing commit 6cbe45d8ac93 ("serial: 8250: Correct the clock for OxSemi PCIe devices"). Signed-off-by: Maciej W. Rozycki Cc: stable Fixes: 1bc8cde46a159 ("8250_pci: Added driver for Endrun Technologies PTP P= CIe card.") Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181515270.9383@angie.or= cam.me.uk Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/tty/serial/8250/8250_pci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/tty/serial/8250/8250_pci.c +++ b/drivers/tty/serial/8250/8250_pci.c @@ -2915,7 +2915,7 @@ enum pci_board_num_t { pbn_panacom2, pbn_panacom4, pbn_plx_romulus, - pbn_endrun_2_4000000, + pbn_endrun_2_3906250, pbn_oxsemi, pbn_oxsemi_1_4000000, pbn_oxsemi_2_4000000, @@ -3479,10 +3479,10 @@ static struct pciserial_board pci_boards * signal now many ports are available * 2 port 952 Uart support */ - [pbn_endrun_2_4000000] =3D { + [pbn_endrun_2_3906250] =3D { .flags =3D FL_BASE0, .num_ports =3D 2, - .base_baud =3D 4000000, + .base_baud =3D 3906250, .uart_offset =3D 0x200, .first_offset =3D 0x1000, }, @@ -4430,7 +4430,7 @@ static struct pci_device_id serial_pci_t */ { PCI_VENDOR_ID_ENDRUN, PCI_DEVICE_ID_ENDRUN_1588, PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_endrun_2_4000000 }, + pbn_endrun_2_3906250 }, /* * Quatech cards. These actually have configurable clocks but for * now we just use the default. From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7D59C433F5 for ; Tue, 10 May 2022 13:12:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242404AbiEJNPz (ORCPT ); Tue, 10 May 2022 09:15:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60870 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242318AbiEJNPc (ORCPT ); Tue, 10 May 2022 09:15:32 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C9B8A369CD; Tue, 10 May 2022 06:11:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id B976ACE1EE2; Tue, 10 May 2022 13:11:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C4D0EC385D3; Tue, 10 May 2022 13:11:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188273; bh=xNaN2J7XaIrUH2DW0OpIFN3289nXX4c1YssyrcL1db8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Pw8pOGGubpV+CxEvoWX0cVWgJtpVS7YE+kuPgt8Dk4IDVeNQrTqnb9gjYLkrHBWOE 8Id6VIzafnH5/GB0Bi4MZlUUP1A0A018j+sk4QDu/a7TyDrKUw+6Sv3z1XiVDdVV6N F0pXuCp7Ho6BsJ5+37i7FhiIdckUMzRnQ4mYQwS4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Linus Torvalds Subject: [PATCH 4.9 19/66] hex2bin: make the function hex_to_bin constant-time Date: Tue, 10 May 2022 15:07:09 +0200 Message-Id: <20220510130730.327688811@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit e5be15767e7e284351853cbaba80cde8620341fb upstream. The function hex2bin is used to load cryptographic keys into device mapper targets dm-crypt and dm-integrity. It should take constant time independent on the processed data, so that concurrently running unprivileged code can't infer any information about the keys via microarchitectural convert channels. This patch changes the function hex_to_bin so that it contains no branches and no memory accesses. Note that this shouldn't cause performance degradation because the size of the new function is the same as the size of the old function (on x86-64) - and the new function causes no branch misprediction penalties. I compile-tested this function with gcc on aarch64 alpha arm hppa hppa64 i386 ia64 m68k mips32 mips64 powerpc powerpc64 riscv sh4 s390x sparc32 sparc64 x86_64 and with clang on aarch64 arm hexagon i386 mips32 mips64 powerpc powerpc64 s390x sparc32 sparc64 x86_64 to verify that there are no branches in the generated code. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- include/linux/kernel.h | 2 +- lib/hexdump.c | 32 +++++++++++++++++++++++++------- 2 files changed, 26 insertions(+), 8 deletions(-) --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -530,7 +530,7 @@ static inline char *hex_byte_pack_upper( return buf; } =20 -extern int hex_to_bin(char ch); +extern int hex_to_bin(unsigned char ch); extern int __must_check hex2bin(u8 *dst, const char *src, size_t count); extern char *bin2hex(char *dst, const void *src, size_t count); =20 --- a/lib/hexdump.c +++ b/lib/hexdump.c @@ -24,15 +24,33 @@ EXPORT_SYMBOL(hex_asc_upper); * * hex_to_bin() converts one hex digit to its actual value or -1 in case o= f bad * input. + * + * This function is used to load cryptographic keys, so it is coded in suc= h a + * way that there are no conditions or memory accesses that depend on data. + * + * Explanation of the logic: + * (ch - '9' - 1) is negative if ch <=3D '9' + * ('0' - 1 - ch) is negative if ch >=3D '0' + * we "and" these two values, so the result is negative if ch is in the ra= nge + * '0' ... '9' + * we are only interested in the sign, so we do a shift ">> 8"; note that = right + * shift of a negative value is implementation-defined, so we cast the + * value to (unsigned) before the shift --- we have 0xffffff if ch is in + * the range '0' ... '9', 0 otherwise + * we "and" this value with (ch - '0' + 1) --- we have a value 1 ... 10 if= ch is + * in the range '0' ... '9', 0 otherwise + * we add this value to -1 --- we have a value 0 ... 9 if ch is in the ran= ge '0' + * ... '9', -1 otherwise + * the next line is similar to the previous one, but we need to decode both + * uppercase and lowercase letters, so we use (ch & 0xdf), which converts + * lowercase to uppercase */ -int hex_to_bin(char ch) +int hex_to_bin(unsigned char ch) { - if ((ch >=3D '0') && (ch <=3D '9')) - return ch - '0'; - ch =3D tolower(ch); - if ((ch >=3D 'a') && (ch <=3D 'f')) - return ch - 'a' + 10; - return -1; + unsigned char cu =3D ch & 0xdf; + return -1 + + ((ch - '0' + 1) & (unsigned)((ch - '9' - 1) & ('0' - 1 - ch)) >> 8) + + ((cu - 'A' + 11) & (unsigned)((cu - 'F' - 1) & ('A' - 1 - cu)) >> 8); } EXPORT_SYMBOL(hex_to_bin); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DAA6C433EF for ; Tue, 10 May 2022 13:12:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230385AbiEJNQc (ORCPT ); Tue, 10 May 2022 09:16:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242308AbiEJNPf (ORCPT ); Tue, 10 May 2022 09:15:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5A66F42EC6; Tue, 10 May 2022 06:11:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CC5ABB81D7C; Tue, 10 May 2022 13:11:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D283C385C2; Tue, 10 May 2022 13:11:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188279; bh=xnGMAVPnM6acoucr9QgmgxwJzzrZh7N4dF54mhzvUa8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e6jqdMiPSA0GZzSWerzulKYXcG6pFas96cI+jBQKWuPXXXB4zE1zpfJFSVxnSfbYg o5RL5yohdGfJkrFDFtQFuZ3iubuaf4gzYm5dRnn/smC9r/7a9lDQe5pDHsYZNPlv51 E3VxAnPmVjyR0LXIGJTEA+98lesfUIUyDxiFaqps= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Andy Shevchenko , Linus Torvalds Subject: [PATCH 4.9 20/66] hex2bin: fix access beyond string end Date: Tue, 10 May 2022 15:07:10 +0200 Message-Id: <20220510130730.355650511@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit e4d8a29997731b3bb14059024b24df9f784288d0 upstream. If we pass too short string to "hex2bin" (and the string size without the terminating NUL character is even), "hex2bin" reads one byte after the terminating NUL character. This patch fixes it. Note that hex_to_bin returns -1 on error and hex2bin return -EINVAL on error - so we can't just return the variable "hi" or "lo" on error. This inconsistency may be fixed in the next merge window, but for the purpose of fixing this bug, we just preserve the existing behavior and return -1 and -EINVAL. Signed-off-by: Mikulas Patocka Reviewed-by: Andy Shevchenko Fixes: b78049831ffe ("lib: add error checking to hex2bin") Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- lib/hexdump.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/lib/hexdump.c +++ b/lib/hexdump.c @@ -65,10 +65,13 @@ EXPORT_SYMBOL(hex_to_bin); int hex2bin(u8 *dst, const char *src, size_t count) { while (count--) { - int hi =3D hex_to_bin(*src++); - int lo =3D hex_to_bin(*src++); + int hi, lo; =20 - if ((hi < 0) || (lo < 0)) + hi =3D hex_to_bin(*src++); + if (unlikely(hi < 0)) + return -1; + lo =3D hex_to_bin(*src++); + if (unlikely(lo < 0)) return -1; =20 *dst++ =3D (hi << 4) | lo; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47D36C43217 for ; Tue, 10 May 2022 13:12:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242399AbiEJNQX (ORCPT ); Tue, 10 May 2022 09:16:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32912 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242370AbiEJNPh (ORCPT ); Tue, 10 May 2022 09:15:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E6F044A0C; Tue, 10 May 2022 06:11:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 28519615F4; Tue, 10 May 2022 13:11:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31C76C385C6; Tue, 10 May 2022 13:11:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188282; bh=vnTXKHoW+s1UCoDCJYnUiMkurm5wSeldRpOsZ741LXw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2DUZ7Q7RGyiDdlgg1B1OkK7b/GX4ZidaeynLXiXZMKicS5awAJdIDQm3HMkWVCMFf Nw3FfFlpzNCK+khbsrs+R1n7YSuq7AwyjBe+XC/7JB9zBLPvOhTsfzu+JvY8kV1MAC Mjnl2CVHIQuOAM+wzyFxBCJ1jWCuqQfBEz2LlKMM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Fabio Estevam , Tim Harvey , Max Krummenacher , Shawn Guo , Sasha Levin Subject: [PATCH 4.9 21/66] ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue Date: Tue, 10 May 2022 15:07:11 +0200 Message-Id: <20220510130730.383346503@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Fabio Estevam [ Upstream commit fa51e1dc4b91375bc18349663a52395ad585bd3c ] On a custom carrier board with a i.MX6Q Apalis SoM, the sgtl5000 codec on the SoM is often not detected and the following error message is seen when the sgtl5000 driver tries to read the ID register: sgtl5000 1-000a: Error reading chip id -6 The reason for the error is that the MCLK clock is not provided early enough. Fix the problem by describing the MCLK pinctrl inside the codec node instead of placing it inside the audmux pinctrl group. With this change applied the sgtl5000 is always detected on every boot. Fixes: 693e3ffaae5a ("ARM: dts: imx6: Add support for Toradex Apalis iMX6Q/= D SoM") Signed-off-by: Fabio Estevam Reviewed-by: Tim Harvey Acked-by: Max Krummenacher Signed-off-by: Shawn Guo Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/arm/boot/dts/imx6qdl-apalis.dtsi | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm/boot/dts/imx6qdl-apalis.dtsi b/arch/arm/boot/dts/imx6= qdl-apalis.dtsi index 99e323b57261..cbe7b0dcb6eb 100644 --- a/arch/arm/boot/dts/imx6qdl-apalis.dtsi +++ b/arch/arm/boot/dts/imx6qdl-apalis.dtsi @@ -324,6 +324,8 @@ vgen6_reg: vgen6 { codec: sgtl5000@0a { compatible =3D "fsl,sgtl5000"; reg =3D <0x0a>; + pinctrl-names =3D "default"; + pinctrl-0 =3D <&pinctrl_sgtl5000>; clocks =3D <&clks IMX6QDL_CLK_CKO>; VDDA-supply =3D <®_2p5v>; VDDIO-supply =3D <®_3p3v>; @@ -550,8 +552,6 @@ MX6QDL_PAD_DISP0_DAT20__AUD4_TXC 0x130b0 MX6QDL_PAD_DISP0_DAT21__AUD4_TXD 0x130b0 MX6QDL_PAD_DISP0_DAT22__AUD4_TXFS 0x130b0 MX6QDL_PAD_DISP0_DAT23__AUD4_RXD 0x130b0 - /* SGTL5000 sys_mclk */ - MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 >; }; =20 @@ -812,6 +812,12 @@ MX6QDL_PAD_NANDF_CS1__GPIO6_IO14 0x000b0 >; }; =20 + pinctrl_sgtl5000: sgtl5000grp { + fsl,pins =3D < + MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 + >; + }; + pinctrl_spdif: spdifgrp { fsl,pins =3D < MX6QDL_PAD_GPIO_16__SPDIF_IN 0x1b0b0 --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 543C9C433FE for ; Tue, 10 May 2022 13:12:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242434AbiEJNQk (ORCPT ); Tue, 10 May 2022 09:16:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242315AbiEJNPt (ORCPT ); Tue, 10 May 2022 09:15:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AD9D048316; Tue, 10 May 2022 06:11:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3A215615F6; Tue, 10 May 2022 13:11:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 39B26C385C2; Tue, 10 May 2022 13:11:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188285; bh=j4PcXJsjL/hECOwko18xaKCIErLy1pvHvAg5qkb9TAo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YiSve1dP3CrRseFn0LIKbgjnV+S7EZnK1pNvbPo3e5lZlrXTU3cX9V63+KLgzl7el DUnBLWfoC48xrW3ZRJPdP+B4grQcEUh7WAVgkVEkYBV7gdVouh7L6ap8ntm/im3BJm I3hxPOIj1h0q9X3I51ohUru1EAijWYCYY7am7zH0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Krzysztof Kozlowski , Vinod Koul , Sasha Levin Subject: [PATCH 4.9 22/66] phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe Date: Tue, 10 May 2022 15:07:12 +0200 Message-Id: <20220510130730.415323343@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 388ec8f079f2f20d5cd183c3bc6f33cbc3ffd3ef ] The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done. Fixes: bcff4cba41bc ("PHY: Exynos: Add Exynos5250 SATA PHY driver") Signed-off-by: Miaoqian Lin Reviewed-by: Krzysztof Kozlowski Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220407091857.230386-1-krzysztof.kozlowski= @linaro.org Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/phy/phy-exynos5250-sata.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/phy/phy-exynos5250-sata.c b/drivers/phy/phy-exynos5250= -sata.c index 60e13afcd9b8..7960c69d09a6 100644 --- a/drivers/phy/phy-exynos5250-sata.c +++ b/drivers/phy/phy-exynos5250-sata.c @@ -193,6 +193,7 @@ static int exynos_sata_phy_probe(struct platform_device= *pdev) return -EINVAL; =20 sata_phy->client =3D of_find_i2c_device_by_node(node); + of_node_put(node); if (!sata_phy->client) return -EPROBE_DEFER; =20 --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1C77C4167E for ; Tue, 10 May 2022 13:20:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242590AbiEJNYJ (ORCPT ); Tue, 10 May 2022 09:24:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45970 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242850AbiEJNVG (ORCPT ); Tue, 10 May 2022 09:21:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5F9382BEF91; Tue, 10 May 2022 06:13:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E7871615DD; Tue, 10 May 2022 13:13:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 02A36C385A6; Tue, 10 May 2022 13:13:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188435; bh=jPCt92pU+Wl1pS6fP94Kk4e1Bgc7LQaNowyPjPGqyJk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WeA4G7jaq3cPVCpFHZrpo4AXP11ZMEcNs/gIG0eeRiH/cEARYesaJRNgtmjFo3l1M ossmIWXgdgx3bvqzlzBqMiuxd+CgOAhWc/6ePc4zjrnywnA86dcFolG2M6MiYJqQIX qwfQJHHCCU6mWf2zEaoSRrAcW9zRUbUZvlwFKc/Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , Alim Akhtar , Vinod Koul , Sasha Levin Subject: [PATCH 4.9 23/66] phy: samsung: exynos5250-sata: fix missing device put in probe error paths Date: Tue, 10 May 2022 15:07:13 +0200 Message-Id: <20220510130730.448142967@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski [ Upstream commit 5c8402c4db45dd55c2c93c8d730f5dfa7c78a702 ] The actions of of_find_i2c_device_by_node() in probe function should be reversed in error paths by putting the reference to obtained device. Fixes: bcff4cba41bc ("PHY: Exynos: Add Exynos5250 SATA PHY driver") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20220407091857.230386-2-krzysztof.kozlowski= @linaro.org Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/phy/phy-exynos5250-sata.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/phy/phy-exynos5250-sata.c b/drivers/phy/phy-exynos5250= -sata.c index 7960c69d09a6..2c39d2fd3cd8 100644 --- a/drivers/phy/phy-exynos5250-sata.c +++ b/drivers/phy/phy-exynos5250-sata.c @@ -202,20 +202,21 @@ static int exynos_sata_phy_probe(struct platform_devi= ce *pdev) sata_phy->phyclk =3D devm_clk_get(dev, "sata_phyctrl"); if (IS_ERR(sata_phy->phyclk)) { dev_err(dev, "failed to get clk for PHY\n"); - return PTR_ERR(sata_phy->phyclk); + ret =3D PTR_ERR(sata_phy->phyclk); + goto put_dev; } =20 ret =3D clk_prepare_enable(sata_phy->phyclk); if (ret < 0) { dev_err(dev, "failed to enable source clk\n"); - return ret; + goto put_dev; } =20 sata_phy->phy =3D devm_phy_create(dev, NULL, &exynos_sata_phy_ops); if (IS_ERR(sata_phy->phy)) { - clk_disable_unprepare(sata_phy->phyclk); dev_err(dev, "failed to create PHY\n"); - return PTR_ERR(sata_phy->phy); + ret =3D PTR_ERR(sata_phy->phy); + goto clk_disable; } =20 phy_set_drvdata(sata_phy->phy, sata_phy); @@ -223,11 +224,18 @@ static int exynos_sata_phy_probe(struct platform_devi= ce *pdev) phy_provider =3D devm_of_phy_provider_register(dev, of_phy_simple_xlate); if (IS_ERR(phy_provider)) { - clk_disable_unprepare(sata_phy->phyclk); - return PTR_ERR(phy_provider); + ret =3D PTR_ERR(phy_provider); + goto clk_disable; } =20 return 0; + +clk_disable: + clk_disable_unprepare(sata_phy->phyclk); +put_dev: + put_device(&sata_phy->client->dev); + + return ret; } =20 static const struct of_device_id exynos_sata_phy_of_match[] =3D { --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A56E2C433F5 for ; Tue, 10 May 2022 13:14:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242479AbiEJNSo (ORCPT ); Tue, 10 May 2022 09:18:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36170 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242334AbiEJNQT (ORCPT ); Tue, 10 May 2022 09:16:19 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C551341316; Tue, 10 May 2022 06:12:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id CD5EACE1EE7; Tue, 10 May 2022 13:11:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E548EC385C2; Tue, 10 May 2022 13:11:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188311; bh=rBjHofO1WNs/cYxljno5UdrSN3KrNADHJN7VZG+ibug=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LsYY/uxRvuTlbNT21mpYs+bZw9b75GpXkQDm8P/SjDhkCUgsFTODUobl9UQL2GPw3 vXFTlofm7LhUCIQBbKi09rjFECYAshtRMwKbGPb3FE+4JzXIHC6H/wWK15a57wC74+ SN6zFLPGGZzOZSxAPGxqJvazrOu8kjGMmThKpwXA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Tony Lindgren , Sasha Levin Subject: [PATCH 4.9 24/66] ARM: OMAP2+: Fix refcount leak in omap_gic_of_init Date: Tue, 10 May 2022 15:07:14 +0200 Message-Id: <20220510130730.476446114@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 0f83e6b4161617014017a694888dd8743f46f071 ] The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_node_put() to release the refcount. Fixes: fd1c07861491 ("ARM: OMAP4: Fix the init code to have OMAP4460 errata= available in DT build") Signed-off-by: Miaoqian Lin Message-Id: <20220309104302.18398-1-linmq006@gmail.com> Signed-off-by: Tony Lindgren Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/arm/mach-omap2/omap4-common.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4= -common.c index e5dcbda20129..7fff67ea7bcd 100644 --- a/arch/arm/mach-omap2/omap4-common.c +++ b/arch/arm/mach-omap2/omap4-common.c @@ -342,10 +342,12 @@ void __init omap_gic_of_init(void) =20 np =3D of_find_compatible_node(NULL, NULL, "arm,cortex-a9-gic"); gic_dist_base_addr =3D of_iomap(np, 0); + of_node_put(np); WARN_ON(!gic_dist_base_addr); =20 np =3D of_find_compatible_node(NULL, NULL, "arm,cortex-a9-twd-timer"); twd_base =3D of_iomap(np, 0); + of_node_put(np); WARN_ON(!twd_base); =20 skip_errata_init: --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5EA8C433EF for ; Tue, 10 May 2022 13:15:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242487AbiEJNTF (ORCPT ); Tue, 10 May 2022 09:19:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36194 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242393AbiEJNQk (ORCPT ); Tue, 10 May 2022 09:16:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B82973B29E; Tue, 10 May 2022 06:12:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 31711B81DA0; Tue, 10 May 2022 13:12:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 55368C385A6; Tue, 10 May 2022 13:12:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188344; bh=SLdg5yQDshNopyNphjAcK8RuTMyxpnoR8vDJbHjfhKE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yuI78ymuIsoe/FJPnP2sPnMIVUbpL+lp3QTiAVXxoK+DJGO3yA4FpbawDvgrBPwpa RX3X53Wt6DroJkC1s3GzlwqB/YEeyXzaDRQno7r9N5R/Sy1Izc+xP7WUvmbOZglLl6 G+TtOFWwIlpBhKbjOB7uxLfE/VyDAm5S2NdPsnks= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "H. Nikolaus Schaller" , Tony Lindgren , Sasha Levin Subject: [PATCH 4.9 25/66] ARM: dts: Fix mmc order for omap3-gta04 Date: Tue, 10 May 2022 15:07:15 +0200 Message-Id: <20220510130730.504084906@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: H. Nikolaus Schaller [ Upstream commit 09269dd050094593fc747f2a5853d189fefcb6b5 ] Commit a1ebdb374199 ("ARM: dts: Fix swapped mmc order for omap3") introduces general mmc aliases. Let's tailor them to the need of the GTA04 board which does not make use of mmc2 and mmc3 interfaces. Fixes: a1ebdb374199 ("ARM: dts: Fix swapped mmc order for omap3") Signed-off-by: H. Nikolaus Schaller Message-Id: Signed-off-by: Tony Lindgren Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/arm/boot/dts/omap3-gta04.dtsi | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-g= ta04.dtsi index 338ee6bd0e0c..ced298d07338 100644 --- a/arch/arm/boot/dts/omap3-gta04.dtsi +++ b/arch/arm/boot/dts/omap3-gta04.dtsi @@ -29,6 +29,8 @@ memory@80000000 { aliases { display0 =3D &lcd; display1 =3D &tv0; + /delete-property/ mmc2; + /delete-property/ mmc3; }; =20 gpio-keys { --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4751EC433F5 for ; Tue, 10 May 2022 13:16:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242667AbiEJNUa (ORCPT ); Tue, 10 May 2022 09:20:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37530 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242570AbiEJNRi (ORCPT ); Tue, 10 May 2022 09:17:38 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8040F54BFA; Tue, 10 May 2022 06:12:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E486A6163C; Tue, 10 May 2022 13:12:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0309DC385C2; Tue, 10 May 2022 13:12:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188376; bh=T7RLLRF+WnGxdF5U/uDdWdVdC42qAGpkSOv5yV9pbIw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Yu0wmP1JLhP7C7Mdkbs08PynwE1i0ptLuaBNti1mGDQph+GQNFzUWFwr7NlR1fw/k alqSPZOU1JkR5gXT8Gdt/ciKmgHB9gPi13W+pV4Up2eyOj+l986yV8cg+kKm+4obH5 jl3m1AJyC7HlPxsneqyHWlOdxIkkMa4yws3HLgMA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Miquel Raynal , Sasha Levin Subject: [PATCH 4.9 26/66] mtd: rawnand: Fix return value check of wait_for_completion_timeout Date: Tue, 10 May 2022 15:07:16 +0200 Message-Id: <20220510130730.532084656@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 084c16ab423a8890121b902b405823bfec5b4365 ] wait_for_completion_timeout() returns unsigned long not int. It returns 0 if timed out, and positive if completed. The check for <=3D 0 is ambiguous and should be =3D=3D 0 here indicating timeout which is the only error case. Fixes: 83738d87e3a0 ("mtd: sh_flctl: Add DMA capabilty") Signed-off-by: Miaoqian Lin Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220412083435.29254-1-linmq006@gma= il.com Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/mtd/nand/sh_flctl.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c index 31f98acdba07..17e15bd05442 100644 --- a/drivers/mtd/nand/sh_flctl.c +++ b/drivers/mtd/nand/sh_flctl.c @@ -399,7 +399,8 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *fl= ctl, unsigned long *buf, dma_addr_t dma_addr; dma_cookie_t cookie; uint32_t reg; - int ret; + int ret =3D 0; + unsigned long time_left; =20 if (dir =3D=3D DMA_FROM_DEVICE) { chan =3D flctl->chan_fifo0_rx; @@ -440,13 +441,14 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *= flctl, unsigned long *buf, goto out; } =20 - ret =3D + time_left =3D wait_for_completion_timeout(&flctl->dma_complete, msecs_to_jiffies(3000)); =20 - if (ret <=3D 0) { + if (time_left =3D=3D 0) { dmaengine_terminate_all(chan); dev_err(&flctl->pdev->dev, "wait_for_completion_timeout\n"); + ret =3D -ETIMEDOUT; } =20 out: @@ -456,7 +458,7 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *fl= ctl, unsigned long *buf, =20 dma_unmap_single(chan->device->dev, dma_addr, len, dir); =20 - /* ret > 0 is success */ + /* ret =3D=3D 0 is success */ return ret; } =20 @@ -480,7 +482,7 @@ static void read_fiforeg(struct sh_flctl *flctl, int rl= en, int offset) =20 /* initiate DMA transfer */ if (flctl->chan_fifo0_rx && rlen >=3D 32 && - flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE) > 0) + !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE)) goto convert; /* DMA success */ =20 /* do polling transfer */ @@ -539,7 +541,7 @@ static void write_ec_fiforeg(struct sh_flctl *flctl, in= t rlen, =20 /* initiate DMA transfer */ if (flctl->chan_fifo0_tx && rlen >=3D 32 && - flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE) > 0) + !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE)) return; /* DMA success */ =20 /* do polling transfer */ --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6A33C4167E for ; Tue, 10 May 2022 13:28:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243809AbiEJNcP (ORCPT ); Tue, 10 May 2022 09:32:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45940 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242662AbiEJNU2 (ORCPT ); Tue, 10 May 2022 09:20:28 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E10F325473B; Tue, 10 May 2022 06:13:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 3E007CE1EE3; Tue, 10 May 2022 13:13:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3EAADC385A6; Tue, 10 May 2022 13:13:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188408; bh=SkicZJaon+6r860YY3xSembF7T/c32xtoZ769rYVxNU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TTr3NiaPyhCjCrBJezyDgGYx7pZ462xw7tvfE3qG6T5ABq3aIzgEBXAEZstohHPPb fZK7Cn6sdCx3cpiYmC6KVDIggaKuczCO1Htpi5+sV01rPpHaZvqU0arjS+LhCxV/7C 48j2DZyQjs4krdpR+T0Zl7PMlt772PRTbDgxEImw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zeal Robot , Lv Ruyi , Linus Walleij , Sasha Levin Subject: [PATCH 4.9 27/66] pinctrl: pistachio: fix use of irq_of_parse_and_map() Date: Tue, 10 May 2022 15:07:17 +0200 Message-Id: <20220510130730.560236635@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lv Ruyi [ Upstream commit 0c9843a74a85224a89daa81fa66891dae2f930e1 ] The irq_of_parse_and_map() function returns 0 on failure, and does not return an negative value. Fixes: cefc03e5995e ("pinctrl: Add Pistachio SoC pin control driver") Reported-by: Zeal Robot Signed-off-by: Lv Ruyi Link: https://lore.kernel.org/r/20220424031430.3170759-1-lv.ruyi@zte.com.cn Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/pinctrl/pinctrl-pistachio.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-= pistachio.c index b2b7e238bda9..fc8c57527fb7 100644 --- a/drivers/pinctrl/pinctrl-pistachio.c +++ b/drivers/pinctrl/pinctrl-pistachio.c @@ -1374,10 +1374,10 @@ static int pistachio_gpio_register(struct pistachio= _pinctrl *pctl) } =20 irq =3D irq_of_parse_and_map(child, 0); - if (irq < 0) { - dev_err(pctl->dev, "No IRQ for bank %u: %d\n", i, irq); + if (!irq) { + dev_err(pctl->dev, "No IRQ for bank %u\n", i); of_node_put(child); - ret =3D irq; + ret =3D -EINVAL; goto err; } =20 --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51604C352AA for ; Tue, 10 May 2022 13:20:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242938AbiEJNWm (ORCPT ); Tue, 10 May 2022 09:22:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37530 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241546AbiEJNUx (ORCPT ); Tue, 10 May 2022 09:20:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3AABD2BA99F; Tue, 10 May 2022 06:13:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8621E61574; Tue, 10 May 2022 13:13:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97C41C385C2; Tue, 10 May 2022 13:13:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188421; bh=LaDG7CapcarKnFOEKMZMJPT3w1lOlsP0oILBZQfjazE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=keR0KxHlIZRniJmEPvjCDDYQ63tIfR0bK4iTcw+Yf3AQ4nniwL2jhRtK5DDXPnWKZ L2PZhpUXS/YJIK8vmBjkoyjj0+fnW99Afa074rR1H3QRUOEDMTQ/wUIudN90HSflyQ MdnqnmDsmzXmFHc2/oGcI/PLzKEi+GEd+BK7CX1w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peilin Ye , William Tu , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 28/66] ip_gre: Make o_seqno start from 0 in native mode Date: Tue, 10 May 2022 15:07:18 +0200 Message-Id: <20220510130730.590531468@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peilin Ye [ Upstream commit ff827beb706ed719c766acf36449801ded0c17fc ] For GRE and GRETAP devices, currently o_seqno starts from 1 in native mode. According to RFC 2890 2.2., "The first datagram is sent with a sequence number of 0." Fix it. It is worth mentioning that o_seqno already starts from 0 in collect_md mode, see gre_fb_xmit(), where tunnel->o_seqno is passed to gre_build_header() before getting incremented. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Peilin Ye Acked-by: William Tu Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/ipv4/ip_gre.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c index fe1801d9f059..eec225c637f0 100644 --- a/net/ipv4/ip_gre.c +++ b/net/ipv4/ip_gre.c @@ -339,14 +339,12 @@ static void __gre_xmit(struct sk_buff *skb, struct ne= t_device *dev, __be16 proto) { struct ip_tunnel *tunnel =3D netdev_priv(dev); - - if (tunnel->parms.o_flags & TUNNEL_SEQ) - tunnel->o_seqno++; + __be16 flags =3D tunnel->parms.o_flags; =20 /* Push GRE header. */ gre_build_header(skb, tunnel->tun_hlen, - tunnel->parms.o_flags, proto, tunnel->parms.o_key, - htonl(tunnel->o_seqno)); + flags, proto, tunnel->parms.o_key, + (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); =20 ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol); } --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82D4AC4167D for ; Tue, 10 May 2022 13:28:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243637AbiEJNbo (ORCPT ); Tue, 10 May 2022 09:31:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45984 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242758AbiEJNVB (ORCPT ); Tue, 10 May 2022 09:21:01 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0045F2BB2D0; Tue, 10 May 2022 06:13:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 4CE18CE1EE2; Tue, 10 May 2022 13:13:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 62230C385A6; Tue, 10 May 2022 13:13:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188423; bh=4BevFSo4u1/OOEbkv59wJVzgE798kjeM/YDKIqMo4us=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KaLee5XcmUm9YaTkbRjxcGxD85i5ijsjjAOSCLEGsCXZYoaLCmCQ+/yX/mKrHVd1q 4+V3Mbhh45A9HErcuB9UWK9UH5AjQySCSiUarHwKN0PYeUjpW/lmX9PN0/h1gCrcBC JbQTzjQvWCtiz8mN3dPz0VA0uHO6GH8mtAcDmimk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Doug Porter , Soheil Hassas Yeganeh , Neal Cardwell , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 29/66] tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT Date: Tue, 10 May 2022 15:07:19 +0200 Message-Id: <20220510130730.620579032@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 4bfe744ff1644fbc0a991a2677dc874475dd6776 ] I had this bug sitting for too long in my pile, it is time to fix it. Thanks to Doug Porter for reminding me of it! We had various attempts in the past, including commit 0cbe6a8f089e ("tcp: remove SOCK_QUEUE_SHRUNK"), but the issue is that TCP stack currently only generates EPOLLOUT from input path, when tp->snd_una has advanced and skb(s) cleaned from rtx queue. If a flow has a big RTT, and/or receives SACKs, it is possible that the notsent part (tp->write_seq - tp->snd_nxt) reaches 0 and no more data can be sent until tp->snd_una finally advances. What is needed is to also check if POLLOUT needs to be generated whenever tp->snd_nxt is advanced, from output path. This bug triggers more often after an idle period, as we do not receive ACK for at least one RTT. tcp_notsent_lowat could be a fraction of what CWND and pacing rate would allow to send during this RTT. In a followup patch, I will remove the bogus call to tcp_chrono_stop(sk, TCP_CHRONO_SNDBUF_LIMITED) from tcp_check_space(). Fact that we have decided to generate an EPOLLOUT does not mean the application has immediately refilled the transmit queue. This optimistic call might have been the reason the bug seemed not too serious. Tested: 200 ms rtt, 1% packet loss, 32 MB tcp_rmem[2] and tcp_wmem[2] $ echo 500000 >/proc/sys/net/ipv4/tcp_notsent_lowat $ cat bench_rr.sh SUM=3D0 for i in {1..10} do V=3D`netperf -H remote_host -l30 -t TCP_RR -- -r 10000000,10000 -o LOCAL_B= YTES_SENT | egrep -v "MIGRATED|Bytes"` echo $V SUM=3D$(($SUM + $V)) done echo SUM=3D$SUM Before patch: $ bench_rr.sh 130000000 80000000 140000000 140000000 140000000 140000000 130000000 40000000 90000000 110000000 SUM=3D1140000000 After patch: $ bench_rr.sh 430000000 590000000 530000000 450000000 450000000 350000000 450000000 490000000 480000000 460000000 SUM=3D4680000000 # This is 410 % of the value before patch. Fixes: c9bee3b7fdec ("tcp: TCP_NOTSENT_LOWAT socket option") Signed-off-by: Eric Dumazet Reported-by: Doug Porter Cc: Soheil Hassas Yeganeh Cc: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- include/net/tcp.h | 1 + net/ipv4/tcp_input.c | 12 +++++++++++- net/ipv4/tcp_output.c | 1 + 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index f26f075250b4..97df2f6fcbd7 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -579,6 +579,7 @@ void tcp_synack_rtt_meas(struct sock *sk, struct reques= t_sock *req); void tcp_reset(struct sock *sk); void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *= skb); void tcp_fin(struct sock *sk); +void tcp_check_space(struct sock *sk); =20 /* tcp_timer.c */ void tcp_init_xmit_timers(struct sock *); diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 01c73775ed00..7f48f8504284 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -5159,7 +5159,17 @@ static void tcp_new_space(struct sock *sk) sk->sk_write_space(sk); } =20 -static void tcp_check_space(struct sock *sk) +/* Caller made space either from: + * 1) Freeing skbs in rtx queues (after tp->snd_una has advanced) + * 2) Sent skbs from output queue (and thus advancing tp->snd_nxt) + * + * We might be able to generate EPOLLOUT to the application if: + * 1) Space consumed in output/rtx queues is below sk->sk_sndbuf/2 + * 2) notsent amount (tp->write_seq - tp->snd_nxt) became + * small enough that tcp_stream_memory_free() decides it + * is time to generate EPOLLOUT. + */ +void tcp_check_space(struct sock *sk) { if (sock_flag(sk, SOCK_QUEUE_SHRUNK)) { sock_reset_flag(sk, SOCK_QUEUE_SHRUNK); diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index aafea53c7c06..95b0f486cb10 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -83,6 +83,7 @@ static void tcp_event_new_data_sent(struct sock *sk, cons= t struct sk_buff *skb) =20 NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT, tcp_skb_pcount(skb)); + tcp_check_space(sk); } =20 /* SND.NXT, if window was not shrunk. --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5952DC43219 for ; Tue, 10 May 2022 13:28:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243620AbiEJNbk (ORCPT ); Tue, 10 May 2022 09:31:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45978 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242773AbiEJNVB (ORCPT ); Tue, 10 May 2022 09:21:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B5D202BB2F1; Tue, 10 May 2022 06:13:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 31C67615DD; Tue, 10 May 2022 13:13:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3EC2FC385A6; Tue, 10 May 2022 13:13:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188426; bh=OusbpPHSfuJErtZSM5kyMfhH1CJ6XmDVEUFq4TjXHBM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gVHWLioVzReh5ZACb4y5KTZLaYdKIRl5UX6IJy6DZt2cCotXDg5pOC7RWWQAczxON OgWoRbMPGhEeu2pKSwWFnYQUiB/eVgdsJQhVaheSiC8C8EvKCtQJ9zu3F8IwiERn3W DOvSSlW6ohDMjuO242aLpVV2JlqoxrU2JSx8M0DQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Samuel Holland , Jernej Skrabec , Sasha Levin Subject: [PATCH 4.9 30/66] bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() Date: Tue, 10 May 2022 15:07:20 +0200 Message-Id: <20220510130730.649957102@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET [ Upstream commit fff8c10368e64e7f8960f149375c12ca5f3b30af ] This code is really spurious. It always returns an ERR_PTR, even when err is known to be 0 and calls put_device() after a successful device_register() call. It is likely that the return statement in the normal path is missing. Add 'return rdev;' to fix it. Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced Seri= al Bus") Signed-off-by: Christophe JAILLET Reviewed-by: Samuel Holland Tested-by: Samuel Holland Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/ef2b9576350bba4c8e05e669e9535e9e2a415763.16= 50551719.git.christophe.jaillet@wanadoo.fr Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/bus/sunxi-rsb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c index 4f3d988210b0..ce5b976a8856 100644 --- a/drivers/bus/sunxi-rsb.c +++ b/drivers/bus/sunxi-rsb.c @@ -224,6 +224,8 @@ static struct sunxi_rsb_device *sunxi_rsb_device_create= (struct sunxi_rsb *rsb, =20 dev_dbg(&rdev->dev, "device %s registered\n", dev_name(&rdev->dev)); =20 + return rdev; + err_device_add: put_device(&rdev->dev); =20 --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 016FBC38A2B for ; Tue, 10 May 2022 13:24:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243005AbiEJN16 (ORCPT ); Tue, 10 May 2022 09:27:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38558 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242809AbiEJNVD (ORCPT ); Tue, 10 May 2022 09:21:03 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1F2D22BAE6D; Tue, 10 May 2022 06:13:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C5254B81CE7; Tue, 10 May 2022 13:13:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 24AAAC385A6; Tue, 10 May 2022 13:13:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188429; bh=MKudbu7vHv3XJ8MbvM3xZDs4i7yKHou2tCtg+kv73Gc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WLxXs2SbKJHRWhr3pgJmM7Ji48XnkAQdPXe17c45sg7gPTx3jNWhvPIZG+nkUoIht nwnlEyAC/t2HVPGdSWSrSbFNCQPugbo71XeUhLQARL92wvJOO6qhY2jmGrpOidhnL+ iSHLdkD68a7rv7Z+Tkx/1vkqHpl6S6oJXEp4lzrc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Yingliang , Samuel Holland , Jernej Skrabec , Sasha Levin Subject: [PATCH 4.9 31/66] clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource() Date: Tue, 10 May 2022 15:07:21 +0200 Message-Id: <20220510130730.679342061@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang [ Upstream commit f58ca215cda1975f77b2b762903684a3c101bec9 ] It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Fixes: 7a6fca879f59 ("clk: sunxi: Add driver for A80 MMC config clocks/rese= ts") Signed-off-by: Yang Yingliang Reviewed-by: Samuel Holland Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220421134308.2885094-1-yangyingliang@huaw= ei.com Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/clk/sunxi/clk-sun9i-mmc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/clk/sunxi/clk-sun9i-mmc.c b/drivers/clk/sunxi/clk-sun9= i-mmc.c index f69f9e8c6f38..7e9d1624032f 100644 --- a/drivers/clk/sunxi/clk-sun9i-mmc.c +++ b/drivers/clk/sunxi/clk-sun9i-mmc.c @@ -117,6 +117,8 @@ static int sun9i_a80_mmc_config_clk_probe(struct platfo= rm_device *pdev) spin_lock_init(&data->lock); =20 r =3D platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!r) + return -EINVAL; /* one clock/reset pair per word */ count =3D DIV_ROUND_UP((resource_size(r)), SUN9I_MMC_WIDTH); data->membase =3D devm_ioremap_resource(&pdev->dev, r); --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9A7FC4332F for ; Tue, 10 May 2022 13:19:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242803AbiEJNXC (ORCPT ); Tue, 10 May 2022 09:23:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45976 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242867AbiEJNVI (ORCPT ); Tue, 10 May 2022 09:21:08 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E73C2BEF8B; Tue, 10 May 2022 06:13:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 1EC0CCE1EE3; Tue, 10 May 2022 13:13:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 284EFC385A6; Tue, 10 May 2022 13:13:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188432; bh=hyjdVlUADfBosYVg3PHJ4AVknv0gLsZpFlspOO+hNtY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=O5kZz9Ez73Z5lq+XnRBiR9lhgF8i29CtWH/YSmkJ63tEKj0fffRrE7ptKvfB9wod9 MP4bcdhYvw2Y514MUWdqilL3rFnePTJt71Qv1hr4J9w4+60H9vjLHXY53UbJv22PGd bazTsLyiZg0MZWtAEQlSO96GMZygXgQ9X9ciu+zI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Christensen , Manish Chopra , Ariel Elior , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.9 32/66] bnx2x: fix napi API usage sequence Date: Tue, 10 May 2022 15:07:22 +0200 Message-Id: <20220510130730.708432233@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Manish Chopra [ Upstream commit af68656d66eda219b7f55ce8313a1da0312c79e1 ] While handling PCI errors (AER flow) driver tries to disable NAPI [napi_disable()] after NAPI is deleted [__netif_napi_del()] which causes unexpected system hang/crash. System message log shows the following: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 3222.537510] EEH: Detected PCI bus error on PHB#384-PE#800000 [ 3222.5375= 11] EEH: This PCI device has failed 2 times in the last hour and will be pe= rmanently disabled after 5 failures. [ 3222.537512] EEH: Notify device drivers to shutdown [ 3222.537513] EEH: B= eginning: 'error_detected(IO frozen)' [ 3222.537514] EEH: PE#800000 (PCI 0384:80:00.0): Invoking bnx2x->error_detected(IO frozen) [ 3222.537516] bnx2x: [bnx2x_io_error_detected:14236(eth14)]IO error detect= ed [ 3222.537650] EEH: PE#800000 (PCI 0384:80:00.0): bnx2x driver reports: 'need reset' [ 3222.537651] EEH: PE#800000 (PCI 0384:80:00.1): Invoking bnx2x->error_detected(IO frozen) [ 3222.537651] bnx2x: [bnx2x_io_error_detected:14236(eth13)]IO error detect= ed [ 3222.537729] EEH: PE#800000 (PCI 0384:80:00.1): bnx2x driver reports: 'need reset' [ 3222.537729] EEH: Finished:'error_detected(IO frozen)' with aggregate rec= overy state:'need reset' [ 3222.537890] EEH: Collect temporary log [ 3222.583481] EEH: of node=3D038= 4:80:00.0 [ 3222.583519] EEH: PCI device/vendor: 168e14e4 [ 3222.583557] EE= H: PCI cmd/status register: 00100140 [ 3222.583557] EEH: PCI-E capabilities= and status follow: [ 3222.583744] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.58= 3892] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.583893] EEH= : PCI-E 20: 00000000 [ 3222.583893] EEH: PCI-E AER capability register set = follows: [ 3222.584079] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 322= 2.584230] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.584= 378] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.584416] = EEH: PCI-E AER 30: 00000000 00000000 [ 3222.584416] EEH: of node=3D0384:80:= 00.1 [ 3222.584454] EEH: PCI device/vendor: 168e14e4 [ 3222.584491] EEH: PC= I cmd/status register: 00100140 [ 3222.584492] EEH: PCI-E capabilities and = status follow: [ 3222.584677] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.58= 4825] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.584826] EEH= : PCI-E 20: 00000000 [ 3222.584826] EEH: PCI-E AER capability register set = follows: [ 3222.585011] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 322= 2.585160] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.585= 309] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.585347] = EEH: PCI-E AER 30: 00000000 00000000 [ 3222.586872] RTAS: event: 5, Type: P= latform Error (224), Severity: 2 [ 3222.586873] EEH: Reset without hotplug = activity [ 3224.762767] EEH: Beginning: 'slot_reset' [ 3224.762770] EEH: PE#800000 (PCI 0384:80:00.0): Invoking bnx2x->slot_reset() [ 3224.762771] bnx2x: [bnx2x_io_slot_reset:14271(eth14)]IO slot reset initi= alizing... [ 3224.762887] bnx2x 0384:80:00.0: enabling device (0140 -> 0142) [ 3224.76= 8157] bnx2x: [bnx2x_io_slot_reset:14287(eth14)]IO slot reset --> driver unload Uninterruptible tasks =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D crash> ps | grep UN 213 2 11 c000000004c89e00 UN 0.0 0 0 [eehd] 215 2 0 c000000004c80000 UN 0.0 0 0 [kworker/0:2] 2196 1 28 c000000004504f00 UN 0.1 15936 11136 wickedd 4287 1 9 c00000020d076800 UN 0.0 4032 3008 agetty 4289 1 20 c00000020d056680 UN 0.0 7232 3840 agetty 32423 2 26 c00000020038c580 UN 0.0 0 0 [kworker/26:3] 32871 4241 27 c0000002609ddd00 UN 0.1 18624 11648 sshd 32920 10130 16 c00000027284a100 UN 0.1 48512 12608 sendmail 33092 32987 0 c000000205218b00 UN 0.1 48512 12608 sendmail 33154 4567 16 c000000260e51780 UN 0.1 48832 12864 pickup 33209 4241 36 c000000270cb6500 UN 0.1 18624 11712 sshd 33473 33283 0 c000000205211480 UN 0.1 48512 12672 sendmail 33531 4241 37 c00000023c902780 UN 0.1 18624 11648 sshd EEH handler hung while bnx2x sleeping and holding RTNL lock =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D crash> bt 213 PID: 213 TASK: c000000004c89e00 CPU: 11 COMMAND: "eehd" #0 [c000000004d477e0] __schedule at c000000000c70808 #1 [c000000004d478b0] schedule at c000000000c70ee0 #2 [c000000004d478e0] schedule_timeout at c000000000c76dec #3 [c000000004d479c0] msleep at c0000000002120cc #4 [c000000004d479f0] napi_disable at c000000000a06448 ^^^^^^^^^^^^^^^^ #5 [c000000004d47a30] bnx2x_netif_stop at c0080000018dba94 [bnx2x] #6 [c000000004d47a60] bnx2x_io_slot_reset at c0080000018a551c [bnx2x] #7 [c000000004d47b20] eeh_report_reset at c00000000004c9bc #8 [c000000004d47b90] eeh_pe_report at c00000000004d1a8 #9 [c000000004d47c40] eeh_handle_normal_event at c00000000004da64 And the sleeping source code =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D crash> dis -ls c000000000a06448 FILE: ../net/core/dev.c LINE: 6702 6697 { 6698 might_sleep(); 6699 set_bit(NAPI_STATE_DISABLE, &n->state); 6700 6701 while (test_and_set_bit(NAPI_STATE_SCHED, &n->state)) * 6702 msleep(1); 6703 while (test_and_set_bit(NAPI_STATE_NPSVC, &n->state)) 6704 msleep(1); 6705 6706 hrtimer_cancel(&n->timer); 6707 6708 clear_bit(NAPI_STATE_DISABLE, &n->state); 6709 } EEH calls into bnx2x twice based on the system log above, first through bnx2x_io_error_detected() and then bnx2x_io_slot_reset(), and executes the following call chains: bnx2x_io_error_detected() +-> bnx2x_eeh_nic_unload() +-> bnx2x_del_all_napi() +-> __netif_napi_del() bnx2x_io_slot_reset() +-> bnx2x_netif_stop() +-> bnx2x_napi_disable() +->napi_disable() Fix this by correcting the sequence of NAPI APIs usage, that is delete the NAPI after disabling it. Fixes: 7fa6f34081f1 ("bnx2x: AER revised") Reported-by: David Christensen Tested-by: David Christensen Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Link: https://lore.kernel.org/r/20220426153913.6966-1-manishc@marvell.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net= /ethernet/broadcom/bnx2x/bnx2x_main.c index 8d17d464c067..398928642a97 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c @@ -14314,10 +14314,6 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp) =20 /* Stop Tx */ bnx2x_tx_disable(bp); - /* Delete all NAPI objects */ - bnx2x_del_all_napi(bp); - if (CNIC_LOADED(bp)) - bnx2x_del_all_napi_cnic(bp); netdev_reset_tc(bp->dev); =20 del_timer_sync(&bp->timer); @@ -14422,6 +14418,11 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct= pci_dev *pdev) bnx2x_drain_tx_queues(bp); bnx2x_send_unload_req(bp, UNLOAD_RECOVERY); bnx2x_netif_stop(bp, 1); + bnx2x_del_all_napi(bp); + + if (CNIC_LOADED(bp)) + bnx2x_del_all_napi_cnic(bp); + bnx2x_free_irq(bp); =20 /* Report UNLOAD_DONE to MCP */ --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD5A3C433F5 for ; Tue, 10 May 2022 13:13:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242562AbiEJNRh (ORCPT ); Tue, 10 May 2022 09:17:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35674 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242552AbiEJNQP (ORCPT ); Tue, 10 May 2022 09:16:15 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9F0BE3C4B5; Tue, 10 May 2022 06:12:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DDD18615E7; Tue, 10 May 2022 13:11:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DD44FC385A6; Tue, 10 May 2022 13:11:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188314; bh=IahD/UGbAtp5D8KEjlB7ZHxiAoNcd+ZHPnhmK08V4LI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IrvmrNi3gIIfhn1lrYSECIchVwBZV+47MxHIiwZ4Acdreioh37uQF1N9m8KlJnmfi dTtbgmxcDmPmsMVesAS1BF1qOQAETeAALXG3MX26MgPo6TiYO4R2tl/PnBWJlMSibS RgfNLlpA5HpG8U6dM+GwmLV7k1oWS3cE4g39fkWQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Mark Brown , Sasha Levin Subject: [PATCH 4.9 33/66] ASoC: wm8731: Disable the regulator when probing fails Date: Tue, 10 May 2022 15:07:23 +0200 Message-Id: <20220510130730.736789271@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit 92ccbf17eeacf510cf1eed9c252d9332ca24f02d ] When the driver fails during probing, the driver should disable the regulator, not just handle it in wm8731_hw_init(). The following log reveals it: [ 17.812483] WARNING: CPU: 1 PID: 364 at drivers/regulator/core.c:2257 _r= egulator_put+0x3ec/0x4e0 [ 17.815958] RIP: 0010:_regulator_put+0x3ec/0x4e0 [ 17.824467] Call Trace: [ 17.824774] [ 17.825040] regulator_bulk_free+0x82/0xe0 [ 17.825514] devres_release_group+0x319/0x3d0 [ 17.825882] i2c_device_probe+0x766/0x940 [ 17.829198] i2c_register_driver+0xb5/0x130 Signed-off-by: Zheyu Ma Link: https://lore.kernel.org/r/20220405121038.4094051-1-zheyuma97@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- sound/soc/codecs/wm8731.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c index 4f9a1eb28120..abe5e77ba171 100644 --- a/sound/soc/codecs/wm8731.c +++ b/sound/soc/codecs/wm8731.c @@ -604,7 +604,7 @@ static int wm8731_hw_init(struct device *dev, struct wm= 8731_priv *wm8731) ret =3D wm8731_reset(wm8731->regmap); if (ret < 0) { dev_err(dev, "Failed to issue reset: %d\n", ret); - goto err_regulator_enable; + goto err; } =20 /* Clear POWEROFF, keep everything else disabled */ @@ -621,10 +621,7 @@ static int wm8731_hw_init(struct device *dev, struct w= m8731_priv *wm8731) =20 regcache_mark_dirty(wm8731->regmap); =20 -err_regulator_enable: - /* Regulators will be enabled by bias management */ - regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); - +err: return ret; } =20 @@ -768,21 +765,27 @@ static int wm8731_i2c_probe(struct i2c_client *i2c, ret =3D PTR_ERR(wm8731->regmap); dev_err(&i2c->dev, "Failed to allocate register map: %d\n", ret); - return ret; + goto err_regulator_enable; } =20 ret =3D wm8731_hw_init(&i2c->dev, wm8731); if (ret !=3D 0) - return ret; + goto err_regulator_enable; =20 ret =3D snd_soc_register_codec(&i2c->dev, &soc_codec_dev_wm8731, &wm8731_dai, 1); if (ret !=3D 0) { dev_err(&i2c->dev, "Failed to register CODEC: %d\n", ret); - return ret; + goto err_regulator_enable; } =20 return 0; + +err_regulator_enable: + /* Regulators will be enabled by bias management */ + regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); + + return ret; } =20 static int wm8731_i2c_remove(struct i2c_client *client) --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B755BC433EF for ; Tue, 10 May 2022 13:14:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242381AbiEJNSI (ORCPT ); Tue, 10 May 2022 09:18:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36172 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242328AbiEJNQT (ORCPT ); Tue, 10 May 2022 09:16:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C56C24132B; Tue, 10 May 2022 06:12:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C4435615F4; Tue, 10 May 2022 13:11:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AEF6DC385C2; Tue, 10 May 2022 13:11:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188317; bh=zlgTwDPqMHGwCom7yT3bg2E8DypAoRsb8SCA47wPt4w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WwRFkwKtdKfveyy1CuXRQsp2AYgv4POCkOydJpCF8SJVEhTpU+USTdw7X9rkvXxaS Yco7JA0dBKWPXwfjdQ/HbFZrNwHx38KyR5PZDykrEtm42rqHV0bXZafsXeTbMVAS4x 1qe5eLotuCuE1y5C9tofGTla9g9pn7bF5G/DZXjI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Paolo Abeni , Sasha Levin Subject: [PATCH 4.9 34/66] drivers: net: hippi: Fix deadlock in rr_close() Date: Tue, 10 May 2022 15:07:24 +0200 Message-Id: <20220510130730.764886380@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou [ Upstream commit bc6de2878429e85c1f1afaa566f7b5abb2243eef ] There is a deadlock in rr_close(), which is shown below: (Thread 1) | (Thread 2) | rr_open() rr_close() | add_timer() spin_lock_irqsave() //(1) | (wait a time) ... | rr_timer() del_timer_sync() | spin_lock_irqsave() //(2) (wait timer to stop) | ... We hold rrpriv->lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need rrpriv->lock in position (2) of thread 2. As a result, rr_close() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock. Signed-off-by: Duoming Zhou Link: https://lore.kernel.org/r/20220417125519.82618-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/hippi/rrunner.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c index 6f3519123eb6..0e1a422d9567 100644 --- a/drivers/net/hippi/rrunner.c +++ b/drivers/net/hippi/rrunner.c @@ -1354,7 +1354,9 @@ static int rr_close(struct net_device *dev) =20 rrpriv->fw_running =3D 0; =20 + spin_unlock_irqrestore(&rrpriv->lock, flags); del_timer_sync(&rrpriv->timer); + spin_lock_irqsave(&rrpriv->lock, flags); =20 writel(0, ®s->TxPi); writel(0, ®s->IpRxPi); --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 946EEC4332F for ; Tue, 10 May 2022 13:14:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242491AbiEJNSZ (ORCPT ); Tue, 10 May 2022 09:18:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35740 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242338AbiEJNQT (ORCPT ); Tue, 10 May 2022 09:16:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ED9B841605; Tue, 10 May 2022 06:12:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C9F306123F; Tue, 10 May 2022 13:12:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF0B6C385A6; Tue, 10 May 2022 13:11:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188320; bh=ryxli4bNx4zlI3Bii0DOL6wjtfbof9pi394z+RUpQdY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZeHu2qDKNvzKxbr+ATO9kn0H1HqkkbwrGAOcCA5CtHjtEEp74y+jT+9RA/SKDjvUR Bn+xqzGqQwhffGLAeXMe28ZBoNOV5cz6Lt1KEmZnE0N7iwlLyK/RVWxHrR1mIyreZH a1Q2D/GjREKepiYl+W0/7VnyvjmMXMotFMQreYCs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Kyle D. Pelton" , Borislav Petkov , Pawan Gupta Subject: [PATCH 4.9 35/66] x86/cpu: Load microcode during restore_processor_state() Date: Tue, 10 May 2022 15:07:25 +0200 Message-Id: <20220510130730.796868930@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Borislav Petkov commit f9e14dbbd454581061c736bf70bf5cbb15ac927c upstream. When resuming from system sleep state, restore_processor_state() restores the boot CPU MSRs. These MSRs could be emulated by microcode. If microcode is not loaded yet, writing to emulated MSRs leads to unchecked MSR access error: ... PM: Calling lapic_suspend+0x0/0x210 unchecked MSR access error: WRMSR to 0x10f (tried to write 0x0...0) at rI= P: ... (native_write_msr) Call Trace: ? restore_processor_state x86_acpi_suspend_lowlevel acpi_suspend_enter suspend_devices_and_enter pm_suspend.cold state_store kobj_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write __x64_sys_write do_syscall_64 entry_SYSCALL_64_after_hwframe RIP: 0033:0x7fda13c260a7 To ensure microcode emulated MSRs are available for restoration, load the microcode on the boot CPU before restoring these MSRs. [ Pawan: write commit message and productize it. ] Fixes: e2a1256b17b1 ("x86/speculation: Restore speculation related MSRs dur= ing S3 resume") Reported-by: Kyle D. Pelton Signed-off-by: Borislav Petkov Signed-off-by: Pawan Gupta Tested-by: Kyle D. Pelton Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D215841 Link: https://lore.kernel.org/r/4350dfbf785cd482d3fafa72b2b49c83102df3ce.16= 50386317.git.pawan.kumar.gupta@linux.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/x86/include/asm/microcode.h | 2 ++ arch/x86/kernel/cpu/microcode/core.c | 6 +++--- arch/x86/power/cpu.c | 8 ++++++++ 3 files changed, 13 insertions(+), 3 deletions(-) --- a/arch/x86/include/asm/microcode.h +++ b/arch/x86/include/asm/microcode.h @@ -135,10 +135,12 @@ extern void __init load_ucode_bsp(void); extern void load_ucode_ap(void); void reload_early_microcode(void); extern bool get_builtin_firmware(struct cpio_data *cd, const char *name); +void microcode_bsp_resume(void); #else static inline void __init load_ucode_bsp(void) { } static inline void load_ucode_ap(void) { } static inline void reload_early_microcode(void) { } +static inline void microcode_bsp_resume(void) { } static inline bool get_builtin_firmware(struct cpio_data *cd, const char *name) { return fals= e; } #endif --- a/arch/x86/kernel/cpu/microcode/core.c +++ b/arch/x86/kernel/cpu/microcode/core.c @@ -586,9 +586,9 @@ static struct subsys_interface mc_cpu_in }; =20 /** - * mc_bp_resume - Update boot CPU microcode during resume. + * microcode_bsp_resume - Update boot CPU microcode during resume. */ -static void mc_bp_resume(void) +void microcode_bsp_resume(void) { int cpu =3D smp_processor_id(); struct ucode_cpu_info *uci =3D ucode_cpu_info + cpu; @@ -600,7 +600,7 @@ static void mc_bp_resume(void) } =20 static struct syscore_ops mc_syscore_ops =3D { - .resume =3D mc_bp_resume, + .resume =3D microcode_bsp_resume, }; =20 static int mc_cpu_online(unsigned int cpu) --- a/arch/x86/power/cpu.c +++ b/arch/x86/power/cpu.c @@ -26,6 +26,7 @@ #include #include #include +#include =20 #ifdef CONFIG_X86_32 __visible unsigned long saved_context_ebx; @@ -261,6 +262,13 @@ static void notrace __restore_processor_ x86_platform.restore_sched_clock_state(); mtrr_bp_restore(); perf_restore_debug_store(); + + microcode_bsp_resume(); + + /* + * This needs to happen after the microcode has been updated upon resume + * because some of the MSRs are "emulated" in microcode. + */ msr_restore_context(ctxt); } From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CB255C433EF for ; Tue, 10 May 2022 13:14:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242448AbiEJNSU (ORCPT ); Tue, 10 May 2022 09:18:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35738 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242346AbiEJNQT (ORCPT ); Tue, 10 May 2022 09:16:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 25BA0433B5; Tue, 10 May 2022 06:12:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 93B7D612E4; Tue, 10 May 2022 13:12:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9EC53C385C2; Tue, 10 May 2022 13:12:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188323; bh=ZFKz7D5VMBgdP5HYgXbth0GjUNlu9Z2TL8vZsHJON3Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uieG78kWd0BTfu4oKUBXz+K82UTaPMjXLMo6Eia8Hfn5qNfW0eAHDqSu2Gl6VTFIB MkVXz9iUNy40N/+qhCmygD0Tgot5vrinTWfK8aP5zbkSum4BwV4XDgElcrb6RTbR44 LxtuBhx7D9vB+BLH3D49pNoxc3WezfT1edOqyrI4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.9 36/66] tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 Date: Tue, 10 May 2022 15:07:26 +0200 Message-Id: <20220510130730.828522012@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 06d5afd4d640eea67f5623e76cd5fc03359b7f3c upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.5.2 describes that the signal octet in convergence layer type 2 can be either one or two bytes. The length is encoded in the EA bit. This is set 1 for the last byte in the sequence. gsmtty_modem_update() handles this correctly but gsm_dlci_data_output() fails to set EA to 1. There is no case in which we encode two signal octets as there is no case in which we send out a break signal. Therefore, always set the EA bit to 1 for the signal octet to fix this. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-5-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/tty/n_gsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -839,7 +839,7 @@ static int gsm_dlci_data_output(struct g break; case 2: /* Unstructed with modem bits. Always one byte as we never send inline break data */ - *dp++ =3D gsm_encode_modem(dlci); + *dp++ =3D (gsm_encode_modem(dlci) << 1) | EA; break; } WARN_ON(kfifo_out_locked(dlci->fifo, dp , len, &dlci->lock) !=3D len); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A254CC433EF for ; Tue, 10 May 2022 13:14:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242422AbiEJNSP (ORCPT ); Tue, 10 May 2022 09:18:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36228 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241535AbiEJNQT (ORCPT ); Tue, 10 May 2022 09:16:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E8FF73EF23; Tue, 10 May 2022 06:12:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5DA6B615F8; Tue, 10 May 2022 13:12:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69F1BC385A6; Tue, 10 May 2022 13:12:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188325; bh=5JcHX9Wa3Mes2Izs1ipgsGcdg9EM9TbFHe/TyofPpc8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C3TBl+jvjbqOv5mwMuT7X1b5Pu0g//OQJmYLEpZlcr+A3dAf4G0U0/NrQ0EZAkwU9 22w+xzTB2zOD4eOxOZMBIUQ4g+EuLtZRh3X25hUn7GJzJu1cIn/FZnN6k9yV0NhzpT 3OP7p8PUlMma3LjwvOpe9ssxiX/HM52DWSM9Ggk0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.9 37/66] tty: n_gsm: fix malformed counter for out of frame data Date: Tue, 10 May 2022 15:07:27 +0200 Message-Id: <20220510130730.857381555@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit a24b4b2f660b7ddf3f484b37600bba382cb28a9d upstream. The gsm_mux field 'malformed' represents the number of malformed frames received. However, gsm1_receive() also increases this counter for any out of frame byte. Fix this by ignoring out of frame data for the malformed counter. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-7-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/tty/n_gsm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1977,7 +1977,8 @@ static void gsm1_receive(struct gsm_mux } /* Any partial frame was a runt so go back to start */ if (gsm->state !=3D GSM_START) { - gsm->malformed++; + if (gsm->state !=3D GSM_SEARCH) + gsm->malformed++; gsm->state =3D GSM_START; } /* A SOF in GSM_START means we are still reading idling or From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE370C43217 for ; Tue, 10 May 2022 13:14:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241153AbiEJNSa (ORCPT ); Tue, 10 May 2022 09:18:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36170 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242391AbiEJNQV (ORCPT ); Tue, 10 May 2022 09:16:21 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0585B3BA50; Tue, 10 May 2022 06:12:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E86B3B81D7C; Tue, 10 May 2022 13:12:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 47E57C385A6; Tue, 10 May 2022 13:12:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188328; bh=DTYGiQibFjQbW48302hwHbwMliOqVVdWPpqKDMKBL5E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JDQgQz/A675x9x60u8PmYXEeqK5qucvCjy5Mry+sCcTxWMTA9i9oUmzd+zlMHdPPS mrKH/wsl6Hd1j8cs849fQwAryGSri+TKUXGUk5yZZQ/tW/JHKQn/VLQedML34PsUrA WO6CdZzlmtqT2hYnARnoRMlOy2psvkjGp6oMEjMk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.9 38/66] tty: n_gsm: fix insufficient txframe size Date: Tue, 10 May 2022 15:07:28 +0200 Message-Id: <20220510130730.886473117@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 535bf600de75a859698892ee873521a48d289ec1 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.7.2 states that the maximum frame size (N1) refers to the length of the information field (i.e. user payload). However, 'txframe' stores the whole frame including frame header, checksum and start/end flags. We also need to consider the byte stuffing overhead. Define constant for the protocol overhead and adjust the 'txframe' size calculation accordingly to reserve enough space for a complete mux frame including byte stuffing for advanced option mode. Note that no byte stuffing is applied to the start and end flag. Also use MAX_MTU instead of MAX_MRU as this buffer is used for data transmission. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-8-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/tty/n_gsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -84,6 +84,8 @@ module_param(debug, int, 0600); */ #define MAX_MRU 1500 #define MAX_MTU 1500 +/* SOF, ADDR, CTRL, LEN1, LEN2, ..., FCS, EOF */ +#define PROT_OVERHEAD 7 #define GSM_NET_TX_TIMEOUT (HZ*10) =20 /** @@ -2199,7 +2201,7 @@ static struct gsm_mux *gsm_alloc_mux(voi kfree(gsm); return NULL; } - gsm->txframe =3D kmalloc(2 * MAX_MRU + 2, GFP_KERNEL); + gsm->txframe =3D kmalloc(2 * (MAX_MTU + PROT_OVERHEAD - 1), GFP_KERNEL); if (gsm->txframe =3D=3D NULL) { kfree(gsm->buf); kfree(gsm); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 37C27C433EF for ; Tue, 10 May 2022 13:14:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242514AbiEJNRv (ORCPT ); Tue, 10 May 2022 09:17:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35746 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242360AbiEJNQQ (ORCPT ); Tue, 10 May 2022 09:16:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 741573ED13; Tue, 10 May 2022 06:12:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3850D61574; Tue, 10 May 2022 13:12:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4855BC385C2; Tue, 10 May 2022 13:12:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188331; bh=JRE8OAckK6Z2/pZaQdU2BPmNB27yYOJnPnYlHynw71Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZhjFuPD0LJiz8ipPJInDDSnvRb2fSJHo397HP6DgUFPYohMFCEX8BKZqNJQOLtEzU Z6EK4RmMy5ObeAhDy1jQ+7kwJdtoitDvJSXcTFlIs3D7mO/lzVNPufzAny1zoIG/RB fYlFLo8RBRSy/KtXlWwLx/Z8vpFtuYmRknzhZIaw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.9 39/66] tty: n_gsm: fix missing explicit ldisc flush Date: Tue, 10 May 2022 15:07:29 +0200 Message-Id: <20220510130730.915130452@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 17eac652028501df7ea296b1d9b9c134db262b7d upstream. In gsm_cleanup_mux() the muxer is closed down and all queues are removed. However, removing the queues is done without explicit control of the underlying buffers. Flush those before freeing up our queues to ensure that all outgoing queues are cleared consistently. Otherwise, a new mux connection establishment attempt may time out while the underlying tty is still busy sending out the remaining data from the previous connection. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-10-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/tty/n_gsm.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2101,6 +2101,7 @@ static void gsm_cleanup_mux(struct gsm_m gsm_dlci_release(gsm->dlci[i]); mutex_unlock(&gsm->mutex); /* Now wipe the queues */ + tty_ldisc_flush(gsm->tty); list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list) kfree(txq); INIT_LIST_HEAD(&gsm->tx_list); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 58B89C433F5 for ; Tue, 10 May 2022 13:14:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238007AbiEJNSi (ORCPT ); Tue, 10 May 2022 09:18:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36192 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242386AbiEJNQV (ORCPT ); Tue, 10 May 2022 09:16:21 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 04CD539B84; Tue, 10 May 2022 06:12:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C260BB81D7A; Tue, 10 May 2022 13:12:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34DFCC385A6; Tue, 10 May 2022 13:12:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188334; bh=oNEVOACShz5Vg5qpBKriSDBye5th5s4kFjJ7D1n5L+Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UdYOzoL58QTszpDg19u3761+IpaN+pGds6zawdY6LYpnT4mvJ2T+b8WzCNYetcEZB bvbtyxVW/KyOaULXaPR9kl+Wdle+e3cDV5Tc2b6nzTqzapgyn72qMMJRv+XNf78qsS umlySUIqylyhCYkHxX+4H0Qmdcgb+Ah+T2aD7oBg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.9 40/66] tty: n_gsm: fix wrong command retry handling Date: Tue, 10 May 2022 15:07:30 +0200 Message-Id: <20220510130730.943978056@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit d0bcdffcad5a22f202e3bf37190c0dd8c080ea92 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.7.3 states that the valid range for the maximum number of retransmissions (N2) is from 0 to 255 (both including). gsm_config() fails to limit this range correctly. Furthermore, gsm_control_retransmit() handles this number incorrectly by performing N2 - 1 retransmission attempts. Setting N2 to zero results in more than 255 retransmission attempts. Fix the range check in gsm_config() and the value handling in gsm_control_send() and gsm_control_retransmit() to comply with 3GPP 27.010. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-11-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/tty/n_gsm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1345,7 +1345,6 @@ static void gsm_control_retransmit(unsig spin_lock_irqsave(&gsm->control_lock, flags); ctrl =3D gsm->pending_cmd; if (ctrl) { - gsm->cretries--; if (gsm->cretries =3D=3D 0) { gsm->pending_cmd =3D NULL; ctrl->error =3D -ETIMEDOUT; @@ -1354,6 +1353,7 @@ static void gsm_control_retransmit(unsig wake_up(&gsm->event); return; } + gsm->cretries--; gsm_control_transmit(gsm, ctrl); mod_timer(&gsm->t2_timer, jiffies + gsm->t2 * HZ / 100); } @@ -1394,7 +1394,7 @@ retry: =20 /* If DLCI0 is in ADM mode skip retries, it won't respond */ if (gsm->dlci[0]->mode =3D=3D DLCI_MODE_ADM) - gsm->cretries =3D 1; + gsm->cretries =3D 0; else gsm->cretries =3D gsm->n2; =20 @@ -2519,7 +2519,7 @@ static int gsmld_config(struct tty_struc /* Check the MRU/MTU range looks sane */ if (c->mru > MAX_MRU || c->mtu > MAX_MTU || c->mru < 8 || c->mtu < 8) return -EINVAL; - if (c->n2 < 3) + if (c->n2 > 255) return -EINVAL; if (c->encapsulation > 1) /* Basic, advanced, no I */ return -EINVAL; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 274E5C433EF for ; Tue, 10 May 2022 13:14:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242538AbiEJNSw (ORCPT ); Tue, 10 May 2022 09:18:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35738 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242363AbiEJNQW (ORCPT ); Tue, 10 May 2022 09:16:22 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 613633B28E; Tue, 10 May 2022 06:12:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2307C615C5; Tue, 10 May 2022 13:12:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 15AD0C385A6; Tue, 10 May 2022 13:12:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188337; bh=8JvN64c//PXkttIcM+5aexIhz/lgA8OH0a3ITB3MlFA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JKj4OoI9wGVD5e3KkDs2DwaGvdWVBanAZytdRtiDljrPlQs1DcHj2T9xG35beKgYr g/0FrnIoqdjdtdkEWW+aiaVT8fpQ0+NgdxRx7oiG70+2zhLkGU7Y9AfDnCu3UVBwd4 Camb1Hgo62kbaBrmSliWdoNLnQlj5jivEL+O629Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.9 41/66] tty: n_gsm: fix wrong command frame length field encoding Date: Tue, 10 May 2022 15:07:31 +0200 Message-Id: <20220510130730.972589341@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 398867f59f956985f4c324f173eff7b946e14bd8 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.4.6.1 states that each command frame shall be made up from type, length and value. Looking for example in chapter 5.4.6.3.5 at the description for the encoding of a flow control on command it becomes obvious, that the type and length field is always present whereas the value may be zero bytes long. The current implementation omits the length field if the value is not present. This is wrong. Correct this by always sending the length in gsm_control_transmit(). So far only the modem status command (MSC) has included a value and encoded its length directly. Therefore, also change gsmtty_modem_update(). Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-12-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/tty/n_gsm.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1318,11 +1318,12 @@ static void gsm_control_response(struct =20 static void gsm_control_transmit(struct gsm_mux *gsm, struct gsm_control *= ctrl) { - struct gsm_msg *msg =3D gsm_data_alloc(gsm, 0, ctrl->len + 1, gsm->ftype); + struct gsm_msg *msg =3D gsm_data_alloc(gsm, 0, ctrl->len + 2, gsm->ftype); if (msg =3D=3D NULL) return; - msg->data[0] =3D (ctrl->cmd << 1) | 2 | EA; /* command */ - memcpy(msg->data + 1, ctrl->data, ctrl->len); + msg->data[0] =3D (ctrl->cmd << 1) | CR | EA; /* command */ + msg->data[1] =3D (ctrl->len << 1) | EA; + memcpy(msg->data + 2, ctrl->data, ctrl->len); gsm_data_queue(gsm->dlci[0], msg); } =20 @@ -2864,19 +2865,17 @@ static struct tty_ldisc_ops tty_ldisc_pa =20 static int gsmtty_modem_update(struct gsm_dlci *dlci, u8 brk) { - u8 modembits[5]; + u8 modembits[3]; struct gsm_control *ctrl; int len =3D 2; =20 - if (brk) + modembits[0] =3D (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ + modembits[1] =3D (gsm_encode_modem(dlci) << 1) | EA; + if (brk) { + modembits[2] =3D (brk << 4) | 2 | EA; /* Length, Break, EA */ len++; - - modembits[0] =3D len << 1 | EA; /* Data bytes */ - modembits[1] =3D dlci->addr << 2 | 3; /* DLCI, EA, 1 */ - modembits[2] =3D gsm_encode_modem(dlci) << 1 | EA; - if (brk) - modembits[3] =3D brk << 4 | 2 | EA; /* Valid, EA */ - ctrl =3D gsm_control_send(dlci->gsm, CMD_MSC, modembits, len + 1); + } + ctrl =3D gsm_control_send(dlci->gsm, CMD_MSC, modembits, len); if (ctrl =3D=3D NULL) return -ENOMEM; return gsm_control_wait(dlci->gsm, ctrl); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CE1C7C433EF for ; Tue, 10 May 2022 13:15:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242604AbiEJNTN (ORCPT ); Tue, 10 May 2022 09:19:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35740 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242414AbiEJNQg (ORCPT ); Tue, 10 May 2022 09:16:36 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 385503EBB9; Tue, 10 May 2022 06:12:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B2220B81DA1; Tue, 10 May 2022 13:12:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2785AC385C2; Tue, 10 May 2022 13:12:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188340; bh=3OFM0X4WoAOflt0Pp2URYa5Mf5EyB4TJoJUaxx8rens=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aYHWPRhSMFZ/nhtc7jyuL0axCAhur46DYkHKSg3AG0eaIRXoQrS1PmHeFFlzJaIef CECZ835MvfM159/y506hdmT+s2rF0j5nOvwJKUESUxipJ1KlVZwJIXFANG1AWTudlg nnKhi6UzrbnuRR2LVEnIRn92Mdccl6i/ymei8i1E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.9 42/66] tty: n_gsm: fix incorrect UA handling Date: Tue, 10 May 2022 15:07:32 +0200 Message-Id: <20220510130731.001332204@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit ff9166c623704337bd6fe66fce2838d9768a6634 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.4.4.2 states that any received unnumbered acknowledgment (UA) with its poll/final (PF) bit set to 0 shall be discarded. Currently, all UA frame are handled in the same way regardless of the PF bit. This does not comply with the standard. Remove the UA case in gsm_queue() to process only UA frames with PF bit set to 1 to abide the standard. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-20-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/tty/n_gsm.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1829,7 +1829,6 @@ static void gsm_queue(struct gsm_mux *gs gsm_response(gsm, address, UA); gsm_dlci_close(dlci); break; - case UA: case UA|PF: if (cr =3D=3D 0 || dlci =3D=3D NULL) break; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79C87C433EF for ; Tue, 10 May 2022 13:15:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242460AbiEJNTA (ORCPT ); Tue, 10 May 2022 09:19:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38326 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242465AbiEJNQm (ORCPT ); Tue, 10 May 2022 09:16:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B41A144749; Tue, 10 May 2022 06:12:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6955FB81DA4; Tue, 10 May 2022 13:12:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9DE54C385C2; Tue, 10 May 2022 13:12:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188347; bh=eGKVehjnwRCQlSs6dV3Bpvrmr8cNDnLluYxZbJGRHOo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mu4YqwEcRiWUyw8wTITuYm6Cbvcoo7VjKnY5iO2oknrcBpKevQaTUGxppNRSln4Ds PwumNmwB1i0S2rF4xTfR3xTDtybymB06i91hf4Jrtv3u3vMrxpu4wRpsCmFDnzIejJ Xw09yUg3VOPxC05OJY4YuxGX5POlsMrDh99a5bWw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Maciej W. Rozycki" , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Thomas Bogendoerfer Subject: [PATCH 4.9 43/66] MIPS: Fix CP0 counter erratum detection for R4k CPUs Date: Tue, 10 May 2022 15:07:33 +0200 Message-Id: <20220510130731.029472163@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Maciej W. Rozycki commit f0a6c68f69981214cb7858738dd2bc81475111f7 upstream. Fix the discrepancy between the two places we check for the CP0 counter erratum in along with the incorrect comparison of the R4400 revision number against 0x30 which matches none and consistently consider all R4000 and R4400 processors affected, as documented in processor errata publications[1][2][3], following the mapping between CP0 PRId register values and processor models: PRId | Processor Model Reviewed-by: Philippe Mathieu-Daud=C3=A9 Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan ---------+-------------------- 00000422 | R4000 Revision 2.2 00000430 | R4000 Revision 3.0 00000440 | R4400 Revision 1.0 00000450 | R4400 Revision 2.0 00000460 | R4400 Revision 3.0 No other revision of either processor has ever been spotted. Contrary to what has been stated in commit ce202cbb9e0b ("[MIPS] Assume R4000/R4400 newer than 3.0 don't have the mfc0 count bug") marking the CP0 counter as buggy does not preclude it from being used as either a clock event or a clock source device. It just cannot be used as both at a time, because in that case clock event interrupts will be occasionally lost, and the use as a clock event device takes precedence. Compare against 0x4ff in `can_use_mips_counter' so that a single machine instruction is produced. [1] "MIPS R4000PC/SC Errata, Processor Revision 2.2 and 3.0", MIPS Technologies Inc., May 10, 1994, Erratum 53, p.13 [2] "MIPS R4400PC/SC Errata, Processor Revision 1.0", MIPS Technologies Inc., February 9, 1994, Erratum 21, p.4 [3] "MIPS R4400PC/SC Errata, Processor Revision 2.0 & 3.0", MIPS Technologies Inc., January 24, 1995, Erratum 14, p.3 Signed-off-by: Maciej W. Rozycki Fixes: ce202cbb9e0b ("[MIPS] Assume R4000/R4400 newer than 3.0 don't have t= he mfc0 count bug") Cc: stable@vger.kernel.org # v2.6.24+ Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Thomas Bogendoerfer Signed-off-by: Greg Kroah-Hartman --- arch/mips/include/asm/timex.h | 8 ++++---- arch/mips/kernel/time.c | 11 +++-------- 2 files changed, 7 insertions(+), 12 deletions(-) --- a/arch/mips/include/asm/timex.h +++ b/arch/mips/include/asm/timex.h @@ -40,9 +40,9 @@ typedef unsigned int cycles_t; =20 /* - * On R4000/R4400 before version 5.0 an erratum exists such that if the - * cycle counter is read in the exact moment that it is matching the - * compare register, no interrupt will be generated. + * On R4000/R4400 an erratum exists such that if the cycle counter is + * read in the exact moment that it is matching the compare register, + * no interrupt will be generated. * * There is a suggested workaround and also the erratum can't strike if * the compare interrupt isn't being used as the clock source device. @@ -63,7 +63,7 @@ static inline int can_use_mips_counter(u if (!__builtin_constant_p(cpu_has_counter)) asm volatile("" : "=3Dm" (cpu_data[0].options)); if (likely(cpu_has_counter && - prid >=3D (PRID_IMP_R4000 | PRID_REV_ENCODE_44(5, 0)))) + prid > (PRID_IMP_R4000 | PRID_REV_ENCODE_44(15, 15)))) return 1; else return 0; --- a/arch/mips/kernel/time.c +++ b/arch/mips/kernel/time.c @@ -168,15 +168,10 @@ static __init int cpu_has_mfc0_count_bug case CPU_R4400MC: /* * The published errata for the R4400 up to 3.0 say the CPU - * has the mfc0 from count bug. + * has the mfc0 from count bug. This seems the last version + * produced. */ - if ((current_cpu_data.processor_id & 0xff) <=3D 0x30) - return 1; - - /* - * we assume newer revisions are ok - */ - return 0; + return 1; } =20 return 0; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F3ACC433EF for ; Tue, 10 May 2022 13:15:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242502AbiEJNTY (ORCPT ); Tue, 10 May 2022 09:19:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38058 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242498AbiEJNQn (ORCPT ); Tue, 10 May 2022 09:16:43 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AE643496B3; Tue, 10 May 2022 06:12:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 93CFBCE1EE2; Tue, 10 May 2022 13:12:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 98CD6C385A6; Tue, 10 May 2022 13:12:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188350; bh=NHaV4yuE/2PD3w4mbg06eoAygsYUC7lzoD4CfDzjT74=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ae/lXk5JUOyy15WErMvHuUpai5EpPoVqqYaSKU45Q8lWvcUVUN08TOSEatG/k3oZM pXlLQX2JVUQvGxSNKUTykUECCzuaHvPZVStaRq7dzDzmlIENYIlTQFPg9Xl9IFzHX+ TPiWsHWc5TuyFJNPpnNLsSrk+/szQTQEMnT09Gmo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller Subject: [PATCH 4.9 44/66] parisc: Merge model and model name into one line in /proc/cpuinfo Date: Tue, 10 May 2022 15:07:34 +0200 Message-Id: <20220510130731.059057471@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller commit 5b89966bc96a06f6ad65f64ae4b0461918fcc9d3 upstream. The Linux tool "lscpu" shows the double amount of CPUs if we have "model" and "model name" in two different lines in /proc/cpuinfo. This change combines the model and the model name into one line. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/parisc/kernel/processor.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/arch/parisc/kernel/processor.c +++ b/arch/parisc/kernel/processor.c @@ -390,8 +390,7 @@ show_cpuinfo (struct seq_file *m, void * } seq_printf(m, " (0x%02lx)\n", boot_cpu_data.pdc.capabilities); =20 - seq_printf(m, "model\t\t: %s\n" - "model name\t: %s\n", + seq_printf(m, "model\t\t: %s - %s\n", boot_cpu_data.pdc.sys_model_name, cpuinfo->dev ? cpuinfo->dev->name : "Unknown"); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E78ACC433F5 for ; Tue, 10 May 2022 13:15:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242533AbiEJNT2 (ORCPT ); Tue, 10 May 2022 09:19:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36724 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242501AbiEJNQn (ORCPT ); Tue, 10 May 2022 09:16:43 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 23A0B49C80; Tue, 10 May 2022 06:12:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 80017CE1EE5; Tue, 10 May 2022 13:12:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 949F1C385A6; Tue, 10 May 2022 13:12:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188352; bh=xcXfCRcoyhfyUlxipCdVEsXYo0JlNezMMEx8Crxqedw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vI3AnWVmVz2eyEJi80ZcdTh78S/n948CeS+XPg4463RmH6HHlmqnwDPOMhLfdt4Eo 6FgdQoyA8Q2uqz47utQJ2bydA4SWUxjjm04JikLAEq3akBMvMD2wA4Fsa2W4Bd9SJT NlPE6fJtJxfsMvwAG8WdT8DEUJ+wrqL+SHMMEFRk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.9 45/66] ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes Date: Tue, 10 May 2022 15:07:35 +0200 Message-Id: <20220510130731.088702139@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Sakamoto commit eb9d84b0ffe39893cb23b0b6712bbe3637fa25fa upstream. ALSA fireworks driver has a bug in its initial state to return count shorter than expected by 4 bytes to userspace applications when handling response frame for Echo Audio Fireworks transaction. It's due to missing addition of the size for the type of event in ALSA firewire stack. Fixes: 555e8a8f7f14 ("ALSA: fireworks: Add command/response functionality i= nto hwdep interface") Cc: Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220424102428.21109-1-o-takashi@sakamocchi= .jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- sound/firewire/fireworks/fireworks_hwdep.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/firewire/fireworks/fireworks_hwdep.c +++ b/sound/firewire/fireworks/fireworks_hwdep.c @@ -35,6 +35,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, type =3D SNDRV_FIREWIRE_EVENT_EFW_RESPONSE; if (copy_to_user(buf, &type, sizeof(type))) return -EFAULT; + count +=3D sizeof(type); remained -=3D sizeof(type); buf +=3D sizeof(type); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F8F3C433F5 for ; Tue, 10 May 2022 13:15:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242622AbiEJNTc (ORCPT ); Tue, 10 May 2022 09:19:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37530 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242522AbiEJNQp (ORCPT ); Tue, 10 May 2022 09:16:45 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1348B4EF4D; Tue, 10 May 2022 06:12:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DA394B81D7C; Tue, 10 May 2022 13:12:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 569DCC385C2; Tue, 10 May 2022 13:12:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188355; bh=zumcUBKdVw+tCDMrhfgUFNeo9e5sfQFbqe3N33yZVjk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LMWP43telmrl5CdtgZ40mwxa5bE6Lp5qk7aEfalHr7WmlgAAwMSs4Y0cdE5GRxScN GuKGTmImMmgL6KNhn7YL0mXdVyjZO5ykQVr69MFylTUJGtGgDeirGMz8jY3vAeBnm/ xD8sxMaaP3Jowq41lKK4yxHpboLplMJjlHksPPcs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "wanghai (M)" , Trond Myklebust Subject: [PATCH 4.9 46/66] Revert "SUNRPC: attempt AF_LOCAL connect on setup" Date: Tue, 10 May 2022 15:07:36 +0200 Message-Id: <20220510130731.117354034@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Trond Myklebust commit a3d0562d4dc039bca39445e1cddde7951662e17d upstream. This reverts commit 7073ea8799a8cf73db60270986f14e4aae20fa80. We must not try to connect the socket while the transport is under construction, because the mechanisms to safely tear it down are not in place. As the code stands, we end up leaking the sockets on a connection error. Reported-by: wanghai (M) Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/sunrpc/xprtsock.c | 3 --- 1 file changed, 3 deletions(-) --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -2882,9 +2882,6 @@ static struct rpc_xprt *xs_setup_local(s } xprt_set_bound(xprt); xs_format_peer_addresses(xprt, "local", RPCBIND_NETID_LOCAL); - ret =3D ERR_PTR(xs_local_setup_socket(transport)); - if (ret) - goto out_err; break; default: ret =3D ERR_PTR(-EAFNOSUPPORT); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF8F8C433F5 for ; Tue, 10 May 2022 13:15:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242627AbiEJNTf (ORCPT ); Tue, 10 May 2022 09:19:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38328 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242528AbiEJNQp (ORCPT ); Tue, 10 May 2022 09:16:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 78CCF3BA65; Tue, 10 May 2022 06:12:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2D6DE612E4; Tue, 10 May 2022 13:12:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34F28C385A6; Tue, 10 May 2022 13:12:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188358; bh=Bn5ILpV3s+Rbw2XFY28VLlaXni3LCUf0kZlkGm9EbU8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OkUOCBKpOintcRowpd6oVdcBY4jt6PacninEUopc5+0s2EMjOzXJGHBPOBUSvKMRc nKhkg43K27QBsmIYRDlt8tOAOp3S7P2VSL+6xz42aOrGN8zltUbb0YndgVvXVkZ9tA t1Lqc9ujxIQ9oo0Jr6pUdJYVr/aNAW//Qj099X38= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengfeng Ye , Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.9 47/66] firewire: fix potential uaf in outbound_phy_packet_callback() Date: Tue, 10 May 2022 15:07:37 +0200 Message-Id: <20220510130731.146172938@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengfeng Ye commit b7c81f80246fac44077166f3e07103affe6db8ff upstream. &e->event and e point to the same address, and &e->event could be freed in queue_event. So there is a potential uaf issue if we dereference e after calling queue_event(). Fix this by adding a temporary variable to maintain e->client in advance, this can avoid the potential uaf issue. Cc: Signed-off-by: Chengfeng Ye Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220409041243.603210-2-o-takashi@sakamocch= i.jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/firewire/core-cdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/firewire/core-cdev.c +++ b/drivers/firewire/core-cdev.c @@ -1496,6 +1496,7 @@ static void outbound_phy_packet_callback { struct outbound_phy_packet_event *e =3D container_of(packet, struct outbound_phy_packet_event, p); + struct client *e_client; =20 switch (status) { /* expected: */ @@ -1512,9 +1513,10 @@ static void outbound_phy_packet_callback } e->phy_packet.data[0] =3D packet->timestamp; =20 + e_client =3D e->client; queue_event(e->client, &e->event, &e->phy_packet, sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0); - client_put(e->client); + client_put(e_client); } =20 static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *a= rg) From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B783C433EF for ; Tue, 10 May 2022 13:16:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242642AbiEJNTw (ORCPT ); Tue, 10 May 2022 09:19:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39616 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242415AbiEJNQy (ORCPT ); Tue, 10 May 2022 09:16:54 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D6424A3F5; Tue, 10 May 2022 06:12:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1A2B4615E7; Tue, 10 May 2022 13:12:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1689AC385A6; Tue, 10 May 2022 13:12:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188361; bh=0w0xQr+Pu/llxYWRbwOnMuOVCGxAkws6yzESbdnf+gk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uMhlJlV6p1JpvMMq39i5uwcfNkHpvxRsO3+v8g/U06F1PlNvydiiaGg865dEHbp73 Ax0HMy1H1/TvYETDtbzidRHrv2glUPkZB0PREkOamwi5WUvH5/O3CwVIfEz4H3y/HN 6AOfG0ahNAh7Kil8sbGOf/rf6WK5j0v3it26NcCU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jakob Koschel , Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.9 48/66] firewire: remove check of list iterator against head past the loop body Date: Tue, 10 May 2022 15:07:38 +0200 Message-Id: <20220510130731.175393079@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jakob Koschel commit 9423973869bd4632ffe669f950510c49296656e0 upstream. When list_for_each_entry() completes the iteration over the whole list without breaking the loop, the iterator value will be a bogus pointer computed based on the head element. While it is safe to use the pointer to determine if it was computed based on the head element, either with list_entry_is_head() or &pos->member =3D=3D head, using the iterator variable after the loop should be avoided. In preparation to limit the scope of a list iterator to the list traversal loop, use a dedicated pointer to point to the found element [1]. Link: https://lore.kernel.org/all/CAHk-=3DwgRr_D8CB-D9Kg-c=3DEHreAsk5SqXPwr= 9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] Cc: Signed-off-by: Jakob Koschel Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220409041243.603210-3-o-takashi@sakamocch= i.jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/firewire/core-transaction.c | 30 ++++++++++++++++-------------- drivers/firewire/sbp2.c | 13 +++++++------ 2 files changed, 23 insertions(+), 20 deletions(-) --- a/drivers/firewire/core-transaction.c +++ b/drivers/firewire/core-transaction.c @@ -86,24 +86,25 @@ static int try_cancel_split_timeout(stru static int close_transaction(struct fw_transaction *transaction, struct fw_card *card, int rcode) { - struct fw_transaction *t; + struct fw_transaction *t =3D NULL, *iter; unsigned long flags; =20 spin_lock_irqsave(&card->lock, flags); - list_for_each_entry(t, &card->transaction_list, link) { - if (t =3D=3D transaction) { - if (!try_cancel_split_timeout(t)) { + list_for_each_entry(iter, &card->transaction_list, link) { + if (iter =3D=3D transaction) { + if (!try_cancel_split_timeout(iter)) { spin_unlock_irqrestore(&card->lock, flags); goto timed_out; } - list_del_init(&t->link); - card->tlabel_mask &=3D ~(1ULL << t->tlabel); + list_del_init(&iter->link); + card->tlabel_mask &=3D ~(1ULL << iter->tlabel); + t =3D iter; break; } } spin_unlock_irqrestore(&card->lock, flags); =20 - if (&t->link !=3D &card->transaction_list) { + if (t) { t->callback(card, rcode, NULL, 0, t->callback_data); return 0; } @@ -938,7 +939,7 @@ EXPORT_SYMBOL(fw_core_handle_request); =20 void fw_core_handle_response(struct fw_card *card, struct fw_packet *p) { - struct fw_transaction *t; + struct fw_transaction *t =3D NULL, *iter; unsigned long flags; u32 *data; size_t data_length; @@ -950,20 +951,21 @@ void fw_core_handle_response(struct fw_c rcode =3D HEADER_GET_RCODE(p->header[1]); =20 spin_lock_irqsave(&card->lock, flags); - list_for_each_entry(t, &card->transaction_list, link) { - if (t->node_id =3D=3D source && t->tlabel =3D=3D tlabel) { - if (!try_cancel_split_timeout(t)) { + list_for_each_entry(iter, &card->transaction_list, link) { + if (iter->node_id =3D=3D source && iter->tlabel =3D=3D tlabel) { + if (!try_cancel_split_timeout(iter)) { spin_unlock_irqrestore(&card->lock, flags); goto timed_out; } - list_del_init(&t->link); - card->tlabel_mask &=3D ~(1ULL << t->tlabel); + list_del_init(&iter->link); + card->tlabel_mask &=3D ~(1ULL << iter->tlabel); + t =3D iter; break; } } spin_unlock_irqrestore(&card->lock, flags); =20 - if (&t->link =3D=3D &card->transaction_list) { + if (!t) { timed_out: fw_notice(card, "unsolicited response (source %x, tlabel %x)\n", source, tlabel); --- a/drivers/firewire/sbp2.c +++ b/drivers/firewire/sbp2.c @@ -421,7 +421,7 @@ static void sbp2_status_write(struct fw_ void *payload, size_t length, void *callback_data) { struct sbp2_logical_unit *lu =3D callback_data; - struct sbp2_orb *orb; + struct sbp2_orb *orb =3D NULL, *iter; struct sbp2_status status; unsigned long flags; =20 @@ -446,17 +446,18 @@ static void sbp2_status_write(struct fw_ =20 /* Lookup the orb corresponding to this status write. */ spin_lock_irqsave(&lu->tgt->lock, flags); - list_for_each_entry(orb, &lu->orb_list, link) { + list_for_each_entry(iter, &lu->orb_list, link) { if (STATUS_GET_ORB_HIGH(status) =3D=3D 0 && - STATUS_GET_ORB_LOW(status) =3D=3D orb->request_bus) { - orb->rcode =3D RCODE_COMPLETE; - list_del(&orb->link); + STATUS_GET_ORB_LOW(status) =3D=3D iter->request_bus) { + iter->rcode =3D RCODE_COMPLETE; + list_del(&iter->link); + orb =3D iter; break; } } spin_unlock_irqrestore(&lu->tgt->lock, flags); =20 - if (&orb->link !=3D &lu->orb_list) { + if (orb) { orb->callback(orb, &status); kref_put(&orb->kref, free_orb); /* orb callback reference */ } else { From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44AD0C433EF for ; Tue, 10 May 2022 13:16:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242651AbiEJNUC (ORCPT ); Tue, 10 May 2022 09:20:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242457AbiEJNRA (ORCPT ); Tue, 10 May 2022 09:17:00 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2CF3B3B579; Tue, 10 May 2022 06:12:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C2B98B81D7C; Tue, 10 May 2022 13:12:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 14FBFC385A6; Tue, 10 May 2022 13:12:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188364; bh=toYvJ6hGHqimqqvlv0Z6FParKGxkAv835wQIL1uz/iA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=02Rof8ycd+0S/eKk1TyY6KmxQAAs31uLdxJFAewXiQgOHIRcWwr63WeSFvm3xRxzJ 3Ai+iIAJlcmwOoM+B21o2HAbM1Rg2RAIxciEKerQ1TX0DGGM4OMzswnHZgnU2oIoia xPZG1N+7lIM4Lt9elQC3SxjI1ArpmB/lNZafh7Rw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Niels Dossche , Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.9 49/66] firewire: core: extend card->lock in fw_core_handle_bus_reset Date: Tue, 10 May 2022 15:07:39 +0200 Message-Id: <20220510130731.204287172@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Niels Dossche commit a7ecbe92b9243edbe94772f6f2c854e4142a3345 upstream. card->local_node and card->bm_retries are both always accessed under card->lock. fw_core_handle_bus_reset has a check whose condition depends on card->local_node and whose body writes to card->bm_retries. Both of these accesses are not under card->lock. Move the lock acquiring of card->lock to before this check such that these accesses do happen when card->lock is held. fw_destroy_nodes is called inside the check. Since fw_destroy_nodes already acquires card->lock inside its function body, move this out to the callsites of fw_destroy_nodes. Also add a comment to indicate which locking is necessary when calling fw_destroy_nodes. Cc: Signed-off-by: Niels Dossche Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220409041243.603210-4-o-takashi@sakamocch= i.jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/firewire/core-card.c | 3 +++ drivers/firewire/core-topology.c | 9 +++------ 2 files changed, 6 insertions(+), 6 deletions(-) --- a/drivers/firewire/core-card.c +++ b/drivers/firewire/core-card.c @@ -681,6 +681,7 @@ EXPORT_SYMBOL_GPL(fw_card_release); void fw_core_remove_card(struct fw_card *card) { struct fw_card_driver dummy_driver =3D dummy_driver_template; + unsigned long flags; =20 card->driver->update_phy_reg(card, 4, PHY_LINK_ACTIVE | PHY_CONTENDER, 0); @@ -695,7 +696,9 @@ void fw_core_remove_card(struct fw_card dummy_driver.stop_iso =3D card->driver->stop_iso; card->driver =3D &dummy_driver; =20 + spin_lock_irqsave(&card->lock, flags); fw_destroy_nodes(card); + spin_unlock_irqrestore(&card->lock, flags); =20 /* Wait for all users, especially device workqueue jobs, to finish. */ fw_card_put(card); --- a/drivers/firewire/core-topology.c +++ b/drivers/firewire/core-topology.c @@ -387,16 +387,13 @@ static void report_found_node(struct fw_ card->bm_retries =3D 0; } =20 +/* Must be called with card->lock held */ void fw_destroy_nodes(struct fw_card *card) { - unsigned long flags; - - spin_lock_irqsave(&card->lock, flags); card->color++; if (card->local_node !=3D NULL) for_each_fw_node(card, card->local_node, report_lost_node); card->local_node =3D NULL; - spin_unlock_irqrestore(&card->lock, flags); } =20 static void move_tree(struct fw_node *node0, struct fw_node *node1, int po= rt) @@ -522,6 +519,8 @@ void fw_core_handle_bus_reset(struct fw_ struct fw_node *local_node; unsigned long flags; =20 + spin_lock_irqsave(&card->lock, flags); + /* * If the selfID buffer is not the immediate successor of the * previously processed one, we cannot reliably compare the @@ -533,8 +532,6 @@ void fw_core_handle_bus_reset(struct fw_ card->bm_retries =3D 0; } =20 - spin_lock_irqsave(&card->lock, flags); - card->broadcast_channel_allocated =3D card->broadcast_channel_auto_alloca= ted; card->node_id =3D node_id; /* From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CCCD0C433F5 for ; Tue, 10 May 2022 13:16:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242674AbiEJNUd (ORCPT ); Tue, 10 May 2022 09:20:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40238 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242467AbiEJNRC (ORCPT ); Tue, 10 May 2022 09:17:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 936BE3C4B6; Tue, 10 May 2022 06:12:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 30D58615FA; Tue, 10 May 2022 13:12:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F21C2C385C2; Tue, 10 May 2022 13:12:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188367; bh=7ni6v9EcwTeRnymZXJCe2F2vv9mVcGy9VAalwjR/0ls=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zgbzU+IW+/pslt9oQDQ2xBgoYP/GOlmWnSuaRZlqsT3xBj7/T0b7ulR9HTzub9lD9 YuEI4pKdulbXRTgWSSHvJacMaPZKpY2lLJq80SYnc0Jeqcq/mPD4ChmkvUZXHZSomI BqyqjGpsooJUIpnCymmj5viA4ewAhIkWumcenpRk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Brown , Charles Keepax Subject: [PATCH 4.9 50/66] ASoC: wm8958: Fix change notifications for DSP controls Date: Tue, 10 May 2022 15:07:40 +0200 Message-Id: <20220510130731.232069294@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mark Brown commit b4f5c6b2e52b27462c0599e64e96e53b58438de1 upstream. The WM8958 DSP controls all return 0 on successful write, not a boolean value indicating if the write changed the value of the control. Fix this by returning 1 after a change, there is already a check at the start of each put() that skips the function in the case that there is no change. Signed-off-by: Mark Brown Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20220416125408.197440-1-broonie@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- sound/soc/codecs/wm8958-dsp2.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/sound/soc/codecs/wm8958-dsp2.c +++ b/sound/soc/codecs/wm8958-dsp2.c @@ -533,7 +533,7 @@ static int wm8958_mbc_put(struct snd_kco =20 wm8958_dsp_apply(codec, mbc, wm8994->mbc_ena[mbc]); =20 - return 0; + return 1; } =20 #define WM8958_MBC_SWITCH(xname, xval) {\ @@ -659,7 +659,7 @@ static int wm8958_vss_put(struct snd_kco =20 wm8958_dsp_apply(codec, vss, wm8994->vss_ena[vss]); =20 - return 0; + return 1; } =20 =20 @@ -733,7 +733,7 @@ static int wm8958_hpf_put(struct snd_kco =20 wm8958_dsp_apply(codec, hpf % 3, ucontrol->value.integer.value[0]); =20 - return 0; + return 1; } =20 #define WM8958_HPF_SWITCH(xname, xval) {\ @@ -827,7 +827,7 @@ static int wm8958_enh_eq_put(struct snd_ =20 wm8958_dsp_apply(codec, eq, ucontrol->value.integer.value[0]); =20 - return 0; + return 1; } =20 #define WM8958_ENH_EQ_SWITCH(xname, xval) {\ From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C23CC433EF for ; Tue, 10 May 2022 13:16:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241981AbiEJNUQ (ORCPT ); Tue, 10 May 2022 09:20:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36694 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242547AbiEJNRS (ORCPT ); Tue, 10 May 2022 09:17:18 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2A494093D; Tue, 10 May 2022 06:12:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 30CAD6123F; Tue, 10 May 2022 13:12:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 36E35C385A6; Tue, 10 May 2022 13:12:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188370; bh=2SQP/iK9dFo1azXQPmUtMwnMxA2HAIdd4EY0EdaBOnI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kXxT+OTDXnIshBvRaO1rpWvGNMIloZEh8Egd5ULqR67rLK+g3QMcVJfn9iQM9BQG0 iWexNbEQtzNqENYPunLXJRHMCuBpH9id9V/Kq2oiTRMZmEiy76fiX2OJ9xwkhx0NnX 8r4MnaldSU07kqaurXxoRXx6aNRGH0073uaUzfxk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Andreas Larsson , Marc Kleine-Budde Subject: [PATCH 4.9 51/66] can: grcan: grcan_close(): fix deadlock Date: Tue, 10 May 2022 15:07:41 +0200 Message-Id: <20220510130731.260968927@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 47f070a63e735bcc8d481de31be1b5a1aa62b31c upstream. There are deadlocks caused by del_timer_sync(&priv->hang_timer) and del_timer_sync(&priv->rr_timer) in grcan_close(), one of the deadlocks are shown below: (Thread 1) | (Thread 2) | grcan_reset_timer() grcan_close() | mod_timer() spin_lock_irqsave() //(1) | (wait a time) ... | grcan_initiate_running_reset() del_timer_sync() | spin_lock_irqsave() //(2) (wait timer to stop) | ... We hold priv->lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need priv->lock in position (2) of thread 2. As a result, grcan_close() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock. Link: https://lore.kernel.org/all/20220425042400.66517-1-duoming@zju.edu.cn Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN co= res") Cc: stable@vger.kernel.org Signed-off-by: Duoming Zhou Reviewed-by: Andreas Larsson Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/can/grcan.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/can/grcan.c +++ b/drivers/net/can/grcan.c @@ -1117,8 +1117,10 @@ static int grcan_close(struct net_device =20 priv->closing =3D true; if (priv->need_txbug_workaround) { + spin_unlock_irqrestore(&priv->lock, flags); del_timer_sync(&priv->hang_timer); del_timer_sync(&priv->rr_timer); + spin_lock_irqsave(&priv->lock, flags); } netif_stop_queue(dev); grcan_stop_hardware(dev); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B74E6C433F5 for ; Tue, 10 May 2022 13:16:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242660AbiEJNU1 (ORCPT ); Tue, 10 May 2022 09:20:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38496 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242559AbiEJNRU (ORCPT ); Tue, 10 May 2022 09:17:20 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9079740927; Tue, 10 May 2022 06:12:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2CF8E615DD; Tue, 10 May 2022 13:12:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3AE76C385A6; Tue, 10 May 2022 13:12:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188373; bh=iXVVI4US+Q041s1HhJh5ERMO/BF9bJSOGPx+QLMsC9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EHo4/0O+exXbYpR87y5DNZShm9b4jNSoVcMEawoS+cCySAytqcjFLMahL7uTZ06KK NIlzvrXNHPaOgqxWqM+7UL6QBlsv4LlaJKlTANd+DWnq2L7wSFZT0NGw8exqGvN1GQ O+BXLqYkdUEHAuwpzOr6CRpM+EmOBpmwwM3C6pJg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Hellstrom , Andreas Larsson , Marc Kleine-Budde Subject: [PATCH 4.9 52/66] can: grcan: use ofdev->dev when allocating DMA memory Date: Tue, 10 May 2022 15:07:42 +0200 Message-Id: <20220510130731.293111525@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Hellstrom commit 101da4268626b00d16356a6bf284d66e44c46ff9 upstream. Use the device of the device tree node should be rather than the device of the struct net_device when allocating DMA buffers. The driver got away with it on sparc32 until commit 53b7670e5735 ("sparc: factor the dma coherent mapping into helper") after which the driver oopses. Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN co= res") Link: https://lore.kernel.org/all/20220429084656.29788-2-andreas@gaisler.com Cc: stable@vger.kernel.org Signed-off-by: Daniel Hellstrom Signed-off-by: Andreas Larsson Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/can/grcan.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/net/can/grcan.c +++ b/drivers/net/can/grcan.c @@ -252,6 +252,7 @@ struct grcan_device_config { struct grcan_priv { struct can_priv can; /* must be the first member */ struct net_device *dev; + struct device *ofdev_dev; struct napi_struct napi; =20 struct grcan_registers __iomem *regs; /* ioremap'ed registers */ @@ -928,7 +929,7 @@ static void grcan_free_dma_buffers(struc struct grcan_priv *priv =3D netdev_priv(dev); struct grcan_dma *dma =3D &priv->dma; =20 - dma_free_coherent(&dev->dev, dma->base_size, dma->base_buf, + dma_free_coherent(priv->ofdev_dev, dma->base_size, dma->base_buf, dma->base_handle); memset(dma, 0, sizeof(*dma)); } @@ -953,7 +954,7 @@ static int grcan_allocate_dma_buffers(st =20 /* Extra GRCAN_BUFFER_ALIGNMENT to allow for alignment */ dma->base_size =3D lsize + ssize + GRCAN_BUFFER_ALIGNMENT; - dma->base_buf =3D dma_alloc_coherent(&dev->dev, + dma->base_buf =3D dma_alloc_coherent(priv->ofdev_dev, dma->base_size, &dma->base_handle, GFP_KERNEL); @@ -1606,6 +1607,7 @@ static int grcan_setup_netdev(struct pla memcpy(&priv->config, &grcan_module_config, sizeof(struct grcan_device_config)); priv->dev =3D dev; + priv->ofdev_dev =3D &ofdev->dev; priv->regs =3D base; priv->can.bittiming_const =3D &grcan_bittiming_const; priv->can.do_set_bittiming =3D grcan_set_bittiming; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15D90C4332F for ; Tue, 10 May 2022 13:16:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242576AbiEJNUh (ORCPT ); Tue, 10 May 2022 09:20:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37730 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242388AbiEJNSK (ORCPT ); Tue, 10 May 2022 09:18:10 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 83E173DDD9; Tue, 10 May 2022 06:13:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B50E4615DD; Tue, 10 May 2022 13:12:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C4934C385A6; Tue, 10 May 2022 13:12:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188379; bh=PLBcffHUTxEwDYZ2I2HzXLMI033QZq0mU5i+o1QVl8o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0a5qaPLu313ocHSrV6Duz7JF+ib+kGAo6CtCN9L1I8fFcOLA4MEAkH9XeDE8ogrQO AH+fVPhm/mDSCwgoy04UcayRbKR01pPSSC8npMYJi6ycivxo57itf4Fjn0EtX0e5o9 wkViNI7XHQW7Hh05RYLs0dTjZaOppcmWRhXU7eYE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , "David S. Miller" Subject: [PATCH 4.9 53/66] nfc: replace improper check device_is_registered() in netlink related functions Date: Tue, 10 May 2022 15:07:43 +0200 Message-Id: <20220510130731.321915579@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit da5c0f119203ad9728920456a0f52a6d850c01cd upstream. The device_is_registered() in nfc core is used to check whether nfc device is registered in netlink related functions such as nfc_fw_download(), nfc_dev_up() and so on. Although device_is_registered() is protected by device_lock, there is still a race condition between device_del() and device_is_registered(). The root cause is that kobject_del() in device_del() is not protected by device_lock. (cleanup task) | (netlink task) | nfc_unregister_device | nfc_fw_download device_del | device_lock ... | if (!device_is_registered)//(1) kobject_del//(2) | ... ... | device_unlock The device_is_registered() returns the value of state_in_sysfs and the state_in_sysfs is set to zero in kobject_del(). If we pass check in position (1), then set zero in position (2). As a result, the check in position (1) is useless. This patch uses bool variable instead of device_is_registered() to judge whether the nfc device is registered, which is well synchronized. Fixes: 3e256b8f8dfa ("NFC: add nfc subsystem core") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/nfc/core.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) --- a/net/nfc/core.c +++ b/net/nfc/core.c @@ -50,7 +50,7 @@ int nfc_fw_download(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -106,7 +106,7 @@ int nfc_dev_up(struct nfc_dev *dev) =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -154,7 +154,7 @@ int nfc_dev_down(struct nfc_dev *dev) =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -218,7 +218,7 @@ int nfc_start_poll(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -257,7 +257,7 @@ int nfc_stop_poll(struct nfc_dev *dev) =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -302,7 +302,7 @@ int nfc_dep_link_up(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -346,7 +346,7 @@ int nfc_dep_link_down(struct nfc_dev *de =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -412,7 +412,7 @@ int nfc_activate_target(struct nfc_dev * =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -458,7 +458,7 @@ int nfc_deactivate_target(struct nfc_dev =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -505,7 +505,7 @@ int nfc_data_exchange(struct nfc_dev *de =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; kfree_skb(skb); goto error; @@ -562,7 +562,7 @@ int nfc_enable_se(struct nfc_dev *dev, u =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -611,7 +611,7 @@ int nfc_disable_se(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -1142,6 +1142,7 @@ int nfc_register_device(struct nfc_dev * dev->rfkill =3D NULL; } } + dev->shutting_down =3D false; device_unlock(&dev->dev); =20 rc =3D nfc_genl_device_added(dev); @@ -1174,12 +1175,10 @@ void nfc_unregister_device(struct nfc_de rfkill_unregister(dev->rfkill); rfkill_destroy(dev->rfkill); } + dev->shutting_down =3D true; device_unlock(&dev->dev); =20 if (dev->ops->check_presence) { - device_lock(&dev->dev); - dev->shutting_down =3D true; - device_unlock(&dev->dev); del_timer_sync(&dev->check_pres_timer); cancel_work_sync(&dev->check_pres_work); } From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5ADDBC433F5 for ; Tue, 10 May 2022 13:16:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242702AbiEJNUk (ORCPT ); Tue, 10 May 2022 09:20:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36170 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242532AbiEJNSb (ORCPT ); Tue, 10 May 2022 09:18:31 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9D28148E7C; Tue, 10 May 2022 06:13:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 46B9DB81DA0; Tue, 10 May 2022 13:13:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A2868C385C9; Tue, 10 May 2022 13:13:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188382; bh=u1cQkEjm2uylWaETzHonkQZYFcxnixFvu9JCXLBQQ0Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cu/RxM04105WPULhSrE3WqbCpsD5CdNUpTI39QpdnuL3yMUg1V4IAEi5XByIsAlCO VSntQUc3OU+1oiNi8uzsdQUMf6f5ZsY2dmWwkDvT9dbWooVAYqx51kCiBKHpBQudh/ pOYBLeE11v7yensiF50B8E8pLiV4GkouvseWmNHg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , "David S. Miller" Subject: [PATCH 4.9 54/66] nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs Date: Tue, 10 May 2022 15:07:44 +0200 Message-Id: <20220510130731.350897432@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit d270453a0d9ec10bb8a802a142fb1b3601a83098 upstream. There are destructive operations such as nfcmrvl_fw_dnld_abort and gpio_free in nfcmrvl_nci_unregister_dev. The resources such as firmware, gpio and so on could be destructed while the upper layer functions such as nfcmrvl_fw_dnld_start and nfcmrvl_nci_recv_frame is executing, which leads to double-free, use-after-free and null-ptr-deref bugs. There are three situations that could lead to double-free bugs. The first situation is shown below: (Thread 1) | (Thread 2) nfcmrvl_fw_dnld_start | ... | nfcmrvl_nci_unregister_dev release_firmware() | nfcmrvl_fw_dnld_abort kfree(fw) //(1) | fw_dnld_over | release_firmware ... | kfree(fw) //(2) | ... The second situation is shown below: (Thread 1) | (Thread 2) nfcmrvl_fw_dnld_start | ... | mod_timer | (wait a time) | fw_dnld_timeout | nfcmrvl_nci_unregister_dev fw_dnld_over | nfcmrvl_fw_dnld_abort release_firmware | fw_dnld_over kfree(fw) //(1) | release_firmware ... | kfree(fw) //(2) The third situation is shown below: (Thread 1) | (Thread 2) nfcmrvl_nci_recv_frame | if(..->fw_download_in_progress)| nfcmrvl_fw_dnld_recv_frame | queue_work | | fw_dnld_rx_work | nfcmrvl_nci_unregister_dev fw_dnld_over | nfcmrvl_fw_dnld_abort release_firmware | fw_dnld_over kfree(fw) //(1) | release_firmware | kfree(fw) //(2) The firmware struct is deallocated in position (1) and deallocated in position (2) again. The crash trace triggered by POC is like below: BUG: KASAN: double-free or invalid-free in fw_dnld_over Call Trace: kfree fw_dnld_over nfcmrvl_nci_unregister_dev nci_uart_tty_close tty_ldisc_kill tty_ldisc_hangup __tty_hangup.part.0 tty_release ... What's more, there are also use-after-free and null-ptr-deref bugs in nfcmrvl_fw_dnld_start. If we deallocate firmware struct, gpio or set null to the members of priv->fw_dnld in nfcmrvl_nci_unregister_dev, then, we dereference firmware, gpio or the members of priv->fw_dnld in nfcmrvl_fw_dnld_start, the UAF or NPD bugs will happen. This patch reorders destructive operations after nci_unregister_device in order to synchronize between cleanup routine and firmware download routine. The nci_unregister_device is well synchronized. If the device is detaching, the firmware download routine will goto error. If firmware download routine is executing, nci_unregister_device will wait until firmware download routine is finished. Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/nfc/nfcmrvl/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/nfc/nfcmrvl/main.c +++ b/drivers/nfc/nfcmrvl/main.c @@ -194,6 +194,7 @@ void nfcmrvl_nci_unregister_dev(struct n { struct nci_dev *ndev =3D priv->ndev; =20 + nci_unregister_device(ndev); if (priv->ndev->nfc_dev->fw_download_in_progress) nfcmrvl_fw_dnld_abort(priv); =20 @@ -202,7 +203,6 @@ void nfcmrvl_nci_unregister_dev(struct n if (priv->config.reset_n_io) gpio_free(priv->config.reset_n_io); =20 - nci_unregister_device(ndev); nci_free_device(ndev); kfree(priv); } From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C362C433F5 for ; Tue, 10 May 2022 13:16:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242569AbiEJNUo (ORCPT ); Tue, 10 May 2022 09:20:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38652 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242523AbiEJNSc (ORCPT ); Tue, 10 May 2022 09:18:32 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BDBA560AA3; Tue, 10 May 2022 06:13:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 46967B81DA3; Tue, 10 May 2022 13:13:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9472CC385A6; Tue, 10 May 2022 13:13:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188384; bh=Nfz6zpMbbUxf74e5+rOO/C5sHyZZWyuK0ySQn8EgPfM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sAs5jKzgu6/3w6CHJVtt1T9nQQWJvGP4fe+ecU8o1byJ5Dba9wYL8K5ktBQkhd5EV Nj3NGi/7Ll3XoXTnfz//59ab0y2lTlSLHp3Vhy7s4ZPM3bpyE+RjLzwalLMc1T8pi1 E1nWZfk9vMTTHLBYyhVSiB49bkbt/ZEUjGOlqUgY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Krzysztof Kozlowski , Paolo Abeni Subject: [PATCH 4.9 55/66] NFC: netlink: fix sleep in atomic bug when firmware download timeout Date: Tue, 10 May 2022 15:07:45 +0200 Message-Id: <20220510130731.379769655@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 4071bf121d59944d5cd2238de0642f3d7995a997 upstream. There are sleep in atomic bug that could cause kernel panic during firmware download process. The root cause is that nlmsg_new with GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer handler. The call trace is shown below: BUG: sleeping function called from invalid context at include/linux/sched/m= m.h:265 Call Trace: kmem_cache_alloc_node __alloc_skb nfc_genl_fw_download_done call_timer_fn __run_timers.part.0 run_timer_softirq __do_softirq ... The nlmsg_new with GFP_KERNEL parameter may sleep during memory allocation process, and the timer handler is run as the result of a "software interrupt" that should not call any other function that could sleep. This patch changes allocation mode of netlink message from GFP_KERNEL to GFP_ATOMIC in order to prevent sleep in atomic bug. The GFP_ATOMIC flag makes memory allocation operation could be used in atomic context. Fixes: 9674da8759df ("NFC: Add firmware upload netlink command") Fixes: 9ea7187c53f6 ("NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD= ") Signed-off-by: Duoming Zhou Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220504055847.38026-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/nfc/netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/nfc/netlink.c +++ b/net/nfc/netlink.c @@ -1254,7 +1254,7 @@ int nfc_genl_fw_download_done(struct nfc struct sk_buff *msg; void *hdr; =20 - msg =3D nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + msg =3D nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); if (!msg) return -ENOMEM; =20 @@ -1270,7 +1270,7 @@ int nfc_genl_fw_download_done(struct nfc =20 genlmsg_end(msg, hdr); =20 - genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL); + genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC); =20 return 0; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22386C433EF for ; Tue, 10 May 2022 13:18:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242835AbiEJNVF (ORCPT ); Tue, 10 May 2022 09:21:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37728 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242557AbiEJNSe (ORCPT ); Tue, 10 May 2022 09:18:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C514D7DE21; Tue, 10 May 2022 06:13:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 490A2B81CE7; Tue, 10 May 2022 13:13:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8BB26C385C9; Tue, 10 May 2022 13:13:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188387; bh=beJbuLc5DeQE1QzkilhzXFk8FrAnqajPtypHf3GrpYA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q0ZIIVFXFfm1L382MjfVWcpwHH3f6OEqkhDRd8QZ4x02DSXiKx4lwl4ZkPQU9bF58 KiiJdIH4xo7UrYWfWQX50/wPznhOHRbSX5vVVbdTe1vRm/PEyfp0Xin7BYsxUhGzQ+ 3EY7MdQS/YKw2JEyXn2ftBDIEi7xyxWvAEtH62Yo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Armin Wolf , Guenter Roeck Subject: [PATCH 4.9 56/66] hwmon: (adt7470) Fix warning on module removal Date: Tue, 10 May 2022 15:07:46 +0200 Message-Id: <20220510130731.408091772@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Armin Wolf commit 7b2666ce445c700b8dcee994da44ddcf050a0842 upstream. When removing the adt7470 module, a warning might be printed: do not call blocking ops when !TASK_RUNNING; state=3D1 set at [] adt7470_update_thread+0x7b/0x130 [adt7470] This happens because adt7470_update_thread() can leave the kthread in TASK_INTERRUPTIBLE state when the kthread is being stopped before the call of set_current_state(). Since kthread_exit() might sleep in exit_signals(), the warning is printed. Fix that by using schedule_timeout_interruptible() and removing the call of set_current_state(). This causes TASK_INTERRUPTIBLE to be set after kthread_should_stop() which might cause the kthread to exit. Reported-by: Zheyu Ma Fixes: 93cacfd41f82 (hwmon: (adt7470) Allow faster removal) Signed-off-by: Armin Wolf Tested-by: Zheyu Ma Link: https://lore.kernel.org/r/20220407101312.13331-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/hwmon/adt7470.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/hwmon/adt7470.c +++ b/drivers/hwmon/adt7470.c @@ -33,6 +33,7 @@ #include #include #include +#include =20 /* Addresses to scan */ static const unsigned short normal_i2c[] =3D { 0x2C, 0x2E, 0x2F, I2C_CLIEN= T_END }; @@ -273,11 +274,10 @@ static int adt7470_update_thread(void *p adt7470_read_temperatures(client, data); mutex_unlock(&data->lock); =20 - set_current_state(TASK_INTERRUPTIBLE); if (kthread_should_stop()) break; =20 - schedule_timeout(msecs_to_jiffies(data->auto_update_interval)); + schedule_timeout_interruptible(msecs_to_jiffies(data->auto_update_interv= al)); } =20 return 0; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79F81C433F5 for ; Tue, 10 May 2022 13:18:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242635AbiEJNU6 (ORCPT ); Tue, 10 May 2022 09:20:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242580AbiEJNSe (ORCPT ); Tue, 10 May 2022 09:18:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BD9DC8D6B8; Tue, 10 May 2022 06:13:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 50E0B615F4; Tue, 10 May 2022 13:13:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5342BC385A6; Tue, 10 May 2022 13:13:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188390; bh=6TDfajJ8pBMh+JcLy099ip64RR+pHVaqJxecjE9Erfk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C3Esn4YaopTMGj9XsJrymli5ue1EaqJ8PTrbprbOcr1xkILmOEy66w3NGpg+Kqa+v H4VR21tIVVdmoxemYHLt26pZRiYDnfbsv5RCFXy8Ne39m9hF6GWWyGiVsX1GzuA5vr /DabRFjCUG0/ErwODUW4q8yRHW2oxKz5ppGiHwYs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sascha Hauer , Codrin Ciubotariu , Mark Brown Subject: [PATCH 4.9 57/66] ASoC: dmaengine: Restore NULL prepare_slave_config() callback Date: Tue, 10 May 2022 15:07:47 +0200 Message-Id: <20220510130731.437972817@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Codrin Ciubotariu commit 660564fc9a92a893a14f255be434f7ea0b967901 upstream. As pointed out by Sascha Hauer, this patch changes: if (pmc->config && !pcm->config->prepare_slave_config) to: if (pmc->config && !pcm->config->prepare_slave_config) snd_dmaengine_pcm_prepare_slave_config() This breaks the drivers that do not need a call to dmaengine_slave_config(). Drivers that still need to call snd_dmaengine_pcm_prepare_slave_config(), but have a NULL pcm->config->prepare_slave_config should use snd_dmaengine_pcm_prepare_slave_config() as their prepare_slave_config callback. Fixes: 9a1e13440a4f ("ASoC: dmaengine: do not use a NULL prepare_slave_conf= ig() callback") Reported-by: Sascha Hauer Signed-off-by: Codrin Ciubotariu Link: https://lore.kernel.org/r/20220421125403.2180824-1-codrin.ciubotariu@= microchip.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- sound/soc/soc-generic-dmaengine-pcm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/sound/soc/soc-generic-dmaengine-pcm.c +++ b/sound/soc/soc-generic-dmaengine-pcm.c @@ -98,10 +98,10 @@ static int dmaengine_pcm_hw_params(struc =20 memset(&slave_config, 0, sizeof(slave_config)); =20 - if (pcm->config && pcm->config->prepare_slave_config) - prepare_slave_config =3D pcm->config->prepare_slave_config; - else + if (!pcm->config) prepare_slave_config =3D snd_dmaengine_pcm_prepare_slave_config; + else + prepare_slave_config =3D pcm->config->prepare_slave_config; =20 if (prepare_slave_config) { ret =3D prepare_slave_config(substream, params, &slave_config); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A377C433FE for ; Tue, 10 May 2022 13:16:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242512AbiEJNUt (ORCPT ); Tue, 10 May 2022 09:20:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242595AbiEJNSe (ORCPT ); Tue, 10 May 2022 09:18:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 37C4599685; Tue, 10 May 2022 06:13:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E9F8AB81B32; Tue, 10 May 2022 13:13:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 626D8C385C2; Tue, 10 May 2022 13:13:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188393; bh=PpHB42D2WhzR1hdSa3ILbnlTtl5eQexm51QPCFTqxsg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=isZ7S1yC2sGxsBsxiwMp5aGnGnXCATv5BagYXho2zjQ0TaA6R9PW6VQOpvqtSGL48 wz3TP3SANniA/XAHTaJLXg6AhU0ao5H5JoQbn33aF0qCYAUoceC6Ffp7hhLeV7hp30 H7N54E340vUL3U9dnEdKlhPOzOQ6EEIZMMEAiW2E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shravya Kumbham , Radhey Shyam Pandey , Paolo Abeni Subject: [PATCH 4.9 58/66] net: emaclite: Add error handling for of_address_to_resource() Date: Tue, 10 May 2022 15:07:48 +0200 Message-Id: <20220510130731.467781204@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Shravya Kumbham commit 7a6bc33ab54923d325d9a1747ec9652c4361ebd1 upstream. check the return value of of_address_to_resource() and also add missing of_node_put() for np and npp nodes. Fixes: e0a3bc65448c ("net: emaclite: Support multiple phys connected to one= MDIO bus") Addresses-Coverity: Event check_return value. Signed-off-by: Shravya Kumbham Signed-off-by: Radhey Shyam Pandey Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) --- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c +++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c @@ -817,10 +817,10 @@ static int xemaclite_mdio_write(struct m static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev) { struct mii_bus *bus; - int rc; struct resource res; struct device_node *np =3D of_get_parent(lp->phy_node); struct device_node *npp; + int rc, ret; =20 /* Don't register the MDIO bus if the phy_node or its parent node * can't be found. @@ -830,8 +830,14 @@ static int xemaclite_mdio_setup(struct n return -ENODEV; } npp =3D of_get_parent(np); - - of_address_to_resource(npp, 0, &res); + ret =3D of_address_to_resource(npp, 0, &res); + of_node_put(npp); + if (ret) { + dev_err(dev, "%s resource error!\n", + dev->of_node->full_name); + of_node_put(np); + return ret; + } if (lp->ndev->mem_start !=3D res.start) { struct phy_device *phydev; phydev =3D of_phy_find_device(lp->phy_node); @@ -840,6 +846,7 @@ static int xemaclite_mdio_setup(struct n "MDIO of the phy is not registered yet\n"); else put_device(&phydev->mdio.dev); + of_node_put(np); return 0; } =20 @@ -852,6 +859,7 @@ static int xemaclite_mdio_setup(struct n bus =3D mdiobus_alloc(); if (!bus) { dev_err(dev, "Failed to allocate mdiobus\n"); + of_node_put(np); return -ENOMEM; } =20 @@ -866,6 +874,7 @@ static int xemaclite_mdio_setup(struct n lp->mii_bus =3D bus; =20 rc =3D of_mdiobus_register(bus, np); + of_node_put(np); if (rc) { dev_err(dev, "Failed to register mdio bus.\n"); goto err_register; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 139B4C433FE for ; Tue, 10 May 2022 13:18:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242791AbiEJNVC (ORCPT ); Tue, 10 May 2022 09:21:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46000 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242594AbiEJNSe (ORCPT ); Tue, 10 May 2022 09:18:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E817C106A55; Tue, 10 May 2022 06:13:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2B84961532; Tue, 10 May 2022 13:13:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D0CFC385C2; Tue, 10 May 2022 13:13:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188396; bh=vrqVFX/5rNQTjld2O2pRIBapKtIEnyHMjCCa+Du3HV0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BIGkiCd3Fy1VNcAkkO5w0amFD3Uft0ikMwh2LlS8kyHlTVjKcAjSppPBBxGiqsiVP JEX4RKjT45fbE5ka8+4rio2m/mi+t88es2h3Y5Hvv0Qk64oiDsE13SJ3b9NDTu/ZRJ aPok3hjsAOYeDE4xZZoDzZhPb18+8/tlgcMRyjP4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Jakub Kicinski Subject: [PATCH 4.9 59/66] smsc911x: allow using IRQ0 Date: Tue, 10 May 2022 15:07:49 +0200 Message-Id: <20220510130731.496264510@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sergey Shtylyov commit 5ef9b803a4af0f5e42012176889b40bb2a978b18 upstream. The AlphaProject AP-SH4A-3A/AP-SH4AD-0A SH boards use IRQ0 for their SMSC LAN911x Ethernet chip, so the networking on them must have been broken by commit 965b2aa78fbc ("net/smsc911x: fix irq resource allocation failure") which filtered out 0 as well as the negative error codes -- it was kinda correct at the time, as platform_get_irq() could return 0 on of_irq_get() failure and on the actual 0 in an IRQ resource. This issue was fixed by me (back in 2016!), so we should be able to fix this driver to allow IRQ0 usage again... When merging this to the stable kernels, make sure you also merge commit e330b9a6bb35 ("platform: don't return 0 from platform_get_irq[_byname]() on error") -- that's my fix to platform_get_irq() for the DT platforms... Fixes: 965b2aa78fbc ("net/smsc911x: fix irq resource allocation failure") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/656036e4-6387-38df-b8a7-6ba683b16e63@omp.ru Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/ethernet/smsc/smsc911x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/smsc/smsc911x.c +++ b/drivers/net/ethernet/smsc/smsc911x.c @@ -2441,7 +2441,7 @@ static int smsc911x_drv_probe(struct pla if (irq =3D=3D -EPROBE_DEFER) { retval =3D -EPROBE_DEFER; goto out_0; - } else if (irq <=3D 0) { + } else if (irq < 0) { pr_warn("Could not allocate irq resource\n"); retval =3D -ENODEV; goto out_0; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AA1BAC433EF for ; Tue, 10 May 2022 13:18:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242691AbiEJNW0 (ORCPT ); Tue, 10 May 2022 09:22:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35740 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242573AbiEJNSx (ORCPT ); Tue, 10 May 2022 09:18:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 26449154015; Tue, 10 May 2022 06:13:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DB174B81B32; Tue, 10 May 2022 13:13:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3B8B2C385C2; Tue, 10 May 2022 13:13:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188399; bh=ftxpZUiRJ6XIBWYxEzwPDWn6N7A5UOZs6uDLol/4rro=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ECs6GzmuZkehmbI67msoP40g9kliVxpLNso7TZc5eKVzjJZdJW01lekIKi8xZoPL8 TdHMXUGopY6NhxteELxVuwvtlRyc/yF30AidXXZzmypTa/f6AtjHy/Ztxg7B4f4uBb aGCliNcjF2ee5rKK8ECBrdr19SFto9RqyPXIE2JQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Filipe Manana , David Sterba Subject: [PATCH 4.9 60/66] btrfs: always log symlinks in full mode Date: Tue, 10 May 2022 15:07:50 +0200 Message-Id: <20220510130731.524148331@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Filipe Manana commit d0e64a981fd841cb0f28fcd6afcac55e6f1e6994 upstream. On Linux, empty symlinks are invalid, and attempting to create one with the system call symlink(2) results in an -ENOENT error and this is explicitly documented in the man page. If we rename a symlink that was created in the current transaction and its parent directory was logged before, we actually end up logging the symlink without logging its content, which is stored in an inline extent. That means that after a power failure we can end up with an empty symlink, having no content and an i_size of 0 bytes. It can be easily reproduced like this: $ mkfs.btrfs -f /dev/sdc $ mount /dev/sdc /mnt $ mkdir /mnt/testdir $ sync # Create a file inside the directory and fsync the directory. $ touch /mnt/testdir/foo $ xfs_io -c "fsync" /mnt/testdir # Create a symlink inside the directory and then rename the symlink. $ ln -s /mnt/testdir/foo /mnt/testdir/bar $ mv /mnt/testdir/bar /mnt/testdir/baz # Now fsync again the directory, this persist the log tree. $ xfs_io -c "fsync" /mnt/testdir $ mount /dev/sdc /mnt $ stat -c %s /mnt/testdir/baz 0 $ readlink /mnt/testdir/baz $ Fix this by always logging symlinks in full mode (LOG_INODE_ALL), so that their content is also logged. A test case for fstests will follow. CC: stable@vger.kernel.org # 4.9+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- fs/btrfs/tree-log.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -4697,6 +4697,18 @@ static int btrfs_log_inode(struct btrfs_ } =20 /* + * For symlinks, we must always log their content, which is stored in an + * inline extent, otherwise we could end up with an empty symlink after + * log replay, which is invalid on linux (symlink(2) returns -ENOENT if + * one attempts to create an empty symlink). + * We don't need to worry about flushing delalloc, because when we create + * the inline extent when the symlink is created (we never have delalloc + * for symlinks). + */ + if (S_ISLNK(inode->i_mode)) + inode_only =3D LOG_INODE_ALL; + + /* * a brute force approach to making sure we get the most uptodate * copies of everything. */ @@ -5271,7 +5283,7 @@ process_leaf: } =20 ctx->log_new_dentries =3D false; - if (type =3D=3D BTRFS_FT_DIR || type =3D=3D BTRFS_FT_SYMLINK) + if (type =3D=3D BTRFS_FT_DIR) log_mode =3D LOG_INODE_ALL; ret =3D btrfs_log_inode(trans, root, di_inode, log_mode, 0, LLONG_MAX, ctx); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CFCA8C41535 for ; Tue, 10 May 2022 13:20:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242754AbiEJNWd (ORCPT ); Tue, 10 May 2022 09:22:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38456 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242496AbiEJNTT (ORCPT ); Tue, 10 May 2022 09:19:19 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 64CED1632BB; Tue, 10 May 2022 06:13:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EEB79B81D0D; Tue, 10 May 2022 13:13:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 42BEAC385C2; Tue, 10 May 2022 13:13:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188402; bh=6e5cb8PZEn39YQelbfgGkF0/G87zXk7lkw+ex3L/OaQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SfjKX7ousydiV5Jhvbg3JzxXIWOddY4+TBjzR2+6abMs/m+OCtYSGD6R3AOrm2+tu 4O/NmyhhV8+D6N4J8gMNR+sht5JUFwlEiPwziPY8K9Qje72eN2fvv8cR+P5BUByVOT CYn1k4NojbyrGGWKFv/e60tw9SHHACKrHkNYys2w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , Flavio Leitner , "David S. Miller" Subject: [PATCH 4.9 61/66] net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() Date: Tue, 10 May 2022 15:07:51 +0200 Message-Id: <20220510130731.554960140@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit dba5bdd57bea587ea4f0b79b03c71135f84a7e8b upstream. syzbot reported an UAF in ip_mc_sf_allow() [1] Whenever RCU protected list replaces an object, the pointer to the new object needs to be updated _before_ the call to kfree_rcu() or call_rcu() Because kfree_rcu(ptr, rcu) got support for NULL ptr only recently in commit 12edff045bc6 ("rcu: Make kfree_rcu() ignore NULL pointers"), I chose to use the conditional to make sure stable backports won't miss this detail. if (psl) kfree_rcu(psl, rcu); net/ipv6/mcast.c has similar issues, addressed in a separate patch. [1] BUG: KASAN: use-after-free in ip_mc_sf_allow+0x6bb/0x6d0 net/ipv4/igmp.c:26= 55 Read of size 4 at addr ffff88807d37b904 by task syz-executor.5/908 CPU: 0 PID: 908 Comm: syz-executor.5 Not tainted 5.18.0-rc4-syzkaller-00064= -g8f4dd16603ce #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 ip_mc_sf_allow+0x6bb/0x6d0 net/ipv4/igmp.c:2655 raw_v4_input net/ipv4/raw.c:190 [inline] raw_local_deliver+0x4d1/0xbe0 net/ipv4/raw.c:218 ip_protocol_deliver_rcu+0xcf/0xb30 net/ipv4/ip_input.c:193 ip_local_deliver_finish+0x2ee/0x4c0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_local_deliver+0x1b3/0x200 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish+0x1cb/0x2f0 net/ipv4/ip_input.c:437 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_rcv+0xaa/0xd0 net/ipv4/ip_input.c:556 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519 netif_receive_skb_internal net/core/dev.c:5605 [inline] netif_receive_skb+0x13e/0x8e0 net/core/dev.c:5664 tun_rx_batched.isra.0+0x460/0x720 drivers/net/tun.c:1534 tun_get_user+0x28b7/0x3e30 drivers/net/tun.c:1985 tun_chr_write_iter+0xdb/0x200 drivers/net/tun.c:2015 call_write_iter include/linux/fs.h:2050 [inline] new_sync_write+0x38a/0x560 fs/read_write.c:504 vfs_write+0x7c0/0xac0 fs/read_write.c:591 ksys_write+0x127/0x250 fs/read_write.c:644 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f3f12c3bbff Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 = 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff f= f 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 RSP: 002b:00007f3f13ea9130 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3f12d9bf60 RCX: 00007f3f12c3bbff RDX: 0000000000000036 RSI: 0000000020002ac0 RDI: 00000000000000c8 RBP: 00007f3f12ce308d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000036 R11: 0000000000000293 R12: 0000000000000000 R13: 00007fffb68dd79f R14: 00007f3f13ea9300 R15: 0000000000022000 Allocated by task 908: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524 kasan_kmalloc include/linux/kasan.h:234 [inline] __do_kmalloc mm/slab.c:3710 [inline] __kmalloc+0x209/0x4d0 mm/slab.c:3719 kmalloc include/linux/slab.h:586 [inline] sock_kmalloc net/core/sock.c:2501 [inline] sock_kmalloc+0xb5/0x100 net/core/sock.c:2492 ip_mc_source+0xba2/0x1100 net/ipv4/igmp.c:2392 do_ip_setsockopt net/ipv4/ip_sockglue.c:1296 [inline] ip_setsockopt+0x2312/0x3ab0 net/ipv4/ip_sockglue.c:1432 raw_setsockopt+0x274/0x2c0 net/ipv4/raw.c:861 __sys_setsockopt+0x2db/0x6a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 753: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x13d/0x180 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:200 [inline] __cache_free mm/slab.c:3439 [inline] kmem_cache_free_bulk+0x69/0x460 mm/slab.c:3774 kfree_bulk include/linux/slab.h:437 [inline] kfree_rcu_work+0x51c/0xa10 kernel/rcu/tree.c:3318 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348 kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3595 ip_mc_msfilter+0x712/0xb60 net/ipv4/igmp.c:2510 do_ip_setsockopt net/ipv4/ip_sockglue.c:1257 [inline] ip_setsockopt+0x32e1/0x3ab0 net/ipv4/ip_sockglue.c:1432 raw_setsockopt+0x274/0x2c0 net/ipv4/raw.c:861 __sys_setsockopt+0x2db/0x6a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348 call_rcu+0x99/0x790 kernel/rcu/tree.c:3074 mpls_dev_notify+0x552/0x8a0 net/mpls/af_mpls.c:1656 notifier_call_chain+0xb5/0x200 kernel/notifier.c:84 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1938 call_netdevice_notifiers_extack net/core/dev.c:1976 [inline] call_netdevice_notifiers net/core/dev.c:1990 [inline] unregister_netdevice_many+0x92e/0x1890 net/core/dev.c:10751 default_device_exit_batch+0x449/0x590 net/core/dev.c:11245 ops_exit_list+0x125/0x170 net/core/net_namespace.c:167 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff88807d37b900 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 4 bytes inside of 64-byte region [ffff88807d37b900, ffff88807d37b940) The buggy address belongs to the physical page: page:ffffea0001f4dec0 refcount:1 mapcount:0 mapping:0000000000000000 index:= 0xffff88807d37b180 pfn:0x7d37b flags: 0xfff00000000200(slab|node=3D0|zone=3D1|lastcpupid=3D0x7ff) raw: 00fff00000000200 ffff888010c41340 ffffea0001c795c8 ffff888010c40200 raw: ffff88807d37b180 ffff88807d37b000 000000010000001f 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x342040(_= _GFP_IO|__GFP_NOWARN|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 2963, t= gid 2963 (udevd), ts 139732238007, free_ts 139730893262 prep_new_page mm/page_alloc.c:2441 [inline] get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408 __alloc_pages_node include/linux/gfp.h:587 [inline] kmem_getpages mm/slab.c:1378 [inline] cache_grow_begin+0x75/0x350 mm/slab.c:2584 cache_alloc_refill+0x27f/0x380 mm/slab.c:2957 ____cache_alloc mm/slab.c:3040 [inline] ____cache_alloc mm/slab.c:3023 [inline] __do_cache_alloc mm/slab.c:3267 [inline] slab_alloc mm/slab.c:3309 [inline] __do_kmalloc mm/slab.c:3708 [inline] __kmalloc+0x3b3/0x4d0 mm/slab.c:3719 kmalloc include/linux/slab.h:586 [inline] kzalloc include/linux/slab.h:714 [inline] tomoyo_encode2.part.0+0xe9/0x3a0 security/tomoyo/realpath.c:45 tomoyo_encode2 security/tomoyo/realpath.c:31 [inline] tomoyo_encode+0x28/0x50 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x186/0x620 security/tomoyo/realpath.c:288 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_perm+0x21b/0x400 security/tomoyo/file.c:822 security_inode_getattr+0xcf/0x140 security/security.c:1350 vfs_getattr fs/stat.c:157 [inline] vfs_statx+0x16a/0x390 fs/stat.c:232 vfs_fstatat+0x8c/0xb0 fs/stat.c:255 __do_sys_newfstatat+0x91/0x110 fs/stat.c:425 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1356 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1406 free_unref_page_prepare mm/page_alloc.c:3328 [inline] free_unref_page+0x19/0x6a0 mm/page_alloc.c:3423 __vunmap+0x85d/0xd30 mm/vmalloc.c:2667 __vfree+0x3c/0xd0 mm/vmalloc.c:2715 vfree+0x5a/0x90 mm/vmalloc.c:2746 __do_replace+0x16b/0x890 net/ipv6/netfilter/ip6_tables.c:1117 do_replace net/ipv6/netfilter/ip6_tables.c:1157 [inline] do_ip6t_set_ctl+0x90d/0xb90 net/ipv6/netfilter/ip6_tables.c:1639 nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1026 tcp_setsockopt+0x136/0x2520 net/ipv4/tcp.c:3696 __sys_setsockopt+0x2db/0x6a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff88807d37b800: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc ffff88807d37b880: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff88807d37b900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88807d37b980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88807d37ba00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc Fixes: c85bb41e9318 ("igmp: fix ip_mc_sf_allow race [v5]") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Flavio Leitner Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/ipv4/igmp.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -2360,9 +2360,10 @@ int ip_mc_source(int add, int omode, str newpsl->sl_addr[i] =3D psl->sl_addr[i]; /* decrease mem now to avoid the memleak warning */ atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc); - kfree_rcu(psl, rcu); } rcu_assign_pointer(pmc->sflist, newpsl); + if (psl) + kfree_rcu(psl, rcu); psl =3D newpsl; } rv =3D 1; /* > 0 for insert logic below if sl_count is 0 */ @@ -2460,11 +2461,13 @@ int ip_mc_msfilter(struct sock *sk, stru psl->sl_count, psl->sl_addr, 0); /* decrease mem now to avoid the memleak warning */ atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc); - kfree_rcu(psl, rcu); - } else + } else { (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode, 0, NULL, 0); + } rcu_assign_pointer(pmc->sflist, newpsl); + if (psl) + kfree_rcu(psl, rcu); pmc->sfmode =3D msf->imsf_fmode; err =3D 0; done: From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33A54C352A7 for ; Tue, 10 May 2022 13:20:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242844AbiEJNWj (ORCPT ); Tue, 10 May 2022 09:22:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38496 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242610AbiEJNTV (ORCPT ); Tue, 10 May 2022 09:19:21 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8CC2C16D5C4; Tue, 10 May 2022 06:13:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 20709615DD; Tue, 10 May 2022 13:13:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2EF19C385A6; Tue, 10 May 2022 13:13:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188405; bh=Fq+uiXNrrJncXpaGY9VAdua8hHlsJPbzUlEDpb2IISQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KERhoIAg0Y49RkSq4jp/n/UjbhM+2L77xvWtkI8UYSLVjFaUgGpfx5z3M267qdlX8 h9LTOGff9gR8tm2SH81Lfv6TzRZtFnxqOg/ZH/nDIQDpNLuZWSPAQ7NiAW9mJAqnnH Ekd+MFRhGsUihE2RhpG6Ga9gGGiiePyVi0dOMLqI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vasant Hegde , Sandipan Das , Paolo Bonzini , Sasha Levin Subject: [PATCH 4.9 62/66] kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU Date: Tue, 10 May 2022 15:07:52 +0200 Message-Id: <20220510130731.583338857@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sandipan Das [ Upstream commit 5a1bde46f98b893cda6122b00e94c0c40a6ead3c ] On some x86 processors, CPUID leaf 0xA provides information on Architectural Performance Monitoring features. It advertises a PMU version which Qemu uses to determine the availability of additional MSRs to manage the PMCs. Upon receiving a KVM_GET_SUPPORTED_CPUID ioctl request for the same, the kernel constructs return values based on the x86_pmu_capability irrespective of the vendor. This leaf and the additional MSRs are not supported on AMD and Hygon processors. If AMD PerfMonV2 is detected, the PMU version is set to 2 and guest startup breaks because of an attempt to access a non-existent MSR. Return zeros to avoid this. Fixes: a6c06ed1a60a ("KVM: Expose the architectural performance monitoring = CPUID leaf") Reported-by: Vasant Hegde Signed-off-by: Sandipan Das Message-Id: <3fef83d9c2b2f7516e8ff50d60851f29a4bcb716.1651058600.git.sandip= an.das@amd.com> Signed-off-by: Paolo Bonzini Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/x86/kvm/cpuid.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index a6f8600672d7..c068027ac55f 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -502,6 +502,11 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entr= y2 *entry, u32 function, union cpuid10_eax eax; union cpuid10_edx edx; =20 + if (!static_cpu_has(X86_FEATURE_ARCH_PERFMON)) { + entry->eax =3D entry->ebx =3D entry->ecx =3D entry->edx =3D 0; + break; + } + perf_get_x86_pmu_capability(&cap); =20 /* --=20 2.35.1 From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4CE1C41535 for ; Tue, 10 May 2022 13:28:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243686AbiEJNcB (ORCPT ); Tue, 10 May 2022 09:32:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38464 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242701AbiEJNUk (ORCPT ); Tue, 10 May 2022 09:20:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C83042B94CF; Tue, 10 May 2022 06:13:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EFF7BB81D0D; Tue, 10 May 2022 13:13:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6241CC385C2; Tue, 10 May 2022 13:13:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188411; bh=1MpbEk9aUP9EbkLor1Hxs1N3aNJR5oZ48rXD3vovWNg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ty/qleBJ7MMnEmC/ApSJd7x0xFZ+fuOZZ7xFaKPzfyBW5C5TyRjLhfgIVJKEyf16G kLISuTWIZqFNfJ5SrMuqVcJ1zhvw2pc6cqvB+BL00O4e9RKIZJZO3XY/GxPdMg7bAQ XR4ak3t3Ii9MJR3+alhYTa0mQf/Jlwu+YoQz3IiM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Thadeu Lima de Souza Cascardo Subject: [PATCH 4.9 63/66] net: sched: prevent UAF on tc_ctl_tfilter when temporarily dropping rtnl_lock Date: Tue, 10 May 2022 15:07:53 +0200 Message-Id: <20220510130731.612169691@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thadeu Lima de Souza Cascardo When dropping the rtnl_lock for looking up for a module, the device may be removed, releasing the qdisc and class memory. Right after trying to load the module, cl_ops->put is called, leading to a potential use-after-free. Though commit e368fdb61d8e ("net: sched: use Qdisc rcu API instead of relying on rtnl lock") fixes this, it involves a lot of refactoring of the net/sched/ code, complicating its backport. This fix calls cl_ops->put before dropping rtnl_lock as it will be called either way, and zeroes it out so it won't be called again on the exit path. This has been shown to stop the following KASAN report with the reproducer: [ 256.609111] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 256.609585] BUG: KASAN: use-after-free in cbq_put+0x20/0xd0 at addr ffff= 880021daaba0 [ 256.610078] Read of size 4 by task total_cbq/11184 [ 256.610380] CPU: 0 PID: 11184 Comm: total_cbq Not tainted 4.9.311 #78 [ 256.610778] ffff8800215875a8 ffffffff96e18735 ffff880024803080 ffff8800= 21daaa80 [ 256.611274] ffff8800215875d0 ffffffff96334841 ffffed00043b5574 ffffed00= 043b5574 [ 256.611768] ffff880024803080 ffff880021587658 ffffffff96334af8 00000000= 00000000 [ 256.612186] Call Trace: [ 256.612344] [] dump_stack+0x6d/0x8b [ 256.612632] [] kasan_object_err+0x21/0x70 [ 256.612973] [] kasan_report.part.1+0x218/0x4f0 [ 256.613349] [] ? cbq_put+0x20/0xd0 [ 256.613634] [] ? kasan_unpoison_shadow+0x36/0x50 [ 256.613993] [] kasan_report+0x25/0x30 [ 256.614288] [] __asan_load4+0x61/0x80 [ 256.614580] [] cbq_put+0x20/0xd0 [ 256.614862] [] tc_ctl_tfilter+0x4f4/0xb80 [ 256.615151] [] ? tfilter_notify+0x140/0x140 [ 256.615478] [] ? do_syscall_64+0xef/0x190 [ 256.615799] [] ? entry_SYSCALL_64_after_swapgs+0x58/0= xc6 [ 256.616190] [] ? sock_sendmsg+0x76/0x80 [ 256.616484] [] ? sock_write_iter+0x13f/0x1f0 [ 256.616833] [] ? __vfs_write+0x262/0x3c0 [ 256.617152] [] ? vfs_write+0xf9/0x260 [ 256.617451] [] ? SyS_write+0xc9/0x1b0 [ 256.617754] [] ? ns_capable_common+0x5a/0xa0 [ 256.618067] [] ? ns_capable+0x13/0x20 [ 256.618334] [] ? __netlink_ns_capable+0x6d/0x80 [ 256.618666] [] rtnetlink_rcv_msg+0x1af/0x410 [ 256.618969] [] ? netlink_compare+0x5b/0x70 [ 256.619295] [] ? rtnl_newlink+0xc60/0xc60 [ 256.619587] [] ? __netlink_lookup+0x1a4/0x240 [ 256.619885] [] ? netlink_broadcast+0x20/0x20 [ 256.620179] [] netlink_rcv_skb+0x155/0x190 [ 256.620463] [] ? rtnl_newlink+0xc60/0xc60 [ 256.620748] [] rtnetlink_rcv+0x28/0x30 [ 256.621015] [] netlink_unicast+0x2f1/0x3b0 [ 256.621354] [] ? netlink_attachskb+0x340/0x340 [ 256.621765] [] netlink_sendmsg+0x56e/0x6f0 [ 256.622181] [] ? netlink_unicast+0x3b0/0x3b0 [ 256.622578] [] ? netlink_unicast+0x3b0/0x3b0 [ 256.622893] [] sock_sendmsg+0x76/0x80 [ 256.623157] [] sock_write_iter+0x13f/0x1f0 [ 256.623440] [] ? sock_sendmsg+0x80/0x80 [ 256.623729] [] ? iov_iter_init+0x82/0xc0 [ 256.624006] [] __vfs_write+0x262/0x3c0 [ 256.624274] [] ? default_llseek+0x120/0x120 [ 256.624566] [] ? common_file_perm+0x92/0x170 [ 256.624925] [] ? rw_verify_area+0x78/0x140 [ 256.625277] [] vfs_write+0xf9/0x260 [ 256.625593] [] SyS_write+0xc9/0x1b0 [ 256.625891] [] ? SyS_read+0x1b0/0x1b0 [ 256.626154] [] ? SyS_read+0x1b0/0x1b0 [ 256.626422] [] do_syscall_64+0xef/0x190 [ 256.626697] [] entry_SYSCALL_64_after_swapgs+0x58/0xc6 [ 256.627033] Object at ffff880021daaa80, in cache kmalloc-512 size: 512 [ 256.627415] Allocated: [ 256.627563] PID =3D 164 [ 256.627711] save_stack_trace+0x1b/0x20 [ 256.627947] save_stack+0x46/0xd0 [ 256.628151] kasan_kmalloc+0xad/0xe0 [ 256.628362] kmem_cache_alloc_trace+0xe8/0x1e0 [ 256.628637] cbq_change_class+0x8b6/0xde0 [ 256.628896] tc_ctl_tclass+0x56a/0x5b0 [ 256.629129] rtnetlink_rcv_msg+0x1af/0x410 [ 256.629380] netlink_rcv_skb+0x155/0x190 [ 256.629621] rtnetlink_rcv+0x28/0x30 [ 256.629840] netlink_unicast+0x2f1/0x3b0 [ 256.630066] netlink_sendmsg+0x56e/0x6f0 [ 256.630263] sock_sendmsg+0x76/0x80 [ 256.630456] sock_write_iter+0x13f/0x1f0 [ 256.630698] __vfs_write+0x262/0x3c0 [ 256.630918] vfs_write+0xf9/0x260 [ 256.631123] SyS_write+0xc9/0x1b0 [ 256.631327] do_syscall_64+0xef/0x190 [ 256.631553] entry_SYSCALL_64_after_swapgs+0x58/0xc6 [ 256.631827] Freed: [ 256.631931] PID =3D 164 [ 256.632048] save_stack_trace+0x1b/0x20 [ 256.632241] save_stack+0x46/0xd0 [ 256.632408] kasan_slab_free+0x71/0xb0 [ 256.632597] kfree+0x8c/0x1a0 [ 256.632751] cbq_destroy_class+0x85/0xa0 [ 256.632948] cbq_destroy+0xfa/0x120 [ 256.633125] qdisc_destroy+0xa1/0x140 [ 256.633309] dev_shutdown+0x12d/0x190 [ 256.633497] rollback_registered_many+0x43c/0x5b0 [ 256.633753] unregister_netdevice_many+0x2c/0x130 [ 256.634041] rtnl_delete_link+0xb3/0x100 [ 256.634283] rtnl_dellink+0x19c/0x360 [ 256.634509] rtnetlink_rcv_msg+0x1af/0x410 [ 256.634760] netlink_rcv_skb+0x155/0x190 [ 256.635001] rtnetlink_rcv+0x28/0x30 [ 256.635221] netlink_unicast+0x2f1/0x3b0 [ 256.635463] netlink_sendmsg+0x56e/0x6f0 [ 256.635700] sock_sendmsg+0x76/0x80 [ 256.635915] sock_write_iter+0x13f/0x1f0 [ 256.636156] __vfs_write+0x262/0x3c0 [ 256.636376] vfs_write+0xf9/0x260 [ 256.636580] SyS_write+0xc9/0x1b0 [ 256.636787] do_syscall_64+0xef/0x190 [ 256.637013] entry_SYSCALL_64_after_swapgs+0x58/0xc6 [ 256.637316] Memory state around the buggy address: [ 256.637610] ffff880021daaa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb= fb fb [ 256.638047] ffff880021daab00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb= fb fb [ 256.638487] >ffff880021daab80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb= fb fb [ 256.638924] ^ [ 256.639186] ffff880021daac00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb= fb fb [ 256.639624] ffff880021daac80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc= fc fc Signed-off-by: Thadeu Lima de Souza Cascardo Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/sched/cls_api.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -268,10 +268,13 @@ replay: err =3D -ENOENT; tp_ops =3D tcf_proto_lookup_ops(tca[TCA_KIND]); if (tp_ops =3D=3D NULL) { -#ifdef CONFIG_MODULES struct nlattr *kind =3D tca[TCA_KIND]; char name[IFNAMSIZ]; =20 + if (cl) + cops->put(q, cl); + cl =3D 0; +#ifdef CONFIG_MODULES if (kind !=3D NULL && nla_strlcpy(name, kind, IFNAMSIZ) < IFNAMSIZ) { rtnl_unlock(); From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C19DDC433EF for ; Tue, 10 May 2022 13:28:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243743AbiEJNcM (ORCPT ); Tue, 10 May 2022 09:32:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38458 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242537AbiEJNUk (ORCPT ); Tue, 10 May 2022 09:20:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 817C02B94DD; Tue, 10 May 2022 06:13:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3C89AB81DA2; Tue, 10 May 2022 13:13:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 86086C385C2; Tue, 10 May 2022 13:13:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188415; bh=a7Xdftnirl6+Yv0iDfdH+DVaKQCBSHUCUNchi72cbcw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zGj1bxOCJV1qKKzuBMykOFgUcP9l8aeS5nPfXTmzW3cFzrVGOdzvsOOmAe7ZO73al dPD4tIxQdXXKnfxMr6x7jsBwr8ts3oeyiNS8QoI8JBp8QDpJHlXSDlWl+WcirBIMmP oxJL2Y4RnQBV+b3vPgI6YGdbDCqc2EHC8xj5uKsY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johannes Nixdorf , "David S. Miller" Subject: [PATCH 4.9 64/66] net: ipv6: ensure we call ipv6_mc_down() at most once Date: Tue, 10 May 2022 15:07:54 +0200 Message-Id: <20220510130731.641665189@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: j.nixdorf@avm.de commit 9995b408f17ff8c7f11bc725c8aa225ba3a63b1c upstream. There are two reasons for addrconf_notify() to be called with NETDEV_DOWN: either the network device is actually going down, or IPv6 was disabled on the interface. If either of them stays down while the other is toggled, we repeatedly call the code for NETDEV_DOWN, including ipv6_mc_down(), while never calling the corresponding ipv6_mc_up() in between. This will cause a new entry in idev->mc_tomb to be allocated for each multicast group the interface is subscribed to, which in turn leaks one struct ifmcaddr6 per nontrivial multicast group the interface is subscribed to. The following reproducer will leak at least $n objects: ip addr add ff2e::4242/32 dev eth0 autojoin sysctl -w net.ipv6.conf.eth0.disable_ipv6=3D1 for i in $(seq 1 $n); do ip link set up eth0; ip link set down eth0 done Joining groups with IPV6_ADD_MEMBERSHIP (unprivileged) or setting the sysctl net.ipv6.conf.eth0.forwarding to 1 (=3D> subscribing to ff02::2) can also be used to create a nontrivial idev->mc_list, which will the leak objects with the right up-down-sequence. Based on both sources for NETDEV_DOWN events the interface IPv6 state should be considered: - not ready if the network interface is not ready OR IPv6 is disabled for it - ready if the network interface is ready AND IPv6 is enabled for it The functions ipv6_mc_up() and ipv6_down() should only be run when this state changes. Implement this by remembering when the IPv6 state is ready, and only run ipv6_mc_down() if it actually changed from ready to not ready. The other direction (not ready -> ready) already works correctly, as: - the interface notification triggered codepath for NETDEV_UP / NETDEV_CHANGE returns early if ipv6 is disabled, and - the disable_ipv6=3D0 triggered codepath skips fully initializing the interface as long as addrconf_link_ready(dev) returns false - calling ipv6_mc_up() repeatedly does not leak anything Fixes: 3ce62a84d53c ("ipv6: exit early in addrconf_notify() if IPv6 is disa= bled") Signed-off-by: Johannes Nixdorf Signed-off-by: David S. Miller [jnixdorf: context updated for bpo to v4.9/v4.14] Signed-off-by: Johannes Nixdorf Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/ipv6/addrconf.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -3539,6 +3539,7 @@ static int addrconf_ifdown(struct net_de struct list_head del_list; int _keep_addr; bool keep_addr; + bool was_ready; int state, i; =20 ASSERT_RTNL(); @@ -3602,7 +3603,10 @@ restart: =20 addrconf_del_rs_timer(idev); =20 - /* Step 2: clear flags for stateless addrconf */ + /* Step 2: clear flags for stateless addrconf, repeated down + * detection + */ + was_ready =3D idev->if_flags & IF_READY; if (!how) idev->if_flags &=3D ~(IF_RS_SENT|IF_RA_RCVD|IF_READY); =20 @@ -3689,7 +3693,7 @@ restart: if (how) { ipv6_ac_destroy_dev(idev); ipv6_mc_destroy_dev(idev); - } else { + } else if (was_ready) { ipv6_mc_down(idev); } From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9302EC4167B for ; Tue, 10 May 2022 13:28:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243652AbiEJNby (ORCPT ); Tue, 10 May 2022 09:31:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45564 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242707AbiEJNUl (ORCPT ); Tue, 10 May 2022 09:20:41 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8332E2B94ED; Tue, 10 May 2022 06:13:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8318E615DD; Tue, 10 May 2022 13:13:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8EA7CC385A6; Tue, 10 May 2022 13:13:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188418; bh=M8IicdsUnZg8vfnppCcQYQR4NgT/lEnuhCttCqnkMSs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AoeAX0PVYBWrPwqpmS/iNSm8mB/huDkdHUFWkW1B9ClizDEIVKrvN2JkV6dcr7hAR CoKuBWjfkSDuBL0gTJW1p71xApN+yGbjQ/HG+s1bTMM6zgnreCx+FvX/Dsrjcyn+XA zD3wQI0JV6ERc2NudgqDcg3aMDrhQt0nrJ0Cv27c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiazi Li , Mike Snitzer , Mikulas Patocka , Mike Snitzer Subject: [PATCH 4.9 65/66] dm: fix mempool NULL pointer race when completing IO Date: Tue, 10 May 2022 15:07:55 +0200 Message-Id: <20220510130731.673926877@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiazi Li commit d208b89401e073de986dc891037c5a668f5d5d95 upstream. dm_io_dec_pending() calls end_io_acct() first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to mempool->elements being NULL: task1 task2 do_resume ->do_suspend ->dm_wait_for_completion bio_endio ->clone_endio ->dm_io_dec_pending ->end_io_acct ->wakeup task1 ->dm_swap_table ->__bind ->__bind_mempools ->bioset_exit ->mempool_exit ->free_io [ 67.330330] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ...... [ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO) [ 67.330510] pc : mempool_free+0x70/0xa0 [ 67.330515] lr : mempool_free+0x4c/0xa0 [ 67.330520] sp : ffffff8008013b20 [ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004 [ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] x15: 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 0000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000 [ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a [ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001 [ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8 [ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970 [ 67.330609] Call trace: [ 67.330616] mempool_free+0x70/0xa0 [ 67.330627] bio_put+0xf8/0x110 [ 67.330638] dec_pending+0x13c/0x230 [ 67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.330716] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq+0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] cpuidle_enter_state+0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4/0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] secondary_start_kernel+0x160/0x170 Fix this by: 1) Establishing pointers to 'struct dm_io' members in dm_io_dec_pending() so that they may be passed into end_io_acct() _after_ free_io() is called. 2) Moving end_io_acct() after free_io(). Cc: stable@vger.kernel.org Signed-off-by: Jiazi Li Signed-off-by: Mike Snitzer Signed-off-by: Mikulas Patocka Reviewed-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/md/dm.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -524,20 +524,19 @@ static void start_io_acct(struct dm_io * false, 0, &io->stats_aux); } =20 -static void end_io_acct(struct dm_io *io) +static void end_io_acct(struct mapped_device *md, struct bio *bio, + unsigned long start_time, struct dm_stats_aux *stats_aux) { - struct mapped_device *md =3D io->md; - struct bio *bio =3D io->bio; - unsigned long duration =3D jiffies - io->start_time; + unsigned long duration =3D jiffies - start_time; int pending; int rw =3D bio_data_dir(bio); =20 - generic_end_io_acct(rw, &dm_disk(md)->part0, io->start_time); + generic_end_io_acct(rw, &dm_disk(md)->part0, start_time); =20 if (unlikely(dm_stats_used(&md->stats))) dm_stats_account_io(&md->stats, bio_data_dir(bio), bio->bi_iter.bi_sector, bio_sectors(bio), - true, duration, &io->stats_aux); + true, duration, stats_aux); =20 /* * After this is decremented the bio must not be touched if it is @@ -768,6 +767,8 @@ static void dec_pending(struct dm_io *io int io_error; struct bio *bio; struct mapped_device *md =3D io->md; + unsigned long start_time =3D 0; + struct dm_stats_aux stats_aux; =20 /* Push-back supersedes any I/O errors */ if (unlikely(error)) { @@ -793,8 +794,10 @@ static void dec_pending(struct dm_io *io =20 io_error =3D io->error; bio =3D io->bio; - end_io_acct(io); + start_time =3D io->start_time; + stats_aux =3D io->stats_aux; free_io(md, io); + end_io_acct(md, bio, start_time, &stats_aux); =20 if (io_error =3D=3D DM_ENDIO_REQUEUE) return; From nobody Fri May 8 05:14:45 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7FBA1C35296 for ; Tue, 10 May 2022 13:19:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243073AbiEJNWy (ORCPT ); Tue, 10 May 2022 09:22:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46000 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242876AbiEJNVI (ORCPT ); Tue, 10 May 2022 09:21:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B8CB72BF30C; Tue, 10 May 2022 06:13:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BBC4D615FA; Tue, 10 May 2022 13:13:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C661CC385A6; Tue, 10 May 2022 13:13:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188438; bh=mUVSaLcs7LePPpfEVIoSnmJu+fY7to4k78o+0jb0k2M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=V6Mqgj+qX8krci74d+W4KQOu7m7SpEeq7oQHj7pr56VkedCi85sVpbb0D3dVfFhNy NrISkv7pScSEQneqrjfk/cBmIyK5eYtolS+VIZhV8THNTNexjyzFKlvM4t0rNv6447 evatSqMjmMx6uNL7kPe+kMg+p/CxDTfSZCCUWNuc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Mike Snitzer , Mike Snitzer Subject: [PATCH 4.9 66/66] dm: interlock pending dm_io and dm_wait_for_bios_completion Date: Tue, 10 May 2022 15:07:56 +0200 Message-Id: <20220510130731.702590252@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130729.762341544@linuxfoundation.org> References: <20220510130729.762341544@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Snitzer commit 9f6dc633761006f974701d4c88da71ab68670749 upstream. Commit d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") didn't go far enough. When bio_end_io_acct ends the count of in-flight I/Os may reach zero and the DM device may be suspended. There is a possibility that the suspend races with dm_stats_account_io. Fix this by adding percpu "pending_io" counters to track outstanding dm_io. Move kicking of suspend queue to dm_io_dec_pending(). Also, rename md_in_flight_bios() to dm_in_flight_bios() and update it to iterate all pending_io counters. Fixes: d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") Cc: stable@vger.kernel.org Co-developed-by: Mikulas Patocka Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Signed-off-by: Mikulas Patocka Reviewed-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/md/dm.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -2027,6 +2027,8 @@ static int dm_wait_for_completion(struct } finish_wait(&md->wait, &wait); =20 + smp_rmb(); /* paired with atomic_dec_return in end_io_acct */ + return r; }