From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9273C4332F for ; Tue, 10 May 2022 13:19:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242085AbiEJNXO (ORCPT ); Tue, 10 May 2022 09:23:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38464 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242885AbiEJNVI (ORCPT ); Tue, 10 May 2022 09:21:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EDC612BF334; Tue, 10 May 2022 06:14:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 540D0B81D7A; Tue, 10 May 2022 13:14:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 73938C385A6; Tue, 10 May 2022 13:14:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188441; bh=vO0VwaCoTDa7weooidthdtauAR9rqvT2UMZUDYlquVg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lgMWMkwvmK8LLIlvQTJlmkp/UEDdKSDjOIUyYMC26Td1eoXw/0zT1pPGL1gPqXMoC xwqi9lB9Il0beLG0CAbH/vRXG1ViZmO+k2wchb2gO2+w6fg1hwcMY+9TMVcJrMfujX 7lRjfD8a4dA5SiqQSphI1SETnDDWTZSf+Y+eteq8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Minh Yuan , syzbot+8e8958586909d62b6840@syzkaller.appspotmail.com, cruise k , Kyungtae Kim , Linus Torvalds , Denis Efremov , Willy Tarreau , Linus Torvalds Subject: [PATCH 4.14 01/78] floppy: disable FDRAWCMD by default Date: Tue, 10 May 2022 15:06:47 +0200 Message-Id: <20220510130732.569016999@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Willy Tarreau commit 233087ca063686964a53c829d547c7571e3f67bf upstream. Minh Yuan reported a concurrency use-after-free issue in the floppy code between raw_cmd_ioctl and seek_interrupt. [ It turns out this has been around, and that others have reported the KASAN splats over the years, but Minh Yuan had a reproducer for it and so gets primary credit for reporting it for this fix - Linus ] The problem is, this driver tends to break very easily and nowadays, nobody is expected to use FDRAWCMD anyway since it was used to manipulate non-standard formats. The risk of breaking the driver is higher than the risk presented by this race, and accessing the device requires privileges anyway. Let's just add a config option to completely disable this ioctl and leave it disabled by default. Distros shouldn't use it, and only those running on antique hardware might need to enable it. Link: https://lore.kernel.org/all/000000000000b71cdd05d703f6bf@google.com/ Link: https://lore.kernel.org/lkml/CAKcFiNC=3DMfYVW-Jt9A3=3DFPJpTwCD2PL_ULN= CpsCVE5s8ZeBQgQ@mail.gmail.com Link: https://lore.kernel.org/all/CAEAjamu1FRhz6StCe_55XY5s389ZP_xmCF69k987= En+1z53=3Deg@mail.gmail.com Reported-by: Minh Yuan Reported-by: syzbot+8e8958586909d62b6840@syzkaller.appspotmail.com Reported-by: cruise k Reported-by: Kyungtae Kim Suggested-by: Linus Torvalds Tested-by: Denis Efremov Signed-off-by: Willy Tarreau Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/block/Kconfig | 16 ++++++++++++++++ drivers/block/floppy.c | 43 ++++++++++++++++++++++++++++++++----------- 2 files changed, 48 insertions(+), 11 deletions(-) --- a/drivers/block/Kconfig +++ b/drivers/block/Kconfig @@ -35,6 +35,22 @@ config BLK_DEV_FD To compile this driver as a module, choose M here: the module will be called floppy. =20 +config BLK_DEV_FD_RAWCMD + bool "Support for raw floppy disk commands (DEPRECATED)" + depends on BLK_DEV_FD + help + If you want to use actual physical floppies and expect to do + special low-level hardware accesses to them (access and use + non-standard formats, for example), then enable this. + + Note that the code enabled by this option is rarely used and + might be unstable or insecure, and distros should not enable it. + + Note: FDRAWCMD is deprecated and will be removed from the kernel + in the near future. + + If unsure, say N. + config AMIGA_FLOPPY tristate "Amiga floppy support" depends on AMIGA --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -3018,6 +3018,8 @@ static const char *drive_name(int type, return "(null)"; } =20 +#ifdef CONFIG_BLK_DEV_FD_RAWCMD + /* raw commands */ static void raw_cmd_done(int flag) { @@ -3229,6 +3231,35 @@ static int raw_cmd_ioctl(int cmd, void _ return ret; } =20 +static int floppy_raw_cmd_ioctl(int type, int drive, int cmd, + void __user *param) +{ + int ret; + + pr_warn_once("Note: FDRAWCMD is deprecated and will be removed from the k= ernel in the near future.\n"); + + if (type) + return -EINVAL; + if (lock_fdc(drive)) + return -EINTR; + set_floppy(drive); + ret =3D raw_cmd_ioctl(cmd, param); + if (ret =3D=3D -EINTR) + return -EINTR; + process_fd_request(); + return ret; +} + +#else /* CONFIG_BLK_DEV_FD_RAWCMD */ + +static int floppy_raw_cmd_ioctl(int type, int drive, int cmd, + void __user *param) +{ + return -EOPNOTSUPP; +} + +#endif + static int invalidate_drive(struct block_device *bdev) { /* invalidate the buffer track to force a reread */ @@ -3416,7 +3447,6 @@ static int fd_locked_ioctl(struct block_ { int drive =3D (long)bdev->bd_disk->private_data; int type =3D ITYPE(UDRS->fd_device); - int i; int ret; int size; union inparam { @@ -3567,16 +3597,7 @@ static int fd_locked_ioctl(struct block_ outparam =3D UDRWE; break; case FDRAWCMD: - if (type) - return -EINVAL; - if (lock_fdc(drive)) - return -EINTR; - set_floppy(drive); - i =3D raw_cmd_ioctl(cmd, (void __user *)param); - if (i =3D=3D -EINTR) - return -EINTR; - process_fd_request(); - return i; + return floppy_raw_cmd_ioctl(type, drive, cmd, (void __user *)param); case FDTWADDLE: if (lock_fdc(drive)) return -EINTR; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25EEFC433F5 for ; Tue, 10 May 2022 13:20:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242016AbiEJNYO (ORCPT ); Tue, 10 May 2022 09:24:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38766 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243021AbiEJNVT (ORCPT ); Tue, 10 May 2022 09:21:19 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 857AE3968F; Tue, 10 May 2022 06:14:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 227A5B81D7A; Tue, 10 May 2022 13:14:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 89B75C36AE3; Tue, 10 May 2022 13:14:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188474; bh=c1/bfUy1hCg7H/0hj5x8AM49hoYla+If72E2RyUqP9c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m/CyT2yKrcy4bjegIV+Uo/tsyDYngF0GFa2xJ+rf4HCmtrktOhIuTZ5FB/6oNXxXz uVgNAOpiD9BpsMURgcyEwYzlNZ5YWYYZqsgR4t6lOcSLdyDMJaplRgSRqERNTLosFK Pu+NCbcbr9IEOnhNR9Xd7GNfFR+IWNW2mRYZTWyI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Ma , "David S. Miller" , Ovidiu Panait Subject: [PATCH 4.14 02/78] hamradio: defer 6pack kfree after unregister_netdev Date: Tue, 10 May 2022 15:06:48 +0200 Message-Id: <20220510130732.599308981@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lin Ma commit 0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 upstream. There is a possible race condition (use-after-free) like below (USE) | (FREE) dev_queue_xmit | __dev_queue_xmit | __dev_xmit_skb | sch_direct_xmit | ... xmit_one | netdev_start_xmit | tty_ldisc_kill __netdev_start_xmit | 6pack_close sp_xmit | kfree sp_encaps | | According to the patch "defer ax25 kfree after unregister_netdev", this patch reorder the kfree after the unregister_netdev to avoid the possible UAF as the unregister_netdev() is well synchronized and won't return if there is a running routine. Signed-off-by: Lin Ma Signed-off-by: David S. Miller Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/hamradio/6pack.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -690,9 +690,11 @@ static void sixpack_close(struct tty_str del_timer_sync(&sp->tx_t); del_timer_sync(&sp->resync_t); =20 - /* Free all 6pack frame buffers. */ + /* Free all 6pack frame buffers after unreg. */ kfree(sp->rbuff); kfree(sp->xbuff); + + free_netdev(sp->dev); } =20 /* Perform I/O control on an active 6pack channel. */ From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 308A0C433F5 for ; Tue, 10 May 2022 13:24:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232105AbiEJN2a (ORCPT ); Tue, 10 May 2022 09:28:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243203AbiEJNVj (ORCPT ); Tue, 10 May 2022 09:21:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1E0792C183F; Tue, 10 May 2022 06:15:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 725C2B81DAA; Tue, 10 May 2022 13:15:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E598FC385A6; Tue, 10 May 2022 13:15:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188507; bh=VtJerBDQCYbUCgpxXLdGU8t1nlWfii6eDosdmY9hF0w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F0mAqS3Zfdi0NS+57tmp/Q0jyInaDB6RGYUuVqrp2LMIz1SvBIXQ8mMedhHM2LajV 678Aw2yC1B/7sZlGdl1AegAO78Y9pz+NKDXYibSHHH39jcC77Yy4q2cDPXEygMJpZ2 Acjk3Zn63yMEH0xemsXLKDFsrdMkpx68Bw6c/kRA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Ma , Jakub Kicinski , Ovidiu Panait Subject: [PATCH 4.14 03/78] hamradio: remove needs_free_netdev to avoid UAF Date: Tue, 10 May 2022 15:06:49 +0200 Message-Id: <20220510130732.628205315@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lin Ma commit 81b1d548d00bcd028303c4f3150fa753b9b8aa71 upstream. The former patch "defer 6pack kfree after unregister_netdev" reorders the kfree of two buffer after the unregister_netdev to prevent the race condition. It also adds free_netdev() function in sixpack_close(), which is a direct copy from the similar code in mkiss_close(). However, in sixpack driver, the flag needs_free_netdev is set to true in sp_setup(), hence the unregister_netdev() will free the netdev automatically. Therefore, as the sp is netdev_priv, use-after-free occurs. This patch removes the needs_free_netdev =3D true and just let the free_netdev to finish this deallocation task. Fixes: 0b9111922b1f ("hamradio: defer 6pack kfree after unregister_netdev") Signed-off-by: Lin Ma Link: https://lore.kernel.org/r/20211111141402.7551-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/hamradio/6pack.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -311,7 +311,6 @@ static void sp_setup(struct net_device * { /* Finish setting up the DEVICE info. */ dev->netdev_ops =3D &sp_netdev_ops; - dev->needs_free_netdev =3D true; dev->mtu =3D SIXP_MTU; dev->hard_header_len =3D AX25_MAX_HEADER_LEN; dev->header_ops =3D &ax25_header_ops; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2ECB6C433EF for ; Tue, 10 May 2022 13:20:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242812AbiEJNYs (ORCPT ); Tue, 10 May 2022 09:24:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45984 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243232AbiEJNVk (ORCPT ); Tue, 10 May 2022 09:21:40 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 92F3C2C2572; Tue, 10 May 2022 06:15:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F3245615DD; Tue, 10 May 2022 13:15:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10232C385C2; Tue, 10 May 2022 13:15:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188516; bh=m2ASRB4GczbfdDdQ1RmKGS9fhnmfR0jNT5aBSJnnqzA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kSUEhTUxqzyRmCVubK72GxjxJ0d1kMnAKn3iK3Vy1Y0sbauYVUAiGruEKPlNRYHFp Siaq079YI6kGdcHPpHZt6d3eYF/wWnr2ZPsbG9oo39OtyUpKqNqddbAEJtf6EDVuxu Lm/TK531XfSlXR0z475UvJ2Gaz+rNLRZglfXmL60= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , Cong Wang , Jiri Pirko , Jamal Hadi Salim , Jakub Kicinski , Robert Kolchmeyer Subject: [PATCH 4.14 04/78] net/sched: cls_u32: fix netns refcount changes in u32_change() Date: Tue, 10 May 2022 15:06:50 +0200 Message-Id: <20220510130732.657790863@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 3db09e762dc79584a69c10d74a6b98f89a9979f8 upstream. We are now able to detect extra put_net() at the moment they happen, instead of much later in correct code paths. u32_init_knode() / tcf_exts_init() populates the ->exts.net pointer, but as mentioned in tcf_exts_init(), the refcount on netns has not been elevated yet. The refcount is taken only once tcf_exts_get_net() is called. So the two u32_destroy_key() calls from u32_change() are attempting to release an invalid reference on the netns. syzbot report: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 0 PID: 21708 at lib/refcount.c:31 refcount_warn_saturate+0xbf= /0x1e0 lib/refcount.c:31 Modules linked in: CPU: 0 PID: 21708 Comm: syz-executor.5 Not tainted 5.18.0-rc2-next-20220412= -syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 RIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31 Code: 1d 14 b6 b2 09 31 ff 89 de e8 6d e9 89 fd 84 db 75 e0 e8 84 e5 89 fd = 48 c7 c7 40 aa 26 8a c6 05 f4 b5 b2 09 01 e8 e5 81 2e 05 <0f> 0b eb c4 e8 6= 8 e5 89 fd 0f b6 1d e3 b5 b2 09 31 ff 89 de e8 38 RSP: 0018:ffffc900051af1b0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000040000 RSI: ffffffff8160a0c8 RDI: fffff52000a35e28 RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff81604a9e R11: 0000000000000000 R12: 1ffff92000a35e3b R13: 00000000ffffffef R14: ffff8880211a0194 R15: ffff8880577d0a00 FS: 00007f25d183e700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f19c859c028 CR3: 0000000051009000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __refcount_dec include/linux/refcount.h:344 [inline] refcount_dec include/linux/refcount.h:359 [inline] ref_tracker_free+0x535/0x6b0 lib/ref_tracker.c:118 netns_tracker_free include/net/net_namespace.h:327 [inline] put_net_track include/net/net_namespace.h:341 [inline] tcf_exts_put_net include/net/pkt_cls.h:255 [inline] u32_destroy_key.isra.0+0xa7/0x2b0 net/sched/cls_u32.c:394 u32_change+0xe01/0x3140 net/sched/cls_u32.c:909 tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148 rtnetlink_rcv_msg+0x80d/0xb80 net/core/rtnetlink.c:6016 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2495 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:725 ____sys_sendmsg+0x6e2/0x800 net/socket.c:2413 ___sys_sendmsg+0xf3/0x170 net/socket.c:2467 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2496 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f25d0689049 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f25d183e168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f25d079c030 RCX: 00007f25d0689049 RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000005 RBP: 00007f25d06e308d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd0b752e3f R14: 00007f25d183e300 R15: 0000000000022000 Fixes: 35c55fc156d8 ("cls_u32: use tcf_exts_get_net() before call_rcu()") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Cong Wang Cc: Jiri Pirko Acked-by: Jamal Hadi Salim Signed-off-by: Jakub Kicinski [rkolchmeyer: Backported to 4.14: adjusted u32_destroy_key() signature] Signed-off-by: Robert Kolchmeyer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sched/cls_u32.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -395,15 +395,20 @@ static int u32_init(struct tcf_proto *tp return 0; } =20 -static int u32_destroy_key(struct tcf_proto *tp, struct tc_u_knode *n, - bool free_pf) +static void __u32_destroy_key(struct tc_u_knode *n) { struct tc_u_hnode *ht =3D rtnl_dereference(n->ht_down); =20 tcf_exts_destroy(&n->exts); - tcf_exts_put_net(&n->exts); if (ht && --ht->refcnt =3D=3D 0) kfree(ht); + kfree(n); +} + +static void u32_destroy_key(struct tcf_proto *tp, struct tc_u_knode *n, + bool free_pf) +{ + tcf_exts_put_net(&n->exts); #ifdef CONFIG_CLS_U32_PERF if (free_pf) free_percpu(n->pf); @@ -412,8 +417,7 @@ static int u32_destroy_key(struct tcf_pr if (free_pf) free_percpu(n->pcpu_success); #endif - kfree(n); - return 0; + __u32_destroy_key(n); } =20 /* u32_delete_key_rcu should be called when free'ing a copied @@ -942,13 +946,13 @@ static int u32_change(struct net *net, s tca[TCA_RATE], ovr); =20 if (err) { - u32_destroy_key(tp, new, false); + __u32_destroy_key(new); return err; } =20 err =3D u32_replace_hw_knode(tp, new, flags); if (err) { - u32_destroy_key(tp, new, false); + __u32_destroy_key(new); return err; } From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD29BC4332F for ; Tue, 10 May 2022 13:24:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243124AbiEJNZ4 (ORCPT ); Tue, 10 May 2022 09:25:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60798 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243343AbiEJNVs (ORCPT ); Tue, 10 May 2022 09:21:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3C5E8369F7; Tue, 10 May 2022 06:15:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8072CB81CE7; Tue, 10 May 2022 13:15:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D7F96C385C6; Tue, 10 May 2022 13:15:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188519; bh=oc6DGHxk7tBm4fTtD+Nku+wgVy/bLOm9h6z8z3yKvNM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mD15IfMlaAXfSVfiVF0ONId0jwZEBAp+Fhdx68+ys1OTIG09dA804XaxaHbFAtuRW rvlplY2h9JQJB/tsNOsUJ1Wr14X1So2QqA7FZ1RoQGijYIuoYxgADVodUVlCWFya6m bu5FsT4JUXkZKIxTqfaPjFxm1rEwR8gVSipZrY/0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Machek , Dinh Nguyen , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 05/78] Revert "net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link" Date: Tue, 10 May 2022 15:06:51 +0200 Message-Id: <20220510130732.686866474@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" This reverts commit 75e105d068cb98e43a6bb6b196fc006da52f9ee5 which is commit a6aaa00324240967272b451bfa772547bd576ee6 upstream. Pavel reports that it causes boot issues, so revert it for now. Link: https://lore.kernel.org/r/20220429074341.GB1423@amd Reported-by: Pavel Machek Cc: Dinh Nguyen Cc: David S. Miller Cc: Sasha Levin Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c | 8 ++++++++ drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h | 4 ---- drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 13 ++++++++----- 3 files changed, 16 insertions(+), 9 deletions(-) --- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c +++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c @@ -68,6 +68,10 @@ #define TSE_PCS_USE_SGMII_ENA BIT(0) #define TSE_PCS_IF_USE_SGMII 0x03 =20 +#define SGMII_ADAPTER_CTRL_REG 0x00 +#define SGMII_ADAPTER_DISABLE 0x0001 +#define SGMII_ADAPTER_ENABLE 0x0000 + #define AUTONEGO_LINK_TIMER 20 =20 static int tse_pcs_reset(void __iomem *base, struct tse_pcs *pcs) @@ -211,8 +215,12 @@ void tse_pcs_fix_mac_speed(struct tse_pc unsigned int speed) { void __iomem *tse_pcs_base =3D pcs->tse_pcs_base; + void __iomem *sgmii_adapter_base =3D pcs->sgmii_adapter_base; u32 val; =20 + writew(SGMII_ADAPTER_ENABLE, + sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); + pcs->autoneg =3D phy_dev->autoneg; =20 if (phy_dev->autoneg =3D=3D AUTONEG_ENABLE) { --- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h +++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h @@ -21,10 +21,6 @@ #include #include =20 -#define SGMII_ADAPTER_CTRL_REG 0x00 -#define SGMII_ADAPTER_ENABLE 0x0000 -#define SGMII_ADAPTER_DISABLE 0x0001 - struct tse_pcs { struct device *dev; void __iomem *tse_pcs_base; --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c @@ -29,6 +29,9 @@ =20 #include "altr_tse_pcs.h" =20 +#define SGMII_ADAPTER_CTRL_REG 0x00 +#define SGMII_ADAPTER_DISABLE 0x0001 + #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII 0x0 #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RGMII 0x1 #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RMII 0x2 @@ -62,14 +65,16 @@ static void socfpga_dwmac_fix_mac_speed( { struct socfpga_dwmac *dwmac =3D (struct socfpga_dwmac *)priv; void __iomem *splitter_base =3D dwmac->splitter_base; + void __iomem *tse_pcs_base =3D dwmac->pcs.tse_pcs_base; void __iomem *sgmii_adapter_base =3D dwmac->pcs.sgmii_adapter_base; struct device *dev =3D dwmac->dev; struct net_device *ndev =3D dev_get_drvdata(dev); struct phy_device *phy_dev =3D ndev->phydev; u32 val; =20 - writew(SGMII_ADAPTER_DISABLE, - sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); + if ((tse_pcs_base) && (sgmii_adapter_base)) + writew(SGMII_ADAPTER_DISABLE, + sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); =20 if (splitter_base) { val =3D readl(splitter_base + EMAC_SPLITTER_CTRL_REG); @@ -91,9 +96,7 @@ static void socfpga_dwmac_fix_mac_speed( writel(val, splitter_base + EMAC_SPLITTER_CTRL_REG); } =20 - writew(SGMII_ADAPTER_ENABLE, - sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); - if (phy_dev) + if (tse_pcs_base && sgmii_adapter_base) tse_pcs_fix_mac_speed(&dwmac->pcs, phy_dev, speed); } From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88B49C388F3 for ; Tue, 10 May 2022 13:28:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243490AbiEJNbE (ORCPT ); Tue, 10 May 2022 09:31:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58078 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243270AbiEJNVo (ORCPT ); Tue, 10 May 2022 09:21:44 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 86C8B2C3354; Tue, 10 May 2022 06:15:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9C4CCB81DA5; Tue, 10 May 2022 13:15:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01974C385CE; Tue, 10 May 2022 13:15:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188522; bh=nbW0eEsimMVjlHNbmfDsIhmqa2VhhW8vzws7CUyZMzo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g+fwc+glpETUpm8GfsVDak4lWMdKQB24A0FIvN+Nj+Er5pR9CZB4QUSB1JVDWV8fj SfQzPYaszqRYylwHE41pto19gDrRYfgdgDFu6G1aTsifKPN5Vq21eHKMLiIFy2ZL09 WFelJzMTXoJzbMepQZouetuDxvkwGMwDAoNs1/Lk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoph Hellwig , =?UTF-8?q?Matias=20Bj=C3=B8rling?= , =?UTF-8?q?Javier=20Gonz=C3=A1lez?= , Jens Axboe Subject: [PATCH 4.14 06/78] lightnvm: disable the subsystem Date: Tue, 10 May 2022 15:06:52 +0200 Message-Id: <20220510130732.716003625@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In commit 9ea9b9c48387 ("remove the lightnvm subsystem") the lightnvm subsystem was removed as there is no hardware in the wild for it, and the code is known to have problems. This should also be disabled for older LTS kernels as well to prevent anyone from accidentally using it. Cc: Christoph Hellwig Cc: Matias Bj=C3=B8rling Cc: Javier Gonz=C3=A1lez Cc: Jens Axboe Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/lightnvm/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/lightnvm/Kconfig +++ b/drivers/lightnvm/Kconfig @@ -4,7 +4,7 @@ =20 menuconfig NVM bool "Open-Channel SSD target support" - depends on BLOCK && HAS_DMA + depends on BLOCK && HAS_DMA && BROKEN help Say Y here to get to enable Open-channel SSDs. =20 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 441C8C433FE for ; Tue, 10 May 2022 13:21:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242715AbiEJNZi (ORCPT ); Tue, 10 May 2022 09:25:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32804 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243397AbiEJNVv (ORCPT ); Tue, 10 May 2022 09:21:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 077D847ACE; Tue, 10 May 2022 06:15:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 07EB36165A; Tue, 10 May 2022 13:15:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0947DC385C6; Tue, 10 May 2022 13:15:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188525; bh=FZfg3tIgQzItUpFCdxmW/CBbwci+zbGsCQcD8ZzaOdI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LOpPWQfK0KuvpsV++Wl2i2knLyf5HpY28p4h/q0dHhQ/e7yxtZ2gth8QGPNIti/6E nW1eKuY6RpIfpAuzzCOA5GXTFaPpurD7V2o1dNpfqBvlPyBMNyBToJUlQrnOJNeuWN Yd46OlQAo/+nCGsIFcv/ckZY/kOUbejCLFOhePkI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Fabien Parent , Chunfeng Yun , Macpaul Lin , Tainping Fang Subject: [PATCH 4.14 07/78] usb: mtu3: fix USB 3.0 dual-role-switch from device to host Date: Tue, 10 May 2022 15:06:53 +0200 Message-Id: <20220510130732.745738342@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Macpaul Lin commit 456244aeecd54249096362a173dfe06b82a5cafa upstream. Issue description: When an OTG port has been switched to device role and then switch back to host role again, the USB 3.0 Host (XHCI) will not be able to detect "plug in event of a connected USB 2.0/1.0 ((Highspeed and Fullspeed) devices until system reboot. Root cause and Solution: There is a condition checking flag "ssusb->otg_switch.is_u3_drd" in toggle_opstate(). At the end of role switch procedure, toggle_opstate() will be called to set DC_SESSION and SOFT_CONN bit. If "is_u3_drd" was set and switched the role to USB host 3.0, bit DC_SESSION and SOFT_CONN will be skipped hence caused the port cannot detect connected USB 2.0 (Highspeed and Fullspeed) devices. Simply remove the condition check to solve this issue. Fixes: d0ed062a8b75 ("usb: mtu3: dual-role mode support") Cc: stable@vger.kernel.org Tested-by: Fabien Parent Reviewed-by: Chunfeng Yun Signed-off-by: Macpaul Lin Signed-off-by: Tainping Fang Link: https://lore.kernel.org/r/20220419081245.21015-1-macpaul.lin@mediatek= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/mtu3/mtu3_dr.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) --- a/drivers/usb/mtu3/mtu3_dr.c +++ b/drivers/usb/mtu3/mtu3_dr.c @@ -39,10 +39,8 @@ enum mtu3_vbus_id_state { =20 static void toggle_opstate(struct ssusb_mtk *ssusb) { - if (!ssusb->otg_switch.is_u3_drd) { - mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); - mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); - } + mtu3_setbits(ssusb->mac_base, U3D_DEVICE_CONTROL, DC_SESSION); + mtu3_setbits(ssusb->mac_base, U3D_POWER_MANAGEMENT, SOFT_CONN); } =20 /* only port0 supports dual-role mode */ From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B369DC433EF for ; Tue, 10 May 2022 13:21:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240014AbiEJNZN (ORCPT ); Tue, 10 May 2022 09:25:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38562 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243279AbiEJNVp (ORCPT ); Tue, 10 May 2022 09:21:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 34A902C3360; Tue, 10 May 2022 06:15:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B8BAA61532; Tue, 10 May 2022 13:15:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 95C3FC385A6; Tue, 10 May 2022 13:15:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188529; bh=q+s6FJfbA7d6EcGsRe441ZZ2FTLTaNIUc3UIe2otjyk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ODDB9AgR9nwgLkSzEc6WFhnre+E8Vhxe1//QdNgqm1dnTUnB7mXoVGV6P/aONyHqI RSR5pes1OoGY3oFrRFKkiAFResH4P4cF0uuvPQ0f3rIrEIzP85qoVmDbrev7Gop91b RVU+endp9XQsMRIwlb/uF8HFyzNhmQDtIn+nHyPM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum Subject: [PATCH 4.14 08/78] USB: quirks: add a Realtek card reader Date: Tue, 10 May 2022 15:06:54 +0200 Message-Id: <20220510130732.779603638@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Neukum commit 2a7ccf6bb6f147f64c025ad68f4255d8e1e0ce6d upstream. This device is reported to stall when enummerated. Cc: stable Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20220414110209.30924-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/core/quirks.c +++ b/drivers/usb/core/quirks.c @@ -243,6 +243,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0b05, 0x17e0), .driver_info =3D USB_QUIRK_IGNORE_REMOTE_WAKEUP }, =20 + /* Realtek Semiconductor Corp. Mass Storage Device (Multicard Reader)*/ + { USB_DEVICE(0x0bda, 0x0151), .driver_info =3D USB_QUIRK_CONFIG_INTF_STRI= NGS }, + /* Realtek hub in Dell WD19 (Type-C) */ { USB_DEVICE(0x0bda, 0x0487), .driver_info =3D USB_QUIRK_NO_LPM }, { USB_DEVICE(0x0bda, 0x5487), .driver_info =3D USB_QUIRK_RESET_RESUME }, From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F1C0C433EF for ; Tue, 10 May 2022 13:25:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242444AbiEJN26 (ORCPT ); Tue, 10 May 2022 09:28:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45570 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243546AbiEJNWD (ORCPT ); Tue, 10 May 2022 09:22:03 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0395750E0E; Tue, 10 May 2022 06:16:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E2BA861661; Tue, 10 May 2022 13:15:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA6BDC385C6; Tue, 10 May 2022 13:15:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188532; bh=0Zsa4+gxXS41nEdbiCUhpnQgdG82KClTrqpYIttuWFc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zUGVeDiNKbho+Ea8Yt3Txo445gyCcPkhRN9ezYYgucgiMsilasWUjn0r9OPG6dqXu iFFGpk2AGpYg3xuE8JlfM+0mcUMAaJaK1INViSM6XgKU80osfPqBN1ywGPPCNf25gJ cSnMiIj3l64o+9ROfjm9V5YsEW8sEKkdtb24AS6A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum Subject: [PATCH 4.14 09/78] USB: quirks: add STRING quirk for VCOM device Date: Tue, 10 May 2022 15:06:55 +0200 Message-Id: <20220510130732.809060787@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Neukum commit ec547af8a9ea6441864bad34172676b5652ceb96 upstream. This has been reported to stall if queried Cc: stable Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20220414123152.1700-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/core/quirks.c +++ b/drivers/usb/core/quirks.c @@ -328,6 +328,9 @@ static const struct usb_device_id usb_qu /* DJI CineSSD */ { USB_DEVICE(0x2ca3, 0x0031), .driver_info =3D USB_QUIRK_NO_LPM }, =20 + /* VCOM device */ + { USB_DEVICE(0x4296, 0x7570), .driver_info =3D USB_QUIRK_CONFIG_INTF_STRI= NGS }, + /* INTEL VALUE SSD */ { USB_DEVICE(0x8086, 0xf1a5), .driver_info =3D USB_QUIRK_RESET_RESUME }, From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D95F5C38A05 for ; Tue, 10 May 2022 13:20:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242780AbiEJNX4 (ORCPT ); Tue, 10 May 2022 09:23:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36228 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242886AbiEJNVI (ORCPT ); Tue, 10 May 2022 09:21:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E7D82BF33C; Tue, 10 May 2022 06:14:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 84A6B61574; Tue, 10 May 2022 13:14:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F82CC385C2; Tue, 10 May 2022 13:14:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188444; bh=MqtgFF+buggGYF2O1oUcULtKmpd2uz5IheHUTdQuv8Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Zg2GPyt4bDN7VrqJnyzz1vRYw6F4EvNGjANDZuo1ZIzylsz3dQXNsmH/bAwrQAAjL /3vj1zwqz9jFIB0Do9j1SdU3VqBtPsTRnDOk+aZwIKr1zvT75TvQPdTMVL8YcZOFP3 y9zbJN77xH6E1yVtqnXWroc2QEiU2ksmP6PouD4A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Kees Cook , Johan Hovold Subject: [PATCH 4.14 10/78] USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS Date: Tue, 10 May 2022 15:06:56 +0200 Message-Id: <20220510130732.841430894@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kees Cook commit e23e50e7acc8d8f16498e9c129db33e6a00e80eb upstream. The sizeof(struct whitehat_dr_info) can be 4 bytes under CONFIG_AEABI=3Dn due to "-mabi=3Dapcs-gnu", even though it has a single u8: whiteheat_private { __u8 mcr; /* 0 1 */ /* size: 4, cachelines: 1, members: 1 */ /* padding: 3 */ /* last cacheline: 4 bytes */ }; The result is technically harmless, as both the source and the destinations are currently the same allocation size (4 bytes) and don't use their padding, but if anything were to ever be added after the "mcr" member in "struct whiteheat_private", it would be overwritten. The structs both have a single u8 "mcr" member, but are 4 bytes in padded size. The memcpy() destination was explicitly targeting the u8 member (size 1) with the length of the whole structure (size 4), triggering the memcpy buffer overflow warning: In file included from include/linux/string.h:253, from include/linux/bitmap.h:11, from include/linux/cpumask.h:12, from include/linux/smp.h:13, from include/linux/lockdep.h:14, from include/linux/spinlock.h:62, from include/linux/mmzone.h:8, from include/linux/gfp.h:6, from include/linux/slab.h:15, from drivers/usb/serial/whiteheat.c:17: In function 'fortify_memcpy_chk', inlined from 'firm_send_command' at drivers/usb/serial/whiteheat.c:587:= 4: include/linux/fortify-string.h:328:25: warning: call to '__write_overflow_f= ield' declared with attribute warning: detected write beyond size of field = (1st parameter); maybe use struct_group()? [-Wattribute-warning] 328 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Instead, just assign the one byte directly. Reported-by: kernel test robot Link: https://lore.kernel.org/lkml/202204142318.vDqjjSFn-lkp@intel.com Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220421001234.2421107-1-keescook@chromium.= org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/whiteheat.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/drivers/usb/serial/whiteheat.c +++ b/drivers/usb/serial/whiteheat.c @@ -615,9 +615,8 @@ static int firm_send_command(struct usb_ switch (command) { case WHITEHEAT_GET_DTR_RTS: info =3D usb_get_serial_port_data(port); - memcpy(&info->mcr, command_info->result_buffer, - sizeof(struct whiteheat_dr_info)); - break; + info->mcr =3D command_info->result_buffer[0]; + break; } } exit: From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A00FC433EF for ; Tue, 10 May 2022 13:19:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243061AbiEJNXv (ORCPT ); Tue, 10 May 2022 09:23:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38654 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242923AbiEJNVK (ORCPT ); Tue, 10 May 2022 09:21:10 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2DA192BFBF7; Tue, 10 May 2022 06:14:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 67A61CE1EE2; Tue, 10 May 2022 13:14:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D7ABC385A6; Tue, 10 May 2022 13:14:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188446; bh=F2Tpis4W/aZ5znDIKQR2Yf3i8XNfZG6H6GiAGMBmcWQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zQ2sc7ue5aAUbi0HZenkJ7crLt5ZBJ1An0maAFH4IXYw/oG0b2DhVCz2Ktz/Aox7J p+enQzdc0PMRKRHKprz/xGX3hyDpozWldoDCYLNuJwOWwD+Jqs/W4J2qcvwN5S24MT qmv1VSsueD8ldTIqAwpT/+KU8UasxGGyIStIhSFk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bruno Thomsen , Johan Hovold Subject: [PATCH 4.14 11/78] USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader Date: Tue, 10 May 2022 15:06:57 +0200 Message-Id: <20220510130732.868168863@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bruno Thomsen commit 35a923a0b329c343e9e81d79518e2937eba06fcd upstream. Wireless reading of water and heat meters using 868 MHz wM-Bus mode C1. The two different product IDs allow detection of dongle antenna solution: - Internal antenna - External antenna using SMA connector https://www.kamstrup.com/en-en/water-solutions/water-meter-reading/usb-mete= r-reader Signed-off-by: Bruno Thomsen Link: https://lore.kernel.org/r/20220414081202.5591-1-bruno.thomsen@gmail.c= om Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/cp210x.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/serial/cp210x.c +++ b/drivers/usb/serial/cp210x.c @@ -198,6 +198,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Contro= l, Monitoring and Data Logger */ { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */ { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */ + { USB_DEVICE(0x17A8, 0x0101) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter R= eader (Int Ant) */ + { USB_DEVICE(0x17A8, 0x0102) }, /* Kamstrup 868 MHz wM-Bus C-Mode Meter R= eader (Ext Ant) */ { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9C12C47082 for ; Tue, 10 May 2022 13:20:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242711AbiEJNXU (ORCPT ); Tue, 10 May 2022 09:23:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45962 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242934AbiEJNVL (ORCPT ); Tue, 10 May 2022 09:21:11 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3E132C07DC; Tue, 10 May 2022 06:14:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 3C108CE1EE3; Tue, 10 May 2022 13:14:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4E24DC385C2; Tue, 10 May 2022 13:14:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188449; bh=JYrQNoyzGo89v5Na0CK11ojhEGnLEC9j0O5N7oqqcsU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LlygFJLxU4DbssXckP3RhJDKWXNBJIKuQAJ8hSX6MCGukogsmyZK3lx2HQ0WPRD6S w0qojvQewiXWC8a6w3mtesWLdX+1WUFiT9hFTGrQEdcLzo0+b2IQ8BP4ECpLKvCIdC NT6VsIgBwAjyKiKuGzg7NNCvI5TW+PLLpC0fzcTU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Slark Xiao , Johan Hovold Subject: [PATCH 4.14 12/78] USB: serial: option: add support for Cinterion MV32-WA/MV32-WB Date: Tue, 10 May 2022 15:06:58 +0200 Message-Id: <20220510130732.897045687@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Slark Xiao commit b4a64ed6e7b857317070fcb9d87ff5d4a73be3e8 upstream. Add support for Cinterion device MV32-WA/MV32-WB. MV32-WA PID is 0x00F1, and MV32-WB PID is 0x00F2. Test evidence as below: T: Bus=3D04 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 4 Spd=3D5000 Mx= Ch=3D 0 D: Ver=3D 3.20 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D 9 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f1 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F1 USB Mobile Broadband S: SerialNumber=3D78ada8c4 C: #Ifs=3D 6 Cfg#=3D 1 Atr=3Da0 MxPwr=3D896mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 1 Cls=3D02(commc) Sub=3D0e Prot=3D00 Driver= =3Dcdc_mbim I: If#=3D0x1 Alt=3D 1 #EPs=3D 2 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 1 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3D(none) I: If#=3D0x4 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D60 Driver= =3Doption I: If#=3D0x5 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption T: Bus=3D04 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 3 Spd=3D5000 Mx= Ch=3D 0 D: Ver=3D 3.20 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D 9 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f2 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F2 USB Mobile Broadband S: SerialNumber=3Dcdd06a78 C: #Ifs=3D 6 Cfg#=3D 1 Atr=3Da0 MxPwr=3D896mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 1 Cls=3D02(commc) Sub=3D0e Prot=3D00 Driver= =3Dcdc_mbim I: If#=3D0x1 Alt=3D 1 #EPs=3D 2 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 1 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3D(none) I: If#=3D0x4 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D60 Driver= =3Doption I: If#=3D0x5 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption Interface 0&1: MBIM, 2:Modem, 3: GNSS, 4: NMEA, 5: Diag GNSS port don't use serial driver. Signed-off-by: Slark Xiao Link: https://lore.kernel.org/r/20220414074434.5699-1-slark_xiao@163.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -435,6 +435,8 @@ static void option_instat_callback(struc #define CINTERION_PRODUCT_CLS8 0x00b0 #define CINTERION_PRODUCT_MV31_MBIM 0x00b3 #define CINTERION_PRODUCT_MV31_RMNET 0x00b7 +#define CINTERION_PRODUCT_MV32_WA 0x00f1 +#define CINTERION_PRODUCT_MV32_WB 0x00f2 =20 /* Olivetti products */ #define OLIVETTI_VENDOR_ID 0x0b3c @@ -1972,6 +1974,10 @@ static const struct usb_device_id option .driver_info =3D RSVD(3)}, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV31_= RMNET, 0xff), .driver_info =3D RSVD(0)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WA, 0xff), + .driver_info =3D RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WB, 0xff), + .driver_info =3D RSVD(3)}, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), .driver_info =3D RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE926C433F5 for ; Tue, 10 May 2022 13:19:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242970AbiEJNX1 (ORCPT ); Tue, 10 May 2022 09:23:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38764 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242940AbiEJNVM (ORCPT ); Tue, 10 May 2022 09:21:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7B1632C07E4; Tue, 10 May 2022 06:14:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E9DC1B81DA2; Tue, 10 May 2022 13:14:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4862AC385A6; Tue, 10 May 2022 13:14:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188452; bh=aXB4daM/ieCFl8DSt7lOnSB+CClJjFzXkNFu859icnM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZwQJ8pnkkTAoOp5sxghPXxRWFCV/PdAL9nKHt14PEM3sYReWMtLYH1nh75ukeXw95 M7pV0LzN/IY/80ruLqSVgsg7hNiTiXkK8b2BQuAuclN2qwViDxVPJjuaPs0Ak0XQiI QZ/X7DXOAe36UA8eaWzWXfH4JXOzbyOGNWSvnpvs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniele Palmas , Johan Hovold Subject: [PATCH 4.14 13/78] USB: serial: option: add Telit 0x1057, 0x1058, 0x1075 compositions Date: Tue, 10 May 2022 15:06:59 +0200 Message-Id: <20220510130732.926532025@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniele Palmas commit f32c5a0423400e01f4d7c607949fa3a1f006e8fa upstream. Add support for the following Telit FN980 and FN990 compositions: 0x1057: tty, adb, rmnet, tty, tty, tty, tty, tty 0x1058: tty, adb, tty, tty, tty, tty, tty 0x1075: adb, tty Signed-off-by: Daniele Palmas Link: https://lore.kernel.org/r/20220406141408.580669-1-dnlplm@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1222,6 +1222,10 @@ static const struct usb_device_id option .driver_info =3D NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD9= 80 */ .driver_info =3D NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1057, 0xff), /* Telit FN9= 80 */ + .driver_info =3D NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1058, 0xff), /* Telit FN9= 80 (PCIe) */ + .driver_info =3D NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN9= 20 (rmnet) */ .driver_info =3D NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN9= 20 (MBIM) */ @@ -1238,6 +1242,8 @@ static const struct usb_device_id option .driver_info =3D NCTRL(2) | RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1073, 0xff), /* Telit FN9= 90 (ECM) */ .driver_info =3D NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1075, 0xff), /* Telit FN9= 90 (PCIe) */ + .driver_info =3D RSVD(0) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info =3D NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DBDB4C352AA for ; Tue, 10 May 2022 13:24:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244018AbiEJN1v (ORCPT ); Tue, 10 May 2022 09:27:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45964 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242950AbiEJNVM (ORCPT ); Tue, 10 May 2022 09:21:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 36DA82C07FD; Tue, 10 May 2022 06:14:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DC191B81DA2; Tue, 10 May 2022 13:14:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 35D7AC385A6; Tue, 10 May 2022 13:14:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188455; bh=rv5YClglW/BeeR7VokaDgRvc3nal0GlKMs5Rdx/I3YE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eeUYb86foMmTbeXxkUytl3ZppB7ApYITngdUmJh1arYHVecWAJqVH4oByA0hivrnP KhnMmoB1bqJrVOaYVOOcN7EC0OtorKr1+6dSutAinvd2rtyzcq9Sx23TG6R6OxkKRd qvRGVQtGZunjbqSEBKaESpsRIo6BkwwSAjHPEToc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Henry Lin , Mathias Nyman Subject: [PATCH 4.14 14/78] xhci: stop polling roothubs after shutdown Date: Tue, 10 May 2022 15:07:00 +0200 Message-Id: <20220510130732.955604657@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Henry Lin commit dc92944a014cd6a6f6c94299aaa36164dd2c238a upstream. While rebooting, XHCI controller and its bus device will be shut down in order by .shutdown callback. Stopping roothubs polling in xhci_shutdown() can prevent XHCI driver from accessing port status after its bus device shutdown. Take PCIe XHCI controller as example, if XHCI driver doesn't stop roothubs polling, XHCI driver may access PCIe BAR register for port status after parent PCIe root port driver is shutdown and cause PCIe bus error. [check shared hcd exist before stopping its roothub polling -Mathias] Cc: stable@vger.kernel.org Signed-off-by: Henry Lin Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220408134823.2527272-3-mathias.nyman@linu= x.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/host/xhci.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -724,6 +724,17 @@ void xhci_shutdown(struct usb_hcd *hcd) if (xhci->quirks & XHCI_SPURIOUS_REBOOT) usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev)); =20 + /* Don't poll the roothubs after shutdown. */ + xhci_dbg(xhci, "%s: stopping usb%d port polling.\n", + __func__, hcd->self.busnum); + clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); + del_timer_sync(&hcd->rh_timer); + + if (xhci->shared_hcd) { + clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); + del_timer_sync(&xhci->shared_hcd->rh_timer); + } + spin_lock_irq(&xhci->lock); xhci_halt(xhci); /* Workaround for spurious wakeups at shutdown with HSW */ From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2325C4332F for ; Tue, 10 May 2022 13:19:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238435AbiEJNXm (ORCPT ); Tue, 10 May 2022 09:23:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242967AbiEJNVN (ORCPT ); Tue, 10 May 2022 09:21:13 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5071B2C0D14; Tue, 10 May 2022 06:14:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id E293BCE1EE4; Tue, 10 May 2022 13:14:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EF482C385C2; Tue, 10 May 2022 13:14:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188458; bh=ycpbxAto+dh1Mn2Va8iL5uowbHR53RqJ38c0L1VvIxE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vOaJqKiVs9XXV1xPFuubvronSFj0Isp3p3ROLc1iw71oEyrLPC6vPN3fvHt7PJpb2 8bybJsykTUVfxuyrawjFpLZVEl0SnC64hwlDKz3BjppRRY/R8lfKKe20pMFRbm5aq5 8USUbwb6jaVFM7mzDOGHVa6Xt9ca3YrlkODLiKHg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zizhuang Deng , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.14 15/78] iio: dac: ad5592r: Fix the missing return value. Date: Tue, 10 May 2022 15:07:01 +0200 Message-Id: <20220510130732.984949266@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zizhuang Deng commit b55b38f7cc12da3b9ef36e7a3b7f8f96737df4d5 upstream. The third call to `fwnode_property_read_u32` did not record the return value, resulting in `channel_offstate` possibly being assigned the wrong value. Fixes: 56ca9db862bf ("iio: dac: Add support for the AD5592R/AD5593R ADCs/DA= Cs") Signed-off-by: Zizhuang Deng Link: https://lore.kernel.org/r/20220310125450.4164164-1-sunsetdzz@gmail.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/iio/dac/ad5592r-base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/dac/ad5592r-base.c +++ b/drivers/iio/dac/ad5592r-base.c @@ -532,7 +532,7 @@ static int ad5592r_alloc_channels(struct if (!ret) st->channel_modes[reg] =3D tmp; =20 - fwnode_property_read_u32(child, "adi,off-state", &tmp); + ret =3D fwnode_property_read_u32(child, "adi,off-state", &tmp); if (!ret) st->channel_offstate[reg] =3D tmp; } From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A3FFC433EF for ; Tue, 10 May 2022 13:28:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243528AbiEJNbQ (ORCPT ); Tue, 10 May 2022 09:31:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242998AbiEJNVQ (ORCPT ); Tue, 10 May 2022 09:21:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C45704A3F5; Tue, 10 May 2022 06:14:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 13176B81DA4; Tue, 10 May 2022 13:14:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7A85FC385A6; Tue, 10 May 2022 13:14:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188461; bh=LlaNvZNC6zMQ2YYn7Jimy2RhtIUwN/GT9NAOZ5adIg8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fLBXaf098KUuKqUdlAg3sj4m1Q5Oe2nWSHanxnVSOPc98UxW1ELg86PSj0eLW2HR3 R0sK18Dsc/A3k3HheaQOsavBPxjsjPQYCtHN+UNiGUpWGcNgZzhG/JSSTrfbzXR0ys GSIIR30i+1fF8phHjkf7xzGHZi3zY9JluqUqjW8A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Hennerich , =?UTF-8?q?Nuno=20S=C3=A1?= , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.14 16/78] iio: dac: ad5446: Fix read_raw not returning set value Date: Tue, 10 May 2022 15:07:02 +0200 Message-Id: <20220510130733.013232254@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Michael Hennerich commit 89a01cd688d3c0ac983ef0b0e5f40018ab768317 upstream. read_raw should return the un-scaled value. Fixes: 5e06bdfb46e8b ("staging:iio:dac:ad5446: Return cached value for 'raw= ' attribute") Signed-off-by: Michael Hennerich Reviewed-by: Nuno S=C3=A1 Link: https://lore.kernel.org/r/20220406105620.1171340-1-michael.hennerich@= analog.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/iio/dac/ad5446.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/dac/ad5446.c +++ b/drivers/iio/dac/ad5446.c @@ -171,7 +171,7 @@ static int ad5446_read_raw(struct iio_de =20 switch (m) { case IIO_CHAN_INFO_RAW: - *val =3D st->cached_val; + *val =3D st->cached_val >> chan->scan_type.shift; return IIO_VAL_INT; case IIO_CHAN_INFO_SCALE: *val =3D st->vref_mv; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36E43C433FE for ; Tue, 10 May 2022 13:19:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243051AbiEJNXq (ORCPT ); Tue, 10 May 2022 09:23:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46000 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242972AbiEJNVO (ORCPT ); Tue, 10 May 2022 09:21:14 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C4C332C0D1D; Tue, 10 May 2022 06:14:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 697E461574; Tue, 10 May 2022 13:14:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B600C385C6; Tue, 10 May 2022 13:14:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188464; bh=Za0+Kg0GzcGKimpUtf0svjSHqpztZKZgkSCW3XGCFmU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z1H3dvzvr0plHbXvGQoBUxBCrdxWBJSz+Plt5F7k4dPCn8MftXQHSVM+WoQaTkW/1 j2sChWl1VdV/rlgdl3DPa2pFkBVx/kqZ0xbOG5A+xqtfHAA8A0EfD2NUVe/3c4e9Q3 kGEfoR52+JypcWkJ3k7najC+ZUwMbDbKHOrHwPeo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.14 17/78] iio: magnetometer: ak8975: Fix the error handling in ak8975_power_on() Date: Tue, 10 May 2022 15:07:03 +0200 Message-Id: <20220510130733.042088677@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma commit 3a26787dacf04257a68b16315c984eb2c340bc5e upstream. When the driver fails to enable the regulator 'vid', we will get the following splat: [ 79.955610] WARNING: CPU: 5 PID: 441 at drivers/regulator/core.c:2257 _r= egulator_put+0x3ec/0x4e0 [ 79.959641] RIP: 0010:_regulator_put+0x3ec/0x4e0 [ 79.967570] Call Trace: [ 79.967773] [ 79.967951] regulator_put+0x1f/0x30 [ 79.968254] devres_release_group+0x319/0x3d0 [ 79.968608] i2c_device_probe+0x766/0x940 Fix this by disabling the 'vdd' regulator when failing to enable 'vid' regulator. Signed-off-by: Zheyu Ma Link: https://lore.kernel.org/r/20220409034849.3717231-2-zheyuma97@gmail.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/iio/magnetometer/ak8975.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/iio/magnetometer/ak8975.c +++ b/drivers/iio/magnetometer/ak8975.c @@ -404,6 +404,7 @@ static int ak8975_power_on(const struct if (ret) { dev_warn(&data->client->dev, "Failed to enable specified Vid supply\n"); + regulator_disable(data->vdd); return ret; } /* From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 652C1C4321E for ; Tue, 10 May 2022 13:20:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242719AbiEJNYF (ORCPT ); Tue, 10 May 2022 09:24:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38482 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242994AbiEJNVQ (ORCPT ); Tue, 10 May 2022 09:21:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1BA4E2C0D33; Tue, 10 May 2022 06:14:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7E2E161663; Tue, 10 May 2022 13:14:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 856AAC385C2; Tue, 10 May 2022 13:14:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188467; bh=e37HFvfo6Eh+cEnaB37DYqiIqFmwsClWRGs6syWfbvw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=s+A8RR6fdZwgii8HmsGDABbjj8kcYsFoSK7mQUg5TAfban/STrnw15oUgGk0qtEnx Vod/fEPyca8ALWzLTVm+7zZ7oNvlnHLtTcenopc8l23wyYdpAUlTO4Qb1Mn6Dt37RS AyCCd1HDa2QMJC9I3ocIbaTOFCP6SDZpvWseaTyg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Dongliang Mu , Hangyu Hua Subject: [PATCH 4.14 18/78] usb: misc: fix improper handling of refcount in uss720_probe() Date: Tue, 10 May 2022 15:07:04 +0200 Message-Id: <20220510130733.070480574@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua commit 0a96fa640dc928da9eaa46a22c46521b037b78ad upstream. usb_put_dev shouldn't be called when uss720_probe succeeds because of priv->usbdev. At the same time, priv->usbdev shouldn't be set to NULL before destroy_priv in uss720_disconnect because usb_put_dev is in destroy_priv. Fix this by moving priv->usbdev =3D NULL after usb_put_dev. Fixes: dcb4b8ad6a44 ("misc/uss720: fix memory leak in uss720_probe") Cc: stable Reviewed-by: Dongliang Mu Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20220407024001.11761-1-hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/misc/uss720.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/drivers/usb/misc/uss720.c +++ b/drivers/usb/misc/uss720.c @@ -84,6 +84,7 @@ static void destroy_priv(struct kref *kr =20 dev_dbg(&priv->usbdev->dev, "destroying priv datastructure\n"); usb_put_dev(priv->usbdev); + priv->usbdev =3D NULL; kfree(priv); } =20 @@ -749,7 +750,6 @@ static int uss720_probe(struct usb_inter parport_announce_port(pp); =20 usb_set_intfdata(intf, pp); - usb_put_dev(usbdev); return 0; =20 probe_abort: @@ -769,7 +769,6 @@ static void uss720_disconnect(struct usb if (pp) { priv =3D pp->private_data; usbdev =3D priv->usbdev; - priv->usbdev =3D NULL; priv->pp =3D NULL; dev_dbg(&intf->dev, "parport_remove_port\n"); parport_remove_port(pp); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D6EAC38A04 for ; Tue, 10 May 2022 13:24:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244037AbiEJN1z (ORCPT ); Tue, 10 May 2022 09:27:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38562 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243005AbiEJNVQ (ORCPT ); Tue, 10 May 2022 09:21:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0EFDA3B57E; Tue, 10 May 2022 06:14:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7682961668; Tue, 10 May 2022 13:14:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7E771C385A6; Tue, 10 May 2022 13:14:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188470; bh=23NIjSuIAxDr+YqpEEABu2BsmOfakhswdhx5AG3Xwb4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hyLyhsUpsftI9CHkDq3Oi9zPqVRdvwUfvGyQo1mS4anVbscY2YGGFB5m7/XkrZW5S ddrY9CaOeSSNyJN1GlZs4PtKJFe6ek65hqBrKuwFM7oE+x4hJMW7RtD4S1DabID5Gs rv766kD1uP0HPDFzfnv4/bT6sf2wZzep081zVneU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Vacura Subject: [PATCH 4.14 19/78] usb: gadget: uvc: Fix crash when encoding data for usb request Date: Tue, 10 May 2022 15:07:05 +0200 Message-Id: <20220510130733.099465057@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Vacura commit 71d471e3faf90c9674cadc7605ac719e82cb7fac upstream. During the uvcg_video_pump() process, if an error occurs and uvcg_queue_cancel() is called, the buffer queue will be cleared out, but the current marker (queue->buf_used) of the active buffer (no longer active) is not reset. On the next iteration of uvcg_video_pump() the stale buf_used count will be used and the logic of min((unsigned int)len, buf->bytesused - queue->buf_used) may incorrectly calculate a nbytes size, causing an invalid memory access. [80802.185460][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. [80802.185519][ T315] configfs-gadget gadget: uvc: VS request completed with status -18. ... uvcg_queue_cancel() is called and the queue is cleared out, but the marker queue->buf_used is not reset. ... [80802.262328][ T8682] Unable to handle kernel paging request at virtual address ffffffc03af9f000 ... ... [80802.263138][ T8682] Call trace: [80802.263146][ T8682] __memcpy+0x12c/0x180 [80802.263155][ T8682] uvcg_video_pump+0xcc/0x1e0 [80802.263165][ T8682] process_one_work+0x2cc/0x568 [80802.263173][ T8682] worker_thread+0x28c/0x518 [80802.263181][ T8682] kthread+0x160/0x170 [80802.263188][ T8682] ret_from_fork+0x10/0x18 [80802.263198][ T8682] Code: a8c12829 a88130cb a8c130 Fixes: d692522577c0 ("usb: gadget/uvc: Port UVC webcam gadget to use videob= uf2 framework") Cc: Signed-off-by: Dan Vacura Link: https://lore.kernel.org/r/20220331184024.23918-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/gadget/function/uvc_queue.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/gadget/function/uvc_queue.c +++ b/drivers/usb/gadget/function/uvc_queue.c @@ -246,6 +246,8 @@ void uvcg_queue_cancel(struct uvc_video_ buf->state =3D UVC_BUF_STATE_ERROR; vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_ERROR); } + queue->buf_used =3D 0; + /* This must be protected by the irqlock spinlock to avoid race * conditions between uvc_queue_buffer and the disconnection event that * could result in an interruptible wait in uvc_dequeue_buffer. Do not From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AEDABC433F5 for ; Tue, 10 May 2022 13:24:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243086AbiEJN2Y (ORCPT ); Tue, 10 May 2022 09:28:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38462 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243069AbiEJNVX (ORCPT ); Tue, 10 May 2022 09:21:23 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 40AE547ACC; Tue, 10 May 2022 06:14:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 47608CE1EE2; Tue, 10 May 2022 13:14:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E762C385C2; Tue, 10 May 2022 13:14:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188476; bh=3RK9xplvXFsEAKF5zctZjPsYO9ZyP3rOjYPdHd2dmZc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0uL73WDExHRnoe/Wk7d1yX6K7HRgPs59kOJxH7uJNSvQNm4WOlLuXonjhtbcoFQYp hn0Etd5Ubol1/zp5b6w5dPe4J2/VviP8dhR1yAsR6ZOlVthJ3/X4MBDQDyPVx45En9 sanQzQP+OAn56qlnb8LuFbnTxMcad76/I/rwZ8yk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vijayavardhan Vennapusa , Dan Vacura , stable Subject: [PATCH 4.14 20/78] usb: gadget: configfs: clear deactivation flag in configfs_composite_unbind() Date: Tue, 10 May 2022 15:07:06 +0200 Message-Id: <20220510130733.128584169@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vijayavardhan Vennapusa commit bf95c4d4630c7a2c16e7b424fdea5177d9ce0864 upstream. If any function like UVC is deactivating gadget as part of composition switch which results in not calling pullup enablement, it is not getting enabled after switch to new composition due to this deactivation flag not cleared. This results in USB enumeration not happening after switch to new USB composition. Hence clear deactivation flag inside gadget structure in configfs_composite_unbind() before switch to new USB composition. Signed-off-by: Vijayavardhan Vennapusa Signed-off-by: Dan Vacura Cc: stable Link: https://lore.kernel.org/r/20220413211038.72797-1-w36195@motorola.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/gadget/configfs.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -1411,6 +1411,8 @@ static void configfs_composite_unbind(st usb_ep_autoconfig_reset(cdev->gadget); spin_lock_irqsave(&gi->spinlock, flags); cdev->gadget =3D NULL; + cdev->deactivations =3D 0; + gadget->deactivated =3D false; set_gadget_data(gadget, NULL); spin_unlock_irqrestore(&gi->spinlock, flags); } From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08CC0C38A02 for ; Tue, 10 May 2022 13:24:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243031AbiEJN2L (ORCPT ); Tue, 10 May 2022 09:28:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37728 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243037AbiEJNVV (ORCPT ); Tue, 10 May 2022 09:21:21 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 415D853B6C; Tue, 10 May 2022 06:14:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 25FD6615FA; Tue, 10 May 2022 13:14:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38C68C385A6; Tue, 10 May 2022 13:14:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188479; bh=R5zxNH/6ea6tY49yUZgBAJKjIXrIpEJh7MaPAFq5tNc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZZXvfXqqpo+bKnfFBpnKbiemNlUO3xylD1GTDta4y+7OuqKYCJswY9KrNr/Z2lKUI Pi7lbBeFIetezGeJSaa15anxoWfM6LuMAFviyYu7zoWb2X0Iqaniuga/gfsKI9A2Ey Z+tm/C40j3RY2irDmzfaB/vDSbasTReiXsRa5ehc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Maciej W. Rozycki" , Andy Shevchenko Subject: [PATCH 4.14 21/78] serial: 8250: Also set sticky MCR bits in console restoration Date: Tue, 10 May 2022 15:07:07 +0200 Message-Id: <20220510130733.157855699@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maciej W. Rozycki commit 6e6eebdf5e2455f089ccd000754a0deaeb79af82 upstream. Sticky MCR bits are lost in console restoration if console suspending has been disabled. This currently affects the AFE bit, which works in combination with RTS which we set, so we want to make sure the UART retains control of its FIFO where previously requested. Also specific drivers may need other bits in the future. Signed-off-by: Maciej W. Rozycki Fixes: 4516d50aabed ("serial: 8250: Use canary to restart console after sus= pend") Cc: stable@vger.kernel.org # v4.0+ Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181518490.9383@angie.or= cam.me.uk Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/serial/8250/8250_port.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/tty/serial/8250/8250_port.c +++ b/drivers/tty/serial/8250/8250_port.c @@ -3240,7 +3240,7 @@ static void serial8250_console_restore(s =20 serial8250_set_divisor(port, baud, quot, frac); serial_port_out(port, UART_LCR, up->lcr); - serial8250_out_MCR(up, UART_MCR_DTR | UART_MCR_RTS); + serial8250_out_MCR(up, up->mcr | UART_MCR_DTR | UART_MCR_RTS); } =20 /* From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45BFBC433F5 for ; Tue, 10 May 2022 13:20:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242677AbiEJNYU (ORCPT ); Tue, 10 May 2022 09:24:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243058AbiEJNVW (ORCPT ); Tue, 10 May 2022 09:21:22 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 09FD32C13C2; Tue, 10 May 2022 06:14:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 16C4E61668; Tue, 10 May 2022 13:14:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0256FC385C2; Tue, 10 May 2022 13:14:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188482; bh=/4tIIjSnRVWb5mqxn4GkUSAWWT+Y1OQB5JP/Vz1OeYo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jENOjyM4Po7rqwxvL/8pyilayNTUKbBNnQ2V8oioxxxP3hR+aX7m6Co+BUIJQyL/N l5rgfPAVyEt2/iCwqXf37INh3GbCxSN1X6S2Q8lYeBORnhIsdKFHIWzkHPr1pQi9AA RzPMOy57vkgu9RQgByhzfuLWFUyuHB+IsVxXMJNw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Maciej W. Rozycki" , stable , Andy Shevchenko Subject: [PATCH 4.14 22/78] serial: 8250: Correct the clock for EndRun PTP/1588 PCIe device Date: Tue, 10 May 2022 15:07:08 +0200 Message-Id: <20220510130733.189588990@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maciej W. Rozycki commit 637674fa40059cddcc3ad2212728965072f62ea3 upstream. The EndRun PTP/1588 dual serial port device is based on the Oxford Semiconductor OXPCIe952 UART device with the PCI vendor:device ID set for EndRun Technologies and is therefore driven by a fixed 62.5MHz clock input derived from the 100MHz PCI Express clock. The clock rate is divided by the oversampling rate of 16 as it is supplied to the baud rate generator, yielding the baud base of 3906250. Replace the incorrect baud base of 4000000 with the right value of 3906250 then, complementing commit 6cbe45d8ac93 ("serial: 8250: Correct the clock for OxSemi PCIe devices"). Signed-off-by: Maciej W. Rozycki Cc: stable Fixes: 1bc8cde46a159 ("8250_pci: Added driver for Endrun Technologies PTP P= CIe card.") Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/alpine.DEB.2.21.2204181515270.9383@angie.or= cam.me.uk Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/serial/8250/8250_pci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/tty/serial/8250/8250_pci.c +++ b/drivers/tty/serial/8250/8250_pci.c @@ -2668,7 +2668,7 @@ enum pci_board_num_t { pbn_panacom2, pbn_panacom4, pbn_plx_romulus, - pbn_endrun_2_4000000, + pbn_endrun_2_3906250, pbn_oxsemi, pbn_oxsemi_1_4000000, pbn_oxsemi_2_4000000, @@ -3184,10 +3184,10 @@ static struct pciserial_board pci_boards * signal now many ports are available * 2 port 952 Uart support */ - [pbn_endrun_2_4000000] =3D { + [pbn_endrun_2_3906250] =3D { .flags =3D FL_BASE0, .num_ports =3D 2, - .base_baud =3D 4000000, + .base_baud =3D 3906250, .uart_offset =3D 0x200, .first_offset =3D 0x1000, }, @@ -4039,7 +4039,7 @@ static const struct pci_device_id serial */ { PCI_VENDOR_ID_ENDRUN, PCI_DEVICE_ID_ENDRUN_1588, PCI_ANY_ID, PCI_ANY_ID, 0, 0, - pbn_endrun_2_4000000 }, + pbn_endrun_2_3906250 }, /* * Quatech cards. These actually have configurable clocks but for * now we just use the default. From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A10BFC4332F for ; Tue, 10 May 2022 13:24:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242766AbiEJN2F (ORCPT ); Tue, 10 May 2022 09:28:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40026 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243059AbiEJNVW (ORCPT ); Tue, 10 May 2022 09:21:22 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0B1732C13CF; Tue, 10 May 2022 06:14:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 222AE61663; Tue, 10 May 2022 13:14:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2023FC385A6; Tue, 10 May 2022 13:14:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188485; bh=2g/WMPTJPer4iFcfPM0Og5LI/Edv3RTtBnSON5Vy+tU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mu89ZQwzxn4VSJL2tcS6r5iZyi9WN42JcBa426/WVpmGp9UHej3XxFndybDCEw5UN TQ67k0DHxrEZ/Mru14TDQeGADVtC/gmTTUwgezpqEfdOvc445v0qy2+oRuB7w6nftg dAY/+w8MlKCkCT2N/ON+R2iHrfoFBCQ/yX7i2atA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Linus Torvalds Subject: [PATCH 4.14 23/78] hex2bin: make the function hex_to_bin constant-time Date: Tue, 10 May 2022 15:07:09 +0200 Message-Id: <20220510130733.218279755@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit e5be15767e7e284351853cbaba80cde8620341fb upstream. The function hex2bin is used to load cryptographic keys into device mapper targets dm-crypt and dm-integrity. It should take constant time independent on the processed data, so that concurrently running unprivileged code can't infer any information about the keys via microarchitectural convert channels. This patch changes the function hex_to_bin so that it contains no branches and no memory accesses. Note that this shouldn't cause performance degradation because the size of the new function is the same as the size of the old function (on x86-64) - and the new function causes no branch misprediction penalties. I compile-tested this function with gcc on aarch64 alpha arm hppa hppa64 i386 ia64 m68k mips32 mips64 powerpc powerpc64 riscv sh4 s390x sparc32 sparc64 x86_64 and with clang on aarch64 arm hexagon i386 mips32 mips64 powerpc powerpc64 s390x sparc32 sparc64 x86_64 to verify that there are no branches in the generated code. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/linux/kernel.h | 2 +- lib/hexdump.c | 32 +++++++++++++++++++++++++------- 2 files changed, 26 insertions(+), 8 deletions(-) --- a/include/linux/kernel.h +++ b/include/linux/kernel.h @@ -582,7 +582,7 @@ static inline char *hex_byte_pack_upper( return buf; } =20 -extern int hex_to_bin(char ch); +extern int hex_to_bin(unsigned char ch); extern int __must_check hex2bin(u8 *dst, const char *src, size_t count); extern char *bin2hex(char *dst, const void *src, size_t count); =20 --- a/lib/hexdump.c +++ b/lib/hexdump.c @@ -25,15 +25,33 @@ EXPORT_SYMBOL(hex_asc_upper); * * hex_to_bin() converts one hex digit to its actual value or -1 in case o= f bad * input. + * + * This function is used to load cryptographic keys, so it is coded in suc= h a + * way that there are no conditions or memory accesses that depend on data. + * + * Explanation of the logic: + * (ch - '9' - 1) is negative if ch <=3D '9' + * ('0' - 1 - ch) is negative if ch >=3D '0' + * we "and" these two values, so the result is negative if ch is in the ra= nge + * '0' ... '9' + * we are only interested in the sign, so we do a shift ">> 8"; note that = right + * shift of a negative value is implementation-defined, so we cast the + * value to (unsigned) before the shift --- we have 0xffffff if ch is in + * the range '0' ... '9', 0 otherwise + * we "and" this value with (ch - '0' + 1) --- we have a value 1 ... 10 if= ch is + * in the range '0' ... '9', 0 otherwise + * we add this value to -1 --- we have a value 0 ... 9 if ch is in the ran= ge '0' + * ... '9', -1 otherwise + * the next line is similar to the previous one, but we need to decode both + * uppercase and lowercase letters, so we use (ch & 0xdf), which converts + * lowercase to uppercase */ -int hex_to_bin(char ch) +int hex_to_bin(unsigned char ch) { - if ((ch >=3D '0') && (ch <=3D '9')) - return ch - '0'; - ch =3D tolower(ch); - if ((ch >=3D 'a') && (ch <=3D 'f')) - return ch - 'a' + 10; - return -1; + unsigned char cu =3D ch & 0xdf; + return -1 + + ((ch - '0' + 1) & (unsigned)((ch - '9' - 1) & ('0' - 1 - ch)) >> 8) + + ((cu - 'A' + 11) & (unsigned)((cu - 'F' - 1) & ('A' - 1 - cu)) >> 8); } EXPORT_SYMBOL(hex_to_bin); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D350C433F5 for ; Tue, 10 May 2022 13:20:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241965AbiEJNYZ (ORCPT ); Tue, 10 May 2022 09:24:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59628 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243114AbiEJNVf (ORCPT ); Tue, 10 May 2022 09:21:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ADEC42C13E3; Tue, 10 May 2022 06:14:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A85A1B81CE7; Tue, 10 May 2022 13:14:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 205E0C385C2; Tue, 10 May 2022 13:14:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188488; bh=YI5UjmM43NAUlBOvm8tcF0gqikdn9+lJvBigtD/JjAc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GR546NNqOfdGiJhovY+nHCMqRpOSlwSEnq/ts0gqn5Yf/nhAv/wRPhvjzjxxQSX3k TTLWCRMimT+6jN1heBvgNls5F7IAxKWXW/ItsFI3eqiJR6JZjDz2NG6EqZI8iXy3jB +/xgecUiW5koYsPD9907WMXJ2dk5wZEUhIO/JHlc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Andy Shevchenko , Linus Torvalds Subject: [PATCH 4.14 24/78] hex2bin: fix access beyond string end Date: Tue, 10 May 2022 15:07:10 +0200 Message-Id: <20220510130733.247460246@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit e4d8a29997731b3bb14059024b24df9f784288d0 upstream. If we pass too short string to "hex2bin" (and the string size without the terminating NUL character is even), "hex2bin" reads one byte after the terminating NUL character. This patch fixes it. Note that hex_to_bin returns -1 on error and hex2bin return -EINVAL on error - so we can't just return the variable "hi" or "lo" on error. This inconsistency may be fixed in the next merge window, but for the purpose of fixing this bug, we just preserve the existing behavior and return -1 and -EINVAL. Signed-off-by: Mikulas Patocka Reviewed-by: Andy Shevchenko Fixes: b78049831ffe ("lib: add error checking to hex2bin") Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- lib/hexdump.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/lib/hexdump.c +++ b/lib/hexdump.c @@ -66,10 +66,13 @@ EXPORT_SYMBOL(hex_to_bin); int hex2bin(u8 *dst, const char *src, size_t count) { while (count--) { - int hi =3D hex_to_bin(*src++); - int lo =3D hex_to_bin(*src++); + int hi, lo; =20 - if ((hi < 0) || (lo < 0)) + hi =3D hex_to_bin(*src++); + if (unlikely(hi < 0)) + return -EINVAL; + lo =3D hex_to_bin(*src++); + if (unlikely(lo < 0)) return -EINVAL; =20 *dst++ =3D (hi << 4) | lo; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A940FC433F5 for ; Tue, 10 May 2022 13:20:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242712AbiEJNYe (ORCPT ); Tue, 10 May 2022 09:24:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45998 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243144AbiEJNVg (ORCPT ); Tue, 10 May 2022 09:21:36 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E7992C1807; Tue, 10 May 2022 06:14:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F06DFB81DA0; Tue, 10 May 2022 13:14:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31E3DC385C2; Tue, 10 May 2022 13:14:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188491; bh=bbuB3klp7gBXlXc0HvRVG1HXiaFEo6yFGRcr8AS1H2s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jpu7+xTzQxq6gSwltFljRhsNBkbJuZl9rGLCAOtnBCDdPe7pVm90KOQgKtRnEOEDm thtgJdRkj2UmHjmgToqN6W7jzHg+p4qsMeD9mI4MNLGx1d3J0BPV3rhntpM8QBFhbz h75baZ+WHE79Apo8a23UvczNjx08pLizJe84JGtQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peter Chen , Weitao Wang , Mathias Nyman , Sasha Levin Subject: [PATCH 4.14 25/78] USB: Fix xhci event ring dequeue pointer ERDP update issue Date: Tue, 10 May 2022 15:07:11 +0200 Message-Id: <20220510130733.276202420@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Weitao Wang [ Upstream commit e91ac20889d1a26d077cc511365cd7ff4346a6f3 ] In some situations software handles TRB events slower than adding TRBs. If the number of TRB events to be processed in a given interrupt is exactly the same as the event ring size 256, then the local variable "event_ring_deq" that holds the initial dequeue position is equal to software_dequeue after handling all 256 interrupts. It will cause driver to not update ERDP to hardware, Software dequeue pointer is out of sync with ERDP on interrupt exit. On the next interrupt, the event ring may full but driver will not update ERDP as software_dequeue is equal to ERDP. [ 536.377115] xhci_hcd 0000:00:12.0: ERROR unknown event type 37 [ 566.933173] sd 8:0:0:0: [sdb] tag#27 uas_eh_abort_handler 0 uas-tag 7 in= flight: CMD OUT [ 566.933181] sd 8:0:0:0: [sdb] tag#27 CDB: Write(10) 2a 00 17 71 e6 78 00= 00 08 00 [ 572.041186] xhci_hcd On some situataions,the0000:00:12.0: xHCI host not = responding to stop endpoint command. [ 572.057193] xhci_hcd 0000:00:12.0: Host halt failed, -110 [ 572.057196] xhci_hcd 0000:00:12.0: xHCI host controller not responding, = assume dead [ 572.057236] sd 8:0:0:0: [sdb] tag#26 uas_eh_abort_handler 0 uas-tag 6 in= flight: CMD [ 572.057240] sd 8:0:0:0: [sdb] tag#26 CDB: Write(10) 2a 00 38 eb cc d8 00= 00 08 00 [ 572.057244] sd 8:0:0:0: [sdb] tag#25 uas_eh_abort_handler 0 uas-tag 5 in= flight: CMD Hardware ERDP is updated mid event handling if there are more than 128 events in an interrupt (half of ring size). Fix this by updating the software local variable at the same time as hardware ERDP. [commit message rewording -Mathias] Fixes: dc0ffbea5729 ("usb: host: xhci: update event ring dequeue pointer on= purpose") Reviewed-by: Peter Chen Signed-off-by: Weitao Wang Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220408134823.2527272-2-mathias.nyman@linu= x.intel.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/host/xhci-ring.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 681d5bb99d99..9f49649f1df5 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2921,6 +2921,8 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (event_loop++ < TRBS_PER_SEGMENT / 2) continue; xhci_update_erst_dequeue(xhci, event_ring_deq); + event_ring_deq =3D xhci->event_ring->dequeue; + event_loop =3D 0; } =20 --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2587BC433EF for ; Tue, 10 May 2022 13:20:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242742AbiEJNYm (ORCPT ); Tue, 10 May 2022 09:24:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58814 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243162AbiEJNVh (ORCPT ); Tue, 10 May 2022 09:21:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 67DB6579B6; Tue, 10 May 2022 06:14:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BC942B81B32; Tue, 10 May 2022 13:14:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA8A0C385C2; Tue, 10 May 2022 13:14:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188495; bh=+mMHRRKrQHamkN6Ya6mXon/4x8LvbSJ7PD4Lv5wUly8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z78dg3w+pZ4a8pQ0eubpejPsSbstSe/jm9wQjEinKjhYF57U7pCMOk5ZP+90DpuwS K6biZcReszI0pJ1FSzKhPW47PZTQ9Pyj7T05Z/M1//sFU62XlHz9MVguBUd63/ABLf Xj6BuUHVFMCFzQcwffAI98mDhANUqb5Rwh4mHuFU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Fabio Estevam , Tim Harvey , Max Krummenacher , Shawn Guo , Sasha Levin Subject: [PATCH 4.14 26/78] ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue Date: Tue, 10 May 2022 15:07:12 +0200 Message-Id: <20220510130733.309672319@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Fabio Estevam [ Upstream commit fa51e1dc4b91375bc18349663a52395ad585bd3c ] On a custom carrier board with a i.MX6Q Apalis SoM, the sgtl5000 codec on the SoM is often not detected and the following error message is seen when the sgtl5000 driver tries to read the ID register: sgtl5000 1-000a: Error reading chip id -6 The reason for the error is that the MCLK clock is not provided early enough. Fix the problem by describing the MCLK pinctrl inside the codec node instead of placing it inside the audmux pinctrl group. With this change applied the sgtl5000 is always detected on every boot. Fixes: 693e3ffaae5a ("ARM: dts: imx6: Add support for Toradex Apalis iMX6Q/= D SoM") Signed-off-by: Fabio Estevam Reviewed-by: Tim Harvey Acked-by: Max Krummenacher Signed-off-by: Shawn Guo Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/boot/dts/imx6qdl-apalis.dtsi | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm/boot/dts/imx6qdl-apalis.dtsi b/arch/arm/boot/dts/imx6= qdl-apalis.dtsi index ea339fa58f4a..2477883c0efb 100644 --- a/arch/arm/boot/dts/imx6qdl-apalis.dtsi +++ b/arch/arm/boot/dts/imx6qdl-apalis.dtsi @@ -316,6 +316,8 @@ vgen6_reg: vgen6 { codec: sgtl5000@0a { compatible =3D "fsl,sgtl5000"; reg =3D <0x0a>; + pinctrl-names =3D "default"; + pinctrl-0 =3D <&pinctrl_sgtl5000>; clocks =3D <&clks IMX6QDL_CLK_CKO>; VDDA-supply =3D <®_2p5v>; VDDIO-supply =3D <®_3p3v>; @@ -543,8 +545,6 @@ MX6QDL_PAD_DISP0_DAT20__AUD4_TXC 0x130b0 MX6QDL_PAD_DISP0_DAT21__AUD4_TXD 0x130b0 MX6QDL_PAD_DISP0_DAT22__AUD4_TXFS 0x130b0 MX6QDL_PAD_DISP0_DAT23__AUD4_RXD 0x130b0 - /* SGTL5000 sys_mclk */ - MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 >; }; =20 @@ -810,6 +810,12 @@ MX6QDL_PAD_NANDF_CS1__GPIO6_IO14 0x000b0 >; }; =20 + pinctrl_sgtl5000: sgtl5000grp { + fsl,pins =3D < + MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 + >; + }; + pinctrl_spdif: spdifgrp { fsl,pins =3D < MX6QDL_PAD_GPIO_16__SPDIF_IN 0x1b0b0 --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 72985C433EF for ; Tue, 10 May 2022 13:20:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242749AbiEJNYp (ORCPT ); Tue, 10 May 2022 09:24:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38496 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243189AbiEJNVi (ORCPT ); Tue, 10 May 2022 09:21:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9F4155A0B1; Tue, 10 May 2022 06:15:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B67B6B81DA4; Tue, 10 May 2022 13:14:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13A7AC385C2; Tue, 10 May 2022 13:14:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188498; bh=pz8zjZPWrbsGCPy0NPZ+4qZXWpmaB0sZuWf9cMya9uU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jIxWpzBfykGzxT5p5cjk9CC1sePHSojML9zMqx50Q0h2xPZHW2/F1QbRzh11H2/Xg 86kcdZu9+3xdPmuvzD9pMxtxQRXYDHsBH9dfI0Q+aWF3zK9Ys+bOnqkQeDsZZMV5Rs W203EmXT9zQmLHNCfSuji1HZjL4u/Qgic+8hnnF0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Krzysztof Kozlowski , Vinod Koul , Sasha Levin Subject: [PATCH 4.14 27/78] phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe Date: Tue, 10 May 2022 15:07:13 +0200 Message-Id: <20220510130733.339939152@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 388ec8f079f2f20d5cd183c3bc6f33cbc3ffd3ef ] The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done. Fixes: bcff4cba41bc ("PHY: Exynos: Add Exynos5250 SATA PHY driver") Signed-off-by: Miaoqian Lin Reviewed-by: Krzysztof Kozlowski Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220407091857.230386-1-krzysztof.kozlowski= @linaro.org Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/phy/samsung/phy-exynos5250-sata.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/phy/samsung/phy-exynos5250-sata.c b/drivers/phy/samsun= g/phy-exynos5250-sata.c index 60e13afcd9b8..7960c69d09a6 100644 --- a/drivers/phy/samsung/phy-exynos5250-sata.c +++ b/drivers/phy/samsung/phy-exynos5250-sata.c @@ -193,6 +193,7 @@ static int exynos_sata_phy_probe(struct platform_device= *pdev) return -EINVAL; =20 sata_phy->client =3D of_find_i2c_device_by_node(node); + of_node_put(node); if (!sata_phy->client) return -EPROBE_DEFER; =20 --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13BA8C433F5 for ; Tue, 10 May 2022 13:28:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243512AbiEJNbK (ORCPT ); Tue, 10 May 2022 09:31:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38560 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243188AbiEJNVi (ORCPT ); Tue, 10 May 2022 09:21:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 319BE5AEF9; Tue, 10 May 2022 06:15:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D9C68B81DA3; Tue, 10 May 2022 13:15:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0D0ECC385A6; Tue, 10 May 2022 13:15:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188501; bh=yLrBDSoik5lYxYHt4/zuvrMAWSDosPSALRSAGfIGK3E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HlJzecGdyOsWmuwWW+doDjwGyTHPIcNu6yFeqUCQw+L80XfG5Ypt1CipEasrfDnqr aOU29uzA/TZMZZTc9zG4I/2bYy3cJajyH3VF8/q4B2Xw7uR8QYEGcfqwqKlLnCZCeB wBgHhnS43X4VW8R6DvMxI8syoLCVvfO1xVTvbBdw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , Alim Akhtar , Vinod Koul , Sasha Levin Subject: [PATCH 4.14 28/78] phy: samsung: exynos5250-sata: fix missing device put in probe error paths Date: Tue, 10 May 2022 15:07:14 +0200 Message-Id: <20220510130733.368696836@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski [ Upstream commit 5c8402c4db45dd55c2c93c8d730f5dfa7c78a702 ] The actions of of_find_i2c_device_by_node() in probe function should be reversed in error paths by putting the reference to obtained device. Fixes: bcff4cba41bc ("PHY: Exynos: Add Exynos5250 SATA PHY driver") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20220407091857.230386-2-krzysztof.kozlowski= @linaro.org Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/phy/samsung/phy-exynos5250-sata.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/phy/samsung/phy-exynos5250-sata.c b/drivers/phy/samsun= g/phy-exynos5250-sata.c index 7960c69d09a6..2c39d2fd3cd8 100644 --- a/drivers/phy/samsung/phy-exynos5250-sata.c +++ b/drivers/phy/samsung/phy-exynos5250-sata.c @@ -202,20 +202,21 @@ static int exynos_sata_phy_probe(struct platform_devi= ce *pdev) sata_phy->phyclk =3D devm_clk_get(dev, "sata_phyctrl"); if (IS_ERR(sata_phy->phyclk)) { dev_err(dev, "failed to get clk for PHY\n"); - return PTR_ERR(sata_phy->phyclk); + ret =3D PTR_ERR(sata_phy->phyclk); + goto put_dev; } =20 ret =3D clk_prepare_enable(sata_phy->phyclk); if (ret < 0) { dev_err(dev, "failed to enable source clk\n"); - return ret; + goto put_dev; } =20 sata_phy->phy =3D devm_phy_create(dev, NULL, &exynos_sata_phy_ops); if (IS_ERR(sata_phy->phy)) { - clk_disable_unprepare(sata_phy->phyclk); dev_err(dev, "failed to create PHY\n"); - return PTR_ERR(sata_phy->phy); + ret =3D PTR_ERR(sata_phy->phy); + goto clk_disable; } =20 phy_set_drvdata(sata_phy->phy, sata_phy); @@ -223,11 +224,18 @@ static int exynos_sata_phy_probe(struct platform_devi= ce *pdev) phy_provider =3D devm_of_phy_provider_register(dev, of_phy_simple_xlate); if (IS_ERR(phy_provider)) { - clk_disable_unprepare(sata_phy->phyclk); - return PTR_ERR(phy_provider); + ret =3D PTR_ERR(phy_provider); + goto clk_disable; } =20 return 0; + +clk_disable: + clk_disable_unprepare(sata_phy->phyclk); +put_dev: + put_device(&sata_phy->client->dev); + + return ret; } =20 static const struct of_device_id exynos_sata_phy_of_match[] =3D { --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EBEEAC433F5 for ; Tue, 10 May 2022 13:24:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237996AbiEJN2j (ORCPT ); Tue, 10 May 2022 09:28:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45968 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243231AbiEJNVk (ORCPT ); Tue, 10 May 2022 09:21:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A16DF2C3345; Tue, 10 May 2022 06:15:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 90E66B81DA6; Tue, 10 May 2022 13:15:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC2EEC385A6; Tue, 10 May 2022 13:15:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188504; bh=rBjHofO1WNs/cYxljno5UdrSN3KrNADHJN7VZG+ibug=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RAHxRnG4wkEDLVkRZwvDGbtqyTol01tUXpRAq45vnLqH8ZzwHtrJKjmOhIkOc3RBa JrLbFEM/oaOzjZXY96MLOVOiBU7sRPLBehPGqKKDPd6gCODv2KAtwxdOhR3slB2QTT nGD5veBV7ijpYt14uKYHePOW2YG7BlfFz5dpd7IU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Tony Lindgren , Sasha Levin Subject: [PATCH 4.14 29/78] ARM: OMAP2+: Fix refcount leak in omap_gic_of_init Date: Tue, 10 May 2022 15:07:15 +0200 Message-Id: <20220510130733.398424783@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 0f83e6b4161617014017a694888dd8743f46f071 ] The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_node_put() to release the refcount. Fixes: fd1c07861491 ("ARM: OMAP4: Fix the init code to have OMAP4460 errata= available in DT build") Signed-off-by: Miaoqian Lin Message-Id: <20220309104302.18398-1-linmq006@gmail.com> Signed-off-by: Tony Lindgren Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/mach-omap2/omap4-common.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4= -common.c index e5dcbda20129..7fff67ea7bcd 100644 --- a/arch/arm/mach-omap2/omap4-common.c +++ b/arch/arm/mach-omap2/omap4-common.c @@ -342,10 +342,12 @@ void __init omap_gic_of_init(void) =20 np =3D of_find_compatible_node(NULL, NULL, "arm,cortex-a9-gic"); gic_dist_base_addr =3D of_iomap(np, 0); + of_node_put(np); WARN_ON(!gic_dist_base_addr); =20 np =3D of_find_compatible_node(NULL, NULL, "arm,cortex-a9-twd-timer"); twd_base =3D of_iomap(np, 0); + of_node_put(np); WARN_ON(!twd_base); =20 skip_errata_init: --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 826EEC433EF for ; Tue, 10 May 2022 13:21:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242854AbiEJNZK (ORCPT ); Tue, 10 May 2022 09:25:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243289AbiEJNVq (ORCPT ); Tue, 10 May 2022 09:21:46 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6F6D42C336B; Tue, 10 May 2022 06:15:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F33DF6123F; Tue, 10 May 2022 13:15:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0AD81C385A6; Tue, 10 May 2022 13:15:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188510; bh=lwwCpzWHUUhleWMxpvTZOhW5QOtkJCzvcj55PnUh7gQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gm2NPsmSCHIa0wRmEqkkChzl/h0xVa2vyQ4hBKW82/I/wx9/MUM6UDh0gJYt3R9/+ wlBo7l/dRw+KQ+UfgkNlsKH2PuEJs1RTYVXnhm7GtjommHe/z+5qyUVb2TWTD1Munh B5TNR+eZCStmGEhPe9yYT1SW7aPaqUC8srEiEaTA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "H. Nikolaus Schaller" , Tony Lindgren , Sasha Levin Subject: [PATCH 4.14 30/78] ARM: dts: Fix mmc order for omap3-gta04 Date: Tue, 10 May 2022 15:07:16 +0200 Message-Id: <20220510130733.427851952@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: H. Nikolaus Schaller [ Upstream commit 09269dd050094593fc747f2a5853d189fefcb6b5 ] Commit a1ebdb374199 ("ARM: dts: Fix swapped mmc order for omap3") introduces general mmc aliases. Let's tailor them to the need of the GTA04 board which does not make use of mmc2 and mmc3 interfaces. Fixes: a1ebdb374199 ("ARM: dts: Fix swapped mmc order for omap3") Signed-off-by: H. Nikolaus Schaller Message-Id: Signed-off-by: Tony Lindgren Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/boot/dts/omap3-gta04.dtsi | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-g= ta04.dtsi index ee028aa663fa..312267724033 100644 --- a/arch/arm/boot/dts/omap3-gta04.dtsi +++ b/arch/arm/boot/dts/omap3-gta04.dtsi @@ -29,6 +29,8 @@ memory@80000000 { aliases { display0 =3D &lcd; display1 =3D &tv0; + /delete-property/ mmc2; + /delete-property/ mmc3; }; =20 gpio-keys { --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99BBEC433F5 for ; Tue, 10 May 2022 13:24:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243144AbiEJN2q (ORCPT ); Tue, 10 May 2022 09:28:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45996 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243230AbiEJNVk (ORCPT ); Tue, 10 May 2022 09:21:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3A7B62C13E8; Tue, 10 May 2022 06:15:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9A42EB81DAD; Tue, 10 May 2022 13:15:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12861C385C9; Tue, 10 May 2022 13:15:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188513; bh=MuIvfaTM07t+T9RBGkEc4AaN7NAIGZmeD96/gTWB/1E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LxheHAH5OvLh5grDvSURsNXmd1UHsw586bmqKiyDt6f/H4hfBJBHt4HhKiV9Og+Zz 7bwoAWYcH+Y3T7EI/E+AmDtWdIZ2fTmvnvKJq3DGUwo5mOMVNUAgw4k/KmU/WAuZoz VWTEQdZQNZ9NzxTLxCvw2NzwXX0L6uHh22BR/6t8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pengcheng Yang , Julian Anastasov , Simon Horman , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.14 31/78] ipvs: correctly print the memory size of ip_vs_conn_tab Date: Tue, 10 May 2022 15:07:17 +0200 Message-Id: <20220510130733.457399420@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pengcheng Yang [ Upstream commit eba1a872cb73314280d5448d934935b23e30b7ca ] The memory size of ip_vs_conn_tab changed after we use hlist instead of list. Fixes: 731109e78415 ("ipvs: use hlist instead of list") Signed-off-by: Pengcheng Yang Acked-by: Julian Anastasov Acked-by: Simon Horman Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/netfilter/ipvs/ip_vs_conn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_con= n.c index 620c865c230b..1ecce76bc266 100644 --- a/net/netfilter/ipvs/ip_vs_conn.c +++ b/net/netfilter/ipvs/ip_vs_conn.c @@ -1432,7 +1432,7 @@ int __init ip_vs_conn_init(void) pr_info("Connection hash table configured " "(size=3D%d, memory=3D%ldKbytes)\n", ip_vs_conn_tab_size, - (long)(ip_vs_conn_tab_size*sizeof(struct list_head))/1024); + (long)(ip_vs_conn_tab_size*sizeof(*ip_vs_conn_tab))/1024); IP_VS_DBG(0, "Each connection entry needs %zd bytes at least\n", sizeof(struct ip_vs_conn)); =20 --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EA50C433F5 for ; Tue, 10 May 2022 13:30:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243468AbiEJNe2 (ORCPT ); Tue, 10 May 2022 09:34:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60968 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242904AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DC3D11F92A4; Tue, 10 May 2022 06:17:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 5C119CE1E67; Tue, 10 May 2022 13:17:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6CA5CC385C6; Tue, 10 May 2022 13:17:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188668; bh=WmU0JrNCPKKDk0egiaa5q5KGJgNq4xSZSHdSFEerGvw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PPlEnqSoMx94214zBzKEiGcNe1xIrXjL2sENyqiSpDTukNZKvzsll2yVoTDJtomDU AIhmaM23wqczcV94c4SfDIvpktRa3yGhKqo6tLDtRoWxRRHgyBskUuytk2a3ETQ/Cq wupYLsnsjVWMV862fSboPwwXLztSjUrFqJaJwk4k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Miquel Raynal , Sasha Levin Subject: [PATCH 4.14 32/78] mtd: rawnand: Fix return value check of wait_for_completion_timeout Date: Tue, 10 May 2022 15:07:18 +0200 Message-Id: <20220510130733.486432722@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 084c16ab423a8890121b902b405823bfec5b4365 ] wait_for_completion_timeout() returns unsigned long not int. It returns 0 if timed out, and positive if completed. The check for <=3D 0 is ambiguous and should be =3D=3D 0 here indicating timeout which is the only error case. Fixes: 83738d87e3a0 ("mtd: sh_flctl: Add DMA capabilty") Signed-off-by: Miaoqian Lin Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220412083435.29254-1-linmq006@gma= il.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/mtd/nand/sh_flctl.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c index f2ed03ee3035..eac65aff5401 100644 --- a/drivers/mtd/nand/sh_flctl.c +++ b/drivers/mtd/nand/sh_flctl.c @@ -399,7 +399,8 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *fl= ctl, unsigned long *buf, dma_addr_t dma_addr; dma_cookie_t cookie; uint32_t reg; - int ret; + int ret =3D 0; + unsigned long time_left; =20 if (dir =3D=3D DMA_FROM_DEVICE) { chan =3D flctl->chan_fifo0_rx; @@ -440,13 +441,14 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *= flctl, unsigned long *buf, goto out; } =20 - ret =3D + time_left =3D wait_for_completion_timeout(&flctl->dma_complete, msecs_to_jiffies(3000)); =20 - if (ret <=3D 0) { + if (time_left =3D=3D 0) { dmaengine_terminate_all(chan); dev_err(&flctl->pdev->dev, "wait_for_completion_timeout\n"); + ret =3D -ETIMEDOUT; } =20 out: @@ -456,7 +458,7 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *fl= ctl, unsigned long *buf, =20 dma_unmap_single(chan->device->dev, dma_addr, len, dir); =20 - /* ret > 0 is success */ + /* ret =3D=3D 0 is success */ return ret; } =20 @@ -480,7 +482,7 @@ static void read_fiforeg(struct sh_flctl *flctl, int rl= en, int offset) =20 /* initiate DMA transfer */ if (flctl->chan_fifo0_rx && rlen >=3D 32 && - flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE) > 0) + !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE)) goto convert; /* DMA success */ =20 /* do polling transfer */ @@ -539,7 +541,7 @@ static void write_ec_fiforeg(struct sh_flctl *flctl, in= t rlen, =20 /* initiate DMA transfer */ if (flctl->chan_fifo0_tx && rlen >=3D 32 && - flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE) > 0) + !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE)) return; /* DMA success */ =20 /* do polling transfer */ --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6AE14C4332F for ; Tue, 10 May 2022 13:21:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238558AbiEJNZY (ORCPT ); Tue, 10 May 2022 09:25:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45976 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243339AbiEJNVs (ORCPT ); Tue, 10 May 2022 09:21:48 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B97EE32079; Tue, 10 May 2022 06:15:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 543CD6166C; Tue, 10 May 2022 13:15:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69E6FC385A6; Tue, 10 May 2022 13:15:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188538; bh=36p3854PZ7hZDvZb9kEHObmWlzU8+m1CZyy2hKINlLY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vota2cn3Cti+vFYbuuK+5xm1ZLLaURGuXJ28YEiZ30tcQezkY+o4Q+zHIl8PTUrEp C+ZfQ975EhQvXMBzolupieVEVvs3tux7EO2F85vSjSF8rKiNx2aZpsgkZe7eRf15Xd MMkS75dmHLY20GbfpXry8i2m5MM1xnMZEBU9lg/U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ying Xu , Xin Long , Marcelo Ricardo Leitner , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 33/78] sctp: check asoc strreset_chunk in sctp_generate_reconf_event Date: Tue, 10 May 2022 15:07:19 +0200 Message-Id: <20220510130733.515442574@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xin Long [ Upstream commit 165e3e17fe8fe6a8aab319bc6e631a2e23b9a857 ] A null pointer reference issue can be triggered when the response of a stream reconf request arrives after the timer is triggered, such as: send Incoming SSN Reset Request ---> CPU0: reconf timer is triggered, go to the handler code before hold sk lock <--- reply with Outgoing SSN Reset Request CPU1: process Outgoing SSN Reset Request, and set asoc->strreset_chunk to NULL CPU0: continue the handler code, hold sk lock, and try to hold asoc->strreset_chunk, crash! In Ying Xu's testing, the call trace is: [ ] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ ] RIP: 0010:sctp_chunk_hold+0xe/0x40 [sctp] [ ] Call Trace: [ ] [ ] sctp_sf_send_reconf+0x2c/0x100 [sctp] [ ] sctp_do_sm+0xa4/0x220 [sctp] [ ] sctp_generate_reconf_event+0xbd/0xe0 [sctp] [ ] call_timer_fn+0x26/0x130 This patch is to fix it by returning from the timer handler if asoc strreset_chunk is already set to NULL. Fixes: 7b9438de0cd4 ("sctp: add stream reconf timer") Reported-by: Ying Xu Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sctp/sm_sideeffect.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c index 1a1128355d86..169819263c0b 100644 --- a/net/sctp/sm_sideeffect.c +++ b/net/sctp/sm_sideeffect.c @@ -456,6 +456,10 @@ void sctp_generate_reconf_event(unsigned long data) goto out_unlock; } =20 + /* This happens when the response arrives after the timer is triggered. */ + if (!asoc->strreset_chunk) + goto out_unlock; + error =3D sctp_do_sm(net, SCTP_EVENT_T_TIMEOUT, SCTP_ST_TIMEOUT(SCTP_EVENT_TIMEOUT_RECONF), asoc->state, asoc->ep, asoc, --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC79AC4332F for ; Tue, 10 May 2022 13:23:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243147AbiEJN0E (ORCPT ); Tue, 10 May 2022 09:26:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45998 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243510AbiEJNWA (ORCPT ); Tue, 10 May 2022 09:22:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 29C91517CB; Tue, 10 May 2022 06:16:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6C5D16166C; Tue, 10 May 2022 13:16:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7C827C385A6; Tue, 10 May 2022 13:16:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188572; bh=SkicZJaon+6r860YY3xSembF7T/c32xtoZ769rYVxNU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZWVuQKDwkLH8lU3MYgqYcKyxir/ixrVwmA7hE65AD90U3Ov3/nNDyAFQVGu8bHn0Q 6CrN4NKMEIvVNIctgjULRSoY6nDmNuU79ptOLGqjSLPtDksrmtEvWfq5PrBxcJJMR8 O2Ju7/hzXQKxvBVn3bn3Ce1+p3OQ2RkFIv7eT4dM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zeal Robot , Lv Ruyi , Linus Walleij , Sasha Levin Subject: [PATCH 4.14 34/78] pinctrl: pistachio: fix use of irq_of_parse_and_map() Date: Tue, 10 May 2022 15:07:20 +0200 Message-Id: <20220510130733.545079332@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lv Ruyi [ Upstream commit 0c9843a74a85224a89daa81fa66891dae2f930e1 ] The irq_of_parse_and_map() function returns 0 on failure, and does not return an negative value. Fixes: cefc03e5995e ("pinctrl: Add Pistachio SoC pin control driver") Reported-by: Zeal Robot Signed-off-by: Lv Ruyi Link: https://lore.kernel.org/r/20220424031430.3170759-1-lv.ruyi@zte.com.cn Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/pinctrl/pinctrl-pistachio.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-= pistachio.c index b2b7e238bda9..fc8c57527fb7 100644 --- a/drivers/pinctrl/pinctrl-pistachio.c +++ b/drivers/pinctrl/pinctrl-pistachio.c @@ -1374,10 +1374,10 @@ static int pistachio_gpio_register(struct pistachio= _pinctrl *pctl) } =20 irq =3D irq_of_parse_and_map(child, 0); - if (irq < 0) { - dev_err(pctl->dev, "No IRQ for bank %u: %d\n", i, irq); + if (!irq) { + dev_err(pctl->dev, "No IRQ for bank %u\n", i); of_node_put(child); - ret =3D irq; + ret =3D -EINVAL; goto err; } =20 --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B0C25C433EF for ; Tue, 10 May 2022 13:26:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243245AbiEJNaM (ORCPT ); Tue, 10 May 2022 09:30:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60930 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243742AbiEJNWW (ORCPT ); Tue, 10 May 2022 09:22:22 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A28D113F93D; Tue, 10 May 2022 06:16:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 56F9D61574; Tue, 10 May 2022 13:16:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5CD78C385A6; Tue, 10 May 2022 13:16:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188605; bh=Aguhp1BFM4cMbxLn8rL9GAdEBOd9nfdi2j6i0pTxaxk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KXeYDqHuTmue6lROai3I/48qXWVZzGKhLP5JdCt3FkTNg8RmLwgXtz7tlqIuGoI5I iYcTAs3gQ1jzPkoEzsV9WKD5tpLI+DuY99zyWIQnnSOaswWo8R5HzzsTQO/WCgUCjS v+8VdcC90JMnFb9P7wC1Uqwze2EdW15PcWK0j9fg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peilin Ye , William Tu , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 35/78] ip_gre: Make o_seqno start from 0 in native mode Date: Tue, 10 May 2022 15:07:21 +0200 Message-Id: <20220510130733.574189963@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peilin Ye [ Upstream commit ff827beb706ed719c766acf36449801ded0c17fc ] For GRE and GRETAP devices, currently o_seqno starts from 1 in native mode. According to RFC 2890 2.2., "The first datagram is sent with a sequence number of 0." Fix it. It is worth mentioning that o_seqno already starts from 0 in collect_md mode, see gre_fb_xmit(), where tunnel->o_seqno is passed to gre_build_header() before getting incremented. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Peilin Ye Acked-by: William Tu Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv4/ip_gre.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c index 1a4d89f8361c..d916accd9783 100644 --- a/net/ipv4/ip_gre.c +++ b/net/ipv4/ip_gre.c @@ -429,14 +429,12 @@ static void __gre_xmit(struct sk_buff *skb, struct ne= t_device *dev, __be16 proto) { struct ip_tunnel *tunnel =3D netdev_priv(dev); - - if (tunnel->parms.o_flags & TUNNEL_SEQ) - tunnel->o_seqno++; + __be16 flags =3D tunnel->parms.o_flags; =20 /* Push GRE header. */ gre_build_header(skb, tunnel->tun_hlen, - tunnel->parms.o_flags, proto, tunnel->parms.o_key, - htonl(tunnel->o_seqno)); + flags, proto, tunnel->parms.o_key, + (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); =20 ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol); } --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04C90C35296 for ; Tue, 10 May 2022 13:28:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243871AbiEJNcT (ORCPT ); Tue, 10 May 2022 09:32:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60506 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242920AbiEJNXV (ORCPT ); Tue, 10 May 2022 09:23:21 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 29EE71CD26B; Tue, 10 May 2022 06:17:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 28CE9615DD; Tue, 10 May 2022 13:17:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 308F3C385A6; Tue, 10 May 2022 13:17:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188638; bh=BQFoZ5VBAeVocPILsY8HgUmVw/RANqQGMeh9+kxbws4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=r1+1lXt0XyqhOZajeRTvpt8eeZq4940ZS5uym9IQd1fAczo3091EJjersw5I9+ljS U6T0vZwm8kKDYlwlHDvw7ci0sYOVVLWoXbmHWoOp76NX3wslxSysbc+bKE+rCuFt2W jKgRpFXuF7iML8ekaSYA8NOBHonHWzTfT3ucqFZs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Doug Porter , Soheil Hassas Yeganeh , Neal Cardwell , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 36/78] tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT Date: Tue, 10 May 2022 15:07:22 +0200 Message-Id: <20220510130733.604544525@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 4bfe744ff1644fbc0a991a2677dc874475dd6776 ] I had this bug sitting for too long in my pile, it is time to fix it. Thanks to Doug Porter for reminding me of it! We had various attempts in the past, including commit 0cbe6a8f089e ("tcp: remove SOCK_QUEUE_SHRUNK"), but the issue is that TCP stack currently only generates EPOLLOUT from input path, when tp->snd_una has advanced and skb(s) cleaned from rtx queue. If a flow has a big RTT, and/or receives SACKs, it is possible that the notsent part (tp->write_seq - tp->snd_nxt) reaches 0 and no more data can be sent until tp->snd_una finally advances. What is needed is to also check if POLLOUT needs to be generated whenever tp->snd_nxt is advanced, from output path. This bug triggers more often after an idle period, as we do not receive ACK for at least one RTT. tcp_notsent_lowat could be a fraction of what CWND and pacing rate would allow to send during this RTT. In a followup patch, I will remove the bogus call to tcp_chrono_stop(sk, TCP_CHRONO_SNDBUF_LIMITED) from tcp_check_space(). Fact that we have decided to generate an EPOLLOUT does not mean the application has immediately refilled the transmit queue. This optimistic call might have been the reason the bug seemed not too serious. Tested: 200 ms rtt, 1% packet loss, 32 MB tcp_rmem[2] and tcp_wmem[2] $ echo 500000 >/proc/sys/net/ipv4/tcp_notsent_lowat $ cat bench_rr.sh SUM=3D0 for i in {1..10} do V=3D`netperf -H remote_host -l30 -t TCP_RR -- -r 10000000,10000 -o LOCAL_B= YTES_SENT | egrep -v "MIGRATED|Bytes"` echo $V SUM=3D$(($SUM + $V)) done echo SUM=3D$SUM Before patch: $ bench_rr.sh 130000000 80000000 140000000 140000000 140000000 140000000 130000000 40000000 90000000 110000000 SUM=3D1140000000 After patch: $ bench_rr.sh 430000000 590000000 530000000 450000000 450000000 350000000 450000000 490000000 480000000 460000000 SUM=3D4680000000 # This is 410 % of the value before patch. Fixes: c9bee3b7fdec ("tcp: TCP_NOTSENT_LOWAT socket option") Signed-off-by: Eric Dumazet Reported-by: Doug Porter Cc: Soheil Hassas Yeganeh Cc: Neal Cardwell Acked-by: Soheil Hassas Yeganeh Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/net/tcp.h | 1 + net/ipv4/tcp_input.c | 12 +++++++++++- net/ipv4/tcp_output.c | 1 + 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index 4602959b58a1..181db7dab176 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -585,6 +585,7 @@ void tcp_synack_rtt_meas(struct sock *sk, struct reques= t_sock *req); void tcp_reset(struct sock *sk); void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *= skb); void tcp_fin(struct sock *sk); +void tcp_check_space(struct sock *sk); =20 /* tcp_timer.c */ void tcp_init_xmit_timers(struct sock *); diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 9382caeb721a..f5cc025003cd 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -5114,7 +5114,17 @@ static void tcp_new_space(struct sock *sk) sk->sk_write_space(sk); } =20 -static void tcp_check_space(struct sock *sk) +/* Caller made space either from: + * 1) Freeing skbs in rtx queues (after tp->snd_una has advanced) + * 2) Sent skbs from output queue (and thus advancing tp->snd_nxt) + * + * We might be able to generate EPOLLOUT to the application if: + * 1) Space consumed in output/rtx queues is below sk->sk_sndbuf/2 + * 2) notsent amount (tp->write_seq - tp->snd_nxt) became + * small enough that tcp_stream_memory_free() decides it + * is time to generate EPOLLOUT. + */ +void tcp_check_space(struct sock *sk) { if (sock_flag(sk, SOCK_QUEUE_SHRUNK)) { sock_reset_flag(sk, SOCK_QUEUE_SHRUNK); diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 83c0e859bb33..1a5c42c67d42 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -81,6 +81,7 @@ static void tcp_event_new_data_sent(struct sock *sk, cons= t struct sk_buff *skb) =20 NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT, tcp_skb_pcount(skb)); + tcp_check_space(sk); } =20 /* SND.NXT, if window was not shrunk or the amount of shrunk was less than= one --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17057C433FE for ; Tue, 10 May 2022 13:29:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243280AbiEJNdG (ORCPT ); Tue, 10 May 2022 09:33:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237431AbiEJNYv (ORCPT ); Tue, 10 May 2022 09:24:51 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E4D7E1DE543; Tue, 10 May 2022 06:17:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 765C9B81CE7; Tue, 10 May 2022 13:17:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C6364C385A6; Tue, 10 May 2022 13:17:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188654; bh=UIra3kRtMq6/pFL+lQMyzsAxAiUjlJL3RiOqVZl920o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Bzg4gm+lCm9L0BYfHZ/M/tpWX3xpTPybayLRkxw9NB6iHYQT3IefYVMPD268sm8bE I+mhn/yk4gmx+MYkT/FfYqMVzD/psV5n9q6KJp2fk09lK6KkWLqbFCbfBA7g/E3+B5 0kfMUJ4RnrRrGYVBmn7MZIi2zLLEL+/pbhaZTPus= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Samuel Holland , Jernej Skrabec , Sasha Levin Subject: [PATCH 4.14 37/78] bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() Date: Tue, 10 May 2022 15:07:23 +0200 Message-Id: <20220510130733.633544267@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET [ Upstream commit fff8c10368e64e7f8960f149375c12ca5f3b30af ] This code is really spurious. It always returns an ERR_PTR, even when err is known to be 0 and calls put_device() after a successful device_register() call. It is likely that the return statement in the normal path is missing. Add 'return rdev;' to fix it. Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced Seri= al Bus") Signed-off-by: Christophe JAILLET Reviewed-by: Samuel Holland Tested-by: Samuel Holland Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/ef2b9576350bba4c8e05e669e9535e9e2a415763.16= 50551719.git.christophe.jaillet@wanadoo.fr Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/bus/sunxi-rsb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c index 2ca2cc56bcef..b85d013a9185 100644 --- a/drivers/bus/sunxi-rsb.c +++ b/drivers/bus/sunxi-rsb.c @@ -224,6 +224,8 @@ static struct sunxi_rsb_device *sunxi_rsb_device_create= (struct sunxi_rsb *rsb, =20 dev_dbg(&rdev->dev, "device %s registered\n", dev_name(&rdev->dev)); =20 + return rdev; + err_device_add: put_device(&rdev->dev); =20 --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE575C433F5 for ; Tue, 10 May 2022 13:31:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243292AbiEJNfd (ORCPT ); Tue, 10 May 2022 09:35:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58404 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242815AbiEJNYv (ORCPT ); Tue, 10 May 2022 09:24:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 286911DF679; Tue, 10 May 2022 06:17:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B84326123F; Tue, 10 May 2022 13:17:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B0148C385C6; Tue, 10 May 2022 13:17:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188657; bh=MKudbu7vHv3XJ8MbvM3xZDs4i7yKHou2tCtg+kv73Gc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aMQ3H341tl95AD4z+mLnElCD9PTDjFMV9JbXvKdhNn6YWutHO1z3ZakDcJLbCx0ZP PGCzHNfxwnVJ0kS6jwMcHiWR93hOg69pH8+C/CXr5otJWnAQ/25X8h+RcrLUvl0jEj nd8GlBlNZCMBav6wYe9bijjLhdc+5Hl5tznT4Nmw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Yingliang , Samuel Holland , Jernej Skrabec , Sasha Levin Subject: [PATCH 4.14 38/78] clk: sunxi: sun9i-mmc: check return value after calling platform_get_resource() Date: Tue, 10 May 2022 15:07:24 +0200 Message-Id: <20220510130733.661922005@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang [ Upstream commit f58ca215cda1975f77b2b762903684a3c101bec9 ] It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Fixes: 7a6fca879f59 ("clk: sunxi: Add driver for A80 MMC config clocks/rese= ts") Signed-off-by: Yang Yingliang Reviewed-by: Samuel Holland Signed-off-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220421134308.2885094-1-yangyingliang@huaw= ei.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/clk/sunxi/clk-sun9i-mmc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/clk/sunxi/clk-sun9i-mmc.c b/drivers/clk/sunxi/clk-sun9= i-mmc.c index f69f9e8c6f38..7e9d1624032f 100644 --- a/drivers/clk/sunxi/clk-sun9i-mmc.c +++ b/drivers/clk/sunxi/clk-sun9i-mmc.c @@ -117,6 +117,8 @@ static int sun9i_a80_mmc_config_clk_probe(struct platfo= rm_device *pdev) spin_lock_init(&data->lock); =20 r =3D platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (!r) + return -EINVAL; /* one clock/reset pair per word */ count =3D DIV_ROUND_UP((resource_size(r)), SUN9I_MMC_WIDTH); data->membase =3D devm_ioremap_resource(&pdev->dev, r); --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BFD08C433F5 for ; Tue, 10 May 2022 13:31:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243360AbiEJNfk (ORCPT ); Tue, 10 May 2022 09:35:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47300 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242819AbiEJNYv (ORCPT ); Tue, 10 May 2022 09:24:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 258B254BCA; Tue, 10 May 2022 06:17:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B40716123F; Tue, 10 May 2022 13:17:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B8A4EC385C6; Tue, 10 May 2022 13:17:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188660; bh=9WcJbyhKyfzGMsCcZQ0zZD8M8VKozBDleT5fSmyAk5c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CLsHXNbUTnNOobZ2FNu4Q2GYCu9bGpkhJffqnZBfHknQPXITejIVhoehQqyzIxumu WuQyw3AeE1KZgNRaj8BZSLgUoNLpmbO3ejupZhjupOmgIoalkaDiT61EPboNNXlWcL 5KGwccNAWpi4fiqs/lFztM2YX1XVnvKrT7GVzBTI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Lemon , Florian Fainelli , Paolo Abeni , Sasha Levin Subject: [PATCH 4.14 39/78] net: bcmgenet: hide status block before TX timestamping Date: Tue, 10 May 2022 15:07:25 +0200 Message-Id: <20220510130733.691527722@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jonathan Lemon [ Upstream commit acac0541d1d65e81e599ec399d34d184d2424401 ] The hardware checksum offloading requires use of a transmit status block inserted before the outgoing frame data, this was updated in '9a9ba2a4aaaa ("net: bcmgenet: always enable status blocks")' However, skb_tx_timestamp() assumes that it is passed a raw frame and PTP parsing chokes on this status block. Fix this by calling __skb_pull(), which hides the TSB before calling skb_tx_timestamp(), so an outgoing PTP packet is parsed correctly. As the data in the skb has already been set up for DMA, and the dma_unmap_* calls use a separately stored address, there is no no effective change in the data transmission. Signed-off-by: Jonathan Lemon Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20220424165307.591145-1-jonathan.lemon@gmai= l.com Fixes: d03825fba459 ("net: bcmgenet: add skb_tx_timestamp call") Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/e= thernet/broadcom/genet/bcmgenet.c index b819a9bde6cc..9bb398d05837 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -1522,6 +1522,11 @@ static struct sk_buff *bcmgenet_put_tx_csum(struct n= et_device *dev, return skb; } =20 +static void bcmgenet_hide_tsb(struct sk_buff *skb) +{ + __skb_pull(skb, sizeof(struct status_64)); +} + static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb, struct net_device *d= ev) { struct bcmgenet_priv *priv =3D netdev_priv(dev); @@ -1632,6 +1637,8 @@ static netdev_tx_t bcmgenet_xmit(struct sk_buff *skb,= struct net_device *dev) } =20 GENET_CB(skb)->last_cb =3D tx_cb_ptr; + + bcmgenet_hide_tsb(skb); skb_tx_timestamp(skb); =20 /* Decrement total BD count and advance our write pointer */ --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A8FBC433F5 for ; Tue, 10 May 2022 13:29:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243337AbiEJNdM (ORCPT ); Tue, 10 May 2022 09:33:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60652 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242826AbiEJNY4 (ORCPT ); Tue, 10 May 2022 09:24:56 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 95A5156232; Tue, 10 May 2022 06:17:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 36586B81CE7; Tue, 10 May 2022 13:17:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 981D2C385C9; Tue, 10 May 2022 13:17:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188663; bh=A6nbKo2UCo0NnMh93O2arkPNWIPu1uBb02A/MRDScxw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WjT5dqXgDq65oAAhn5LD2sJ7dbCOkgqwaJ380AF6g18sWr6ebqJ4E0bvGuoafe8u0 fMQSZuzP2FbTL6FdpgzJ1k5SLOv4DtiQytXgkVv/jDOsGeyZ+53mDsDuhNgA89S8mL z3nBCcLfcdOtYtj0fjULDxoPRMKlcFkcvurEqZy4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Christensen , Manish Chopra , Ariel Elior , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.14 40/78] bnx2x: fix napi API usage sequence Date: Tue, 10 May 2022 15:07:26 +0200 Message-Id: <20220510130733.721181840@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Manish Chopra [ Upstream commit af68656d66eda219b7f55ce8313a1da0312c79e1 ] While handling PCI errors (AER flow) driver tries to disable NAPI [napi_disable()] after NAPI is deleted [__netif_napi_del()] which causes unexpected system hang/crash. System message log shows the following: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 3222.537510] EEH: Detected PCI bus error on PHB#384-PE#800000 [ 3222.5375= 11] EEH: This PCI device has failed 2 times in the last hour and will be pe= rmanently disabled after 5 failures. [ 3222.537512] EEH: Notify device drivers to shutdown [ 3222.537513] EEH: B= eginning: 'error_detected(IO frozen)' [ 3222.537514] EEH: PE#800000 (PCI 0384:80:00.0): Invoking bnx2x->error_detected(IO frozen) [ 3222.537516] bnx2x: [bnx2x_io_error_detected:14236(eth14)]IO error detect= ed [ 3222.537650] EEH: PE#800000 (PCI 0384:80:00.0): bnx2x driver reports: 'need reset' [ 3222.537651] EEH: PE#800000 (PCI 0384:80:00.1): Invoking bnx2x->error_detected(IO frozen) [ 3222.537651] bnx2x: [bnx2x_io_error_detected:14236(eth13)]IO error detect= ed [ 3222.537729] EEH: PE#800000 (PCI 0384:80:00.1): bnx2x driver reports: 'need reset' [ 3222.537729] EEH: Finished:'error_detected(IO frozen)' with aggregate rec= overy state:'need reset' [ 3222.537890] EEH: Collect temporary log [ 3222.583481] EEH: of node=3D038= 4:80:00.0 [ 3222.583519] EEH: PCI device/vendor: 168e14e4 [ 3222.583557] EE= H: PCI cmd/status register: 00100140 [ 3222.583557] EEH: PCI-E capabilities= and status follow: [ 3222.583744] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.58= 3892] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.583893] EEH= : PCI-E 20: 00000000 [ 3222.583893] EEH: PCI-E AER capability register set = follows: [ 3222.584079] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 322= 2.584230] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.584= 378] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.584416] = EEH: PCI-E AER 30: 00000000 00000000 [ 3222.584416] EEH: of node=3D0384:80:= 00.1 [ 3222.584454] EEH: PCI device/vendor: 168e14e4 [ 3222.584491] EEH: PC= I cmd/status register: 00100140 [ 3222.584492] EEH: PCI-E capabilities and = status follow: [ 3222.584677] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.58= 4825] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.584826] EEH= : PCI-E 20: 00000000 [ 3222.584826] EEH: PCI-E AER capability register set = follows: [ 3222.585011] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 322= 2.585160] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.585= 309] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.585347] = EEH: PCI-E AER 30: 00000000 00000000 [ 3222.586872] RTAS: event: 5, Type: P= latform Error (224), Severity: 2 [ 3222.586873] EEH: Reset without hotplug = activity [ 3224.762767] EEH: Beginning: 'slot_reset' [ 3224.762770] EEH: PE#800000 (PCI 0384:80:00.0): Invoking bnx2x->slot_reset() [ 3224.762771] bnx2x: [bnx2x_io_slot_reset:14271(eth14)]IO slot reset initi= alizing... [ 3224.762887] bnx2x 0384:80:00.0: enabling device (0140 -> 0142) [ 3224.76= 8157] bnx2x: [bnx2x_io_slot_reset:14287(eth14)]IO slot reset --> driver unload Uninterruptible tasks =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D crash> ps | grep UN 213 2 11 c000000004c89e00 UN 0.0 0 0 [eehd] 215 2 0 c000000004c80000 UN 0.0 0 0 [kworker/0:2] 2196 1 28 c000000004504f00 UN 0.1 15936 11136 wickedd 4287 1 9 c00000020d076800 UN 0.0 4032 3008 agetty 4289 1 20 c00000020d056680 UN 0.0 7232 3840 agetty 32423 2 26 c00000020038c580 UN 0.0 0 0 [kworker/26:3] 32871 4241 27 c0000002609ddd00 UN 0.1 18624 11648 sshd 32920 10130 16 c00000027284a100 UN 0.1 48512 12608 sendmail 33092 32987 0 c000000205218b00 UN 0.1 48512 12608 sendmail 33154 4567 16 c000000260e51780 UN 0.1 48832 12864 pickup 33209 4241 36 c000000270cb6500 UN 0.1 18624 11712 sshd 33473 33283 0 c000000205211480 UN 0.1 48512 12672 sendmail 33531 4241 37 c00000023c902780 UN 0.1 18624 11648 sshd EEH handler hung while bnx2x sleeping and holding RTNL lock =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D crash> bt 213 PID: 213 TASK: c000000004c89e00 CPU: 11 COMMAND: "eehd" #0 [c000000004d477e0] __schedule at c000000000c70808 #1 [c000000004d478b0] schedule at c000000000c70ee0 #2 [c000000004d478e0] schedule_timeout at c000000000c76dec #3 [c000000004d479c0] msleep at c0000000002120cc #4 [c000000004d479f0] napi_disable at c000000000a06448 ^^^^^^^^^^^^^^^^ #5 [c000000004d47a30] bnx2x_netif_stop at c0080000018dba94 [bnx2x] #6 [c000000004d47a60] bnx2x_io_slot_reset at c0080000018a551c [bnx2x] #7 [c000000004d47b20] eeh_report_reset at c00000000004c9bc #8 [c000000004d47b90] eeh_pe_report at c00000000004d1a8 #9 [c000000004d47c40] eeh_handle_normal_event at c00000000004da64 And the sleeping source code =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D crash> dis -ls c000000000a06448 FILE: ../net/core/dev.c LINE: 6702 6697 { 6698 might_sleep(); 6699 set_bit(NAPI_STATE_DISABLE, &n->state); 6700 6701 while (test_and_set_bit(NAPI_STATE_SCHED, &n->state)) * 6702 msleep(1); 6703 while (test_and_set_bit(NAPI_STATE_NPSVC, &n->state)) 6704 msleep(1); 6705 6706 hrtimer_cancel(&n->timer); 6707 6708 clear_bit(NAPI_STATE_DISABLE, &n->state); 6709 } EEH calls into bnx2x twice based on the system log above, first through bnx2x_io_error_detected() and then bnx2x_io_slot_reset(), and executes the following call chains: bnx2x_io_error_detected() +-> bnx2x_eeh_nic_unload() +-> bnx2x_del_all_napi() +-> __netif_napi_del() bnx2x_io_slot_reset() +-> bnx2x_netif_stop() +-> bnx2x_napi_disable() +->napi_disable() Fix this by correcting the sequence of NAPI APIs usage, that is delete the NAPI after disabling it. Fixes: 7fa6f34081f1 ("bnx2x: AER revised") Reported-by: David Christensen Tested-by: David Christensen Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Link: https://lore.kernel.org/r/20220426153913.6966-1-manishc@marvell.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net= /ethernet/broadcom/bnx2x/bnx2x_main.c index b0ada7eac652..7925c40c0062 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c @@ -14317,10 +14317,6 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp) =20 /* Stop Tx */ bnx2x_tx_disable(bp); - /* Delete all NAPI objects */ - bnx2x_del_all_napi(bp); - if (CNIC_LOADED(bp)) - bnx2x_del_all_napi_cnic(bp); netdev_reset_tc(bp->dev); =20 del_timer_sync(&bp->timer); @@ -14425,6 +14421,11 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct= pci_dev *pdev) bnx2x_drain_tx_queues(bp); bnx2x_send_unload_req(bp, UNLOAD_RECOVERY); bnx2x_netif_stop(bp, 1); + bnx2x_del_all_napi(bp); + + if (CNIC_LOADED(bp)) + bnx2x_del_all_napi_cnic(bp); + bnx2x_free_irq(bp); =20 /* Report UNLOAD_DONE to MCP */ --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C437C433F5 for ; Tue, 10 May 2022 13:31:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241902AbiEJNfC (ORCPT ); Tue, 10 May 2022 09:35:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242872AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CB03148316; Tue, 10 May 2022 06:17:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 67F196123F; Tue, 10 May 2022 13:17:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 78003C385A6; Tue, 10 May 2022 13:17:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188665; bh=IahD/UGbAtp5D8KEjlB7ZHxiAoNcd+ZHPnhmK08V4LI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FQHUzD0xEQiv6Hupxj/Afy9gCL/qQkRJe6fnieelz+VUhyNvvmfOq6fYjkewmdGpY hVmK9IMQrwAxLieCDHKZINViUbDF5OJv1++Nfg4o79dbRDkVu748hZGJCLNCOX9fxP Vh9aJuE1zEEoaWSBkBqgmiJF5etKn3AIsVIF3Z94= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Mark Brown , Sasha Levin Subject: [PATCH 4.14 41/78] ASoC: wm8731: Disable the regulator when probing fails Date: Tue, 10 May 2022 15:07:27 +0200 Message-Id: <20220510130733.751427333@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit 92ccbf17eeacf510cf1eed9c252d9332ca24f02d ] When the driver fails during probing, the driver should disable the regulator, not just handle it in wm8731_hw_init(). The following log reveals it: [ 17.812483] WARNING: CPU: 1 PID: 364 at drivers/regulator/core.c:2257 _r= egulator_put+0x3ec/0x4e0 [ 17.815958] RIP: 0010:_regulator_put+0x3ec/0x4e0 [ 17.824467] Call Trace: [ 17.824774] [ 17.825040] regulator_bulk_free+0x82/0xe0 [ 17.825514] devres_release_group+0x319/0x3d0 [ 17.825882] i2c_device_probe+0x766/0x940 [ 17.829198] i2c_register_driver+0xb5/0x130 Signed-off-by: Zheyu Ma Link: https://lore.kernel.org/r/20220405121038.4094051-1-zheyuma97@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/soc/codecs/wm8731.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c index 4f9a1eb28120..abe5e77ba171 100644 --- a/sound/soc/codecs/wm8731.c +++ b/sound/soc/codecs/wm8731.c @@ -604,7 +604,7 @@ static int wm8731_hw_init(struct device *dev, struct wm= 8731_priv *wm8731) ret =3D wm8731_reset(wm8731->regmap); if (ret < 0) { dev_err(dev, "Failed to issue reset: %d\n", ret); - goto err_regulator_enable; + goto err; } =20 /* Clear POWEROFF, keep everything else disabled */ @@ -621,10 +621,7 @@ static int wm8731_hw_init(struct device *dev, struct w= m8731_priv *wm8731) =20 regcache_mark_dirty(wm8731->regmap); =20 -err_regulator_enable: - /* Regulators will be enabled by bias management */ - regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); - +err: return ret; } =20 @@ -768,21 +765,27 @@ static int wm8731_i2c_probe(struct i2c_client *i2c, ret =3D PTR_ERR(wm8731->regmap); dev_err(&i2c->dev, "Failed to allocate register map: %d\n", ret); - return ret; + goto err_regulator_enable; } =20 ret =3D wm8731_hw_init(&i2c->dev, wm8731); if (ret !=3D 0) - return ret; + goto err_regulator_enable; =20 ret =3D snd_soc_register_codec(&i2c->dev, &soc_codec_dev_wm8731, &wm8731_dai, 1); if (ret !=3D 0) { dev_err(&i2c->dev, "Failed to register CODEC: %d\n", ret); - return ret; + goto err_regulator_enable; } =20 return 0; + +err_regulator_enable: + /* Regulators will be enabled by bias management */ + regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); + + return ret; } =20 static int wm8731_i2c_remove(struct i2c_client *client) --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16B45C433F5 for ; Tue, 10 May 2022 13:26:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243260AbiEJNa2 (ORCPT ); Tue, 10 May 2022 09:30:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243520AbiEJNWB (ORCPT ); Tue, 10 May 2022 09:22:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0313C506E4; Tue, 10 May 2022 06:16:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 42261615F8; Tue, 10 May 2022 13:15:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4BD67C385C2; Tue, 10 May 2022 13:15:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188541; bh=vCU5qEkJjk+EcRlpBM/zbmu5Bbw3XDvJpwb9pfhgSjI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NxpuoeBF3jEtDmU3kw6/vNyMKo5EzZ2cgF8NRLgOwXRitcKb3cSx5NqcwSn/YpXMv r97PBBrBbG8AsCdyBCO87qnwARxPRein+zIjuUJERKq4t2XbsawVkXn/Cnss4m42+7 1ntebiqDE+752Wf6DAMSGGkADxsWWIhfGV2uX7WI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Linus Torvalds , Sasha Levin Subject: [PATCH 4.14 42/78] x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 Date: Tue, 10 May 2022 15:07:28 +0200 Message-Id: <20220510130733.780119348@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka [ Upstream commit a6823e4e360fe975bd3da4ab156df7c74c8b07f3 ] The first "if" condition in __memcpy_flushcache is supposed to align the "dest" variable to 8 bytes and copy data up to this alignment. However, this condition may misbehave if "size" is greater than 4GiB. The statement min_t(unsigned, size, ALIGN(dest, 8) - dest); casts both arguments to unsigned int and selects the smaller one. However, the cast truncates high bits in "size" and it results in misbehavior. For example: suppose that size =3D=3D 0x100000001, dest =3D=3D 0x200000002 min_t(unsigned, size, ALIGN(dest, 8) - dest) =3D=3D min_t(0x1, 0xe) =3D=3D= 0x1; ... dest +=3D 0x1; so we copy just one byte "and" dest remains unaligned. This patch fixes the bug by replacing unsigned with size_t. Signed-off-by: Mikulas Patocka Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/lib/usercopy_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c index 2c3b4bcbe8f2..0650b440b389 100644 --- a/arch/x86/lib/usercopy_64.c +++ b/arch/x86/lib/usercopy_64.c @@ -140,7 +140,7 @@ void memcpy_flushcache(void *_dst, const void *_src, si= ze_t size) =20 /* cache copy and flush to align dest */ if (!IS_ALIGNED(dest, 8)) { - unsigned len =3D min_t(unsigned, size, ALIGN(dest, 8) - dest); + size_t len =3D min_t(size_t, size, ALIGN(dest, 8) - dest); =20 memcpy((void *) dest, (void *) source, len); clean_cache_range((void *) dest, len); --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68720C433FE for ; Tue, 10 May 2022 13:24:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243227AbiEJN2y (ORCPT ); Tue, 10 May 2022 09:28:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60628 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243401AbiEJNVv (ORCPT ); Tue, 10 May 2022 09:21:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 307DA4B846; Tue, 10 May 2022 06:15:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2E18D615DD; Tue, 10 May 2022 13:15:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 388C5C385A6; Tue, 10 May 2022 13:15:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188544; bh=KR943c8CFkXLKMhnK9yAbS4g5Lha2CsC/opzgmgUJ6o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t1leVvz/ppVsGjIz4KVsoYjkrq2SNw74QqZwyQwGawEaHSkAzuDiV5CAbc9LiAidO 8isfNi0GJCPp0+VmWF+w9GQ3gEuFgA2UXUjBr+63eyimpniWRUyk/cYhzLAxD4Yk3R UVKo5ELyuqq189wlMBoynbctT3MLCKkd0zKa69Ek= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiaoli Feng , Ronnie Sahlberg , Steve French , Sasha Levin Subject: [PATCH 4.14 43/78] cifs: destage any unwritten data to the server before calling copychunk_write Date: Tue, 10 May 2022 15:07:29 +0200 Message-Id: <20220510130733.809826225@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ronnie Sahlberg [ Upstream commit f5d0f921ea362636e4a2efb7c38d1ead373a8700 ] because the copychunk_write might cover a region of the file that has not y= et been sent to the server and thus fail. A simple way to reproduce this is: truncate -s 0 /mnt/testfile; strace -f -o x -ttT xfs_io -i -f -c 'pwrite 0k= 128k' -c 'fcollapse 16k 24k' /mnt/testfile the issue is that the 'pwrite 0k 128k' becomes rearranged on the wire with the 'fcollapse 16k 24k' due to write-back caching. fcollapse is implemented in cifs.ko as a SMB2 IOCTL(COPYCHUNK_WRITE) call and it will fail serverside since the file is still 0b in size serverside until the writes have been destaged. To avoid this we must ensure that we destage any unwritten data to the server before calling COPYCHUNK_WRITE. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=3D1997373 Reported-by: Xiaoli Feng Signed-off-by: Ronnie Sahlberg Signed-off-by: Steve French Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/cifs/smb2ops.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index ba56c00f2650..3280a801b1d7 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -855,9 +855,17 @@ smb2_copychunk_range(const unsigned int xid, int chunks_copied =3D 0; bool chunk_sizes_updated =3D false; ssize_t bytes_written, total_bytes_written =3D 0; + struct inode *inode; =20 pcchunk =3D kmalloc(sizeof(struct copychunk_ioctl), GFP_KERNEL); =20 + /* + * We need to flush all unwritten data before we can send the + * copychunk ioctl to the server. + */ + inode =3D d_inode(trgtfile->dentry); + filemap_write_and_wait(inode->i_mapping); + if (pcchunk =3D=3D NULL) return -ENOMEM; =20 --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6974BC4321E for ; Tue, 10 May 2022 13:23:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243207AbiEJN0c (ORCPT ); Tue, 10 May 2022 09:26:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60652 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243578AbiEJNWM (ORCPT ); Tue, 10 May 2022 09:22:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D66056768; Tue, 10 May 2022 06:16:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B109EB81D7A; Tue, 10 May 2022 13:15:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EAE53C385A6; Tue, 10 May 2022 13:15:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188547; bh=O726eevFd4aa9bv4B67BLbuQbMjvTTVMMcyh219BVxE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U2mq2JCWT2frtWWGagREk2iw4pUIKH2aU4bKe8zeJHn2R5PGdaAIMFbnGOpv926YK NIXYegdV1KwjDuB0mLF8QkXUTkYOYqAIU6Fz4Ux/rt/VeRK74YJPAHZNOpIACEZRsc lbsLZtMpEYenSPP11F7ZQ545kSARO5DDiFyiefzs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Paolo Abeni , Sasha Levin Subject: [PATCH 4.14 44/78] drivers: net: hippi: Fix deadlock in rr_close() Date: Tue, 10 May 2022 15:07:30 +0200 Message-Id: <20220510130733.839982828@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou [ Upstream commit bc6de2878429e85c1f1afaa566f7b5abb2243eef ] There is a deadlock in rr_close(), which is shown below: (Thread 1) | (Thread 2) | rr_open() rr_close() | add_timer() spin_lock_irqsave() //(1) | (wait a time) ... | rr_timer() del_timer_sync() | spin_lock_irqsave() //(2) (wait timer to stop) | ... We hold rrpriv->lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need rrpriv->lock in position (2) of thread 2. As a result, rr_close() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock. Signed-off-by: Duoming Zhou Link: https://lore.kernel.org/r/20220417125519.82618-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/hippi/rrunner.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c index 40ef4aeb0ef0..3a73ac03fb2b 100644 --- a/drivers/net/hippi/rrunner.c +++ b/drivers/net/hippi/rrunner.c @@ -1354,7 +1354,9 @@ static int rr_close(struct net_device *dev) =20 rrpriv->fw_running =3D 0; =20 + spin_unlock_irqrestore(&rrpriv->lock, flags); del_timer_sync(&rrpriv->timer); + spin_lock_irqsave(&rrpriv->lock, flags); =20 writel(0, ®s->TxPi); writel(0, ®s->IpRxPi); --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 319BFC433F5 for ; Tue, 10 May 2022 13:21:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242946AbiEJNZa (ORCPT ); Tue, 10 May 2022 09:25:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60630 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243400AbiEJNVv (ORCPT ); Tue, 10 May 2022 09:21:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 07111473BD; Tue, 10 May 2022 06:15:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9A9CB61668; Tue, 10 May 2022 13:15:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A61DEC385C2; Tue, 10 May 2022 13:15:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188550; bh=91cH3L1VOAhw76ePh5Cx8T4GAcal67FgrHUFzd3Uz3w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yNYqBn/cYqfd+i6WRoCVdjW4GDNI9dNf+rlyVMksymzrHQfdHUOHT3g18pjU3k+sr TsIlc24DYXYZ/cWt+OnUfipsiH3zJhLbT4cCFg63ypAr0WvIW6tg9Ah9Y7pPjZqFat jy6kz1UiR7lnsIK3vvb/Tzv+UtAT80p+rQ2lWuL4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Kyle D. Pelton" , Borislav Petkov , Pawan Gupta Subject: [PATCH 4.14 45/78] x86/cpu: Load microcode during restore_processor_state() Date: Tue, 10 May 2022 15:07:31 +0200 Message-Id: <20220510130733.869269749@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Borislav Petkov commit f9e14dbbd454581061c736bf70bf5cbb15ac927c upstream. When resuming from system sleep state, restore_processor_state() restores the boot CPU MSRs. These MSRs could be emulated by microcode. If microcode is not loaded yet, writing to emulated MSRs leads to unchecked MSR access error: ... PM: Calling lapic_suspend+0x0/0x210 unchecked MSR access error: WRMSR to 0x10f (tried to write 0x0...0) at rI= P: ... (native_write_msr) Call Trace: ? restore_processor_state x86_acpi_suspend_lowlevel acpi_suspend_enter suspend_devices_and_enter pm_suspend.cold state_store kobj_attr_store sysfs_kf_write kernfs_fop_write_iter new_sync_write vfs_write ksys_write __x64_sys_write do_syscall_64 entry_SYSCALL_64_after_hwframe RIP: 0033:0x7fda13c260a7 To ensure microcode emulated MSRs are available for restoration, load the microcode on the boot CPU before restoring these MSRs. [ Pawan: write commit message and productize it. ] Fixes: e2a1256b17b1 ("x86/speculation: Restore speculation related MSRs dur= ing S3 resume") Reported-by: Kyle D. Pelton Signed-off-by: Borislav Petkov Signed-off-by: Pawan Gupta Tested-by: Kyle D. Pelton Cc: stable@vger.kernel.org Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D215841 Link: https://lore.kernel.org/r/4350dfbf785cd482d3fafa72b2b49c83102df3ce.16= 50386317.git.pawan.kumar.gupta@linux.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/include/asm/microcode.h | 2 ++ arch/x86/kernel/cpu/microcode/core.c | 6 +++--- arch/x86/power/cpu.c | 8 ++++++++ 3 files changed, 13 insertions(+), 3 deletions(-) --- a/arch/x86/include/asm/microcode.h +++ b/arch/x86/include/asm/microcode.h @@ -147,11 +147,13 @@ extern void load_ucode_ap(void); void reload_early_microcode(void); extern bool get_builtin_firmware(struct cpio_data *cd, const char *name); extern bool initrd_gone; +void microcode_bsp_resume(void); #else static inline int __init microcode_init(void) { return 0; }; static inline void __init load_ucode_bsp(void) { } static inline void load_ucode_ap(void) { } static inline void reload_early_microcode(void) { } +static inline void microcode_bsp_resume(void) { } static inline bool get_builtin_firmware(struct cpio_data *cd, const char *name) { return fals= e; } #endif --- a/arch/x86/kernel/cpu/microcode/core.c +++ b/arch/x86/kernel/cpu/microcode/core.c @@ -773,9 +773,9 @@ static struct subsys_interface mc_cpu_in }; =20 /** - * mc_bp_resume - Update boot CPU microcode during resume. + * microcode_bsp_resume - Update boot CPU microcode during resume. */ -static void mc_bp_resume(void) +void microcode_bsp_resume(void) { int cpu =3D smp_processor_id(); struct ucode_cpu_info *uci =3D ucode_cpu_info + cpu; @@ -787,7 +787,7 @@ static void mc_bp_resume(void) } =20 static struct syscore_ops mc_syscore_ops =3D { - .resume =3D mc_bp_resume, + .resume =3D microcode_bsp_resume, }; =20 static int mc_cpu_starting(unsigned int cpu) --- a/arch/x86/power/cpu.c +++ b/arch/x86/power/cpu.c @@ -26,6 +26,7 @@ #include #include #include +#include =20 #ifdef CONFIG_X86_32 __visible unsigned long saved_context_ebx; @@ -268,6 +269,13 @@ static void notrace __restore_processor_ x86_platform.restore_sched_clock_state(); mtrr_bp_restore(); perf_restore_debug_store(); + + microcode_bsp_resume(); + + /* + * This needs to happen after the microcode has been updated upon resume + * because some of the MSRs are "emulated" in microcode. + */ msr_restore_context(ctxt); } From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A394DC433FE for ; Tue, 10 May 2022 13:24:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243220AbiEJN2s (ORCPT ); Tue, 10 May 2022 09:28:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45960 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243389AbiEJNVu (ORCPT ); Tue, 10 May 2022 09:21:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0AB1C48393; Tue, 10 May 2022 06:15:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3C6026166E; Tue, 10 May 2022 13:15:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D39E9C385A6; Tue, 10 May 2022 13:15:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188553; bh=UijIQ3SLZpbUro05ZQA+Qa+W6F8cFx3scj6Osw79oHY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=c8uyCa7ORiGGExI0CMy/gBRcb93vZ2xOrtJvtmD0axvdj6y5VrQzYtsBKqJb/e3Lr IJHWq+0XtDs1/b892uj4fzlBG9jtklmkIh2FGaobFDBTm7ZtvA9N8ViXiZmrRzaX+X dDsq0+nEoz+a9x/IUKfm9b1FGxotYa3orGINHLkc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.14 46/78] tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 Date: Tue, 10 May 2022 15:07:32 +0200 Message-Id: <20220510130733.900794072@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 06d5afd4d640eea67f5623e76cd5fc03359b7f3c upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.5.2 describes that the signal octet in convergence layer type 2 can be either one or two bytes. The length is encoded in the EA bit. This is set 1 for the last byte in the sequence. gsmtty_modem_update() handles this correctly but gsm_dlci_data_output() fails to set EA to 1. There is no case in which we encode two signal octets as there is no case in which we send out a break signal. Therefore, always set the EA bit to 1 for the signal octet to fix this. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-5-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -835,7 +835,7 @@ static int gsm_dlci_data_output(struct g break; case 2: /* Unstructed with modem bits. Always one byte as we never send inline break data */ - *dp++ =3D gsm_encode_modem(dlci); + *dp++ =3D (gsm_encode_modem(dlci) << 1) | EA; break; } WARN_ON(kfifo_out_locked(dlci->fifo, dp , len, &dlci->lock) !=3D len); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2173C4332F for ; Tue, 10 May 2022 13:28:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243557AbiEJNbY (ORCPT ); Tue, 10 May 2022 09:31:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45984 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243691AbiEJNWT (ORCPT ); Tue, 10 May 2022 09:22:19 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D7A2E5252B; Tue, 10 May 2022 06:16:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id B4587CE1EE5; Tue, 10 May 2022 13:15:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1482C385C2; Tue, 10 May 2022 13:15:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188557; bh=W34MZk3EtXVGP67+Bx2iGoR3kmpNyZe266vZTLgpJd0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gSNKP9NkLS7uTzWOzJshsg7NB9hUfrGEUTPt1Urr3w1Re5Qz2Usc/QAs5eJUJcoCH VsITLHVV7C+z7ygOq6qfFfEpSiyyNOgcc8XMjVfj7WI5d6DPXxPsj/7Hp5BLGxOFpw wkC3QQwLHwSkPVa90ykuttQH9Uaao041tHmsn3YQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.14 47/78] tty: n_gsm: fix malformed counter for out of frame data Date: Tue, 10 May 2022 15:07:33 +0200 Message-Id: <20220510130733.930598618@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit a24b4b2f660b7ddf3f484b37600bba382cb28a9d upstream. The gsm_mux field 'malformed' represents the number of malformed frames received. However, gsm1_receive() also increases this counter for any out of frame byte. Fix this by ignoring out of frame data for the malformed counter. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-7-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1973,7 +1973,8 @@ static void gsm1_receive(struct gsm_mux } /* Any partial frame was a runt so go back to start */ if (gsm->state !=3D GSM_START) { - gsm->malformed++; + if (gsm->state !=3D GSM_SEARCH) + gsm->malformed++; gsm->state =3D GSM_START; } /* A SOF in GSM_START means we are still reading idling or From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 187EDC433F5 for ; Tue, 10 May 2022 13:23:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243161AbiEJN0P (ORCPT ); Tue, 10 May 2022 09:26:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243565AbiEJNWE (ORCPT ); Tue, 10 May 2022 09:22:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3416F53A72; Tue, 10 May 2022 06:16:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C30A861532; Tue, 10 May 2022 13:16:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C2755C385C2; Tue, 10 May 2022 13:15:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188560; bh=MKK5ZJ9IUYz5rN4WMjJXXQlyeAz3VtRXT4EZBFNKVVw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U/TXfjZKdPTeDjh1klSu2FubaHFKDOBUt423jdFAWZUIvJ64wmy8Cqi45thLeU0Ne EReN5GzuGs36qJVB/MjX0RRWzMWjWdzWNFZI+hlIrYDJIyc6HHZkra0iKkfw1HGWL/ 4c9ORd1pOre1VdpUHHj0igOOD2GQa3RLHB81j0w0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.14 48/78] tty: n_gsm: fix insufficient txframe size Date: Tue, 10 May 2022 15:07:34 +0200 Message-Id: <20220510130733.959398362@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 535bf600de75a859698892ee873521a48d289ec1 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.7.2 states that the maximum frame size (N1) refers to the length of the information field (i.e. user payload). However, 'txframe' stores the whole frame including frame header, checksum and start/end flags. We also need to consider the byte stuffing overhead. Define constant for the protocol overhead and adjust the 'txframe' size calculation accordingly to reserve enough space for a complete mux frame including byte stuffing for advanced option mode. Note that no byte stuffing is applied to the start and end flag. Also use MAX_MTU instead of MAX_MRU as this buffer is used for data transmission. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-8-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -84,6 +84,8 @@ module_param(debug, int, 0600); */ #define MAX_MRU 1500 #define MAX_MTU 1500 +/* SOF, ADDR, CTRL, LEN1, LEN2, ..., FCS, EOF */ +#define PROT_OVERHEAD 7 #define GSM_NET_TX_TIMEOUT (HZ*10) =20 /** @@ -2211,7 +2213,7 @@ static struct gsm_mux *gsm_alloc_mux(voi kfree(gsm); return NULL; } - gsm->txframe =3D kmalloc(2 * MAX_MRU + 2, GFP_KERNEL); + gsm->txframe =3D kmalloc(2 * (MAX_MTU + PROT_OVERHEAD - 1), GFP_KERNEL); if (gsm->txframe =3D=3D NULL) { kfree(gsm->buf); kfree(gsm); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA3FFC433FE for ; Tue, 10 May 2022 13:28:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243543AbiEJNbT (ORCPT ); Tue, 10 May 2022 09:31:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60524 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243564AbiEJNWE (ORCPT ); Tue, 10 May 2022 09:22:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 13D37532D1; Tue, 10 May 2022 06:16:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 28FAE615FA; Tue, 10 May 2022 13:16:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38EC1C385A6; Tue, 10 May 2022 13:16:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188563; bh=rcPMcmx+O2Rg0m2AEX3UqeiP68IktvyIl4QmJckVrk4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pxD+QVcx+Q4CcaTPCrkLRokkfQpJFuBOdAGR4F1FV5bvD2l6qfXd5+Sr7ad/k50w5 FiZFtYpVAhyI/KYCSNKrrdaIJ0Ah3SgDcGOyzRTC5d8u8UZ+Y7fZ/kFo0sQgnAhwzj UJF4uiI2pDx1MDbp7d/eAZD9aMySQ64Kn0H1vOjk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.14 49/78] tty: n_gsm: fix missing explicit ldisc flush Date: Tue, 10 May 2022 15:07:35 +0200 Message-Id: <20220510130733.989336187@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 17eac652028501df7ea296b1d9b9c134db262b7d upstream. In gsm_cleanup_mux() the muxer is closed down and all queues are removed. However, removing the queues is done without explicit control of the underlying buffers. Flush those before freeing up our queues to ensure that all outgoing queues are cleared consistently. Otherwise, a new mux connection establishment attempt may time out while the underlying tty is still busy sending out the remaining data from the previous connection. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-10-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2113,6 +2113,7 @@ static void gsm_cleanup_mux(struct gsm_m gsm_dlci_release(gsm->dlci[i]); mutex_unlock(&gsm->mutex); /* Now wipe the queues */ + tty_ldisc_flush(gsm->tty); list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list) kfree(txq); INIT_LIST_HEAD(&gsm->tx_list); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97C69C433EF for ; Tue, 10 May 2022 13:24:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242873AbiEJNZt (ORCPT ); Tue, 10 May 2022 09:25:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45570 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243450AbiEJNVz (ORCPT ); Tue, 10 May 2022 09:21:55 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 52CB84EF58; Tue, 10 May 2022 06:16:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3EBCD61663; Tue, 10 May 2022 13:16:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3FF8AC385A6; Tue, 10 May 2022 13:16:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188566; bh=rrHsYt9Qs4PHF/mVTk+Pvgt2CBMycA8rpv2zIgNl2mE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q0IdvtVW/PJG73rDMFMm6yzY2BFe5mpsJr4cKeY5I2IAleDCaO/S+M7iOHG3U7obe bNHDKpA4/nlKfxWjiyg5M+rzIVVdhrZ4H2KhbTnXF7FT1sYsS9fuFo0MsFiPlBgn3f UbS9l5ZQrkptZqt/Zv9RTTwCz1/sdUopSi2/Vkm0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.14 50/78] tty: n_gsm: fix wrong command retry handling Date: Tue, 10 May 2022 15:07:36 +0200 Message-Id: <20220510130734.019028524@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit d0bcdffcad5a22f202e3bf37190c0dd8c080ea92 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.7.3 states that the valid range for the maximum number of retransmissions (N2) is from 0 to 255 (both including). gsm_config() fails to limit this range correctly. Furthermore, gsm_control_retransmit() handles this number incorrectly by performing N2 - 1 retransmission attempts. Setting N2 to zero results in more than 255 retransmission attempts. Fix the range check in gsm_config() and the value handling in gsm_control_send() and gsm_control_retransmit() to comply with 3GPP 27.010. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-11-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1341,7 +1341,6 @@ static void gsm_control_retransmit(unsig spin_lock_irqsave(&gsm->control_lock, flags); ctrl =3D gsm->pending_cmd; if (ctrl) { - gsm->cretries--; if (gsm->cretries =3D=3D 0) { gsm->pending_cmd =3D NULL; ctrl->error =3D -ETIMEDOUT; @@ -1350,6 +1349,7 @@ static void gsm_control_retransmit(unsig wake_up(&gsm->event); return; } + gsm->cretries--; gsm_control_transmit(gsm, ctrl); mod_timer(&gsm->t2_timer, jiffies + gsm->t2 * HZ / 100); } @@ -1390,7 +1390,7 @@ retry: =20 /* If DLCI0 is in ADM mode skip retries, it won't respond */ if (gsm->dlci[0]->mode =3D=3D DLCI_MODE_ADM) - gsm->cretries =3D 1; + gsm->cretries =3D 0; else gsm->cretries =3D gsm->n2; =20 @@ -2531,7 +2531,7 @@ static int gsmld_config(struct tty_struc /* Check the MRU/MTU range looks sane */ if (c->mru > MAX_MRU || c->mtu > MAX_MTU || c->mru < 8 || c->mtu < 8) return -EINVAL; - if (c->n2 < 3) + if (c->n2 > 255) return -EINVAL; if (c->encapsulation > 1) /* Basic, advanced, no I */ return -EINVAL; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EFE8AC43219 for ; Tue, 10 May 2022 13:24:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243135AbiEJN0A (ORCPT ); Tue, 10 May 2022 09:26:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45996 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243506AbiEJNWA (ORCPT ); Tue, 10 May 2022 09:22:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 612424F9C2; Tue, 10 May 2022 06:16:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 627D461574; Tue, 10 May 2022 13:16:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53B2FC385A6; Tue, 10 May 2022 13:16:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188569; bh=jNZnxmiMZ53JTlAIFKpA7EvVzwcYlv69uGX2/qyvw2I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jEzj8B1jVtrw3O+LCz0fAbVc2Kxlm0cQNFOPk3QXrYRE8QEIKXqnUXxbY3abPdmCu AOj+zv2Ar4VZz1yEE5Tkd+sYBKxOWWnhf24d5xX6YACb+InldMxApT2TRvoGShhWRC NBmLyTxzhP65RotybjGzhhPAEgwkWBZ/ckS5UgIA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.14 51/78] tty: n_gsm: fix wrong command frame length field encoding Date: Tue, 10 May 2022 15:07:37 +0200 Message-Id: <20220510130734.048919100@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit 398867f59f956985f4c324f173eff7b946e14bd8 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.4.6.1 states that each command frame shall be made up from type, length and value. Looking for example in chapter 5.4.6.3.5 at the description for the encoding of a flow control on command it becomes obvious, that the type and length field is always present whereas the value may be zero bytes long. The current implementation omits the length field if the value is not present. This is wrong. Correct this by always sending the length in gsm_control_transmit(). So far only the modem status command (MSC) has included a value and encoded its length directly. Therefore, also change gsmtty_modem_update(). Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-12-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1314,11 +1314,12 @@ static void gsm_control_response(struct =20 static void gsm_control_transmit(struct gsm_mux *gsm, struct gsm_control *= ctrl) { - struct gsm_msg *msg =3D gsm_data_alloc(gsm, 0, ctrl->len + 1, gsm->ftype); + struct gsm_msg *msg =3D gsm_data_alloc(gsm, 0, ctrl->len + 2, gsm->ftype); if (msg =3D=3D NULL) return; - msg->data[0] =3D (ctrl->cmd << 1) | 2 | EA; /* command */ - memcpy(msg->data + 1, ctrl->data, ctrl->len); + msg->data[0] =3D (ctrl->cmd << 1) | CR | EA; /* command */ + msg->data[1] =3D (ctrl->len << 1) | EA; + memcpy(msg->data + 2, ctrl->data, ctrl->len); gsm_data_queue(gsm->dlci[0], msg); } =20 @@ -2874,19 +2875,17 @@ static struct tty_ldisc_ops tty_ldisc_pa =20 static int gsmtty_modem_update(struct gsm_dlci *dlci, u8 brk) { - u8 modembits[5]; + u8 modembits[3]; struct gsm_control *ctrl; int len =3D 2; =20 - if (brk) + modembits[0] =3D (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ + modembits[1] =3D (gsm_encode_modem(dlci) << 1) | EA; + if (brk) { + modembits[2] =3D (brk << 4) | 2 | EA; /* Length, Break, EA */ len++; - - modembits[0] =3D len << 1 | EA; /* Data bytes */ - modembits[1] =3D dlci->addr << 2 | 3; /* DLCI, EA, 1 */ - modembits[2] =3D gsm_encode_modem(dlci) << 1 | EA; - if (brk) - modembits[3] =3D brk << 4 | 2 | EA; /* Valid, EA */ - ctrl =3D gsm_control_send(dlci->gsm, CMD_MSC, modembits, len + 1); + } + ctrl =3D gsm_control_send(dlci->gsm, CMD_MSC, modembits, len); if (ctrl =3D=3D NULL) return -ENOMEM; return gsm_control_wait(dlci->gsm, ctrl); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A9CAC43217 for ; Tue, 10 May 2022 13:23:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243190AbiEJN02 (ORCPT ); Tue, 10 May 2022 09:26:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59628 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243560AbiEJNWE (ORCPT ); Tue, 10 May 2022 09:22:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1ECCA53A44; Tue, 10 May 2022 06:16:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 47C65B81DA3; Tue, 10 May 2022 13:16:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8DCD2C385A6; Tue, 10 May 2022 13:16:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188576; bh=JJe8sEvxS5e9xUkxokihEGFI8ATuPtWVWFYdW0GQdmI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tMRrb0d1sEUFRA2c4bvzVkRGuxfwxmAiFSHYXdoy+YR+LOHTTBmgJGMPgrJ7Twxuo vPJEEjpx+/GG1lk0Pf4XWRQZ6dOUvnX/NF+9qkWrMZ4icaTZqp9D0fcF6dhO2XrVic jd0+YVmK9+Ilu9WCEl+6bT4g6428c/UMQwIpfykU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 4.14 52/78] tty: n_gsm: fix incorrect UA handling Date: Tue, 10 May 2022 15:07:38 +0200 Message-Id: <20220510130734.079029094@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke commit ff9166c623704337bd6fe66fce2838d9768a6634 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.4.4.2 states that any received unnumbered acknowledgment (UA) with its poll/final (PF) bit set to 0 shall be discarded. Currently, all UA frame are handled in the same way regardless of the PF bit. This does not comply with the standard. Remove the UA case in gsm_queue() to process only UA frames with PF bit set to 1 to abide the standard. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220414094225.4527-20-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1825,7 +1825,6 @@ static void gsm_queue(struct gsm_mux *gs gsm_response(gsm, address, UA); gsm_dlci_close(dlci); break; - case UA: case UA|PF: if (cr =3D=3D 0 || dlci =3D=3D NULL) break; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AEC5C43219 for ; Tue, 10 May 2022 13:23:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243175AbiEJN0V (ORCPT ); Tue, 10 May 2022 09:26:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243563AbiEJNWE (ORCPT ); Tue, 10 May 2022 09:22:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 21AD852530; Tue, 10 May 2022 06:16:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 61129615DD; Tue, 10 May 2022 13:16:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 46067C385C2; Tue, 10 May 2022 13:16:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188578; bh=NI3jWGh0Qcgl5TwhM/Wovh4SvdT7Ryx5lfnD/o7tqM0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SDqhUEr/oQnDm5DaF5bGz7DGmNKODtQrM3uZUcZslQLL/rwEchuRykshZ9cKNkNQM osRn17TUjJsHPtu8eifKN/saxCHRAOuLqoarP2s88Fui5GoPLHPwaU8akzihes20un 1++speVEOW6xLjtlTISmZPqHSfiT9nUUag/G5440= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Hillf Danton , syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com, Emil Velikov , Daniel Vetter , Sean Paul , Chris Wilson , Eric Anholt , Sam Ravnborg , Rob Clark , Daniel Vetter , Ovidiu Panait Subject: [PATCH 4.14 53/78] drm/vgem: Close use-after-free race in vgem_gem_create Date: Tue, 10 May 2022 15:07:39 +0200 Message-Id: <20220510130734.108704531@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Vetter commit 4b848f20eda5974020f043ca14bacf7a7e634fc8 upstream. There's two references floating around here (for the object reference, not the handle_count reference, that's a different thing): - The temporary reference held by vgem_gem_create, acquired by creating the object and released by calling drm_gem_object_put_unlocked. - The reference held by the object handle, created by drm_gem_handle_create. This one generally outlives the function, except if a 2nd thread races with a GEM_CLOSE ioctl call. So usually everything is correct, except in that race case, where the access to gem_object->size could be looking at freed data already. Which again isn't a real problem (userspace shot its feet off already with the race, we could return garbage), but maybe someone can exploit this as an information leak. Cc: Dan Carpenter Cc: Hillf Danton Reported-by: syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Cc: Emil Velikov Cc: Daniel Vetter Cc: Sean Paul Cc: Chris Wilson Cc: Eric Anholt Cc: Sam Ravnborg Cc: Rob Clark Reviewed-by: Chris Wilson Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20200202132133.1891846-= 1-daniel.vetter@ffwll.ch [OP: backport to 4.19: adjusted DRM_DEBUG() -> DRM_DEBUG_DRIVER()] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/vgem/vgem_drv.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/drivers/gpu/drm/vgem/vgem_drv.c +++ b/drivers/gpu/drm/vgem/vgem_drv.c @@ -190,9 +190,10 @@ static struct drm_gem_object *vgem_gem_c return ERR_CAST(obj); =20 ret =3D drm_gem_handle_create(file, &obj->base, handle); - drm_gem_object_put_unlocked(&obj->base); - if (ret) + if (ret) { + drm_gem_object_put_unlocked(&obj->base); return ERR_PTR(ret); + } =20 return &obj->base; } @@ -215,7 +216,9 @@ static int vgem_gem_dumb_create(struct d args->size =3D gem_object->size; args->pitch =3D pitch; =20 - DRM_DEBUG_DRIVER("Created object of size %lld\n", size); + drm_gem_object_put_unlocked(gem_object); + + DRM_DEBUG_DRIVER("Created object of size %llu\n", args->size); =20 return 0; } From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0ED3C433EF for ; Tue, 10 May 2022 13:25:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238601AbiEJN3E (ORCPT ); Tue, 10 May 2022 09:29:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45940 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243569AbiEJNWF (ORCPT ); Tue, 10 May 2022 09:22:05 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7793C54F8F; Tue, 10 May 2022 06:16:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EC5FDB81CE7; Tue, 10 May 2022 13:16:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3BC3DC385CC; Tue, 10 May 2022 13:16:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188581; bh=/UVAzQlgFegpmkQYaFIjEN+bkQrQ1feWxFKhU29pdeU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rRF3/4KPnf00rkpw3LjnX2FMdxwHKsVt1X/NmZnaXw4AvJDv5nIBWooRH34oldEMe 6Rm4gybKhO4DDuF//lPflZvZfGfJ8j9GYqnFjx1HU8FyXKUVLvmeuLkn970fUU6deo A2gp3rxEiWVvXE5cTgW3Le86nnNtWkFl5LAt55Mw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Maciej W. Rozycki" , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Thomas Bogendoerfer Subject: [PATCH 4.14 54/78] MIPS: Fix CP0 counter erratum detection for R4k CPUs Date: Tue, 10 May 2022 15:07:40 +0200 Message-Id: <20220510130734.137598475@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Maciej W. Rozycki commit f0a6c68f69981214cb7858738dd2bc81475111f7 upstream. Fix the discrepancy between the two places we check for the CP0 counter erratum in along with the incorrect comparison of the R4400 revision number against 0x30 which matches none and consistently consider all R4000 and R4400 processors affected, as documented in processor errata publications[1][2][3], following the mapping between CP0 PRId register values and processor models: PRId | Processor Model Reviewed-by: Philippe Mathieu-Daud=C3=A9 Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing ---------+-------------------- 00000422 | R4000 Revision 2.2 00000430 | R4000 Revision 3.0 00000440 | R4400 Revision 1.0 00000450 | R4400 Revision 2.0 00000460 | R4400 Revision 3.0 No other revision of either processor has ever been spotted. Contrary to what has been stated in commit ce202cbb9e0b ("[MIPS] Assume R4000/R4400 newer than 3.0 don't have the mfc0 count bug") marking the CP0 counter as buggy does not preclude it from being used as either a clock event or a clock source device. It just cannot be used as both at a time, because in that case clock event interrupts will be occasionally lost, and the use as a clock event device takes precedence. Compare against 0x4ff in `can_use_mips_counter' so that a single machine instruction is produced. [1] "MIPS R4000PC/SC Errata, Processor Revision 2.2 and 3.0", MIPS Technologies Inc., May 10, 1994, Erratum 53, p.13 [2] "MIPS R4400PC/SC Errata, Processor Revision 1.0", MIPS Technologies Inc., February 9, 1994, Erratum 21, p.4 [3] "MIPS R4400PC/SC Errata, Processor Revision 2.0 & 3.0", MIPS Technologies Inc., January 24, 1995, Erratum 14, p.3 Signed-off-by: Maciej W. Rozycki Fixes: ce202cbb9e0b ("[MIPS] Assume R4000/R4400 newer than 3.0 don't have t= he mfc0 count bug") Cc: stable@vger.kernel.org # v2.6.24+ Reviewed-by: Philippe Mathieu-Daud=C3=A9 Signed-off-by: Thomas Bogendoerfer Signed-off-by: Greg Kroah-Hartman --- arch/mips/include/asm/timex.h | 8 ++++---- arch/mips/kernel/time.c | 11 +++-------- 2 files changed, 7 insertions(+), 12 deletions(-) --- a/arch/mips/include/asm/timex.h +++ b/arch/mips/include/asm/timex.h @@ -40,9 +40,9 @@ typedef unsigned int cycles_t; =20 /* - * On R4000/R4400 before version 5.0 an erratum exists such that if the - * cycle counter is read in the exact moment that it is matching the - * compare register, no interrupt will be generated. + * On R4000/R4400 an erratum exists such that if the cycle counter is + * read in the exact moment that it is matching the compare register, + * no interrupt will be generated. * * There is a suggested workaround and also the erratum can't strike if * the compare interrupt isn't being used as the clock source device. @@ -63,7 +63,7 @@ static inline int can_use_mips_counter(u if (!__builtin_constant_p(cpu_has_counter)) asm volatile("" : "=3Dm" (cpu_data[0].options)); if (likely(cpu_has_counter && - prid >=3D (PRID_IMP_R4000 | PRID_REV_ENCODE_44(5, 0)))) + prid > (PRID_IMP_R4000 | PRID_REV_ENCODE_44(15, 15)))) return 1; else return 0; --- a/arch/mips/kernel/time.c +++ b/arch/mips/kernel/time.c @@ -155,15 +155,10 @@ static __init int cpu_has_mfc0_count_bug case CPU_R4400MC: /* * The published errata for the R4400 up to 3.0 say the CPU - * has the mfc0 from count bug. + * has the mfc0 from count bug. This seems the last version + * produced. */ - if ((current_cpu_data.processor_id & 0xff) <=3D 0x30) - return 1; - - /* - * we assume newer revisions are ok - */ - return 0; + return 1; } =20 return 0; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8175DC433F5 for ; Tue, 10 May 2022 13:26:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243322AbiEJNaT (ORCPT ); Tue, 10 May 2022 09:30:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58028 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243716AbiEJNWU (ORCPT ); Tue, 10 May 2022 09:22:20 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 985C7134E15; Tue, 10 May 2022 06:16:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 534C7616D0; Tue, 10 May 2022 13:16:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5FB45C385D8; Tue, 10 May 2022 13:16:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188584; bh=aVuH+MV+446GnglHFZUuaSvVDT1o8j9Oc6/CrUI0p00=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bPTfDkyB6UWziItKV/7mqtlfaDhp1xAtBoKRq5d8Iq+tTtkIMK5GlnfySe+0fKkpY 0l6kxW4NxDVnhN87T2PFJfpDfCSUmm+nc04zFrF7WC8gEb/TjKutQun/7oeFmLeKUM Dq+RuuU/HSm5Z5wIUYq1YFRjLnFfx83U4ZmI170U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller Subject: [PATCH 4.14 55/78] parisc: Merge model and model name into one line in /proc/cpuinfo Date: Tue, 10 May 2022 15:07:41 +0200 Message-Id: <20220510130734.167169023@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller commit 5b89966bc96a06f6ad65f64ae4b0461918fcc9d3 upstream. The Linux tool "lscpu" shows the double amount of CPUs if we have "model" and "model name" in two different lines in /proc/cpuinfo. This change combines the model and the model name into one line. Signed-off-by: Helge Deller Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/parisc/kernel/processor.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/arch/parisc/kernel/processor.c +++ b/arch/parisc/kernel/processor.c @@ -408,8 +408,7 @@ show_cpuinfo (struct seq_file *m, void * } seq_printf(m, " (0x%02lx)\n", boot_cpu_data.pdc.capabilities); =20 - seq_printf(m, "model\t\t: %s\n" - "model name\t: %s\n", + seq_printf(m, "model\t\t: %s - %s\n", boot_cpu_data.pdc.sys_model_name, cpuinfo->dev ? cpuinfo->dev->name : "Unknown"); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7659BC35296 for ; Tue, 10 May 2022 13:24:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243996AbiEJN1r (ORCPT ); Tue, 10 May 2022 09:27:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60668 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243595AbiEJNWN (ORCPT ); Tue, 10 May 2022 09:22:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 49CA45C361; Tue, 10 May 2022 06:16:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 36F956166B; Tue, 10 May 2022 13:16:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3F622C385C2; Tue, 10 May 2022 13:16:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188587; bh=xcXfCRcoyhfyUlxipCdVEsXYo0JlNezMMEx8Crxqedw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tj4bBzIq74m6Gnv9ZgQSGkdetLvVNvksbclqgSK+7PJ91nwRRdHNPoBsmiNchSV8/ B4OFSgWnAday+/8ZrDn+IQuPwtynSl/x9WXlHcEScyhs3sUKNsa0YlVJijJvsNIg2X 2RqJO/uJwL4zgHAo0gAxUKiuXrAlcBe546MC9kNU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.14 56/78] ALSA: fireworks: fix wrong return count shorter than expected by 4 bytes Date: Tue, 10 May 2022 15:07:42 +0200 Message-Id: <20220510130734.195164302@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Sakamoto commit eb9d84b0ffe39893cb23b0b6712bbe3637fa25fa upstream. ALSA fireworks driver has a bug in its initial state to return count shorter than expected by 4 bytes to userspace applications when handling response frame for Echo Audio Fireworks transaction. It's due to missing addition of the size for the type of event in ALSA firewire stack. Fixes: 555e8a8f7f14 ("ALSA: fireworks: Add command/response functionality i= nto hwdep interface") Cc: Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220424102428.21109-1-o-takashi@sakamocchi= .jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/firewire/fireworks/fireworks_hwdep.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/firewire/fireworks/fireworks_hwdep.c +++ b/sound/firewire/fireworks/fireworks_hwdep.c @@ -35,6 +35,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, type =3D SNDRV_FIREWIRE_EVENT_EFW_RESPONSE; if (copy_to_user(buf, &type, sizeof(type))) return -EFAULT; + count +=3D sizeof(type); remained -=3D sizeof(type); buf +=3D sizeof(type); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC852C433FE for ; Tue, 10 May 2022 13:25:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243305AbiEJN3S (ORCPT ); Tue, 10 May 2022 09:29:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243609AbiEJNWO (ORCPT ); Tue, 10 May 2022 09:22:14 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B4BA65FF3F; Tue, 10 May 2022 06:16:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2A6C461574; Tue, 10 May 2022 13:16:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 377FFC385A6; Tue, 10 May 2022 13:16:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188590; bh=iU2kGbeV2AGXng7GTOm144m3ZrXyN2g/Z2KDXwFmdEA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YNNPGJNY0UfdJkB06sbs9yRSmKkgZj2Gfe5ckYUY2dmYkJQDAe/Mp40ptytEyd7// 8It9GVQZZRa2Lj2c/VMbqudjrcsLRvEZ9dXLOdhXLHICZZSsZ9Fp4sqf2y4NgRcWoI IcudIzSI+l32QHBwp2Qq0vbB8FzwF3Vi+7oRytJw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "wanghai (M)" , Trond Myklebust Subject: [PATCH 4.14 57/78] Revert "SUNRPC: attempt AF_LOCAL connect on setup" Date: Tue, 10 May 2022 15:07:43 +0200 Message-Id: <20220510130734.222454597@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Trond Myklebust commit a3d0562d4dc039bca39445e1cddde7951662e17d upstream. This reverts commit 7073ea8799a8cf73db60270986f14e4aae20fa80. We must not try to connect the socket while the transport is under construction, because the mechanisms to safely tear it down are not in place. As the code stands, we end up leaking the sockets on a connection error. Reported-by: wanghai (M) Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sunrpc/xprtsock.c | 3 --- 1 file changed, 3 deletions(-) --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -2941,9 +2941,6 @@ static struct rpc_xprt *xs_setup_local(s } xprt_set_bound(xprt); xs_format_peer_addresses(xprt, "local", RPCBIND_NETID_LOCAL); - ret =3D ERR_PTR(xs_local_setup_socket(transport)); - if (ret) - goto out_err; break; default: ret =3D ERR_PTR(-EAFNOSUPPORT); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E7E8C43217 for ; Tue, 10 May 2022 13:28:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243589AbiEJNbc (ORCPT ); Tue, 10 May 2022 09:31:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45972 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242720AbiEJNW1 (ORCPT ); Tue, 10 May 2022 09:22:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3DDE71632A7; Tue, 10 May 2022 06:16:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C170FB81DA7; Tue, 10 May 2022 13:16:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 166E6C385C9; Tue, 10 May 2022 13:16:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188593; bh=lyBqSR0EnOVA8i/cJ7U1vjDXnqHAh9OtfQbsNi3k8Ys=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aFozMqH3v16zvI+2cPOdl8+Zk+AvZIumItKiOJ/erGYn4uqivycC/AY6g8D1pbVq2 4EoaZtNmG5MK20ulPjjjOLe8oQ8XVXLvQrOzj5n/B1PEMLWKmZb30w16VqgYIoTinG ZeRcueKjv8RhxBxn1tc6LC4OIWyl2znJQlrKRJn0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengfeng Ye , Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.14 58/78] firewire: fix potential uaf in outbound_phy_packet_callback() Date: Tue, 10 May 2022 15:07:44 +0200 Message-Id: <20220510130734.251438789@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengfeng Ye commit b7c81f80246fac44077166f3e07103affe6db8ff upstream. &e->event and e point to the same address, and &e->event could be freed in queue_event. So there is a potential uaf issue if we dereference e after calling queue_event(). Fix this by adding a temporary variable to maintain e->client in advance, this can avoid the potential uaf issue. Cc: Signed-off-by: Chengfeng Ye Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220409041243.603210-2-o-takashi@sakamocch= i.jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/firewire/core-cdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/firewire/core-cdev.c +++ b/drivers/firewire/core-cdev.c @@ -1495,6 +1495,7 @@ static void outbound_phy_packet_callback { struct outbound_phy_packet_event *e =3D container_of(packet, struct outbound_phy_packet_event, p); + struct client *e_client; =20 switch (status) { /* expected: */ @@ -1511,9 +1512,10 @@ static void outbound_phy_packet_callback } e->phy_packet.data[0] =3D packet->timestamp; =20 + e_client =3D e->client; queue_event(e->client, &e->event, &e->phy_packet, sizeof(e->phy_packet) + e->phy_packet.length, NULL, 0); - client_put(e->client); + client_put(e_client); } =20 static int ioctl_send_phy_packet(struct client *client, union ioctl_arg *a= rg) From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30B7AC433F5 for ; Tue, 10 May 2022 13:25:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243021AbiEJN3L (ORCPT ); Tue, 10 May 2022 09:29:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243652AbiEJNWQ (ORCPT ); Tue, 10 May 2022 09:22:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8887A8CDB9; Tue, 10 May 2022 06:16:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 68CEA615F8; Tue, 10 May 2022 13:16:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 72969C385C6; Tue, 10 May 2022 13:16:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188596; bh=0w0xQr+Pu/llxYWRbwOnMuOVCGxAkws6yzESbdnf+gk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fXBJznsgb9MbeIuuPLPQIJGffDgvTAWImECTNoUWG6TVDPrIk4cDSD2JSh5n02QUL +5khG9a78BS+H63rxQd3qLPOF1XCYwo2W3SVTwTQ7WW7fjTuZ/1oVe+UPEV/X6JHMW +8LaJT4ykojb3CalOI+GrroFlOldagQRsU0WYCZY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jakob Koschel , Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.14 59/78] firewire: remove check of list iterator against head past the loop body Date: Tue, 10 May 2022 15:07:45 +0200 Message-Id: <20220510130734.280568671@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jakob Koschel commit 9423973869bd4632ffe669f950510c49296656e0 upstream. When list_for_each_entry() completes the iteration over the whole list without breaking the loop, the iterator value will be a bogus pointer computed based on the head element. While it is safe to use the pointer to determine if it was computed based on the head element, either with list_entry_is_head() or &pos->member =3D=3D head, using the iterator variable after the loop should be avoided. In preparation to limit the scope of a list iterator to the list traversal loop, use a dedicated pointer to point to the found element [1]. Link: https://lore.kernel.org/all/CAHk-=3DwgRr_D8CB-D9Kg-c=3DEHreAsk5SqXPwr= 9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] Cc: Signed-off-by: Jakob Koschel Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220409041243.603210-3-o-takashi@sakamocch= i.jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/firewire/core-transaction.c | 30 ++++++++++++++++-------------- drivers/firewire/sbp2.c | 13 +++++++------ 2 files changed, 23 insertions(+), 20 deletions(-) --- a/drivers/firewire/core-transaction.c +++ b/drivers/firewire/core-transaction.c @@ -86,24 +86,25 @@ static int try_cancel_split_timeout(stru static int close_transaction(struct fw_transaction *transaction, struct fw_card *card, int rcode) { - struct fw_transaction *t; + struct fw_transaction *t =3D NULL, *iter; unsigned long flags; =20 spin_lock_irqsave(&card->lock, flags); - list_for_each_entry(t, &card->transaction_list, link) { - if (t =3D=3D transaction) { - if (!try_cancel_split_timeout(t)) { + list_for_each_entry(iter, &card->transaction_list, link) { + if (iter =3D=3D transaction) { + if (!try_cancel_split_timeout(iter)) { spin_unlock_irqrestore(&card->lock, flags); goto timed_out; } - list_del_init(&t->link); - card->tlabel_mask &=3D ~(1ULL << t->tlabel); + list_del_init(&iter->link); + card->tlabel_mask &=3D ~(1ULL << iter->tlabel); + t =3D iter; break; } } spin_unlock_irqrestore(&card->lock, flags); =20 - if (&t->link !=3D &card->transaction_list) { + if (t) { t->callback(card, rcode, NULL, 0, t->callback_data); return 0; } @@ -938,7 +939,7 @@ EXPORT_SYMBOL(fw_core_handle_request); =20 void fw_core_handle_response(struct fw_card *card, struct fw_packet *p) { - struct fw_transaction *t; + struct fw_transaction *t =3D NULL, *iter; unsigned long flags; u32 *data; size_t data_length; @@ -950,20 +951,21 @@ void fw_core_handle_response(struct fw_c rcode =3D HEADER_GET_RCODE(p->header[1]); =20 spin_lock_irqsave(&card->lock, flags); - list_for_each_entry(t, &card->transaction_list, link) { - if (t->node_id =3D=3D source && t->tlabel =3D=3D tlabel) { - if (!try_cancel_split_timeout(t)) { + list_for_each_entry(iter, &card->transaction_list, link) { + if (iter->node_id =3D=3D source && iter->tlabel =3D=3D tlabel) { + if (!try_cancel_split_timeout(iter)) { spin_unlock_irqrestore(&card->lock, flags); goto timed_out; } - list_del_init(&t->link); - card->tlabel_mask &=3D ~(1ULL << t->tlabel); + list_del_init(&iter->link); + card->tlabel_mask &=3D ~(1ULL << iter->tlabel); + t =3D iter; break; } } spin_unlock_irqrestore(&card->lock, flags); =20 - if (&t->link =3D=3D &card->transaction_list) { + if (!t) { timed_out: fw_notice(card, "unsolicited response (source %x, tlabel %x)\n", source, tlabel); --- a/drivers/firewire/sbp2.c +++ b/drivers/firewire/sbp2.c @@ -421,7 +421,7 @@ static void sbp2_status_write(struct fw_ void *payload, size_t length, void *callback_data) { struct sbp2_logical_unit *lu =3D callback_data; - struct sbp2_orb *orb; + struct sbp2_orb *orb =3D NULL, *iter; struct sbp2_status status; unsigned long flags; =20 @@ -446,17 +446,18 @@ static void sbp2_status_write(struct fw_ =20 /* Lookup the orb corresponding to this status write. */ spin_lock_irqsave(&lu->tgt->lock, flags); - list_for_each_entry(orb, &lu->orb_list, link) { + list_for_each_entry(iter, &lu->orb_list, link) { if (STATUS_GET_ORB_HIGH(status) =3D=3D 0 && - STATUS_GET_ORB_LOW(status) =3D=3D orb->request_bus) { - orb->rcode =3D RCODE_COMPLETE; - list_del(&orb->link); + STATUS_GET_ORB_LOW(status) =3D=3D iter->request_bus) { + iter->rcode =3D RCODE_COMPLETE; + list_del(&iter->link); + orb =3D iter; break; } } spin_unlock_irqrestore(&lu->tgt->lock, flags); =20 - if (&orb->link !=3D &lu->orb_list) { + if (orb) { orb->callback(orb, &status); kref_put(&orb->kref, free_orb); /* orb callback reference */ } else { From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BEB81C433EF for ; Tue, 10 May 2022 13:26:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243189AbiEJNaH (ORCPT ); Tue, 10 May 2022 09:30:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60462 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242843AbiEJNWi (ORCPT ); Tue, 10 May 2022 09:22:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6C0A81868DB; Tue, 10 May 2022 06:16:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2B91FB81DA2; Tue, 10 May 2022 13:16:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 79E98C385A6; Tue, 10 May 2022 13:16:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188599; bh=toYvJ6hGHqimqqvlv0Z6FParKGxkAv835wQIL1uz/iA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ywXmtoL8BKb5kl+z22FHORw17Ehza3DU5Snz55N5an2y0b3x2WlaOJIGWWnODDW8i OmLPaYnMUww+91EsdUd/XRpQJ0ZawJhKFXI4iImkINR0lxBTQ17e70tgqiRL6fzDP3 za9ZV09UxcUybLeJru4Pys/uSf7+5TYeTo2C+BsU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Niels Dossche , Takashi Sakamoto , Takashi Iwai Subject: [PATCH 4.14 60/78] firewire: core: extend card->lock in fw_core_handle_bus_reset Date: Tue, 10 May 2022 15:07:46 +0200 Message-Id: <20220510130734.309553864@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Niels Dossche commit a7ecbe92b9243edbe94772f6f2c854e4142a3345 upstream. card->local_node and card->bm_retries are both always accessed under card->lock. fw_core_handle_bus_reset has a check whose condition depends on card->local_node and whose body writes to card->bm_retries. Both of these accesses are not under card->lock. Move the lock acquiring of card->lock to before this check such that these accesses do happen when card->lock is held. fw_destroy_nodes is called inside the check. Since fw_destroy_nodes already acquires card->lock inside its function body, move this out to the callsites of fw_destroy_nodes. Also add a comment to indicate which locking is necessary when calling fw_destroy_nodes. Cc: Signed-off-by: Niels Dossche Signed-off-by: Takashi Sakamoto Link: https://lore.kernel.org/r/20220409041243.603210-4-o-takashi@sakamocch= i.jp Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/firewire/core-card.c | 3 +++ drivers/firewire/core-topology.c | 9 +++------ 2 files changed, 6 insertions(+), 6 deletions(-) --- a/drivers/firewire/core-card.c +++ b/drivers/firewire/core-card.c @@ -681,6 +681,7 @@ EXPORT_SYMBOL_GPL(fw_card_release); void fw_core_remove_card(struct fw_card *card) { struct fw_card_driver dummy_driver =3D dummy_driver_template; + unsigned long flags; =20 card->driver->update_phy_reg(card, 4, PHY_LINK_ACTIVE | PHY_CONTENDER, 0); @@ -695,7 +696,9 @@ void fw_core_remove_card(struct fw_card dummy_driver.stop_iso =3D card->driver->stop_iso; card->driver =3D &dummy_driver; =20 + spin_lock_irqsave(&card->lock, flags); fw_destroy_nodes(card); + spin_unlock_irqrestore(&card->lock, flags); =20 /* Wait for all users, especially device workqueue jobs, to finish. */ fw_card_put(card); --- a/drivers/firewire/core-topology.c +++ b/drivers/firewire/core-topology.c @@ -387,16 +387,13 @@ static void report_found_node(struct fw_ card->bm_retries =3D 0; } =20 +/* Must be called with card->lock held */ void fw_destroy_nodes(struct fw_card *card) { - unsigned long flags; - - spin_lock_irqsave(&card->lock, flags); card->color++; if (card->local_node !=3D NULL) for_each_fw_node(card, card->local_node, report_lost_node); card->local_node =3D NULL; - spin_unlock_irqrestore(&card->lock, flags); } =20 static void move_tree(struct fw_node *node0, struct fw_node *node1, int po= rt) @@ -522,6 +519,8 @@ void fw_core_handle_bus_reset(struct fw_ struct fw_node *local_node; unsigned long flags; =20 + spin_lock_irqsave(&card->lock, flags); + /* * If the selfID buffer is not the immediate successor of the * previously processed one, we cannot reliably compare the @@ -533,8 +532,6 @@ void fw_core_handle_bus_reset(struct fw_ card->bm_retries =3D 0; } =20 - spin_lock_irqsave(&card->lock, flags); - card->broadcast_channel_allocated =3D card->broadcast_channel_auto_alloca= ted; card->node_id =3D node_id; /* From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11E66C433EF for ; Tue, 10 May 2022 13:25:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242948AbiEJN3e (ORCPT ); Tue, 10 May 2022 09:29:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242878AbiEJNWj (ORCPT ); Tue, 10 May 2022 09:22:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A4381A29DE; Tue, 10 May 2022 06:16:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EC42EB81D7A; Tue, 10 May 2022 13:16:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 590ECC385C6; Tue, 10 May 2022 13:16:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188602; bh=7ni6v9EcwTeRnymZXJCe2F2vv9mVcGy9VAalwjR/0ls=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G9itMwvt8im3pN8BvabH2mjS981tB854PiDgRejri6Vj+hj8HX5mXLGkhUrU1Dlpo TYbFzre/5E+s3cnWuFDqs3Cg+nQ7HhlPFwpJLfyZMnHWASC4uGjMN81wsO81Wuro19 xSNFUBAceeaQZXjRUKjWs0A6wEL+Dt3jh6qcXJ3g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Brown , Charles Keepax Subject: [PATCH 4.14 61/78] ASoC: wm8958: Fix change notifications for DSP controls Date: Tue, 10 May 2022 15:07:47 +0200 Message-Id: <20220510130734.338358207@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mark Brown commit b4f5c6b2e52b27462c0599e64e96e53b58438de1 upstream. The WM8958 DSP controls all return 0 on successful write, not a boolean value indicating if the write changed the value of the control. Fix this by returning 1 after a change, there is already a check at the start of each put() that skips the function in the case that there is no change. Signed-off-by: Mark Brown Acked-by: Charles Keepax Link: https://lore.kernel.org/r/20220416125408.197440-1-broonie@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/soc/codecs/wm8958-dsp2.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/sound/soc/codecs/wm8958-dsp2.c +++ b/sound/soc/codecs/wm8958-dsp2.c @@ -533,7 +533,7 @@ static int wm8958_mbc_put(struct snd_kco =20 wm8958_dsp_apply(codec, mbc, wm8994->mbc_ena[mbc]); =20 - return 0; + return 1; } =20 #define WM8958_MBC_SWITCH(xname, xval) {\ @@ -659,7 +659,7 @@ static int wm8958_vss_put(struct snd_kco =20 wm8958_dsp_apply(codec, vss, wm8994->vss_ena[vss]); =20 - return 0; + return 1; } =20 =20 @@ -733,7 +733,7 @@ static int wm8958_hpf_put(struct snd_kco =20 wm8958_dsp_apply(codec, hpf % 3, ucontrol->value.integer.value[0]); =20 - return 0; + return 1; } =20 #define WM8958_HPF_SWITCH(xname, xval) {\ @@ -827,7 +827,7 @@ static int wm8958_enh_eq_put(struct snd_ =20 wm8958_dsp_apply(codec, eq, ucontrol->value.integer.value[0]); =20 - return 0; + return 1; } =20 #define WM8958_ENH_EQ_SWITCH(xname, xval) {\ From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9F225C433F5 for ; Tue, 10 May 2022 13:28:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243350AbiEJNa4 (ORCPT ); Tue, 10 May 2022 09:30:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45972 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243074AbiEJNWy (ORCPT ); Tue, 10 May 2022 09:22:54 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A8C7B52E73; Tue, 10 May 2022 06:17:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EB73CB81CE7; Tue, 10 May 2022 13:16:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3BCDBC385C6; Tue, 10 May 2022 13:16:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188608; bh=2SQP/iK9dFo1azXQPmUtMwnMxA2HAIdd4EY0EdaBOnI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uA8dnf9xHnREbTcvJOrBbKeLj/NsO96SZ9l8lExRdgjVF+UHSJ1dyoub2g+z+QQty epo7M/nqDCL9obu9s0rMdDCH4Ty5GH5HcATHUHyViwbSNaVirdSl57lTLjF7OFpHk+ IGusFEY/ix3lAH8zkwoL92+TDtEyBEa4ctWHQ/os= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Andreas Larsson , Marc Kleine-Budde Subject: [PATCH 4.14 62/78] can: grcan: grcan_close(): fix deadlock Date: Tue, 10 May 2022 15:07:48 +0200 Message-Id: <20220510130734.367303060@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 47f070a63e735bcc8d481de31be1b5a1aa62b31c upstream. There are deadlocks caused by del_timer_sync(&priv->hang_timer) and del_timer_sync(&priv->rr_timer) in grcan_close(), one of the deadlocks are shown below: (Thread 1) | (Thread 2) | grcan_reset_timer() grcan_close() | mod_timer() spin_lock_irqsave() //(1) | (wait a time) ... | grcan_initiate_running_reset() del_timer_sync() | spin_lock_irqsave() //(2) (wait timer to stop) | ... We hold priv->lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need priv->lock in position (2) of thread 2. As a result, grcan_close() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock. Link: https://lore.kernel.org/all/20220425042400.66517-1-duoming@zju.edu.cn Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN co= res") Cc: stable@vger.kernel.org Signed-off-by: Duoming Zhou Reviewed-by: Andreas Larsson Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/grcan.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/can/grcan.c +++ b/drivers/net/can/grcan.c @@ -1117,8 +1117,10 @@ static int grcan_close(struct net_device =20 priv->closing =3D true; if (priv->need_txbug_workaround) { + spin_unlock_irqrestore(&priv->lock, flags); del_timer_sync(&priv->hang_timer); del_timer_sync(&priv->rr_timer); + spin_lock_irqsave(&priv->lock, flags); } netif_stop_queue(dev); grcan_stop_hardware(dev); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 405C5C4321E for ; Tue, 10 May 2022 13:28:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243604AbiEJNbh (ORCPT ); Tue, 10 May 2022 09:31:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58814 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242821AbiEJNWh (ORCPT ); Tue, 10 May 2022 09:22:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9E63C16C5F1; Tue, 10 May 2022 06:16:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5772E615F8; Tue, 10 May 2022 13:16:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4DA6FC385C6; Tue, 10 May 2022 13:16:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188611; bh=iXVVI4US+Q041s1HhJh5ERMO/BF9bJSOGPx+QLMsC9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vH9NFvs8BYAvPo0+zbVCZzjnl4wPYOjLbKx8rU70RZReo2TDlNQ69/9BmeyWqLYxN GZZjK3EeCxjKit/uAaf5x7k6YsCaQ0PICwRBnNbaFjM3Ppq3XVqGUbgpKCEtXyVbL8 cY/PTUtiSXGMP5FFPOvjrjkGZcRZAcRDRkutLwfo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Hellstrom , Andreas Larsson , Marc Kleine-Budde Subject: [PATCH 4.14 63/78] can: grcan: use ofdev->dev when allocating DMA memory Date: Tue, 10 May 2022 15:07:49 +0200 Message-Id: <20220510130734.397351505@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Hellstrom commit 101da4268626b00d16356a6bf284d66e44c46ff9 upstream. Use the device of the device tree node should be rather than the device of the struct net_device when allocating DMA buffers. The driver got away with it on sparc32 until commit 53b7670e5735 ("sparc: factor the dma coherent mapping into helper") after which the driver oopses. Fixes: 6cec9b07fe6a ("can: grcan: Add device driver for GRCAN and GRHCAN co= res") Link: https://lore.kernel.org/all/20220429084656.29788-2-andreas@gaisler.com Cc: stable@vger.kernel.org Signed-off-by: Daniel Hellstrom Signed-off-by: Andreas Larsson Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/grcan.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/net/can/grcan.c +++ b/drivers/net/can/grcan.c @@ -252,6 +252,7 @@ struct grcan_device_config { struct grcan_priv { struct can_priv can; /* must be the first member */ struct net_device *dev; + struct device *ofdev_dev; struct napi_struct napi; =20 struct grcan_registers __iomem *regs; /* ioremap'ed registers */ @@ -928,7 +929,7 @@ static void grcan_free_dma_buffers(struc struct grcan_priv *priv =3D netdev_priv(dev); struct grcan_dma *dma =3D &priv->dma; =20 - dma_free_coherent(&dev->dev, dma->base_size, dma->base_buf, + dma_free_coherent(priv->ofdev_dev, dma->base_size, dma->base_buf, dma->base_handle); memset(dma, 0, sizeof(*dma)); } @@ -953,7 +954,7 @@ static int grcan_allocate_dma_buffers(st =20 /* Extra GRCAN_BUFFER_ALIGNMENT to allow for alignment */ dma->base_size =3D lsize + ssize + GRCAN_BUFFER_ALIGNMENT; - dma->base_buf =3D dma_alloc_coherent(&dev->dev, + dma->base_buf =3D dma_alloc_coherent(priv->ofdev_dev, dma->base_size, &dma->base_handle, GFP_KERNEL); @@ -1606,6 +1607,7 @@ static int grcan_setup_netdev(struct pla memcpy(&priv->config, &grcan_module_config, sizeof(struct grcan_device_config)); priv->dev =3D dev; + priv->ofdev_dev =3D &ofdev->dev; priv->regs =3D base; priv->can.bittiming_const =3D &grcan_bittiming_const; priv->can.do_set_bittiming =3D grcan_set_bittiming; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A98AC433FE for ; Tue, 10 May 2022 13:26:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243294AbiEJNaB (ORCPT ); Tue, 10 May 2022 09:30:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242879AbiEJNWj (ORCPT ); Tue, 10 May 2022 09:22:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 82C7819FB03; Tue, 10 May 2022 06:16:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3442B6165A; Tue, 10 May 2022 13:16:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 486B5C385C9; Tue, 10 May 2022 13:16:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188614; bh=PLBcffHUTxEwDYZ2I2HzXLMI033QZq0mU5i+o1QVl8o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=InLX1GgHU1XLSBf6rPiRrOzffV7JTdWwie6LSBe0DG+j9FQOV0ex6bqDlkXOwRsEB xXC5m5xs83dKFoHa/xT2/XwlR32KZEYoCintbJx7KY22DPp6b6qwFRP2jGC+cRk/Ve l1WSwtNHy5QZhA2NG4Xd/ETckajRVIIIbulllivs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , "David S. Miller" Subject: [PATCH 4.14 64/78] nfc: replace improper check device_is_registered() in netlink related functions Date: Tue, 10 May 2022 15:07:50 +0200 Message-Id: <20220510130734.427117291@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit da5c0f119203ad9728920456a0f52a6d850c01cd upstream. The device_is_registered() in nfc core is used to check whether nfc device is registered in netlink related functions such as nfc_fw_download(), nfc_dev_up() and so on. Although device_is_registered() is protected by device_lock, there is still a race condition between device_del() and device_is_registered(). The root cause is that kobject_del() in device_del() is not protected by device_lock. (cleanup task) | (netlink task) | nfc_unregister_device | nfc_fw_download device_del | device_lock ... | if (!device_is_registered)//(1) kobject_del//(2) | ... ... | device_unlock The device_is_registered() returns the value of state_in_sysfs and the state_in_sysfs is set to zero in kobject_del(). If we pass check in position (1), then set zero in position (2). As a result, the check in position (1) is useless. This patch uses bool variable instead of device_is_registered() to judge whether the nfc device is registered, which is well synchronized. Fixes: 3e256b8f8dfa ("NFC: add nfc subsystem core") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/nfc/core.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) --- a/net/nfc/core.c +++ b/net/nfc/core.c @@ -50,7 +50,7 @@ int nfc_fw_download(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -106,7 +106,7 @@ int nfc_dev_up(struct nfc_dev *dev) =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -154,7 +154,7 @@ int nfc_dev_down(struct nfc_dev *dev) =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -218,7 +218,7 @@ int nfc_start_poll(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -257,7 +257,7 @@ int nfc_stop_poll(struct nfc_dev *dev) =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -302,7 +302,7 @@ int nfc_dep_link_up(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -346,7 +346,7 @@ int nfc_dep_link_down(struct nfc_dev *de =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -412,7 +412,7 @@ int nfc_activate_target(struct nfc_dev * =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -458,7 +458,7 @@ int nfc_deactivate_target(struct nfc_dev =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -505,7 +505,7 @@ int nfc_data_exchange(struct nfc_dev *de =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; kfree_skb(skb); goto error; @@ -562,7 +562,7 @@ int nfc_enable_se(struct nfc_dev *dev, u =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -611,7 +611,7 @@ int nfc_disable_se(struct nfc_dev *dev, =20 device_lock(&dev->dev); =20 - if (!device_is_registered(&dev->dev)) { + if (dev->shutting_down) { rc =3D -ENODEV; goto error; } @@ -1142,6 +1142,7 @@ int nfc_register_device(struct nfc_dev * dev->rfkill =3D NULL; } } + dev->shutting_down =3D false; device_unlock(&dev->dev); =20 rc =3D nfc_genl_device_added(dev); @@ -1174,12 +1175,10 @@ void nfc_unregister_device(struct nfc_de rfkill_unregister(dev->rfkill); rfkill_destroy(dev->rfkill); } + dev->shutting_down =3D true; device_unlock(&dev->dev); =20 if (dev->ops->check_presence) { - device_lock(&dev->dev); - dev->shutting_down =3D true; - device_unlock(&dev->dev); del_timer_sync(&dev->check_pres_timer); cancel_work_sync(&dev->check_pres_work); } From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25FDFC433F5 for ; Tue, 10 May 2022 13:28:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243969AbiEJNcZ (ORCPT ); Tue, 10 May 2022 09:32:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60814 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242870AbiEJNXA (ORCPT ); Tue, 10 May 2022 09:23:00 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 460C61BE94A; Tue, 10 May 2022 06:17:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 080B3B81DA6; Tue, 10 May 2022 13:16:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6608DC385C6; Tue, 10 May 2022 13:16:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188617; bh=tUBIoF9N6X0NiJbBCmDtbiWMfzpX2+Dhrt4Z/jqBemM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WrpXPFPWEh9VD5O9KfajGgWQuydzLHIb99ggk0QB+iOTU99Mp1ylPFbxPKF8aNKgb A3jFfunRhmdhp4K8aUbabXJ/U/yRCce95I18GqF4EHrAdwasH34XLXprPlMXGxcJUB c56oUjoLm1o8iDCgbwUQEYRqMc89PCPWoLXF6PFM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , "David S. Miller" Subject: [PATCH 4.14 65/78] nfc: nfcmrvl: main: reorder destructive operations in nfcmrvl_nci_unregister_dev to avoid bugs Date: Tue, 10 May 2022 15:07:51 +0200 Message-Id: <20220510130734.455069801@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit d270453a0d9ec10bb8a802a142fb1b3601a83098 upstream. There are destructive operations such as nfcmrvl_fw_dnld_abort and gpio_free in nfcmrvl_nci_unregister_dev. The resources such as firmware, gpio and so on could be destructed while the upper layer functions such as nfcmrvl_fw_dnld_start and nfcmrvl_nci_recv_frame is executing, which leads to double-free, use-after-free and null-ptr-deref bugs. There are three situations that could lead to double-free bugs. The first situation is shown below: (Thread 1) | (Thread 2) nfcmrvl_fw_dnld_start | ... | nfcmrvl_nci_unregister_dev release_firmware() | nfcmrvl_fw_dnld_abort kfree(fw) //(1) | fw_dnld_over | release_firmware ... | kfree(fw) //(2) | ... The second situation is shown below: (Thread 1) | (Thread 2) nfcmrvl_fw_dnld_start | ... | mod_timer | (wait a time) | fw_dnld_timeout | nfcmrvl_nci_unregister_dev fw_dnld_over | nfcmrvl_fw_dnld_abort release_firmware | fw_dnld_over kfree(fw) //(1) | release_firmware ... | kfree(fw) //(2) The third situation is shown below: (Thread 1) | (Thread 2) nfcmrvl_nci_recv_frame | if(..->fw_download_in_progress)| nfcmrvl_fw_dnld_recv_frame | queue_work | | fw_dnld_rx_work | nfcmrvl_nci_unregister_dev fw_dnld_over | nfcmrvl_fw_dnld_abort release_firmware | fw_dnld_over kfree(fw) //(1) | release_firmware | kfree(fw) //(2) The firmware struct is deallocated in position (1) and deallocated in position (2) again. The crash trace triggered by POC is like below: BUG: KASAN: double-free or invalid-free in fw_dnld_over Call Trace: kfree fw_dnld_over nfcmrvl_nci_unregister_dev nci_uart_tty_close tty_ldisc_kill tty_ldisc_hangup __tty_hangup.part.0 tty_release ... What's more, there are also use-after-free and null-ptr-deref bugs in nfcmrvl_fw_dnld_start. If we deallocate firmware struct, gpio or set null to the members of priv->fw_dnld in nfcmrvl_nci_unregister_dev, then, we dereference firmware, gpio or the members of priv->fw_dnld in nfcmrvl_fw_dnld_start, the UAF or NPD bugs will happen. This patch reorders destructive operations after nci_unregister_device in order to synchronize between cleanup routine and firmware download routine. The nci_unregister_device is well synchronized. If the device is detaching, the firmware download routine will goto error. If firmware download routine is executing, nci_unregister_device will wait until firmware download routine is finished. Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/nfc/nfcmrvl/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/nfc/nfcmrvl/main.c +++ b/drivers/nfc/nfcmrvl/main.c @@ -194,6 +194,7 @@ void nfcmrvl_nci_unregister_dev(struct n { struct nci_dev *ndev =3D priv->ndev; =20 + nci_unregister_device(ndev); if (priv->ndev->nfc_dev->fw_download_in_progress) nfcmrvl_fw_dnld_abort(priv); =20 @@ -202,7 +203,6 @@ void nfcmrvl_nci_unregister_dev(struct n if (gpio_is_valid(priv->config.reset_n_io)) gpio_free(priv->config.reset_n_io); =20 - nci_unregister_device(ndev); nci_free_device(ndev); kfree(priv); } From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17906C433F5 for ; Tue, 10 May 2022 13:25:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243080AbiEJN3r (ORCPT ); Tue, 10 May 2022 09:29:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33516 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242953AbiEJNWn (ORCPT ); Tue, 10 May 2022 09:22:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6E8A91ACFB2; Tue, 10 May 2022 06:17:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2FFC26123F; Tue, 10 May 2022 13:17:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3C5CAC385C2; Tue, 10 May 2022 13:17:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188620; bh=NKHhRp6+HZv38THHVqfFc0ZPO0kyCzzKjN8CZ3PiGY8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q+e4Ar9nVBJYQhDAmwWlfzX+EHJwZdRYMmajL+v1dRvnV3RrXOCMNKb08L2kZ9rj8 ogqPUZT9jT/joe1mr1y4+KpOrKQdVhpr5wuNporyIiKcfeUTSX35n7r0/97am/XFp7 KcSgasehkcL0QJhGsQo3vTVt/de6SStDyBDbLOks= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Krzysztof Kozlowski , Paolo Abeni Subject: [PATCH 4.14 66/78] NFC: netlink: fix sleep in atomic bug when firmware download timeout Date: Tue, 10 May 2022 15:07:52 +0200 Message-Id: <20220510130734.484860647@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 4071bf121d59944d5cd2238de0642f3d7995a997 upstream. There are sleep in atomic bug that could cause kernel panic during firmware download process. The root cause is that nlmsg_new with GFP_KERNEL parameter is called in fw_dnld_timeout which is a timer handler. The call trace is shown below: BUG: sleeping function called from invalid context at include/linux/sched/m= m.h:265 Call Trace: kmem_cache_alloc_node __alloc_skb nfc_genl_fw_download_done call_timer_fn __run_timers.part.0 run_timer_softirq __do_softirq ... The nlmsg_new with GFP_KERNEL parameter may sleep during memory allocation process, and the timer handler is run as the result of a "software interrupt" that should not call any other function that could sleep. This patch changes allocation mode of netlink message from GFP_KERNEL to GFP_ATOMIC in order to prevent sleep in atomic bug. The GFP_ATOMIC flag makes memory allocation operation could be used in atomic context. Fixes: 9674da8759df ("NFC: Add firmware upload netlink command") Fixes: 9ea7187c53f6 ("NFC: netlink: Rename CMD_FW_UPLOAD to CMD_FW_DOWNLOAD= ") Signed-off-by: Duoming Zhou Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220504055847.38026-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/nfc/netlink.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/nfc/netlink.c +++ b/net/nfc/netlink.c @@ -1251,7 +1251,7 @@ int nfc_genl_fw_download_done(struct nfc struct sk_buff *msg; void *hdr; =20 - msg =3D nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + msg =3D nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); if (!msg) return -ENOMEM; =20 @@ -1267,7 +1267,7 @@ int nfc_genl_fw_download_done(struct nfc =20 genlmsg_end(msg, hdr); =20 - genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_KERNEL); + genlmsg_multicast(&nfc_genl_family, msg, 0, 0, GFP_ATOMIC); =20 return 0; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45161C352A7 for ; Tue, 10 May 2022 13:28:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244074AbiEJNce (ORCPT ); Tue, 10 May 2022 09:32:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45954 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240821AbiEJNXc (ORCPT ); Tue, 10 May 2022 09:23:32 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BF6FC1C15C2; Tue, 10 May 2022 06:17:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 15294CE1EE5; Tue, 10 May 2022 13:17:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2B385C385C9; Tue, 10 May 2022 13:17:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188623; bh=beJbuLc5DeQE1QzkilhzXFk8FrAnqajPtypHf3GrpYA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QG9OWtC4PDtqTE/8hOKUhRFSSyr814Camv9iA2kL2vbRU70ivOjRKLUCaXM5NvTxb Y70QNvRgBCLi9pPULSlXi03G/Fy/ejIVDB42bTHPDnHtC8jQqgsJosLpVrSKMN3PJZ hDRqFhnmL+ZhznA1XmY5Ukq9slV3FD/pjmG8WPxE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Armin Wolf , Guenter Roeck Subject: [PATCH 4.14 67/78] hwmon: (adt7470) Fix warning on module removal Date: Tue, 10 May 2022 15:07:53 +0200 Message-Id: <20220510130734.514033328@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Armin Wolf commit 7b2666ce445c700b8dcee994da44ddcf050a0842 upstream. When removing the adt7470 module, a warning might be printed: do not call blocking ops when !TASK_RUNNING; state=3D1 set at [] adt7470_update_thread+0x7b/0x130 [adt7470] This happens because adt7470_update_thread() can leave the kthread in TASK_INTERRUPTIBLE state when the kthread is being stopped before the call of set_current_state(). Since kthread_exit() might sleep in exit_signals(), the warning is printed. Fix that by using schedule_timeout_interruptible() and removing the call of set_current_state(). This causes TASK_INTERRUPTIBLE to be set after kthread_should_stop() which might cause the kthread to exit. Reported-by: Zheyu Ma Fixes: 93cacfd41f82 (hwmon: (adt7470) Allow faster removal) Signed-off-by: Armin Wolf Tested-by: Zheyu Ma Link: https://lore.kernel.org/r/20220407101312.13331-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/hwmon/adt7470.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/hwmon/adt7470.c +++ b/drivers/hwmon/adt7470.c @@ -33,6 +33,7 @@ #include #include #include +#include =20 /* Addresses to scan */ static const unsigned short normal_i2c[] =3D { 0x2C, 0x2E, 0x2F, I2C_CLIEN= T_END }; @@ -273,11 +274,10 @@ static int adt7470_update_thread(void *p adt7470_read_temperatures(client, data); mutex_unlock(&data->lock); =20 - set_current_state(TASK_INTERRUPTIBLE); if (kthread_should_stop()) break; =20 - schedule_timeout(msecs_to_jiffies(data->auto_update_interval)); + schedule_timeout_interruptible(msecs_to_jiffies(data->auto_update_interv= al)); } =20 return 0; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C86DAC433EF for ; Tue, 10 May 2022 13:26:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243343AbiEJNah (ORCPT ); Tue, 10 May 2022 09:30:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45964 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243104AbiEJNWz (ORCPT ); Tue, 10 May 2022 09:22:55 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EAB7B1B1844; Tue, 10 May 2022 06:17:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CD536B81DA0; Tue, 10 May 2022 13:17:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 28E03C385C2; Tue, 10 May 2022 13:17:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188626; bh=6TDfajJ8pBMh+JcLy099ip64RR+pHVaqJxecjE9Erfk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oc6aaJWka96HAvjG6Qu/8EPCrlPllO5wZ5EqWVPJp0EGR5uUJNueAerEbxBv2us0m L9SyeQgH6pgeZ9KVD9C38bSM91qKAvMiuErDzhMc6YQUNWIuUHQUPOKsf/1chDfazH fTYkuW7ZK7pvxeHbNbedoEFRp9Vhm28TjQwCWy5o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sascha Hauer , Codrin Ciubotariu , Mark Brown Subject: [PATCH 4.14 68/78] ASoC: dmaengine: Restore NULL prepare_slave_config() callback Date: Tue, 10 May 2022 15:07:54 +0200 Message-Id: <20220510130734.543705295@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Codrin Ciubotariu commit 660564fc9a92a893a14f255be434f7ea0b967901 upstream. As pointed out by Sascha Hauer, this patch changes: if (pmc->config && !pcm->config->prepare_slave_config) to: if (pmc->config && !pcm->config->prepare_slave_config) snd_dmaengine_pcm_prepare_slave_config() This breaks the drivers that do not need a call to dmaengine_slave_config(). Drivers that still need to call snd_dmaengine_pcm_prepare_slave_config(), but have a NULL pcm->config->prepare_slave_config should use snd_dmaengine_pcm_prepare_slave_config() as their prepare_slave_config callback. Fixes: 9a1e13440a4f ("ASoC: dmaengine: do not use a NULL prepare_slave_conf= ig() callback") Reported-by: Sascha Hauer Signed-off-by: Codrin Ciubotariu Link: https://lore.kernel.org/r/20220421125403.2180824-1-codrin.ciubotariu@= microchip.com Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/soc/soc-generic-dmaengine-pcm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/sound/soc/soc-generic-dmaengine-pcm.c +++ b/sound/soc/soc-generic-dmaengine-pcm.c @@ -98,10 +98,10 @@ static int dmaengine_pcm_hw_params(struc =20 memset(&slave_config, 0, sizeof(slave_config)); =20 - if (pcm->config && pcm->config->prepare_slave_config) - prepare_slave_config =3D pcm->config->prepare_slave_config; - else + if (!pcm->config) prepare_slave_config =3D snd_dmaengine_pcm_prepare_slave_config; + else + prepare_slave_config =3D pcm->config->prepare_slave_config; =20 if (prepare_slave_config) { ret =3D prepare_slave_config(substream, params, &slave_config); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25A45C433F5 for ; Tue, 10 May 2022 13:26:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243306AbiEJNac (ORCPT ); Tue, 10 May 2022 09:30:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45998 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243106AbiEJNW5 (ORCPT ); Tue, 10 May 2022 09:22:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 33F4553A76; Tue, 10 May 2022 06:17:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EEE3BB81DA4; Tue, 10 May 2022 13:17:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 24D73C385C6; Tue, 10 May 2022 13:17:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188629; bh=PpHB42D2WhzR1hdSa3ILbnlTtl5eQexm51QPCFTqxsg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cMSn5tESh7Lmo5WWSamzIqIijcZr5nuU9+Kt+WK9tuf0+4sVKdcttPsEw6NDmMHP5 bmDWp5js6Vd7yQsK9i0yL9W5lZp+n6MYYVO5UQwHt9EXVRXw/ESvPuholaeuRS1IuC PQx+RrYssTdk/FNs3XN8KKRTrJCqZu/dzJBSKDnQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shravya Kumbham , Radhey Shyam Pandey , Paolo Abeni Subject: [PATCH 4.14 69/78] net: emaclite: Add error handling for of_address_to_resource() Date: Tue, 10 May 2022 15:07:55 +0200 Message-Id: <20220510130734.573146434@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Shravya Kumbham commit 7a6bc33ab54923d325d9a1747ec9652c4361ebd1 upstream. check the return value of of_address_to_resource() and also add missing of_node_put() for np and npp nodes. Fixes: e0a3bc65448c ("net: emaclite: Support multiple phys connected to one= MDIO bus") Addresses-Coverity: Event check_return value. Signed-off-by: Shravya Kumbham Signed-off-by: Radhey Shyam Pandey Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) --- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c +++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c @@ -817,10 +817,10 @@ static int xemaclite_mdio_write(struct m static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev) { struct mii_bus *bus; - int rc; struct resource res; struct device_node *np =3D of_get_parent(lp->phy_node); struct device_node *npp; + int rc, ret; =20 /* Don't register the MDIO bus if the phy_node or its parent node * can't be found. @@ -830,8 +830,14 @@ static int xemaclite_mdio_setup(struct n return -ENODEV; } npp =3D of_get_parent(np); - - of_address_to_resource(npp, 0, &res); + ret =3D of_address_to_resource(npp, 0, &res); + of_node_put(npp); + if (ret) { + dev_err(dev, "%s resource error!\n", + dev->of_node->full_name); + of_node_put(np); + return ret; + } if (lp->ndev->mem_start !=3D res.start) { struct phy_device *phydev; phydev =3D of_phy_find_device(lp->phy_node); @@ -840,6 +846,7 @@ static int xemaclite_mdio_setup(struct n "MDIO of the phy is not registered yet\n"); else put_device(&phydev->mdio.dev); + of_node_put(np); return 0; } =20 @@ -852,6 +859,7 @@ static int xemaclite_mdio_setup(struct n bus =3D mdiobus_alloc(); if (!bus) { dev_err(dev, "Failed to allocate mdiobus\n"); + of_node_put(np); return -ENOMEM; } =20 @@ -866,6 +874,7 @@ static int xemaclite_mdio_setup(struct n lp->mii_bus =3D bus; =20 rc =3D of_mdiobus_register(bus, np); + of_node_put(np); if (rc) { dev_err(dev, "Failed to register mdio bus.\n"); goto err_register; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3FCA9C433F5 for ; Tue, 10 May 2022 13:26:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243240AbiEJNap (ORCPT ); Tue, 10 May 2022 09:30:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45996 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243103AbiEJNWz (ORCPT ); Tue, 10 May 2022 09:22:55 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 03F871C197D; Tue, 10 May 2022 06:17:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AAC8EB81DA5; Tue, 10 May 2022 13:17:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 262DFC385C2; Tue, 10 May 2022 13:17:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188632; bh=xaxQ4D3S8c6xBDzlo5MOyl9OyEkK2VqCkaI1Jbqa9UA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I2I3/f5jVeG82yCPlJR8dgtJo5/MiPRaSG6rWUJOPp2RdjMi4oe5f/xnWGzUVeJ9l WnkGeXnPERYe7uAtvpuNxrS8syqVnx/Ic5+zS8AsPbWHJ06TjOCFYO/zYKjCSWzRWX P5uyBsV3NIEz8P9mk2Ug/zTopRpFtfHQ6tAfnerE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Jakub Kicinski Subject: [PATCH 4.14 70/78] smsc911x: allow using IRQ0 Date: Tue, 10 May 2022 15:07:56 +0200 Message-Id: <20220510130734.601834439@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sergey Shtylyov commit 5ef9b803a4af0f5e42012176889b40bb2a978b18 upstream. The AlphaProject AP-SH4A-3A/AP-SH4AD-0A SH boards use IRQ0 for their SMSC LAN911x Ethernet chip, so the networking on them must have been broken by commit 965b2aa78fbc ("net/smsc911x: fix irq resource allocation failure") which filtered out 0 as well as the negative error codes -- it was kinda correct at the time, as platform_get_irq() could return 0 on of_irq_get() failure and on the actual 0 in an IRQ resource. This issue was fixed by me (back in 2016!), so we should be able to fix this driver to allow IRQ0 usage again... When merging this to the stable kernels, make sure you also merge commit e330b9a6bb35 ("platform: don't return 0 from platform_get_irq[_byname]() on error") -- that's my fix to platform_get_irq() for the DT platforms... Fixes: 965b2aa78fbc ("net/smsc911x: fix irq resource allocation failure") Signed-off-by: Sergey Shtylyov Link: https://lore.kernel.org/r/656036e4-6387-38df-b8a7-6ba683b16e63@omp.ru Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/smsc/smsc911x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/smsc/smsc911x.c +++ b/drivers/net/ethernet/smsc/smsc911x.c @@ -2446,7 +2446,7 @@ static int smsc911x_drv_probe(struct pla if (irq =3D=3D -EPROBE_DEFER) { retval =3D -EPROBE_DEFER; goto out_0; - } else if (irq <=3D 0) { + } else if (irq < 0) { pr_warn("Could not allocate irq resource\n"); retval =3D -ENODEV; goto out_0; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2A3FC4321E for ; Tue, 10 May 2022 13:28:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242701AbiEJNcx (ORCPT ); Tue, 10 May 2022 09:32:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60154 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242991AbiEJNXn (ORCPT ); Tue, 10 May 2022 09:23:43 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 112A21CD24C; Tue, 10 May 2022 06:17:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D1496B81DA2; Tue, 10 May 2022 13:17:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 30418C385A6; Tue, 10 May 2022 13:17:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188635; bh=CQI6WkPQGuCBQ1p6kqFgS0LIfUWapXnfnxB/65SJFDQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0FPf1Uvs4aubHfs01GWMsZrp1sUGYdKvF3JJJJgsh6bAzMcqd7vlovdNxcPiIXQKo az1MRYF5wxxJayy1ORYuU+zdS+PW3aeYUCO3tJHePA+k2Id5DUeF53dgS6l9vBfcx5 DJqRkD5TysBYoJLp0ML80SVy7eYA1NpOW8JkxIZc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Filipe Manana , David Sterba Subject: [PATCH 4.14 71/78] btrfs: always log symlinks in full mode Date: Tue, 10 May 2022 15:07:57 +0200 Message-Id: <20220510130734.631397637@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Filipe Manana commit d0e64a981fd841cb0f28fcd6afcac55e6f1e6994 upstream. On Linux, empty symlinks are invalid, and attempting to create one with the system call symlink(2) results in an -ENOENT error and this is explicitly documented in the man page. If we rename a symlink that was created in the current transaction and its parent directory was logged before, we actually end up logging the symlink without logging its content, which is stored in an inline extent. That means that after a power failure we can end up with an empty symlink, having no content and an i_size of 0 bytes. It can be easily reproduced like this: $ mkfs.btrfs -f /dev/sdc $ mount /dev/sdc /mnt $ mkdir /mnt/testdir $ sync # Create a file inside the directory and fsync the directory. $ touch /mnt/testdir/foo $ xfs_io -c "fsync" /mnt/testdir # Create a symlink inside the directory and then rename the symlink. $ ln -s /mnt/testdir/foo /mnt/testdir/bar $ mv /mnt/testdir/bar /mnt/testdir/baz # Now fsync again the directory, this persist the log tree. $ xfs_io -c "fsync" /mnt/testdir $ mount /dev/sdc /mnt $ stat -c %s /mnt/testdir/baz 0 $ readlink /mnt/testdir/baz $ Fix this by always logging symlinks in full mode (LOG_INODE_ALL), so that their content is also logged. A test case for fstests will follow. CC: stable@vger.kernel.org # 4.9+ Signed-off-by: Filipe Manana Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/btrfs/tree-log.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -4869,6 +4869,18 @@ static int btrfs_log_inode(struct btrfs_ } =20 /* + * For symlinks, we must always log their content, which is stored in an + * inline extent, otherwise we could end up with an empty symlink after + * log replay, which is invalid on linux (symlink(2) returns -ENOENT if + * one attempts to create an empty symlink). + * We don't need to worry about flushing delalloc, because when we create + * the inline extent when the symlink is created (we never have delalloc + * for symlinks). + */ + if (S_ISLNK(inode->vfs_inode.i_mode)) + inode_only =3D LOG_INODE_ALL; + + /* * a brute force approach to making sure we get the most uptodate * copies of everything. */ @@ -5430,7 +5442,7 @@ process_leaf: } =20 ctx->log_new_dentries =3D false; - if (type =3D=3D BTRFS_FT_DIR || type =3D=3D BTRFS_FT_SYMLINK) + if (type =3D=3D BTRFS_FT_DIR) log_mode =3D LOG_INODE_ALL; ret =3D btrfs_log_inode(trans, root, BTRFS_I(di_inode), log_mode, 0, LLONG_MAX, ctx); From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC506C46467 for ; Tue, 10 May 2022 13:28:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244237AbiEJNcq (ORCPT ); Tue, 10 May 2022 09:32:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41390 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243043AbiEJNXn (ORCPT ); Tue, 10 May 2022 09:23:43 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 679C01CEECC; Tue, 10 May 2022 06:17:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B822AB81DA0; Tue, 10 May 2022 13:17:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1CC79C385CB; Tue, 10 May 2022 13:17:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188641; bh=Ywp8AQPMexBaG2LWlyMH3o6rfZDkUcOInMlkxk5lBYs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZrGbkGxuK1uD5iIN1HUADPguf+zDVEWmv2jUQonegrV0E8DkcQGqr7TMvDxJOjUYF M/SRrH5tjzQm0sbxdK3OhGyHaJwzGkB5xufvR6lzJMU4vyisyEuUhJc3B/IF005Ut+ xWRjgh7PXOBrsi4SZhazyJriKiN04ALpsULIlrxM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , Flavio Leitner , "David S. Miller" Subject: [PATCH 4.14 72/78] net: igmp: respect RCU rules in ip_mc_source() and ip_mc_msfilter() Date: Tue, 10 May 2022 15:07:58 +0200 Message-Id: <20220510130734.661991988@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit dba5bdd57bea587ea4f0b79b03c71135f84a7e8b upstream. syzbot reported an UAF in ip_mc_sf_allow() [1] Whenever RCU protected list replaces an object, the pointer to the new object needs to be updated _before_ the call to kfree_rcu() or call_rcu() Because kfree_rcu(ptr, rcu) got support for NULL ptr only recently in commit 12edff045bc6 ("rcu: Make kfree_rcu() ignore NULL pointers"), I chose to use the conditional to make sure stable backports won't miss this detail. if (psl) kfree_rcu(psl, rcu); net/ipv6/mcast.c has similar issues, addressed in a separate patch. [1] BUG: KASAN: use-after-free in ip_mc_sf_allow+0x6bb/0x6d0 net/ipv4/igmp.c:26= 55 Read of size 4 at addr ffff88807d37b904 by task syz-executor.5/908 CPU: 0 PID: 908 Comm: syz-executor.5 Not tainted 5.18.0-rc4-syzkaller-00064= -g8f4dd16603ce #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 ip_mc_sf_allow+0x6bb/0x6d0 net/ipv4/igmp.c:2655 raw_v4_input net/ipv4/raw.c:190 [inline] raw_local_deliver+0x4d1/0xbe0 net/ipv4/raw.c:218 ip_protocol_deliver_rcu+0xcf/0xb30 net/ipv4/ip_input.c:193 ip_local_deliver_finish+0x2ee/0x4c0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_local_deliver+0x1b3/0x200 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish+0x1cb/0x2f0 net/ipv4/ip_input.c:437 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_rcv+0xaa/0xd0 net/ipv4/ip_input.c:556 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5405 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5519 netif_receive_skb_internal net/core/dev.c:5605 [inline] netif_receive_skb+0x13e/0x8e0 net/core/dev.c:5664 tun_rx_batched.isra.0+0x460/0x720 drivers/net/tun.c:1534 tun_get_user+0x28b7/0x3e30 drivers/net/tun.c:1985 tun_chr_write_iter+0xdb/0x200 drivers/net/tun.c:2015 call_write_iter include/linux/fs.h:2050 [inline] new_sync_write+0x38a/0x560 fs/read_write.c:504 vfs_write+0x7c0/0xac0 fs/read_write.c:591 ksys_write+0x127/0x250 fs/read_write.c:644 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f3f12c3bbff Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 = 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff f= f 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 RSP: 002b:00007f3f13ea9130 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3f12d9bf60 RCX: 00007f3f12c3bbff RDX: 0000000000000036 RSI: 0000000020002ac0 RDI: 00000000000000c8 RBP: 00007f3f12ce308d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000036 R11: 0000000000000293 R12: 0000000000000000 R13: 00007fffb68dd79f R14: 00007f3f13ea9300 R15: 0000000000022000 Allocated by task 908: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524 kasan_kmalloc include/linux/kasan.h:234 [inline] __do_kmalloc mm/slab.c:3710 [inline] __kmalloc+0x209/0x4d0 mm/slab.c:3719 kmalloc include/linux/slab.h:586 [inline] sock_kmalloc net/core/sock.c:2501 [inline] sock_kmalloc+0xb5/0x100 net/core/sock.c:2492 ip_mc_source+0xba2/0x1100 net/ipv4/igmp.c:2392 do_ip_setsockopt net/ipv4/ip_sockglue.c:1296 [inline] ip_setsockopt+0x2312/0x3ab0 net/ipv4/ip_sockglue.c:1432 raw_setsockopt+0x274/0x2c0 net/ipv4/raw.c:861 __sys_setsockopt+0x2db/0x6a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 753: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x13d/0x180 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:200 [inline] __cache_free mm/slab.c:3439 [inline] kmem_cache_free_bulk+0x69/0x460 mm/slab.c:3774 kfree_bulk include/linux/slab.h:437 [inline] kfree_rcu_work+0x51c/0xa10 kernel/rcu/tree.c:3318 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348 kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3595 ip_mc_msfilter+0x712/0xb60 net/ipv4/igmp.c:2510 do_ip_setsockopt net/ipv4/ip_sockglue.c:1257 [inline] ip_setsockopt+0x32e1/0x3ab0 net/ipv4/ip_sockglue.c:1432 raw_setsockopt+0x274/0x2c0 net/ipv4/raw.c:861 __sys_setsockopt+0x2db/0x6a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348 call_rcu+0x99/0x790 kernel/rcu/tree.c:3074 mpls_dev_notify+0x552/0x8a0 net/mpls/af_mpls.c:1656 notifier_call_chain+0xb5/0x200 kernel/notifier.c:84 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1938 call_netdevice_notifiers_extack net/core/dev.c:1976 [inline] call_netdevice_notifiers net/core/dev.c:1990 [inline] unregister_netdevice_many+0x92e/0x1890 net/core/dev.c:10751 default_device_exit_batch+0x449/0x590 net/core/dev.c:11245 ops_exit_list+0x125/0x170 net/core/net_namespace.c:167 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff88807d37b900 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 4 bytes inside of 64-byte region [ffff88807d37b900, ffff88807d37b940) The buggy address belongs to the physical page: page:ffffea0001f4dec0 refcount:1 mapcount:0 mapping:0000000000000000 index:= 0xffff88807d37b180 pfn:0x7d37b flags: 0xfff00000000200(slab|node=3D0|zone=3D1|lastcpupid=3D0x7ff) raw: 00fff00000000200 ffff888010c41340 ffffea0001c795c8 ffff888010c40200 raw: ffff88807d37b180 ffff88807d37b000 000000010000001f 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x342040(_= _GFP_IO|__GFP_NOWARN|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 2963, t= gid 2963 (udevd), ts 139732238007, free_ts 139730893262 prep_new_page mm/page_alloc.c:2441 [inline] get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408 __alloc_pages_node include/linux/gfp.h:587 [inline] kmem_getpages mm/slab.c:1378 [inline] cache_grow_begin+0x75/0x350 mm/slab.c:2584 cache_alloc_refill+0x27f/0x380 mm/slab.c:2957 ____cache_alloc mm/slab.c:3040 [inline] ____cache_alloc mm/slab.c:3023 [inline] __do_cache_alloc mm/slab.c:3267 [inline] slab_alloc mm/slab.c:3309 [inline] __do_kmalloc mm/slab.c:3708 [inline] __kmalloc+0x3b3/0x4d0 mm/slab.c:3719 kmalloc include/linux/slab.h:586 [inline] kzalloc include/linux/slab.h:714 [inline] tomoyo_encode2.part.0+0xe9/0x3a0 security/tomoyo/realpath.c:45 tomoyo_encode2 security/tomoyo/realpath.c:31 [inline] tomoyo_encode+0x28/0x50 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x186/0x620 security/tomoyo/realpath.c:288 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_perm+0x21b/0x400 security/tomoyo/file.c:822 security_inode_getattr+0xcf/0x140 security/security.c:1350 vfs_getattr fs/stat.c:157 [inline] vfs_statx+0x16a/0x390 fs/stat.c:232 vfs_fstatat+0x8c/0xb0 fs/stat.c:255 __do_sys_newfstatat+0x91/0x110 fs/stat.c:425 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1356 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1406 free_unref_page_prepare mm/page_alloc.c:3328 [inline] free_unref_page+0x19/0x6a0 mm/page_alloc.c:3423 __vunmap+0x85d/0xd30 mm/vmalloc.c:2667 __vfree+0x3c/0xd0 mm/vmalloc.c:2715 vfree+0x5a/0x90 mm/vmalloc.c:2746 __do_replace+0x16b/0x890 net/ipv6/netfilter/ip6_tables.c:1117 do_replace net/ipv6/netfilter/ip6_tables.c:1157 [inline] do_ip6t_set_ctl+0x90d/0xb90 net/ipv6/netfilter/ip6_tables.c:1639 nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1026 tcp_setsockopt+0x136/0x2520 net/ipv4/tcp.c:3696 __sys_setsockopt+0x2db/0x6a0 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff88807d37b800: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc ffff88807d37b880: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff88807d37b900: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88807d37b980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88807d37ba00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc Fixes: c85bb41e9318 ("igmp: fix ip_mc_sf_allow race [v5]") Signed-off-by: Eric Dumazet Reported-by: syzbot Cc: Flavio Leitner Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv4/igmp.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -2368,9 +2368,10 @@ int ip_mc_source(int add, int omode, str newpsl->sl_addr[i] =3D psl->sl_addr[i]; /* decrease mem now to avoid the memleak warning */ atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc); - kfree_rcu(psl, rcu); } rcu_assign_pointer(pmc->sflist, newpsl); + if (psl) + kfree_rcu(psl, rcu); psl =3D newpsl; } rv =3D 1; /* > 0 for insert logic below if sl_count is 0 */ @@ -2468,11 +2469,13 @@ int ip_mc_msfilter(struct sock *sk, stru psl->sl_count, psl->sl_addr, 0); /* decrease mem now to avoid the memleak warning */ atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc); - kfree_rcu(psl, rcu); - } else + } else { (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode, 0, NULL, 0); + } rcu_assign_pointer(pmc->sflist, newpsl); + if (psl) + kfree_rcu(psl, rcu); pmc->sfmode =3D msf->imsf_fmode; err =3D 0; done: From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C75BC433F5 for ; Tue, 10 May 2022 13:29:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241495AbiEJNdA (ORCPT ); Tue, 10 May 2022 09:33:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44434 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242610AbiEJNYR (ORCPT ); Tue, 10 May 2022 09:24:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3869C54682; Tue, 10 May 2022 06:17:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D9665B81D0D; Tue, 10 May 2022 13:17:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 480B8C385C2; Tue, 10 May 2022 13:17:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188644; bh=hwo8XwOH5FAgJgZVLngvecjaImRzHhr+s7d0muU2US0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CSo6ah9Z8Gy7ErJvooKELAVbAUxLxHBP6mkiawZSdhXOemdOFlF5Hm7twqYGRJ/9U BSHxs3aJvnAQJPh09ewvQ6W0LVSF0RcHYxXLddIjTGmEpzcOYB8cuY0jSE4dWl2NhS TozF/WwX74ayDd8Oc4ezFlpm34INgmSKAshHxG98= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vasant Hegde , Sandipan Das , Paolo Bonzini , Sasha Levin Subject: [PATCH 4.14 73/78] kvm: x86/cpuid: Only provide CPUID leaf 0xA if host has architectural PMU Date: Tue, 10 May 2022 15:07:59 +0200 Message-Id: <20220510130734.690549554@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sandipan Das [ Upstream commit 5a1bde46f98b893cda6122b00e94c0c40a6ead3c ] On some x86 processors, CPUID leaf 0xA provides information on Architectural Performance Monitoring features. It advertises a PMU version which Qemu uses to determine the availability of additional MSRs to manage the PMCs. Upon receiving a KVM_GET_SUPPORTED_CPUID ioctl request for the same, the kernel constructs return values based on the x86_pmu_capability irrespective of the vendor. This leaf and the additional MSRs are not supported on AMD and Hygon processors. If AMD PerfMonV2 is detected, the PMU version is set to 2 and guest startup breaks because of an attempt to access a non-existent MSR. Return zeros to avoid this. Fixes: a6c06ed1a60a ("KVM: Expose the architectural performance monitoring = CPUID leaf") Reported-by: Vasant Hegde Signed-off-by: Sandipan Das Message-Id: <3fef83d9c2b2f7516e8ff50d60851f29a4bcb716.1651058600.git.sandip= an.das@amd.com> Signed-off-by: Paolo Bonzini Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/kvm/cpuid.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c index 7e1ab0e0f3f2..fd1eb8600ccf 100644 --- a/arch/x86/kvm/cpuid.c +++ b/arch/x86/kvm/cpuid.c @@ -517,6 +517,11 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entr= y2 *entry, u32 function, union cpuid10_eax eax; union cpuid10_edx edx; =20 + if (!static_cpu_has(X86_FEATURE_ARCH_PERFMON)) { + entry->eax =3D entry->ebx =3D entry->ecx =3D entry->edx =3D 0; + break; + } + perf_get_x86_pmu_capability(&cap); =20 /* --=20 2.35.1 From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 865EFC433FE for ; Tue, 10 May 2022 13:35:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243563AbiEJNjg (ORCPT ); Tue, 10 May 2022 09:39:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59570 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242769AbiEJNYq (ORCPT ); Tue, 10 May 2022 09:24:46 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EDB601D5268; Tue, 10 May 2022 06:17:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2AC9CB81CE7; Tue, 10 May 2022 13:17:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77EBBC385C9; Tue, 10 May 2022 13:17:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188647; bh=nkxvK/LmljPa2TgaOh3D/laoycyV7JXVdk9NozXoCvo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YpbozLKwRFQXJu3YQF0Hx6YRGzGzVC9WuOPwtTjIF9SQtIpSjqF3nx0T0gfw6pk+b RG2/n3uCAz8crCiJrfnrym584xiVtcfow0FjIJ6gQpx02hxBR85KXOXBzbxNE20ux9 T4SKBitKCWkajpOSlSbsbE6xJs2e3C9fQ622hVHs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johannes Nixdorf , "David S. Miller" Subject: [PATCH 4.14 74/78] net: ipv6: ensure we call ipv6_mc_down() at most once Date: Tue, 10 May 2022 15:08:00 +0200 Message-Id: <20220510130734.719777234@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: j.nixdorf@avm.de commit 9995b408f17ff8c7f11bc725c8aa225ba3a63b1c upstream. There are two reasons for addrconf_notify() to be called with NETDEV_DOWN: either the network device is actually going down, or IPv6 was disabled on the interface. If either of them stays down while the other is toggled, we repeatedly call the code for NETDEV_DOWN, including ipv6_mc_down(), while never calling the corresponding ipv6_mc_up() in between. This will cause a new entry in idev->mc_tomb to be allocated for each multicast group the interface is subscribed to, which in turn leaks one struct ifmcaddr6 per nontrivial multicast group the interface is subscribed to. The following reproducer will leak at least $n objects: ip addr add ff2e::4242/32 dev eth0 autojoin sysctl -w net.ipv6.conf.eth0.disable_ipv6=3D1 for i in $(seq 1 $n); do ip link set up eth0; ip link set down eth0 done Joining groups with IPV6_ADD_MEMBERSHIP (unprivileged) or setting the sysctl net.ipv6.conf.eth0.forwarding to 1 (=3D> subscribing to ff02::2) can also be used to create a nontrivial idev->mc_list, which will the leak objects with the right up-down-sequence. Based on both sources for NETDEV_DOWN events the interface IPv6 state should be considered: - not ready if the network interface is not ready OR IPv6 is disabled for it - ready if the network interface is ready AND IPv6 is enabled for it The functions ipv6_mc_up() and ipv6_down() should only be run when this state changes. Implement this by remembering when the IPv6 state is ready, and only run ipv6_mc_down() if it actually changed from ready to not ready. The other direction (not ready -> ready) already works correctly, as: - the interface notification triggered codepath for NETDEV_UP / NETDEV_CHANGE returns early if ipv6 is disabled, and - the disable_ipv6=3D0 triggered codepath skips fully initializing the interface as long as addrconf_link_ready(dev) returns false - calling ipv6_mc_up() repeatedly does not leak anything Fixes: 3ce62a84d53c ("ipv6: exit early in addrconf_notify() if IPv6 is disa= bled") Signed-off-by: Johannes Nixdorf Signed-off-by: David S. Miller [jnixdorf: context updated for bpo to v4.9/v4.14] Signed-off-by: Johannes Nixdorf Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv6/addrconf.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -3580,6 +3580,7 @@ static int addrconf_ifdown(struct net_de struct list_head del_list; int _keep_addr; bool keep_addr; + bool was_ready; int state, i; =20 ASSERT_RTNL(); @@ -3643,7 +3644,10 @@ restart: =20 addrconf_del_rs_timer(idev); =20 - /* Step 2: clear flags for stateless addrconf */ + /* Step 2: clear flags for stateless addrconf, repeated down + * detection + */ + was_ready =3D idev->if_flags & IF_READY; if (!how) idev->if_flags &=3D ~(IF_RS_SENT|IF_RA_RCVD|IF_READY); =20 @@ -3730,7 +3734,7 @@ restart: if (how) { ipv6_ac_destroy_dev(idev); ipv6_mc_destroy_dev(idev); - } else { + } else if (was_ready) { ipv6_mc_down(idev); } From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3B3CC4321E for ; Tue, 10 May 2022 13:35:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243445AbiEJNjc (ORCPT ); Tue, 10 May 2022 09:39:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60626 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242801AbiEJNYs (ORCPT ); Tue, 10 May 2022 09:24:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B78371CEECA; Tue, 10 May 2022 06:17:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 39CA2B81D7A; Tue, 10 May 2022 13:17:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8E5D3C385C6; Tue, 10 May 2022 13:17:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188651; bh=tvW45ZDWTzMoKTEwlh7llbdaNSi7QjPG7Pnc2jayG/I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v3RqefWvNkR/5kOuOvBDFhW4dr/O267BieL1WRORPKLjPqxT4/lgzTessa3UTcIIL FO4h2CyprdM6K2rW99JFNc9UX6LJ8HMS07VVNJLZpAKYNfxbxwujHI8gDuRcZACNcq wrgCxFp2VZI00a221XVWT9cx1lKyRnPLb1mU87MQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiazi Li , Mike Snitzer , Mikulas Patocka , Mike Snitzer Subject: [PATCH 4.14 75/78] dm: fix mempool NULL pointer race when completing IO Date: Tue, 10 May 2022 15:08:01 +0200 Message-Id: <20220510130734.749365802@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiazi Li commit d208b89401e073de986dc891037c5a668f5d5d95 upstream. dm_io_dec_pending() calls end_io_acct() first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to mempool->elements being NULL: task1 task2 do_resume ->do_suspend ->dm_wait_for_completion bio_endio ->clone_endio ->dm_io_dec_pending ->end_io_acct ->wakeup task1 ->dm_swap_table ->__bind ->__bind_mempools ->bioset_exit ->mempool_exit ->free_io [ 67.330330] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ...... [ 67.330494] pstate: 80400085 (Nzcv daIf +PAN -UAO) [ 67.330510] pc : mempool_free+0x70/0xa0 [ 67.330515] lr : mempool_free+0x4c/0xa0 [ 67.330520] sp : ffffff8008013b20 [ 67.330524] x29: ffffff8008013b20 x28: 0000000000000004 [ 67.330530] x27: ffffffa8c2ff40a0 x26: 00000000ffff1cc8 [ 67.330535] x25: 0000000000000000 x24: ffffffdada34c800 [ 67.330541] x23: 0000000000000000 x22: ffffffdada34c800 [ 67.330547] x21: 00000000ffff1cc8 x20: ffffffd9a1304d80 [ 67.330552] x19: ffffffdada34c970 x18: 000000b312625d9c [ 67.330558] x17: 00000000002dcfbf x16: 00000000000006dd [ 67.330563] x15: 000000000093b41e x14: 0000000000000010 [ 67.330569] x13: 0000000000007f7a x12: 0000000034155555 [ 67.330574] x11: 0000000000000001 x10: 0000000000000001 [ 67.330579] x9 : 0000000000000000 x8 : 0000000000000000 [ 67.330585] x7 : 0000000000000000 x6 : ffffff80148b5c1a [ 67.330590] x5 : ffffff8008013ae0 x4 : 0000000000000001 [ 67.330596] x3 : ffffff80080139c8 x2 : ffffff801083bab8 [ 67.330601] x1 : 0000000000000000 x0 : ffffffdada34c970 [ 67.330609] Call trace: [ 67.330616] mempool_free+0x70/0xa0 [ 67.330627] bio_put+0xf8/0x110 [ 67.330638] dec_pending+0x13c/0x230 [ 67.330644] clone_endio+0x90/0x180 [ 67.330649] bio_endio+0x198/0x1b8 [ 67.330655] dec_pending+0x190/0x230 [ 67.330660] clone_endio+0x90/0x180 [ 67.330665] bio_endio+0x198/0x1b8 [ 67.330673] blk_update_request+0x214/0x428 [ 67.330683] scsi_end_request+0x2c/0x300 [ 67.330688] scsi_io_completion+0xa0/0x710 [ 67.330695] scsi_finish_command+0xd8/0x110 [ 67.330700] scsi_softirq_done+0x114/0x148 [ 67.330708] blk_done_softirq+0x74/0xd0 [ 67.330716] __do_softirq+0x18c/0x374 [ 67.330724] irq_exit+0xb4/0xb8 [ 67.330732] __handle_domain_irq+0x84/0xc0 [ 67.330737] gic_handle_irq+0x148/0x1b0 [ 67.330744] el1_irq+0xe8/0x190 [ 67.330753] lpm_cpuidle_enter+0x4f8/0x538 [ 67.330759] cpuidle_enter_state+0x1fc/0x398 [ 67.330764] cpuidle_enter+0x18/0x20 [ 67.330772] do_idle+0x1b4/0x290 [ 67.330778] cpu_startup_entry+0x20/0x28 [ 67.330786] secondary_start_kernel+0x160/0x170 Fix this by: 1) Establishing pointers to 'struct dm_io' members in dm_io_dec_pending() so that they may be passed into end_io_acct() _after_ free_io() is called. 2) Moving end_io_acct() after free_io(). Cc: stable@vger.kernel.org Signed-off-by: Jiazi Li Signed-off-by: Mike Snitzer Signed-off-by: Mikulas Patocka Reviewed-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/md/dm.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -528,20 +528,19 @@ static void start_io_acct(struct dm_io * false, 0, &io->stats_aux); } =20 -static void end_io_acct(struct dm_io *io) +static void end_io_acct(struct mapped_device *md, struct bio *bio, + unsigned long start_time, struct dm_stats_aux *stats_aux) { - struct mapped_device *md =3D io->md; - struct bio *bio =3D io->bio; - unsigned long duration =3D jiffies - io->start_time; + unsigned long duration =3D jiffies - start_time; int pending; int rw =3D bio_data_dir(bio); =20 - generic_end_io_acct(md->queue, rw, &dm_disk(md)->part0, io->start_time); + generic_end_io_acct(md->queue, rw, &dm_disk(md)->part0, start_time); =20 if (unlikely(dm_stats_used(&md->stats))) dm_stats_account_io(&md->stats, bio_data_dir(bio), bio->bi_iter.bi_sector, bio_sectors(bio), - true, duration, &io->stats_aux); + true, duration, stats_aux); =20 /* * After this is decremented the bio must not be touched if it is @@ -775,6 +774,8 @@ static void dec_pending(struct dm_io *io blk_status_t io_error; struct bio *bio; struct mapped_device *md =3D io->md; + unsigned long start_time =3D 0; + struct dm_stats_aux stats_aux; =20 /* Push-back supersedes any I/O errors */ if (unlikely(error)) { @@ -801,8 +802,10 @@ static void dec_pending(struct dm_io *io =20 io_error =3D io->status; bio =3D io->bio; - end_io_acct(io); + start_time =3D io->start_time; + stats_aux =3D io->stats_aux; free_io(md, io); + end_io_acct(md, bio, start_time, &stats_aux); =20 if (io_error =3D=3D BLK_STS_DM_REQUEUE) return; From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB377C433F5 for ; Tue, 10 May 2022 13:30:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238056AbiEJNdx (ORCPT ); Tue, 10 May 2022 09:33:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49298 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242895AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 39748369F7; Tue, 10 May 2022 06:17:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C987B61532; Tue, 10 May 2022 13:17:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C40D7C385C2; Tue, 10 May 2022 13:17:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188678; bh=uxmI1h5GXmIVI9bUbztyAkNTD9CthJs/xPqH/27qeR8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J95VxAbe0b6rk4oW5vlu06uwiQQmZItEtggUaWnmK6raOUxXrxKMIIyKPWpprkNf6 AvMLF3uaVuNfda8zCqvLx+g8i6uHBb8j8aqRbSVliPDn8Sp6CRAh6oIJ7UczxYS+aJ jOWC7ckgN6XMTLseO1phH7TWR5jCXHB8g9Tn0TMU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Mike Snitzer , Mike Snitzer Subject: [PATCH 4.14 76/78] dm: interlock pending dm_io and dm_wait_for_bios_completion Date: Tue, 10 May 2022 15:08:02 +0200 Message-Id: <20220510130734.778375785@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Snitzer commit 9f6dc633761006f974701d4c88da71ab68670749 upstream. Commit d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") didn't go far enough. When bio_end_io_acct ends the count of in-flight I/Os may reach zero and the DM device may be suspended. There is a possibility that the suspend races with dm_stats_account_io. Fix this by adding percpu "pending_io" counters to track outstanding dm_io. Move kicking of suspend queue to dm_io_dec_pending(). Also, rename md_in_flight_bios() to dm_in_flight_bios() and update it to iterate all pending_io counters. Fixes: d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") Cc: stable@vger.kernel.org Co-developed-by: Mikulas Patocka Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Signed-off-by: Mikulas Patocka Reviewed-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/md/dm.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -2230,6 +2230,8 @@ static int dm_wait_for_completion(struct } finish_wait(&md->wait, &wait); =20 + smp_rmb(); /* paired with atomic_dec_return in end_io_acct */ + return r; } From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5E2A0C433F5 for ; Tue, 10 May 2022 13:30:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241920AbiEJNet (ORCPT ); Tue, 10 May 2022 09:34:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60524 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242901AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B737DB1D2; Tue, 10 May 2022 06:17:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 36B21CE1EE2; Tue, 10 May 2022 13:17:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4FE09C385C2; Tue, 10 May 2022 13:17:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188671; bh=467C2HkfQ6VpmjdBiPKWp3XCWnFwQxZ8dcLM2EMpRqU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lsB+6A28u2j11umB8iExcgdPzM8nn42UdLF9Rg+HaUjLpGQ/QxZlrt9UOXjgDq5MK KkR1vb/HzgR54gt1JdDsgqubbRZ4HKwjx88AZN/GUmoanopq+T0AHIOYg2r4z0PPkq xjshStzwPngVIrj4ODI8B1III0yMHj3CUIIpb6wM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Pali=20Roh=C3=A1r?= , =?UTF-8?q?Marek=20Beh=C3=BAn?= , Lorenzo Pieralisi Subject: [PATCH 4.14 77/78] PCI: aardvark: Clear all MSIs at setup Date: Tue, 10 May 2022 15:08:03 +0200 Message-Id: <20220510130734.806683402@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pali Roh=C3=A1r commit 7d8dc1f7cd007a7ce94c5b4c20d63a8b8d6d7751 upstream. We already clear all the other interrupts (ISR0, ISR1, HOST_CTRL_INT). Define a new macro PCIE_MSI_ALL_MASK and do the same clearing for MSIs, to ensure that we don't start receiving spurious interrupts. Use this new mask in advk_pcie_handle_msi(); Link: https://lore.kernel.org/r/20211130172913.9727-5-kabel@kernel.org Signed-off-by: Pali Roh=C3=A1r Signed-off-by: Marek Beh=C3=BAn Signed-off-by: Lorenzo Pieralisi Signed-off-by: Marek Beh=C3=BAn Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/pci/host/pci-aardvark.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/pci/host/pci-aardvark.c +++ b/drivers/pci/host/pci-aardvark.c @@ -104,6 +104,7 @@ #define PCIE_MSI_ADDR_HIGH_REG (CONTROL_BASE_ADDR + 0x54) #define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58) #define PCIE_MSI_MASK_REG (CONTROL_BASE_ADDR + 0x5C) +#define PCIE_MSI_ALL_MASK GENMASK(31, 0) #define PCIE_MSI_PAYLOAD_REG (CONTROL_BASE_ADDR + 0x9C) #define PCIE_MSI_DATA_MASK GENMASK(15, 0) =20 @@ -490,6 +491,7 @@ static void advk_pcie_setup_hw(struct ad advk_writel(pcie, reg, PCIE_CORE_CTRL2_REG); =20 /* Clear all interrupts */ + advk_writel(pcie, PCIE_MSI_ALL_MASK, PCIE_MSI_STATUS_REG); advk_writel(pcie, PCIE_ISR0_ALL_MASK, PCIE_ISR0_REG); advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_REG); advk_writel(pcie, PCIE_IRQ_ALL_MASK, HOST_CTRL_INT_STATUS_REG); @@ -502,7 +504,7 @@ static void advk_pcie_setup_hw(struct ad advk_writel(pcie, PCIE_ISR1_ALL_MASK, PCIE_ISR1_MASK_REG); =20 /* Unmask all MSI's */ - advk_writel(pcie, 0, PCIE_MSI_MASK_REG); + advk_writel(pcie, ~(u32)PCIE_MSI_ALL_MASK, PCIE_MSI_MASK_REG); =20 /* Enable summary interrupt for GIC SPI source */ reg =3D PCIE_IRQ_ALL_MASK & (~PCIE_IRQ_ENABLE_INTS_MASK); @@ -1038,7 +1040,7 @@ static void advk_pcie_handle_msi(struct =20 msi_mask =3D advk_readl(pcie, PCIE_MSI_MASK_REG); msi_val =3D advk_readl(pcie, PCIE_MSI_STATUS_REG); - msi_status =3D msi_val & ~msi_mask; + msi_status =3D msi_val & ((~msi_mask) & PCIE_MSI_ALL_MASK); =20 for (msi_idx =3D 0; msi_idx < MSI_IRQ_NUM; msi_idx++) { if (!(BIT(msi_idx) & msi_status)) From nobody Fri May 8 05:14:47 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4D97C433EF for ; Tue, 10 May 2022 13:30:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243342AbiEJNex (ORCPT ); Tue, 10 May 2022 09:34:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60624 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242902AbiEJNZQ (ORCPT ); Tue, 10 May 2022 09:25:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E5CC2013BF; Tue, 10 May 2022 06:17:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9C1D861574; Tue, 10 May 2022 13:17:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 81FD1C385C2; Tue, 10 May 2022 13:17:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652188675; bh=Mjqm6ST4VdKm9gYNxUOqp1Z19TuJPOHgsc7bkCMeYfo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fLRAOk5QzVfoHxHSvPxhJdVzWaaVzqg7DG2cZ0Vuw7SO3LPl7aD7lCa8akvgavqYI +4ZTgc9JTahK16/fJurCcuqGMJymoprXPgTos6PtTFU697mq3UIFJsfsfbJ7V7cwWE d98Djyw3GULzb6ipxY8Q92whV0E3J7HBG/dMIeyc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Pali=20Roh=C3=A1r?= , =?UTF-8?q?Marek=20Beh=C3=BAn?= , Lorenzo Pieralisi Subject: [PATCH 4.14 78/78] PCI: aardvark: Fix reading MSI interrupt number Date: Tue, 10 May 2022 15:08:04 +0200 Message-Id: <20220510130734.835879313@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220510130732.522479698@linuxfoundation.org> References: <20220510130732.522479698@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pali Roh=C3=A1r commit 805dfc18dd3d4dd97a987d4406593b5a225b1253 upstream. In advk_pcie_handle_msi() it is expected that when bit i in the W1C register PCIE_MSI_STATUS_REG is cleared, the PCIE_MSI_PAYLOAD_REG is updated to contain the MSI number corresponding to index i. Experiments show that this is not so, and instead PCIE_MSI_PAYLOAD_REG always contains the number of the last received MSI, overall. Do not read PCIE_MSI_PAYLOAD_REG register for determining MSI interrupt number. Since Aardvark already forbids more than 32 interrupts and uses own allocated hwirq numbers, the msi_idx already corresponds to the received MSI number. Link: https://lore.kernel.org/r/20220110015018.26359-3-kabel@kernel.org Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller drive= r") Signed-off-by: Pali Roh=C3=A1r Signed-off-by: Marek Beh=C3=BAn Signed-off-by: Lorenzo Pieralisi Signed-off-by: Marek Beh=C3=BAn Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/pci/host/pci-aardvark.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) --- a/drivers/pci/host/pci-aardvark.c +++ b/drivers/pci/host/pci-aardvark.c @@ -1036,7 +1036,7 @@ static void advk_pcie_remove_irq_domain( static void advk_pcie_handle_msi(struct advk_pcie *pcie) { u32 msi_val, msi_mask, msi_status, msi_idx; - u16 msi_data; + int virq; =20 msi_mask =3D advk_readl(pcie, PCIE_MSI_MASK_REG); msi_val =3D advk_readl(pcie, PCIE_MSI_STATUS_REG); @@ -1046,13 +1046,9 @@ static void advk_pcie_handle_msi(struct if (!(BIT(msi_idx) & msi_status)) continue; =20 - /* - * msi_idx contains bits [4:0] of the msi_data and msi_data - * contains 16bit MSI interrupt number - */ advk_writel(pcie, BIT(msi_idx), PCIE_MSI_STATUS_REG); - msi_data =3D advk_readl(pcie, PCIE_MSI_PAYLOAD_REG) & PCIE_MSI_DATA_MASK; - generic_handle_irq(msi_data); + virq =3D irq_find_mapping(pcie->msi_inner_domain, msi_idx); + generic_handle_irq(virq); } =20 advk_writel(pcie, PCIE_ISR0_MSI_INT_PENDING,