From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E12FFC433EF for ; Mon, 23 May 2022 17:03:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239103AbiEWRDx (ORCPT ); Mon, 23 May 2022 13:03:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44698 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232387AbiEWRDu (ORCPT ); Mon, 23 May 2022 13:03:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CA23C1274C; Mon, 23 May 2022 10:03:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6E52E614B8; Mon, 23 May 2022 17:03:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 70299C385A9; Mon, 23 May 2022 17:03:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325426; bh=QJjr4F2E7z6wY2IlEDW71nY7Eb23d0UzslDtJuPPzBI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TirgZRRjbHs8s28/R1khbde3vqwUuPQ+6IV3TgBaZ8dBr733SkmWazswWRqyNDMtD fraz7XtOkGvuSilicurCI6MUjOZoOh6QtcOENuzAHuyNF132az/XGoo2VVvz9kfKdt JCuStdFoJRraVvfGQ0xUPN48JF0yvE0EimUGAtlI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Minh Yuan , Linus Torvalds , Denis Efremov , Willy Tarreau , Linus Torvalds Subject: [PATCH 4.9 01/25] floppy: use a statically allocated error counter Date: Mon, 23 May 2022 19:03:19 +0200 Message-Id: <20220523165744.949672070@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Willy Tarreau commit f71f01394f742fc4558b3f9f4c7ef4c4cf3b07c8 upstream. Interrupt handler bad_flp_intr() may cause a UAF on the recently freed request just to increment the error count. There's no point keeping that one in the request anyway, and since the interrupt handler uses a static pointer to the error which cannot be kept in sync with the pending request, better make it use a static error counter that's reset for each new request. This reset now happens when entering redo_fd_request() for a new request via set_next_request(). One initial concern about a single error counter was that errors on one floppy drive could be reported on another one, but this problem is not real given that the driver uses a single drive at a time, as that PC-compatible controllers also have this limitation by using shared signals. As such the error count is always for the "current" drive. Reported-by: Minh Yuan Suggested-by: Linus Torvalds Tested-by: Denis Efremov Signed-off-by: Willy Tarreau Signed-off-by: Linus Torvalds Signed-off-by: Denis Efremov Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/block/floppy.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -516,8 +516,8 @@ static unsigned long fdc_busy; static DECLARE_WAIT_QUEUE_HEAD(fdc_wait); static DECLARE_WAIT_QUEUE_HEAD(command_done); =20 -/* Errors during formatting are counted here. */ -static int format_errors; +/* errors encountered on the current (or last) request */ +static int floppy_errors; =20 /* Format request descriptor. */ static struct format_descr format_req; @@ -537,7 +537,6 @@ static struct format_descr format_req; static char *floppy_track_buffer; static int max_buffer_sectors; =20 -static int *errors; typedef void (*done_f)(int); static const struct cont_t { void (*interrupt)(void); @@ -1426,7 +1425,7 @@ static int interpret_errors(void) if (DP->flags & FTD_MSG) DPRINT("Over/Underrun - retrying\n"); bad =3D 0; - } else if (*errors >=3D DP->max_errors.reporting) { + } else if (floppy_errors >=3D DP->max_errors.reporting) { print_errors(); } if (ST2 & ST2_WC || ST2 & ST2_BC) @@ -2049,7 +2048,7 @@ static void bad_flp_intr(void) if (!next_valid_format()) return; } - err_count =3D ++(*errors); + err_count =3D ++floppy_errors; INFBOUND(DRWE->badness, err_count); if (err_count > DP->max_errors.abort) cont->done(0); @@ -2194,9 +2193,8 @@ static int do_format(int drive, struct f return -EINVAL; } format_req =3D *tmp_format_req; - format_errors =3D 0; cont =3D &format_cont; - errors =3D &format_errors; + floppy_errors =3D 0; ret =3D wait_til_done(redo_format, true); if (ret =3D=3D -EINTR) return -EINTR; @@ -2679,7 +2677,7 @@ static int make_raw_rw_request(void) */ if (!direct || (indirect * 2 > direct * 3 && - *errors < DP->max_errors.read_track && + floppy_errors < DP->max_errors.read_track && ((!probing || (DP->read_track & (1 << DRS->probed_format)))))) { max_size =3D blk_rq_sectors(current_req); @@ -2812,8 +2810,10 @@ static int set_next_request(void) fdc_queue =3D 0; if (q) { current_req =3D blk_fetch_request(q); - if (current_req) + if (current_req) { + floppy_errors =3D 0; break; + } } } while (fdc_queue !=3D old_pos); =20 @@ -2873,7 +2873,6 @@ do_request: _floppy =3D floppy_type + DP->autodetect[DRS->probed_format]; } else probing =3D 0; - errors =3D &(current_req->errors); tmp =3D make_raw_rw_request(); if (tmp < 2) { request_done(tmp); From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30673C433F5 for ; Mon, 23 May 2022 17:04:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239188AbiEWREH (ORCPT ); Mon, 23 May 2022 13:04:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44956 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239129AbiEWRD6 (ORCPT ); Mon, 23 May 2022 13:03:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8FC355253F; Mon, 23 May 2022 10:03:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1A72FB811E9; Mon, 23 May 2022 17:03:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 555E5C385AA; Mon, 23 May 2022 17:03:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325434; bh=xhmdDEoKotcUO/7eHbPi3dL9BFugG1l1EDjl/avpqzE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lQshdhbMzS+bzOeKolBu1yo1ol0px+ResS9cwCQ6aV8+KIwUFIDyf79TqpQOhhSdv /p9bJsQeP3+JB/UkA8RRgpq1vgIXPhHvtgaxeSMR/GZAOp5eRVsqLJGQMCY7s0jLm5 ufvdWsbax5/c5tjn9OY2qWVyLkZGIFxJiLdNHP24= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Gow , Richard Weinberger , Sasha Levin Subject: [PATCH 4.9 02/25] um: Cleanup syscall_handler_t definition/cast, fix warning Date: Mon, 23 May 2022 19:03:20 +0200 Message-Id: <20220523165745.101254298@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: David Gow [ Upstream commit f4f03f299a56ce4d73c5431e0327b3b6cb55ebb9 ] The syscall_handler_t type for x86_64 was defined as 'long (*)(void)', but always cast to 'long (*)(long, long, long, long, long, long)' before use. This now triggers a warning (see below). Define syscall_handler_t as the latter instead, and remove the cast. This simplifies the code, and fixes the warning. Warning: In file included from ../arch/um/include/asm/processor-generic.h:13 from ../arch/x86/um/asm/processor.h:41 from ../include/linux/rcupdate.h:30 from ../include/linux/rculist.h:11 from ../include/linux/pid.h:5 from ../include/linux/sched.h:14 from ../include/linux/ptrace.h:6 from ../arch/um/kernel/skas/syscall.c:7: ../arch/um/kernel/skas/syscall.c: In function =E2=80=98handle_syscall=E2=80= =99: ../arch/x86/um/shared/sysdep/syscalls_64.h:18:11: warning: cast between inc= ompatible function types from =E2=80=98long int (*)(void)=E2=80=99 to =E2= =80=98long int (*)(long int, long int, long int, long int, long int, l= ong int)=E2=80=99 [ -Wcast-function-type] 18 | (((long (*)(long, long, long, long, long, long)) \ | ^ ../arch/x86/um/asm/ptrace.h:36:62: note: in definition of macro =E2=80=98PT= _REGS_SET_SYSCALL_RETURN=E2=80=99 36 | #define PT_REGS_SET_SYSCALL_RETURN(r, res) (PT_REGS_AX(r) =3D (res)) | ^~~ ../arch/um/kernel/skas/syscall.c:46:33: note: in expansion of macro =E2=80= =98EXECUTE_SYSCALL=E2=80=99 46 | EXECUTE_SYSCALL(syscall, regs)); | ^~~~~~~~~~~~~~~ Signed-off-by: David Gow Signed-off-by: Richard Weinberger Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/x86/um/shared/sysdep/syscalls_64.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/x86/um/shared/sysdep/syscalls_64.h b/arch/x86/um/shared/s= ysdep/syscalls_64.h index 8a7d5e1da98e..1e6875b4ffd8 100644 --- a/arch/x86/um/shared/sysdep/syscalls_64.h +++ b/arch/x86/um/shared/sysdep/syscalls_64.h @@ -10,13 +10,12 @@ #include #include =20 -typedef long syscall_handler_t(void); +typedef long syscall_handler_t(long, long, long, long, long, long); =20 extern syscall_handler_t *sys_call_table[]; =20 #define EXECUTE_SYSCALL(syscall, regs) \ - (((long (*)(long, long, long, long, long, long)) \ - (*sys_call_table[syscall]))(UPT_SYSCALL_ARG1(®s->regs), \ + (((*sys_call_table[syscall]))(UPT_SYSCALL_ARG1(®s->regs), \ UPT_SYSCALL_ARG2(®s->regs), \ UPT_SYSCALL_ARG3(®s->regs), \ UPT_SYSCALL_ARG4(®s->regs), \ --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0B64C433EF for ; Mon, 23 May 2022 17:04:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239117AbiEWREM (ORCPT ); Mon, 23 May 2022 13:04:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45028 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239180AbiEWREA (ORCPT ); Mon, 23 May 2022 13:04:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DE0771274C; Mon, 23 May 2022 10:03:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 785D2614BD; Mon, 23 May 2022 17:03:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7AD7DC385A9; Mon, 23 May 2022 17:03:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325437; bh=27cTnvoFkCsAQH2G/vahS3TonYJm82Kv2MOibG2P2FA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MxxSRcwgQ+Cqkkweasux51j8jL/3PNbyL1sEJ5ackljxGn2t4fc+sJl2HuOkm6lYF xWDJBlUu6OOM81s+SAbUfIKjCl9g12oTEaj3Z3pM+3BAcAp9JfNH9vr+Tu0jMtDOCF PNpQxDNJzvBVqVXkX0vdlX2pwsh6b+r5mcyEAfl8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Tomasz=20Mo=C5=84?= , Jeff LaBundy , Dmitry Torokhov , Sasha Levin Subject: [PATCH 4.9 03/25] Input: add bounds checking to input_set_capability() Date: Mon, 23 May 2022 19:03:21 +0200 Message-Id: <20220523165745.267140190@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jeff LaBundy [ Upstream commit 409353cbe9fe48f6bc196114c442b1cff05a39bc ] Update input_set_capability() to prevent kernel panic in case the event code exceeds the bitmap for the given event type. Suggested-by: Tomasz Mo=C5=84 Signed-off-by: Jeff LaBundy Reviewed-by: Tomasz Mo=C5=84 Link: https://lore.kernel.org/r/20220320032537.545250-1-jeff@labundy.com Signed-off-by: Dmitry Torokhov Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/input/input.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/drivers/input/input.c b/drivers/input/input.c index 5d94fc3fce0b..378717d1b3b4 100644 --- a/drivers/input/input.c +++ b/drivers/input/input.c @@ -50,6 +50,17 @@ static DEFINE_MUTEX(input_mutex); =20 static const struct input_value input_value_sync =3D { EV_SYN, SYN_REPORT,= 1 }; =20 +static const unsigned int input_max_code[EV_CNT] =3D { + [EV_KEY] =3D KEY_MAX, + [EV_REL] =3D REL_MAX, + [EV_ABS] =3D ABS_MAX, + [EV_MSC] =3D MSC_MAX, + [EV_SW] =3D SW_MAX, + [EV_LED] =3D LED_MAX, + [EV_SND] =3D SND_MAX, + [EV_FF] =3D FF_MAX, +}; + static inline int is_event_supported(unsigned int code, unsigned long *bm, unsigned int max) { @@ -1913,6 +1924,14 @@ EXPORT_SYMBOL(input_free_device); */ void input_set_capability(struct input_dev *dev, unsigned int type, unsign= ed int code) { + if (type < EV_CNT && input_max_code[type] && + code > input_max_code[type]) { + pr_err("%s: invalid code %u for type %u\n", __func__, code, + type); + dump_stack(); + return; + } + switch (type) { case EV_KEY: __set_bit(code, dev->keybit); --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2985C433EF for ; Mon, 23 May 2022 17:04:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239222AbiEWREQ (ORCPT ); Mon, 23 May 2022 13:04:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45254 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239162AbiEWREG (ORCPT ); Mon, 23 May 2022 13:04:06 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 74E4A54F81; Mon, 23 May 2022 10:04:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id CF335CE1710; Mon, 23 May 2022 17:04:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AE807C385AA; Mon, 23 May 2022 17:04:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325441; bh=HRk57lP6sF9mILCmLjJQ6o2/9oKk/pnufB31Sf1vFA0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ceiX76itaZ2wEtB09jjWzWHRo5FOj0gw0MmozbH74jp9mENt1AWOMVEyewe6y6FF/ 8LmaKalA+rNt7KjfiVPVyA37ZbO/le+J2el3LZ1M1VFVMakjxsrPg9VorbqUhqvLnU LkD9IrsQ4ssoDcPLOFqND5Frct1M1FlV6UIb0hzw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiaoke Wang , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.9 04/25] MIPS: lantiq: check the return value of kzalloc() Date: Mon, 23 May 2022 19:03:22 +0200 Message-Id: <20220523165745.453623965@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiaoke Wang [ Upstream commit 34123208bbcc8c884a0489f543a23fe9eebb5514 ] kzalloc() is a memory allocation function which can return NULL when some internal memory errors happen. So it is better to check the return value of it to prevent potential wrong memory access or memory leak. Signed-off-by: Xiaoke Wang Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/mips/lantiq/falcon/sysctrl.c | 2 ++ arch/mips/lantiq/xway/gptu.c | 2 ++ arch/mips/lantiq/xway/sysctrl.c | 46 ++++++++++++++++++++----------- 3 files changed, 34 insertions(+), 16 deletions(-) diff --git a/arch/mips/lantiq/falcon/sysctrl.c b/arch/mips/lantiq/falcon/sy= sctrl.c index 82bbd0e2e298..714d92659489 100644 --- a/arch/mips/lantiq/falcon/sysctrl.c +++ b/arch/mips/lantiq/falcon/sysctrl.c @@ -169,6 +169,8 @@ static inline void clkdev_add_sys(const char *dev, unsi= gned int module, { struct clk *clk =3D kzalloc(sizeof(struct clk), GFP_KERNEL); =20 + if (!clk) + return; clk->cl.dev_id =3D dev; clk->cl.con_id =3D NULL; clk->cl.clk =3D clk; diff --git a/arch/mips/lantiq/xway/gptu.c b/arch/mips/lantiq/xway/gptu.c index 0f1bbea1a816..955d0d5cfbdb 100644 --- a/arch/mips/lantiq/xway/gptu.c +++ b/arch/mips/lantiq/xway/gptu.c @@ -124,6 +124,8 @@ static inline void clkdev_add_gptu(struct device *dev, = const char *con, { struct clk *clk =3D kzalloc(sizeof(struct clk), GFP_KERNEL); =20 + if (!clk) + return; clk->cl.dev_id =3D dev_name(dev); clk->cl.con_id =3D con; clk->cl.clk =3D clk; diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctr= l.c index 95bec460b651..dd7c36a193e3 100644 --- a/arch/mips/lantiq/xway/sysctrl.c +++ b/arch/mips/lantiq/xway/sysctrl.c @@ -331,6 +331,8 @@ static void clkdev_add_pmu(const char *dev, const char = *con, bool deactivate, { struct clk *clk =3D kzalloc(sizeof(struct clk), GFP_KERNEL); =20 + if (!clk) + return; clk->cl.dev_id =3D dev; clk->cl.con_id =3D con; clk->cl.clk =3D clk; @@ -354,6 +356,8 @@ static void clkdev_add_cgu(const char *dev, const char = *con, { struct clk *clk =3D kzalloc(sizeof(struct clk), GFP_KERNEL); =20 + if (!clk) + return; clk->cl.dev_id =3D dev; clk->cl.con_id =3D con; clk->cl.clk =3D clk; @@ -372,24 +376,28 @@ static void clkdev_add_pci(void) struct clk *clk_ext =3D kzalloc(sizeof(struct clk), GFP_KERNEL); =20 /* main pci clock */ - clk->cl.dev_id =3D "17000000.pci"; - clk->cl.con_id =3D NULL; - clk->cl.clk =3D clk; - clk->rate =3D CLOCK_33M; - clk->rates =3D valid_pci_rates; - clk->enable =3D pci_enable; - clk->disable =3D pmu_disable; - clk->module =3D 0; - clk->bits =3D PMU_PCI; - clkdev_add(&clk->cl); + if (clk) { + clk->cl.dev_id =3D "17000000.pci"; + clk->cl.con_id =3D NULL; + clk->cl.clk =3D clk; + clk->rate =3D CLOCK_33M; + clk->rates =3D valid_pci_rates; + clk->enable =3D pci_enable; + clk->disable =3D pmu_disable; + clk->module =3D 0; + clk->bits =3D PMU_PCI; + clkdev_add(&clk->cl); + } =20 /* use internal/external bus clock */ - clk_ext->cl.dev_id =3D "17000000.pci"; - clk_ext->cl.con_id =3D "external"; - clk_ext->cl.clk =3D clk_ext; - clk_ext->enable =3D pci_ext_enable; - clk_ext->disable =3D pci_ext_disable; - clkdev_add(&clk_ext->cl); + if (clk_ext) { + clk_ext->cl.dev_id =3D "17000000.pci"; + clk_ext->cl.con_id =3D "external"; + clk_ext->cl.clk =3D clk_ext; + clk_ext->enable =3D pci_ext_enable; + clk_ext->disable =3D pci_ext_disable; + clkdev_add(&clk_ext->cl); + } } =20 /* xway socs can generate clocks on gpio pins */ @@ -409,9 +417,15 @@ static void clkdev_add_clkout(void) char *name; =20 name =3D kzalloc(sizeof("clkout0"), GFP_KERNEL); + if (!name) + continue; sprintf(name, "clkout%d", i); =20 clk =3D kzalloc(sizeof(struct clk), GFP_KERNEL); + if (!clk) { + kfree(name); + continue; + } clk->cl.dev_id =3D "1f103000.cgu"; clk->cl.con_id =3D name; clk->cl.clk =3D clk; --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16809C433F5 for ; Mon, 23 May 2022 17:06:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239472AbiEWRGq (ORCPT ); Mon, 23 May 2022 13:06:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239292AbiEWRFM (ORCPT ); Mon, 23 May 2022 13:05:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3BD469710; Mon, 23 May 2022 10:05:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0998F614BB; Mon, 23 May 2022 17:05:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8FC3BC385A9; Mon, 23 May 2022 17:05:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325510; bh=6jNmCwqW0fu4CPFR3J5FzbGjeFGMlP2sKf6skwD6jqA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vw9IXf8+jIHvYs7uImeCMba7yaCMuxx40A8ZN5MTX9y6rCP+rcQoL59Q+la5gFp9y nIyYGQ6zc3mt7KxSM496H6/nexwzh5pt4M8AeqZmxZS//UukyaG3Y/eq6B3iQIpa/l uFJo8bqom3x4eepJVCnYVM2ElCaZ+ISiD9AR0cT0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jakob Koschel , Jens Axboe , Sasha Levin Subject: [PATCH 4.9 05/25] drbd: remove usage of list iterator variable after loop Date: Mon, 23 May 2022 19:03:23 +0200 Message-Id: <20220523165745.621276276@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jakob Koschel [ Upstream commit 901aeda62efa21f2eae937bccb71b49ae531be06 ] In preparation to limit the scope of a list iterator to the list traversal loop, use a dedicated pointer to iterate through the list [1]. Since that variable should not be used past the loop iteration, a separate variable is used to 'remember the current location within the loop'. To either continue iterating from that position or skip the iteration (if the previous iteration was complete) list_prepare_entry() is used. Link: https://lore.kernel.org/all/CAHk-=3DwgRr_D8CB-D9Kg-c=3DEHreAsk5SqXPwr= 9Y7k9sA6cWXJ6w@mail.gmail.com/ [1] Signed-off-by: Jakob Koschel Link: https://lore.kernel.org/r/20220331220349.885126-1-jakobkoschel@gmail.= com Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/block/drbd/drbd_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c index daa9cef96ec6..f4537a5eef02 100644 --- a/drivers/block/drbd/drbd_main.c +++ b/drivers/block/drbd/drbd_main.c @@ -193,7 +193,7 @@ void tl_release(struct drbd_connection *connection, uns= igned int barrier_nr, unsigned int set_size) { struct drbd_request *r; - struct drbd_request *req =3D NULL; + struct drbd_request *req =3D NULL, *tmp =3D NULL; int expect_epoch =3D 0; int expect_size =3D 0; =20 @@ -247,8 +247,11 @@ void tl_release(struct drbd_connection *connection, un= signed int barrier_nr, * to catch requests being barrier-acked "unexpectedly". * It usually should find the same req again, or some READ preceding it. = */ list_for_each_entry(req, &connection->transfer_log, tl_requests) - if (req->epoch =3D=3D expect_epoch) + if (req->epoch =3D=3D expect_epoch) { + tmp =3D req; break; + } + req =3D list_prepare_entry(tmp, &connection->transfer_log, tl_requests); list_for_each_entry_safe_from(req, r, &connection->transfer_log, tl_reque= sts) { if (req->epoch !=3D expect_epoch) break; --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F377C433F5 for ; Mon, 23 May 2022 17:04:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239230AbiEWREU (ORCPT ); Mon, 23 May 2022 13:04:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45314 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239192AbiEWREH (ORCPT ); Mon, 23 May 2022 13:04:07 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D3D4F58E44; Mon, 23 May 2022 10:04:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 651B9B811F8; Mon, 23 May 2022 17:04:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BDB77C385AA; Mon, 23 May 2022 17:04:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325444; bh=ysIqWVHbnrXLFB5Xh0t302S4eTBVDG6PTJHJP26q2Po=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=at1Ml486X0pg/nOL7LBt9fA0BxOedXqYLWfUY/DDrqBemGac6CU7fCVP1Izv9Mcrp 6aE8OY2Zj0oeBcvn68/B8BvbAtBbAKwITmd6RxvsamcHZnFlU+WMD29KzrppLNSAfo co0dS5fDQcCnKilVVSRzvL2zmb+5XEsauj8fvJRU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Yujun , He Ying , "Russell King (Oracle)" , Sasha Levin Subject: [PATCH 4.9 06/25] ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() Date: Mon, 23 May 2022 19:03:24 +0200 Message-Id: <20220523165745.789905812@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: linyujun [ Upstream commit 9be4c88bb7924f68f88cfd47d925c2d046f51a73 ] The following KASAN warning is detected by QEMU. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: stack-out-of-bounds in unwind_frame+0x508/0x870 Read of size 4 at addr c36bba90 by task cat/163 CPU: 1 PID: 163 Comm: cat Not tainted 5.10.0-rc1 #40 Hardware name: ARM-Versatile Express [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0x98/0xb0) [] (dump_stack) from [] (print_address_description.cons= tprop.0+0x58/0x4bc) [] (print_address_description.constprop.0) from [] (kas= an_report+0x154/0x170) [] (kasan_report) from [] (unwind_frame+0x508/0x870) [] (unwind_frame) from [] (__save_stack_trace+0x110/0x1= 34) [] (__save_stack_trace) from [] (stack_trace_save+0x8c/= 0xb4) [] (stack_trace_save) from [] (kasan_set_track+0x38/0x6= 0) [] (kasan_set_track) from [] (kasan_set_free_info+0x20/= 0x2c) [] (kasan_set_free_info) from [] (__kasan_slab_free+0xe= c/0x120) [] (__kasan_slab_free) from [] (kmem_cache_free+0x7c/0x= 334) [] (kmem_cache_free) from [] (rcu_core+0x390/0xccc) [] (rcu_core) from [] (__do_softirq+0x180/0x518) [] (__do_softirq) from [] (irq_exit+0x9c/0xe0) [] (irq_exit) from [] (__handle_domain_irq+0xb0/0x110) [] (__handle_domain_irq) from [] (gic_handle_irq+0xa0/0= xb8) [] (gic_handle_irq) from [] (__irq_svc+0x6c/0x94) Exception stack(0xc36bb928 to 0xc36bb970) b920: c36bb9c0 00000000 c0126919 c0101228 c36bb9c0 b76d77= 30 b940: c36b8000 c36bb9a0 c3335b00 c01ce0d8 00000003 c36bba3c c36bb940 c36bb9= 78 b960: c010e298 c011373c 60000013 ffffffff [] (__irq_svc) from [] (unwind_frame+0x0/0x870) [] (unwind_frame) from [<00000000>] (0x0) The buggy address belongs to the page: page:(ptrval) refcount:0 mapcount:0 mapping:00000000 index:0x0 pfn:0x636bb flags: 0x0() raw: 00000000 00000000 ef867764 00000000 00000000 00000000 ffffffff 00000000 page dumped because: kasan: bad access detected addr c36bba90 is located in stack of task cat/163 at offset 48 in frame: stack_trace_save+0x0/0xb4 this frame has 1 object: [32, 48) 'trace' Memory state around the buggy address: c36bb980: f1 f1 f1 f1 00 04 f2 f2 00 00 f3 f3 00 00 00 00 c36bba00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 >c36bba80: 00 00 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 ^ c36bbb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c36bbb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D There is a same issue on x86 and has been resolved by the commit f7d27c35dd= ff ("x86/mm, kasan: Silence KASAN warnings in get_wchan()"). The solution could be applied to arm architecture too. Signed-off-by: Lin Yujun Reported-by: He Ying Signed-off-by: Russell King (Oracle) Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/arm/kernel/stacktrace.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c index c10c1de244eb..83d0aa217bb2 100644 --- a/arch/arm/kernel/stacktrace.c +++ b/arch/arm/kernel/stacktrace.c @@ -50,17 +50,17 @@ int notrace unwind_frame(struct stackframe *frame) return -EINVAL; =20 frame->sp =3D frame->fp; - frame->fp =3D *(unsigned long *)(fp); - frame->pc =3D *(unsigned long *)(fp + 4); + frame->fp =3D READ_ONCE_NOCHECK(*(unsigned long *)(fp)); + frame->pc =3D READ_ONCE_NOCHECK(*(unsigned long *)(fp + 4)); #else /* check current frame pointer is within bounds */ if (fp < low + 12 || fp > high - 4) return -EINVAL; =20 /* restore the registers from the stack frame */ - frame->fp =3D *(unsigned long *)(fp - 12); - frame->sp =3D *(unsigned long *)(fp - 8); - frame->pc =3D *(unsigned long *)(fp - 4); + frame->fp =3D READ_ONCE_NOCHECK(*(unsigned long *)(fp - 12)); + frame->sp =3D READ_ONCE_NOCHECK(*(unsigned long *)(fp - 8)); + frame->pc =3D READ_ONCE_NOCHECK(*(unsigned long *)(fp - 4)); #endif =20 return 0; --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25827C433EF for ; Mon, 23 May 2022 17:05:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239346AbiEWRFS (ORCPT ); Mon, 23 May 2022 13:05:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239260AbiEWREo (ORCPT ); Mon, 23 May 2022 13:04:44 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6679262BC5; Mon, 23 May 2022 10:04:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0FBCDB811E9; Mon, 23 May 2022 17:04:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 70933C385A9; Mon, 23 May 2022 17:04:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325480; bh=KK64IlH3w9eeVXqXAmJOrVOhdQ3ukjaBlyzBvMQ66Vc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PMlYIsf2mLr9+jZUE/Bohx45SOZuSlPqPkuwcfxzN8PxD+zwC+rSnpFf6MaDvF+nX CO24Bj4uKLUnvhsZZmHpxFay21bmFeomOBlyqwt8DJV8HlGDnucb4jvPcMosnAxj7K i7cjjMwh3Fyn8of4hr6I+l+7StMkFLwfAXl4Ro5o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Ulf Hansson , Kamal Dasu , Florian Fainelli Subject: [PATCH 4.9 07/25] mmc: core: Specify timeouts for BKOPS and CACHE_FLUSH for eMMC Date: Mon, 23 May 2022 19:03:25 +0200 Message-Id: <20220523165745.966956440@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ulf Hansson commit 24ed3bd01d6a844fd5e8a75f48d0a3d10ed71bf9 upstream The timeout values used while waiting for a CMD6 for BKOPS or a CACHE_FLUSH to complete, are not defined by the eMMC spec. However, a timeout of 10 minutes as is currently being used, is just silly for both of these cases. Instead, let's specify more reasonable timeouts, 120s for BKOPS and 30s for CACHE_FLUSH. Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20200122142747.5690-2-ulf.hansson@linaro.org Signed-off-by: Kamal Dasu [kamal: Drop mmc_run_bkops hunk, non-existent] Signed-off-by: Florian Fainelli Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/mmc/core/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/mmc/core/core.c +++ b/drivers/mmc/core/core.c @@ -61,6 +61,8 @@ /* The max erase timeout, used when host->max_busy_timeout isn't specified= */ #define MMC_ERASE_TIMEOUT_MS (60 * 1000) /* 60 s */ =20 +#define MMC_CACHE_FLUSH_TIMEOUT_MS (30 * 1000) /* 30s */ + static const unsigned freqs[] =3D { 400000, 300000, 200000, 100000 }; =20 /* @@ -2936,7 +2938,8 @@ int mmc_flush_cache(struct mmc_card *car (card->ext_csd.cache_size > 0) && (card->ext_csd.cache_ctrl & 1)) { err =3D mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, - EXT_CSD_FLUSH_CACHE, 1, 0); + EXT_CSD_FLUSH_CACHE, 1, + MMC_CACHE_FLUSH_TIMEOUT_MS); if (err) pr_err("%s: cache flush error %d\n", mmc_hostname(card->host), err); From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78152C433FE for ; Mon, 23 May 2022 17:05:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239351AbiEWRFZ (ORCPT ); Mon, 23 May 2022 13:05:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47540 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239199AbiEWREu (ORCPT ); Mon, 23 May 2022 13:04:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7B7155FF36; Mon, 23 May 2022 10:04:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C2AAB614C7; Mon, 23 May 2022 17:04:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CBA51C385A9; Mon, 23 May 2022 17:04:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325487; bh=w37guEZIi9YdWbu0gvfh8Afk2sCoA5rp+b+1nsLFmfQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=17iF5qZmUsv4paCXTMkB5iHRLtW0AjaP14M63i8tCG9Iku2xWlxJtk8D8ekIxl1aV EIdfL4YE0lFy57+lU8r8MDPIJzsjHur+j6y2jroCrvIt5gtAIY8hiXag8mCALqU8r2 deWRFwxKvUNWVwcmNYu0F5Kv2AUkLRO/teOna10M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Ulf Hansson , Kamal Dasu , Florian Fainelli Subject: [PATCH 4.9 08/25] mmc: block: Use generic_cmd6_time when modifying INAND_CMD38_ARG_EXT_CSD Date: Mon, 23 May 2022 19:03:26 +0200 Message-Id: <20220523165746.128948726@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ulf Hansson commit ad91619aa9d78ab1c6d4a969c3db68bc331ae76c upstream The INAND_CMD38_ARG_EXT_CSD is a vendor specific EXT_CSD register, which is used to prepare an erase/trim operation. However, it doesn't make sense to use a timeout of 10 minutes while updating the register, which becomes the case when the timeout_ms argument for mmc_switch() is set to zero. Instead, let's use the generic_cmd6_time, as that seems like a reasonable timeout to use for these cases. Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20200122142747.5690-3-ulf.hansson@linaro.org Signed-off-by: Kamal Dasu Signed-off-by: Florian Fainelli Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/mmc/card/block.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/mmc/card/block.c +++ b/drivers/mmc/card/block.c @@ -1192,7 +1192,7 @@ retry: arg =3D=3D MMC_TRIM_ARG ? INAND_CMD38_ARG_TRIM : INAND_CMD38_ARG_ERASE, - 0); + card->ext_csd.generic_cmd6_time); if (err) goto out; } @@ -1235,7 +1235,7 @@ retry: arg =3D=3D MMC_SECURE_TRIM1_ARG ? INAND_CMD38_ARG_SECTRIM1 : INAND_CMD38_ARG_SECERASE, - 0); + card->ext_csd.generic_cmd6_time); if (err) goto out_retry; } @@ -1251,7 +1251,7 @@ retry: err =3D mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, INAND_CMD38_ARG_EXT_CSD, INAND_CMD38_ARG_SECTRIM2, - 0); + card->ext_csd.generic_cmd6_time); if (err) goto out_retry; } From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45814C433FE for ; Mon, 23 May 2022 17:05:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239357AbiEWRFc (ORCPT ); Mon, 23 May 2022 13:05:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47736 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239257AbiEWREx (ORCPT ); Mon, 23 May 2022 13:04:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A9E6D674C5; Mon, 23 May 2022 10:04:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DD3E7614BB; Mon, 23 May 2022 17:04:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E74E7C385A9; Mon, 23 May 2022 17:04:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325490; bh=1vNedQjfYeJf4gSkwmjMImK2i6aez+HKQrc2U7rc+6M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VN5GSvfiMJbyUtpdXUPlIxLCHopfeeZ3EO0Wl9UTuqqMmqvvcKgM4Khao9jXhYhop 1nlKjm9NFu3gTLMHEL8lCLvE5UFriZd4ylqoNC25HGKkiOvgvf+TOHcuiVy6/xeFRR VwGY3fL/OJTzjTPXjaP4GvbEwsNIJYHAjJKRY8fk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Ulf Hansson , Kamal Dasu , Florian Fainelli Subject: [PATCH 4.9 09/25] mmc: core: Default to generic_cmd6_time as timeout in __mmc_switch() Date: Mon, 23 May 2022 19:03:27 +0200 Message-Id: <20220523165746.295047581@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ulf Hansson commit 533a6cfe08f96a7b5c65e06d20916d552c11b256 upstream All callers of __mmc_switch() should now be specifying a valid timeout for the CMD6 command. However, just to be sure, let's print a warning and default to use the generic_cmd6_time in case the provided timeout_ms argument is zero. In this context, let's also simplify some of the corresponding code and clarify some related comments. Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20200122142747.5690-4-ulf.hansson@linaro.org Signed-off-by: Kamal Dasu [kamal: Drop non-existent hunks in 4.9's __mmc_switch] Signed-off-by: Florian Fainelli Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/mmc/core/mmc_ops.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) --- a/drivers/mmc/core/mmc_ops.c +++ b/drivers/mmc/core/mmc_ops.c @@ -22,8 +22,6 @@ #include "host.h" #include "mmc_ops.h" =20 -#define MMC_OPS_TIMEOUT_MS (10 * 60 * 1000) /* 10 minute timeout */ - static const u8 tuning_blk_pattern_4bit[] =3D { 0xff, 0x0f, 0xff, 0x00, 0xff, 0xcc, 0xc3, 0xcc, 0xc3, 0x3c, 0xcc, 0xff, 0xfe, 0xff, 0xfe, 0xef, @@ -530,8 +528,11 @@ int __mmc_switch(struct mmc_card *card, ignore_crc =3D false; =20 /* We have an unspecified cmd timeout, use the fallback value. */ - if (!timeout_ms) - timeout_ms =3D MMC_OPS_TIMEOUT_MS; + if (!timeout_ms) { + pr_warn("%s: unspecified timeout for CMD6 - use generic\n", + mmc_hostname(host)); + timeout_ms =3D card->ext_csd.generic_cmd6_time; + } =20 /* Must check status to be sure of no errors. */ timeout =3D jiffies + msecs_to_jiffies(timeout_ms) + 1; From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60311C433EF for ; Mon, 23 May 2022 17:05:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239300AbiEWRFj (ORCPT ); Mon, 23 May 2022 13:05:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47914 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239311AbiEWRE5 (ORCPT ); Mon, 23 May 2022 13:04:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CFD6168313; Mon, 23 May 2022 10:04:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 31036614BB; Mon, 23 May 2022 17:04:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F393C385A9; Mon, 23 May 2022 17:04:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325493; bh=iBB4Xyk+CODao7GNk41ZGPTs4iuw6wqrIAr2W8C2D1Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QSTaQmZQAP21CqJCyXKWD1E4hxerRnMnldpme7/1oGbsSf6Q3XopFrFBRDqS3gMnT uMppKoFLbk9QanvOIjN5QVW1uiqPKR399myHML+kCpvEMuGle9X4x1rHm11WaqOBFf J0IH0FFBmZFN7EFcGN1XKqSZGr+unjzwJpFfVyoU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Torvalds , Takashi Iwai Subject: [PATCH 4.9 10/25] ALSA: wavefront: Proper check of get_user() error Date: Mon, 23 May 2022 19:03:28 +0200 Message-Id: <20220523165746.470112101@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit a34ae6c0660d3b96b0055f68ef74dc9478852245 upstream. The antient ISA wavefront driver reads its sample patch data (uploaded over an ioctl) via __get_user() with no good reason; likely just for some performance optimizations in the past. Let's change this to the standard get_user() and the error check for handling the fault case properly. Reported-by: Linus Torvalds Cc: Link: https://lore.kernel.org/r/20220510103626.16635-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- sound/isa/wavefront/wavefront_synth.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/sound/isa/wavefront/wavefront_synth.c +++ b/sound/isa/wavefront/wavefront_synth.c @@ -1091,7 +1091,8 @@ wavefront_send_sample (snd_wavefront_t * =20 if (dataptr < data_end) { =09 - __get_user (sample_short, dataptr); + if (get_user(sample_short, dataptr)) + return -EFAULT; dataptr +=3D skip; =09 if (data_is_unsigned) { /* GUS ? */ From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B39DC433EF for ; Mon, 23 May 2022 17:05:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239379AbiEWRFn (ORCPT ); Mon, 23 May 2022 13:05:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48056 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239316AbiEWRE7 (ORCPT ); Mon, 23 May 2022 13:04:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 146006830B; Mon, 23 May 2022 10:04:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9AA04614BF; Mon, 23 May 2022 17:04:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80B70C385A9; Mon, 23 May 2022 17:04:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325497; bh=rhNiHcKcwt4+PZWMHm/DhDagUxcc1+Te8lDussxpnkQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HjBAnk/YkyV5GoRwOchu7US4yLdMF0YmsOzSvNyp6XFHM0heqSMEr20HbEZEQtz2j JKIBKnilcv6jYbduaeTi+WL+sJLltkGppyhwKfhgGKT23P/s+fidSuB4Zl8RyvKA9T dtWJ+Pwk22lxLLeIYQkNqJrM3GOqLxq3OAD7O/Ms= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Norbert Slusarek , "Peter Zijlstra (Intel)" , Linus Torvalds Subject: [PATCH 4.9 11/25] perf: Fix sys_perf_event_open() race against self Date: Mon, 23 May 2022 19:03:29 +0200 Message-Id: <20220523165746.647111301@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peter Zijlstra commit 3ac6487e584a1eb54071dbe1212e05b884136704 upstream. Norbert reported that it's possible to race sys_perf_event_open() such that the looser ends up in another context from the group leader, triggering many WARNs. The move_group case checks for races against itself, but the !move_group case doesn't, seemingly relying on the previous group_leader->ctx =3D=3D ctx check. However, that check is racy due to not holding any locks at that time. Therefore, re-check the result after acquiring locks and bailing if they no longer match. Additionally, clarify the not_move_group case from the move_group-vs-move_group race. Fixes: f63a8daa5812 ("perf: Fix event->ctx locking") Reported-by: Norbert Slusarek Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- kernel/events/core.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -9903,6 +9903,9 @@ SYSCALL_DEFINE5(perf_event_open, * Do not allow to attach to a group in a different task * or CPU context. If we're moving SW events, we'll fix * this up later, so allow that. + * + * Racy, not holding group_leader->ctx->mutex, see comment with + * perf_event_ctx_lock(). */ if (!move_group && group_leader->ctx !=3D ctx) goto err_context; @@ -9952,11 +9955,22 @@ SYSCALL_DEFINE5(perf_event_open, } else { perf_event_ctx_unlock(group_leader, gctx); move_group =3D 0; + goto not_move_group; } } } else { mutex_lock(&ctx->mutex); + + /* + * Now that we hold ctx->lock, (re)validate group_leader->ctx =3D=3D ctx, + * see the group_leader && !move_group test earlier. + */ + if (group_leader && group_leader->ctx !=3D ctx) { + err =3D -EINVAL; + goto err_locked; + } } +not_move_group: =20 if (ctx->task =3D=3D TASK_TOMBSTONE) { err =3D -ESRCH; From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F397DC433EF for ; Mon, 23 May 2022 17:06:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239394AbiEWRFu (ORCPT ); Mon, 23 May 2022 13:05:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48298 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239317AbiEWRFC (ORCPT ); Mon, 23 May 2022 13:05:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8758E62CD9; Mon, 23 May 2022 10:05:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E33FF614BC; Mon, 23 May 2022 17:05:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D9C7AC385A9; Mon, 23 May 2022 17:04:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325500; bh=/n1jvuZgXfMmssLmtGUHlHxOaxvfRQ7eIBhQycsuqxc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KNR8CxlAvbaJf/pmUoOmjcnGvCFTdR6mJw8F0sYdEXr4deQGgvi3XoK7Ysmed+4sD S+b4YBjCiQ9xrbQqCbcQFo/nAJXeL//eQItvTfB1OL+LuW3hMd2I6hO+moKTXG1LnM jJafdm9EsQK1V6UA00RojVIDg4LKIswGcMsiURak= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangyu Hua , Lyude Paul Subject: [PATCH 4.9 12/25] drm/dp/mst: fix a possible memory leak in fetch_monitor_name() Date: Mon, 23 May 2022 19:03:30 +0200 Message-Id: <20220523165746.853184064@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua commit 6e03b13cc7d9427c2c77feed1549191015615202 upstream. drm_dp_mst_get_edid call kmemdup to create mst_edid. So mst_edid need to be freed after use. Signed-off-by: Hangyu Hua Reviewed-by: Lyude Paul Signed-off-by: Lyude Paul Cc: stable@vger.kernel.org Link: https://patchwork.freedesktop.org/patch/msgid/20220516032042.13166-1-= hbh25y@gmail.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/gpu/drm/drm_dp_mst_topology.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -2830,6 +2830,7 @@ static void fetch_monitor_name(struct dr =20 mst_edid =3D drm_dp_mst_get_edid(port->connector, mgr, port); drm_edid_get_monitor_name(mst_edid, name, namelen); + kfree(mst_edid); } =20 /** From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2DFB6C433EF for ; Mon, 23 May 2022 17:06:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239427AbiEWRGd (ORCPT ); Mon, 23 May 2022 13:06:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48602 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239334AbiEWRFI (ORCPT ); Mon, 23 May 2022 13:05:08 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C72C860BA4; Mon, 23 May 2022 10:05:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 04686CE170E; Mon, 23 May 2022 17:05:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 03DAAC385AA; Mon, 23 May 2022 17:05:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325503; bh=WQIfEQsyilP+TeW+rhZZKdBu27Lg3NIJXqYjNAESbp8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KgS5fbGJIKhRncvs+PeeN3uj4NRr/8CtKAmEYlbAvd+0J+v9ZIanP4V62giVmpBRx MlqJXxTrpxIVXfwK+lwgyPuPP+jCphMhrygoQq/kGfVCIwq3TiBv7FoVuDxJ4oe8XU 0eLwloeM28oDWFIV1CvwI40ntA89hzx+3Jyg+hjw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, TOTE Robot , Zixuan Fu , Paolo Abeni , Sasha Levin Subject: [PATCH 4.9 13/25] net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() Date: Mon, 23 May 2022 19:03:31 +0200 Message-Id: <20220523165747.026426754@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zixuan Fu [ Upstream commit 9e7fef9521e73ca8afd7da9e58c14654b02dfad8 ] In vmxnet3_rq_alloc_rx_buf(), when dma_map_single() fails, rbi->skb is freed immediately. Similarly, in another branch, when dma_map_page() fails, rbi->page is also freed. In the two cases, vmxnet3_rq_alloc_rx_buf() returns an error to its callers vmxnet3_rq_init() -> vmxnet3_rq_init_all() -> vmxnet3_activate_dev(). Then vmxnet3_activate_dev() calls vmxnet3_rq_cleanup_all() in error handling code, and rbi->skb or rbi->page are freed again in vmxnet3_rq_cleanup_all(), causing use-after-free bugs. To fix these possible bugs, rbi->skb and rbi->page should be cleared after they are freed. The error log in our fault-injection testing is shown as follows: [ 14.319016] BUG: KASAN: use-after-free in consume_skb+0x2f/0x150 ... [ 14.321586] Call Trace: ... [ 14.325357] consume_skb+0x2f/0x150 [ 14.325671] vmxnet3_rq_cleanup_all+0x33a/0x4e0 [vmxnet3] [ 14.326150] vmxnet3_activate_dev+0xb9d/0x2ca0 [vmxnet3] [ 14.326616] vmxnet3_open+0x387/0x470 [vmxnet3] ... [ 14.361675] Allocated by task 351: ... [ 14.362688] __netdev_alloc_skb+0x1b3/0x6f0 [ 14.362960] vmxnet3_rq_alloc_rx_buf+0x1b0/0x8d0 [vmxnet3] [ 14.363317] vmxnet3_activate_dev+0x3e3/0x2ca0 [vmxnet3] [ 14.363661] vmxnet3_open+0x387/0x470 [vmxnet3] ... [ 14.367309] [ 14.367412] Freed by task 351: ... [ 14.368932] __dev_kfree_skb_any+0xd2/0xe0 [ 14.369193] vmxnet3_rq_alloc_rx_buf+0x71e/0x8d0 [vmxnet3] [ 14.369544] vmxnet3_activate_dev+0x3e3/0x2ca0 [vmxnet3] [ 14.369883] vmxnet3_open+0x387/0x470 [vmxnet3] [ 14.370174] __dev_open+0x28a/0x420 [ 14.370399] __dev_change_flags+0x192/0x590 [ 14.370667] dev_change_flags+0x7a/0x180 [ 14.370919] do_setlink+0xb28/0x3570 [ 14.371150] rtnl_newlink+0x1160/0x1740 [ 14.371399] rtnetlink_rcv_msg+0x5bf/0xa50 [ 14.371661] netlink_rcv_skb+0x1cd/0x3e0 [ 14.371913] netlink_unicast+0x5dc/0x840 [ 14.372169] netlink_sendmsg+0x856/0xc40 [ 14.372420] ____sys_sendmsg+0x8a7/0x8d0 [ 14.372673] __sys_sendmsg+0x1c2/0x270 [ 14.372914] do_syscall_64+0x41/0x90 [ 14.373145] entry_SYSCALL_64_after_hwframe+0x44/0xae ... Fixes: 5738a09d58d5a ("vmxnet3: fix checks for dma mapping errors") Reported-by: TOTE Robot Signed-off-by: Zixuan Fu Link: https://lore.kernel.org/r/20220514050656.2636588-1-r33s3n6@gmail.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/vmxnet3/vmxnet3_drv.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet= 3_drv.c index 56a8031b56b3..b76404d0657e 100644 --- a/drivers/net/vmxnet3/vmxnet3_drv.c +++ b/drivers/net/vmxnet3/vmxnet3_drv.c @@ -595,6 +595,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u3= 2 ring_idx, if (dma_mapping_error(&adapter->pdev->dev, rbi->dma_addr)) { dev_kfree_skb_any(rbi->skb); + rbi->skb =3D NULL; rq->stats.rx_buf_alloc_failure++; break; } @@ -619,6 +620,7 @@ vmxnet3_rq_alloc_rx_buf(struct vmxnet3_rx_queue *rq, u3= 2 ring_idx, if (dma_mapping_error(&adapter->pdev->dev, rbi->dma_addr)) { put_page(rbi->page); + rbi->page =3D NULL; rq->stats.rx_buf_alloc_failure++; break; } --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4F1AC433EF for ; Mon, 23 May 2022 17:06:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239370AbiEWRGj (ORCPT ); Mon, 23 May 2022 13:06:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48674 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239338AbiEWRFI (ORCPT ); Mon, 23 May 2022 13:05:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0EC969727; Mon, 23 May 2022 10:05:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 233C2614C7; Mon, 23 May 2022 17:05:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2436BC385A9; Mon, 23 May 2022 17:05:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325506; bh=uk2ykdRUx9fBVgKlVsNcS69b0DTjULi+nD+Jr/UxuGs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OAzgxwysGA/K9T4KiH7kaYKoJHD+so0Gk8mgm5c53QMQWSqB0QgAj9o7dJKgYd9Cm pNkCdvtNbmB5A7wK9zyfVdH7F3kvRkf7VSj+PqlJLiQl/4i3NXEHoHNJZrcvjJZdsR 642kCxg1VBXqL8GLgo7U9oas0uTmJjO31na9vOpU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, TOTE Robot , Zixuan Fu , Paolo Abeni , Sasha Levin Subject: [PATCH 4.9 14/25] net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() Date: Mon, 23 May 2022 19:03:32 +0200 Message-Id: <20220523165747.189968038@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zixuan Fu [ Upstream commit edf410cb74dc612fd47ef5be319c5a0bcd6e6ccd ] In vmxnet3_rq_create(), when dma_alloc_coherent() fails, vmxnet3_rq_destroy() is called. It sets rq->rx_ring[i].base to NULL. Then vmxnet3_rq_create() returns an error to its callers mxnet3_rq_create_all() -> vmxnet3_change_mtu(). Then vmxnet3_change_mtu() calls vmxnet3_force_close() -> dev_close() in error handling code. And the driver calls vmxnet3_close() -> vmxnet3_quiesce_dev() -> vmxnet3_rq_cleanup_all() -> vmxnet3_rq_cleanup(). In vmxnet3_rq_cleanup(), rq->rx_ring[ring_idx].base is accessed, but this variable is NULL, causing a NULL pointer dereference. To fix this possible bug, an if statement is added to check whether rq->rx_ring[0].base is NULL in vmxnet3_rq_cleanup() and exit early if so. The error log in our fault-injection testing is shown as follows: [ 65.220135] BUG: kernel NULL pointer dereference, address: 0000000000000= 008 ... [ 65.222633] RIP: 0010:vmxnet3_rq_cleanup_all+0x396/0x4e0 [vmxnet3] ... [ 65.227977] Call Trace: ... [ 65.228262] vmxnet3_quiesce_dev+0x80f/0x8a0 [vmxnet3] [ 65.228580] vmxnet3_close+0x2c4/0x3f0 [vmxnet3] [ 65.228866] __dev_close_many+0x288/0x350 [ 65.229607] dev_close_many+0xa4/0x480 [ 65.231124] dev_close+0x138/0x230 [ 65.231933] vmxnet3_force_close+0x1f0/0x240 [vmxnet3] [ 65.232248] vmxnet3_change_mtu+0x75d/0x920 [vmxnet3] ... Fixes: d1a890fa37f27 ("net: VMware virtual Ethernet NIC driver: vmxnet3") Reported-by: TOTE Robot Signed-off-by: Zixuan Fu Link: https://lore.kernel.org/r/20220514050711.2636709-1-r33s3n6@gmail.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/vmxnet3/vmxnet3_drv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet= 3_drv.c index b76404d0657e..cce959f281b7 100644 --- a/drivers/net/vmxnet3/vmxnet3_drv.c +++ b/drivers/net/vmxnet3/vmxnet3_drv.c @@ -1573,6 +1573,10 @@ vmxnet3_rq_cleanup(struct vmxnet3_rx_queue *rq, u32 i, ring_idx; struct Vmxnet3_RxDesc *rxd; =20 + /* ring has already been cleaned up */ + if (!rq->rx_ring[0].base) + return; + for (ring_idx =3D 0; ring_idx < 2; ring_idx++) { for (i =3D 0; i < rq->rx_ring[ring_idx].size; i++) { #ifdef __BIG_ENDIAN_BITFIELD --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60ED2C433EF for ; Mon, 23 May 2022 17:04:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239245AbiEWREX (ORCPT ); Mon, 23 May 2022 13:04:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45378 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239199AbiEWREJ (ORCPT ); Mon, 23 May 2022 13:04:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CFECE54FBB; Mon, 23 May 2022 10:04:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 61C4D614BF; Mon, 23 May 2022 17:04:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 63C89C385A9; Mon, 23 May 2022 17:04:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325447; bh=uIm61Ja8CySFdnlS4xGVURLTLLzoNaoSoJAbJKty5Ns=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z++1lF1JMerbS+fYCGBpWQgag9tOUvdkx0gqg50cjDeCdVV5K7JTFKHG9dBzX8Oj3 0bbAWlavRomEnxADcuXCdYZmRSKf5xMDlsMJCMpti2BQqCNXZy6KyQKwOkDwW2cy1C gImvhMSwRqhPkcJEFeFBnz+1xsZJBTTC9t97Jxas= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.9 15/25] net/qla3xxx: Fix a test in ql_reset_work() Date: Mon, 23 May 2022 19:03:33 +0200 Message-Id: <20220523165747.368958980@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET [ Upstream commit 5361448e45fac6fb96738df748229432a62d78b6 ] test_bit() tests if one bit is set or not. Here the logic seems to check of bit QL_RESET_PER_SCSI (i.e. 4) OR bit QL_RESET_START (i.e. 3) is set. In fact, it checks if bit 7 (4 | 3 =3D 7) is set, that is to say QL_ADAPTER_UP. This looks harmless, because this bit is likely be set, and when the ql_reset_work() delayed work is scheduled in ql3xxx_isr() (the only place that schedule this work), QL_RESET_START or QL_RESET_PER_SCSI is set. This has been spotted by smatch. Fixes: 5a4faa873782 ("[PATCH] qla3xxx NIC driver") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/80e73e33f390001d9c0140ffa9baddf6466a41a2.16= 52637337.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/ethernet/qlogic/qla3xxx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/q= logic/qla3xxx.c index 147effc16316..e62e3a9d5249 100644 --- a/drivers/net/ethernet/qlogic/qla3xxx.c +++ b/drivers/net/ethernet/qlogic/qla3xxx.c @@ -3625,7 +3625,8 @@ static void ql_reset_work(struct work_struct *work) qdev->mem_map_registers; unsigned long hw_flags; =20 - if (test_bit((QL_RESET_PER_SCSI | QL_RESET_START), &qdev->flags)) { + if (test_bit(QL_RESET_PER_SCSI, &qdev->flags) || + test_bit(QL_RESET_START, &qdev->flags)) { clear_bit(QL_LINK_MASTER, &qdev->flags); =20 /* --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED30AC433F5 for ; Mon, 23 May 2022 17:04:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239251AbiEWRE2 (ORCPT ); Mon, 23 May 2022 13:04:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45574 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239214AbiEWREN (ORCPT ); Mon, 23 May 2022 13:04:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4EE295A588; Mon, 23 May 2022 10:04:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C1408614CA; Mon, 23 May 2022 17:04:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C563CC385AA; Mon, 23 May 2022 17:04:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325451; bh=eLXtVv/gyCft0m7oLFDOCv2NdFuhvuKKxzvs6PE2RX0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vGN2Hrfx3IBpji1gFZvBFUyp7McKNytgwgvwpII+H8WQn7Sdcra6kdTvV8paqQo8s qZi3/4EjJgvqIzK/ipLVv86fsrYhytHcrdYtLEhJ5Rxr2px1gb0R4dFDuXvh9prQF4 Abpsa3bM5/nT/xMnDrBNU4DnKUxfxAUAt2C9KAX0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Krzysztof Kozlowski , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.9 16/25] NFC: nci: fix sleep in atomic context bugs caused by nci_skb_alloc Date: Mon, 23 May 2022 19:03:34 +0200 Message-Id: <20220523165747.575050147@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou [ Upstream commit 23dd4581350d4ffa23d58976ec46408f8f4c1e16 ] There are sleep in atomic context bugs when the request to secure element of st-nci is timeout. The root cause is that nci_skb_alloc with GFP_KERNEL parameter is called in st_nci_se_wt_timeout which is a timer handler. The call paths that could trigger bugs are shown below: (interrupt context 1) st_nci_se_wt_timeout nci_hci_send_event nci_hci_send_data nci_skb_alloc(..., GFP_KERNEL) //may sleep (interrupt context 2) st_nci_se_wt_timeout nci_hci_send_event nci_hci_send_data nci_send_data nci_queue_tx_data_frags nci_skb_alloc(..., GFP_KERNEL) //may sleep This patch changes allocation mode of nci_skb_alloc from GFP_KERNEL to GFP_ATOMIC in order to prevent atomic context sleeping. The GFP_ATOMIC flag makes memory allocation operation could be used in atomic context. Fixes: ed06aeefdac3 ("nfc: st-nci: Rename st21nfcb to st-nci") Signed-off-by: Duoming Zhou Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220517012530.75714-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/nfc/nci/data.c | 2 +- net/nfc/nci/hci.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c index d20383779710..b8a295dd15d8 100644 --- a/net/nfc/nci/data.c +++ b/net/nfc/nci/data.c @@ -130,7 +130,7 @@ static int nci_queue_tx_data_frags(struct nci_dev *ndev, =20 skb_frag =3D nci_skb_alloc(ndev, (NCI_DATA_HDR_SIZE + frag_len), - GFP_KERNEL); + GFP_ATOMIC); if (skb_frag =3D=3D NULL) { rc =3D -ENOMEM; goto free_exit; diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c index 5fae3f064ad0..9c37618f36c6 100644 --- a/net/nfc/nci/hci.c +++ b/net/nfc/nci/hci.c @@ -165,7 +165,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 p= ipe, =20 i =3D 0; skb =3D nci_skb_alloc(ndev, conn_info->max_pkt_payload_len + - NCI_DATA_HDR_SIZE, GFP_KERNEL); + NCI_DATA_HDR_SIZE, GFP_ATOMIC); if (!skb) return -ENOMEM; =20 @@ -198,7 +198,7 @@ static int nci_hci_send_data(struct nci_dev *ndev, u8 p= ipe, if (i < data_len) { skb =3D nci_skb_alloc(ndev, conn_info->max_pkt_payload_len + - NCI_DATA_HDR_SIZE, GFP_KERNEL); + NCI_DATA_HDR_SIZE, GFP_ATOMIC); if (!skb) return -ENOMEM; =20 --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 146A3C433F5 for ; Mon, 23 May 2022 17:04:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239215AbiEWREj (ORCPT ); Mon, 23 May 2022 13:04:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239226AbiEWREU (ORCPT ); Mon, 23 May 2022 13:04:20 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DAA215EBFB; Mon, 23 May 2022 10:04:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 26829CE1702; Mon, 23 May 2022 17:04:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA593C385A9; Mon, 23 May 2022 17:04:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325454; bh=a53XyWgxcHsItrYzpMjm/O/QH6M0PYqPnsWpncreaHs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gouc1jed6Ti1OfAdbzOZOD67wDfEQnW6nHuagDfBlXL/ErtgAbSjZPeGJA4sbcCsN OxIpNX4I8Pj90gUKYjSglniRwCDvCGO3xkMOUIuwoowIgcr0g+dLGQzHpHkG9BELbA jw5mnKFssxmmGM6Mtfx9lG33IarN9lw37PszAZ8w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Steffen Klassert , Sasha Levin Subject: [PATCH 4.9 17/25] net: af_key: add check for pfkey_broadcast in function pfkey_process Date: Mon, 23 May 2022 19:03:35 +0200 Message-Id: <20220523165747.753367333@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 4dc2a5a8f6754492180741facf2a8787f2c415d7 ] If skb_clone() returns null pointer, pfkey_broadcast() will return error. Therefore, it should be better to check the return value of pfkey_broadcast() and return error if fails. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jiasheng Jiang Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/key/af_key.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/key/af_key.c b/net/key/af_key.c index c9cc9f75b099..776f94ecbfe6 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -2861,8 +2861,10 @@ static int pfkey_process(struct sock *sk, struct sk_= buff *skb, const struct sadb void *ext_hdrs[SADB_EXT_MAX]; int err; =20 - pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, - BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); + err =3D pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, + BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); + if (err) + return err; =20 memset(ext_hdrs, 0, sizeof(ext_hdrs)); err =3D parse_exthdrs(skb, hdr, ext_hdrs); --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DBFF4C433EF for ; Mon, 23 May 2022 17:04:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239269AbiEWREp (ORCPT ); Mon, 23 May 2022 13:04:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45968 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239233AbiEWREW (ORCPT ); Mon, 23 May 2022 13:04:22 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8B4975DE5C; Mon, 23 May 2022 10:04:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 337D5B811ED; Mon, 23 May 2022 17:04:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6340FC385A9; Mon, 23 May 2022 17:04:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325457; bh=UodYB9RZCKj8YDl/NrPyDzZlEGObUwSATbKP+WigtdM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jAV7YWXXYAoaHa94FkcAAPmyS3Eq2vtg7dPVR2F8imQhG1AKwo9ESHLBg5ePFwhEo g20tqLZTMVRhXai66y1cthy3QL3FpShWxQ6s5qQvTPAtlBa7QsapwT1QI5/9svlaHo J8l1RXzSenAeDGixvc9ltIONyw3CIJu9zy4qT8wk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ard Biesheuvel , "Russell King (Oracle)" , Sasha Levin Subject: [PATCH 4.9 18/25] ARM: 9196/1: spectre-bhb: enable for Cortex-A15 Date: Mon, 23 May 2022 19:03:36 +0200 Message-Id: <20220523165747.922316017@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ard Biesheuvel [ Upstream commit 0dc14aa94ccd8ba35eb17a0f9b123d1566efd39e ] The Spectre-BHB mitigations were inadvertently left disabled for Cortex-A15, due to the fact that cpu_v7_bugs_init() is not called in that case. So fix that. Fixes: b9baf5c8c5c3 ("ARM: Spectre-BHB workaround") Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (Oracle) Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/arm/mm/proc-v7-bugs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c index 1b6e770bc1cd..8b78694d56b8 100644 --- a/arch/arm/mm/proc-v7-bugs.c +++ b/arch/arm/mm/proc-v7-bugs.c @@ -297,6 +297,7 @@ void cpu_v7_ca15_ibe(void) { if (check_spectre_auxcr(this_cpu_ptr(&spectre_warned), BIT(0))) cpu_v7_spectre_v2_init(); + cpu_v7_spectre_bhb_init(); } =20 void cpu_v7_bugs_init(void) --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6960BC433EF for ; Mon, 23 May 2022 17:04:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239286AbiEWREt (ORCPT ); Mon, 23 May 2022 13:04:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46140 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239247AbiEWREZ (ORCPT ); Mon, 23 May 2022 13:04:25 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0EB2154F80; Mon, 23 May 2022 10:04:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8FD36B811ED; Mon, 23 May 2022 17:04:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DA524C385A9; Mon, 23 May 2022 17:04:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325461; bh=IjHjZKGjwLvPiD+iIO/uDEmcKN/6d7RzLUJBVizQgSo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BTUZ8VaXNZuo96geB2RasYCSgIl7sEGIcdMx9uwGIpelhIE6vk1tOKkiYNmneubug hXJOhXEhLQ0M/wPJGMf0s/SsKFZiHXJfyoyEQikQDRw01qRXnLaUkNEUX8kyp6FBEC USlSNmBL3D0bjrz3nOVf9BPj/knLdULjYwf33wmY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ard Biesheuvel , "Russell King (Oracle)" , Sasha Levin Subject: [PATCH 4.9 19/25] ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 Date: Mon, 23 May 2022 19:03:37 +0200 Message-Id: <20220523165748.114174640@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ard Biesheuvel [ Upstream commit 3cfb3019979666bdf33a1010147363cf05e0f17b ] In Thumb2, 'b . + 4' produces a branch instruction that uses a narrow encoding, and so it does not jump to the following instruction as expected. So use W(b) instead. Fixes: 6c7cb60bff7a ("ARM: fix Thumb2 regression with Spectre BHB") Signed-off-by: Ard Biesheuvel Signed-off-by: Russell King (Oracle) Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- arch/arm/kernel/entry-armv.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S index 77ec669fd5ee..247229e69322 100644 --- a/arch/arm/kernel/entry-armv.S +++ b/arch/arm/kernel/entry-armv.S @@ -1074,7 +1074,7 @@ vector_bhb_loop8_\name: =20 @ bhb workaround mov r0, #8 -3: b . + 4 +3: W(b) . + 4 subs r0, r0, #1 bne 3b dsb --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 439C1C433EF for ; Mon, 23 May 2022 17:04:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239306AbiEWREy (ORCPT ); Mon, 23 May 2022 13:04:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46184 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239207AbiEWRE0 (ORCPT ); Mon, 23 May 2022 13:04:26 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 883885AA75; Mon, 23 May 2022 10:04:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0D5D3614C5; Mon, 23 May 2022 17:04:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 082DEC385AA; Mon, 23 May 2022 17:04:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325464; bh=lTdW7lb3zEyhISNlSN4jt98GKD7778Q4bGawEDXk098=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PDO1mCH5aoaEl9OeEvod/MUT13sXJtwyJNz5OpEBk/7ZPtxMOB6VQog/FV8hboUKR pX0xv5W4P7vfVMC6PEGwjE5Lj8xN+ZgQmA+QU5dxf058zjvPQ/zk/WYIWtO5y2EdwB tPja9zJEshEbTs+UtgG1NyHVIm3NTGDX52RnKWh4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kevin Mitchell , Tony Nguyen , "David S. Miller" , Sasha Levin , Gurucharan Subject: [PATCH 4.9 20/25] igb: skip phy status check where unavailable Date: Mon, 23 May 2022 19:03:38 +0200 Message-Id: <20220523165748.366311349@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kevin Mitchell [ Upstream commit 942d2ad5d2e0df758a645ddfadffde2795322728 ] igb_read_phy_reg() will silently return, leaving phy_data untouched, if hw->ops.read_reg isn't set. Depending on the uninitialized value of phy_data, this led to the phy status check either succeeding immediately or looping continuously for 2 seconds before emitting a noisy err-level timeout. This message went out to the console even though there was no actual problem. Instead, first check if there is read_reg function pointer. If not, proceed without trying to check the phy status register. Fixes: b72f3f72005d ("igb: When GbE link up, wait for Remote receiver statu= s condition") Signed-off-by: Kevin Mitchell Tested-by: Gurucharan (A Contingent worker at Int= el) Signed-off-by: Tony Nguyen Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/ethernet/intel/igb/igb_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethern= et/intel/igb/igb_main.c index 6bede6774486..d825e527ec1a 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -4546,7 +4546,8 @@ static void igb_watchdog_task(struct work_struct *wor= k) break; } =20 - if (adapter->link_speed !=3D SPEED_1000) + if (adapter->link_speed !=3D SPEED_1000 || + !hw->phy.ops.read_reg) goto no_wait; =20 /* wait for Remote receiver status OK */ --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5FB0C433FE for ; Mon, 23 May 2022 17:04:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239315AbiEWRE6 (ORCPT ); Mon, 23 May 2022 13:04:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46392 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239186AbiEWREa (ORCPT ); Mon, 23 May 2022 13:04:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CECB2606C5; Mon, 23 May 2022 10:04:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2B638614CA; Mon, 23 May 2022 17:04:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2C77BC385AA; Mon, 23 May 2022 17:04:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325467; bh=HSgZXCYSvJ2DAUSCVxoxr58HGGP+tTK7i18NqmCvYZI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M/BwFFYO3dWIhZmOhD9pz+/iGh/rZuCQ8Db2RLyDADqgRVy1/noa6dmx+yL7UDWQO hiAK8o3qwzZOguSo6dHxhqMYvREwuzoJ30eJnmnaAuU2PA8LQR1dYvNBj2VI0ezHld jeQNDRnNmmK9U8zH79Glajlt5c+c+NCql8IphZQU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Namhyung Kim , Thomas Richter , Heiko Carstens , Sumanth Korikkar , Sven Schnelle , Vasily Gorbik , Arnaldo Carvalho de Melo , Sasha Levin Subject: [PATCH 4.9 21/25] perf bench numa: Address compiler error on s390 Date: Mon, 23 May 2022 19:03:39 +0200 Message-Id: <20220523165749.082966913@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Thomas Richter [ Upstream commit f8ac1c478424a9a14669b8cef7389b1e14e5229d ] The compilation on s390 results in this error: # make DEBUG=3Dy bench/numa.o ... bench/numa.c: In function =E2=80=98__bench_numa=E2=80=99: bench/numa.c:1749:81: error: =E2=80=98%d=E2=80=99 directive output may be= truncated writing between 1 and 11 bytes into a region of size between 10 and 20 [-Werror=3Dformat-truncation=3D] 1749 | snprintf(tname, sizeof(tname), "process%d:thread%d", p, t); ^~ ... bench/numa.c:1749:64: note: directive argument in the range [-2147483647, 2147483646] ... # The maximum length of the %d replacement is 11 characters because of the negative sign. Therefore extend the array by two more characters. Output after: # make DEBUG=3Dy bench/numa.o > /dev/null 2>&1; ll bench/numa.o -rw-r--r-- 1 root root 418320 May 19 09:11 bench/numa.o # Fixes: 3aff8ba0a4c9c919 ("perf bench numa: Avoid possible truncation when u= sing snprintf()") Suggested-by: Namhyung Kim Signed-off-by: Thomas Richter Cc: Heiko Carstens Cc: Sumanth Korikkar Cc: Sven Schnelle Cc: Vasily Gorbik Link: https://lore.kernel.org/r/20220520081158.2990006-1-tmricht@linux.ibm.= com Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- tools/perf/bench/numa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c index 7b364f2926d4..901e9d6efcec 100644 --- a/tools/perf/bench/numa.c +++ b/tools/perf/bench/numa.c @@ -1626,7 +1626,7 @@ static int __bench_numa(const char *name) "GB/sec,", "total-speed", "GB/sec total speed"); =20 if (g->p.show_details >=3D 2) { - char tname[14 + 2 * 10 + 1]; + char tname[14 + 2 * 11 + 1]; struct thread_data *td; for (p =3D 0; p < g->p.nr_proc; p++) { for (t =3D 0; t < g->p.nr_threads; t++) { --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A91D5C433F5 for ; Mon, 23 May 2022 17:05:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239327AbiEWRFC (ORCPT ); Mon, 23 May 2022 13:05:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46650 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239256AbiEWREf (ORCPT ); Mon, 23 May 2022 13:04:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 00CEE60B85; Mon, 23 May 2022 10:04:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 74880B811E9; Mon, 23 May 2022 17:04:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7DBC9C385A9; Mon, 23 May 2022 17:04:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325471; bh=sBS5VQKb5ioj3Nk8RgBkunxitCuvKvoRM4eCzRa6ets=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nTTw5TuuOyWdUNbNkYn9mzqD/tFKCyMbLLRSCF8wMS4WNbCTPAh3Fu/dMZyX2+yK7 4Sv2rbP9EFJfXZ/lsmDLoZIl34++GT4wiyoyLGeqn/h+8+lmSnCitf9yukcaB1HUrM 13lUfZ8sNxQWVG/YQmCzsXoM9voFWsNLXKU13IEU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Himanshu Madhani , Gleb Chesnokov , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.9 22/25] scsi: qla2xxx: Fix missed DMA unmap for aborted commands Date: Mon, 23 May 2022 19:03:40 +0200 Message-Id: <20220523165749.618286779@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Gleb Chesnokov [ Upstream commit 26f9ce53817a8fd84b69a73473a7de852a24c897 ] Aborting commands that have already been sent to the firmware can cause BUG in qlt_free_cmd(): BUG_ON(cmd->sg_mapped) For instance: - Command passes rdx_to_xfer state, maps sgl, sends to the firmware - Reset occurs, qla2xxx performs ISP error recovery, aborts the command - Target stack calls qlt_abort_cmd() and then qlt_free_cmd() - BUG_ON(cmd->sg_mapped) in qlt_free_cmd() occurs because sgl was not unmapped Thus, unmap sgl in qlt_abort_cmd() for commands with the aborted flag set. Link: https://lore.kernel.org/r/AS8PR10MB4952D545F84B6B1DFD39EC1E9DEE9@AS8P= R10MB4952.EURPRD10.PROD.OUTLOOK.COM Reviewed-by: Himanshu Madhani Signed-off-by: Gleb Chesnokov Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/scsi/qla2xxx/qla_target.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_t= arget.c index 6ef7a094ee51..b4a21adb3e73 100644 --- a/drivers/scsi/qla2xxx/qla_target.c +++ b/drivers/scsi/qla2xxx/qla_target.c @@ -3286,6 +3286,9 @@ int qlt_abort_cmd(struct qla_tgt_cmd *cmd) =20 spin_lock_irqsave(&cmd->cmd_lock, flags); if (cmd->aborted) { + if (cmd->sg_mapped) + qlt_unmap_sg(vha, cmd); + spin_unlock_irqrestore(&cmd->cmd_lock, flags); /* * It's normal to see 2 calls in this path: --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA0CCC433F5 for ; Mon, 23 May 2022 17:05:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239331AbiEWRFG (ORCPT ); Mon, 23 May 2022 13:05:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46744 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239224AbiEWREg (ORCPT ); Mon, 23 May 2022 13:04:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A75D1606C2; Mon, 23 May 2022 10:04:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 03042614C1; Mon, 23 May 2022 17:04:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 05D54C385A9; Mon, 23 May 2022 17:04:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325474; bh=J5AZ6YoBIpezjSlGXkcI10G3x5B8FyKLScmskPDYuuY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z3GBQW4ybRAI86qc4CFzd/aCI8Az3Jx45p1CRwoaQPWJ14xO+IWx6+O0Vmj2lPICX Quq1oq03SuBPwbVWzu2RJdUmjJMWmT5JrPI/8I6BUF/qOKXMVgDVWOy9l0yMpyrGIT IaPylWTB9YqUGXDaEkq40/1YQsACcVHSJ0LLdKRI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Felix Fietkau , Johannes Berg , Sasha Levin Subject: [PATCH 4.9 23/25] mac80211: fix rx reordering with non explicit / psmp ack policy Date: Mon, 23 May 2022 19:03:41 +0200 Message-Id: <20220523165749.857405906@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Felix Fietkau [ Upstream commit 5e469ed9764d4722c59562da13120bd2dc6834c5 ] When the QoS ack policy was set to non explicit / psmp ack, frames are trea= ted as not being part of a BA session, which causes extra latency on reordering. Fix this by only bypassing reordering for packets with no-ack policy Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20220420105038.36443-1-nbd@nbd.name Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- net/mac80211/rx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 41af02a70742..02845bed07d7 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1179,8 +1179,7 @@ static void ieee80211_rx_reorder_ampdu(struct ieee802= 11_rx_data *rx, goto dont_reorder; =20 /* not part of a BA session */ - if (ack_policy !=3D IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && - ack_policy !=3D IEEE80211_QOS_CTL_ACK_POLICY_NORMAL) + if (ack_policy =3D=3D IEEE80211_QOS_CTL_ACK_POLICY_NOACK) goto dont_reorder; =20 /* new, potentially un-ordered, ampdu frame - process it */ --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8BCC9C433FE for ; Mon, 23 May 2022 17:05:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239335AbiEWRFM (ORCPT ); Mon, 23 May 2022 13:05:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47026 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239264AbiEWREl (ORCPT ); Mon, 23 May 2022 13:04:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 55E2160B9B; Mon, 23 May 2022 10:04:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E4EB3B811F6; Mon, 23 May 2022 17:04:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 40B0DC385AA; Mon, 23 May 2022 17:04:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325477; bh=g38ZTHA6CA9KSQxW8tPZQqLR6HoOyH7cl3Ykf1X8weA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=srEAr0KBTRaT3hzoqdGx8w5DavZ6BoJ8Q8wJSTbwVjhV7nGA8xbeaIDziS1KEkSfK LgpTZBf7CVJRAxmxiLG5cmQzWLc0+rTuh2BvsS/Jr0mCjAOH4pOGjss8von/PBGsfX 7Cl99larC34bFqp27cYBLduNYuo5F1dZbBcF6rSU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Yang Yingliang , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.9 24/25] ethernet: tulip: fix missing pci_disable_device() on error in tulip_init_one() Date: Mon, 23 May 2022 19:03:42 +0200 Message-Id: <20220523165750.008597497@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang [ Upstream commit 51ca86b4c9c7c75f5630fa0dbe5f8f0bd98e3c3e ] Fix the missing pci_disable_device() before return from tulip_init_one() in the error handling case. Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220506094250.3630615-1-yangyingliang@huaw= ei.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/ethernet/dec/tulip/tulip_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethe= rnet/dec/tulip/tulip_core.c index bbde90bc74fe..6224f9d22298 100644 --- a/drivers/net/ethernet/dec/tulip/tulip_core.c +++ b/drivers/net/ethernet/dec/tulip/tulip_core.c @@ -1412,8 +1412,10 @@ static int tulip_init_one(struct pci_dev *pdev, cons= t struct pci_device_id *ent) =20 /* alloc_etherdev ensures aligned and zeroed private structures */ dev =3D alloc_etherdev (sizeof (*tp)); - if (!dev) + if (!dev) { + pci_disable_device(pdev); return -ENOMEM; + } =20 SET_NETDEV_DEV(dev, &pdev->dev); if (pci_resource_len (pdev, 0) < tulip_tbl[chip_idx].io_size) { @@ -1792,6 +1794,7 @@ static int tulip_init_one(struct pci_dev *pdev, const= struct pci_device_id *ent) =20 err_out_free_netdev: free_netdev (dev); + pci_disable_device(pdev); return -ENODEV; } =20 --=20 2.35.1 From nobody Wed May 8 18:19:11 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C19CC433EF for ; Mon, 23 May 2022 17:05:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239318AbiEWRFX (ORCPT ); Mon, 23 May 2022 13:05:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47342 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239249AbiEWREq (ORCPT ); Mon, 23 May 2022 13:04:46 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 671116007B; Mon, 23 May 2022 10:04:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9D27C614BC; Mon, 23 May 2022 17:04:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A1289C34116; Mon, 23 May 2022 17:04:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1653325484; bh=9r1To4cmU5c4mec6rBMYQpdcINHgYGrxktesEOKlJhI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oNvo0bJXVau787T/JczhFof+Dbzm40FnQ8D/hvkOFndgWi2pBaazBmJSxyEGoekSg 3HIzPmAe1AtmLnFKStGph8TJ8ltJEXSQpBpexyS08JDyFhvmqGYMINlWnLMLMylpki 9SeHAahBoQvQb0EYkNuvognGbwoGyeDbfMNDl5YA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Yang Yingliang , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.9 25/25] net: stmmac: fix missing pci_disable_device() on error in stmmac_pci_probe() Date: Mon, 23 May 2022 19:03:43 +0200 Message-Id: <20220523165750.505021218@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220523165743.398280407@linuxfoundation.org> References: <20220523165743.398280407@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang [ Upstream commit 0807ce0b010418a191e0e4009803b2d74c3245d5 ] Switch to using pcim_enable_device() to avoid missing pci_disable_device(). Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220510031316.1780409-1-yangyingliang@huaw= ei.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan --- drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net= /ethernet/stmicro/stmmac/stmmac_pci.c index 49eaede34eea..9beb93479e28 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c @@ -183,7 +183,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev, return -ENOMEM; =20 /* Enable pci device */ - ret =3D pci_enable_device(pdev); + ret =3D pcim_enable_device(pdev); if (ret) { dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n", __func__); @@ -241,8 +241,6 @@ static void stmmac_pci_remove(struct pci_dev *pdev) pcim_iounmap_regions(pdev, BIT(i)); break; } - - pci_disable_device(pdev); } =20 static int stmmac_pci_suspend(struct device *dev) --=20 2.35.1