From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0B55C43334 for ; Tue, 5 Jul 2022 12:01:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231307AbiGEMBl (ORCPT ); Tue, 5 Jul 2022 08:01:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43254 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232988AbiGEMAr (ORCPT ); Tue, 5 Jul 2022 08:00:47 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 22BB218374; Tue, 5 Jul 2022 05:00:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BA7B7B817CC; Tue, 5 Jul 2022 12:00:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3268DC341CB; Tue, 5 Jul 2022 12:00:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022444; bh=IcjmW3CAugrd2BO89KzfYurHCbYolgfhJ8RSBNK+o58=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KsawS7kUQZf3rLb7a2dNX9XbU3AIZaIdNCMxuMtkfyjOe8YN+Ii3vfHEIe7oi7wMl Ynw7iSZI59IQenZZNwxjYqFCWd933gzX56GayDqorDTU9vpl07vDu/FX6yoDmaV3vc Lo0uhGary2RIlW6t5BOcWBBmCUDSkgLBqa0VaW04= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chris Ye , Vishal Verma , Dan Williams Subject: [PATCH 4.14 01/29] nvdimm: Fix badblocks clear off-by-one error Date: Tue, 5 Jul 2022 13:57:49 +0200 Message-Id: <20220705115606.379999939@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chris Ye commit ef9102004a87cb3f8b26e000a095a261fc0467d3 upstream. nvdimm_clear_badblocks_region() validates badblock clearing requests against the span of the region, however it compares the inclusive badblock request range to the exclusive region range. Fix up the off-by-one error. Fixes: 23f498448362 ("libnvdimm: rework region badblocks clearing") Cc: Signed-off-by: Chris Ye Reviewed-by: Vishal Verma Link: https://lore.kernel.org/r/165404219489.2445897.9792886413715690399.st= git@dwillia2-xfh Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/nvdimm/bus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/nvdimm/bus.c +++ b/drivers/nvdimm/bus.c @@ -192,8 +192,8 @@ static int nvdimm_clear_badblocks_region ndr_end =3D nd_region->ndr_start + nd_region->ndr_size - 1; =20 /* make sure we are in the region */ - if (ctx->phys < nd_region->ndr_start - || (ctx->phys + ctx->cleared) > ndr_end) + if (ctx->phys < nd_region->ndr_start || + (ctx->phys + ctx->cleared - 1) > ndr_end) return 0; =20 sector =3D (ctx->phys - nd_region->ndr_start) / 512; From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ACA19C43334 for ; Tue, 5 Jul 2022 12:02:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232712AbiGEMCY (ORCPT ); Tue, 5 Jul 2022 08:02:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43856 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233101AbiGEMBQ (ORCPT ); Tue, 5 Jul 2022 08:01:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 133F018380; Tue, 5 Jul 2022 05:01:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A6DD6616F6; Tue, 5 Jul 2022 12:01:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AB0A3C341C7; Tue, 5 Jul 2022 12:01:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022475; bh=TTtfvhXxU0uvqFIlieViAp+V/n80nhVYUfEtqlj/6Rc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BnHgxN4lHmUNwz3FZnAIP/MKUBgKLA3pvbZQPAMn8HcoGngruqQmO2LQXx+PozPWX l9b3MD8kGn1mEageS5/JZXGhZXY4VoQuTHj4A+EqVOIkGv0dVSHR7R6QUrcLuQA6fw PilcljWTOZ3bJvWIAM4HYxpS6Fvv3GyiKUNYCXdA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Heinz Mauelshagen , Mike Snitzer Subject: [PATCH 4.14 02/29] dm raid: fix accesses beyond end of raid member array Date: Tue, 5 Jul 2022 13:57:50 +0200 Message-Id: <20220705115606.410043833@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Heinz Mauelshagen commit 332bd0778775d0cf105c4b9e03e460b590749916 upstream. On dm-raid table load (using raid_ctr), dm-raid allocates an array rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks is defined by the number of raid metadata and image tupples passed into the target's constructor. In the case of RAID layout changes being requested, that number can be different from the current number of members for existing raid sets as defined in their superblocks. Example RAID layout changes include: - raid1 legs being added/removed - raid4/5/6/10 number of stripes changed (stripe reshaping) - takeover to higher raid level (e.g. raid5 -> raid6) When accessing array members, rs->raid_disks must be used in control loops instead of the potentially larger value in rs->md.raid_disks. Otherwise it will cause memory access beyond the end of the rs->devs array. Fix this by changing code that is prone to out-of-bounds access. Also fix validate_raid_redundancy() to validate all devices that are added. Also, use braces to help clean up raid_iterate_devices(). The out-of-bounds memory accesses was discovered using KASAN. This commit was verified to pass all LVM2 RAID tests (with KASAN enabled). Cc: stable@vger.kernel.org Signed-off-by: Heinz Mauelshagen Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/md/dm-raid.c | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -998,12 +998,13 @@ static int validate_region_size(struct r static int validate_raid_redundancy(struct raid_set *rs) { unsigned int i, rebuild_cnt =3D 0; - unsigned int rebuilds_per_group =3D 0, copies; + unsigned int rebuilds_per_group =3D 0, copies, raid_disks; unsigned int group_size, last_group_start; =20 - for (i =3D 0; i < rs->md.raid_disks; i++) - if (!test_bit(In_sync, &rs->dev[i].rdev.flags) || - !rs->dev[i].rdev.sb_page) + for (i =3D 0; i < rs->raid_disks; i++) + if (!test_bit(FirstUse, &rs->dev[i].rdev.flags) && + ((!test_bit(In_sync, &rs->dev[i].rdev.flags) || + !rs->dev[i].rdev.sb_page))) rebuild_cnt++; =20 switch (rs->raid_type->level) { @@ -1038,8 +1039,9 @@ static int validate_raid_redundancy(stru * A A B B C * C D D E E */ + raid_disks =3D min(rs->raid_disks, rs->md.raid_disks); if (__is_raid10_near(rs->md.new_layout)) { - for (i =3D 0; i < rs->md.raid_disks; i++) { + for (i =3D 0; i < raid_disks; i++) { if (!(i % copies)) rebuilds_per_group =3D 0; if ((!rs->dev[i].rdev.sb_page || @@ -1062,10 +1064,10 @@ static int validate_raid_redundancy(stru * results in the need to treat the last (potentially larger) * set differently. */ - group_size =3D (rs->md.raid_disks / copies); - last_group_start =3D (rs->md.raid_disks / group_size) - 1; + group_size =3D (raid_disks / copies); + last_group_start =3D (raid_disks / group_size) - 1; last_group_start *=3D group_size; - for (i =3D 0; i < rs->md.raid_disks; i++) { + for (i =3D 0; i < raid_disks; i++) { if (!(i % copies) && !(i > last_group_start)) rebuilds_per_group =3D 0; if ((!rs->dev[i].rdev.sb_page || @@ -1569,7 +1571,7 @@ static sector_t __rdev_sectors(struct ra { int i; =20 - for (i =3D 0; i < rs->md.raid_disks; i++) { + for (i =3D 0; i < rs->raid_disks; i++) { struct md_rdev *rdev =3D &rs->dev[i].rdev; =20 if (!test_bit(Journal, &rdev->flags) && @@ -3611,13 +3613,13 @@ static int raid_iterate_devices(struct d unsigned int i; int r =3D 0; =20 - for (i =3D 0; !r && i < rs->md.raid_disks; i++) - if (rs->dev[i].data_dev) - r =3D fn(ti, - rs->dev[i].data_dev, - 0, /* No offset on data devs */ - rs->md.dev_sectors, - data); + for (i =3D 0; !r && i < rs->raid_disks; i++) { + if (rs->dev[i].data_dev) { + r =3D fn(ti, rs->dev[i].data_dev, + 0, /* No offset on data devs */ + rs->md.dev_sectors, data); + } + } =20 return r; } From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF176C433EF for ; Tue, 5 Jul 2022 12:03:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233553AbiGEMDX (ORCPT ); Tue, 5 Jul 2022 08:03:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42830 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231465AbiGEMBx (ORCPT ); Tue, 5 Jul 2022 08:01:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0FB25183A2; Tue, 5 Jul 2022 05:01:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9310EB817D3; Tue, 5 Jul 2022 12:01:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E1C9EC341C7; Tue, 5 Jul 2022 12:01:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022505; bh=c6vtjDsUvTnnXR8XpyHcPF4t2AXKtHHBZEfEQCOfs4E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KlTfuwBXzT/Lswa+N1RD0F8ph0fmZ7isU6YHHcZOU5QxgT5ZkncSUra0vVUStOHap SM6XpFR/bkgUlG3fL1E8uOPtkeRoLxp9JfAJMMYI16L0tSWkHSzNcWMMyPVnaMCmNT RO1GUqEqmRECtwcHI6ymV0ib9my2W5oTfhOmFV54= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Mike Snitzer Subject: [PATCH 4.14 03/29] dm raid: fix KASAN warning in raid5_add_disks Date: Tue, 5 Jul 2022 13:57:51 +0200 Message-Id: <20220705115606.440077428@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit 617b365872a247480e9dcd50a32c8d1806b21861 upstream. There's a KASAN warning in raid5_add_disk when running the LVM testsuite. The warning happens in the test lvconvert-raid-reshape-linear_to_raid6-single-type.sh. We fix the warning by verifying that rdev->saved_raid_disk is within limits. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/md/raid5.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -7689,6 +7689,7 @@ static int raid5_add_disk(struct mddev * */ if (rdev->saved_raid_disk >=3D 0 && rdev->saved_raid_disk >=3D first && + rdev->saved_raid_disk <=3D last && conf->disks[rdev->saved_raid_disk].rdev =3D=3D NULL) first =3D rdev->saved_raid_disk; From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2AE1C433EF for ; Tue, 5 Jul 2022 12:05:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233333AbiGEMFy (ORCPT ); Tue, 5 Jul 2022 08:05:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42990 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233187AbiGEMB7 (ORCPT ); Tue, 5 Jul 2022 08:01:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8622C183AB; Tue, 5 Jul 2022 05:01:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 36B4DB817E0; Tue, 5 Jul 2022 12:01:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 933B2C341CF; Tue, 5 Jul 2022 12:01:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022507; bh=zn+oj4F3sWLH/khQA3k0ERFN8bPpUeyumgY59Fo0PEA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=stT6mZ+AVlHAJbjZx3OyV28ztLfDmoPhAXxrqhX0FhJHplGOqY7MN6nOe2rRJAHbA guQ+VR3Gf24M+m3v2PdpHptQUC16ejIKZN8qDbB1FLs01qPx0zYXGWMf9OYdNqTa6J SF1ileAvYpDv+jFc1/7rhQgD9jcjXLRSDbw39XGs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Harald Freudenberger , Ingo Franzki , Juergen Christ , Heiko Carstens , "Jason A. Donenfeld" , Alexander Gordeev Subject: [PATCH 4.14 04/29] s390/archrandom: simplify back to earlier design and initialize earlier Date: Tue, 5 Jul 2022 13:57:52 +0200 Message-Id: <20220705115606.470285882@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason A. Donenfeld commit e4f74400308cb8abde5fdc9cad609c2aba32110c upstream. s390x appears to present two RNG interfaces: - a "TRNG" that gathers entropy using some hardware function; and - a "DRBG" that takes in a seed and expands it. Previously, the TRNG was wired up to arch_get_random_{long,int}(), but it was observed that this was being called really frequently, resulting in high overhead. So it was changed to be wired up to arch_get_random_ seed_{long,int}(), which was a reasonable decision. Later on, the DRBG was then wired up to arch_get_random_{long,int}(), with a complicated buffer filling thread, to control overhead and rate. Fortunately, none of the performance issues matter much now. The RNG always attempts to use arch_get_random_seed_{long,int}() first, which means a complicated implementation of arch_get_random_{long,int}() isn't really valuable or useful to have around. And it's only used when reseeding, which means it won't hit the high throughput complications that were faced before. So this commit returns to an earlier design of just calling the TRNG in arch_get_random_seed_{long,int}(), and returning false in arch_get_ random_{long,int}(). Part of what makes the simplification possible is that the RNG now seeds itself using the TRNG at bootup. But this only works if the TRNG is detected early in boot, before random_init() is called. So this commit also causes that check to happen in setup_arch(). Cc: stable@vger.kernel.org Cc: Harald Freudenberger Cc: Ingo Franzki Cc: Juergen Christ Cc: Heiko Carstens Signed-off-by: Jason A. Donenfeld Link: https://lore.kernel.org/r/20220610222023.378448-1-Jason@zx2c4.com Reviewed-by: Harald Freudenberger Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev Signed-off-by: Jason A. Donenfeld Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/s390/crypto/arch_random.c | 20 +++----------------- arch/s390/include/asm/archrandom.h | 32 ++++++++++++++------------------ arch/s390/kernel/setup.c | 5 +++++ 3 files changed, 22 insertions(+), 35 deletions(-) --- a/arch/s390/crypto/arch_random.c +++ b/arch/s390/crypto/arch_random.c @@ -1,13 +1,9 @@ +// SPDX-License-Identifier: GPL-2.0 /* * s390 arch random implementation. * - * Copyright IBM Corp. 2017 - * Author(s): Harald Freudenberger - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License (version 2 only) - * as published by the Free Software Foundation. - * + * Copyright IBM Corp. 2017, 2020 + * Author(s): Harald Freudenberger */ =20 #include @@ -20,13 +16,3 @@ DEFINE_STATIC_KEY_FALSE(s390_arch_random =20 atomic64_t s390_arch_random_counter =3D ATOMIC64_INIT(0); EXPORT_SYMBOL(s390_arch_random_counter); - -static int __init s390_arch_random_init(void) -{ - /* check if subfunction CPACF_PRNO_TRNG is available */ - if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG)) - static_branch_enable(&s390_arch_random_available); - - return 0; -} -arch_initcall(s390_arch_random_init); --- a/arch/s390/include/asm/archrandom.h +++ b/arch/s390/include/asm/archrandom.h @@ -2,7 +2,7 @@ /* * Kernel interface for the s390 arch_random_* functions * - * Copyright IBM Corp. 2017 + * Copyright IBM Corp. 2017, 2020 * * Author: Harald Freudenberger * @@ -20,38 +20,34 @@ DECLARE_STATIC_KEY_FALSE(s390_arch_random_available); extern atomic64_t s390_arch_random_counter; =20 -static void s390_arch_random_generate(u8 *buf, unsigned int nbytes) +static inline bool __must_check arch_get_random_long(unsigned long *v) { - cpacf_trng(NULL, 0, buf, nbytes); - atomic64_add(nbytes, &s390_arch_random_counter); + return false; } =20 -static inline bool arch_get_random_long(unsigned long *v) +static inline bool __must_check arch_get_random_int(unsigned int *v) { - if (static_branch_likely(&s390_arch_random_available)) { - s390_arch_random_generate((u8 *)v, sizeof(*v)); - return true; - } return false; } =20 -static inline bool arch_get_random_int(unsigned int *v) +static inline bool __must_check arch_get_random_seed_long(unsigned long *v) { if (static_branch_likely(&s390_arch_random_available)) { - s390_arch_random_generate((u8 *)v, sizeof(*v)); + cpacf_trng(NULL, 0, (u8 *)v, sizeof(*v)); + atomic64_add(sizeof(*v), &s390_arch_random_counter); return true; } return false; } =20 -static inline bool arch_get_random_seed_long(unsigned long *v) +static inline bool __must_check arch_get_random_seed_int(unsigned int *v) { - return arch_get_random_long(v); -} - -static inline bool arch_get_random_seed_int(unsigned int *v) -{ - return arch_get_random_int(v); + if (static_branch_likely(&s390_arch_random_available)) { + cpacf_trng(NULL, 0, (u8 *)v, sizeof(*v)); + atomic64_add(sizeof(*v), &s390_arch_random_counter); + return true; + } + return false; } =20 #endif /* CONFIG_ARCH_RANDOM */ --- a/arch/s390/kernel/setup.c +++ b/arch/s390/kernel/setup.c @@ -853,6 +853,11 @@ static void __init setup_randomness(void if (stsi(vmms, 3, 2, 2) =3D=3D 0 && vmms->count) add_device_randomness(&vmms->vm, sizeof(vmms->vm[0]) * vmms->count); memblock_free((unsigned long) vmms, PAGE_SIZE); + +#ifdef CONFIG_ARCH_RANDOM + if (cpacf_query_func(CPACF_PRNO, CPACF_PRNO_TRNG)) + static_branch_enable(&s390_arch_random_available); +#endif } =20 /* From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 805FAC43334 for ; Tue, 5 Jul 2022 12:03:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233574AbiGEMD2 (ORCPT ); Tue, 5 Jul 2022 08:03:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42696 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233088AbiGEMCK (ORCPT ); Tue, 5 Jul 2022 08:02:10 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1A83D183B8; Tue, 5 Jul 2022 05:01:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 6E2C8CE1B86; Tue, 5 Jul 2022 12:01:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 598E5C341CB; Tue, 5 Jul 2022 12:01:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022510; bh=edsKe0FVOvsRAYwbS5XjA2Hdnp3PFY86vrBZUlfMG/g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uTlF/f/IEJVCGELNDUIO8cMdbqMYS/ZAX6XEMN4hwQkwl0eNAYq+WNYLSCIYPBN1H HuqnVsqXxZUbf5yPGjijnh1x01aGT9nM8zJQwdpZM7LMJPsqLmmZEAkapDPtXwh+SO X2AHTRb/vzZeri9Nb/N/7qqz+4ST6GLCEaZDO2T8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bruce Fields , Zorro Lang , Chuck Lever Subject: [PATCH 4.14 05/29] SUNRPC: Fix READ_PLUS crasher Date: Tue, 5 Jul 2022 13:57:53 +0200 Message-Id: <20220705115606.500197427@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chuck Lever commit a23dd544debcda4ee4a549ec7de59e85c3c8345c upstream. Looks like there are still cases when "space_left - frag1bytes" can legitimately exceed PAGE_SIZE. Ensure that xdr->end always remains within the current encode buffer. Reported-by: Bruce Fields Reported-by: Zorro Lang Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D216151 Fixes: 6c254bf3b637 ("SUNRPC: Fix the calculation of xdr->end in xdr_get_ne= xt_encode_buffer()") Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sunrpc/xdr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/sunrpc/xdr.c +++ b/net/sunrpc/xdr.c @@ -544,7 +544,7 @@ static __be32 *xdr_get_next_encode_buffe */ xdr->p =3D (void *)p + frag2bytes; space_left =3D xdr->buf->buflen - xdr->buf->len; - if (space_left - nbytes >=3D PAGE_SIZE) + if (space_left - frag1bytes >=3D PAGE_SIZE) xdr->end =3D (void *)p + PAGE_SIZE; else xdr->end =3D (void *)p + space_left - frag1bytes; From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5903C43334 for ; Tue, 5 Jul 2022 12:03:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233169AbiGEMDh (ORCPT ); Tue, 5 Jul 2022 08:03:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43248 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231331AbiGEMCK (ORCPT ); Tue, 5 Jul 2022 08:02:10 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 759EA1838F; Tue, 5 Jul 2022 05:01:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0F80F617B1; Tue, 5 Jul 2022 12:01:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B0D4C341C7; Tue, 5 Jul 2022 12:01:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022513; bh=BwtAlbeoYwlm276eE6Ld6ih9gWnNqn4EnaUMB9lfIBk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lza7rLsX8leUN+r3UWMYQa7wEOfZ2UrTFqCoQRw2/vKtNEnR3xutsWY8kGhUS1HNN 0O3PzAyO2maT0vN6+eoq7q/7Dg6rALgS/oXJaHPh5QLtKNLlYwxSBhj2KjrWD/f1Xg PGsGeXoU5SQ1cF7Ra4a6Aijexg0eICBz1AO9lDRg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Paolo Abeni Subject: [PATCH 4.14 06/29] net: rose: fix UAF bugs caused by timer handler Date: Tue, 5 Jul 2022 13:57:54 +0200 Message-Id: <20220705115606.530712188@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 9cc02ede696272c5271a401e4f27c262359bc2f6 upstream. There are UAF bugs in rose_heartbeat_expiry(), rose_timer_expiry() and rose_idletimer_expiry(). The root cause is that del_timer() could not stop the timer handler that is running and the refcount of sock is not managed properly. One of the UAF bugs is shown below: (thread 1) | (thread 2) | rose_bind | rose_connect | rose_start_heartbeat rose_release | (wait a time) case ROSE_STATE_0 | rose_destroy_socket | rose_heartbeat_expiry rose_stop_heartbeat | sock_put(sk) | ... sock_put(sk) // FREE | | bh_lock_sock(sk) // USE The sock is deallocated by sock_put() in rose_release() and then used by bh_lock_sock() in rose_heartbeat_expiry(). Although rose_destroy_socket() calls rose_stop_heartbeat(), it could not stop the timer that is running. The KASAN report triggered by POC is shown below: BUG: KASAN: use-after-free in _raw_spin_lock+0x5a/0x110 Write of size 4 at addr ffff88800ae59098 by task swapper/3/0 ... Call Trace: dump_stack_lvl+0xbf/0xee print_address_description+0x7b/0x440 print_report+0x101/0x230 ? irq_work_single+0xbb/0x140 ? _raw_spin_lock+0x5a/0x110 kasan_report+0xed/0x120 ? _raw_spin_lock+0x5a/0x110 kasan_check_range+0x2bd/0x2e0 _raw_spin_lock+0x5a/0x110 rose_heartbeat_expiry+0x39/0x370 ? rose_start_heartbeat+0xb0/0xb0 call_timer_fn+0x2d/0x1c0 ? rose_start_heartbeat+0xb0/0xb0 expire_timers+0x1f3/0x320 __run_timers+0x3ff/0x4d0 run_timer_softirq+0x41/0x80 __do_softirq+0x233/0x544 irq_exit_rcu+0x41/0xa0 sysvec_apic_timer_interrupt+0x8c/0xb0 asm_sysvec_apic_timer_interrupt+0x1b/0x20 RIP: 0010:default_idle+0xb/0x10 RSP: 0018:ffffc9000012fea0 EFLAGS: 00000202 RAX: 000000000000bcae RBX: ffff888006660f00 RCX: 000000000000bcae RDX: 0000000000000001 RSI: ffffffff843a11c0 RDI: ffffffff843a1180 RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffed100da36d46 R10: dfffe9100da36d47 R11: ffffffff83cf0950 R12: 0000000000000000 R13: 1ffff11000ccc1e0 R14: ffffffff8542af28 R15: dffffc0000000000 ... Allocated by task 146: __kasan_kmalloc+0xc4/0xf0 sk_prot_alloc+0xdd/0x1a0 sk_alloc+0x2d/0x4e0 rose_create+0x7b/0x330 __sock_create+0x2dd/0x640 __sys_socket+0xc7/0x270 __x64_sys_socket+0x71/0x80 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 152: kasan_set_track+0x4c/0x70 kasan_set_free_info+0x1f/0x40 ____kasan_slab_free+0x124/0x190 kfree+0xd3/0x270 __sk_destruct+0x314/0x460 rose_release+0x2fa/0x3b0 sock_close+0xcb/0x230 __fput+0x2d9/0x650 task_work_run+0xd6/0x160 exit_to_user_mode_loop+0xc7/0xd0 exit_to_user_mode_prepare+0x4e/0x80 syscall_exit_to_user_mode+0x20/0x40 do_syscall_64+0x4f/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This patch adds refcount of sock when we use functions such as rose_start_heartbeat() and so on to start timer, and decreases the refcount of sock when timer is finished or deleted by functions such as rose_stop_heartbeat() and so on. As a result, the UAF bugs could be mitigated. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou Tested-by: Duoming Zhou Link: https://lore.kernel.org/r/20220629002640.5693-1-duoming@zju.edu.cn Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/rose/rose_timer.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) --- a/net/rose/rose_timer.c +++ b/net/rose/rose_timer.c @@ -34,90 +34,90 @@ static void rose_idletimer_expiry(struct =20 void rose_start_heartbeat(struct sock *sk) { - del_timer(&sk->sk_timer); + sk_stop_timer(sk, &sk->sk_timer); =20 sk->sk_timer.data =3D (unsigned long)sk; sk->sk_timer.function =3D &rose_heartbeat_expiry; sk->sk_timer.expires =3D jiffies + 5 * HZ; =20 - add_timer(&sk->sk_timer); + sk_reset_timer(sk, &sk->sk_timer, sk->sk_timer.expires); } =20 void rose_start_t1timer(struct sock *sk) { struct rose_sock *rose =3D rose_sk(sk); =20 - del_timer(&rose->timer); + sk_stop_timer(sk, &rose->timer); =20 rose->timer.function =3D (TIMER_FUNC_TYPE)rose_timer_expiry; rose->timer.expires =3D jiffies + rose->t1; =20 - add_timer(&rose->timer); + sk_reset_timer(sk, &rose->timer, rose->timer.expires); } =20 void rose_start_t2timer(struct sock *sk) { struct rose_sock *rose =3D rose_sk(sk); =20 - del_timer(&rose->timer); + sk_stop_timer(sk, &rose->timer); =20 rose->timer.function =3D (TIMER_FUNC_TYPE)rose_timer_expiry; rose->timer.expires =3D jiffies + rose->t2; =20 - add_timer(&rose->timer); + sk_reset_timer(sk, &rose->timer, rose->timer.expires); } =20 void rose_start_t3timer(struct sock *sk) { struct rose_sock *rose =3D rose_sk(sk); =20 - del_timer(&rose->timer); + sk_stop_timer(sk, &rose->timer); =20 rose->timer.function =3D (TIMER_FUNC_TYPE)rose_timer_expiry; rose->timer.expires =3D jiffies + rose->t3; =20 - add_timer(&rose->timer); + sk_reset_timer(sk, &rose->timer, rose->timer.expires); } =20 void rose_start_hbtimer(struct sock *sk) { struct rose_sock *rose =3D rose_sk(sk); =20 - del_timer(&rose->timer); + sk_stop_timer(sk, &rose->timer); =20 rose->timer.function =3D (TIMER_FUNC_TYPE)rose_timer_expiry; rose->timer.expires =3D jiffies + rose->hb; =20 - add_timer(&rose->timer); + sk_reset_timer(sk, &rose->timer, rose->timer.expires); } =20 void rose_start_idletimer(struct sock *sk) { struct rose_sock *rose =3D rose_sk(sk); =20 - del_timer(&rose->idletimer); + sk_stop_timer(sk, &rose->timer); =20 if (rose->idle > 0) { rose->idletimer.function =3D (TIMER_FUNC_TYPE)rose_idletimer_expiry; rose->idletimer.expires =3D jiffies + rose->idle; =20 - add_timer(&rose->idletimer); + sk_reset_timer(sk, &rose->idletimer, rose->idletimer.expires); } } =20 void rose_stop_heartbeat(struct sock *sk) { - del_timer(&sk->sk_timer); + sk_stop_timer(sk, &sk->sk_timer); } =20 void rose_stop_timer(struct sock *sk) { - del_timer(&rose_sk(sk)->timer); + sk_stop_timer(sk, &rose_sk(sk)->timer); } =20 void rose_stop_idletimer(struct sock *sk) { - del_timer(&rose_sk(sk)->idletimer); + sk_stop_timer(sk, &rose_sk(sk)->idletimer); } =20 static void rose_heartbeat_expiry(unsigned long param) @@ -134,6 +134,7 @@ static void rose_heartbeat_expiry(unsign (sk->sk_state =3D=3D TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) { bh_unlock_sock(sk); rose_destroy_socket(sk); + sock_put(sk); return; } break; @@ -156,6 +157,7 @@ static void rose_heartbeat_expiry(unsign =20 rose_start_heartbeat(sk); bh_unlock_sock(sk); + sock_put(sk); } =20 static void rose_timer_expiry(struct timer_list *t) @@ -185,6 +187,7 @@ static void rose_timer_expiry(struct tim break; } bh_unlock_sock(sk); + sock_put(sk); } =20 static void rose_idletimer_expiry(struct timer_list *t) @@ -209,4 +212,5 @@ static void rose_idletimer_expiry(struct sock_set_flag(sk, SOCK_DEAD); } bh_unlock_sock(sk); + sock_put(sk); } From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAFAFC433EF for ; Tue, 5 Jul 2022 12:03:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233250AbiGEMDj (ORCPT ); Tue, 5 Jul 2022 08:03:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44060 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233203AbiGEMCL (ORCPT ); Tue, 5 Jul 2022 08:02:11 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A6574183A9; Tue, 5 Jul 2022 05:01:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 651D1B817E0; Tue, 5 Jul 2022 12:01:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CEEF3C341C7; Tue, 5 Jul 2022 12:01:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022516; bh=2SjUKnBlYMObbRagry9lnHLHmnLWtnfuV+FAe2s+P9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TLML7HH+RuQ17vjPZ6wZxXCg3+gYS998a/jU+m84rSVRZntRMA6gR3RkF/rmktE9U 1pBDgpAYJu19/el9Ro5su2CQiTGNtJIOrWB5BttLsXUfgxpYwucT+zYAweQxD9KrND nf7PdxICYO2EKe/uex9ScuiYu2BH370n5t1owEYw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jose Alonso , Paolo Abeni Subject: [PATCH 4.14 07/29] net: usb: ax88179_178a: Fix packet receiving Date: Tue, 5 Jul 2022 13:57:55 +0200 Message-Id: <20220705115606.559918641@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jose Alonso commit f8ebb3ac881b17712e1d5967c97ab1806b16d3d6 upstream. This patch corrects packet receiving in ax88179_rx_fixup. - problem observed: ifconfig shows allways a lot of 'RX Errors' while packets are received normally. This occurs because ax88179_rx_fixup does not recognise properly the usb urb received. The packets are normally processed and at the end, the code exits with 'return 0', generating RX Errors. (pkt_cnt=3D=3D-2 and ptk_hdr over field rx_hdr trying to identify another packet there) This is a usb urb received by "tcpdump -i usbmon2 -X" on a little-endian CPU: 0x0000: eeee f8e3 3b19 87a0 94de 80e3 daac 0800 ^ packet 1 start (pkt_len =3D 0x05ec) ^^^^ IP alignment pseudo header ^ ethernet packet start last byte ethernet packet v padding (8-bytes aligned) vvvv vvvv 0x05e0: c92d d444 1420 8a69 83dd 272f e82b 9811 0x05f0: eeee f8e3 3b19 87a0 94de 80e3 daac 0800 ... ^ packet 2 0x0be0: eeee f8e3 3b19 87a0 94de 80e3 daac 0800 ... 0x1130: 9d41 9171 8a38 0ec5 eeee f8e3 3b19 87a0 ... 0x1720: 8cfc 15ff 5e4c e85c eeee f8e3 3b19 87a0 ... 0x1d10: ecfa 2a3a 19ab c78c eeee f8e3 3b19 87a0 ... 0x2070: eeee f8e3 3b19 87a0 94de 80e3 daac 0800 ... ^ packet 7 0x2120: 7c88 4ca5 5c57 7dcc 0d34 7577 f778 7e0a 0x2130: f032 e093 7489 0740 3008 ec05 0000 0080 =3D=3D=3D=3D1=3D=3D=3D=3D =3D=3D=3D=3D2=3D= =3D=3D=3D hdr_off ^ pkt_len =3D 0x05ec ^^^^ AX_RXHDR_*=3D0x00830 ^^^^ ^ pkt_len =3D 0 ^^^^ AX_RXHDR_DROP_ERR=3D0x80000000 ^^^^ ^ 0x2140: 3008 ec05 0000 0080 3008 5805 0000 0080 0x2150: 3008 ec05 0000 0080 3008 ec05 0000 0080 0x2160: 3008 5803 0000 0080 3008 c800 0000 0080 =3D=3D=3D11=3D=3D=3D=3D =3D=3D=3D12=3D=3D=3D=3D =3D=3D=3D13=3D= =3D=3D=3D =3D=3D=3D14=3D=3D=3D=3D 0x2170: 0000 0000 0e00 3821 ^^^^ ^^^^ rx_hdr ^^^^ pkt_cnt=3D14 ^^^^ hdr_off=3D0x2138 ^^^^ ^^^^ padding The dump shows that pkt_cnt is the number of entrys in the per-packet metadata. It is "2 * packet count". Each packet have two entrys. The first have a valid value (pkt_len and AX_RXHDR_*) and the second have a dummy-header 0x80000000 (pkt_len=3D0 with AX_RXHDR_DROP_ERR). Why exists dummy-header for each packet?!? My guess is that this was done probably to align the entry for each packet to 64-bits and maintain compatibility with old firmware. There is also a padding (0x00000000) before the rx_hdr to align the end of rx_hdr to 64-bit. Note that packets have a alignment of 64-bits (8-bytes). This patch assumes that the dummy-header and the last padding are optional. So it preserves semantics and recognises the same valid packets as the current code. This patch was made using only the dumpfile information and tested with only one device: 0b95:1790 ASIX Electronics Corp. AX88179 Gigabit Ethernet Fixes: 57bc3d3ae8c1 ("net: usb: ax88179_178a: Fix out-of-bounds accesses in= RX fixup") Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabi= t ethernet adapter driver") Signed-off-by: Jose Alonso Acked-by: Paolo Abeni Link: https://lore.kernel.org/r/d6970bb04bf67598af4d316eaeb1792040b18cfd.ca= mel@gmail.com Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/usb/ax88179_178a.c | 101 ++++++++++++++++++++++++++++++------= ----- 1 file changed, 76 insertions(+), 25 deletions(-) --- a/drivers/net/usb/ax88179_178a.c +++ b/drivers/net/usb/ax88179_178a.c @@ -1377,6 +1377,42 @@ static int ax88179_rx_fixup(struct usbne * are bundled into this buffer and where we can find an array of * per-packet metadata (which contains elements encoded into u16). */ + + /* SKB contents for current firmware: + * + * ... + * + * + * ... + * + * + * + * where: + * contains pkt_len bytes: + * 2 bytes of IP alignment pseudo header + * packet received + * contains 4 bytes: + * pkt_len and fields AX_RXHDR_* + * 0-7 bytes to terminate at + * 8 bytes boundary (64-bit). + * 4 bytes to make rx_hdr terminate at + * 8 bytes boundary (64-bit) + * contains 4 bytes: + * pkt_len=3D0 and AX_RXHDR_DROP_ERR + * contains 4 bytes: + * pkt_cnt and hdr_off (offset of + * ) + * + * pkt_cnt is number of entrys in the per-packet metadata. + * In current firmware there is 2 entrys per packet. + * The first points to the packet and the + * second is a dummy header. + * This was done probably to align fields in 64-bit and + * maintain compatibility with old firmware. + * This code assumes that and are + * optional. + */ + if (skb->len < 4) return 0; skb_trim(skb, skb->len - 4); @@ -1391,51 +1427,66 @@ static int ax88179_rx_fixup(struct usbne /* Make sure that the bounds of the metadata array are inside the SKB * (and in front of the counter at the end). */ - if (pkt_cnt * 2 + hdr_off > skb->len) + if (pkt_cnt * 4 + hdr_off > skb->len) return 0; pkt_hdr =3D (u32 *)(skb->data + hdr_off); =20 /* Packets must not overlap the metadata array */ skb_trim(skb, hdr_off); =20 - for (; ; pkt_cnt--, pkt_hdr++) { + for (; pkt_cnt > 0; pkt_cnt--, pkt_hdr++) { + u16 pkt_len_plus_padd; u16 pkt_len; =20 le32_to_cpus(pkt_hdr); pkt_len =3D (*pkt_hdr >> 16) & 0x1fff; + pkt_len_plus_padd =3D (pkt_len + 7) & 0xfff8; =20 - if (pkt_len > skb->len) + /* Skip dummy header used for alignment + */ + if (pkt_len =3D=3D 0) + continue; + + if (pkt_len_plus_padd > skb->len) return 0; =20 /* Check CRC or runt packet */ - if (((*pkt_hdr & (AX_RXHDR_CRC_ERR | AX_RXHDR_DROP_ERR)) =3D=3D 0) && - pkt_len >=3D 2 + ETH_HLEN) { - bool last =3D (pkt_cnt =3D=3D 0); - - if (last) { - ax_skb =3D skb; - } else { - ax_skb =3D skb_clone(skb, GFP_ATOMIC); - if (!ax_skb) - return 0; - } - ax_skb->len =3D pkt_len; - /* Skip IP alignment pseudo header */ - skb_pull(ax_skb, 2); - skb_set_tail_pointer(ax_skb, ax_skb->len); - ax_skb->truesize =3D pkt_len + sizeof(struct sk_buff); - ax88179_rx_checksum(ax_skb, pkt_hdr); + if ((*pkt_hdr & (AX_RXHDR_CRC_ERR | AX_RXHDR_DROP_ERR)) || + pkt_len < 2 + ETH_HLEN) { + dev->net->stats.rx_errors++; + skb_pull(skb, pkt_len_plus_padd); + continue; + } =20 - if (last) - return 1; + /* last packet */ + if (pkt_len_plus_padd =3D=3D skb->len) { + skb_trim(skb, pkt_len); =20 - usbnet_skb_return(dev, ax_skb); + /* Skip IP alignment pseudo header */ + skb_pull(skb, 2); + + skb->truesize =3D SKB_TRUESIZE(pkt_len_plus_padd); + ax88179_rx_checksum(skb, pkt_hdr); + return 1; } =20 - /* Trim this packet away from the SKB */ - if (!skb_pull(skb, (pkt_len + 7) & 0xFFF8)) + ax_skb =3D skb_clone(skb, GFP_ATOMIC); + if (!ax_skb) return 0; + skb_trim(ax_skb, pkt_len); + + /* Skip IP alignment pseudo header */ + skb_pull(ax_skb, 2); + + skb->truesize =3D pkt_len_plus_padd + + SKB_DATA_ALIGN(sizeof(struct sk_buff)); + ax88179_rx_checksum(ax_skb, pkt_hdr); + usbnet_skb_return(dev, ax_skb); + + skb_pull(skb, pkt_len_plus_padd); } + + return 0; } =20 static struct sk_buff * From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26FDBC433EF for ; Tue, 5 Jul 2022 12:03:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233627AbiGEMDn (ORCPT ); Tue, 5 Jul 2022 08:03:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42708 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233248AbiGEMCY (ORCPT ); Tue, 5 Jul 2022 08:02:24 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6479417E2A; Tue, 5 Jul 2022 05:02:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2984DB817E0; Tue, 5 Jul 2022 12:02:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 96034C341CF; Tue, 5 Jul 2022 12:01:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022519; bh=y3quOylrbNrftdgb0x+MhHAOK2UQdoFHebEVwFbie38=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kIxztMts7qrz/Gj4YKiQd7pBwGhrjyCU82lZx3VdyVcGqA1CBvWkUoWqKcp7FhBsT 9wAZkwF++vvryTwWah94krsIihQcsq3op0HKbl7oD2C0lZWOkkLYexqbclNf029Hma HHpPFph6G84T6AK1h/bhI41dy12LxVK257IYRUmQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kamal Heib , =?UTF-8?q?Michal=20Kalderon=C2=A0?= , Leon Romanovsky Subject: [PATCH 4.14 08/29] RDMA/qedr: Fix reporting QP timeout attribute Date: Tue, 5 Jul 2022 13:57:56 +0200 Message-Id: <20220705115606.588895217@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Kamal Heib commit 118f767413ada4eef7825fbd4af7c0866f883441 upstream. Make sure to save the passed QP timeout attribute when the QP gets modified, so when calling query QP the right value is reported and not the converted value that is required by the firmware. This issue was found while running the pyverbs tests. Fixes: cecbcddf6461 ("qedr: Add support for QP verbs") Link: https://lore.kernel.org/r/20220525132029.84813-1-kamalheib1@gmail.com Signed-off-by: Kamal Heib Acked-by: Michal Kalderon=C2=A0 Signed-off-by: Leon Romanovsky Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/infiniband/hw/qedr/qedr.h | 1 + drivers/infiniband/hw/qedr/verbs.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) --- a/drivers/infiniband/hw/qedr/qedr.h +++ b/drivers/infiniband/hw/qedr/qedr.h @@ -361,6 +361,7 @@ struct qedr_qp { u32 sq_psn; u32 qkey; u32 dest_qp_num; + u8 timeout; =20 /* Relevant to qps created from kernel space only (ULPs) */ u8 prev_wqe_size; --- a/drivers/infiniband/hw/qedr/verbs.c +++ b/drivers/infiniband/hw/qedr/verbs.c @@ -1921,6 +1921,8 @@ int qedr_modify_qp(struct ib_qp *ibqp, s 1 << max_t(int, attr->timeout - 8, 0); else qp_params.ack_timeout =3D 0; + + qp->timeout =3D attr->timeout; } =20 if (attr_mask & IB_QP_RETRY_CNT) { @@ -2080,7 +2082,7 @@ int qedr_query_qp(struct ib_qp *ibqp, rdma_ah_set_dgid_raw(&qp_attr->ah_attr, ¶ms.dgid.bytes[0]); rdma_ah_set_port_num(&qp_attr->ah_attr, 1); rdma_ah_set_sl(&qp_attr->ah_attr, 0); - qp_attr->timeout =3D params.timeout; + qp_attr->timeout =3D qp->timeout; qp_attr->rnr_retry =3D params.rnr_retry; qp_attr->retry_cnt =3D params.retry_cnt; qp_attr->min_rnr_timer =3D params.min_rnr_nak_timer; From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10064C43334 for ; Tue, 5 Jul 2022 12:03:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233678AbiGEMD5 (ORCPT ); Tue, 5 Jul 2022 08:03:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43384 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233253AbiGEMC0 (ORCPT ); Tue, 5 Jul 2022 08:02:26 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D3934183B4; Tue, 5 Jul 2022 05:02:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 486E3CE1B86; Tue, 5 Jul 2022 12:02:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 46E11C341C7; Tue, 5 Jul 2022 12:02:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022521; bh=vL0arXI7ti0jT6m6fv3+MgrGNiDpDyse8ySN/98+12c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yimnsKX5kppxsWYh4gYCCQpc4No4Yqa/Mv/IcY0x/PjVnoRi1/qlQvyfj/+Sn0r+h UMpS8Ho0MlzVK73YWAxa0SUEixHpEsPu9jfIjOcW81NnXBlEv74T355S+ouritiIIW pSWOCUBb/kcsSTL9sB8/6R/JkAC4IGbSadLJFQeE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , Jakub Kicinski Subject: [PATCH 4.14 09/29] usbnet: fix memory allocation in helpers Date: Tue, 5 Jul 2022 13:57:57 +0200 Message-Id: <20220705115606.618114319@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Neukum commit e65af5403e462ccd7dff6a045a886c64da598c2e upstream. usbnet provides some helper functions that are also used in the context of reset() operations. During a reset the other drivers on a device are unable to operate. As that can be block drivers, a driver for another interface cannot use paging in its memory allocations without risking a deadlock. Use GFP_NOIO in the helpers. Fixes: 877bd862f32b8 ("usbnet: introduce usbnet 3 command helpers") Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20220628093517.7469-1-oneukum@suse.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/usb/usbnet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -2002,7 +2002,7 @@ static int __usbnet_read_cmd(struct usbn cmd, reqtype, value, index, size); =20 if (size) { - buf =3D kmalloc(size, GFP_KERNEL); + buf =3D kmalloc(size, GFP_NOIO); if (!buf) goto out; } @@ -2034,7 +2034,7 @@ static int __usbnet_write_cmd(struct usb cmd, reqtype, value, index, size); =20 if (data) { - buf =3D kmemdup(data, size, GFP_KERNEL); + buf =3D kmemdup(data, size, GFP_NOIO); if (!buf) goto out; } else { From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E15CEC43334 for ; Tue, 5 Jul 2022 12:01:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233163AbiGEMBn (ORCPT ); Tue, 5 Jul 2022 08:01:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42696 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232999AbiGEMAs (ORCPT ); Tue, 5 Jul 2022 08:00:48 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3427318376; Tue, 5 Jul 2022 05:00:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C6527617B9; Tue, 5 Jul 2022 12:00:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D4AA5C341C7; Tue, 5 Jul 2022 12:00:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022447; bh=onAYcPnbBE6j4IvOJKB4XBG4btFllbiMF11hZ6/oNsw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J9gr7FLBgtp+RpopTzRhDfRQaLRq1v4RUsFsUl6lpbA5c/c0esqWu4Ts7mtLW0EwV H11rLyBHOT7mBOAPZ32eoX4SXvedvUTf/kP9DQU3xTsQm1c4uhc0ROd960cU4Ielmx QjqY3Q6kuJeCjUCUoQiVoH+wvmlAocvFREPQic18= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , YueHaibing , Jakub Kicinski Subject: [PATCH 4.14 10/29] net: ipv6: unexport __init-annotated seg6_hmac_net_init() Date: Tue, 5 Jul 2022 13:57:58 +0200 Message-Id: <20220705115606.647493871@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: YueHaibing commit 53ad46169fe2996fe1b623ba6c9c4fa33847876f upstream. As of commit 5801f064e351 ("net: ipv6: unexport __init-annotated seg6_hmac_= init()"), EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. This remove the EXPORT_SYMBOL to fix modpost warning: WARNING: modpost: vmlinux.o(___ksymtab+seg6_hmac_net_init+0x0): Section mis= match in reference from the variable __ksymtab_seg6_hmac_net_init to the fu= nction .init.text:seg6_hmac_net_init() The symbol seg6_hmac_net_init is exported and annotated __init Fix this by removing the __init annotation of seg6_hmac_net_init or drop th= e export. Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support") Reported-by: Hulk Robot Signed-off-by: YueHaibing Link: https://lore.kernel.org/r/20220628033134.21088-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv6/seg6_hmac.c | 1 - 1 file changed, 1 deletion(-) --- a/net/ipv6/seg6_hmac.c +++ b/net/ipv6/seg6_hmac.c @@ -414,7 +414,6 @@ int __net_init seg6_hmac_net_init(struct =20 return 0; } -EXPORT_SYMBOL(seg6_hmac_net_init); =20 void seg6_hmac_exit(void) { From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC824CCA47B for ; Tue, 5 Jul 2022 12:01:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230248AbiGEMBr (ORCPT ); Tue, 5 Jul 2022 08:01:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42224 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232906AbiGEMAx (ORCPT ); Tue, 5 Jul 2022 08:00:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9B9421582A; Tue, 5 Jul 2022 05:00:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 43818B817D6; Tue, 5 Jul 2022 12:00:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 94A57C341C7; Tue, 5 Jul 2022 12:00:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022450; bh=v40g/hBBeQmr4W1jpD2WWBoeCsbWUBpQuUMf2B4Nk+o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=w/MvqmlVg21K862aYaNaM7oCo1AKs0XPifoAulMSIf3EFGUQrBXdephxWByfCIT+A srvDo/WLNTs3lKsueqV0Vds+lj5Y6BQ2oQreTDiBJlu+sS+svLKFtoG692y42GkpNc 0DKKJ6EeShr1OEUnOD/aP9cHiQpzsU9S5lY+YmYg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jason Wang , "Michael S. Tsirkin" Subject: [PATCH 4.14 11/29] caif_virtio: fix race between virtio_device_ready() and ndo_open() Date: Tue, 5 Jul 2022 13:57:59 +0200 Message-Id: <20220705115606.676585095@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason Wang commit 11a37eb66812ce6a06b79223ad530eb0e1d7294d upstream. We currently depend on probe() calling virtio_device_ready() - which happens after netdev registration. Since ndo_open() can be called immediately after register_netdev, this means there exists a race between ndo_open() and virtio_device_ready(): the driver may start to use the device (e.g. TX) before DRIVER_OK which violates the spec. Fix this by switching to use register_netdevice() and protect the virtio_device_ready() with rtnl_lock() to make sure ndo_open() can only be called after virtio_device_ready(). Fixes: 0d2e1a2926b18 ("caif_virtio: Introduce caif over virtio") Signed-off-by: Jason Wang Message-Id: <20220620051115.3142-3-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/caif/caif_virtio.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) --- a/drivers/net/caif/caif_virtio.c +++ b/drivers/net/caif/caif_virtio.c @@ -727,13 +727,21 @@ static int cfv_probe(struct virtio_devic /* Carrier is off until netdevice is opened */ netif_carrier_off(netdev); =20 + /* serialize netdev register + virtio_device_ready() with ndo_open() */ + rtnl_lock(); + /* register Netdev */ - err =3D register_netdev(netdev); + err =3D register_netdevice(netdev); if (err) { + rtnl_unlock(); dev_err(&vdev->dev, "Unable to register netdev (%d)\n", err); goto err; } =20 + virtio_device_ready(vdev); + + rtnl_unlock(); + debugfs_init(cfv); =20 return 0; From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8EB47C43334 for ; Tue, 5 Jul 2022 12:01:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233178AbiGEMBs (ORCPT ); Tue, 5 Jul 2022 08:01:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43386 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232882AbiGEMAy (ORCPT ); Tue, 5 Jul 2022 08:00:54 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C277718343; Tue, 5 Jul 2022 05:00:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5C20B617DB; Tue, 5 Jul 2022 12:00:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 68778C341C7; Tue, 5 Jul 2022 12:00:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022452; bh=Fjz4FNY8X9b8x9Bgqc8fzqlaOfq4GfGD4PoiPWMxbug=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vpfC2e6iq6ESR42alnR/8O/v5oMOle3xJLMw6Qj11aghcHbPL8epm4zZRipIWiNxt j82nRyHeMgnwieQkBoQ6QYUx5QIpuQT3IXjQLLqlO2wej/XJWINRf5Tjqo9Jl/qvIa CtcvHE2e9GZUDaysByh879Ezw355FMtJEs+Lxe8o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pablo Neira Ayuso Subject: [PATCH 4.14 12/29] netfilter: nft_dynset: restore set element counter when failing to update Date: Tue, 5 Jul 2022 13:58:00 +0200 Message-Id: <20220705115606.706201363@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pablo Neira Ayuso commit 05907f10e235680cc7fb196810e4ad3215d5e648 upstream. This patch fixes a race condition. nft_rhash_update() might fail for two reasons: - Element already exists in the hashtable. - Another packet won race to insert an entry in the hashtable. In both cases, new() has already bumped the counter via atomic_add_unless(), therefore, decrement the set element counter. Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set upd= ates") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/netfilter/nft_set_hash.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/netfilter/nft_set_hash.c +++ b/net/netfilter/nft_set_hash.c @@ -127,6 +127,7 @@ static bool nft_rhash_update(struct nft_ /* Another cpu may race to insert the element with the same key */ if (prev) { nft_set_elem_destroy(set, he, true); + atomic_dec(&set->nelems); he =3D prev; } =20 @@ -136,6 +137,7 @@ out: =20 err2: nft_set_elem_destroy(set, he, true); + atomic_dec(&set->nelems); err1: return false; } From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9EF6C43334 for ; Tue, 5 Jul 2022 12:01:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230461AbiGEMBy (ORCPT ); Tue, 5 Jul 2022 08:01:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42240 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232806AbiGEMBA (ORCPT ); Tue, 5 Jul 2022 08:01:00 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DB8DF17AA4; Tue, 5 Jul 2022 05:00:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id ED38BB817D2; Tue, 5 Jul 2022 12:00:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3AB53C341CB; Tue, 5 Jul 2022 12:00:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022455; bh=natjzoNVuok8jL2tlZZK9EuInynrUlEN/QD++tPtf+0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e3BCbzmCy+c7jxxkQ2EzaTMhmh7Ei3Ip+qWnsBAM/jIRhCtLo/aa94FWgdG3D3DQ7 Q0FSbZh5J1gwSIiMKBu50FDHPkMOb9gbs6RYI5T1TmRZGPKFNNKpgyxU3WnIMP3D9C f3xJZflHGeY9C0V2Vcg9Bj0/eJwXVI9vTJFkNE0E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Eric Dumazet , Jay Vosburgh , Veaceslav Falico , Andy Gospodarek , Jay Vosburgh , Paolo Abeni Subject: [PATCH 4.14 13/29] net: bonding: fix possible NULL deref in rlb code Date: Tue, 5 Jul 2022 13:58:01 +0200 Message-Id: <20220705115606.735975551@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit ab84db251c04d38b8dc7ee86e13d4050bedb1c88 upstream. syzbot has two reports involving the same root cause. bond_alb_initialize() must not set bond->alb_info.rlb_enabled if a memory allocation error is detected. Report 1: general protection fault, probably for non-canonical address 0xdffffc000000= 0002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 PID: 12276 Comm: kworker/u4:10 Not tainted 5.19.0-rc3-syzkaller-0013= 2-g3b89b511ea0c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:rlb_clear_slave+0x10e/0x690 drivers/net/bonding/bond_alb.c:393 Code: 8e fc 83 fb ff 0f 84 74 02 00 00 e8 cc 2a 8e fc 48 8b 44 24 08 89 dd = 48 c1 e5 06 4c 8d 34 28 49 8d 7e 14 48 89 f8 48 c1 e8 03 <42> 0f b6 14 20 4= 8 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 RSP: 0018:ffffc90018a8f678 EFLAGS: 00010203 RAX: 0000000000000002 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88803375bb00 RSI: ffffffff84ec4ac4 RDI: 0000000000000014 RBP: 0000000000000000 R08: 0000000000000005 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff8880ac889000 R14: 0000000000000000 R15: ffff88815a668c80 FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005597077e10b0 CR3: 0000000026668000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bond_alb_deinit_slave+0x43c/0x6b0 drivers/net/bonding/bond_alb.c:1663 __bond_release_one.cold+0x383/0xd53 drivers/net/bonding/bond_main.c:2370 bond_slave_netdev_event drivers/net/bonding/bond_main.c:3778 [inline] bond_netdev_event+0x993/0xad0 drivers/net/bonding/bond_main.c:3889 notifier_call_chain+0xb5/0x200 kernel/notifier.c:87 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] unregister_netdevice_many+0x948/0x18b0 net/core/dev.c:10839 default_device_exit_batch+0x449/0x590 net/core/dev.c:11333 ops_exit_list+0x125/0x170 net/core/net_namespace.c:167 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 Report 2: general protection fault, probably for non-canonical address 0xdffffc000000= 0006: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 1 PID: 5206 Comm: syz-executor.1 Not tainted 5.18.0-syzkaller-12108-g5= 8f9d52ff689 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 01/01/2011 RIP: 0010:rlb_req_update_slave_clients+0x109/0x2f0 drivers/net/bonding/bond= _alb.c:502 Code: 5d 18 8f fc 41 80 3e 00 0f 85 a5 01 00 00 89 d8 48 c1 e0 06 49 03 84 = 24 68 01 00 00 48 8d 78 30 49 89 c7 48 89 fa 48 c1 ea 03 <80> 3c 2a 00 0f 8= 5 98 01 00 00 4d 39 6f 30 75 83 e8 22 18 8f fc 49 RSP: 0018:ffffc9000300ee80 EFLAGS: 00010206 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90016c11000 RDX: 0000000000000006 RSI: ffffffff84eb6bf3 RDI: 0000000000000030 RBP: dffffc0000000000 R08: 0000000000000005 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000000 R12: ffff888027c80c80 R13: ffff88807d7ff800 R14: ffffed1004f901bd R15: 0000000000000000 FS: 00007f6f46c58700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020010000 CR3: 00000000516cc000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: alb_fasten_mac_swap+0x886/0xa80 drivers/net/bonding/bond_alb.c:1070 bond_alb_handle_active_change+0x624/0x1050 drivers/net/bonding/bond_alb.c:= 1765 bond_change_active_slave+0xfa1/0x29b0 drivers/net/bonding/bond_main.c:1173 bond_select_active_slave+0x23f/0xa50 drivers/net/bonding/bond_main.c:1253 bond_enslave+0x3b34/0x53b0 drivers/net/bonding/bond_main.c:2159 do_set_master+0x1c8/0x220 net/core/rtnetlink.c:2577 rtnl_newlink_create net/core/rtnetlink.c:3380 [inline] __rtnl_newlink+0x13ac/0x17e0 net/core/rtnetlink.c:3580 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3593 rtnetlink_rcv_msg+0x43a/0xc90 net/core/rtnetlink.c:6089 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492 ___sys_sendmsg+0xf3/0x170 net/socket.c:2546 __sys_sendmsg net/socket.c:2575 [inline] __do_sys_sendmsg net/socket.c:2584 [inline] __se_sys_sendmsg net/socket.c:2582 [inline] __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f6f45a89109 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6f46c58168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f6f45b9c030 RCX: 00007f6f45a89109 RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000006 RBP: 00007f6f45ae308d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffed99029af R14: 00007f6f46c58300 R15: 0000000000022000 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Jay Vosburgh Cc: Veaceslav Falico Cc: Andy Gospodarek Acked-by: Jay Vosburgh Link: https://lore.kernel.org/r/20220627102813.126264-1-edumazet@google.com Signed-off-by: Paolo Abeni Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/bonding/bond_alb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -1296,12 +1296,12 @@ int bond_alb_initialize(struct bonding * return res; =20 if (rlb_enabled) { - bond->alb_info.rlb_enabled =3D 1; res =3D rlb_initialize(bond); if (res) { tlb_deinitialize(bond); return res; } + bond->alb_info.rlb_enabled =3D 1; } else { bond->alb_info.rlb_enabled =3D 0; } From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 575D3C433EF for ; Tue, 5 Jul 2022 12:01:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232925AbiGEMB4 (ORCPT ); Tue, 5 Jul 2022 08:01:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43592 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231642AbiGEMBB (ORCPT ); Tue, 5 Jul 2022 08:01:01 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F02D218342; Tue, 5 Jul 2022 05:01:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A9D89B817DA; Tue, 5 Jul 2022 12:00:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 062A3C341C7; Tue, 5 Jul 2022 12:00:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022458; bh=b6w3Tl/YDZM1RVBwx6PWhyX1ZlZFKFIlHJHoiiJxQdM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NfdTFxrbkL9Y5e5CNUJUJcOQCqotOgHaaOwcKyxrnAVMSvGzcUmPgnGeHaGTDrTJ5 gg/tqGCeLWSgY8cuB+Gjaca0+eKinXAQ3C5EbZA7St9w2ulRXiygkYWwAfCKLscpxW kf0ep1Z4MqTJqhmPRRrolmVCcMxm9uDrH4J9+A6A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maksym Glubokiy , Yevhen Orlov , Jay Vosburgh , Jakub Kicinski Subject: [PATCH 4.14 14/29] net: bonding: fix use-after-free after 802.3ad slave unbind Date: Tue, 5 Jul 2022 13:58:02 +0200 Message-Id: <20220705115606.765435902@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yevhen Orlov commit 050133e1aa2cb49bb17be847d48a4431598ef562 upstream. commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), resolve case, when there is several aggregation groups in the same bond. bond_3ad_unbind_slave will invalidate (clear) aggregator when __agg_active_ports return zero. So, ad_clear_agg can be executed even, when num_of_ports!=3D0. Than bond_3ad_unbind_slave can be executed again for, previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave will not update slave ports list, because lag_ports=3D=3DNULL. So, here we got slave ports, pointing to freed aggregator memory. Fix with checking actual number of ports in group (as was before commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ), before ad_clear_agg(). The KASAN logs are as follows: [ 767.617392] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler= +0x13dc/0x1470 [ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7= /767 [ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.= 15.11 #15 [ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) [ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler [ 767.666468] Call trace: [ 767.668930] dump_backtrace+0x0/0x2d0 [ 767.672625] show_stack+0x24/0x30 [ 767.675965] dump_stack_lvl+0x68/0x84 [ 767.679659] print_address_description.constprop.0+0x74/0x2b8 [ 767.685451] kasan_report+0x1f0/0x260 [ 767.689148] __asan_load2+0x94/0xd0 [ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470 Fixes: 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") Co-developed-by: Maksym Glubokiy Signed-off-by: Maksym Glubokiy Signed-off-by: Yevhen Orlov Acked-by: Jay Vosburgh Link: https://lore.kernel.org/r/20220629012914.361-1-yevhen.orlov@plvision.= eu Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/bonding/bond_3ad.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/bonding/bond_3ad.c +++ b/drivers/net/bonding/bond_3ad.c @@ -2199,7 +2199,8 @@ void bond_3ad_unbind_slave(struct slave temp_aggregator->num_of_ports--; if (__agg_active_ports(temp_aggregator) =3D=3D 0) { select_new_active_agg =3D temp_aggregator->is_active; - ad_clear_agg(temp_aggregator); + if (temp_aggregator->num_of_ports =3D=3D 0) + ad_clear_agg(temp_aggregator); if (select_new_active_agg) { netdev_info(bond->dev, "Removing an active aggregator\n"); /* select new active aggregator */ From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07246C43334 for ; Tue, 5 Jul 2022 12:02:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233189AbiGEMCA (ORCPT ); Tue, 5 Jul 2022 08:02:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43680 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231303AbiGEMBF (ORCPT ); Tue, 5 Jul 2022 08:01:05 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A741018385; Tue, 5 Jul 2022 05:01:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5BC73B817D2; Tue, 5 Jul 2022 12:01:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B1B0FC341C7; Tue, 5 Jul 2022 12:01:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022461; bh=eWhg2Htyke+OsaZs7/m9A1zorj1Ngbbnj7Lp253PPtg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tF6otWVo2qTraYsPiw5Y1bOj41hPgucT30uGk6fAgI5qwGnPYTz0bVIqmDEqSA6zy YVFS9SFrfMHbH991LPdDPdGXsR8gTGGMCI25L0HVTcQ2tUwOW+nhL7ly9Ukj1MP+GF C44Va3LINguzyQh9GGsUYjOwIAhoYpe5APuRSvVU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lv Ruyi , Krzysztof Kozlowski , Jakub Kicinski Subject: [PATCH 4.14 15/29] nfc: nfcmrvl: Fix irq_of_parse_and_map() return value Date: Tue, 5 Jul 2022 13:58:03 +0200 Message-Id: <20220705115606.793844092@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski commit 5a478a653b4cca148d5c89832f007ec0809d7e6d upstream. The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO. Reported-by: Lv Ruyi Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220627124048.296253-1-krzysztof.kozlowski= @linaro.org Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/nfc/nfcmrvl/i2c.c | 6 +++--- drivers/nfc/nfcmrvl/spi.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) --- a/drivers/nfc/nfcmrvl/i2c.c +++ b/drivers/nfc/nfcmrvl/i2c.c @@ -186,9 +186,9 @@ static int nfcmrvl_i2c_parse_dt(struct d pdata->irq_polarity =3D IRQF_TRIGGER_RISING; =20 ret =3D irq_of_parse_and_map(node, 0); - if (ret < 0) { - pr_err("Unable to get irq, error: %d\n", ret); - return ret; + if (!ret) { + pr_err("Unable to get irq\n"); + return -EINVAL; } pdata->irq =3D ret; =20 --- a/drivers/nfc/nfcmrvl/spi.c +++ b/drivers/nfc/nfcmrvl/spi.c @@ -129,9 +129,9 @@ static int nfcmrvl_spi_parse_dt(struct d } =20 ret =3D irq_of_parse_and_map(node, 0); - if (ret < 0) { - pr_err("Unable to get irq, error: %d\n", ret); - return ret; + if (!ret) { + pr_err("Unable to get irq\n"); + return -EINVAL; } pdata->irq =3D ret; From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52284C43334 for ; Tue, 5 Jul 2022 12:02:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231974AbiGEMCD (ORCPT ); Tue, 5 Jul 2022 08:02:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42830 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233082AbiGEMBJ (ORCPT ); Tue, 5 Jul 2022 08:01:09 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7D6771838D; Tue, 5 Jul 2022 05:01:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2B4F9B817D2; Tue, 5 Jul 2022 12:01:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 787B2C341C7; Tue, 5 Jul 2022 12:01:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022463; bh=IXuzRz5oVHoJYP8Vq7RjV2ZsHhZp2usTsI+g98gYu2w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nz7i5XhjmItYXK8WOFzgitnAeA1YIr72yaJHgnh7BBu7ZJ+axa/Bebu76REQtde/w O6FjYEa+2+b8Rd0rnjOMDcdIqPVWjRrhc1pE7eUhJCG3QlIJ151KHela5SYXi444dj x1Wq3XQ2kKGAz3otrYo7NQoWdqDFrdKduC0JfjgQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Walle , Krzysztof Kozlowski , "David S. Miller" Subject: [PATCH 4.14 16/29] NFC: nxp-nci: Dont issue a zero length i2c_master_read() Date: Tue, 5 Jul 2022 13:58:04 +0200 Message-Id: <20220705115606.823891248@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Walle commit eddd95b9423946aaacb55cac6a9b2cea8ab944fc upstream. There are packets which doesn't have a payload. In that case, the second i2c_master_read() will have a zero length. But because the NFC controller doesn't have any data left, it will NACK the I2C read and -ENXIO will be returned. In case there is no payload, just skip the second i2c master read. Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver") Signed-off-by: Michael Walle Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/nfc/nxp-nci/i2c.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/nfc/nxp-nci/i2c.c +++ b/drivers/nfc/nxp-nci/i2c.c @@ -178,6 +178,9 @@ static int nxp_nci_i2c_nci_read(struct n =20 skb_put_data(*skb, (void *)&header, NCI_CTRL_HDR_SIZE); =20 + if (!header.plen) + return 0; + r =3D i2c_master_recv(client, skb_put(*skb, header.plen), header.plen); if (r !=3D header.plen) { nfc_err(&client->dev, From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00D3FC43334 for ; Tue, 5 Jul 2022 12:02:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230316AbiGEMCJ (ORCPT ); Tue, 5 Jul 2022 08:02:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43756 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233088AbiGEMBJ (ORCPT ); Tue, 5 Jul 2022 08:01:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BDD401838F; Tue, 5 Jul 2022 05:01:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 48EA4617C5; Tue, 5 Jul 2022 12:01:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 51834C341C7; Tue, 5 Jul 2022 12:01:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022466; bh=G17Et2axdl1SkTvxsFPUv1B+tJ6c7xh7vmVbR06lRwU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DYWXoBBOum8b72nlba3kLl1JUCLPiySCV3IGqGkNsoqc36pNdp7aEjfzEnXhEZn/g Kt5dXw7S7bsgHYFnr9DE8VE1BPIhrouVMbywIi36m77K9Tt7g/1ik8msDm0HARlmY+ FDg1vBtWWHK33ZQemly8oGi/9qx3jwvDr/okSBRE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Demi Marie Obenour , Juergen Gross Subject: [PATCH 4.14 17/29] xen/gntdev: Avoid blocking in unmap_grant_pages() Date: Tue, 5 Jul 2022 13:58:05 +0200 Message-Id: <20220705115606.853154191@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Demi Marie Obenour commit dbe97cff7dd9f0f75c524afdd55ad46be3d15295 upstream. unmap_grant_pages() currently waits for the pages to no longer be used. In https://github.com/QubesOS/qubes-issues/issues/7481, this lead to a deadlock against i915: i915 was waiting for gntdev's MMU notifier to finish, while gntdev was waiting for i915 to free its pages. I also believe this is responsible for various deadlocks I have experienced in the past. Avoid these problems by making unmap_grant_pages async. This requires making it return void, as any errors will not be available when the function returns. Fortunately, the only use of the return value is a WARN_ON(), which can be replaced by a WARN_ON when the error is detected. Additionally, a failed call will not prevent further calls from being made, but this is harmless. Because unmap_grant_pages is now async, the grant handle will be sent to INVALID_GRANT_HANDLE too late to prevent multiple unmaps of the same handle. Instead, a separate bool array is allocated for this purpose. This wastes memory, but stuffing this information in padding bytes is too fragile. Furthermore, it is necessary to grab a reference to the map before making the asynchronous call, and release the reference when the call returns. It is also necessary to guard against reentrancy in gntdev_map_put(), and to handle the case where userspace tries to map a mapping whose contents have not all been freed yet. Fixes: 745282256c75 ("xen/gntdev: safely unmap grants in case they are stil= l in use") Cc: stable@vger.kernel.org Signed-off-by: Demi Marie Obenour Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220622022726.2538-1-demi@invisiblethingsl= ab.com Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/xen/gntdev.c | 145 ++++++++++++++++++++++++++++++++++++----------= ----- 1 file changed, 103 insertions(+), 42 deletions(-) --- a/drivers/xen/gntdev.c +++ b/drivers/xen/gntdev.c @@ -59,6 +59,7 @@ MODULE_PARM_DESC(limit, "Maximum number =20 static atomic_t pages_mapped =3D ATOMIC_INIT(0); =20 +/* True in PV mode, false otherwise */ static int use_ptemod; #define populate_freeable_maps use_ptemod =20 @@ -94,11 +95,16 @@ struct grant_map { struct gnttab_unmap_grant_ref *unmap_ops; struct gnttab_map_grant_ref *kmap_ops; struct gnttab_unmap_grant_ref *kunmap_ops; + bool *being_removed; struct page **pages; unsigned long pages_vm_start; + /* Number of live grants */ + atomic_t live_grants; + /* Needed to avoid allocation in unmap_grant_pages */ + struct gntab_unmap_queue_data unmap_data; }; =20 -static int unmap_grant_pages(struct grant_map *map, int offset, int pages); +static void unmap_grant_pages(struct grant_map *map, int offset, int pages= ); =20 /* ------------------------------------------------------------------ */ =20 @@ -129,6 +135,7 @@ static void gntdev_free_map(struct grant kfree(map->unmap_ops); kfree(map->kmap_ops); kfree(map->kunmap_ops); + kfree(map->being_removed); kfree(map); } =20 @@ -147,12 +154,15 @@ static struct grant_map *gntdev_alloc_ma add->kmap_ops =3D kcalloc(count, sizeof(add->kmap_ops[0]), GFP_KERNEL); add->kunmap_ops =3D kcalloc(count, sizeof(add->kunmap_ops[0]), GFP_KERNEL= ); add->pages =3D kcalloc(count, sizeof(add->pages[0]), GFP_KERNEL); + add->being_removed =3D + kcalloc(count, sizeof(add->being_removed[0]), GFP_KERNEL); if (NULL =3D=3D add->grants || NULL =3D=3D add->map_ops || NULL =3D=3D add->unmap_ops || NULL =3D=3D add->kmap_ops || NULL =3D=3D add->kunmap_ops || - NULL =3D=3D add->pages) + NULL =3D=3D add->pages || + NULL =3D=3D add->being_removed) goto err; =20 if (gnttab_alloc_pages(count, add->pages)) @@ -217,6 +227,35 @@ static void gntdev_put_map(struct gntdev return; =20 atomic_sub(map->count, &pages_mapped); + if (map->pages && !use_ptemod) { + /* + * Increment the reference count. This ensures that the + * subsequent call to unmap_grant_pages() will not wind up + * re-entering itself. It *can* wind up calling + * gntdev_put_map() recursively, but such calls will be with a + * reference count greater than 1, so they will return before + * this code is reached. The recursion depth is thus limited to + * 1. Do NOT use refcount_inc() here, as it will detect that + * the reference count is zero and WARN(). + */ + refcount_set(&map->users, 1); + + /* + * Unmap the grants. This may or may not be asynchronous, so it + * is possible that the reference count is 1 on return, but it + * could also be greater than 1. + */ + unmap_grant_pages(map, 0, map->count); + + /* Check if the memory now needs to be freed */ + if (!refcount_dec_and_test(&map->users)) + return; + + /* + * All pages have been returned to the hypervisor, so free the + * map. + */ + } =20 if (map->notify.flags & UNMAP_NOTIFY_SEND_EVENT) { notify_remote_via_evtchn(map->notify.event); @@ -274,6 +313,7 @@ static int set_grant_ptes_as_special(pte =20 static int map_grant_pages(struct grant_map *map) { + size_t alloced =3D 0; int i, err =3D 0; =20 if (!use_ptemod) { @@ -322,85 +362,107 @@ static int map_grant_pages(struct grant_ map->pages, map->count); =20 for (i =3D 0; i < map->count; i++) { - if (map->map_ops[i].status =3D=3D GNTST_okay) + if (map->map_ops[i].status =3D=3D GNTST_okay) { map->unmap_ops[i].handle =3D map->map_ops[i].handle; - else if (!err) + if (!use_ptemod) + alloced++; + } else if (!err) err =3D -EINVAL; =20 if (map->flags & GNTMAP_device_map) map->unmap_ops[i].dev_bus_addr =3D map->map_ops[i].dev_bus_addr; =20 if (use_ptemod) { - if (map->kmap_ops[i].status =3D=3D GNTST_okay) + if (map->kmap_ops[i].status =3D=3D GNTST_okay) { + if (map->map_ops[i].status =3D=3D GNTST_okay) + alloced++; map->kunmap_ops[i].handle =3D map->kmap_ops[i].handle; - else if (!err) + } else if (!err) err =3D -EINVAL; } } + atomic_add(alloced, &map->live_grants); return err; } =20 -static int __unmap_grant_pages(struct grant_map *map, int offset, int page= s) +static void __unmap_grant_pages_done(int result, + struct gntab_unmap_queue_data *data) { - int i, err =3D 0; - struct gntab_unmap_queue_data unmap_data; + unsigned int i; + struct grant_map *map =3D data->data; + unsigned int offset =3D data->unmap_ops - map->unmap_ops; + + for (i =3D 0; i < data->count; i++) { + WARN_ON(map->unmap_ops[offset+i].status); + pr_debug("unmap handle=3D%d st=3D%d\n", + map->unmap_ops[offset+i].handle, + map->unmap_ops[offset+i].status); + map->unmap_ops[offset+i].handle =3D -1; + } + /* + * Decrease the live-grant counter. This must happen after the loop to + * prevent premature reuse of the grants by gnttab_mmap(). + */ + atomic_sub(data->count, &map->live_grants); + + /* Release reference taken by unmap_grant_pages */ + gntdev_put_map(NULL, map); +} =20 +static void __unmap_grant_pages(struct grant_map *map, int offset, int pag= es) +{ if (map->notify.flags & UNMAP_NOTIFY_CLEAR_BYTE) { int pgno =3D (map->notify.addr >> PAGE_SHIFT); + if (pgno >=3D offset && pgno < offset + pages) { /* No need for kmap, pages are in lowmem */ uint8_t *tmp =3D pfn_to_kaddr(page_to_pfn(map->pages[pgno])); + tmp[map->notify.addr & (PAGE_SIZE-1)] =3D 0; map->notify.flags &=3D ~UNMAP_NOTIFY_CLEAR_BYTE; } } =20 - unmap_data.unmap_ops =3D map->unmap_ops + offset; - unmap_data.kunmap_ops =3D use_ptemod ? map->kunmap_ops + offset : NULL; - unmap_data.pages =3D map->pages + offset; - unmap_data.count =3D pages; + map->unmap_data.unmap_ops =3D map->unmap_ops + offset; + map->unmap_data.kunmap_ops =3D use_ptemod ? map->kunmap_ops + offset : NU= LL; + map->unmap_data.pages =3D map->pages + offset; + map->unmap_data.count =3D pages; + map->unmap_data.done =3D __unmap_grant_pages_done; + map->unmap_data.data =3D map; + refcount_inc(&map->users); /* to keep map alive during async call below */ =20 - err =3D gnttab_unmap_refs_sync(&unmap_data); - if (err) - return err; - - for (i =3D 0; i < pages; i++) { - if (map->unmap_ops[offset+i].status) - err =3D -EINVAL; - pr_debug("unmap handle=3D%d st=3D%d\n", - map->unmap_ops[offset+i].handle, - map->unmap_ops[offset+i].status); - map->unmap_ops[offset+i].handle =3D -1; - } - return err; + gnttab_unmap_refs_async(&map->unmap_data); } =20 -static int unmap_grant_pages(struct grant_map *map, int offset, int pages) +static void unmap_grant_pages(struct grant_map *map, int offset, int pages) { - int range, err =3D 0; + int range; + + if (atomic_read(&map->live_grants) =3D=3D 0) + return; /* Nothing to do */ =20 pr_debug("unmap %d+%d [%d+%d]\n", map->index, map->count, offset, pages); =20 /* It is possible the requested range will have a "hole" where we * already unmapped some of the grants. Only unmap valid ranges. */ - while (pages && !err) { - while (pages && map->unmap_ops[offset].handle =3D=3D -1) { + while (pages) { + while (pages && map->being_removed[offset]) { offset++; pages--; } range =3D 0; while (range < pages) { - if (map->unmap_ops[offset+range].handle =3D=3D -1) + if (map->being_removed[offset + range]) break; + map->being_removed[offset + range] =3D true; range++; } - err =3D __unmap_grant_pages(map, offset, range); + if (range) + __unmap_grant_pages(map, offset, range); offset +=3D range; pages -=3D range; } - - return err; } =20 /* ------------------------------------------------------------------ */ @@ -456,7 +518,6 @@ static void unmap_if_in_range(struct gra unsigned long start, unsigned long end) { unsigned long mstart, mend; - int err; =20 if (!map->vma) return; @@ -470,10 +531,9 @@ static void unmap_if_in_range(struct gra map->index, map->count, map->vma->vm_start, map->vma->vm_end, start, end, mstart, mend); - err =3D unmap_grant_pages(map, + unmap_grant_pages(map, (mstart - map->vma->vm_start) >> PAGE_SHIFT, (mend - mstart) >> PAGE_SHIFT); - WARN_ON(err); } =20 static void mn_invl_range_start(struct mmu_notifier *mn, @@ -498,7 +558,6 @@ static void mn_release(struct mmu_notifi { struct gntdev_priv *priv =3D container_of(mn, struct gntdev_priv, mn); struct grant_map *map; - int err; =20 mutex_lock(&priv->lock); list_for_each_entry(map, &priv->maps, next) { @@ -507,8 +566,7 @@ static void mn_release(struct mmu_notifi pr_debug("map %d+%d (%lx %lx)\n", map->index, map->count, map->vma->vm_start, map->vma->vm_end); - err =3D unmap_grant_pages(map, /* offset */ 0, map->count); - WARN_ON(err); + unmap_grant_pages(map, /* offset */ 0, map->count); } list_for_each_entry(map, &priv->freeable_maps, next) { if (!map->vma) @@ -516,8 +574,7 @@ static void mn_release(struct mmu_notifi pr_debug("map %d+%d (%lx %lx)\n", map->index, map->count, map->vma->vm_start, map->vma->vm_end); - err =3D unmap_grant_pages(map, /* offset */ 0, map->count); - WARN_ON(err); + unmap_grant_pages(map, /* offset */ 0, map->count); } mutex_unlock(&priv->lock); } @@ -1006,6 +1063,10 @@ static int gntdev_mmap(struct file *flip goto unlock_out; } =20 + if (atomic_read(&map->live_grants)) { + err =3D -EAGAIN; + goto unlock_out; + } refcount_inc(&map->users); =20 vma->vm_ops =3D &gntdev_vmops; From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 782AFCCA47F for ; Tue, 5 Jul 2022 12:02:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233208AbiGEMCO (ORCPT ); Tue, 5 Jul 2022 08:02:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42924 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232949AbiGEMBL (ORCPT ); Tue, 5 Jul 2022 08:01:11 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 80A4F17E26; Tue, 5 Jul 2022 05:01:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1B849617C5; Tue, 5 Jul 2022 12:01:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 24296C341C7; Tue, 5 Jul 2022 12:01:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022469; bh=CQl6euab5xGbNlx53hUvYix1BiHS9rLNvUdVGXVQJ1E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tX224ih4VRTRbGaGyXCloz0d2jESLMcBoPmyUHfi4McV1wMsAMQPY119rQYk2GiRL TJM0B7OljrMNPTyB+nxCKe9K5HFlrtw5tgHmH3r51Y94X/rn4w+ZxyY7cuqYpPbCBh hmIAyh5PKxnr0F67erO+i5yZRC8TYw1FP91MW1g8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Yang Yingliang , Guenter Roeck , Sasha Levin Subject: [PATCH 4.14 18/29] hwmon: (ibmaem) dont call platform_device_del() if platform_device_add() fails Date: Tue, 5 Jul 2022 13:58:06 +0200 Message-Id: <20220705115606.881762229@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang [ Upstream commit d0e51022a025ca5350fafb8e413a6fe5d4baf833 ] If platform_device_add() fails, it no need to call platform_device_del(), s= plit platform_device_unregister() into platform_device_del/put(), so platform_de= vice_put() can be called separately. Fixes: 8808a793f052 ("ibmaem: new driver for power/energy/temp meters in IB= M System X hardware") Reported-by: Hulk Robot Signed-off-by: Yang Yingliang Link: https://lore.kernel.org/r/20220701074153.4021556-1-yangyingliang@huaw= ei.com Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/hwmon/ibmaem.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/drivers/hwmon/ibmaem.c +++ b/drivers/hwmon/ibmaem.c @@ -563,7 +563,7 @@ static int aem_init_aem1_inst(struct aem =20 res =3D platform_device_add(data->pdev); if (res) - goto ipmi_err; + goto dev_add_err; =20 platform_set_drvdata(data->pdev, data); =20 @@ -611,7 +611,9 @@ hwmon_reg_err: ipmi_destroy_user(data->ipmi.user); ipmi_err: platform_set_drvdata(data->pdev, NULL); - platform_device_unregister(data->pdev); + platform_device_del(data->pdev); +dev_add_err: + platform_device_put(data->pdev); dev_err: ida_simple_remove(&aem_ida, data->id); id_err: @@ -703,7 +705,7 @@ static int aem_init_aem2_inst(struct aem =20 res =3D platform_device_add(data->pdev); if (res) - goto ipmi_err; + goto dev_add_err; =20 platform_set_drvdata(data->pdev, data); =20 @@ -751,7 +753,9 @@ hwmon_reg_err: ipmi_destroy_user(data->ipmi.user); ipmi_err: platform_set_drvdata(data->pdev, NULL); - platform_device_unregister(data->pdev); + platform_device_del(data->pdev); +dev_add_err: + platform_device_put(data->pdev); dev_err: ida_simple_remove(&aem_ida, data->id); id_err: From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 41EBBC43334 for ; Tue, 5 Jul 2022 12:02:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233220AbiGEMCQ (ORCPT ); Tue, 5 Jul 2022 08:02:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43828 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233096AbiGEMBP (ORCPT ); Tue, 5 Jul 2022 08:01:15 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D39E817AA6; Tue, 5 Jul 2022 05:01:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 86011B817D4; Tue, 5 Jul 2022 12:01:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DCCCBC341CB; Tue, 5 Jul 2022 12:01:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022472; bh=IoZTyfzd9DsX/b0gQKO3BlhJTHwTyv/JniQkRhKv3yk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IJOELwScx95d0PlCyyAOwMCbYV11DrtMMbgTLEcbnHw/YOFtHwoG60N3lybszveRc ukiQZRCl2DNBSqRqd5w/aiLIKbK74/2diT40dRmBll7gyMUZ1oHtrckgtIJSMMZVGj A4eArYu+JqS1Eg1013gnz68cAcQu8Lqeq2MoFfkI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Doug Berger , Florian Fainelli , Jakub Kicinski Subject: [PATCH 4.14 19/29] net: dsa: bcm_sf2: force pause link settings Date: Tue, 5 Jul 2022 13:58:07 +0200 Message-Id: <20220705115606.910907553@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Doug Berger commit 7c97bc0128b2eecc703106112679a69d446d1a12 upstream. The pause settings reported by the PHY should also be applied to the GMII p= ort status override otherwise the switch will not generate pause frames towards= the link partner despite the advertisement saying otherwise. Fixes: 246d7f773c13 ("net: dsa: add Broadcom SF2 switch driver") Signed-off-by: Doug Berger Signed-off-by: Florian Fainelli Link: https://lore.kernel.org/r/20220623030204.1966851-1-f.fainelli@gmail.c= om Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/dsa/bcm_sf2.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/net/dsa/bcm_sf2.c +++ b/drivers/net/dsa/bcm_sf2.c @@ -701,6 +701,11 @@ force_link: reg |=3D LINK_STS; if (phydev->duplex =3D=3D DUPLEX_FULL) reg |=3D DUPLX_MODE; + if (phydev->pause) { + if (phydev->asym_pause) + reg |=3D TXFLOW_CNTL; + reg |=3D RXFLOW_CNTL; + } =20 core_writel(priv, reg, offset); From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16711C43334 for ; Tue, 5 Jul 2022 12:02:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233239AbiGEMCV (ORCPT ); Tue, 5 Jul 2022 08:02:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42990 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233109AbiGEMBT (ORCPT ); Tue, 5 Jul 2022 08:01:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D3EAD18381; Tue, 5 Jul 2022 05:01:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6FE7B617C9; Tue, 5 Jul 2022 12:01:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 78A58C341C7; Tue, 5 Jul 2022 12:01:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022477; bh=xy/zpNF28Nl4sccHc2YYbTctrPGisl++k7Cccms5UtU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YNDIY4plxe3ZRy1BuhwEtBRSRXnd7g+2r7AGaFvTUtFsPmBRlTPbFTlgn3/uSCgOy TfqZSK3VUVZeRv4W6CMi289T0TmAhGt37IOt7qwXkcdPa965ocd5U7QHEs9xflXrLo FRCHbIdIB9Y4wkmT9SkeeqNzNJaV1/PR/B83Yu+Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Denis Efremov , kernel test robot , David Ahern , "David S. Miller" Subject: [PATCH 4.14 20/29] sit: use min Date: Tue, 5 Jul 2022 13:58:08 +0200 Message-Id: <20220705115606.940197025@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: kernel test robot commit 284fda1eff8a8b27d2cafd7dc8fb423d13720f21 upstream. Opportunity for min() Generated by: scripts/coccinelle/misc/minmax.cocci CC: Denis Efremov Reported-by: kernel test robot Signed-off-by: kernel test robot Reviewed-by: David Ahern Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv6/sit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -310,7 +310,7 @@ static int ipip6_tunnel_get_prl(struct i =20 rcu_read_lock(); =20 - ca =3D t->prl_count < cmax ? t->prl_count : cmax; + ca =3D min(t->prl_count, cmax); =20 if (!kp) { /* We don't try hard to allocate much memory for From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00228C433EF for ; Tue, 5 Jul 2022 12:02:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233270AbiGEMC2 (ORCPT ); Tue, 5 Jul 2022 08:02:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43266 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232981AbiGEMBY (ORCPT ); Tue, 5 Jul 2022 08:01:24 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 408701835F; Tue, 5 Jul 2022 05:01:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C2879B817D3; Tue, 5 Jul 2022 12:01:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2B5A9C36AE3; Tue, 5 Jul 2022 12:01:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022480; bh=FnF83P0Me1TTViQOm7a/P8GEvR4lEBNIGtf5qJLmVJM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tkvKMPcU+7u83dyBUR+GG6Fv5byeba0LX9cZgjCtUp2YjmXW4VmkL2q0Bdn89OQ01 P41ySJLYWEVDmbBbhhb6asLbUtprG0v6gSlhd1g0OOONwIU651PBdSJRYdN6OnhhXR ekVvykQWmgp05oQ+uYbboKw24ttQsRI22SwSc2J0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, katrinzhou , Eric Dumazet , David Ahern , Jakub Kicinski Subject: [PATCH 4.14 21/29] ipv6/sit: fix ipip6_tunnel_get_prl return value Date: Tue, 5 Jul 2022 13:58:09 +0200 Message-Id: <20220705115606.969644195@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: katrinzhou commit adabdd8f6acabc0c3fdbba2e7f5a2edd9c5ef22d upstream. When kcalloc fails, ipip6_tunnel_get_prl() should return -ENOMEM. Move the position of label "out" to return correctly. Addresses-Coverity: ("Unused value") Fixes: 300aaeeaab5f ("[IPV6] SIT: Add SIOCGETPRL ioctl to get/dump PRL.") Signed-off-by: katrinzhou Reviewed-by: Eric Dumazet Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20220628035030.1039171-1-zys.zljxml@gmail.c= om Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv6/sit.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c @@ -308,8 +308,6 @@ static int ipip6_tunnel_get_prl(struct i kcalloc(cmax, sizeof(*kp), GFP_KERNEL | __GFP_NOWARN) : NULL; =20 - rcu_read_lock(); - ca =3D min(t->prl_count, cmax); =20 if (!kp) { @@ -325,7 +323,7 @@ static int ipip6_tunnel_get_prl(struct i } } =20 - c =3D 0; + rcu_read_lock(); for_each_prl_rcu(t->prl) { if (c >=3D cmax) break; @@ -337,7 +335,7 @@ static int ipip6_tunnel_get_prl(struct i if (kprl.addr !=3D htonl(INADDR_ANY)) break; } -out: + rcu_read_unlock(); =20 len =3D sizeof(*kp) * c; @@ -346,7 +344,7 @@ out: ret =3D -EFAULT; =20 kfree(kp); - +out: return ret; } From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1DA64CCA47F for ; Tue, 5 Jul 2022 12:02:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233030AbiGEMC5 (ORCPT ); Tue, 5 Jul 2022 08:02:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42336 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232954AbiGEMBZ (ORCPT ); Tue, 5 Jul 2022 08:01:25 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4745A17E32; Tue, 5 Jul 2022 05:01:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CB513617F7; Tue, 5 Jul 2022 12:01:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D72E3C341C7; Tue, 5 Jul 2022 12:01:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022483; bh=tAOL+DzPK9I8lxGvKJA0eAmciffreLwLn+mtGUgEUmc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lAXpLPt+SYvFs9uAL28QqyNSQFpCE6Auajb/FfTWyJYmAn2hc1tUr2yviUvHLE5on YPmy17ZmaJx/486irZvbVOgXGSACllu+buNS/8VI1vzli7CNAwaNVWSS/of9EPJVSR V8zNeeB6Gvp4N7IWJo4NV/eItJFx3AmWN4UbWd/8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ilya Lesokhin , Boris Pismenny , "David S. Miller" Subject: [PATCH 4.14 22/29] net: Rename and export copy_skb_header Date: Tue, 5 Jul 2022 13:58:10 +0200 Message-Id: <20220705115606.998499842@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ilya Lesokhin commit 08303c189581c985e60f588ad92a041e46b6e307 upstream. [ jgross@suse.com: added as needed by XSA-403 mitigation ] copy_skb_header is renamed to skb_copy_header and exported. Exposing this function give more flexibility in copying SKBs. skb_copy and skb_copy_expand do not give enough control over which parts are copied. Signed-off-by: Ilya Lesokhin Signed-off-by: Boris Pismenny Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/linux/skbuff.h | 1 + net/core/skbuff.c | 9 +++++---- 2 files changed, 6 insertions(+), 4 deletions(-) --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -1025,6 +1025,7 @@ static inline struct sk_buff *alloc_skb_ struct sk_buff *skb_morph(struct sk_buff *dst, struct sk_buff *src); int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask); struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t priority); +void skb_copy_header(struct sk_buff *new, const struct sk_buff *old); struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t priority); struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom, gfp_t gfp_mask, bool fclone); --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -1314,7 +1314,7 @@ static void skb_headers_offset_update(st skb->inner_mac_header +=3D off; } =20 -static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old) +void skb_copy_header(struct sk_buff *new, const struct sk_buff *old) { __copy_skb_header(new, old); =20 @@ -1322,6 +1322,7 @@ static void copy_skb_header(struct sk_bu skb_shinfo(new)->gso_segs =3D skb_shinfo(old)->gso_segs; skb_shinfo(new)->gso_type =3D skb_shinfo(old)->gso_type; } +EXPORT_SYMBOL(skb_copy_header); =20 static inline int skb_alloc_rx_flag(const struct sk_buff *skb) { @@ -1365,7 +1366,7 @@ struct sk_buff *skb_copy(const struct sk if (skb_copy_bits(skb, -headerlen, n->head, headerlen + skb->len)) BUG(); =20 - copy_skb_header(n, skb); + skb_copy_header(n, skb); return n; } EXPORT_SYMBOL(skb_copy); @@ -1429,7 +1430,7 @@ struct sk_buff *__pskb_copy_fclone(struc skb_clone_fraglist(n); } =20 - copy_skb_header(n, skb); + skb_copy_header(n, skb); out: return n; } @@ -1609,7 +1610,7 @@ struct sk_buff *skb_copy_expand(const st skb->len + head_copy_len)) BUG(); =20 - copy_skb_header(n, skb); + skb_copy_header(n, skb); =20 skb_headers_offset_update(n, newheadroom - oldheadroom); From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24D07C43334 for ; Tue, 5 Jul 2022 12:03:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233180AbiGEMDA (ORCPT ); Tue, 5 Jul 2022 08:03:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43384 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233141AbiGEMB3 (ORCPT ); Tue, 5 Jul 2022 08:01:29 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BF74D1582A; Tue, 5 Jul 2022 05:01:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4C8C1B817CC; Tue, 5 Jul 2022 12:01:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 848E6C341C7; Tue, 5 Jul 2022 12:01:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022485; bh=16qWtBAtgeBJRudyGfkIKclqH02YQfiB4Ii4vSjWRng=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QL/fHu42HQQFw+kWLZ/6ObX7lK0YjVBFIwWX4AGPMFPx1N02bhwHeZiT/NsD3XcU5 W3I9dP2BKvmDf8zzY68ZowKFHjxWBQYGSLHZ4U1F3ZjwrJttmWA/NkWrsn/rZrKzR5 jZ2Y5Cln6ocXM8VMgjsY2xtVEk5zxrqrnIsI2szQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Jan Beulich , Juergen Gross Subject: [PATCH 4.14 23/29] xen/blkfront: fix leaking data in shared pages Date: Tue, 5 Jul 2022 13:58:11 +0200 Message-Id: <20220705115607.027328709@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Roger Pau Monne commit 2f446ffe9d737e9a844b97887919c4fda18246e7 upstream. When allocating pages to be used for shared communication with the backend always zero them, this avoids leaking unintended data present on the pages. This is CVE-2022-26365, part of XSA-403. Signed-off-by: Roger Pau Monn=C3=A9 Reviewed-by: Jan Beulich Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/block/xen-blkfront.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -302,7 +302,7 @@ static int fill_grant_buffer(struct blkf goto out_of_memory; =20 if (info->feature_persistent) { - granted_page =3D alloc_page(GFP_NOIO); + granted_page =3D alloc_page(GFP_NOIO | __GFP_ZERO); if (!granted_page) { kfree(gnt_list_entry); goto out_of_memory; @@ -1744,7 +1744,7 @@ static int setup_blkring(struct xenbus_d for (i =3D 0; i < info->nr_ring_pages; i++) rinfo->ring_ref[i] =3D GRANT_INVALID_REF; =20 - sring =3D alloc_pages_exact(ring_size, GFP_NOIO); + sring =3D alloc_pages_exact(ring_size, GFP_NOIO | __GFP_ZERO); if (!sring) { xenbus_dev_fatal(dev, -ENOMEM, "allocating shared ring"); return -ENOMEM; @@ -2266,7 +2266,8 @@ static int blkfront_setup_indirect(struc =20 BUG_ON(!list_empty(&rinfo->indirect_pages)); for (i =3D 0; i < num; i++) { - struct page *indirect_page =3D alloc_page(GFP_NOIO); + struct page *indirect_page =3D alloc_page(GFP_NOIO | + __GFP_ZERO); if (!indirect_page) goto out_of_memory; list_add(&indirect_page->lru, &rinfo->indirect_pages); From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E8DBC43334 for ; Tue, 5 Jul 2022 12:03:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233316AbiGEMDG (ORCPT ); Tue, 5 Jul 2022 08:03:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44246 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233032AbiGEMBc (ORCPT ); Tue, 5 Jul 2022 08:01:32 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 518DF17AA9; Tue, 5 Jul 2022 05:01:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D0374B817DA; Tue, 5 Jul 2022 12:01:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 344AFC341C7; Tue, 5 Jul 2022 12:01:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022488; bh=FKkgouZZjBPUrb7Wvw9iFLZz7PIMsh/l6Yr1v91nFWs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KhNDMZkud+vWwVZXM6/zbM5Fq1KpK5FJBxGFYWAWamXzA7KelCd/dxFhSPxG0q9vr +OGdc9bjPjbIlzD85wlM5sG88jDhNmbsO12UZzq+Q6s8NxsGOKtUd1kJZWFMzpqEEf 9ioeZwePZTRn0nUpxn5dMidbPPfB59df1zQhJgfo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Jan Beulich , Juergen Gross Subject: [PATCH 4.14 24/29] xen/netfront: fix leaking data in shared pages Date: Tue, 5 Jul 2022 13:58:12 +0200 Message-Id: <20220705115607.055647740@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Roger Pau Monne commit 307c8de2b02344805ebead3440d8feed28f2f010 upstream. When allocating pages to be used for shared communication with the backend always zero them, this avoids leaking unintended data present on the pages. This is CVE-2022-33740, part of XSA-403. Signed-off-by: Roger Pau Monn=C3=A9 Reviewed-by: Jan Beulich Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/xen-netfront.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -261,7 +261,7 @@ static struct sk_buff *xennet_alloc_one_ if (unlikely(!skb)) return NULL; =20 - page =3D alloc_page(GFP_ATOMIC | __GFP_NOWARN); + page =3D alloc_page(GFP_ATOMIC | __GFP_NOWARN | __GFP_ZERO); if (!page) { kfree_skb(skb); return NULL; From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B0D1C433EF for ; Tue, 5 Jul 2022 12:03:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233393AbiGEMDM (ORCPT ); Tue, 5 Jul 2022 08:03:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44308 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230026AbiGEMBe (ORCPT ); Tue, 5 Jul 2022 08:01:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EF09618375; Tue, 5 Jul 2022 05:01:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A1631B817D4; Tue, 5 Jul 2022 12:01:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E5485C341C7; Tue, 5 Jul 2022 12:01:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022491; bh=whB7DChqKjNXM6KulnnZB0EMSPHoC3atR9z0QHm4pT4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=r8tNRXc7cFM/Qh5+bg584xm5qgRAFA6RM2fqZ8IX4DJTFrD5MGg/08/GsHkjVw337 ZhZWmdEI/wlWXouVX3SW62RISj9PLZtudoG1LmGZ7U9T0DnV/aIC34A3rO8OJEvsaM LE2FWOTb3WtCyWmU/062RhUoO2bcXIaONQdjlnys= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Juergen Gross Subject: [PATCH 4.14 25/29] xen/netfront: force data bouncing when backend is untrusted Date: Tue, 5 Jul 2022 13:58:13 +0200 Message-Id: <20220705115607.084848474@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Roger Pau Monne commit 4491001c2e0fa69efbb748c96ec96b100a5cdb7e upstream. Bounce all data on the skbs to be transmitted into zeroed pages if the backend is untrusted. This avoids leaking data present in the pages shared with the backend but not part of the skb fragments. This requires introducing a new helper in order to allocate skbs with a size multiple of XEN_PAGE_SIZE so we don't leak contiguous data on the granted pages. Reporting whether the backend is to be trusted can be done using a module parameter, or from the xenstore frontend path as set by the toolstack when adding the device. This is CVE-2022-33741, part of XSA-403. Signed-off-by: Roger Pau Monn=C3=A9 Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/xen-netfront.c | 50 ++++++++++++++++++++++++++++++++++++++++= +++-- 1 file changed, 48 insertions(+), 2 deletions(-) --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -63,6 +63,10 @@ module_param_named(max_queues, xennet_ma MODULE_PARM_DESC(max_queues, "Maximum number of queues per virtual interface"); =20 +static bool __read_mostly xennet_trusted =3D true; +module_param_named(trusted, xennet_trusted, bool, 0644); +MODULE_PARM_DESC(trusted, "Is the backend trusted"); + #define XENNET_TIMEOUT (5 * HZ) =20 static const struct ethtool_ops xennet_ethtool_ops; @@ -163,6 +167,9 @@ struct netfront_info { /* Is device behaving sane? */ bool broken; =20 + /* Should skbs be bounced into a zeroed buffer? */ + bool bounce; + atomic_t rx_gso_checksum_fixup; }; =20 @@ -592,6 +599,34 @@ static void xennet_mark_tx_pending(struc queue->tx_link[i] =3D TX_PENDING; } =20 +struct sk_buff *bounce_skb(const struct sk_buff *skb) +{ + unsigned int headerlen =3D skb_headroom(skb); + /* Align size to allocate full pages and avoid contiguous data leaks */ + unsigned int size =3D ALIGN(skb_end_offset(skb) + skb->data_len, + XEN_PAGE_SIZE); + struct sk_buff *n =3D alloc_skb(size, GFP_ATOMIC | __GFP_ZERO); + + if (!n) + return NULL; + + if (!IS_ALIGNED((uintptr_t)n->head, XEN_PAGE_SIZE)) { + WARN_ONCE(1, "misaligned skb allocated\n"); + kfree_skb(n); + return NULL; + } + + /* Set the data pointer */ + skb_reserve(n, headerlen); + /* Set the tail pointer and length */ + skb_put(n, skb->len); + + BUG_ON(skb_copy_bits(skb, -headerlen, n->head, headerlen + skb->len)); + + skb_copy_header(n, skb); + return n; +} + #define MAX_XEN_SKB_FRAGS (65536 / XEN_PAGE_SIZE + 1) =20 static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev) @@ -644,9 +679,13 @@ static int xennet_start_xmit(struct sk_b =20 /* The first req should be at least ETH_HLEN size or the packet will be * dropped by netback. + * + * If the backend is not trusted bounce all data to zeroed pages to + * avoid exposing contiguous data on the granted page not belonging to + * the skb. */ - if (unlikely(PAGE_SIZE - offset < ETH_HLEN)) { - nskb =3D skb_copy(skb, GFP_ATOMIC); + if (np->bounce || unlikely(PAGE_SIZE - offset < ETH_HLEN)) { + nskb =3D bounce_skb(skb); if (!nskb) goto drop; dev_consume_skb_any(skb); @@ -1946,6 +1985,10 @@ static int talk_to_netback(struct xenbus =20 info->netdev->irq =3D 0; =20 + /* Check if backend is trusted. */ + info->bounce =3D !xennet_trusted || + !xenbus_read_unsigned(dev->nodename, "trusted", 1); + /* Check if backend supports multiple queues */ max_queues =3D xenbus_read_unsigned(info->xbdev->otherend, "multi-queue-max-queues", 1); @@ -2099,6 +2142,9 @@ static int xennet_connect(struct net_dev err =3D talk_to_netback(np->xbdev, np); if (err) return err; + if (np->bounce) + dev_info(&np->xbdev->dev, + "bouncing transmitted data to zeroed pages\n"); =20 /* talk_to_netback() sets the correct number of queues */ num_queues =3D dev->real_num_tx_queues; From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1AF9BCCA47B for ; Tue, 5 Jul 2022 12:03:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233353AbiGEMDJ (ORCPT ); Tue, 5 Jul 2022 08:03:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44334 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231135AbiGEMBg (ORCPT ); Tue, 5 Jul 2022 08:01:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3A29418356; Tue, 5 Jul 2022 05:01:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BA0B26184A; Tue, 5 Jul 2022 12:01:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0000C341C7; Tue, 5 Jul 2022 12:01:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022494; bh=zlk6f9vOJB8weBnkiCKJdA1tSvlOjwDX1031HjkIl0s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U9qWg7o7i3p4LXd1Y+qZAFjpvOhB4tREGuzXRFqGcPFg/gst94MpPeSBv+5hpjfws aMNo+x3JyMbzA0FQDcwLs9iOtn6d2rWIZZh56zCYmf0oDKFa2mHQLwaG34Gl6kz9ad 1huI1Txivd7DcQ9XYuQErqKz1lekO2n07WGskjak= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Juergen Gross Subject: [PATCH 4.14 26/29] xen/blkfront: force data bouncing when backend is untrusted Date: Tue, 5 Jul 2022 13:58:14 +0200 Message-Id: <20220705115607.114216075@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Roger Pau Monne commit 2400617da7eebf9167d71a46122828bc479d64c9 upstream. Split the current bounce buffering logic used with persistent grants into it's own option, and allow enabling it independently of persistent grants. This allows to reuse the same code paths to perform the bounce buffering required to avoid leaking contiguous data in shared pages not part of the request fragments. Reporting whether the backend is to be trusted can be done using a module parameter, or from the xenstore frontend path as set by the toolstack when adding the device. This is CVE-2022-33742, part of XSA-403. Signed-off-by: Roger Pau Monn=C3=A9 Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/block/xen-blkfront.c | 42 +++++++++++++++++++++++++++-----------= ---- 1 file changed, 27 insertions(+), 15 deletions(-) --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -148,6 +148,10 @@ static unsigned int xen_blkif_max_ring_o module_param_named(max_ring_page_order, xen_blkif_max_ring_order, int, S_I= RUGO); MODULE_PARM_DESC(max_ring_page_order, "Maximum order of pages to be used f= or the shared ring"); =20 +static bool __read_mostly xen_blkif_trusted =3D true; +module_param_named(trusted, xen_blkif_trusted, bool, 0644); +MODULE_PARM_DESC(trusted, "Is the backend trusted"); + #define BLK_RING_SIZE(info) \ __CONST_RING_SIZE(blkif, XEN_PAGE_SIZE * (info)->nr_ring_pages) =20 @@ -208,6 +212,7 @@ struct blkfront_info unsigned int feature_discard:1; unsigned int feature_secdiscard:1; unsigned int feature_persistent:1; + unsigned int bounce:1; unsigned int discard_granularity; unsigned int discard_alignment; /* Number of 4KB segments handled */ @@ -301,7 +306,7 @@ static int fill_grant_buffer(struct blkf if (!gnt_list_entry) goto out_of_memory; =20 - if (info->feature_persistent) { + if (info->bounce) { granted_page =3D alloc_page(GFP_NOIO | __GFP_ZERO); if (!granted_page) { kfree(gnt_list_entry); @@ -321,7 +326,7 @@ out_of_memory: list_for_each_entry_safe(gnt_list_entry, n, &rinfo->grants, node) { list_del(&gnt_list_entry->node); - if (info->feature_persistent) + if (info->bounce) __free_page(gnt_list_entry->page); kfree(gnt_list_entry); i--; @@ -367,7 +372,7 @@ static struct grant *get_grant(grant_ref /* Assign a gref to this page */ gnt_list_entry->gref =3D gnttab_claim_grant_reference(gref_head); BUG_ON(gnt_list_entry->gref =3D=3D -ENOSPC); - if (info->feature_persistent) + if (info->bounce) grant_foreign_access(gnt_list_entry, info); else { /* Grant access to the GFN passed by the caller */ @@ -391,7 +396,7 @@ static struct grant *get_indirect_grant( /* Assign a gref to this page */ gnt_list_entry->gref =3D gnttab_claim_grant_reference(gref_head); BUG_ON(gnt_list_entry->gref =3D=3D -ENOSPC); - if (!info->feature_persistent) { + if (!info->bounce) { struct page *indirect_page; =20 /* Fetch a pre-allocated page to use for indirect grefs */ @@ -706,7 +711,7 @@ static int blkif_queue_rw_req(struct req .grant_idx =3D 0, .segments =3D NULL, .rinfo =3D rinfo, - .need_copy =3D rq_data_dir(req) && info->feature_persistent, + .need_copy =3D rq_data_dir(req) && info->bounce, }; =20 /* @@ -1027,11 +1032,12 @@ static void xlvbd_flush(struct blkfront_ { blk_queue_write_cache(info->rq, info->feature_flush ? true : false, info->feature_fua ? true : false); - pr_info("blkfront: %s: %s %s %s %s %s\n", + pr_info("blkfront: %s: %s %s %s %s %s %s %s\n", info->gd->disk_name, flush_info(info), "persistent grants:", info->feature_persistent ? "enabled;" : "disabled;", "indirect descriptors:", - info->max_indirect_segments ? "enabled;" : "disabled;"); + info->max_indirect_segments ? "enabled;" : "disabled;", + "bounce buffer:", info->bounce ? "enabled" : "disabled;"); } =20 static int xen_translate_vdev(int vdevice, int *minor, unsigned int *offse= t) @@ -1266,7 +1272,7 @@ static void blkif_free_ring(struct blkfr if (!list_empty(&rinfo->indirect_pages)) { struct page *indirect_page, *n; =20 - BUG_ON(info->feature_persistent); + BUG_ON(info->bounce); list_for_each_entry_safe(indirect_page, n, &rinfo->indirect_pages, lru) { list_del(&indirect_page->lru); __free_page(indirect_page); @@ -1283,7 +1289,7 @@ static void blkif_free_ring(struct blkfr continue; =20 rinfo->persistent_gnts_c--; - if (info->feature_persistent) + if (info->bounce) __free_page(persistent_gnt->page); kfree(persistent_gnt); } @@ -1303,7 +1309,7 @@ static void blkif_free_ring(struct blkfr for (j =3D 0; j < segs; j++) { persistent_gnt =3D rinfo->shadow[i].grants_used[j]; gnttab_end_foreign_access(persistent_gnt->gref, 0, 0UL); - if (info->feature_persistent) + if (info->bounce) __free_page(persistent_gnt->page); kfree(persistent_gnt); } @@ -1493,7 +1499,7 @@ static int blkif_completion(unsigned lon data.s =3D s; num_sg =3D s->num_sg; =20 - if (bret->operation =3D=3D BLKIF_OP_READ && info->feature_persistent) { + if (bret->operation =3D=3D BLKIF_OP_READ && info->bounce) { for_each_sg(s->sg, sg, num_sg, i) { BUG_ON(sg->offset + sg->length > PAGE_SIZE); =20 @@ -1552,7 +1558,7 @@ static int blkif_completion(unsigned lon * Add the used indirect page back to the list of * available pages for indirect grefs. */ - if (!info->feature_persistent) { + if (!info->bounce) { indirect_page =3D s->indirect_grants[i]->page; list_add(&indirect_page->lru, &rinfo->indirect_pages); } @@ -1841,6 +1847,10 @@ static int talk_to_blkback(struct xenbus if (!info) return -ENODEV; =20 + /* Check if backend is trusted. */ + info->bounce =3D !xen_blkif_trusted || + !xenbus_read_unsigned(dev->nodename, "trusted", 1); + max_page_order =3D xenbus_read_unsigned(info->xbdev->otherend, "max-ring-page-order", 0); ring_page_order =3D min(xen_blkif_max_ring_order, max_page_order); @@ -2256,10 +2266,10 @@ static int blkfront_setup_indirect(struc if (err) goto out_of_memory; =20 - if (!info->feature_persistent && info->max_indirect_segments) { + if (!info->bounce && info->max_indirect_segments) { /* - * We are using indirect descriptors but not persistent - * grants, we need to allocate a set of pages that can be + * We are using indirect descriptors but don't have a bounce + * buffer, we need to allocate a set of pages that can be * used for mapping indirect grefs */ int num =3D INDIRECT_GREFS(grants) * BLK_RING_SIZE(info); @@ -2352,6 +2362,8 @@ static void blkfront_gather_backend_feat info->feature_persistent =3D !!xenbus_read_unsigned(info->xbdev->otherend, "feature-persistent", 0); + if (info->feature_persistent) + info->bounce =3D true; =20 indirect_segments =3D xenbus_read_unsigned(info->xbdev->otherend, "feature-max-indirect-segments", 0); From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF8BAC433EF for ; Tue, 5 Jul 2022 12:03:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233502AbiGEMDR (ORCPT ); Tue, 5 Jul 2022 08:03:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44486 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233150AbiGEMBk (ORCPT ); Tue, 5 Jul 2022 08:01:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7CE4918395; Tue, 5 Jul 2022 05:01:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 26136B817D2; Tue, 5 Jul 2022 12:01:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F56CC341C7; Tue, 5 Jul 2022 12:01:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022497; bh=k4N6KH1YWbQV3DGzZLvNHzX7b6DSgKb1L14QGC7GHeU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iax06IvFnV13hbDfNOtJiapPhTO/keK60O3aHukHvkVTUfWtfXGu+zZR18IzURDM8 ahO/pDEc7waaGxlZJq9gxIjKjK6ej3/2LowUMak8ZG855V5S5m1dwKKXKjSbjivJga gqWnf76gAbj+ch9CCqXi1y8szEBGIiTIM4ttOi/Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oleksandr Tyshchenko , Stefano Stabellini , Juergen Gross Subject: [PATCH 4.14 27/29] xen/arm: Fix race in RB-tree based P2M accounting Date: Tue, 5 Jul 2022 13:58:15 +0200 Message-Id: <20220705115607.143563466@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oleksandr Tyshchenko commit b75cd218274e01d026dc5240e86fdeb44bbed0c8 upstream. During the PV driver life cycle the mappings are added to the RB-tree by set_foreign_p2m_mapping(), which is called from gnttab_map_refs() and are removed by clear_foreign_p2m_mapping() which is called from gnttab_unmap_refs(). As both functions end up calling __set_phys_to_machine_multi() which updates the RB-tree, this function can be called concurrently. There is already a "p2m_lock" to protect against concurrent accesses, but the problem is that the first read of "phys_to_mach.rb_node" in __set_phys_to_machine_multi() is not covered by it, so this might lead to the incorrect mappings update (removing in our case) in RB-tree. In my environment the related issue happens rarely and only when PV net backend is running, the xen_add_phys_to_mach_entry() claims that it cannot add new pfn <-> mfn mapping to the tree since it is already exists which results in a failure when mapping foreign pages. But there might be other bad consequences related to the non-protected root reads such use-after-free, etc. While at it, also fix the similar usage in __pfn_to_mfn(), so initialize "struct rb_node *n" with the "p2m_lock" held in both functions to avoid possible bad consequences. This is CVE-2022-33744 / XSA-406. Signed-off-by: Oleksandr Tyshchenko Reviewed-by: Stefano Stabellini Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/xen/p2m.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/arch/arm/xen/p2m.c +++ b/arch/arm/xen/p2m.c @@ -61,11 +61,12 @@ out: =20 unsigned long __pfn_to_mfn(unsigned long pfn) { - struct rb_node *n =3D phys_to_mach.rb_node; + struct rb_node *n; struct xen_p2m_entry *entry; unsigned long irqflags; =20 read_lock_irqsave(&p2m_lock, irqflags); + n =3D phys_to_mach.rb_node; while (n) { entry =3D rb_entry(n, struct xen_p2m_entry, rbnode_phys); if (entry->pfn <=3D pfn && @@ -151,10 +152,11 @@ bool __set_phys_to_machine_multi(unsigne int rc; unsigned long irqflags; struct xen_p2m_entry *p2m_entry; - struct rb_node *n =3D phys_to_mach.rb_node; + struct rb_node *n; =20 if (mfn =3D=3D INVALID_P2M_ENTRY) { write_lock_irqsave(&p2m_lock, irqflags); + n =3D phys_to_mach.rb_node; while (n) { p2m_entry =3D rb_entry(n, struct xen_p2m_entry, rbnode_phys); if (p2m_entry->pfn <=3D pfn && From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4439C43334 for ; Tue, 5 Jul 2022 12:05:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233369AbiGEMFv (ORCPT ); Tue, 5 Jul 2022 08:05:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44502 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233159AbiGEMBl (ORCPT ); Tue, 5 Jul 2022 08:01:41 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AE8131839A; Tue, 5 Jul 2022 05:01:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 49E52617C9; Tue, 5 Jul 2022 12:01:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5CF68C341C7; Tue, 5 Jul 2022 12:01:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022499; bh=/wYvsUJnxuTUS1B4t+EWOKud8Tk4NduNwwo9s+mmy08=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Vf+PY2mSo8J9DmGsMztP9yYc/ydDnW1CjcmLrXnCSiOvW0A+6rsaN9tM5LyDVvVmG p8Nq9U+EcNTQSfHFE1or7cEkQfneFA80syP+loX78h1TfL2K3Al1QzuseLZotqOPKO QSSWM7CUX1OfPHm8RiDZzdWOm8K8qcQjIVxOhWbM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Carlo Lobrano , "David S. Miller" , Fabio Porcedda Subject: [PATCH 4.14 28/29] net: usb: qmi_wwan: add Telit 0x1060 composition Date: Tue, 5 Jul 2022 13:58:16 +0200 Message-Id: <20220705115607.173990178@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Carlo Lobrano commit 8d17a33b076d24aa4861f336a125c888fb918605 upstream. This patch adds support for Telit LN920 0x1060 composition 0x1060: tty, adb, rmnet, tty, tty, tty, tty Signed-off-by: Carlo Lobrano Signed-off-by: David S. Miller Cc: Fabio Porcedda Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/usb/qmi_wwan.c +++ b/drivers/net/usb/qmi_wwan.c @@ -1307,6 +1307,7 @@ static const struct usb_device_id produc {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ From nobody Sun Apr 19 05:31:36 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6082FC43334 for ; Tue, 5 Jul 2022 12:03:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233538AbiGEMDW (ORCPT ); Tue, 5 Jul 2022 08:03:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230348AbiGEMBr (ORCPT ); Tue, 5 Jul 2022 08:01:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 979CE18392; Tue, 5 Jul 2022 05:01:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 36951617B9; Tue, 5 Jul 2022 12:01:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17293C341C7; Tue, 5 Jul 2022 12:01:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657022502; bh=L+TEF1izGni3M66cHb4MOAqlNAGDsFriebUnKiySbEE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RWlkTHDehIOdD767cpLbjz5UbH2zJ7xZRcdIIR/vG6w9ixL8vIYI45eAzsqmxls04 YSL8pJY75TjvLp+pOROLx3d+8j7nMTp9YdNxiamKYqfLcdxue+CRQBcezryZU4qUhE ojsJnwWb/pFUJ8m6xaZI6UQfFMbgtr3FV45QsnkQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniele Palmas , =?UTF-8?q?Bj=C3=B8rn=20Mork?= , Jakub Kicinski , Fabio Porcedda Subject: [PATCH 4.14 29/29] net: usb: qmi_wwan: add Telit 0x1070 composition Date: Tue, 5 Jul 2022 13:58:17 +0200 Message-Id: <20220705115607.203432019@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220705115606.333669144@linuxfoundation.org> References: <20220705115606.333669144@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Daniele Palmas commit 94f2a444f28a649926c410eb9a38afb13a83ebe0 upstream. Add the following Telit FN990 composition: 0x1070: tty, adb, rmnet, tty, tty, tty, tty Signed-off-by: Daniele Palmas Acked-by: Bj=C3=B8rn Mork Link: https://lore.kernel.org/r/20211210095722.22269-1-dnlplm@gmail.com Signed-off-by: Jakub Kicinski Cc: Fabio Porcedda Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/usb/qmi_wwan.c +++ b/drivers/net/usb/qmi_wwan.c @@ -1308,6 +1308,7 @@ static const struct usb_device_id produc {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */