From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5DF12C433EF for ; Mon, 11 Jul 2022 09:08:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229530AbiGKJIa (ORCPT ); Mon, 11 Jul 2022 05:08:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47204 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231195AbiGKJH5 (ORCPT ); Mon, 11 Jul 2022 05:07:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CB6DC2497E; Mon, 11 Jul 2022 02:07:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0163CB80D2C; Mon, 11 Jul 2022 09:07:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6C1AAC341CA; Mon, 11 Jul 2022 09:07:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530451; bh=41osInqy4wOa4+2t1XImaRvNj+PBf+rtJFHd/tCOres=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Lmb0JZlxpwT+seIibXmkiL2t6lrOZ5T/uqRPfsiXfsE5ObdCDQmzBON3FDvD0/D1t A3d27dOIN/pBWsacsKuSoEmLSli7raawFDOevUvOE1j2aNpQCOzSdnz1BPPUHDMj+m wdPwEMLg5z4vMOHvUcBZGGeVQPlfEg52atXpuS6U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sabrina Dubroca , Steffen Klassert Subject: [PATCH 4.14 01/17] esp: limit skb_page_frag_refill use to a single page Date: Mon, 11 Jul 2022 11:06:26 +0200 Message-Id: <20220711090536.292670494@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sabrina Dubroca commit 5bd8baab087dff657e05387aee802e70304cc813 upstream. Commit ebe48d368e97 ("esp: Fix possible buffer overflow in ESP transformation") tried to fix skb_page_frag_refill usage in ESP by capping allocsize to 32k, but that doesn't completely solve the issue, as skb_page_frag_refill may return a single page. If that happens, we will write out of bounds, despite the check introduced in the previous patch. This patch forces COW in cases where we would end up calling skb_page_frag_refill with a size larger than a page (first in esp_output_head with tailen, then in esp_output_tail with skb->data_len). Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/net/esp.h | 2 -- net/ipv4/esp4.c | 5 ++--- net/ipv6/esp6.c | 5 ++--- 3 files changed, 4 insertions(+), 8 deletions(-) --- a/include/net/esp.h +++ b/include/net/esp.h @@ -4,8 +4,6 @@ =20 #include =20 -#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER) - struct ip_esp_hdr; =20 static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb) --- a/net/ipv4/esp4.c +++ b/net/ipv4/esp4.c @@ -257,7 +257,6 @@ int esp_output_head(struct xfrm_state *x struct page *page; struct sk_buff *trailer; int tailen =3D esp->tailen; - unsigned int allocsz; =20 /* this is non-NULL only with UDP Encapsulation */ if (x->encap) { @@ -267,8 +266,8 @@ int esp_output_head(struct xfrm_state *x return err; } =20 - allocsz =3D ALIGN(skb->data_len + tailen, L1_CACHE_BYTES); - if (allocsz > ESP_SKB_FRAG_MAXSIZE) + if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE || + ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE) goto cow; =20 if (!skb_cloned(skb)) { --- a/net/ipv6/esp6.c +++ b/net/ipv6/esp6.c @@ -223,10 +223,9 @@ int esp6_output_head(struct xfrm_state * struct page *page; struct sk_buff *trailer; int tailen =3D esp->tailen; - unsigned int allocsz; =20 - allocsz =3D ALIGN(skb->data_len + tailen, L1_CACHE_BYTES); - if (allocsz > ESP_SKB_FRAG_MAXSIZE) + if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE || + ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE) goto cow; =20 if (!skb_cloned(skb)) { From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D5F1C433EF for ; Mon, 11 Jul 2022 09:09:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229863AbiGKJJh (ORCPT ); Mon, 11 Jul 2022 05:09:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50632 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231154AbiGKJI4 (ORCPT ); Mon, 11 Jul 2022 05:08:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA11B22BD7; Mon, 11 Jul 2022 02:07:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6747E6118F; Mon, 11 Jul 2022 09:07:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6E7F7C34115; Mon, 11 Jul 2022 09:07:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530476; bh=ZG6w6HKvEceL0MQx2SuxvYp351/gMcj+5D29fCM8eL4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dtrRazPmNc/O/L9LfUxzlVDtjcHf6VyHhqXWdfm7qqpqxi85f2cCIBv5v3pcofKPa sDEug1kIWP0Y13IHMy4XoB4GzOWQMaaevQRVuHNqmk5mBpJwiQ4iYWmrTZq2yZJ8Is E4Hie5WxxHCVipTTsTi1wuTkyFaEaf/0jfUm1XOs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jann Horn , Christoph Lameter , David Rientjes , Muchun Song , Hyeonggon Yoo <42.hyeyoo@gmail.com>, Vlastimil Babka Subject: [PATCH 4.14 02/17] mm/slub: add missing TID updates on slab deactivation Date: Mon, 11 Jul 2022 11:06:27 +0200 Message-Id: <20220711090536.325380578@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jann Horn commit eeaa345e128515135ccb864c04482180c08e3259 upstream. The fastpath in slab_alloc_node() assumes that c->slab is stable as long as the TID stays the same. However, two places in __slab_alloc() currently don't update the TID when deactivating the CPU slab. If multiple operations race the right way, this could lead to an object getting lost; or, in an even more unlikely situation, it could even lead to an object being freed onto the wrong slab's freelist, messing up the `inuse` counter and eventually causing a page to be freed to the page allocator while it still contains slab objects. (I haven't actually tested these cases though, this is just based on looking at the code. Writing testcases for this stuff seems like it'd be a pain...) The race leading to state inconsistency is (all operations on the same CPU and kmem_cache): - task A: begin do_slab_free(): - read TID - read pcpu freelist (=3D=3DNULL) - check `slab =3D=3D c->slab` (true) - [PREEMPT A->B] - task B: begin slab_alloc_node(): - fastpath fails (`c->freelist` is NULL) - enter __slab_alloc() - slub_get_cpu_ptr() (disables preemption) - enter ___slab_alloc() - take local_lock_irqsave() - read c->freelist as NULL - get_freelist() returns NULL - write `c->slab =3D NULL` - drop local_unlock_irqrestore() - goto new_slab - slub_percpu_partial() is NULL - get_partial() returns NULL - slub_put_cpu_ptr() (enables preemption) - [PREEMPT B->A] - task A: finish do_slab_free(): - this_cpu_cmpxchg_double() succeeds() - [CORRUPT STATE: c->slab=3D=3DNULL, c->freelist!=3DNULL] >From there, the object on c->freelist will get lost if task B is allowed to continue from here: It will proceed to the retry_load_slab label, set c->slab, then jump to load_freelist, which clobbers c->freelist. But if we instead continue as follows, we get worse corruption: - task A: run __slab_free() on object from other struct slab: - CPU_PARTIAL_FREE case (slab was on no list, is now on pcpu partial) - task A: run slab_alloc_node() with NUMA node constraint: - fastpath fails (c->slab is NULL) - call __slab_alloc() - slub_get_cpu_ptr() (disables preemption) - enter ___slab_alloc() - c->slab is NULL: goto new_slab - slub_percpu_partial() is non-NULL - set c->slab to slub_percpu_partial(c) - [CORRUPT STATE: c->slab points to slab-1, c->freelist has objects from slab-2] - goto redo - node_match() fails - goto deactivate_slab - existing c->freelist is passed into deactivate_slab() - inuse count of slab-1 is decremented to account for object from slab-2 At this point, the inuse count of slab-1 is 1 lower than it should be. This means that if we free all allocated objects in slab-1 except for one, SLUB will think that slab-1 is completely unused, and may free its page, leading to use-after-free. Fixes: c17dda40a6a4e ("slub: Separate out kmem_cache_cpu processing from de= activate_slab") Fixes: 03e404af26dc2 ("slub: fast release on full slab") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn Acked-by: Christoph Lameter Acked-by: David Rientjes Reviewed-by: Muchun Song Tested-by: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Vlastimil Babka Link: https://lore.kernel.org/r/20220608182205.2945720-1-jannh@google.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- mm/slub.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/mm/slub.c +++ b/mm/slub.c @@ -2171,6 +2171,7 @@ redo: =20 c->page =3D NULL; c->freelist =3D NULL; + c->tid =3D next_tid(c->tid); } =20 /* @@ -2306,8 +2307,6 @@ static inline void flush_slab(struct kme { stat(s, CPUSLAB_FLUSH); deactivate_slab(s, c->page, c->freelist, c); - - c->tid =3D next_tid(c->tid); } =20 /* @@ -2592,6 +2591,7 @@ redo: =20 if (!freelist) { c->page =3D NULL; + c->tid =3D next_tid(c->tid); stat(s, DEACTIVATE_BYPASS); goto new_slab; } From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5DEDFC433EF for ; Mon, 11 Jul 2022 09:09:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231204AbiGKJJo (ORCPT ); Mon, 11 Jul 2022 05:09:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47284 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231245AbiGKJJN (ORCPT ); Mon, 11 Jul 2022 05:09:13 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 628D227CE0; Mon, 11 Jul 2022 02:08:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E7000B80D2C; Mon, 11 Jul 2022 09:08:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4119DC34115; Mon, 11 Jul 2022 09:07:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530479; bh=++Ww8pPVHs+rvU8WtFnJVr6Tf7qYaVEmgDt46VFu64o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GqRGHU+avjwJpYYjptgUELkf/VLDhQWcO+sDNmYADLLoZzhKDrmdzhSb8Vdwp37SW gOcSTy8ndhapjzdriNDZLyTLIWPUr1C5Gyq5vIwqiTZP7Qm3lJlenUyIcrUqtyEXC9 BRa4V10IFOum2dhAPyjn9FVk2ND8lsa9NO2s/5S4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andreas Larsson , Liang He , Marc Kleine-Budde Subject: [PATCH 4.14 03/17] can: grcan: grcan_probe(): remove extra of_node_get() Date: Mon, 11 Jul 2022 11:06:28 +0200 Message-Id: <20220711090536.356437373@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He commit 562fed945ea482833667f85496eeda766d511386 upstream. In grcan_probe(), of_find_node_by_path() has already increased the refcount. There is no need to call of_node_get() again, so remove it. Link: https://lore.kernel.org/all/20220619070257.4067022-1-windhl@126.com Fixes: 1e93ed26acf0 ("can: grcan: grcan_probe(): fix broken system id check= for errata workaround needs") Cc: stable@vger.kernel.org # v5.18 Cc: Andreas Larsson Signed-off-by: Liang He Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/grcan.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/net/can/grcan.c +++ b/drivers/net/can/grcan.c @@ -1669,7 +1669,6 @@ static int grcan_probe(struct platform_d */ sysid_parent =3D of_find_node_by_path("/ambapp0"); if (sysid_parent) { - of_node_get(sysid_parent); err =3D of_property_read_u32(sysid_parent, "systemid", &sysid); if (!err && ((sysid & GRLIB_VERSION_MASK) >=3D GRCAN_TXBUG_SAFE_GRLIB_VERSION)) From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 034D6CCA47B for ; Mon, 11 Jul 2022 09:09:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229926AbiGKJJz (ORCPT ); Mon, 11 Jul 2022 05:09:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46882 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230053AbiGKJJQ (ORCPT ); Mon, 11 Jul 2022 05:09:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0412427FCC; Mon, 11 Jul 2022 02:08:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A3522B80E5E; Mon, 11 Jul 2022 09:08:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0705C34115; Mon, 11 Jul 2022 09:08:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530482; bh=pILSbY4XJmMlzVTApIp6ncXPXmKzjXMYUZqolYEqo2U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tfIfRfiF/whRsFkem9o3KunOR1qIPajmjIEB+DtghkDRMMYVFymGPdOYHRkiQgd3g t5ddbQmtkeWLNo5Z8bj4axIBKtRgAaPVIr7VTwubOqVV3Fpy0O4IMKIhK26Oi26Gsl C04AC4KW5LsS4STf48oVUm41ldugrDE3j8RWe1H8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rhett Aultman , Marc Kleine-Budde Subject: [PATCH 4.14 04/17] can: gs_usb: gs_usb_open/close(): fix memory leak Date: Mon, 11 Jul 2022 11:06:29 +0200 Message-Id: <20220711090536.387211041@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rhett Aultman commit 2bda24ef95c0311ab93bda00db40486acf30bd0a upstream. The gs_usb driver appears to suffer from a malady common to many USB CAN adapter drivers in that it performs usb_alloc_coherent() to allocate a number of USB request blocks (URBs) for RX, and then later relies on usb_kill_anchored_urbs() to free them, but this doesn't actually free them. As a result, this may be leaking DMA memory that's been used by the driver. This commit is an adaptation of the techniques found in the esd_usb2 driver where a similar design pattern led to a memory leak. It explicitly frees the RX URBs and their DMA memory via a call to usb_free_coherent(). Since the RX URBs were allocated in the gs_can_open(), we remove them in gs_can_close() rather than in the disconnect function as was done in esd_usb2. For more information, see the 928150fad41b ("can: esd_usb2: fix memory leak"). Link: https://lore.kernel.org/all/alpine.DEB.2.22.394.2206031547001.1630869= @thelappy Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices= ") Cc: stable@vger.kernel.org Signed-off-by: Rhett Aultman Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/usb/gs_usb.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) --- a/drivers/net/can/usb/gs_usb.c +++ b/drivers/net/can/usb/gs_usb.c @@ -192,6 +192,8 @@ struct gs_can { =20 struct usb_anchor tx_submitted; atomic_t active_tx_urbs; + void *rxbuf[GS_MAX_RX_URBS]; + dma_addr_t rxbuf_dma[GS_MAX_RX_URBS]; }; =20 /* usb interface struct */ @@ -600,6 +602,7 @@ static int gs_can_open(struct net_device for (i =3D 0; i < GS_MAX_RX_URBS; i++) { struct urb *urb; u8 *buf; + dma_addr_t buf_dma; =20 /* alloc rx urb */ urb =3D usb_alloc_urb(0, GFP_KERNEL); @@ -610,7 +613,7 @@ static int gs_can_open(struct net_device buf =3D usb_alloc_coherent(dev->udev, sizeof(struct gs_host_frame), GFP_KERNEL, - &urb->transfer_dma); + &buf_dma); if (!buf) { netdev_err(netdev, "No memory left for USB buffer\n"); @@ -618,6 +621,8 @@ static int gs_can_open(struct net_device return -ENOMEM; } =20 + urb->transfer_dma =3D buf_dma; + /* fill, anchor, and submit rx urb */ usb_fill_bulk_urb(urb, dev->udev, @@ -641,10 +646,17 @@ static int gs_can_open(struct net_device rc); =20 usb_unanchor_urb(urb); + usb_free_coherent(dev->udev, + sizeof(struct gs_host_frame), + buf, + buf_dma); usb_free_urb(urb); break; } =20 + dev->rxbuf[i] =3D buf; + dev->rxbuf_dma[i] =3D buf_dma; + /* Drop reference, * USB core will take care of freeing it */ @@ -709,13 +721,20 @@ static int gs_can_close(struct net_devic int rc; struct gs_can *dev =3D netdev_priv(netdev); struct gs_usb *parent =3D dev->parent; + unsigned int i; =20 netif_stop_queue(netdev); =20 /* Stop polling */ parent->active_channels--; - if (!parent->active_channels) + if (!parent->active_channels) { usb_kill_anchored_urbs(&parent->rx_submitted); + for (i =3D 0; i < GS_MAX_RX_URBS; i++) + usb_free_coherent(dev->udev, + sizeof(struct gs_host_frame), + dev->rxbuf[i], + dev->rxbuf_dma[i]); + } =20 /* Stop sending URBs */ usb_kill_anchored_urbs(&dev->tx_submitted); From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47340C433EF for ; Mon, 11 Jul 2022 09:10:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229613AbiGKJKB (ORCPT ); Mon, 11 Jul 2022 05:10:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46966 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231266AbiGKJJV (ORCPT ); Mon, 11 Jul 2022 05:09:21 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DFE71286E3; Mon, 11 Jul 2022 02:08:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4DF9FB80E5E; Mon, 11 Jul 2022 09:08:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E82DC34115; Mon, 11 Jul 2022 09:08:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530485; bh=vb+0lighot6AX9XY2AUdCpU/s0sy+Et1zMwoqyMhtNA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2TDjDtVdqXUK38/2rhiXngxCuZcrpHp7Ed8OYCEYAsAron6Gmp3Fb0isFqoghFbPM VnUxwQLW0l9TlZsC8mp+Hzq03fWelB3RvZo/ChjMn+qPzxwVKUh855hl2VR8EmVJ5y MC/q6MjCx4ZbcjbdgXQfMNN4wb1QoQz0lmgOdKUA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , Jakub Kicinski Subject: [PATCH 4.14 05/17] usbnet: fix memory leak in error case Date: Mon, 11 Jul 2022 11:06:30 +0200 Message-Id: <20220711090536.416927837@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Neukum commit b55a21b764c1e182014630fa5486d717484ac58f upstream. usbnet_write_cmd_async() mixed up which buffers need to be freed in which error case. v2: add Fixes tag v3: fix uninitialized buf pointer Fixes: 877bd862f32b8 ("usbnet: introduce usbnet 3 command helpers") Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20220705125351.17309-1-oneukum@suse.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/usb/usbnet.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -2135,7 +2135,7 @@ static void usbnet_async_cmd_cb(struct u int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype, u16 value, u16 index, const void *data, u16 size) { - struct usb_ctrlrequest *req =3D NULL; + struct usb_ctrlrequest *req; struct urb *urb; int err =3D -ENOMEM; void *buf =3D NULL; @@ -2153,7 +2153,7 @@ int usbnet_write_cmd_async(struct usbnet if (!buf) { netdev_err(dev->net, "Error allocating buffer" " in %s!\n", __func__); - goto fail_free; + goto fail_free_urb; } } =20 @@ -2177,14 +2177,21 @@ int usbnet_write_cmd_async(struct usbnet if (err < 0) { netdev_err(dev->net, "Error submitting the control" " message: status=3D%d\n", err); - goto fail_free; + goto fail_free_all; } return 0; =20 +fail_free_all: + kfree(req); fail_free_buf: kfree(buf); -fail_free: - kfree(req); + /* + * avoid a double free + * needed because the flag can be set only + * after filling the URB + */ + urb->transfer_flags =3D 0; +fail_free_urb: usb_free_urb(urb); fail: return err; From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74365C43334 for ; Mon, 11 Jul 2022 09:10:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230060AbiGKJKG (ORCPT ); Mon, 11 Jul 2022 05:10:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46410 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231137AbiGKJJW (ORCPT ); Mon, 11 Jul 2022 05:09:22 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 465FD22BF8; Mon, 11 Jul 2022 02:08:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4635F611A5; Mon, 11 Jul 2022 09:08:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 558A8C34115; Mon, 11 Jul 2022 09:08:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530487; bh=87vGQEQfDaYwPc75I7+wx1o+VbDJU1V1K/ZgNF3NO80=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=k6Z+1T0C8JI+y3FktPhMVdg6nYFGuilJn+3hua4Ez+u8CxEvK5+qU6xGDm5sgImto pMI6yknRuqbWx/TvdiOw6mUNznnNaZS6UWwIdsGXQglV12s9mQ0cnKttKIJN45kdfx bdoIcOJm0rj0HB19ci2lzartX+i3hwFzY3yqL2u0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Jakub Kicinski Subject: [PATCH 4.14 06/17] net: rose: fix UAF bug caused by rose_t0timer_expiry Date: Mon, 11 Jul 2022 11:06:31 +0200 Message-Id: <20220711090536.447480515@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 148ca04518070910739dfc4eeda765057856403d upstream. There are UAF bugs caused by rose_t0timer_expiry(). The root cause is that del_timer() could not stop the timer handler that is running and there is no synchronization. One of the race conditions is shown below: (thread 1) | (thread 2) | rose_device_event | rose_rt_device_down | rose_remove_neigh rose_t0timer_expiry | rose_stop_t0timer(rose_neigh) ... | del_timer(&neigh->t0timer) | kfree(rose_neigh) //[1]FREE neigh->dce_mode //[2]USE | The rose_neigh is deallocated in position [1] and use in position [2]. The crash trace triggered by POC is like below: BUG: KASAN: use-after-free in expire_timers+0x144/0x320 Write of size 8 at addr ffff888009b19658 by task swapper/0/0 ... Call Trace: dump_stack_lvl+0xbf/0xee print_address_description+0x7b/0x440 print_report+0x101/0x230 ? expire_timers+0x144/0x320 kasan_report+0xed/0x120 ? expire_timers+0x144/0x320 expire_timers+0x144/0x320 __run_timers+0x3ff/0x4d0 run_timer_softirq+0x41/0x80 __do_softirq+0x233/0x544 ... This patch changes rose_stop_ftimer() and rose_stop_t0timer() in rose_remove_neigh() to del_timer_sync() in order that the timer handler could be finished before the resources such as rose_neigh and so on are deallocated. As a result, the UAF bugs could be mitigated. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou Link: https://lore.kernel.org/r/20220705125610.77971-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/rose/rose_route.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/rose/rose_route.c +++ b/net/rose/rose_route.c @@ -230,8 +230,8 @@ static void rose_remove_neigh(struct ros { struct rose_neigh *s; =20 - rose_stop_ftimer(rose_neigh); - rose_stop_t0timer(rose_neigh); + del_timer_sync(&rose_neigh->ftimer); + del_timer_sync(&rose_neigh->t0timer); =20 skb_queue_purge(&rose_neigh->queue); From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8811C433EF for ; Mon, 11 Jul 2022 09:10:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231272AbiGKJKJ (ORCPT ); Mon, 11 Jul 2022 05:10:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47102 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230162AbiGKJJe (ORCPT ); Mon, 11 Jul 2022 05:09:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B967228705; Mon, 11 Jul 2022 02:08:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EBA36611A5; Mon, 11 Jul 2022 09:08:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 08E7EC34115; Mon, 11 Jul 2022 09:08:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530490; bh=lYtXQwvRK4CFn7nBebGXd73gog73aQFaLKjhL0F+3Pc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q3fb1bwBCp9VGNkx/oOEns4Pg/BeKaEw//8SVWBTjtLyqUwz2ngxmSjFpDMkQr+4K dJAjSOEMzRPzGFiZk5Q2j+mvS9XwQaw5VtOseRwsb0ciLTsBq3E3Qt/mzN1sNwS9s1 +vCeZgIX7pLvKLJ25/DdP/NJj1jbk/mf/mdZcN0E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Zhang, Bernice" , Jacob Pan , Yian Chen , Joerg Roedel , Zhang@vger.kernel.org Subject: [PATCH 4.14 07/17] iommu/vt-d: Fix PCI bus rescan device hot add Date: Mon, 11 Jul 2022 11:06:32 +0200 Message-Id: <20220711090536.477219460@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yian Chen commit 316f92a705a4c2bf4712135180d56f3cca09243a upstream. Notifier calling chain uses priority to determine the execution order of the notifiers or listeners registered to the chain. PCI bus device hot add utilizes the notification mechanism. The current code sets low priority (INT_MIN) to Intel dmar_pci_bus_notifier and postpones DMAR decoding after adding new device into IOMMU. The result is that struct device pointer cannot be found in DRHD search for the new device's DMAR/IOMMU. Subsequently, the device is put under the "catch-all" IOMMU instead of the correct one. This could cause system hang when device TLB invalidation is sent to the wrong IOMMU. Invalidation timeout error and hard lockup have been observed and data inconsistency/crush may occur as well. This patch fixes the issue by setting a positive priority(1) for dmar_pci_bus_notifier while the priority of IOMMU bus notifier uses the default value(0), therefore DMAR decoding will be in advance of DRHD search for a new device to find the correct IOMMU. Following is a 2-step example that triggers the bug by simulating PCI device hot add behavior in Intel Sapphire Rapids server. echo 1 > /sys/bus/pci/devices/0000:6a:01.0/remove echo 1 > /sys/bus/pci/rescan Fixes: 59ce0515cdaf ("iommu/vt-d: Update DRHD/RMRR/ATSR device scope") Cc: stable@vger.kernel.org # v3.15+ Reported-by: Zhang, Bernice Signed-off-by: Jacob Pan Signed-off-by: Yian Chen Link: https://lore.kernel.org/r/20220521002115.1624069-1-yian.chen@intel.com Signed-off-by: Joerg Roedel Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/iommu/dmar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iommu/dmar.c +++ b/drivers/iommu/dmar.c @@ -374,7 +374,7 @@ static int dmar_pci_bus_notifier(struct =20 static struct notifier_block dmar_pci_bus_nb =3D { .notifier_call =3D dmar_pci_bus_notifier, - .priority =3D INT_MIN, + .priority =3D 1, }; =20 static struct dmar_drhd_unit * From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4AE1EC43334 for ; Mon, 11 Jul 2022 09:10:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230264AbiGKJKO (ORCPT ); Mon, 11 Jul 2022 05:10:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47282 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231154AbiGKJJl (ORCPT ); Mon, 11 Jul 2022 05:09:41 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 42AB428E29; Mon, 11 Jul 2022 02:08:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B245F61183; Mon, 11 Jul 2022 09:08:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BDEDAC34115; Mon, 11 Jul 2022 09:08:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530493; bh=ScC+AZ/Dw/P+jFHGC5l3wAydwM8lOs+uKFo0U/CGB5E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WN2uLwkBdX4jsuVCCbXsKB1FdN9Y5W7HVx6VQE0HwSovx6BZvOpzTdA3vLe2iq36M PP2QztMvcNuUBRPisvZIf8YKSwMkj6QQhHmIF6p2cJZ+nUAP5WoHz3JQdNRqEZrv9W S7/MtWwa9ob24bEGbap7bjhlNDCWiV3dfHHyWkBQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller , Daniel Vetter , Geert Uytterhoeven Subject: [PATCH 4.14 08/17] fbcon: Disallow setting font bigger than screen size Date: Mon, 11 Jul 2022 11:06:33 +0200 Message-Id: <20220711090536.507712550@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller commit 65a01e601dbba8b7a51a2677811f70f783766682 upstream. Prevent that users set a font size which is bigger than the physical screen. It's unlikely this may happen (because screens are usually much larger than= the fonts and each font char is limited to 32x32 pixels), but it may happen on smaller screens/LCD displays. Signed-off-by: Helge Deller Reviewed-by: Daniel Vetter Reviewed-by: Geert Uytterhoeven Cc: stable@vger.kernel.org # v4.14+ Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/video/fbdev/core/fbcon.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2445,6 +2445,11 @@ static int fbcon_set_font(struct vc_data if (charcount !=3D 256 && charcount !=3D 512) return -EINVAL; =20 + /* font bigger than screen resolution ? */ + if (w > FBCON_SWAP(info->var.rotate, info->var.xres, info->var.yres) || + h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres)) + return -EINVAL; + /* Make sure drawing engine can handle the font */ if (!(info->pixmap.blit_x & (1 << (font->width - 1))) || !(info->pixmap.blit_y & (1 << (font->height - 1)))) From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1CABC433EF for ; Mon, 11 Jul 2022 09:10:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231241AbiGKJK1 (ORCPT ); Mon, 11 Jul 2022 05:10:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47032 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231249AbiGKJJz (ORCPT ); Mon, 11 Jul 2022 05:09:55 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C4B99248FF; Mon, 11 Jul 2022 02:08:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 14FA1B80E49; Mon, 11 Jul 2022 09:08:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D986C34115; Mon, 11 Jul 2022 09:08:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530495; bh=3Rmk8qZWpW2yMzZ5SsMzHiMd/7zR1ly06CyIaurBVtM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vcjOS2bRZXj6sKhmckvfvkR/31413NxKrQ3OhOXoHTDUEqbRi1pX5My600YILWOq4 eDU+35/i2Iy8mXIzvpYQDXtJRfkGuwbSPP3lHYxq2gz7aNrnUVvF+0+jWe3wKsR+Tz VmIEuN2LDHxlcyfTdVRWaVSHOlwVOmj5D5Fd/kB8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stephen Boyd , Hsin-Yi Wang , Helge Deller Subject: [PATCH 4.14 09/17] video: of_display_timing.h: include errno.h Date: Mon, 11 Jul 2022 11:06:34 +0200 Message-Id: <20220711090536.537267956@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hsin-Yi Wang commit 3663a2fb325b8782524f3edb0ae32d6faa615109 upstream. If CONFIG_OF is not enabled, default of_get_display_timing() returns an errno, so include the header. Fixes: 422b67e0b31a ("videomode: provide dummy inline functions for !CONFIG= _OF") Suggested-by: Stephen Boyd Signed-off-by: Hsin-Yi Wang Reviewed-by: Stephen Boyd Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/video/of_display_timing.h | 2 ++ 1 file changed, 2 insertions(+) --- a/include/video/of_display_timing.h +++ b/include/video/of_display_timing.h @@ -9,6 +9,8 @@ #ifndef __LINUX_OF_DISPLAY_TIMING_H #define __LINUX_OF_DISPLAY_TIMING_H =20 +#include + struct device_node; struct display_timing; struct display_timings; From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E39FBC433EF for ; Mon, 11 Jul 2022 09:08:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230192AbiGKJIh (ORCPT ); Mon, 11 Jul 2022 05:08:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46792 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231202AbiGKJH5 (ORCPT ); Mon, 11 Jul 2022 05:07:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7522824BD1; Mon, 11 Jul 2022 02:07:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 140F461183; Mon, 11 Jul 2022 09:07:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 24217C34115; Mon, 11 Jul 2022 09:07:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530454; bh=K6jNGp2dUuNiWhAggovJ4j01QWBZArB13C35cE1qd8I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m2fov78FFlOSy9i4P6VekJJqeiT4gKFzmb2fvrqTyNiRLbEJyNX/cjxDddxzUimnN 0Vk85lvMH98rACAMcIIwLh9O4lg8SOuzBOa40hZJxYOWpldVGdYdZrwUR02SfqPiI8 LYwqEGw67seDOqgmdq+rotfYR1ZBMMklQb5k1o+0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sachin Sant , "Jason A. Donenfeld" , Michael Ellerman Subject: [PATCH 4.14 10/17] powerpc/powernv: delay rng platform device creation until later in boot Date: Mon, 11 Jul 2022 11:06:35 +0200 Message-Id: <20220711090536.567996594@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason A. Donenfeld commit 887502826549caa7e4215fd9e628f48f14c0825a upstream. The platform device for the rng must be created much later in boot. Otherwise it tries to connect to a parent that doesn't yet exist, resulting in this splat: [ 0.000478] kobject: '(null)' ((____ptrval____)): is not initialized, = yet kobject_get() is being called. [ 0.002925] [c000000002a0fb30] [c00000000073b0bc] kobject_get+0x8c/0x1= 00 (unreliable) [ 0.003071] [c000000002a0fba0] [c00000000087e464] device_add+0xf4/0xb00 [ 0.003194] [c000000002a0fc80] [c000000000a7f6e4] of_device_add+0x64/0= x80 [ 0.003321] [c000000002a0fcb0] [c000000000a800d0] of_platform_device_c= reate_pdata+0xd0/0x1b0 [ 0.003476] [c000000002a0fd00] [c00000000201fa44] pnv_get_random_long_= early+0x240/0x2e4 [ 0.003623] [c000000002a0fe20] [c000000002060c38] random_init+0xc0/0x2= 14 This patch fixes the issue by doing the platform device creation inside of machine_subsys_initcall. Fixes: f3eac426657d ("powerpc/powernv: wire up rng during setup_arch") Cc: stable@vger.kernel.org Reported-by: Sachin Sant Signed-off-by: Jason A. Donenfeld Tested-by: Sachin Sant [mpe: Change "of node" to "platform device" in change log] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220630121654.1939181-1-Jason@zx2c4.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/powerpc/platforms/powernv/rng.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) --- a/arch/powerpc/platforms/powernv/rng.c +++ b/arch/powerpc/platforms/powernv/rng.c @@ -176,12 +176,8 @@ static int __init pnv_get_random_long_ea NULL) !=3D pnv_get_random_long_early) return 0; =20 - for_each_compatible_node(dn, NULL, "ibm,power-rng") { - if (rng_create(dn)) - continue; - /* Create devices for hwrng driver */ - of_platform_device_create(dn, NULL, NULL); - } + for_each_compatible_node(dn, NULL, "ibm,power-rng") + rng_create(dn); =20 if (!ppc_md.get_random_seed) return 0; @@ -205,10 +201,18 @@ void __init pnv_rng_init(void) =20 static int __init pnv_rng_late_init(void) { + struct device_node *dn; unsigned long v; + /* In case it wasn't called during init for some other reason. */ if (ppc_md.get_random_seed =3D=3D pnv_get_random_long_early) pnv_get_random_long_early(&v); + + if (ppc_md.get_random_seed =3D=3D powernv_get_random_long) { + for_each_compatible_node(dn, NULL, "ibm,power-rng") + of_platform_device_create(dn, NULL, NULL); + } + return 0; } machine_subsys_initcall(powernv, pnv_rng_late_init); From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B5DCC43334 for ; Mon, 11 Jul 2022 09:08:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231166AbiGKJIx (ORCPT ); Mon, 11 Jul 2022 05:08:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46664 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231154AbiGKJII (ORCPT ); Mon, 11 Jul 2022 05:08:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D51222253D; Mon, 11 Jul 2022 02:07:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5E624B80D2C; Mon, 11 Jul 2022 09:07:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C4FD9C34115; Mon, 11 Jul 2022 09:07:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530457; bh=I+1qzEEFcQrKrVfMqDFwcSCOAGZs8oqZHD9xM5Q2sDE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ftk4c6WRe5KhF1a4Nip9iHTWz0rFOL6Zauc2KAs4Ye97mt35eteTP+k5KPzjvk5tE Seve13WIRwYt9wGxLttzruDXTMbsYQhi9xs29vGrWhF33fkVOd4PRlwh1xQ9Xa1XK4 D71zX4DwvJI6ovFZTS1SB6fgRDFtV0hZfl4nCDsg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paolo Bonzini , Eric Sandeen , "Darrick J. Wong" , Kuniyuki Iwashima Subject: [PATCH 4.14 11/17] xfs: remove incorrect ASSERT in xfs_rename Date: Mon, 11 Jul 2022 11:06:36 +0200 Message-Id: <20220711090536.598200765@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Sandeen commit e445976537ad139162980bee015b7364e5b64fff upstream. This ASSERT in xfs_rename is a) incorrect, because (RENAME_WHITEOUT|RENAME_NOREPLACE) is a valid combination, and b) unnecessary, because actual invalid flag combinations are already handled at the vfs level in do_renameat2() before we get called. So, remove it. Reported-by: Paolo Bonzini Signed-off-by: Eric Sandeen Reviewed-by: Darrick J. Wong Signed-off-by: Darrick J. Wong Fixes: 7dcf5c3e4527 ("xfs: add RENAME_WHITEOUT support") Signed-off-by: Kuniyuki Iwashima Acked-by: Darrick J. Wong Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/xfs/xfs_inode.c | 1 - 1 file changed, 1 deletion(-) --- a/fs/xfs/xfs_inode.c +++ b/fs/xfs/xfs_inode.c @@ -2964,7 +2964,6 @@ xfs_rename( * appropriately. */ if (flags & RENAME_WHITEOUT) { - ASSERT(!(flags & (RENAME_NOREPLACE | RENAME_EXCHANGE))); error =3D xfs_rename_alloc_whiteout(target_dp, &wip); if (error) return error; From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B137FC433EF for ; Mon, 11 Jul 2022 09:09:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229927AbiGKJJB (ORCPT ); Mon, 11 Jul 2022 05:09:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46940 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229798AbiGKJIK (ORCPT ); Mon, 11 Jul 2022 05:08:10 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2BD9225582; Mon, 11 Jul 2022 02:07:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 85FA261183; Mon, 11 Jul 2022 09:07:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 911D5C34115; Mon, 11 Jul 2022 09:07:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530459; bh=JnbQUXFmoCPU/Ryxi5nJ3JILasfWjNYUzM7FYb5s3Dg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0C8b9GHa9/wtNEnNQxOi2EXgteLMSvBUuYMo8nFmjfX3aiaWzZvmxHuxCzH13aISO wiB4uPDQ8bw4UFacgk7Mej5XPqyufBqFgVVOF/+t0AOLuRUDVE7Hv8zpKXoGKzn9me lBY5CYbYyrS3hTS5KPFwXDSdUzLUhSEYyXTVKjn0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Samuel Holland , Jernej Skrabec , Linus Walleij , Sasha Levin Subject: [PATCH 4.14 12/17] pinctrl: sunxi: a83t: Fix NAND function name for some pins Date: Mon, 11 Jul 2022 11:06:37 +0200 Message-Id: <20220711090536.628367217@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Samuel Holland [ Upstream commit aaefa29270d9551b604165a08406543efa9d16f5 ] The other NAND pins on Port C use the "nand0" function name. "nand0" also matches all of the other Allwinner SoCs. Fixes: 4730f33f0d82 ("pinctrl: sunxi: add allwinner A83T PIO controller sup= port") Signed-off-by: Samuel Holland Acked-by: Jernej Skrabec Link: https://lore.kernel.org/r/20220526024956.49500-1-samuel@sholland.org Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/s= unxi/pinctrl-sun8i-a83t.c index 4ada80317a3b..b5c1a8f363f3 100644 --- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c +++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c @@ -158,26 +158,26 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = =3D { SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 14), SUNXI_FUNCTION(0x0, "gpio_in"), SUNXI_FUNCTION(0x1, "gpio_out"), - SUNXI_FUNCTION(0x2, "nand"), /* DQ6 */ + SUNXI_FUNCTION(0x2, "nand0"), /* DQ6 */ SUNXI_FUNCTION(0x3, "mmc2")), /* D6 */ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 15), SUNXI_FUNCTION(0x0, "gpio_in"), SUNXI_FUNCTION(0x1, "gpio_out"), - SUNXI_FUNCTION(0x2, "nand"), /* DQ7 */ + SUNXI_FUNCTION(0x2, "nand0"), /* DQ7 */ SUNXI_FUNCTION(0x3, "mmc2")), /* D7 */ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 16), SUNXI_FUNCTION(0x0, "gpio_in"), SUNXI_FUNCTION(0x1, "gpio_out"), - SUNXI_FUNCTION(0x2, "nand"), /* DQS */ + SUNXI_FUNCTION(0x2, "nand0"), /* DQS */ SUNXI_FUNCTION(0x3, "mmc2")), /* RST */ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 17), SUNXI_FUNCTION(0x0, "gpio_in"), SUNXI_FUNCTION(0x1, "gpio_out"), - SUNXI_FUNCTION(0x2, "nand")), /* CE2 */ + SUNXI_FUNCTION(0x2, "nand0")), /* CE2 */ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 18), SUNXI_FUNCTION(0x0, "gpio_in"), SUNXI_FUNCTION(0x1, "gpio_out"), - SUNXI_FUNCTION(0x2, "nand")), /* CE3 */ + SUNXI_FUNCTION(0x2, "nand0")), /* CE3 */ /* Hole */ SUNXI_PIN(SUNXI_PINCTRL_PIN(D, 2), SUNXI_FUNCTION(0x0, "gpio_in"), --=20 2.35.1 From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2DE8C433EF for ; Mon, 11 Jul 2022 09:09:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231173AbiGKJJE (ORCPT ); Mon, 11 Jul 2022 05:09:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46992 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230520AbiGKJIQ (ORCPT ); Mon, 11 Jul 2022 05:08:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AD51222B1D; Mon, 11 Jul 2022 02:07:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3777C6118F; Mon, 11 Jul 2022 09:07:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 44D3DC34115; Mon, 11 Jul 2022 09:07:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530462; bh=aFXRT0ma0toellNu+x8gD8/rkeB50zhZA+nMSArnUY0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tXpajff7PIKRp4sedCcHp0bDwb99bAi8hLL3O3VBBNq3RQEd4wYgbfL14JifbPqWF 8RvyXmZLbvx56zxlpUGTebDSztIekcpbjwihI99AoUB0OO7Cn0sFPfwpJykoCLl9+6 VfW3YjAmNkhzrEFBxUB0A/caL3KWieP3el227hBU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Satish Nagireddy , Lars-Peter Clausen , Michal Simek , Wolfram Sang , Sasha Levin Subject: [PATCH 4.14 13/17] i2c: cadence: Unregister the clk notifier in error path Date: Mon, 11 Jul 2022 11:06:38 +0200 Message-Id: <20220711090536.658096693@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Satish Nagireddy [ Upstream commit 3501f0c663063513ad604fb1b3f06af637d3396d ] This patch ensures that the clock notifier is unregistered when driver probe is returning error. Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller") Signed-off-by: Satish Nagireddy Tested-by: Lars-Peter Clausen Reviewed-by: Michal Simek Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/i2c/busses/i2c-cadence.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/i2c/busses/i2c-cadence.c +++ b/drivers/i2c/busses/i2c-cadence.c @@ -990,6 +990,7 @@ static int cdns_i2c_probe(struct platfor return 0; =20 err_clk_dis: + clk_notifier_unregister(id->clk, &id->clk_rate_change_nb); clk_disable_unprepare(id->clk); pm_runtime_set_suspended(&pdev->dev); pm_runtime_disable(&pdev->dev); From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F28DC43334 for ; Mon, 11 Jul 2022 09:09:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231203AbiGKJJG (ORCPT ); Mon, 11 Jul 2022 05:09:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46730 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230060AbiGKJIV (ORCPT ); Mon, 11 Jul 2022 05:08:21 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AF8F6255A0; Mon, 11 Jul 2022 02:07:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F3D4C61183; Mon, 11 Jul 2022 09:07:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09DD0C34115; Mon, 11 Jul 2022 09:07:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530465; bh=lPdGCGY4nCPJiAo2k5l1xKVFPxrsnk/2+JWwawIClYA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=itdkMG6JjUujmTh/CDihpCuzpBdkUTy+uA6c0T6DFTB1BPStItwjfE5M+fFf2byZE mIW6Y0xWDky4/ulsFTFqtqmLECbCeOYpb5qumGuThJAktZIQ+8s7imejawvgbdBkHn 5tpbvb7cMc4kF0lUukb0HGfRof9C1w2RDUJYolj0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Itay Iellin , Matthew Wilcox , Linus Torvalds Subject: [PATCH 4.14 14/17] ida: dont use BUG_ON() for debugging Date: Mon, 11 Jul 2022 11:06:39 +0200 Message-Id: <20220711090536.687509539@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Torvalds commit fc82bbf4dede758007763867d0282353c06d1121 upstream. This is another old BUG_ON() that just shouldn't exist (see also commit a382f8fee42c: "signal handling: don't use BUG_ON() for debugging"). In fact, as Matthew Wilcox points out, this condition shouldn't really even result in a warning, since a negative id allocation result is just a normal allocation failure: "I wonder if we should even warn here -- sure, the caller is trying to free something that wasn't allocated, but we don't warn for kfree(NULL)" and goes on to point out how that current error check is only causing people to unnecessarily do their own index range checking before freeing it. This was noted by Itay Iellin, because the bluetooth HCI socket cookie code does *not* do that range checking, and ends up just freeing the error case too, triggering the BUG_ON(). The HCI code requires CAP_NET_RAW, and seems to just result in an ugly splat, but there really is no reason to BUG_ON() here, and we have generally striven for allocation models where it's always ok to just do free(alloc()); even if the allocation were to fail for some random reason (usually obviously that "random" reason being some resource limit). Fixes: 88eca0207cf1 ("ida: simplified functions for id allocation") Reported-by: Itay Iellin Suggested-by: Matthew Wilcox Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- lib/idr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/lib/idr.c +++ b/lib/idr.c @@ -498,7 +498,9 @@ void ida_simple_remove(struct ida *ida, { unsigned long flags; =20 - BUG_ON((int)id < 0); + if ((int)id < 0) + return; + spin_lock_irqsave(&simple_ida_lock, flags); ida_remove(ida, id); spin_unlock_irqrestore(&simple_ida_lock, flags); From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F014EC433EF for ; Mon, 11 Jul 2022 09:09:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231207AbiGKJJP (ORCPT ); Mon, 11 Jul 2022 05:09:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47402 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229638AbiGKJIi (ORCPT ); Mon, 11 Jul 2022 05:08:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5952022B26; Mon, 11 Jul 2022 02:07:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A2BA6B80E7B; Mon, 11 Jul 2022 09:07:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12064C34115; Mon, 11 Jul 2022 09:07:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530468; bh=8tFdo+OIIS3mTEzo0rS2Tz8lJWzmLaRAn8Rg1nhuTjE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2MFfU6I7TkLRps5DBMJBzDrL2zd/YSZCbzmNN9XkxOV5ZaafPfYHssmzjgL3EN3C8 noWM7VG+Nna9j0LDrDqnnFgwWyBXWdNg40ZEJfegtiaM5qF/vcuHpmrnrQqeJgCQiw S20xk5CgdCzG6asEGbLeQfm+ngezBkQVQ2ju2ez8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Walle , Vinod Koul Subject: [PATCH 4.14 15/17] dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly Date: Mon, 11 Jul 2022 11:06:40 +0200 Message-Id: <20220711090536.717217005@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Walle commit 3770d92bd5237d686e49da7b2fb86f53ee6ed259 upstream. It seems that it is valid to have less than the requested number of descriptors. But what is not valid and leads to subsequent errors is to have zero descriptors. In that case, abort the probing. Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended D= MA Controller driver") Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20220526135111.1470926-1-michael@walle.cc Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/dma/at_xdmac.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/dma/at_xdmac.c +++ b/drivers/dma/at_xdmac.c @@ -1804,6 +1804,11 @@ static int at_xdmac_alloc_chan_resources for (i =3D 0; i < init_nr_desc_per_channel; i++) { desc =3D at_xdmac_alloc_desc(chan, GFP_ATOMIC); if (!desc) { + if (i =3D=3D 0) { + dev_warn(chan2dev(chan), + "can't allocate any descriptors\n"); + return -EIO; + } dev_warn(chan2dev(chan), "only %d descriptors have been allocated\n", i); break; From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2399DC43334 for ; Mon, 11 Jul 2022 09:09:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229986AbiGKJJT (ORCPT ); Mon, 11 Jul 2022 05:09:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46882 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230056AbiGKJIq (ORCPT ); Mon, 11 Jul 2022 05:08:46 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A61E4275C0; Mon, 11 Jul 2022 02:07:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BD4BF6118F; Mon, 11 Jul 2022 09:07:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C612CC341CD; Mon, 11 Jul 2022 09:07:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530471; bh=CJBE30fgZXe3monlOPi4HZcMFV3BbSj4yu2McIeje50=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=clJTqzAUaBixZgu1sUEE8eXG+1d+cekYuk43qjFLmrxYESosYE7ZeZ0RFb43MfGIJ wcTKN9cgaW3CsM8Lv9uVUhkIrLeu3/aYpyj1iTlIP9qW5ws6strNgtjlyZ/mDmFUhB QPvtpV/6xMAhlnbUTjA9cfXs2dgMlS1DlsONNAy4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Vinod Koul Subject: [PATCH 4.14 16/17] dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate Date: Mon, 11 Jul 2022 11:06:41 +0200 Message-Id: <20220711090536.747481497@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin commit c132fe78ad7b4ce8b5d49a501a15c29d08eeb23a upstream. of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not needed anymore. Add missing of_node_put() in to fix this. Fixes: ec9bfa1e1a79 ("dmaengine: ti-dma-crossbar: dra7: Use bitops instead = of idr") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220605042723.17668-2-linmq006@gmail.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/dma/ti-dma-crossbar.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/dma/ti-dma-crossbar.c +++ b/drivers/dma/ti-dma-crossbar.c @@ -274,6 +274,7 @@ static void *ti_dra7_xbar_route_allocate mutex_unlock(&xbar->mutex); dev_err(&pdev->dev, "Run out of free DMA requests\n"); kfree(map); + of_node_put(dma_spec->np); return ERR_PTR(-ENOMEM); } set_bit(map->xbar_out, xbar->dma_inuse); From nobody Sat Apr 18 21:00:50 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97DDAC433EF for ; Mon, 11 Jul 2022 09:09:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229737AbiGKJJ1 (ORCPT ); Mon, 11 Jul 2022 05:09:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46728 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230103AbiGKJIx (ORCPT ); Mon, 11 Jul 2022 05:08:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DB31C237D7; Mon, 11 Jul 2022 02:07:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 701CCB80E7A; Mon, 11 Jul 2022 09:07:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 93A17C341C0; Mon, 11 Jul 2022 09:07:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530474; bh=eAlf2ThEJ0oh3s9MfqamQLqIhi0NIAtmAN9WqohRE7s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LitSIO2iQuiK8VsBtaD2VuAEkrxruJng/Op+1h9tOlEZ7zJel2LNKeOKwavPXJMOF IM7XD3u+mtzsjM8dMgDeZpE+hxg+DL+LEWFWwdl8AdiV6KPRKEFCACQO4wv236jT0q 7HEhh6QJ0R5TJ5Cy+0+hiatIZysYlm7JrDG6TNvs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Peter Ujfalusi , Vinod Koul Subject: [PATCH 4.14 17/17] dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate Date: Mon, 11 Jul 2022 11:06:42 +0200 Message-Id: <20220711090536.776114629@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin commit 615a4bfc426e11dba05c2cf343f9ac752fb381d2 upstream. of_find_device_by_node() takes reference, we should use put_device() to release it when not need anymore. Fixes: a074ae38f859 ("dmaengine: Add driver for TI DMA crossbar on DRA7x") Signed-off-by: Miaoqian Lin Acked-by: Peter Ujfalusi Link: https://lore.kernel.org/r/20220605042723.17668-1-linmq006@gmail.com Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/dma/ti-dma-crossbar.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/dma/ti-dma-crossbar.c +++ b/drivers/dma/ti-dma-crossbar.c @@ -251,6 +251,7 @@ static void *ti_dra7_xbar_route_allocate if (dma_spec->args[0] >=3D xbar->xbar_requests) { dev_err(&pdev->dev, "Invalid XBAR request number: %d\n", dma_spec->args[0]); + put_device(&pdev->dev); return ERR_PTR(-EINVAL); } =20 @@ -258,12 +259,14 @@ static void *ti_dra7_xbar_route_allocate dma_spec->np =3D of_parse_phandle(ofdma->of_node, "dma-masters", 0); if (!dma_spec->np) { dev_err(&pdev->dev, "Can't get DMA master\n"); + put_device(&pdev->dev); return ERR_PTR(-EINVAL); } =20 map =3D kzalloc(sizeof(*map), GFP_KERNEL); if (!map) { of_node_put(dma_spec->np); + put_device(&pdev->dev); return ERR_PTR(-ENOMEM); } =20 @@ -275,6 +278,7 @@ static void *ti_dra7_xbar_route_allocate dev_err(&pdev->dev, "Run out of free DMA requests\n"); kfree(map); of_node_put(dma_spec->np); + put_device(&pdev->dev); return ERR_PTR(-ENOMEM); } set_bit(map->xbar_out, xbar->dma_inuse);