From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6CB4C32772 for ; Tue, 23 Aug 2022 09:29:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349404AbiHWJ3h (ORCPT ); Tue, 23 Aug 2022 05:29:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52444 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351151AbiHWJ0o (ORCPT ); Tue, 23 Aug 2022 05:26:44 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 50EBC91094; Tue, 23 Aug 2022 01:37:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EFA6F614C5; Tue, 23 Aug 2022 08:35:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F3F7AC433D6; Tue, 23 Aug 2022 08:35:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243745; bh=iJZpFLRwvDbeVZ/DqC+ffQrnPhgOnA1QgJ3ZxT8FJCc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qlUhYW5yUywWxAPe3aRgo57zi6dsA/Lkhu8eVBs39yzSROYjGIuD3bQYkuxOBnNz0 gkitNaRcBInZU5oINYX2eRF+6oZyqXlsuOMrz0ZJ//GeOoFNmBTyFrIuSVfooCcYcu 4WDQVcM2+5298Xu2uSNYyvYuAQ1y5ACK5NLbGA50= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Lee Jones , Luiz Augusto von Dentz Subject: [PATCH 4.14 001/229] Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put Date: Tue, 23 Aug 2022 10:22:42 +0200 Message-Id: <20220823080053.272976849@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Luiz Augusto von Dentz commit d0be8347c623e0ac4202a1d4e0373882821f56b0 upstream. This fixes the following trace which is caused by hci_rx_work starting up *after* the final channel reference has been put() during sock_close() but *before* the references to the channel have been destroyed, so instead the code now rely on kref_get_unless_zero/l2cap_chan_hold_unless_zero to prevent referencing a channel that is about to be destroyed. refcount_t: increment on 0; use-after-free. BUG: KASAN: use-after-free in refcount_dec_and_test+0x20/0xd0 Read of size 4 at addr ffffffc114f5bf18 by task kworker/u17:14/705 CPU: 4 PID: 705 Comm: kworker/u17:14 Tainted: G S W 4.14.234-00003-g1fb6d0bd49a4-dirty #28 Hardware name: Qualcomm Technologies, Inc. SM8150 V2 PM8150 Google Inc. MSM sm8150 Flame DVT (DT) Workqueue: hci0 hci_rx_work Call trace: dump_backtrace+0x0/0x378 show_stack+0x20/0x2c dump_stack+0x124/0x148 print_address_description+0x80/0x2e8 __kasan_report+0x168/0x188 kasan_report+0x10/0x18 __asan_load4+0x84/0x8c refcount_dec_and_test+0x20/0xd0 l2cap_chan_put+0x48/0x12c l2cap_recv_frame+0x4770/0x6550 l2cap_recv_acldata+0x44c/0x7a4 hci_acldata_packet+0x100/0x188 hci_rx_work+0x178/0x23c process_one_work+0x35c/0x95c worker_thread+0x4cc/0x960 kthread+0x1a8/0x1c4 ret_from_fork+0x10/0x18 Cc: stable@kernel.org Reported-by: Lee Jones Signed-off-by: Luiz Augusto von Dentz Tested-by: Lee Jones Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/net/bluetooth/l2cap.h | 1=20 net/bluetooth/l2cap_core.c | 61 +++++++++++++++++++++++++++++++++----= ----- 2 files changed, 49 insertions(+), 13 deletions(-) --- a/include/net/bluetooth/l2cap.h +++ b/include/net/bluetooth/l2cap.h @@ -798,6 +798,7 @@ enum { }; =20 void l2cap_chan_hold(struct l2cap_chan *c); +struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c); void l2cap_chan_put(struct l2cap_chan *c); =20 static inline void l2cap_chan_lock(struct l2cap_chan *chan) --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -113,7 +113,8 @@ static struct l2cap_chan *__l2cap_get_ch } =20 /* Find channel with given SCID. - * Returns locked channel. */ + * Returns a reference locked channel. + */ static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid) { @@ -121,15 +122,19 @@ static struct l2cap_chan *l2cap_get_chan =20 mutex_lock(&conn->chan_lock); c =3D __l2cap_get_chan_by_scid(conn, cid); - if (c) - l2cap_chan_lock(c); + if (c) { + /* Only lock if chan reference is not 0 */ + c =3D l2cap_chan_hold_unless_zero(c); + if (c) + l2cap_chan_lock(c); + } mutex_unlock(&conn->chan_lock); =20 return c; } =20 /* Find channel with given DCID. - * Returns locked channel. + * Returns a reference locked channel. */ static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid) @@ -138,8 +143,12 @@ static struct l2cap_chan *l2cap_get_chan =20 mutex_lock(&conn->chan_lock); c =3D __l2cap_get_chan_by_dcid(conn, cid); - if (c) - l2cap_chan_lock(c); + if (c) { + /* Only lock if chan reference is not 0 */ + c =3D l2cap_chan_hold_unless_zero(c); + if (c) + l2cap_chan_lock(c); + } mutex_unlock(&conn->chan_lock); =20 return c; @@ -164,8 +173,12 @@ static struct l2cap_chan *l2cap_get_chan =20 mutex_lock(&conn->chan_lock); c =3D __l2cap_get_chan_by_ident(conn, ident); - if (c) - l2cap_chan_lock(c); + if (c) { + /* Only lock if chan reference is not 0 */ + c =3D l2cap_chan_hold_unless_zero(c); + if (c) + l2cap_chan_lock(c); + } mutex_unlock(&conn->chan_lock); =20 return c; @@ -491,6 +504,16 @@ void l2cap_chan_hold(struct l2cap_chan * kref_get(&c->kref); } =20 +struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c) +{ + BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); + + if (!kref_get_unless_zero(&c->kref)) + return NULL; + + return c; +} + void l2cap_chan_put(struct l2cap_chan *c) { BT_DBG("chan %p orig refcnt %d", c, kref_read(&c->kref)); @@ -1803,7 +1826,10 @@ static struct l2cap_chan *l2cap_global_c src_match =3D !bacmp(&c->src, src); dst_match =3D !bacmp(&c->dst, dst); if (src_match && dst_match) { - l2cap_chan_hold(c); + c =3D l2cap_chan_hold_unless_zero(c); + if (!c) + continue; + read_unlock(&chan_list_lock); return c; } @@ -1818,7 +1844,7 @@ static struct l2cap_chan *l2cap_global_c } =20 if (c1) - l2cap_chan_hold(c1); + c1 =3D l2cap_chan_hold_unless_zero(c1); =20 read_unlock(&chan_list_lock); =20 @@ -4204,6 +4230,7 @@ static inline int l2cap_config_req(struc =20 unlock: l2cap_chan_unlock(chan); + l2cap_chan_put(chan); return err; } =20 @@ -4316,6 +4343,7 @@ static inline int l2cap_config_rsp(struc =20 done: l2cap_chan_unlock(chan); + l2cap_chan_put(chan); return err; } =20 @@ -5044,6 +5072,7 @@ send_move_response: l2cap_send_move_chan_rsp(chan, result); =20 l2cap_chan_unlock(chan); + l2cap_chan_put(chan); =20 return 0; } @@ -5136,6 +5165,7 @@ static void l2cap_move_continue(struct l } =20 l2cap_chan_unlock(chan); + l2cap_chan_put(chan); } =20 static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid, @@ -5165,6 +5195,7 @@ static void l2cap_move_fail(struct l2cap l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); =20 l2cap_chan_unlock(chan); + l2cap_chan_put(chan); } =20 static int l2cap_move_channel_rsp(struct l2cap_conn *conn, @@ -5228,6 +5259,7 @@ static int l2cap_move_channel_confirm(st l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid); =20 l2cap_chan_unlock(chan); + l2cap_chan_put(chan); =20 return 0; } @@ -5263,6 +5295,7 @@ static inline int l2cap_move_channel_con } =20 l2cap_chan_unlock(chan); + l2cap_chan_put(chan); =20 return 0; } @@ -5635,12 +5668,11 @@ static inline int l2cap_le_credits(struc if (credits > max_credits) { BT_ERR("LE credits overflow"); l2cap_send_disconn_req(chan, ECONNRESET); - l2cap_chan_unlock(chan); =20 /* Return 0 so that we don't trigger an unnecessary * command reject packet. */ - return 0; + goto unlock; } =20 chan->tx_credits +=3D credits; @@ -5651,7 +5683,9 @@ static inline int l2cap_le_credits(struc if (chan->tx_credits) chan->ops->resume(chan); =20 +unlock: l2cap_chan_unlock(chan); + l2cap_chan_put(chan); =20 return 0; } @@ -6949,6 +6983,7 @@ drop: =20 done: l2cap_chan_unlock(chan); + l2cap_chan_put(chan); } =20 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, @@ -7353,7 +7388,7 @@ static struct l2cap_chan *l2cap_global_f if (src_type !=3D c->src_type) continue; =20 - l2cap_chan_hold(c); + c =3D l2cap_chan_hold_unless_zero(c); read_unlock(&chan_list_lock); return c; } From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4BBF9C32772 for ; Tue, 23 Aug 2022 09:33:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350881AbiHWJdB (ORCPT ); Tue, 23 Aug 2022 05:33:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39410 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351128AbiHWJbU (ORCPT ); Tue, 23 Aug 2022 05:31:20 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 38B4015A2E; Tue, 23 Aug 2022 01:38:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8DC38B81C28; Tue, 23 Aug 2022 08:37:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DCB96C433C1; Tue, 23 Aug 2022 08:37:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243844; bh=yagiaS4psLuXibb3+PS+oAKKqpiYlNe2XinfS2S4DwQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jQTNYKchK0m+tY8zXYbGr6G6zAWlSEe3XWmpewHmKghXL9VvVCIy6yCVAZpQAYWJL 44seLxDmOmJdrrSsGcz1KWtAoNMLzkgOjYjAwdsLEn6/wdRzIdW8oEQHIYH1b4ohbw jFtddZm7AW6J5hHhA8iW/KqDHB9DklYSYs5OMvuw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, ChenXiaoSong , Hawkins Jiawei , Anton Altaparmakov , Yongqiang Liu , Zhang Yi , Zhang Xiaoxu , Andrew Morton Subject: [PATCH 4.14 002/229] ntfs: fix use-after-free in ntfs_ucsncmp() Date: Tue, 23 Aug 2022 10:22:43 +0200 Message-Id: <20220823080053.326718526@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: ChenXiaoSong commit 38c9c22a85aeed28d0831f230136e9cf6fa2ed44 upstream. Syzkaller reported use-after-free bug as follows: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in ntfs_ucsncmp+0x123/0x130 Read of size 2 at addr ffff8880751acee8 by task a.out/879 CPU: 7 PID: 879 Comm: a.out Not tainted 5.19.0-rc4-next-20220630-00001-gcc5= 218c8bd2c-dirty #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd= 239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x1c0/0x2b0 print_address_description.constprop.0.cold+0xd4/0x484 print_report.cold+0x55/0x232 kasan_report+0xbf/0xf0 ntfs_ucsncmp+0x123/0x130 ntfs_are_names_equal.cold+0x2b/0x41 ntfs_attr_find+0x43b/0xb90 ntfs_attr_lookup+0x16d/0x1e0 ntfs_read_locked_attr_inode+0x4aa/0x2360 ntfs_attr_iget+0x1af/0x220 ntfs_read_locked_inode+0x246c/0x5120 ntfs_iget+0x132/0x180 load_system_files+0x1cc6/0x3480 ntfs_fill_super+0xa66/0x1cf0 mount_bdev+0x38d/0x460 legacy_get_tree+0x10d/0x220 vfs_get_tree+0x93/0x300 do_new_mount+0x2da/0x6d0 path_mount+0x496/0x19d0 __x64_sys_mount+0x284/0x300 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f3f2118d9ea Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 = 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffc269deac8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3f2118d9ea RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc269dec00 RBP: 00007ffc269dec80 R08: 00007ffc269deb00 R09: 00007ffc269dec44 R10: 0000000000000000 R11: 0000000000000202 R12: 000055f81ab1d220 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to the physical page: page:0000000085430378 refcount:1 mapcount:1 mapping:0000000000000000 index:= 0x555c6a81d pfn:0x751ac memcg:ffff888101f7e180 anon flags: 0xfffffc00a0014(uptodate|lru|mappedtodisk|swapbacked|node=3D0|z= one=3D1|lastcpupid=3D0x1fffff) raw: 000fffffc00a0014 ffffea0001bf2988 ffffea0001de2448 ffff88801712e201 raw: 0000000555c6a81d 0000000000000000 0000000100000000 ffff888101f7e180 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880751acd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880751ace00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880751ace80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff8880751acf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880751acf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The reason is that struct ATTR_RECORD->name_offset is 6485, end address of name string is out of bounds. Fix this by adding sanity check on end address of attribute name string. [akpm@linux-foundation.org: coding-style cleanups] [chenxiaosong2@huawei.com: cleanup suggested by Hawkins Jiawei] Link: https://lkml.kernel.org/r/20220709064511.3304299-1-chenxiaosong2@hu= awei.com Link: https://lkml.kernel.org/r/20220707105329.4020708-1-chenxiaosong2@huaw= ei.com Signed-off-by: ChenXiaoSong Signed-off-by: Hawkins Jiawei Cc: Anton Altaparmakov Cc: ChenXiaoSong Cc: Yongqiang Liu Cc: Zhang Yi Cc: Zhang Xiaoxu Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/ntfs/attrib.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/fs/ntfs/attrib.c +++ b/fs/ntfs/attrib.c @@ -606,8 +606,12 @@ static int ntfs_attr_find(const ATTR_TYP a =3D (ATTR_RECORD*)((u8*)ctx->attr + le32_to_cpu(ctx->attr->length)); for (;; a =3D (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))) { - if ((u8*)a < (u8*)ctx->mrec || (u8*)a > (u8*)ctx->mrec + - le32_to_cpu(ctx->mrec->bytes_allocated)) + u8 *mrec_end =3D (u8 *)ctx->mrec + + le32_to_cpu(ctx->mrec->bytes_allocated); + u8 *name_end =3D (u8 *)a + le16_to_cpu(a->name_offset) + + a->name_length * sizeof(ntfschar); + if ((u8*)a < (u8*)ctx->mrec || (u8*)a > mrec_end || + name_end > mrec_end) break; ctx->attr =3D a; if (unlikely(le32_to_cpu(a->type) > le32_to_cpu(type) || From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A61CC32772 for ; Tue, 23 Aug 2022 09:27:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349985AbiHWJ1w (ORCPT ); Tue, 23 Aug 2022 05:27:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349960AbiHWJY6 (ORCPT ); Tue, 23 Aug 2022 05:24:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 915EB90816; Tue, 23 Aug 2022 01:35:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 15755B81C4D; Tue, 23 Aug 2022 08:35:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5AD2EC433C1; Tue, 23 Aug 2022 08:35:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243754; bh=0DOI+tH+obLM/ah1ir/rAmzRsoGfunCYQfDTahRUfW4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JNSJFUwdRMlWhI+WW9N2UVIeuUnb2A7Qcn27QsdUmT0ZkccOTdqxRhRQt3+t454Jo renl9UbrZgiZls3WkXRk5JEeLjvTij/npp/IYOX8T9GCWAN69HCHhDChyrNOBkMxCE uzYdrrMYyh7JZagd6cZCd/byJzSKugYmvwCMM3DY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Harald Freudenberger , "Jason A. Donenfeld" , Juergen Christ , Alexander Gordeev Subject: [PATCH 4.14 003/229] s390/archrandom: prevent CPACF trng invocations in interrupt context Date: Tue, 23 Aug 2022 10:22:44 +0200 Message-Id: <20220823080053.380061246@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Harald Freudenberger commit 918e75f77af7d2e049bb70469ec0a2c12782d96a upstream. This patch slightly reworks the s390 arch_get_random_seed_{int,long} implementation: Make sure the CPACF trng instruction is never called in any interrupt context. This is done by adding an additional condition in_task(). Justification: There are some constrains to satisfy for the invocation of the arch_get_random_seed_{int,long}() functions: - They should provide good random data during kernel initialization. - They should not be called in interrupt context as the TRNG instruction is relatively heavy weight and may for example make some network loads cause to timeout and buck. However, it was not clear what kind of interrupt context is exactly encountered during kernel init or network traffic eventually calling arch_get_random_seed_long(). After some days of investigations it is clear that the s390 start_kernel function is not running in any interrupt context and so the trng is called: Jul 11 18:33:39 t35lp54 kernel: [<00000001064e90ca>] arch_get_random_seed_= long.part.0+0x32/0x70 Jul 11 18:33:39 t35lp54 kernel: [<000000010715f246>] random_init+0xf6/0x238 Jul 11 18:33:39 t35lp54 kernel: [<000000010712545c>] start_kernel+0x4a4/0x= 628 Jul 11 18:33:39 t35lp54 kernel: [<000000010590402a>] startup_continue+0x2a= /0x40 The condition in_task() is true and the CPACF trng provides random data during kernel startup. The network traffic however, is more difficult. A typical call stack looks like this: Jul 06 17:37:07 t35lp54 kernel: [<000000008b5600fc>] extract_entropy.const= prop.0+0x23c/0x240 Jul 06 17:37:07 t35lp54 kernel: [<000000008b560136>] crng_reseed+0x36/0xd8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b5604b8>] crng_make_state+0x78/= 0x340 Jul 06 17:37:07 t35lp54 kernel: [<000000008b5607e0>] _get_random_bytes+0x6= 0/0xf8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b56108a>] get_random_u32+0xda/0= x248 Jul 06 17:37:07 t35lp54 kernel: [<000000008aefe7a8>] kfence_guarded_alloc+= 0x48/0x4b8 Jul 06 17:37:07 t35lp54 kernel: [<000000008aeff35e>] __kfence_alloc+0x18e/= 0x1b8 Jul 06 17:37:07 t35lp54 kernel: [<000000008aef7f10>] __kmalloc_node_track_= caller+0x368/0x4d8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b611eac>] kmalloc_reserve+0x44/= 0xa0 Jul 06 17:37:07 t35lp54 kernel: [<000000008b611f98>] __alloc_skb+0x90/0x178 Jul 06 17:37:07 t35lp54 kernel: [<000000008b6120dc>] __napi_alloc_skb+0x5c= /0x118 Jul 06 17:37:07 t35lp54 kernel: [<000000008b8f06b4>] qeth_extract_skb+0x13= c/0x680 Jul 06 17:37:07 t35lp54 kernel: [<000000008b8f6526>] qeth_poll+0x256/0x3f8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b63d76e>] __napi_poll.constprop= .0+0x46/0x2f8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b63dbec>] net_rx_action+0x1cc/0= x408 Jul 06 17:37:07 t35lp54 kernel: [<000000008b937302>] __do_softirq+0x132/0x= 6b0 Jul 06 17:37:07 t35lp54 kernel: [<000000008abf46ce>] __irq_exit_rcu+0x13e/= 0x170 Jul 06 17:37:07 t35lp54 kernel: [<000000008abf531a>] irq_exit_rcu+0x22/0x50 Jul 06 17:37:07 t35lp54 kernel: [<000000008b922506>] do_io_irq+0xe6/0x198 Jul 06 17:37:07 t35lp54 kernel: [<000000008b935826>] io_int_handler+0xd6/0= x110 Jul 06 17:37:07 t35lp54 kernel: [<000000008b9358a6>] psw_idle_exit+0x0/0xa Jul 06 17:37:07 t35lp54 kernel: ([<000000008ab9c59a>] arch_cpu_idle+0x52/0x= e0) Jul 06 17:37:07 t35lp54 kernel: [<000000008b933cfe>] default_idle_call+0x6= e/0xd0 Jul 06 17:37:07 t35lp54 kernel: [<000000008ac59f4e>] do_idle+0xf6/0x1b0 Jul 06 17:37:07 t35lp54 kernel: [<000000008ac5a28e>] cpu_startup_entry+0x3= 6/0x40 Jul 06 17:37:07 t35lp54 kernel: [<000000008abb0d90>] smp_start_secondary+0= x148/0x158 Jul 06 17:37:07 t35lp54 kernel: [<000000008b935b9e>] restart_int_handler+0= x6e/0x90 which confirms that the call is in softirq context. So in_task() covers exa= ctly the cases where we want to have CPACF trng called: not in nmi, not in hard = irq, not in soft irq but in normal task context and during kernel init. Signed-off-by: Harald Freudenberger Acked-by: Jason A. Donenfeld Reviewed-by: Juergen Christ Link: https://lore.kernel.org/r/20220713131721.257907-1-freude@linux.ibm.com Fixes: e4f74400308c ("s390/archrandom: simplify back to earlier design and = initialize earlier") [agordeev@linux.ibm.com changed desc, added Fixes and Link, removed -stable] Signed-off-by: Alexander Gordeev Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/s390/include/asm/archrandom.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/arch/s390/include/asm/archrandom.h +++ b/arch/s390/include/asm/archrandom.h @@ -2,7 +2,7 @@ /* * Kernel interface for the s390 arch_random_* functions * - * Copyright IBM Corp. 2017, 2020 + * Copyright IBM Corp. 2017, 2022 * * Author: Harald Freudenberger * @@ -14,6 +14,7 @@ #ifdef CONFIG_ARCH_RANDOM =20 #include +#include #include #include =20 @@ -32,7 +33,8 @@ static inline bool __must_check arch_get =20 static inline bool __must_check arch_get_random_seed_long(unsigned long *v) { - if (static_branch_likely(&s390_arch_random_available)) { + if (static_branch_likely(&s390_arch_random_available) && + in_task()) { cpacf_trng(NULL, 0, (u8 *)v, sizeof(*v)); atomic64_add(sizeof(*v), &s390_arch_random_counter); return true; @@ -42,7 +44,8 @@ static inline bool __must_check arch_get =20 static inline bool __must_check arch_get_random_seed_int(unsigned int *v) { - if (static_branch_likely(&s390_arch_random_available)) { + if (static_branch_likely(&s390_arch_random_available) && + in_task()) { cpacf_trng(NULL, 0, (u8 *)v, sizeof(*v)); atomic64_add(sizeof(*v), &s390_arch_random_counter); return true; From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5456CC3F6B0 for ; Tue, 23 Aug 2022 09:31:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350226AbiHWJbx (ORCPT ); Tue, 23 Aug 2022 05:31:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36464 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350105AbiHWJ3u (ORCPT ); Tue, 23 Aug 2022 05:29:50 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7B12C91D06; Tue, 23 Aug 2022 01:37:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D8472B81C5A; Tue, 23 Aug 2022 08:36:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20ADCC433C1; Tue, 23 Aug 2022 08:36:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243788; bh=/w7F+iipsaqlzfkd/2XvhEnRnAT6KKvkuj4hCLT0PrQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0KpY04kBcobziMb2kHfSay8XgIUFnyGqMK0kd2utZMUE3J8fCkqRy2MbVfa6DkEvy U/9nMG9OcnASZI6mM+8nh23DOv46x7fMTyRsC2xmgC2wgW7NnbfjfRGDdicWVure7q eB6F7cXfHk70y4290UnQ3hvUvcKTyI5NE2VmM8Ug= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bart Van Assche , Liang He , "Martin K. Petersen" Subject: [PATCH 4.14 004/229] scsi: ufs: host: Hold reference returned by of_parse_phandle() Date: Tue, 23 Aug 2022 10:22:45 +0200 Message-Id: <20220823080053.430708004@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He commit a3435afba87dc6cd83f5595e7607f3c40f93ef01 upstream. In ufshcd_populate_vreg(), we should hold the reference returned by of_parse_phandle() and then use it to call of_node_put() for refcount balance. Link: https://lore.kernel.org/r/20220719071529.1081166-1-windhl@126.com Fixes: aa4976130934 ("ufs: Add regulator enable support") Reviewed-by: Bart Van Assche Signed-off-by: Liang He Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/scsi/ufs/ufshcd-pltfrm.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) --- a/drivers/scsi/ufs/ufshcd-pltfrm.c +++ b/drivers/scsi/ufs/ufshcd-pltfrm.c @@ -124,9 +124,20 @@ out: return ret; } =20 +static bool phandle_exists(const struct device_node *np, + const char *phandle_name, int index) +{ + struct device_node *parse_np =3D of_parse_phandle(np, phandle_name, index= ); + + if (parse_np) + of_node_put(parse_np); + + return parse_np !=3D NULL; +} + #define MAX_PROP_SIZE 32 static int ufshcd_populate_vreg(struct device *dev, const char *name, - struct ufs_vreg **out_vreg) + struct ufs_vreg **out_vreg) { int ret =3D 0; char prop_name[MAX_PROP_SIZE]; @@ -139,7 +150,7 @@ static int ufshcd_populate_vreg(struct d } =20 snprintf(prop_name, MAX_PROP_SIZE, "%s-supply", name); - if (!of_parse_phandle(np, prop_name, 0)) { + if (!phandle_exists(np, prop_name, 0)) { dev_info(dev, "%s: Unable to find %s regulator, assuming enabled\n", __func__, prop_name); goto out; From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EEF19C32774 for ; Tue, 23 Aug 2022 09:32:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350817AbiHWJcs (ORCPT ); Tue, 23 Aug 2022 05:32:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351056AbiHWJbP (ORCPT ); Tue, 23 Aug 2022 05:31:15 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B993862C5; Tue, 23 Aug 2022 01:38:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E70A861540; Tue, 23 Aug 2022 08:37:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EB2BCC433D6; Tue, 23 Aug 2022 08:37:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243822; bh=Ko2KFsJXefQC6uhU20nFUKfN9T0HQZh3ccGCRZW+100=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h2bV2RwNPOWxMUgYuD0TWHvShDz3kE7hpH4u5auRO+4hQRDAYdDuqBGIvCFndtPMG YJkAgncBQxa/yud5oa7Nz7TruNg3sazZIc6mNUtF9WwwY3iUPJRjtZWaf5PNnqpqFi sULqjmKYThmykm7WxTZEew07ph1ujDZwbmqPMQWI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+a8430774139ec3ab7176@syzkaller.appspotmail.com, Ayushman Dutta , Kuniyuki Iwashima , David Ahern , Eric Dumazet , Jakub Kicinski Subject: [PATCH 4.14 005/229] net: ping6: Fix memleak in ipv6_renew_options(). Date: Tue, 23 Aug 2022 10:22:46 +0200 Message-Id: <20220823080053.481732597@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima commit e27326009a3d247b831eda38878c777f6f4eb3d1 upstream. When we close ping6 sockets, some resources are left unfreed because pingv6_prot is missing sk->sk_prot->destroy(). As reported by syzbot [0], just three syscalls leak 96 bytes and easily cause OOM. struct ipv6_sr_hdr *hdr; char data[24] =3D {0}; int fd; hdr =3D (struct ipv6_sr_hdr *)data; hdr->hdrlen =3D 2; hdr->type =3D IPV6_SRCRT_TYPE_4; fd =3D socket(AF_INET6, SOCK_DGRAM, NEXTHDR_ICMP); setsockopt(fd, IPPROTO_IPV6, IPV6_RTHDR, data, 24); close(fd); To fix memory leaks, let's add a destroy function. Note the socket() syscall checks if the GID is within the range of net.ipv4.ping_group_range. The default value is [1, 0] so that no GID meets the condition (1 <=3D GID <=3D 0). Thus, the local DoS does not succeed until we change the default value. However, at least Ubuntu/Fedora/RHEL loosen it. $ cat /usr/lib/sysctl.d/50-default.conf ... -net.ipv4.ping_group_range =3D 0 2147483647 Also, there could be another path reported with these options, and some of them require CAP_NET_RAW. setsockopt IPV6_ADDRFORM (inet6_sk(sk)->pktoptions) IPV6_RECVPATHMTU (inet6_sk(sk)->rxpmtu) IPV6_HOPOPTS (inet6_sk(sk)->opt) IPV6_RTHDRDSTOPTS (inet6_sk(sk)->opt) IPV6_RTHDR (inet6_sk(sk)->opt) IPV6_DSTOPTS (inet6_sk(sk)->opt) IPV6_2292PKTOPTIONS (inet6_sk(sk)->opt) getsockopt IPV6_FLOWLABEL_MGR (inet6_sk(sk)->ipv6_fl_list) For the record, I left a different splat with syzbot's one. unreferenced object 0xffff888006270c60 (size 96): comm "repro2", pid 231, jiffies 4294696626 (age 13.118s) hex dump (first 32 bytes): 01 00 00 00 44 00 00 00 00 00 00 00 00 00 00 00 ....D........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000f6bc7ea9>] sock_kmalloc (net/core/sock.c:2564 net/core/sock= .c:2554) [<000000006d699550>] do_ipv6_setsockopt.constprop.0 (net/ipv6/ipv6_so= ckglue.c:715) [<00000000c3c3b1f5>] ipv6_setsockopt (net/ipv6/ipv6_sockglue.c:1024) [<000000007096a025>] __sys_setsockopt (net/socket.c:2254) [<000000003a8ff47b>] __x64_sys_setsockopt (net/socket.c:2265 net/sock= et.c:2262 net/socket.c:2262) [<000000007c409dcb>] do_syscall_64 (arch/x86/entry/common.c:50 arch/x= 86/entry/common.c:80) [<00000000e939c4a9>] entry_SYSCALL_64_after_hwframe (arch/x86/entry/e= ntry_64.S:120) [0]: https://syzkaller.appspot.com/bug?extid=3Da8430774139ec3ab7176 Fixes: 6d0bfe226116 ("net: ipv6: Add IPv6 support to the ping socket.") Reported-by: syzbot+a8430774139ec3ab7176@syzkaller.appspotmail.com Reported-by: Ayushman Dutta Signed-off-by: Kuniyuki Iwashima Reviewed-by: David Ahern Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220728012220.46918-1-kuniyu@amazon.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv6/ping.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/net/ipv6/ping.c +++ b/net/ipv6/ping.c @@ -26,6 +26,11 @@ #include #include =20 +static void ping_v6_destroy(struct sock *sk) +{ + inet6_destroy_sock(sk); +} + /* Compatibility glue so we can support IPv6 when it's compiled as a modul= e */ static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int = len, int *addr_len) @@ -173,6 +178,7 @@ struct proto pingv6_prot =3D { .owner =3D THIS_MODULE, .init =3D ping_init_sock, .close =3D ping_close, + .destroy =3D ping_v6_destroy, .connect =3D ip6_datagram_connect_v6_only, .disconnect =3D __udp_disconnect, .setsockopt =3D ipv6_setsockopt, From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26036C32772 for ; Tue, 23 Aug 2022 09:32:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350724AbiHWJcm (ORCPT ); Tue, 23 Aug 2022 05:32:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38816 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351024AbiHWJbN (ORCPT ); Tue, 23 Aug 2022 05:31:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B9872627F; Tue, 23 Aug 2022 01:38:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id ED9896132D; Tue, 23 Aug 2022 08:37:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F4176C433C1; Tue, 23 Aug 2022 08:37:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243825; bh=3SEtrh6MNpXnvKk3vVEPj7E7RPsWRJCj7UxewlvKznA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UAImMthU8y+HfBX240HX51T3xh7Q8eJH4844pBY1gC7o21uK1tnNE6OeynGIPvRCO YsLO8/x7MjM0S+o/6Uunx17PY3BDtQ4zxOWG+fgJ85CnKVDk5xD6Zz/lBf87Sa37a+ K7GQ05YRpZV0u4e33Nvcsmg23zaSEJUrvDFB6mIw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.14 006/229] net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() Date: Tue, 23 Aug 2022 10:22:47 +0200 Message-Id: <20220823080053.536799407@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit ebbbe23fdf6070e31509638df3321688358cc211 ] In bcm5421_init(), we should call of_node_put() for the reference returned by of_get_parent() which has increased the refcount. Fixes: 3c326fe9cb7a ("[PATCH] ppc64: Add new PHY to sungem") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220720131003.1287426-1-windhl@126.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/sungem_phy.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c index 63a8ff816e59..e556b00dfed2 100644 --- a/drivers/net/sungem_phy.c +++ b/drivers/net/sungem_phy.c @@ -453,6 +453,7 @@ static int bcm5421_init(struct mii_phy* phy) int can_low_power =3D 1; if (np =3D=3D NULL || of_get_property(np, "no-autolowpower", NULL)) can_low_power =3D 0; + of_node_put(np); if (can_low_power) { /* Enable automatic low-power */ sungem_phy_write(phy, 0x1c, 0x9002); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 192E0C32772 for ; Tue, 23 Aug 2022 09:33:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350953AbiHWJdK (ORCPT ); Tue, 23 Aug 2022 05:33:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38712 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351231AbiHWJb0 (ORCPT ); Tue, 23 Aug 2022 05:31:26 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DA818275F1; Tue, 23 Aug 2022 01:38:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 39DDB61547; Tue, 23 Aug 2022 08:37:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 29CF5C433C1; Tue, 23 Aug 2022 08:37:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243828; bh=yMu/+1FFUxvoYGpo6+tLh1Im8+eo2FszMBiGdkHivVk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WnKYaV/zKw0R+Hpua2nqq8w3L79HSzbZ1ikOsrSE4YjV60IsNcaEwTN1lVnd2KOVo b2IgBi7h5lLZNr/cU9ZKWs3DZmBrTtWcyGHGYB6BiWaV8cRXDYaPSGaMPrWtgTNFRU Y6bMdyw5buT8LWcRK25pEWTlAizY1n++0rymH0ws= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Domingo Dirutigliano , Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.14 007/229] netfilter: nf_queue: do not allow packet truncation below transport header offset Date: Tue, 23 Aug 2022 10:22:48 +0200 Message-Id: <20220823080053.580178437@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal [ Upstream commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 ] Domingo Dirutigliano and Nicola Guerrera report kernel panic when sending nf_queue verdict with 1-byte nfta_payload attribute. The IP/IPv6 stack pulls the IP(v6) header from the packet after the input hook. If user truncates the packet below the header size, this skb_pull() will result in a malformed skb (skb->len < 0). Fixes: 7af4cc3fa158 ("[NETFILTER]: Add "nfnetlink_queue" netfilter queue ha= ndler over nfnetlink") Reported-by: Domingo Dirutigliano Signed-off-by: Florian Westphal Reviewed-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/netfilter/nfnetlink_queue.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queu= e.c index ba74bb2d6341..369f1634afe9 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -827,11 +827,16 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, un= signed int queuenum) } =20 static int -nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e, int diff) +nfqnl_mangle(void *data, unsigned int data_len, struct nf_queue_entry *e, = int diff) { struct sk_buff *nskb; =20 if (diff < 0) { + unsigned int min_len =3D skb_transport_offset(e->skb); + + if (data_len < min_len) + return -EINVAL; + if (pskb_trim(e->skb, data_len)) return -ENOMEM; } else if (diff > 0) { --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 105B9C32772 for ; Tue, 23 Aug 2022 09:33:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351005AbiHWJd0 (ORCPT ); Tue, 23 Aug 2022 05:33:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39326 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350344AbiHWJb7 (ORCPT ); Tue, 23 Aug 2022 05:31:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 07B4943E52; Tue, 23 Aug 2022 01:38:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 416A1B81C6B; Tue, 23 Aug 2022 08:37:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 552E5C433C1; Tue, 23 Aug 2022 08:37:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243831; bh=ljrqwzOrbT0JrmQUw2UjpfLFC5dyyN3a2eOKGBHBJcM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xkcNuQtU1zq65TlSGZjzB+Y4xYOPQUMz6jM5u7r8HFlyDM/Mhih+q2pGciBE6C5Ct Hb0/A644C3is/CmTxdSncEdblduoSXpHD5wvXhJEZ6bGQenaHYOJZm/7MreTx0OgPw mcX+nOuBug1J9f+EFs8ksnbPdaaEpR4QdbuWWcak= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , "Jason A. Donenfeld" , "Justin M. Forbes" , Ard Biesheuvel , Arnd Bergmann , Nicolas Pitre , Nathan Chancellor , Nick Desaulniers Subject: [PATCH 4.14 008/229] ARM: crypto: comment out gcc warning that breaks clang builds Date: Tue, 23 Aug 2022 10:22:49 +0200 Message-Id: <20220823080053.626188301@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Greg Kroah-Hartman The gcc build warning prevents all clang-built kernels from working properly, so comment it out to fix the build. This is a -stable kernel only patch for now, it will be resolved differently in mainline releases in the future. Cc: "Jason A. Donenfeld" Cc: "Justin M. Forbes" Cc: Ard Biesheuvel Acked-by: Arnd Bergmann Cc: Nicolas Pitre Cc: Nathan Chancellor Cc: Nick Desaulniers Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/lib/xor-neon.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/arch/arm/lib/xor-neon.c +++ b/arch/arm/lib/xor-neon.c @@ -29,8 +29,9 @@ MODULE_LICENSE("GPL"); * While older versions of GCC do not generate incorrect code, they fail to * recognize the parallel nature of these functions, and emit plain ARM co= de, * which is known to be slower than the optimized ARM code in asm-arm/xor.= h. + * + * #warning This code requires at least version 4.6 of GCC */ -#warning This code requires at least version 4.6 of GCC #endif =20 #pragma GCC diagnostic ignored "-Wunused-variable" From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16916C32772 for ; Tue, 23 Aug 2022 09:29:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350419AbiHWJ3r (ORCPT ); Tue, 23 Aug 2022 05:29:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349783AbiHWJ1T (ORCPT ); Tue, 23 Aug 2022 05:27:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7865C760E7; Tue, 23 Aug 2022 01:37:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A26076152E; Tue, 23 Aug 2022 08:37:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 979BDC433C1; Tue, 23 Aug 2022 08:37:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243835; bh=4JTwL98KeRAHBUUp0B3u8WDPwf7Kzfa2VOERamwCuU4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0E+/HMfdmDvobDZIMR0Y5LdtAU9Uh012AKy6JBimdWzNvT0HPq+OQorp1WX3KutsF 94he/bVrWmzp5/PzNuGcmahtbZ8OdVrCjX+TPjsiHstNPCqOR9moAHNC7L19XPEHsC l/8ukHLExzA/rzpme1R0rGeAw5KaEOSobSCWisuE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wei Mingzhi , Jakub Kicinski , Kalle Valo , Yan Xinyu Subject: [PATCH 4.14 009/229] mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle. Date: Tue, 23 Aug 2022 10:22:50 +0200 Message-Id: <20220823080053.679929709@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wei Mingzhi commit 829eea7c94e0bac804e65975639a2f2e5f147033 upstream. USB device ID of some versions of XiaoDu WiFi Dongle is 2955:1003 instead of 2955:1001. Both are the same mt7601u hardware. Signed-off-by: Wei Mingzhi Acked-by: Jakub Kicinski Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20210618160840.305024-1-whistler@member.fsf= .org Cc: Yan Xinyu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/wireless/mediatek/mt7601u/usb.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/wireless/mediatek/mt7601u/usb.c +++ b/drivers/net/wireless/mediatek/mt7601u/usb.c @@ -34,6 +34,7 @@ static const struct usb_device_id mt7601 { USB_DEVICE(0x2717, 0x4106) }, { USB_DEVICE(0x2955, 0x0001) }, { USB_DEVICE(0x2955, 0x1001) }, + { USB_DEVICE(0x2955, 0x1003) }, { USB_DEVICE(0x2a5f, 0x1000) }, { USB_DEVICE(0x7392, 0x7710) }, { 0, } From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 664C1C32772 for ; Tue, 23 Aug 2022 09:32:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350704AbiHWJch (ORCPT ); Tue, 23 Aug 2022 05:32:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38530 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350940AbiHWJbD (ORCPT ); Tue, 23 Aug 2022 05:31:03 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C57DE77562; Tue, 23 Aug 2022 01:38:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A41CD61541; Tue, 23 Aug 2022 08:37:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA383C433D6; Tue, 23 Aug 2022 08:37:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243838; bh=kAAceLf1VywHIek44vBXTfsB0yb0I7oJ0SqPKKlSA08=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RWwB4xcbtC1S/Yj+gjW+9s+5voP1G8LgzaYUC5VESlgjxINngAXaB6toxf0VaVeHF gWHPezaxsLMGJEwEMzDN/UQr25cc2we582JCrJuy6L6Kw4ydAYLdIDAm5sVFj+ieiK c8gtPkEPEI8vs100TYLoz57YuP4bh5dza3noePeQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Werner Sembach , Hans de Goede , "Rafael J. Wysocki" Subject: [PATCH 4.14 010/229] ACPI: video: Force backlight native for some TongFang devices Date: Tue, 23 Aug 2022 10:22:51 +0200 Message-Id: <20220823080053.733076151@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Werner Sembach commit c752089f7cf5b5800c6ace4cdd1a8351ee78a598 upstream. The TongFang PF5PU1G, PF4NU1F, PF5NU1G, and PF5LUXG/TUXEDO BA15 Gen10, Pulse 14/15 Gen1, and Pulse 15 Gen2 have the same problem as the Clevo NL5xRU and NL5xNU/TUXEDO Aura 15 Gen1 and Gen2: They have a working native and video interface. However the default detection mechanism first registers the video interface before unregistering it again and switching to the native interface during boot. This results in a dangling SBIOS request for backlight change for some reason, causing the backlight to switch to ~2% once per boot on the first power cord connect or disconnect event. Setting the native interface explicitly circumvents this buggy behaviour by avoiding the unregistering process. Signed-off-by: Werner Sembach Cc: All applicable Reviewed-by: Hans de Goede Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/acpi/video_detect.c | 51 +++++++++++++++++++++++++++++++++++++++= ++++- 1 file changed, 50 insertions(+), 1 deletion(-) --- a/drivers/acpi/video_detect.c +++ b/drivers/acpi/video_detect.c @@ -431,7 +431,56 @@ static const struct dmi_system_id video_ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), }, }, - + /* + * The TongFang PF5PU1G, PF4NU1F, PF5NU1G, and PF5LUXG/TUXEDO BA15 Gen10, + * Pulse 14/15 Gen1, and Pulse 15 Gen2 have the same problem as the Clevo + * NL5xRU and NL5xNU/TUXEDO Aura 15 Gen1 and Gen2. See the description + * above. + */ + { + .callback =3D video_detect_force_native, + .ident =3D "TongFang PF5PU1G", + .matches =3D { + DMI_MATCH(DMI_BOARD_NAME, "PF5PU1G"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "TongFang PF4NU1F", + .matches =3D { + DMI_MATCH(DMI_BOARD_NAME, "PF4NU1F"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "TongFang PF4NU1F", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), + DMI_MATCH(DMI_BOARD_NAME, "PULSE1401"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "TongFang PF5NU1G", + .matches =3D { + DMI_MATCH(DMI_BOARD_NAME, "PF5NU1G"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "TongFang PF5NU1G", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), + DMI_MATCH(DMI_BOARD_NAME, "PULSE1501"), + }, + }, + { + .callback =3D video_detect_force_native, + .ident =3D "TongFang PF5LUXG", + .matches =3D { + DMI_MATCH(DMI_BOARD_NAME, "PF5LUXG"), + }, + }, /* * Desktops which falsely report a backlight and which our heuristics * for this do not catch. From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A99EAC32772 for ; Tue, 23 Aug 2022 09:33:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350916AbiHWJdE (ORCPT ); Tue, 23 Aug 2022 05:33:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53302 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351163AbiHWJbX (ORCPT ); Tue, 23 Aug 2022 05:31:23 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D63BCBCBF; Tue, 23 Aug 2022 01:38:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id B5C20CE1B4A; Tue, 23 Aug 2022 08:37:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BB040C43470; Tue, 23 Aug 2022 08:37:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243841; bh=yXd7a1cUrnNABJJH7d5iVOcQbSOFbG5yvXQbf4pNum4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MwfrYdlcxO4rG4d7sWQ/6csI7nBDSuXN60EYB7bCUwpb//DIeX+54MfKzj4B5IFtG x2sF+OmIXlM12WXf3VMFExHs7J/33zbtfzGHn+Rc7tl6jW879rPulQhRTdoO//0jQo 1mH4aDG+u9BG0QtTAEfEBsr0ETUs1d2SgyyEV1gY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Werner Sembach , Hans de Goede , "Rafael J. Wysocki" Subject: [PATCH 4.14 011/229] ACPI: video: Shortening quirk list by identifying Clevo by board_name only Date: Tue, 23 Aug 2022 10:22:52 +0200 Message-Id: <20220823080053.774935680@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Werner Sembach commit f0341e67b3782603737f7788e71bd3530012a4f4 upstream. Taking a recent change in the i8042 quirklist to this one: Clevo board_names are somewhat unique, and if not: The generic Board_-/Sys_Vendor string "Notebook" doesn't help much anyway. So identifying the devices just by the board_name helps keeping the list significantly shorter and might even hit more devices requiring the fix. Signed-off-by: Werner Sembach Fixes: c844d22fe0c0 ("ACPI: video: Force backlight native for Clevo NL5xRU = and NL5xNU") Cc: All applicable Reviewed-by: Hans de Goede Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/acpi/video_detect.c | 34 ---------------------------------- 1 file changed, 34 deletions(-) --- a/drivers/acpi/video_detect.c +++ b/drivers/acpi/video_detect.c @@ -371,23 +371,6 @@ static const struct dmi_system_id video_ .callback =3D video_detect_force_native, .ident =3D "Clevo NL5xRU", .matches =3D { - DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), - DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), - }, - }, - { - .callback =3D video_detect_force_native, - .ident =3D "Clevo NL5xRU", - .matches =3D { - DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), - DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), - }, - }, - { - .callback =3D video_detect_force_native, - .ident =3D "Clevo NL5xRU", - .matches =3D { - DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), }, }, @@ -411,23 +394,6 @@ static const struct dmi_system_id video_ .callback =3D video_detect_force_native, .ident =3D "Clevo NL5xNU", .matches =3D { - DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), - DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), - }, - }, - { - .callback =3D video_detect_force_native, - .ident =3D "Clevo NL5xNU", - .matches =3D { - DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), - DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), - }, - }, - { - .callback =3D video_detect_force_native, - .ident =3D "Clevo NL5xNU", - .matches =3D { - DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), }, }, From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD650C32772 for ; Tue, 23 Aug 2022 09:30:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350214AbiHWJaM (ORCPT ); Tue, 23 Aug 2022 05:30:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42514 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350011AbiHWJ1w (ORCPT ); Tue, 23 Aug 2022 05:27:52 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4E85B77E82; Tue, 23 Aug 2022 01:37:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 52009CE1B49; Tue, 23 Aug 2022 08:35:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4BD8EC433D6; Tue, 23 Aug 2022 08:35:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243757; bh=e+Sqdz09GdVHe1dlbhbcgQasCVxSYIYnh6jIqbIAANo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2XgeoDqUJveMEJTaJ0FeDmNaU6dIf0j1LZGFzlQsROO9CRR2rcFNQ2u0suRK8yu3H t7n7mvuQN6jdZpMMMubax4VGymgs3FYpDvNxzq6hWq0I3rNvIVISo+OZg7+wdU0XNs QQqTz6yngUwlgzzcKhUtaH8BzvTtQEQn6noEAtKE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Ning Qiang , Kees Cook , Benjamin Herrenschmidt , Michael Ellerman Subject: [PATCH 4.14 012/229] macintosh/adb: fix oob read in do_adb_query() function Date: Tue, 23 Aug 2022 10:22:53 +0200 Message-Id: <20220823080053.828036841@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ning Qiang commit fd97e4ad6d3b0c9fce3bca8ea8e6969d9ce7423b upstream. In do_adb_query() function of drivers/macintosh/adb.c, req->data is copied form userland. The parameter "req->data[2]" is missing check, the array size of adb_handler[] is 16, so adb_handler[req->data[2]].original_address = and adb_handler[req->data[2]].handler_id will lead to oob read. Cc: stable Signed-off-by: Ning Qiang Reviewed-by: Kees Cook Reviewed-by: Greg Kroah-Hartman Acked-by: Benjamin Herrenschmidt Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220713153734.2248-1-sohu0106@126.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/macintosh/adb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/macintosh/adb.c +++ b/drivers/macintosh/adb.c @@ -647,7 +647,7 @@ do_adb_query(struct adb_request *req) =20 switch(req->data[1]) { case ADB_QUERY_GETDEVINFO: - if (req->nbytes < 3) + if (req->nbytes < 3 || req->data[2] >=3D 16) break; mutex_lock(&adb_handler_mutex); req->reply[0] =3D adb_handler[req->data[2]].original_address; From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68151C32772 for ; Tue, 23 Aug 2022 09:29:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350101AbiHWJ3u (ORCPT ); Tue, 23 Aug 2022 05:29:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51208 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349876AbiHWJ1U (ORCPT ); Tue, 23 Aug 2022 05:27:20 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A449790C4A; Tue, 23 Aug 2022 01:37:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 00018B81C3B; Tue, 23 Aug 2022 08:36:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5F7C3C433D7; Tue, 23 Aug 2022 08:36:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243760; bh=9tYH85BTIVEd2kbDCWr6tvmS9gkPziL43vV4QunDigI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vA/IEmUjbZEG/cof3a0iayRyU7sAiuGGhjKQnU24wHYLcge7Qy7eRW4Jla66wFRb6 TV59RrGAj5lT9JN6W5e7fk/MqjVvx0K5WAmsZwz/eJrkAqjB8BCdgSvQB/jISsKZV6 vTuo7cOusQXbGXckew+4kc+f5z3s+j6dRIuVt7jc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Fangrui Song , Nick Desaulniers , Linus Torvalds , Jens Axboe Subject: [PATCH 4.14 013/229] Makefile: link with -z noexecstack --no-warn-rwx-segments Date: Tue, 23 Aug 2022 10:22:54 +0200 Message-Id: <20220823080053.873421249@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nick Desaulniers commit 0d362be5b14200b77ecc2127936a5ff82fbffe41 upstream. Users of GNU ld (BFD) from binutils 2.39+ will observe multiple instances of a new warning when linking kernels in the form: ld: warning: vmlinux: missing .note.GNU-stack section implies executable = stack ld: NOTE: This behaviour is deprecated and will be removed in a future ve= rsion of the linker ld: warning: vmlinux has a LOAD segment with RWX permissions Generally, we would like to avoid the stack being executable. Because there could be a need for the stack to be executable, assembler sources have to opt-in to this security feature via explicit creation of the .note.GNU-stack feature (which compilers create by default) or command line flag --noexecstack. Or we can simply tell the linker the production of such sections is irrelevant and to link the stack as --noexecstack. LLVM's LLD linker defaults to -z noexecstack, so this flag isn't strictly necessary when linking with LLD, only BFD, but it doesn't hurt to be explicit here for all linkers IMO. --no-warn-rwx-segments is currently BFD specific and only available in the current latest release, so it's wrapped in an ld-option check. While the kernel makes extensive usage of ELF sections, it doesn't use permissions from ELF segments. Link: https://lore.kernel.org/linux-block/3af4127a-f453-4cf7-f133-a181cce06= f73@kernel.dk/ Link: https://sourceware.org/git/?p=3Dbinutils-gdb.git;a=3Dcommit;h=3Dba951= afb99912da01a6e8434126b8fac7aa75107 Link: https://github.com/llvm/llvm-project/issues/57009 Reported-and-tested-by: Jens Axboe Suggested-by: Fangrui Song Signed-off-by: Nick Desaulniers Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- Makefile | 3 +++ 1 file changed, 3 insertions(+) --- a/Makefile +++ b/Makefile @@ -873,6 +873,9 @@ ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATI LDFLAGS_vmlinux +=3D $(call ld-option, --gc-sections,) endif =20 +LDFLAGS +=3D -z noexecstack +LDFLAGS +=3D $(call ld-option,--no-warn-rwx-segments) + ifeq ($(CONFIG_STRIP_ASM_SYMS),y) LDFLAGS_vmlinux +=3D $(call ld-option, -X,) endif From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70D19C32772 for ; Tue, 23 Aug 2022 09:29:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350303AbiHWJ3Q (ORCPT ); Tue, 23 Aug 2022 05:29:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50936 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350940AbiHWJ0a (ORCPT ); Tue, 23 Aug 2022 05:26:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A4A5D915C8; Tue, 23 Aug 2022 01:37:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 68AE461485; Tue, 23 Aug 2022 08:36:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 565D3C433D6; Tue, 23 Aug 2022 08:36:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243763; bh=ck+41J0w7dpuISrQ+RvTbUpIJtkyd4sm1/cjAbIqIzM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tUHsanMLZ0YxmTNXYRGU27h3296HHt3qAFADfwT8dCpM8qJj2SMoqlzH0/2tcPlHx gqSZhqH3Vc1uZ7bEnU2A5JZ45M1lt5+WdDDsE5kSvYTY6amwUyYIr+MNd9GYFytVEQ um9cvJq/8GuCJRA3DH4/IHRiQXbghZpugULlzbjI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Fangrui Song , Nick Desaulniers , Linus Torvalds , Jens Axboe Subject: [PATCH 4.14 014/229] x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments Date: Tue, 23 Aug 2022 10:22:55 +0200 Message-Id: <20220823080053.915124858@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nick Desaulniers commit ffcf9c5700e49c0aee42dcba9a12ba21338e8136 upstream. Users of GNU ld (BFD) from binutils 2.39+ will observe multiple instances of a new warning when linking kernels in the form: ld: warning: arch/x86/boot/pmjump.o: missing .note.GNU-stack section impl= ies executable stack ld: NOTE: This behaviour is deprecated and will be removed in a future ve= rsion of the linker ld: warning: arch/x86/boot/compressed/vmlinux has a LOAD segment with RWX= permissions Generally, we would like to avoid the stack being executable. Because there could be a need for the stack to be executable, assembler sources have to opt-in to this security feature via explicit creation of the .note.GNU-stack feature (which compilers create by default) or command line flag --noexecstack. Or we can simply tell the linker the production of such sections is irrelevant and to link the stack as --noexecstack. LLVM's LLD linker defaults to -z noexecstack, so this flag isn't strictly necessary when linking with LLD, only BFD, but it doesn't hurt to be explicit here for all linkers IMO. --no-warn-rwx-segments is currently BFD specific and only available in the current latest release, so it's wrapped in an ld-option check. While the kernel makes extensive usage of ELF sections, it doesn't use permissions from ELF segments. Link: https://lore.kernel.org/linux-block/3af4127a-f453-4cf7-f133-a181cce06= f73@kernel.dk/ Link: https://sourceware.org/git/?p=3Dbinutils-gdb.git;a=3Dcommit;h=3Dba951= afb99912da01a6e8434126b8fac7aa75107 Link: https://github.com/llvm/llvm-project/issues/57009 Reported-and-tested-by: Jens Axboe Suggested-by: Fangrui Song Signed-off-by: Nick Desaulniers Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/boot/Makefile | 2 +- arch/x86/boot/compressed/Makefile | 4 ++++ arch/x86/entry/vdso/Makefile | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) --- a/arch/x86/boot/Makefile +++ b/arch/x86/boot/Makefile @@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmli AFLAGS_header.o +=3D -I$(objtree)/$(obj) $(obj)/header.o: $(obj)/zoffset.h =20 -LDFLAGS_setup.elf :=3D -m elf_i386 -T +LDFLAGS_setup.elf :=3D -m elf_i386 -z noexecstack -T $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE $(call if_changed,ld) =20 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -55,6 +55,10 @@ else LDFLAGS +=3D $(shell $(LD) --help 2>&1 | grep -q "\-z noreloc-overflow" \ && echo "-z noreloc-overflow -pie --no-dynamic-linker") endif + +LDFLAGS +=3D -z noexecstack +LDFLAGS +=3D $(call ld-option,--no-warn-rwx-segments) + LDFLAGS_vmlinux :=3D -T =20 hostprogs-y :=3D mkpiggy --- a/arch/x86/entry/vdso/Makefile +++ b/arch/x86/entry/vdso/Makefile @@ -183,7 +183,7 @@ quiet_cmd_vdso =3D VDSO $@ =20 VDSO_LDFLAGS =3D -shared $(call ld-option, --hash-style=3Dboth) \ $(call ld-option, --build-id) $(call ld-option, --eh-frame-hdr) \ - -Bsymbolic + -Bsymbolic -z noexecstack GCOV_PROFILE :=3D n =20 # From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5EEAAC32772 for ; Tue, 23 Aug 2022 09:29:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350330AbiHWJ3U (ORCPT ); Tue, 23 Aug 2022 05:29:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50184 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351110AbiHWJ0l (ORCPT ); Tue, 23 Aug 2022 05:26:41 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9A266910B0; Tue, 23 Aug 2022 01:37:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7507B6152E; Tue, 23 Aug 2022 08:36:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 822DEC433D6; Tue, 23 Aug 2022 08:36:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243766; bh=XnKHTAqr4cw2+DZhxkmwjc8pnDzf654pxG/zleJA8kA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PeVzG1S4mV3C5B+k0tyJGMXAu8ohzQ20k8+lMWUs5PyLyyun9NDO7r3pC6Q+GMrvz f7G0jLI0gGVMZqBpzn4vnvXn0pdHXgYackmjoZunJvq1CYGZX2bZA16lYcTOQum2dr rnF8V4TYrt6NmTY3acs9+rOw4vNo2RRcKokOGjPQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Takashi Iwai Subject: [PATCH 4.14 015/229] ALSA: bcd2000: Fix a UAF bug on the error path of probing Date: Tue, 23 Aug 2022 10:22:56 +0200 Message-Id: <20220823080053.954612763@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma commit ffb2759df7efbc00187bfd9d1072434a13a54139 upstream. When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug. The following log can reveal it: [ 50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0= x2e0 [snd_bcd2000] [ 50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] Fix this by adding usb_kill_urb() before usb_free_urb(). Fixes: b47a22290d58 ("ALSA: MIDI driver for Behringer BCD2000 USB device") Signed-off-by: Zheyu Ma Cc: Link: https://lore.kernel.org/r/20220715010515.2087925-1-zheyuma97@gmail.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/usb/bcd2000/bcd2000.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/sound/usb/bcd2000/bcd2000.c +++ b/sound/usb/bcd2000/bcd2000.c @@ -357,7 +357,8 @@ static int bcd2000_init_midi(struct bcd2 static void bcd2000_free_usb_related_resources(struct bcd2000 *bcd2k, struct usb_interface *interface) { - /* usb_kill_urb not necessary, urb is aborted automatically */ + usb_kill_urb(bcd2k->midi_out_urb); + usb_kill_urb(bcd2k->midi_in_urb); =20 usb_free_urb(bcd2k->midi_out_urb); usb_free_urb(bcd2k->midi_in_urb); From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4FEDC32772 for ; Tue, 23 Aug 2022 09:32:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230051AbiHWJcW (ORCPT ); Tue, 23 Aug 2022 05:32:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38816 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350706AbiHWJao (ORCPT ); Tue, 23 Aug 2022 05:30:44 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1556F91D3F; Tue, 23 Aug 2022 01:37:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4D4A2B81C48; Tue, 23 Aug 2022 08:36:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8651FC433D6; Tue, 23 Aug 2022 08:36:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243770; bh=mfyyL8DMutEJjf4ziH8V3LsgaPzBtQTeXlYzsqiDMag=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oDALQdg0bMNSo1MO2NPnAQyKbHziPkS5RBb6qpRDR0cyPL1uBDvYvWRfcHSiQ5oEQ t6/uge9oGzaim+3frYN+DXVL57jnW2y12Nrm0bzFvAGDXrH2UcwlMDQ379CdtZJD7Z IZnmylzbCGX0OBwGjf5gf0X98FzpLsQaxhX31W9I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , "Matthew Wilcox (Oracle)" , Linus Torvalds Subject: [PATCH 4.14 016/229] add barriers to buffer_uptodate and set_buffer_uptodate Date: Tue, 23 Aug 2022 10:22:57 +0200 Message-Id: <20220823080053.992559325@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit d4252071b97d2027d246f6a82cbee4d52f618b47 upstream. Let's have a look at this piece of code in __bread_slow: get_bh(bh); bh->b_end_io =3D end_buffer_read_sync; submit_bh(REQ_OP_READ, 0, bh); wait_on_buffer(bh); if (buffer_uptodate(bh)) return bh; Neither wait_on_buffer nor buffer_uptodate contain any memory barrier. Consequently, if someone calls sb_bread and then reads the buffer data, the read of buffer data may be executed before wait_on_buffer(bh) on architectures with weak memory ordering and it may return invalid data. Fix this bug by adding a memory barrier to set_buffer_uptodate and an acquire barrier to buffer_uptodate (in a similar way as folio_test_uptodate and folio_mark_uptodate). Signed-off-by: Mikulas Patocka Reviewed-by: Matthew Wilcox (Oracle) Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/linux/buffer_head.h | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@ -114,7 +114,6 @@ static __always_inline int test_clear_bu * of the form "mark_buffer_foo()". These are higher-level functions which * do something in addition to setting a b_state bit. */ -BUFFER_FNS(Uptodate, uptodate) BUFFER_FNS(Dirty, dirty) TAS_BUFFER_FNS(Dirty, dirty) BUFFER_FNS(Lock, locked) @@ -132,6 +131,30 @@ BUFFER_FNS(Meta, meta) BUFFER_FNS(Prio, prio) BUFFER_FNS(Defer_Completion, defer_completion) =20 +static __always_inline void set_buffer_uptodate(struct buffer_head *bh) +{ + /* + * make it consistent with folio_mark_uptodate + * pairs with smp_load_acquire in buffer_uptodate + */ + smp_mb__before_atomic(); + set_bit(BH_Uptodate, &bh->b_state); +} + +static __always_inline void clear_buffer_uptodate(struct buffer_head *bh) +{ + clear_bit(BH_Uptodate, &bh->b_state); +} + +static __always_inline int buffer_uptodate(const struct buffer_head *bh) +{ + /* + * make it consistent with folio_test_uptodate + * pairs with smp_mb__before_atomic in set_buffer_uptodate + */ + return (smp_load_acquire(&bh->b_state) & (1UL << BH_Uptodate)) !=3D 0; +} + #define bh_offset(bh) ((unsigned long)(bh)->b_data & ~PAGE_MASK) =20 /* If we *know* page->private refers to buffer_heads */ From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3501C32772 for ; Tue, 23 Aug 2022 09:29:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238392AbiHWJ3a (ORCPT ); Tue, 23 Aug 2022 05:29:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52442 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351139AbiHWJ0n (ORCPT ); Tue, 23 Aug 2022 05:26:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1B932915D3; Tue, 23 Aug 2022 01:37:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B0ABD6152F; Tue, 23 Aug 2022 08:36:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3E37C433D6; Tue, 23 Aug 2022 08:36:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243773; bh=9SKAJjXFlHzhEZCiqbtuAW5C1JszHwdRG7QcZnOFqYY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BPmCiEK+6tsM5D69esATLAQpAW6rvyHp1ov9PXBWwB8xfBWGBB7HaKeo74AsL+sF5 nI9w90jiXdmF2m7hFGqF7rkgWpRuUJJ7AX8acwKDYNz9d36viQhMpzidxClzLdJdcC /e8nCtiMlanxK+qhAy2YztPBCd5njDjacgpSNODg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ping Cheng , Jason Gerecke , Jiri Kosina Subject: [PATCH 4.14 017/229] HID: wacom: Dont register pad_input for touch switch Date: Tue, 23 Aug 2022 10:22:58 +0200 Message-Id: <20220823080054.044105435@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ping Cheng commit d6b675687a4ab4dba684716d97c8c6f81bf10905 upstream. Touch switch state is received through WACOM_PAD_FIELD. However, it is reported by touch_input. Don't register pad_input if no other pad events require the interface. Cc: stable@vger.kernel.org Signed-off-by: Ping Cheng Reviewed-by: Jason Gerecke Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/hid/wacom_sys.c | 2 +- drivers/hid/wacom_wac.c | 43 +++++++++++++++++++++++++------------------ 2 files changed, 26 insertions(+), 19 deletions(-) --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -1956,7 +1956,7 @@ static int wacom_register_inputs(struct =20 error =3D wacom_setup_pad_input_capabilities(pad_input_dev, wacom_wac); if (error) { - /* no pad in use on this interface */ + /* no pad events using this interface */ input_free_device(pad_input_dev); wacom_wac->pad_input =3D NULL; pad_input_dev =3D NULL; --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -1897,7 +1897,6 @@ static void wacom_wac_pad_usage_mapping( wacom_wac->has_mute_touch_switch =3D true; usage->type =3D EV_SW; usage->code =3D SW_MUTE_DEVICE; - features->device_type |=3D WACOM_DEVICETYPE_PAD; break; case WACOM_HID_WD_TOUCHSTRIP: wacom_map_usage(input, usage, field, EV_ABS, ABS_RX, 0); @@ -1977,6 +1976,30 @@ static void wacom_wac_pad_event(struct h wacom_wac->hid_data.inrange_state |=3D value; } =20 + /* Process touch switch state first since it is reported through touch in= terface, + * which is indepentent of pad interface. In the case when there are no o= ther pad + * events, the pad interface will not even be created. + */ + if ((equivalent_usage =3D=3D WACOM_HID_WD_MUTE_DEVICE) || + (equivalent_usage =3D=3D WACOM_HID_WD_TOUCHONOFF)) { + if (wacom_wac->shared->touch_input) { + bool *is_touch_on =3D &wacom_wac->shared->is_touch_on; + + if (equivalent_usage =3D=3D WACOM_HID_WD_MUTE_DEVICE && value) + *is_touch_on =3D !(*is_touch_on); + else if (equivalent_usage =3D=3D WACOM_HID_WD_TOUCHONOFF) + *is_touch_on =3D value; + + input_report_switch(wacom_wac->shared->touch_input, + SW_MUTE_DEVICE, !(*is_touch_on)); + input_sync(wacom_wac->shared->touch_input); + } + return; + } + + if (!input) + return; + switch (equivalent_usage) { case WACOM_HID_WD_TOUCHRING: /* @@ -2006,22 +2029,6 @@ static void wacom_wac_pad_event(struct h input_event(input, usage->type, usage->code, 0); break; =20 - case WACOM_HID_WD_MUTE_DEVICE: - case WACOM_HID_WD_TOUCHONOFF: - if (wacom_wac->shared->touch_input) { - bool *is_touch_on =3D &wacom_wac->shared->is_touch_on; - - if (equivalent_usage =3D=3D WACOM_HID_WD_MUTE_DEVICE && value) - *is_touch_on =3D !(*is_touch_on); - else if (equivalent_usage =3D=3D WACOM_HID_WD_TOUCHONOFF) - *is_touch_on =3D value; - - input_report_switch(wacom_wac->shared->touch_input, - SW_MUTE_DEVICE, !(*is_touch_on)); - input_sync(wacom_wac->shared->touch_input); - } - break; - case WACOM_HID_WD_MODE_CHANGE: if (wacom_wac->is_direct_mode !=3D value) { wacom_wac->is_direct_mode =3D value; @@ -2610,7 +2617,7 @@ void wacom_wac_event(struct hid_device * /* usage tests must precede field tests */ if (WACOM_BATTERY_USAGE(usage)) wacom_wac_battery_event(hdev, field, usage, value); - else if (WACOM_PAD_FIELD(field) && wacom->wacom_wac.pad_input) + else if (WACOM_PAD_FIELD(field)) wacom_wac_pad_event(hdev, field, usage, value); else if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input) wacom_wac_pen_event(hdev, field, usage, value); From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2ED5C32793 for ; Tue, 23 Aug 2022 09:32:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350849AbiHWJcv (ORCPT ); Tue, 23 Aug 2022 05:32:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350274AbiHWJ3M (ORCPT ); Tue, 23 Aug 2022 05:29:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C2DD791D3B; Tue, 23 Aug 2022 01:37:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A0E8E61517; Tue, 23 Aug 2022 08:36:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A9D4AC433C1; Tue, 23 Aug 2022 08:36:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243776; bh=+6p6i+rNtRJweP0roXLoLTkhcZV/0hxAM7C3fBVXD18=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h/r1+BeJTcR+x2aCTXy/D9IMSvtvfbVYsoIwDQXZFim4GnpdgORhgCedpkvl98tmZ qM0nSqpQnhIuGjHFdc90j1P54bzLXq8OaBvPOU8Wz46+DRu7IY4a3E18wqkmNse+r4 +rlop/JgD3gD5ZubtaTLBa3wku7ELEqXnWb40wnQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sean Christopherson , "Maciej S. Szmigiero" , Paolo Bonzini Subject: [PATCH 4.14 018/229] KVM: SVM: Dont BUG if userspace injects an interrupt with GIF=0 Date: Tue, 23 Aug 2022 10:22:59 +0200 Message-Id: <20220823080054.084215205@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maciej S. Szmigiero commit f17c31c48e5cde9895a491d91c424eeeada3e134 upstream. Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KVM_SET_VCPU_EVENTS (even if having at least a WARN there would be correct for KVM internally generated injections). kernel BUG at arch/x86/kvm/svm/svm.c:3386! invalid opcode: 0000 [#1] SMP CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:svm_inject_irq+0xab/0xb0 [kvm_amd] Code: <0f> 0b 0f 1f 00 0f 1f 44 00 00 80 3d ac b3 01 00 00 55 48 89 f5 53 RSP: 0018:ffffc90000b37d88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810a234ac0 RCX: 0000000000000006 RDX: 0000000000000000 RSI: ffffc90000b37df7 RDI: ffff88810a234ac0 RBP: ffffc90000b37df7 R08: ffff88810a1fa410 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888109571000 R14: ffff88810a234ac0 R15: 0000000000000000 FS: 0000000001821380(0000) GS:ffff88846fdc0000(0000) knlGS:0000000000000= 000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f74fc550008 CR3: 000000010a6fe000 CR4: 0000000000350ea0 Call Trace: inject_pending_event+0x2f7/0x4c0 [kvm] kvm_arch_vcpu_ioctl_run+0x791/0x17a0 [kvm] kvm_vcpu_ioctl+0x26d/0x650 [kvm] __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae Fixes: 219b65dcf6c0 ("KVM: SVM: Improve nested interrupt injection") Cc: stable@vger.kernel.org Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Signed-off-by: Maciej S. Szmigiero Message-Id: <35426af6e123cbe91ec7ce5132ce72521f02b1b5.1651440202.git.maciej= .szmigiero@oracle.com> Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/kvm/svm.c | 2 -- 1 file changed, 2 deletions(-) --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -4611,8 +4611,6 @@ static void svm_set_irq(struct kvm_vcpu { struct vcpu_svm *svm =3D to_svm(vcpu); =20 - BUG_ON(!(gif_set(svm))); - trace_kvm_inj_virq(vcpu->arch.interrupt.nr); ++vcpu->stat.irq_injections; From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1505C32772 for ; Tue, 23 Aug 2022 09:28:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350144AbiHWJ2a (ORCPT ); Tue, 23 Aug 2022 05:28:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51038 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350215AbiHWJZf (ORCPT ); Tue, 23 Aug 2022 05:25:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E69D6760F9; Tue, 23 Aug 2022 01:36:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A191361475; Tue, 23 Aug 2022 08:36:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A8502C433D6; Tue, 23 Aug 2022 08:36:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243779; bh=eicEbu+IdcK/sMPONUo+LG9V3CoqePHys2TFpekNiR0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DAmHfIKlN+hmLTA7s2waLF0raWlOmmrKaNDbMnNaKal7012WQQ1WlbNBQb2Hnmwai 5+QIW960TPTXAQzLDCOTusxaClVua7OXVel+Mz7243j+vzCuPQ4s7z89wWmzklPtX3 z/cWl3loHutGy4Ej1ArmHhyw3EEx41vQh0YrqXpQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+760a73552f47a8cd0fd9@syzkaller.appspotmail.com, Tetsuo Handa , Hou Wenlong , Sean Christopherson , Maxim Levitsky Subject: [PATCH 4.14 019/229] KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks Date: Tue, 23 Aug 2022 10:23:00 +0200 Message-Id: <20220823080054.129802752@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Christopherson commit ec6e4d863258d4bfb36d48d5e3ef68140234d688 upstream. Wait to mark the TSS as busy during LTR emulation until after all fault checks for the LTR have passed. Specifically, don't mark the TSS busy if the new TSS base is non-canonical. Opportunistically drop the one-off !seg_desc.PRESENT check for TR as the only reason for the early check was to avoid marking a !PRESENT TSS as busy, i.e. the common !PRESENT is now done before setting the busy bit. Fixes: e37a75a13cda ("KVM: x86: Emulator ignores LDTR/TR extended base on L= LDT/LTR") Reported-by: syzbot+760a73552f47a8cd0fd9@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Cc: Tetsuo Handa Cc: Hou Wenlong Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky Link: https://lore.kernel.org/r/20220711232750.1092012-2-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/kvm/emulate.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -1721,16 +1721,6 @@ static int __load_segment_descriptor(str case VCPU_SREG_TR: if (seg_desc.s || (seg_desc.type !=3D 1 && seg_desc.type !=3D 9)) goto exception; - if (!seg_desc.p) { - err_vec =3D NP_VECTOR; - goto exception; - } - old_desc =3D seg_desc; - seg_desc.type |=3D 2; /* busy */ - ret =3D ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_des= c, - sizeof(seg_desc), &ctxt->exception); - if (ret !=3D X86EMUL_CONTINUE) - return ret; break; case VCPU_SREG_LDTR: if (seg_desc.s || seg_desc.type !=3D 2) @@ -1771,6 +1761,15 @@ static int __load_segment_descriptor(str ((u64)base3 << 32), ctxt)) return emulate_gp(ctxt, 0); } + + if (seg =3D=3D VCPU_SREG_TR) { + old_desc =3D seg_desc; + seg_desc.type |=3D 2; /* busy */ + ret =3D ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_des= c, + sizeof(seg_desc), &ctxt->exception); + if (ret !=3D X86EMUL_CONTINUE) + return ret; + } load: ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg); if (desc) From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4E0AC32772 for ; Tue, 23 Aug 2022 09:29:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350454AbiHWJ3z (ORCPT ); Tue, 23 Aug 2022 05:29:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53444 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348812AbiHWJ1e (ORCPT ); Tue, 23 Aug 2022 05:27:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 017BF915F7; Tue, 23 Aug 2022 01:37:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A558BB81C4F; Tue, 23 Aug 2022 08:36:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D6C44C433C1; Tue, 23 Aug 2022 08:36:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243782; bh=B3zwTcB/xhXEugosPjzJlf0j/Duf78YLQt3ExNWz/Co=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=coJ2cnWm016p45/vdQMGvPwK7rkcS/KcBB7njdKEC81/R6fzWlZqZia6ujE0Awh2m KB4ICjG3alO+S/56NdDVD2P5mb1phD/pcWOAxZvXTl9B6lu38UTY5umONGi3NX7jhh 7wDgU0TYwyHCPcYlnccKUS+zv6C5LoPUirDuUeQU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sean Christopherson , Maxim Levitsky Subject: [PATCH 4.14 020/229] KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP Date: Tue, 23 Aug 2022 10:23:01 +0200 Message-Id: <20220823080054.161410421@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Christopherson commit 2626206963ace9e8bf92b6eea5ff78dd674c555c upstream. When injecting a #GP on LLDT/LTR due to a non-canonical LDT/TSS base, set the error code to the selector. Intel SDM's says nothing about the #GP, but AMD's APM explicitly states that both LLDT and LTR set the error code to the selector, not zero. Note, a non-canonical memory operand on LLDT/LTR does generate a #GP(0), but the KVM code in question is specific to the base from the descriptor. Fixes: e37a75a13cda ("KVM: x86: Emulator ignores LDTR/TR extended base on L= LDT/LTR") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Reviewed-by: Maxim Levitsky Link: https://lore.kernel.org/r/20220711232750.1092012-3-seanjc@google.com Signed-off-by: Sean Christopherson Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/kvm/emulate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -1758,8 +1758,8 @@ static int __load_segment_descriptor(str if (ret !=3D X86EMUL_CONTINUE) return ret; if (emul_is_noncanonical_address(get_desc_base(&seg_desc) | - ((u64)base3 << 32), ctxt)) - return emulate_gp(ctxt, 0); + ((u64)base3 << 32), ctxt)) + return emulate_gp(ctxt, err_code); } =20 if (seg =3D=3D VCPU_SREG_TR) { From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 504F0C32792 for ; Tue, 23 Aug 2022 09:29:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350405AbiHWJ3o (ORCPT ); Tue, 23 Aug 2022 05:29:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53254 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349721AbiHWJ1Q (ORCPT ); Tue, 23 Aug 2022 05:27:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AF570915FE; Tue, 23 Aug 2022 01:37:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BB389B81C28; Tue, 23 Aug 2022 08:36:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0BA96C433C1; Tue, 23 Aug 2022 08:36:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243785; bh=lC8VNserpxc9lEksxhxWfyjpwHq+IYvvwv2JOQYygBA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Tjkx4HNsBGnJTim9J2YCSVgy/zD23eFDhe3Nd0xAS4NeRQ5xQ2DhFtjfwywn5/7Ek uZ4uUICWhraZhiDtIPstyPyMW8SBHo6g2ZghGLSG1b1438t2HUvUkeQx24Ypyfzcsu 6DCp6vdiAuN+/AtPUIJ8XIGHP+jhjxhk75FsqYSw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Meng Tang , Takashi Iwai Subject: [PATCH 4.14 021/229] ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model Date: Tue, 23 Aug 2022 10:23:02 +0200 Message-Id: <20220823080054.205889775@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Meng Tang commit f83bb2592482fe94c6eea07a8121763c80f36ce5 upstream. There is another LENOVO 20149 (Type1Sku0) Notebook model with CX20590, the device PCI SSID is 17aa:3977, which headphones are not responding, that requires the quirk CXT_PINCFG_LENOVO_NOTEBOOK. Add the corresponding entry to the quirk table. Signed-off-by: Meng Tang Cc: Link: https://lore.kernel.org/r/20220808073406.19460-1-tangmeng@uniontech.c= om Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/pci/hda/patch_conexant.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) --- a/sound/pci/hda/patch_conexant.c +++ b/sound/pci/hda/patch_conexant.c @@ -244,6 +244,7 @@ enum { CXT_PINCFG_LEMOTE_A1205, CXT_PINCFG_COMPAQ_CQ60, CXT_FIXUP_STEREO_DMIC, + CXT_PINCFG_LENOVO_NOTEBOOK, CXT_FIXUP_INC_MIC_BOOST, CXT_FIXUP_HEADPHONE_MIC_PIN, CXT_FIXUP_HEADPHONE_MIC, @@ -787,6 +788,14 @@ static const struct hda_fixup cxt_fixups .type =3D HDA_FIXUP_FUNC, .v.func =3D cxt_fixup_stereo_dmic, }, + [CXT_PINCFG_LENOVO_NOTEBOOK] =3D { + .type =3D HDA_FIXUP_PINS, + .v.pins =3D (const struct hda_pintbl[]) { + { 0x1a, 0x05d71030 }, + { } + }, + .chain_id =3D CXT_FIXUP_STEREO_DMIC, + }, [CXT_FIXUP_INC_MIC_BOOST] =3D { .type =3D HDA_FIXUP_FUNC, .v.func =3D cxt5066_increase_mic_boost, @@ -977,7 +986,7 @@ static const struct snd_pci_quirk cxt506 SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC), SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC), SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMI= C), + SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_PINCFG_LENOVO_NO= TEBOOK), SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC), SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC), SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI), From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B2A4C32772 for ; Tue, 23 Aug 2022 09:44:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241853AbiHWJoP (ORCPT ); Tue, 23 Aug 2022 05:44:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41666 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352175AbiHWJlA (ORCPT ); Tue, 23 Aug 2022 05:41:00 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9770379627; Tue, 23 Aug 2022 01:41:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 01896B81BF8; Tue, 23 Aug 2022 08:36:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 36390C433D6; Tue, 23 Aug 2022 08:36:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243791; bh=aQR3DJEg3kHfSmbwMTdsmvUZ/TBQcuNlem3MABWTKe4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ayHOrNv9/9wqwpYafnu8MJZc31iscntYPtTrAhAnBG+22HaPan+/MrP3RYD3Ud6Fx ttzdvaUqjqXfLCmRFnDYH1g6VxVf1BEixWgYVct4/KLXAAu2JU+g8/r1SkSxo05k5b 6rUiKcf82VVRB44yVJANCEk8oRZ3rKPRnCFx2jOM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Allen Ballway , Takashi Iwai Subject: [PATCH 4.14 022/229] ALSA: hda/cirrus - support for iMac 12,1 model Date: Tue, 23 Aug 2022 10:23:03 +0200 Message-Id: <20220823080054.237252077@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Allen Ballway commit 74bba640d69914cf832b87f6bbb700e5ba430672 upstream. The 12,1 model requires the same configuration as the 12,2 model to enable headphones but has a different codec SSID. Adds 12,1 SSID for matching quirk. [ re-sorted in SSID order by tiwai ] Signed-off-by: Allen Ballway Cc: Link: https://lore.kernel.org/r/20220810152701.1.I902c2e591bbf8de9acb649d13= 22fa1f291849266@changeid Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/pci/hda/patch_cirrus.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/patch_cirrus.c +++ b/sound/pci/hda/patch_cirrus.c @@ -409,6 +409,7 @@ static const struct snd_pci_quirk cs420x =20 /* codec SSID */ SND_PCI_QUIRK(0x106b, 0x0600, "iMac 14,1", CS420X_IMAC27_122), + SND_PCI_QUIRK(0x106b, 0x0900, "iMac 12,1", CS420X_IMAC27_122), SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81), SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122), SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101), From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 02FAFC32772 for ; Tue, 23 Aug 2022 09:32:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350866AbiHWJcz (ORCPT ); Tue, 23 Aug 2022 05:32:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53302 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350273AbiHWJ3M (ORCPT ); Tue, 23 Aug 2022 05:29:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6B510915E8; Tue, 23 Aug 2022 01:37:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4BEB2614E7; Tue, 23 Aug 2022 08:36:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D4C8C433D7; Tue, 23 Aug 2022 08:36:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243794; bh=8OjWaQrQ6n/R9pZg1uxFuSmosI8D28c28OyBd/Bvl8Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hTVxVhLzuecpebgpJrreT9YUHDPqPnS+fve4ke5tgU3Ez0zDa4gbIyKuZJHw0tZwQ 5ti5v9cGKi5AdVmfs9fwsfrgsJYr8H+iaBix7QVAYNFwetm7je/on5MQNG8/R6dk6z SmTRna9qs9vYigw+1X63qZvfMKes5+WkriY1IWW0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Howells , Jeff Layton , Namjae Jeon , stable@kernel.org, Alexander Viro , Steve French , Hyunchul Lee , Chuck Lever , Dave Wysochanski , Linus Torvalds Subject: [PATCH 4.14 023/229] vfs: Check the truncate maximum size in inode_newsize_ok() Date: Tue, 23 Aug 2022 10:23:04 +0200 Message-Id: <20220823080054.269554753@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Howells commit e2ebff9c57fe4eb104ce4768f6ebcccf76bef849 upstream. If something manages to set the maximum file size to MAX_OFFSET+1, this can cause the xfs and ext4 filesystems at least to become corrupt. Ordinarily, the kernel protects against userspace trying this by checking the value early in the truncate() and ftruncate() system calls calls - but there are at least two places that this check is bypassed: (1) Cachefiles will round up the EOF of the backing file to DIO block size so as to allow DIO on the final block - but this might push the offset negative. It then calls notify_change(), but this inadvertently bypasses the checking. This can be triggered if someone puts an 8EiB-1 file on a server for someone else to try and access by, say, nfs. (2) ksmbd doesn't check the value it is given in set_end_of_file_info() and then calls vfs_truncate() directly - which also bypasses the check. In both cases, it is potentially possible for a network filesystem to cause a disk filesystem to be corrupted: cachefiles in the client's cache filesystem; ksmbd in the server's filesystem. nfsd is okay as it checks the value, but we can then remove this check too. Fix this by adding a check to inode_newsize_ok(), as called from setattr_prepare(), thereby catching the issue as filesystems set up to perform the truncate with minimal opportunity for bypassing the new check. Fixes: 1f08c925e7a3 ("cachefiles: Implement backing file wrangling") Fixes: f44158485826 ("cifsd: add file operations") Signed-off-by: David Howells Reported-by: Jeff Layton Tested-by: Jeff Layton Reviewed-by: Namjae Jeon Cc: stable@kernel.org Acked-by: Alexander Viro cc: Steve French cc: Hyunchul Lee cc: Chuck Lever cc: Dave Wysochanski Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/attr.c | 2 ++ 1 file changed, 2 insertions(+) --- a/fs/attr.c +++ b/fs/attr.c @@ -113,6 +113,8 @@ EXPORT_SYMBOL(setattr_prepare); */ int inode_newsize_ok(const struct inode *inode, loff_t offset) { + if (offset < 0) + return -EINVAL; if (inode->i_size < offset) { unsigned long limit; From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B37D1C32772 for ; Tue, 23 Aug 2022 09:32:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350538AbiHWJcQ (ORCPT ); Tue, 23 Aug 2022 05:32:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38784 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350694AbiHWJan (ORCPT ); Tue, 23 Aug 2022 05:30:43 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 567B777E98; Tue, 23 Aug 2022 01:37:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0B61FB81C59; Tue, 23 Aug 2022 08:36:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 37C8EC433D6; Tue, 23 Aug 2022 08:36:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243797; bh=8+uI3dGK+g1A3bAEeGbQ0dbGyAfd+7/26+/vSwy/3pA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0CRtaL3aF9XPGKEqFuLbWDlnyCuMQWp4s1F+A1uVVlQc2QSNHSB4RWnUXFuUZ5/1W 3od4gpa7A8EVhLIIeECPXBFIFzTZmbrSKVqfUnSTBdvDjKQFaSPVLJdRcWn18xkEKP maMQsRZQ/ukqzZT1w2zbEyocXXWP4FoGXe5NITyU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Christian Brauner (Microsoft)" , "Darrick J. Wong" , Yang Xu , Jeff Layton Subject: [PATCH 4.14 024/229] fs: Add missing umask strip in vfs_tmpfile Date: Tue, 23 Aug 2022 10:23:05 +0200 Message-Id: <20220823080054.313390750@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Xu commit ac6800e279a22b28f4fc21439843025a0d5bf03e upstream. All creation paths except for O_TMPFILE handle umask in the vfs directly if the filesystem doesn't support or enable POSIX ACLs. If the filesystem does then umask handling is deferred until posix_acl_create(). Because, O_TMPFILE misses umask handling in the vfs it will not honor umask settings. Fix this by adding the missing umask handling. Link: https://lore.kernel.org/r/1657779088-2242-2-git-send-email-xuyang2018= .jy@fujitsu.com Fixes: 60545d0d4610 ("[O_TMPFILE] it's still short a few helpers, but infra= structure should be OK now...") Cc: # 4.19+ Reported-by: Christian Brauner (Microsoft) Reviewed-by: Darrick J. Wong Reviewed-and-Tested-by: Jeff Layton Acked-by: Christian Brauner (Microsoft) Signed-off-by: Yang Xu Signed-off-by: Christian Brauner (Microsoft) Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/namei.c | 2 ++ 1 file changed, 2 insertions(+) --- a/fs/namei.c +++ b/fs/namei.c @@ -3465,6 +3465,8 @@ struct dentry *vfs_tmpfile(struct dentry child =3D d_alloc(dentry, &slash_name); if (unlikely(!child)) goto out_err; + if (!IS_POSIXACL(dir)) + mode &=3D ~current_umask(); error =3D dir->i_op->tmpfile(dir, child, mode); if (error) goto out_err; From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0EB5DC32772 for ; Tue, 23 Aug 2022 09:31:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350567AbiHWJa3 (ORCPT ); Tue, 23 Aug 2022 05:30:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51024 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350213AbiHWJ2u (ORCPT ); Tue, 23 Aug 2022 05:28:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 05B2791D34; Tue, 23 Aug 2022 01:37:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BFAA761338; Tue, 23 Aug 2022 08:36:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 661C7C433D6; Tue, 23 Aug 2022 08:36:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243801; bh=gqbaW8/ikRdd6TxRUOKi9A3Jc4QfMJtxgR9AO8Z7Cpk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bRdk4QkV7IG5Xzioet0b92s9A5eKaeSpXgRKw4rRQZ3FdSoHLtKqpU5Apyvml1v+8 pmjk5ySuXyTe8FKZz/OfjwatNWoSyZnLGJfUMTs47Gmt0/PmpvmSAYhUH5WE1wCl+m 3Ens0CFAFoMppyMDPWMNQlL7ACYKEppBHaP3Hfes= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jann Horn , Oleksij Rempel , Lukas Wunner , Oliver Neukum , Jakub Kicinski Subject: [PATCH 4.14 025/229] usbnet: Fix linkwatch use-after-free on disconnect Date: Tue, 23 Aug 2022 10:23:06 +0200 Message-Id: <20220823080054.355292979@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Wunner commit a69e617e533edddf3fa3123149900f36e0a6dc74 upstream. usbnet uses the work usbnet_deferred_kevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in ->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock": https://git.kernel.org/tglx/history/c/0f138bbfd83c The change was made because back then, the kernel's workqueue implementation did not allow waiting for a single work. One had to wait for completion of *all* work by calling flush_scheduled_work(), and that could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex held in ->ndo_stop(). The commit solved one problem but created another: It causes a use-after-free in USB Ethernet drivers aqc111.c, asix_devices.c, ax88179_178a.c, ch9200.c and smsc75xx.c: * If the drivers receive a link change interrupt immediately before disconnect, they raise EVENT_LINK_RESET in their (non-sleepable) ->status() callback and schedule usbnet_deferred_kevent(). * usbnet_deferred_kevent() invokes the driver's ->link_reset() callback, which calls netif_carrier_{on,off}(). * That in turn schedules the work linkwatch_event(). Because usbnet_deferred_kevent() is awaited after unregister_netdev(), netif_carrier_{on,off}() may operate on an unregistered netdev and linkwatch_event() may run after free_netdev(), causing a use-after-free. In 2010, usbnet was changed to only wait for a single instance of usbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf ("drivers/net: don't use flush_scheduled_work()"). Unfortunately the commit neglected to move the wait back to ->ndo_stop(). Rectify that omission at long last. Reported-by: Jann Horn Link: https://lore.kernel.org/netdev/CAG48ez0MHBbENX5gCdHAUXZ7h7s20LnepBF-p= a5M=3D7Bi-jZrEA@mail.gmail.com/ Reported-by: Oleksij Rempel Link: https://lore.kernel.org/netdev/20220315113841.GA22337@pengutronix.de/ Signed-off-by: Lukas Wunner Cc: stable@vger.kernel.org Acked-by: Oliver Neukum Link: https://lore.kernel.org/r/d1c87ebe9fc502bffcd1576e238d685ad08321e4.16= 55987888.git.lukas@wunner.de Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/usb/usbnet.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -847,13 +847,11 @@ int usbnet_stop (struct net_device *net) =20 mpn =3D !test_and_clear_bit(EVENT_NO_RUNTIME_PM, &dev->flags); =20 - /* deferred work (task, timer, softirq) must also stop. - * can't flush_scheduled_work() until we drop rtnl (later), - * else workers could deadlock; so make workers a NOP. - */ + /* deferred work (timer, softirq, task) must also stop */ dev->flags =3D 0; del_timer_sync (&dev->delay); tasklet_kill (&dev->bh); + cancel_work_sync(&dev->kevent); if (!pm) usb_autopm_put_interface(dev->intf); =20 @@ -1616,8 +1614,6 @@ void usbnet_disconnect (struct usb_inter net =3D dev->net; unregister_netdev (net); =20 - cancel_work_sync(&dev->kevent); - usb_scuttle_anchored_urbs(&dev->deferred); =20 if (dev->driver_info->unbind) From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 343DAC32772 for ; Tue, 23 Aug 2022 09:32:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350351AbiHWJcA (ORCPT ); Tue, 23 Aug 2022 05:32:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51022 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350527AbiHWJaX (ORCPT ); Tue, 23 Aug 2022 05:30:23 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CEC37923F0; Tue, 23 Aug 2022 01:37:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9EA39B81C35; Tue, 23 Aug 2022 08:36:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01561C433C1; Tue, 23 Aug 2022 08:36:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243804; bh=vWwA4f4O0Bfos50TDwGtYO/p5gav7IBXlJJI5sEDmao=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wWL4YHd35MhrYi0OnY8k53WozE7iVZ1XwCQV5fYF50Uu7zpsWho4QpAtPTqePXz/g Thgdivg/y5qEY6yPjvbHPr0HchTlmeG9Xtq+kYcXclr0W8AxNgVEeeFWLofkFVpLej uNS+komgNRVumxZ+EclChohyq4KdFLxoI+jSO+cg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller Subject: [PATCH 4.14 026/229] parisc: Fix device names in /proc/iomem Date: Tue, 23 Aug 2022 10:23:07 +0200 Message-Id: <20220823080054.396142524@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller commit cab56b51ec0e69128909cef4650e1907248d821b upstream. Fix the output of /proc/iomem to show the real hardware device name including the pa_pathname, e.g. "Merlin 160 Core Centronics [8:16:0]". Up to now only the pa_pathname ("[8:16.0]") was shown. Signed-off-by: Helge Deller Cc: # v4.9+ Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/parisc/kernel/drivers.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) --- a/arch/parisc/kernel/drivers.c +++ b/arch/parisc/kernel/drivers.c @@ -505,7 +505,6 @@ alloc_pa_dev(unsigned long hpa, struct h dev->id.hversion_rev =3D iodc_data[1] & 0x0f; dev->id.sversion =3D ((iodc_data[4] & 0x0f) << 16) | (iodc_data[5] << 8) | iodc_data[6]; - dev->hpa.name =3D parisc_pathname(dev); dev->hpa.start =3D hpa; /* This is awkward. The STI spec says that gfx devices may occupy * 32MB or 64MB. Unfortunately, we don't know how to tell whether @@ -519,10 +518,10 @@ alloc_pa_dev(unsigned long hpa, struct h dev->hpa.end =3D hpa + 0xfff; } dev->hpa.flags =3D IORESOURCE_MEM; - name =3D parisc_hardware_description(&dev->id); - if (name) { - strlcpy(dev->name, name, sizeof(dev->name)); - } + dev->hpa.name =3D dev->name; + name =3D parisc_hardware_description(&dev->id) ? : "unknown"; + snprintf(dev->name, sizeof(dev->name), "%s [%s]", + name, parisc_pathname(dev)); =20 /* Silently fail things like mouse ports which are subsumed within * the keyboard controller From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56515C32774 for ; Tue, 23 Aug 2022 09:31:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235140AbiHWJbg (ORCPT ); Tue, 23 Aug 2022 05:31:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53160 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350215AbiHWJ2u (ORCPT ); Tue, 23 Aug 2022 05:28:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4071077541; Tue, 23 Aug 2022 01:37:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E4D0A614F5; Tue, 23 Aug 2022 08:36:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D5CF6C433D6; Tue, 23 Aug 2022 08:36:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243807; bh=38z5+1E7HVbT6HeQjqkDPqJFtUVE6OakjVGr/qrHk+k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FHK0OQQInPAIudxUQ6fZtPJbDZgU/kicBVQIEu5GBp+m1W362TXaGjXjlZyvyPPlr Jeq18MTVwvswR+mR/T4ZESbvjoBzSPF5VcRyw6F1soYnNf42rGMAFULDDEClJoMKGW B+9U/HBhYVMz7q2M77EY1aZjwyG7jrSo1rDEc+vc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Timur Tabi , Karol Herbst , Lyude Paul Subject: [PATCH 4.14 027/229] drm/nouveau: fix another off-by-one in nvbios_addr Date: Tue, 23 Aug 2022 10:23:08 +0200 Message-Id: <20220823080054.440387469@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Timur Tabi commit c441d28945fb113220d48d6c86ebc0b090a2b677 upstream. This check determines whether a given address is part of image 0 or image 1. Image 1 starts at offset image0_size, so that address should be included. Fixes: 4d4e9907ff572 ("drm/nouveau/bios: guard against out-of-bounds access= es to image") Cc: # v4.8+ Signed-off-by: Timur Tabi Reviewed-by: Karol Herbst Signed-off-by: Lyude Paul Link: https://patchwork.freedesktop.org/patch/msgid/20220511163716.3520591-= 1-ttabi@nvidia.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c +++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c @@ -33,7 +33,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 { u32 p =3D *addr; =20 - if (*addr > bios->image0_size && bios->imaged_addr) { + if (*addr >=3D bios->image0_size && bios->imaged_addr) { *addr -=3D bios->image0_size; *addr +=3D bios->imaged_addr; } From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A2A8C32772 for ; Tue, 23 Aug 2022 09:32:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350683AbiHWJce (ORCPT ); Tue, 23 Aug 2022 05:32:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53302 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350932AbiHWJbC (ORCPT ); Tue, 23 Aug 2022 05:31:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7A443923FB; Tue, 23 Aug 2022 01:38:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 06727614E9; Tue, 23 Aug 2022 08:36:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B3FDC433C1; Tue, 23 Aug 2022 08:36:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243810; bh=sAdOeYBAPi9CerLXn7XWAIKEmLZgLjt+4p7AzfjIoMk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q5dUJ/SwQCcvuDq0GWdJohR461JN/SvMld572MgP4VKfct5aapXYXLTWl9nQHYJtI ks6BxHynsSNILUzLxSV1CJ0fFSQcKOCBvJZ8hRlDcxJvpwCQWTEtEyGvY3XCr7/Bhn 5tkkOCtdKHclG4wR1SS4RdSjKbqXsp3DDJ114VUI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Leo Li , Alex Deucher , =?UTF-8?q?Christian=20K=C3=B6nig?= Subject: [PATCH 4.14 028/229] drm/amdgpu: Check BOs requested pinning domains against its preferred_domains Date: Tue, 23 Aug 2022 10:23:09 +0200 Message-Id: <20220823080054.483979397@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Leo Li commit f5ba14043621f4afdf3ad5f92ee2d8dbebbe4340 upstream. When pinning a buffer, we should check to see if there are any additional restrictions imposed by bo->preferred_domains. This will prevent the BO from being moved to an invalid domain when pinning. For example, this can happen if the user requests to create a BO in GTT domain for display scanout. amdgpu_dm will allow pinning to either VRAM or GTT domains, since DCN can scanout from either or. However, in amdgpu_bo_pin_restricted(), pinning to VRAM is preferred if there is adequate carveout. This can lead to pinning to VRAM despite the user requesting GTT placement for the BO. v2: Allow the kernel to override the domain, which can happen when exporting a BO to a V4L camera (for example). Signed-off-by: Leo Li Reviewed-by: Alex Deucher Reviewed-by: Christian K=C3=B6nig Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c @@ -682,6 +682,10 @@ int amdgpu_bo_pin_restricted(struct amdg if (WARN_ON_ONCE(min_offset > max_offset)) return -EINVAL; =20 + /* Check domain to be pinned to against preferred domains */ + if (bo->preferred_domains & domain) + domain =3D bo->preferred_domains & domain; + /* A shared bo cannot be migrated to VRAM */ if (bo->prime_shared_count) { if (domain & AMDGPU_GEM_DOMAIN_GTT) From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 892BEC32772 for ; Tue, 23 Aug 2022 09:44:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241959AbiHWJon (ORCPT ); Tue, 23 Aug 2022 05:44:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42140 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352303AbiHWJlL (ORCPT ); Tue, 23 Aug 2022 05:41:11 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 611E969F50; Tue, 23 Aug 2022 01:42:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C77C4B81C60; Tue, 23 Aug 2022 08:36:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1D025C433C1; Tue, 23 Aug 2022 08:36:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243813; bh=44fGQV+kG3Jg42x+1HawgyqUwq+Q9vZOHBEqydMZa2E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QbDJjSLRsm1ojvzn8NEycp4FS2jF7g29T1Y0y8OvnCTQM0rCCyWDR0MIZave11h/W uOAkA0c0z5nhIvhuUpQ8DO3ZdXflRqypiWR1MShvjgWCGnkpK4hzToKiGlM7jx2rpK utY6tJo0+RqDNQlNZPkF+HZr3Gb9NqEHgEEdqlG0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.14 029/229] iio: light: isl29028: Fix the warning in isl29028_remove() Date: Tue, 23 Aug 2022 10:23:10 +0200 Message-Id: <20220823080054.531378813@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma commit 06674fc7c003b9d0aa1d37fef7ab2c24802cc6ad upstream. The driver use the non-managed form of the register function in isl29028_remove(). To keep the release order as mirroring the ordering in probe, the driver should use non-managed form in probe, too. The following log reveals it: [ 32.374955] isl29028 0-0010: remove [ 32.376861] general protection fault, probably for non-canonical address= 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI [ 32.377676] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000= 000000037] [ 32.379432] RIP: 0010:kernfs_find_and_get_ns+0x28/0xe0 [ 32.385461] Call Trace: [ 32.385807] sysfs_unmerge_group+0x59/0x110 [ 32.386110] dpm_sysfs_remove+0x58/0xc0 [ 32.386391] device_del+0x296/0xe50 [ 32.386959] cdev_device_del+0x1d/0xd0 [ 32.387231] devm_iio_device_unreg+0x27/0xb0 [ 32.387542] devres_release_group+0x319/0x3d0 [ 32.388162] i2c_device_remove+0x93/0x1f0 Fixes: 2db5054ac28d ("staging: iio: isl29028: add runtime power management = support") Signed-off-by: Zheyu Ma Link: https://lore.kernel.org/r/20220717004241.2281028-1-zheyuma97@gmail.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/iio/light/isl29028.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/light/isl29028.c +++ b/drivers/iio/light/isl29028.c @@ -640,7 +640,7 @@ static int isl29028_probe(struct i2c_cli ISL29028_POWER_OFF_DELAY_MS); pm_runtime_use_autosuspend(&client->dev); =20 - ret =3D devm_iio_device_register(indio_dev->dev.parent, indio_dev); + ret =3D iio_device_register(indio_dev); if (ret < 0) { dev_err(&client->dev, "%s(): iio registration failed with error %d\n", From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7F64C32792 for ; Tue, 23 Aug 2022 09:32:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350744AbiHWJcp (ORCPT ); Tue, 23 Aug 2022 05:32:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38778 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351019AbiHWJbK (ORCPT ); Tue, 23 Aug 2022 05:31:10 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A37B9351B; Tue, 23 Aug 2022 01:38:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0621061538; Tue, 23 Aug 2022 08:36:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 03FCDC43140; Tue, 23 Aug 2022 08:36:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243816; bh=MSkgAf1zIqW/oIhnY3v5vqHnCfp7wiwThy3eGepHuUI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F6+9y8Np4FzyzxkmC5PO2s4kEeJcSjJrs831dzxQ/LLjObXweHxV+q2ZtqHemvwsB v1WtbaWPNugrZKrlet1guTPmJbKrS5Gmew1cVV8TJNmyN2IfOgDiAx5Rrw/XGJXPt5 dHDSpYp76omHIpg+b/eomWry6I49Awl6Zaax+EEg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miklos Szeredi Subject: [PATCH 4.14 030/229] fuse: limit nsec Date: Tue, 23 Aug 2022 10:23:11 +0200 Message-Id: <20220823080054.572703405@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miklos Szeredi commit 47912eaa061a6a81e4aa790591a1874c650733c0 upstream. Limit nanoseconds to 0..999999999. Fixes: d8a5ba45457e ("[PATCH] FUSE - core") Cc: Signed-off-by: Miklos Szeredi Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/fuse/inode.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -174,6 +174,12 @@ void fuse_change_attributes_common(struc inode->i_uid =3D make_kuid(&init_user_ns, attr->uid); inode->i_gid =3D make_kgid(&init_user_ns, attr->gid); inode->i_blocks =3D attr->blocks; + + /* Sanitize nsecs */ + attr->atimensec =3D min_t(u32, attr->atimensec, NSEC_PER_SEC - 1); + attr->mtimensec =3D min_t(u32, attr->mtimensec, NSEC_PER_SEC - 1); + attr->ctimensec =3D min_t(u32, attr->ctimensec, NSEC_PER_SEC - 1); + inode->i_atime.tv_sec =3D attr->atime; inode->i_atime.tv_nsec =3D attr->atimensec; /* mtime from server may be stale due to local buffered write */ From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97B04C32772 for ; Tue, 23 Aug 2022 09:32:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350386AbiHWJcG (ORCPT ); Tue, 23 Aug 2022 05:32:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38532 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350594AbiHWJah (ORCPT ); Tue, 23 Aug 2022 05:30:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 615DB76752; Tue, 23 Aug 2022 01:37:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F1F0D6153F; Tue, 23 Aug 2022 08:36:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01871C433D6; Tue, 23 Aug 2022 08:36:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243819; bh=83vKly5RIZKW8TzjwWoq6rTFWBXa0AYVIp5ttn/oWzQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BKR6VN9KPk4NnNBBj7kN6EVW0SFE7zPSjz77WUBT8o7zdZQZtA3GGgjgIaYA4Jo+U VFwnGSFEAwXGCP8NAKC/aGqwfVt7KmPHGU+W6uw/Z0aGOoqE6HYehbyd9Tb5emiakS PjdgmvPGV0sFlHYZqrI6VuE7wf+ZfOmOEkKXuK6I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Song Liu , Jens Axboe Subject: [PATCH 4.14 031/229] md-raid10: fix KASAN warning Date: Tue, 23 Aug 2022 10:23:12 +0200 Message-Id: <20220823080054.612888954@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit d17f744e883b2f8d13cca252d71cfe8ace346f7d upstream. There's a KASAN warning in raid10_remove_disk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the value "number" is valid. BUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10] Read of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682 CPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/= 2014 Call Trace: dump_stack_lvl+0x34/0x44 print_report.cold+0x45/0x57a ? __lock_text_start+0x18/0x18 ? raid10_remove_disk+0x61/0x2a0 [raid10] kasan_report+0xa8/0xe0 ? raid10_remove_disk+0x61/0x2a0 [raid10] raid10_remove_disk+0x61/0x2a0 [raid10] Buffer I/O error on dev dm-76, logical block 15344, async page read ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0 remove_and_add_spares+0x367/0x8a0 [md_mod] ? super_written+0x1c0/0x1c0 [md_mod] ? mutex_trylock+0xac/0x120 ? _raw_spin_lock+0x72/0xc0 ? _raw_spin_lock_bh+0xc0/0xc0 md_check_recovery+0x848/0x960 [md_mod] raid10d+0xcf/0x3360 [raid10] ? sched_clock_cpu+0x185/0x1a0 ? rb_erase+0x4d4/0x620 ? var_wake_function+0xe0/0xe0 ? psi_group_change+0x411/0x500 ? preempt_count_sub+0xf/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? raid10_sync_request+0x36c0/0x36c0 [raid10] ? preempt_count_sub+0xf/0xc0 ? _raw_spin_unlock_irqrestore+0x19/0x40 ? del_timer_sync+0xa9/0x100 ? try_to_del_timer_sync+0xc0/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? _raw_spin_unlock_irq+0x11/0x24 ? __list_del_entry_valid+0x68/0xa0 ? finish_wait+0xa3/0x100 md_thread+0x161/0x260 [md_mod] ? unregister_md_personality+0xa0/0xa0 [md_mod] ? _raw_spin_lock_irqsave+0x78/0xc0 ? prepare_to_wait_event+0x2c0/0x2c0 ? unregister_md_personality+0xa0/0xa0 [md_mod] kthread+0x148/0x180 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 Allocated by task 124495: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x80/0xa0 setup_conf+0x140/0x5c0 [raid10] raid10_run+0x4cd/0x740 [raid10] md_run+0x6f9/0x1300 [md_mod] raid_ctr+0x2531/0x4ac0 [dm_raid] dm_table_add_target+0x2b0/0x620 [dm_mod] table_load+0x1c8/0x400 [dm_mod] ctl_ioctl+0x29e/0x560 [dm_mod] dm_compat_ctl_ioctl+0x7/0x20 [dm_mod] __do_compat_sys_ioctl+0xfa/0x160 do_syscall_64+0x90/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 L __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff889108f3d200 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte region [ffff889108f3d200, ffff889108f3d300) The buggy address belongs to the physical page: page:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:= 0x0 pfn:0x1108f3c head:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=3D2) raw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff889108f3d280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff889108f3d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff889108f3d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff889108f3d400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: Song Liu Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/md/raid10.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1831,9 +1831,12 @@ static int raid10_remove_disk(struct mdd int err =3D 0; int number =3D rdev->raid_disk; struct md_rdev **rdevp; - struct raid10_info *p =3D conf->mirrors + number; + struct raid10_info *p; =20 print_conf(conf); + if (unlikely(number >=3D mddev->raid_disks)) + return 0; + p =3D conf->mirrors + number; if (rdev =3D=3D p->rdev) rdevp =3D &p->rdev; else if (rdev =3D=3D p->replacement) From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51949C32772 for ; Tue, 23 Aug 2022 09:38:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241360AbiHWJit (ORCPT ); Tue, 23 Aug 2022 05:38:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52354 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351479AbiHWJho (ORCPT ); Tue, 23 Aug 2022 05:37:44 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F277298A6D; Tue, 23 Aug 2022 01:40:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BF3E061326; Tue, 23 Aug 2022 08:39:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C2CA7C433D6; Tue, 23 Aug 2022 08:39:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243996; bh=YLHITOvYu0lt7iEImGEtaN+nTdRoAlJHZbNZO7E2YxY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MbOxqPD1D+vkF1Pcbvh0w7RJP1SYtbGXExf9+2pFKo/85crafWQOZRaYCs+0ZLEtf oKLjkYCryIYe3vpm5Adi9VT92WfF/tBOZwrvcXyTmTIOkroSbD32UQPsvfEeKW1V7+ MNKtzPnqVcYRywP6W/AteWF14CHnoQW7blQu8hho= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Alexander Lobakin , Andy Shevchenko , Yury Norov Subject: [PATCH 4.14 032/229] ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr() Date: Tue, 23 Aug 2022 10:23:13 +0200 Message-Id: <20220823080054.666162644@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Lobakin commit e5a16a5c4602c119262f350274021f90465f479d upstream. test_bit(), as any other bitmap op, takes `unsigned long *` as a second argument (pointer to the actual bitmap), as any bitmap itself is an array of unsigned longs. However, the ia64_get_irr() code passes a ref to `u64` as a second argument. This works with the ia64 bitops implementation due to that they have `void *` as the second argument and then cast it later on. This works with the bitmap API itself due to that `unsigned long` has the same size on ia64 as `u64` (`unsigned long long`), but from the compiler PoV those two are different. Define @irr as `unsigned long` to fix that. That implies no functional changes. Has been hidden for 16 years! Fixes: a58786917ce2 ("[IA64] avoid broken SAL_CACHE_FLUSH implementations") Cc: stable@vger.kernel.org # 2.6.16+ Reported-by: kernel test robot Signed-off-by: Alexander Lobakin Reviewed-by: Andy Shevchenko Reviewed-by: Yury Norov Signed-off-by: Yury Norov Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/ia64/include/asm/processor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/ia64/include/asm/processor.h +++ b/arch/ia64/include/asm/processor.h @@ -552,7 +552,7 @@ ia64_get_irr(unsigned int vector) { unsigned int reg =3D vector / 64; unsigned int bit =3D vector % 64; - u64 irr; + unsigned long irr; =20 switch (reg) { case 0: irr =3D ia64_getreg(_IA64_REG_CR_IRR0); break; From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 868B5C32772 for ; Tue, 23 Aug 2022 09:33:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350996AbiHWJdU (ORCPT ); Tue, 23 Aug 2022 05:33:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351304AbiHWJbb (ORCPT ); Tue, 23 Aug 2022 05:31:31 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3259B2CC88; Tue, 23 Aug 2022 01:38:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D51B161530; Tue, 23 Aug 2022 08:37:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C46BDC433D6; Tue, 23 Aug 2022 08:37:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243847; bh=7oHLfdxUfI49xPBE6W9NwDX0o2JYr7uHVpkexMqKnlc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hn2eEI2pTRjWZpUrLnKHwGaRnX4973R1Mwa/ORNn6RzS2r3h58d8i1j9xJ9le8g/b 7B7vYEVrHWmrZ+4/lRAFdvh4ohYV2uEezXc3p0U9HZpq0C+o4IKF7kXgCBi4WVjppe c+HMbAnUzkfuEghNZcMDp+cNWZ3FBYL7yqeVJpbA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Pali=20Roh=C3=A1r?= , Bjorn Helgaas , Naresh Kamboju , Guenter Roeck Subject: [PATCH 4.14 033/229] PCI: Add defines for normal and subtractive PCI bridges Date: Tue, 23 Aug 2022 10:23:14 +0200 Message-Id: <20220823080054.708220842@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pali Roh=C3=A1r commit 904b10fb189cc15376e9bfce1ef0282e68b0b004 upstream. Add these PCI class codes to pci_ids.h: PCI_CLASS_BRIDGE_PCI_NORMAL PCI_CLASS_BRIDGE_PCI_SUBTRACTIVE Use these defines in all kernel code for describing PCI class codes for normal and subtractive PCI bridges. [bhelgaas: similar change in pci-mvebu.c] Link: https://lore.kernel.org/r/20220214114109.26809-1-pali@kernel.org Signed-off-by: Pali Roh=C3=A1r Signed-off-by: Bjorn Helgaas Cc: Guenter Roeck a Cc: Naresh Kamboju [ gregkh - take only the pci_ids.h portion for stable backports ] Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/linux/pci_ids.h | 2 ++ 1 file changed, 2 insertions(+) --- a/include/linux/pci_ids.h +++ b/include/linux/pci_ids.h @@ -59,6 +59,8 @@ #define PCI_CLASS_BRIDGE_EISA 0x0602 #define PCI_CLASS_BRIDGE_MC 0x0603 #define PCI_CLASS_BRIDGE_PCI 0x0604 +#define PCI_CLASS_BRIDGE_PCI_NORMAL 0x060400 +#define PCI_CLASS_BRIDGE_PCI_SUBTRACTIVE 0x060401 #define PCI_CLASS_BRIDGE_PCMCIA 0x0605 #define PCI_CLASS_BRIDGE_NUBUS 0x0606 #define PCI_CLASS_BRIDGE_CARDBUS 0x0607 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A44D4C32772 for ; Tue, 23 Aug 2022 09:35:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350576AbiHWJfT (ORCPT ); Tue, 23 Aug 2022 05:35:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38532 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351130AbiHWJeX (ORCPT ); Tue, 23 Aug 2022 05:34:23 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1C1FE48E83; Tue, 23 Aug 2022 01:39:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D8B7AB81C65; Tue, 23 Aug 2022 08:38:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18E0AC433D6; Tue, 23 Aug 2022 08:38:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243881; bh=mB+QeLdtXDfUxawUS97f6jMYGaHxQ+B3Mh18ctmz3eM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MmAMBu6+Z9V+4EtCLixbsmCb90TKlhB/mQsyRE8xUNGNt3Z2ipzB69wLiLu10AKh+ 3LVCKdNyKpraEYgRUWWmv6WdUys5as+pAOwYlc21yfBBi5UehlOS3BOoFoZzqHWK2c fFMNlmqt4fzazThe+gis5PVtSiEM5NEJn4GPJy2Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Pali=20Roh=C3=A1r?= , Michael Ellerman Subject: [PATCH 4.14 034/229] powerpc/fsl-pci: Fix Class Code of PCIe Root Port Date: Tue, 23 Aug 2022 10:23:15 +0200 Message-Id: <20220823080054.759237296@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pali Roh=C3=A1r commit 0c551abfa004ce154d487d91777bf221c808a64f upstream. By default old pre-3.0 Freescale PCIe controllers reports invalid PCI Class Code 0x0b20 for PCIe Root Port. It can be seen by lspci -b output on P2020 board which has this pre-3.0 controller: $ lspci -bvnn 00:00.0 Power PC [0b20]: Freescale Semiconductor Inc P2020E [1957:0070] (= rev 21) !!! Invalid class 0b20 for header type 01 Capabilities: [4c] Express Root Port (Slot-), MSI 00 Fix this issue by programming correct PCI Class Code 0x0604 for PCIe Root Port to the Freescale specific PCIe register 0x474. With this change lspci -b output is: $ lspci -bvnn 00:00.0 PCI bridge [0604]: Freescale Semiconductor Inc P2020E [1957:0070]= (rev 21) (prog-if 00 [Normal decode]) Capabilities: [4c] Express Root Port (Slot-), MSI 00 Without any "Invalid class" error. So class code was properly reflected into standard (read-only) PCI register 0x08. Same fix is already implemented in U-Boot pcie_fsl.c driver in commit: http://source.denx.de/u-boot/u-boot/-/commit/d18d06ac35229345a0af80977a408c= fbe1d1015b Fix activated by U-Boot stay active also after booting Linux kernel. But boards which use older U-Boot version without that fix are affected and still require this fix. So implement this class code fix also in kernel fsl_pci.c driver. Cc: stable@vger.kernel.org Signed-off-by: Pali Roh=C3=A1r Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220706101043.4867-1-pali@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/powerpc/sysdev/fsl_pci.c | 8 ++++++++ arch/powerpc/sysdev/fsl_pci.h | 1 + 2 files changed, 9 insertions(+) --- a/arch/powerpc/sysdev/fsl_pci.c +++ b/arch/powerpc/sysdev/fsl_pci.c @@ -523,6 +523,7 @@ int fsl_add_bridge(struct platform_devic struct resource rsrc; const int *bus_range; u8 hdr_type, progif; + u32 class_code; struct device_node *dev; struct ccsr_pci __iomem *pci; u16 temp; @@ -596,6 +597,13 @@ int fsl_add_bridge(struct platform_devic PPC_INDIRECT_TYPE_SURPRESS_PRIMARY_BUS; if (fsl_pcie_check_link(hose)) hose->indirect_type |=3D PPC_INDIRECT_TYPE_NO_PCIE_LINK; + /* Fix Class Code to PCI_CLASS_BRIDGE_PCI_NORMAL for pre-3.0 controller = */ + if (in_be32(&pci->block_rev1) < PCIE_IP_REV_3_0) { + early_read_config_dword(hose, 0, 0, PCIE_FSL_CSR_CLASSCODE, &class_code= ); + class_code &=3D 0xff; + class_code |=3D PCI_CLASS_BRIDGE_PCI_NORMAL << 8; + early_write_config_dword(hose, 0, 0, PCIE_FSL_CSR_CLASSCODE, class_code= ); + } } else { /* * Set PBFR(PCI Bus Function Register)[10] =3D 1 to --- a/arch/powerpc/sysdev/fsl_pci.h +++ b/arch/powerpc/sysdev/fsl_pci.h @@ -23,6 +23,7 @@ struct platform_device; =20 #define PCIE_LTSSM 0x0404 /* PCIE Link Training and Status */ #define PCIE_LTSSM_L0 0x16 /* L0 state */ +#define PCIE_FSL_CSR_CLASSCODE 0x474 /* FSL GPEX CSR */ #define PCIE_IP_REV_2_2 0x02080202 /* PCIE IP block version Rev2.2 */ #define PCIE_IP_REV_3_0 0x02080300 /* PCIE IP block version Rev3.0 */ #define PIWAR_EN 0x80000000 /* Enable */ From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC2EAC32792 for ; Tue, 23 Aug 2022 09:36:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351152AbiHWJgt (ORCPT ); Tue, 23 Aug 2022 05:36:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351129AbiHWJfP (ORCPT ); Tue, 23 Aug 2022 05:35:15 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 290A695E7F; Tue, 23 Aug 2022 01:39:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 889106132D; Tue, 23 Aug 2022 08:38:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 788F4C433D6; Tue, 23 Aug 2022 08:38:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243915; bh=b09QnvDg7xfHPslMRVg7vHUSCPbJTeYQlqKvtTja7U4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xByAZDETCrENvkjbaP4OnqiZ4zUWxKq99jrHto5unDhGUvAv9jYC1vx8/U4NoWemc LWoAJbAiqFW9lCzCZ/Rqv/IWt/vfR4/oYvDm6uAWOpxyXSbBYFalHRbiQEfMPzrGvH tTNkrAzLLScRcFGDzIHr0xToJ4BxaKN7I6utPcbw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Jason A. Donenfeld" , Michael Ellerman Subject: [PATCH 4.14 035/229] powerpc/powernv: Avoid crashing if rng is NULL Date: Tue, 23 Aug 2022 10:23:16 +0200 Message-Id: <20220823080054.807322627@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Ellerman commit 90b5d4fe0b3ba7f589c6723c6bfb559d9e83956a upstream. On a bare-metal Power8 system that doesn't have an "ibm,power-rng", a malicious QEMU and guest that ignore the absence of the KVM_CAP_PPC_HWRNG flag, and calls H_RANDOM anyway, will dereference a NULL pointer. In practice all Power8 machines have an "ibm,power-rng", but let's not rely on that, add a NULL check and early return in powernv_get_random_real_mode(). Fixes: e928e9cb3601 ("KVM: PPC: Book3S HV: Add fast real-mode H_RANDOM impl= ementation.") Cc: stable@vger.kernel.org # v4.1+ Signed-off-by: Jason A. Donenfeld Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220727143219.2684192-1-mpe@ellerman.id.au Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/powerpc/platforms/powernv/rng.c | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/powerpc/platforms/powernv/rng.c +++ b/arch/powerpc/platforms/powernv/rng.c @@ -63,6 +63,8 @@ int powernv_get_random_real_mode(unsigne struct powernv_rng *rng; =20 rng =3D raw_cpu_read(powernv_rng); + if (!rng) + return 0; =20 *v =3D rng_whiten(rng, __raw_rm_readq(rng->regs_real)); From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1C298C32774 for ; Tue, 23 Aug 2022 09:35:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351107AbiHWJfA (ORCPT ); Tue, 23 Aug 2022 05:35:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41454 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350897AbiHWJeJ (ORCPT ); Tue, 23 Aug 2022 05:34:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3458C94EDA; Tue, 23 Aug 2022 01:39:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D9FF761446; Tue, 23 Aug 2022 08:39:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DCE26C433D6; Tue, 23 Aug 2022 08:39:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243949; bh=4X2N5YLZivTElO/vwNdZbZrGvbTCeJ9ZbtX65VpGyDY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LTzHoro25J7UgTLDN4iWveIY2YJ7ov34+cykJJG/QighiwlIIuNjgrChLaBEilajh kCFAmYCwq5GeeUq4BwjcOCnknppylWSybJ/1B3trgRGHoVe0A9zTEChnWeMw8FQIQW waIhpyXMmndIi1IYIyAhFdUsTmJzmoA1Eazb1vhk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Huacai Chen , Thomas Bogendoerfer Subject: [PATCH 4.14 036/229] MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK Date: Tue, 23 Aug 2022 10:23:17 +0200 Message-Id: <20220823080054.849049647@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Huacai Chen commit e1a534f5d074db45ae5cbac41d8912b98e96a006 upstream. When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected, cpu_max_bits_warn() generates a runtime warning similar as below while we show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs. [ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_c= puinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.084034] Hardware name: Loongson Loongson-3A4000-7A1000-1w-V0.1-CRB/L= oongson-LS3A4000-7A1000-1w-EVB-V1.21, BIOS Loongson-UDK2018-V2.0.04082-beta= 7 04/27 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9= 000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9= 000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 f= fffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 9= 00000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0= 000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0= 000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0= 000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0= 000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 0= 0007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0= 000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<98000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9800000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<980000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9800000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9800000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<98000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<98000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<98000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<98000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9800000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9800000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]--- Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen Signed-off-by: Thomas Bogendoerfer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/mips/kernel/proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/mips/kernel/proc.c +++ b/arch/mips/kernel/proc.c @@ -164,7 +164,7 @@ static void *c_start(struct seq_file *m, { unsigned long i =3D *pos; =20 - return i < NR_CPUS ? (void *) (i + 1) : NULL; + return i < nr_cpu_ids ? (void *) (i + 1) : NULL; } =20 static void *c_next(struct seq_file *m, void *v, loff_t *pos) From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14890C32772 for ; Tue, 23 Aug 2022 09:39:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241263AbiHWJjM (ORCPT ); Tue, 23 Aug 2022 05:39:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52832 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351276AbiHWJiW (ORCPT ); Tue, 23 Aug 2022 05:38:22 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C1B6469F48; Tue, 23 Aug 2022 01:40:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6CF8EB81C62; Tue, 23 Aug 2022 08:39:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B1D1CC433D6; Tue, 23 Aug 2022 08:39:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243980; bh=ZUgivN8zhNC9/Vowk6oVJLvlCbVPWbn1Iq8fxa3fI6I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JMviMhyCdG+yCk0OS6r9kUhpFOBX47cgs9daJMRptZwJYZGMUK1f1sfKhoLd04VTX ZIN3AM8H3Wy00rLQEOLC2o/rwjHEaQnEhC9HSvfFaJckDncTFlPMg2KeMBPK6DRh21 JUqtWAEFC482h4QQttgEN3mg/T6xBnZivYEAnvH8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Alan Stern , Weitao Wang Subject: [PATCH 4.14 037/229] USB: HCD: Fix URB giveback issue in tasklet function Date: Tue, 23 Aug 2022 10:23:18 +0200 Message-Id: <20220823080054.902065549@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Weitao Wang commit 26c6c2f8a907c9e3a2f24990552a4d77235791e6 upstream. Usb core introduce the mechanism of giveback of URB in tasklet context to reduce hardware interrupt handling time. On some test situation(such as FIO with 4KB block size), when tasklet callback function called to giveback URB, interrupt handler add URB node to the bh->head list also. If check bh->head list again after finish all URB giveback of local_list, then it may introduce a "dynamic balance" between giveback URB and add URB to bh->head list. This tasklet callback function may not exit for a long time, which will cause other tasklet function calls to be delayed. Some real-time applications(such as KB and Mouse) will see noticeable lag. In order to prevent the tasklet function from occupying the cpu for a long time at a time, new URBS will not be added to the local_list even though the bh->head list is not empty. But also need to ensure the left URB giveback to be processed in time, so add a member high_prio for structure giveback_urb_bh to prioritize tasklet and schelule this tasklet again if bh->head list is not empty. At the same time, we are able to prioritize tasklet through structure member high_prio. So, replace the local high_prio_bh variable with this structure member in usb_hcd_giveback_urb. Fixes: 94dfd7edfd5c ("USB: HCD: support giveback of URB in tasklet context") Cc: stable Reviewed-by: Alan Stern Signed-off-by: Weitao Wang Link: https://lore.kernel.org/r/20220726074918.5114-1-WeitaoWang-oc@zhaoxin= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/core/hcd.c | 26 +++++++++++++++----------- include/linux/usb/hcd.h | 1 + 2 files changed, 16 insertions(+), 11 deletions(-) --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -1814,7 +1814,6 @@ static void usb_giveback_urb_bh(unsigned =20 spin_lock_irq(&bh->lock); bh->running =3D true; - restart: list_replace_init(&bh->head, &local_list); spin_unlock_irq(&bh->lock); =20 @@ -1828,10 +1827,17 @@ static void usb_giveback_urb_bh(unsigned bh->completing_ep =3D NULL; } =20 - /* check if there are new URBs to giveback */ + /* + * giveback new URBs next time to prevent this function + * from not exiting for a long time. + */ spin_lock_irq(&bh->lock); - if (!list_empty(&bh->head)) - goto restart; + if (!list_empty(&bh->head)) { + if (bh->high_prio) + tasklet_hi_schedule(&bh->bh); + else + tasklet_schedule(&bh->bh); + } bh->running =3D false; spin_unlock_irq(&bh->lock); } @@ -1856,7 +1862,7 @@ static void usb_giveback_urb_bh(unsigned void usb_hcd_giveback_urb(struct usb_hcd *hcd, struct urb *urb, int status) { struct giveback_urb_bh *bh; - bool running, high_prio_bh; + bool running; =20 /* pass status to tasklet via unlinked */ if (likely(!urb->unlinked)) @@ -1867,13 +1873,10 @@ void usb_hcd_giveback_urb(struct usb_hcd return; } =20 - if (usb_pipeisoc(urb->pipe) || usb_pipeint(urb->pipe)) { + if (usb_pipeisoc(urb->pipe) || usb_pipeint(urb->pipe)) bh =3D &hcd->high_prio_bh; - high_prio_bh =3D true; - } else { + else bh =3D &hcd->low_prio_bh; - high_prio_bh =3D false; - } =20 spin_lock(&bh->lock); list_add_tail(&urb->urb_list, &bh->head); @@ -1882,7 +1885,7 @@ void usb_hcd_giveback_urb(struct usb_hcd =20 if (running) ; - else if (high_prio_bh) + else if (bh->high_prio) tasklet_hi_schedule(&bh->bh); else tasklet_schedule(&bh->bh); @@ -2900,6 +2903,7 @@ int usb_add_hcd(struct usb_hcd *hcd, =20 /* initialize tasklets */ init_giveback_urb_bh(&hcd->high_prio_bh); + hcd->high_prio_bh.high_prio =3D true; init_giveback_urb_bh(&hcd->low_prio_bh); =20 /* enable irqs just before we start the controller, --- a/include/linux/usb/hcd.h +++ b/include/linux/usb/hcd.h @@ -65,6 +65,7 @@ =20 struct giveback_urb_bh { bool running; + bool high_prio; spinlock_t lock; struct list_head head; struct tasklet_struct bh; From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A224C32772 for ; Tue, 23 Aug 2022 09:37:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240766AbiHWJhO (ORCPT ); Tue, 23 Aug 2022 05:37:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38622 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351464AbiHWJfi (ORCPT ); Tue, 23 Aug 2022 05:35:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D3C496FEB; Tue, 23 Aug 2022 01:39:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B00EBB81C69; Tue, 23 Aug 2022 08:39:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DB841C433C1; Tue, 23 Aug 2022 08:39:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243983; bh=cCp7HDZu1TX9MiE28RgccNIpZL6o0PAcUvQZmt32Vb0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OyWipnLEm9S5+oekBJZc4nqYxT3T6q4PfjJc23EviWyFzRyHSzbs8LbUVxtwCBtj7 2CCGp/hpMXpdvPZP9eXKxxQDrCs8TgLs4EMXFYWGrie93H4vePbjiZxk2ZlCfVpqaE 5yMTdDXp5OlkGWJmuoo9vU4fFAcbhZT6SrYu3eCg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, mingi cho , Florian Westphal , Pablo Neira Ayuso Subject: [PATCH 4.14 038/229] netfilter: nf_tables: fix null deref due to zeroed list head Date: Tue, 23 Aug 2022 10:23:19 +0200 Message-Id: <20220823080054.943513120@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal commit 580077855a40741cf511766129702d97ff02f4d9 upstream. In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a null dereference: BUG: KASAN: null-ptr-deref in nft_trans_destroy+0x26/0x59 Call Trace: nft_trans_destroy+0x26/0x59 nf_tables_newtable+0x4bc/0x9bc [..] Its sane to assume that nft_trans_destroy() can be called on the transaction object returned by nft_trans_alloc(), so make sure the list head is initialised. Fixes: 55dd6f93076b ("netfilter: nf_tables: use new transaction infrastruct= ure to handle table") Reported-by: mingi cho Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+) --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -121,6 +121,7 @@ static struct nft_trans *nft_trans_alloc if (trans =3D=3D NULL) return NULL; =20 + INIT_LIST_HEAD(&trans->list); trans->msg_type =3D msg_type; trans->ctx =3D *ctx; From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83907C32793 for ; Tue, 23 Aug 2022 10:19:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353255AbiHWKTj (ORCPT ); Tue, 23 Aug 2022 06:19:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36054 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352698AbiHWKIc (ORCPT ); Tue, 23 Aug 2022 06:08:32 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D0E4A6DFA7; Tue, 23 Aug 2022 01:54:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A7FFDB81C54; Tue, 23 Aug 2022 08:39:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13D8EC433C1; Tue, 23 Aug 2022 08:39:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243986; bh=NtEwKMZ/Nfx57WqXVp8dLzBoBoDtiLiAqK5M3OVyZj0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UavR/g+vJINka8Vb6ngdEe9hodN3pXydW1sTCySVhwM5WY1AfoW6tAZV9XpI7dSs9 DxtH0VyY80rBTxAo5VFXD2bQoPBsf6VBikH+RWXHf+aIHiYlk79vaXGmB+CTyQwE2Q fQ2LHPYTTa4Q53HFS2U/NP4PAm4+SNzyn+3Z94U0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Francis Laniel , Will Deacon , Sasha Levin Subject: [PATCH 4.14 039/229] arm64: Do not forget syscall when starting a new thread. Date: Tue, 23 Aug 2022 10:23:20 +0200 Message-Id: <20220823080054.982504326@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Francis Laniel [ Upstream commit de6921856f99c11d3986c6702d851e1328d4f7f6 ] Enable tracing of the execve*() system calls with the syscalls:sys_exit_execve tracepoint by removing the call to forget_syscall() when starting a new thread and preserving the value of regs->syscallno across exec. Signed-off-by: Francis Laniel Link: https://lore.kernel.org/r/20220608162447.666494-2-flaniel@linux.micro= soft.com Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm64/include/asm/processor.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/pr= ocessor.h index 9eb95ab19924..8767f9d4ebc6 100644 --- a/arch/arm64/include/asm/processor.h +++ b/arch/arm64/include/asm/processor.h @@ -143,8 +143,9 @@ void tls_preserve_current_state(void); =20 static inline void start_thread_common(struct pt_regs *regs, unsigned long= pc) { + s32 previous_syscall =3D regs->syscallno; memset(regs, 0, sizeof(*regs)); - forget_syscall(regs); + regs->syscallno =3D previous_syscall; regs->pc =3D pc; } =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B286DC32772 for ; Tue, 23 Aug 2022 09:38:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351699AbiHWJix (ORCPT ); Tue, 23 Aug 2022 05:38:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52568 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351575AbiHWJh6 (ORCPT ); Tue, 23 Aug 2022 05:37:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE93232B89; Tue, 23 Aug 2022 01:40:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1577361517; Tue, 23 Aug 2022 08:39:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1F263C433D7; Tue, 23 Aug 2022 08:39:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243989; bh=5F9RsjFgVNOGiSc2oDB5+Far0a7iC5ApU7VDGncrxM0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LfziJT/DabePtSgAyMxlobBpsGxqozCktToWfc8I1nHbSpeDg+kj2KWcMJUR/ziYE 0b2xgZKBoKKfMKTB73SAuo0sfXRlVCKyVnZmn59Q+kBxTHtVD1rjMf3NDC0yM8Z3Je H1VlFMWKFM01R+PeP4xM7VkwhFQ4AxO4aI7podFQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, hewenliang , Haibin Zhang , Catalin Marinas , Will Deacon , Sasha Levin Subject: [PATCH 4.14 040/229] arm64: fix oops in concurrently setting insn_emulation sysctls Date: Tue, 23 Aug 2022 10:23:21 +0200 Message-Id: <20220823080055.024139667@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: haibinzhang (=E5=BC=A0=E6=B5=B7=E6=96=8C) [ Upstream commit af483947d472eccb79e42059276c4deed76f99a6 ] emulation_proc_handler() changes table->data for proc_dointvec_minmax and can generate the following Oops if called concurrently with itself: | Unable to handle kernel NULL pointer dereference at virtual address 0000= 000000000010 | Internal error: Oops: 96000006 [#1] SMP | Call trace: | update_insn_emulation_mode+0xc0/0x148 | emulation_proc_handler+0x64/0xb8 | proc_sys_call_handler+0x9c/0xf8 | proc_sys_write+0x18/0x20 | __vfs_write+0x20/0x48 | vfs_write+0xe4/0x1d0 | ksys_write+0x70/0xf8 | __arm64_sys_write+0x20/0x28 | el0_svc_common.constprop.0+0x7c/0x1c0 | el0_svc_handler+0x2c/0xa0 | el0_svc+0x8/0x200 To fix this issue, keep the table->data as &insn->current_mode and use container_of() to retrieve the insn pointer. Another mutex is used to protect against the current_mode update but not for retrieving insn_emulation as table->data is no longer changing. Co-developed-by: hewenliang Signed-off-by: hewenliang Signed-off-by: Haibin Zhang Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20220128090324.2727688-1-hewenliang4@huawei= .com Link: https://lore.kernel.org/r/9A004C03-250B-46C5-BF39-782D7551B00E@tencen= t.com Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm64/kernel/armv8_deprecated.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8= _deprecated.c index 092046704cbc..b82e32daaf66 100644 --- a/arch/arm64/kernel/armv8_deprecated.c +++ b/arch/arm64/kernel/armv8_deprecated.c @@ -63,6 +63,7 @@ struct insn_emulation { static LIST_HEAD(insn_emulation); static int nr_insn_emulated __initdata; static DEFINE_RAW_SPINLOCK(insn_emulation_lock); +static DEFINE_MUTEX(insn_emulation_mutex); =20 static void register_emulation_hooks(struct insn_emulation_ops *ops) { @@ -208,10 +209,10 @@ static int emulation_proc_handler(struct ctl_table *t= able, int write, loff_t *ppos) { int ret =3D 0; - struct insn_emulation *insn =3D (struct insn_emulation *) table->data; + struct insn_emulation *insn =3D container_of(table->data, struct insn_emu= lation, current_mode); enum insn_emulation_mode prev_mode =3D insn->current_mode; =20 - table->data =3D &insn->current_mode; + mutex_lock(&insn_emulation_mutex); ret =3D proc_dointvec_minmax(table, write, buffer, lenp, ppos); =20 if (ret || !write || prev_mode =3D=3D insn->current_mode) @@ -224,7 +225,7 @@ static int emulation_proc_handler(struct ctl_table *tab= le, int write, update_insn_emulation_mode(insn, INSN_UNDEF); } ret: - table->data =3D insn; + mutex_unlock(&insn_emulation_mutex); return ret; } =20 @@ -254,7 +255,7 @@ static void __init register_insn_emulation_sysctl(struc= t ctl_table *table) sysctl->maxlen =3D sizeof(int); =20 sysctl->procname =3D insn->ops->name; - sysctl->data =3D insn; + sysctl->data =3D &insn->current_mode; sysctl->extra1 =3D &insn->min; sysctl->extra2 =3D &insn->max; sysctl->proc_handler =3D emulation_proc_handler; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A211AC32772 for ; Tue, 23 Aug 2022 09:38:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351705AbiHWJiz (ORCPT ); Tue, 23 Aug 2022 05:38:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53150 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351594AbiHWJh7 (ORCPT ); Tue, 23 Aug 2022 05:37:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1BC295A158; Tue, 23 Aug 2022 01:40:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0030FB81C6A; Tue, 23 Aug 2022 08:39:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50021C4314C; Tue, 23 Aug 2022 08:39:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243992; bh=bKOMXVn5Qf7CFuGv6kc/zrvEaFQfUTDMxbBHWEk4aqI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tXwh8GvFoWbkZxeeWct7H1lxFaT+mLpjhbuuRXWSdAJcohumDgORef7/CSQ8ik6WI 2kG6iLpdginPggKKUQw5/s9uBHBKem+dCIbV6ZpVbpGkxQsrIKlOOPYnb9hoUY3dGi ZtQk0425EnmGWUALWA82Nm2uMuUMFOISwcEHjYkc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com, Jan Kara , Sasha Levin Subject: [PATCH 4.14 041/229] ext2: Add more validity checks for inode counts Date: Tue, 23 Aug 2022 10:23:22 +0200 Message-Id: <20220823080055.066458693@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jan Kara [ Upstream commit fa78f336937240d1bc598db817d638086060e7e9 ] Add checks verifying number of inodes stored in the superblock matches the number computed from number of inodes per group. Also verify we have at least one block worth of inodes per group. This prevents crashes on corrupted filesystems. Reported-by: syzbot+d273f7d7f58afd93be48@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/ext2/super.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/fs/ext2/super.c b/fs/ext2/super.c index f3d55f1c0ce4..5f7079b65426 100644 --- a/fs/ext2/super.c +++ b/fs/ext2/super.c @@ -1072,9 +1072,10 @@ static int ext2_fill_super(struct super_block *sb, v= oid *data, int silent) sbi->s_frags_per_group); goto failed_mount; } - if (sbi->s_inodes_per_group > sb->s_blocksize * 8) { + if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || + sbi->s_inodes_per_group > sb->s_blocksize * 8) { ext2_msg(sb, KERN_ERR, - "error: #inodes per group too big: %lu", + "error: invalid #inodes per group: %lu", sbi->s_inodes_per_group); goto failed_mount; } @@ -1084,6 +1085,13 @@ static int ext2_fill_super(struct super_block *sb, v= oid *data, int silent) sbi->s_groups_count =3D ((le32_to_cpu(es->s_blocks_count) - le32_to_cpu(es->s_first_data_block) - 1) / EXT2_BLOCKS_PER_GROUP(sb)) + 1; + if ((u64)sbi->s_groups_count * sbi->s_inodes_per_group !=3D + le32_to_cpu(es->s_inodes_count)) { + ext2_msg(sb, KERN_ERR, "error: invalid #inodes: %u vs computed %llu", + le32_to_cpu(es->s_inodes_count), + (u64)sbi->s_groups_count * sbi->s_inodes_per_group); + goto failed_mount; + } db_count =3D (sbi->s_groups_count + EXT2_DESC_PER_BLOCK(sb) - 1) / EXT2_DESC_PER_BLOCK(sb); sbi->s_group_desc =3D kmalloc (db_count * sizeof (struct buffer_head *), = GFP_KERNEL); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71D7BC32792 for ; Tue, 23 Aug 2022 09:33:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350937AbiHWJdI (ORCPT ); Tue, 23 Aug 2022 05:33:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38562 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351179AbiHWJbY (ORCPT ); Tue, 23 Aug 2022 05:31:24 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3EF281DA48; Tue, 23 Aug 2022 01:38:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D3AE56153A; Tue, 23 Aug 2022 08:37:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D75DEC433D6; Tue, 23 Aug 2022 08:37:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243850; bh=nEfnCkm6dMAf/YSXk6JFMlC0KFHoXXKfgDVfZUnrVxA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=N0p+QYNMQXjgmTctLFUvj1umcUMZ6tIdyMWyuIgNwrd+E+kOHngW0Rwd3tJi/6dZt hp1muOKN3oX6OHuinorAJvH4Fvozifzn1FmKm2j7x946dkP/Aq9dzVt8tLXitNR7TL bcU3ylcDVDJkhwe+8kCQT7KrBLS7ZDqfCpXS+CpQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Stein , Shawn Guo , Sasha Levin Subject: [PATCH 4.14 042/229] ARM: dts: imx6ul: add missing properties for sram Date: Tue, 23 Aug 2022 10:23:23 +0200 Message-Id: <20220823080055.107590606@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Stein [ Upstream commit 5655699cf5cff9f4c4ee703792156bdd05d1addf ] All 3 properties are required by sram.yaml. Fixes the dtbs_check warning: sram@900000: '#address-cells' is a required property sram@900000: '#size-cells' is a required property sram@900000: 'ranges' is a required property Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/boot/dts/imx6ul.dtsi | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi index 49f4bdc0d864..d544015d10e5 100644 --- a/arch/arm/boot/dts/imx6ul.dtsi +++ b/arch/arm/boot/dts/imx6ul.dtsi @@ -152,6 +152,9 @@ pmu { ocram: sram@00900000 { compatible =3D "mmio-sram"; reg =3D <0x00900000 0x20000>; + ranges =3D <0 0x00900000 0x20000>; + #address-cells =3D <1>; + #size-cells =3D <1>; }; =20 dma_apbh: dma-apbh@01804000 { --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 185F9C32792 for ; Tue, 23 Aug 2022 09:31:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350000AbiHWJbr (ORCPT ); Tue, 23 Aug 2022 05:31:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51304 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349953AbiHWJ3e (ORCPT ); Tue, 23 Aug 2022 05:29:34 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B4339923DF; Tue, 23 Aug 2022 01:37:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 0A603CE1B49; Tue, 23 Aug 2022 08:37:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0E2C4C433D6; Tue, 23 Aug 2022 08:37:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243853; bh=Xz5hcmM4qCkmNj4cQMqcWYCdPA3cuKankeknCXY9KUs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IjkXt9Y/jJkMExQQtTihIXY7LahNtZ5Re71jtt0GCFhQZ+f8m1JZ9dhDRsWt8be3D AQcAeAkzqJazu/PyFcycSfgQMvCGYIjSBkc1WQI9xJBz3DMsZKG8BCLDsOQlG9KzFX qcH/62wI9E7jYSXRnfLngBJ8j9nALfWQCc2SSiSM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Stein , Shawn Guo , Sasha Levin Subject: [PATCH 4.14 043/229] ARM: dts: imx6ul: fix qspi node compatible Date: Tue, 23 Aug 2022 10:23:24 +0200 Message-Id: <20220823080055.145148391@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Stein [ Upstream commit 0c6cf86e1ab433b2d421880fdd9c6e954f404948 ] imx6ul is not compatible to imx6sx, both have different erratas. Fixes the dt_binding_check warning: spi@21e0000: compatible: 'oneOf' conditional failed, one must be fixed: ['fsl,imx6ul-qspi', 'fsl,imx6sx-qspi'] is too long Additional items are not allowed ('fsl,imx6sx-qspi' was unexpected) 'fsl,imx6ul-qspi' is not one of ['fsl,ls1043a-qspi'] 'fsl,imx6ul-qspi' is not one of ['fsl,imx8mq-qspi'] 'fsl,ls1021a-qspi' was expected 'fsl,imx7d-qspi' was expected Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/boot/dts/imx6ul.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi index d544015d10e5..e4006bd47440 100644 --- a/arch/arm/boot/dts/imx6ul.dtsi +++ b/arch/arm/boot/dts/imx6ul.dtsi @@ -883,7 +883,7 @@ lcdif: lcdif@021c8000 { qspi: qspi@021e0000 { #address-cells =3D <1>; #size-cells =3D <0>; - compatible =3D "fsl,imx6ul-qspi", "fsl,imx6sx-qspi"; + compatible =3D "fsl,imx6ul-qspi"; reg =3D <0x021e0000 0x4000>, <0x60000000 0x10000000>; reg-names =3D "QuadSPI", "QuadSPI-memory"; interrupts =3D ; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 708B6C32772 for ; Tue, 23 Aug 2022 09:34:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350936AbiHWJeM (ORCPT ); Tue, 23 Aug 2022 05:34:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38692 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350664AbiHWJca (ORCPT ); Tue, 23 Aug 2022 05:32:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0469012D19; Tue, 23 Aug 2022 01:38:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3D89B6152E; Tue, 23 Aug 2022 08:37:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B78DC433D6; Tue, 23 Aug 2022 08:37:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243856; bh=x599Q0uNqhEXX/zTlqbs0/t9r9wM0qizRo+Y0uYiNVs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AInPgHz3zYSXCFUL7W92MFR8Aj+jBVrFIWWLSBhDJRcr/HJF+s29+CzFg+Pvby8aP cZCnl19o6CE6CN9P0dSzbF9t5fGgTeADtxpu+nRlLTd0Q7SWnciCb8r/MNYCRcNhAG hJFP3C6+SIhvKfSViYXjRitoyeSEdQCsz/WVn580= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Tony Lindgren , Sasha Levin Subject: [PATCH 4.14 044/229] ARM: OMAP2+: display: Fix refcount leak bug Date: Tue, 23 Aug 2022 10:23:25 +0200 Message-Id: <20220823080055.198391821@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 50b87a32a79bca6e275918a711fb8cc55e16d739 ] In omapdss_init_fbdev(), of_find_node_by_name() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Signed-off-by: Liang He Message-Id: <20220617145803.4050918-1-windhl@126.com> Signed-off-by: Tony Lindgren Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/mach-omap2/display.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c index 6e7440ef503a..b01b7515b6cc 100644 --- a/arch/arm/mach-omap2/display.c +++ b/arch/arm/mach-omap2/display.c @@ -218,6 +218,7 @@ static int __init omapdss_init_fbdev(void) node =3D of_find_node_by_name(NULL, "omap4_padconf_global"); if (node) omap4_dsi_mux_syscon =3D syscon_node_to_regmap(node); + of_node_put(node); =20 return 0; } --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A946C32774 for ; Tue, 23 Aug 2022 09:31:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350325AbiHWJb5 (ORCPT ); Tue, 23 Aug 2022 05:31:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51038 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350539AbiHWJaZ (ORCPT ); Tue, 23 Aug 2022 05:30:25 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CDB10923E8; Tue, 23 Aug 2022 01:37:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6E11C614C5; Tue, 23 Aug 2022 08:37:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7392DC433C1; Tue, 23 Aug 2022 08:37:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243859; bh=Xa6s7LYbZMRUMtcixMwGFLO019BA0YLdj1CCuUTJ8O8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VFkqVPFOgied8zG51bN4OOo7UTNthMpiwJD/s6whVkN2/t410tXM98hbx4T2jrL+y d9ZLaUGDkawZ8J8kHXbIaZcOCs34Z31gKXESFngahJwPEoq3q6c3J9tNo05V2zhFIR 4WpykC1hpLfQKw1Dojn2UNC2Rb74NmXLFYYxilhM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Manyi Li , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 4.14 045/229] ACPI: PM: save NVS memory for Lenovo G40-45 Date: Tue, 23 Aug 2022 10:23:26 +0200 Message-Id: <20220823080055.255044572@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Manyi Li [ Upstream commit 4b7ef7b05afcde44142225c184bf43a0cd9e2178 ] [821d6f0359b0614792ab8e2fb93b503e25a65079] is to make machines produced from 2012 to now not saving NVS region to accelerate S3. But, Lenovo G40-45, a platform released in 2015, still needs NVS memory saving during S3. A quirk is introduced for this platform. Signed-off-by: Manyi Li Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/acpi/sleep.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c index 7a0af16f86f2..d341908cbd16 100644 --- a/drivers/acpi/sleep.c +++ b/drivers/acpi/sleep.c @@ -359,6 +359,14 @@ static const struct dmi_system_id acpisleep_dmi_table[= ] __initconst =3D { DMI_MATCH(DMI_PRODUCT_NAME, "80E3"), }, }, + { + .callback =3D init_nvs_save_s3, + .ident =3D "Lenovo G40-45", + .matches =3D { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "80E1"), + }, + }, /* * https://bugzilla.kernel.org/show_bug.cgi?id=3D196907 * Some Dell XPS13 9360 cannot do suspend-to-idle using the Low Power --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D14F6C32772 for ; Tue, 23 Aug 2022 09:34:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350524AbiHWJeT (ORCPT ); Tue, 23 Aug 2022 05:34:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38908 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350825AbiHWJcs (ORCPT ); Tue, 23 Aug 2022 05:32:48 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 08DA07B1FE; Tue, 23 Aug 2022 01:38:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B21AE61446; Tue, 23 Aug 2022 08:37:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 72825C433D7; Tue, 23 Aug 2022 08:37:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243863; bh=YtjYNrgY2aCbWqM67G8OxeniAR3dUoUmn0JshvL67Sg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=b8VojThlw9yWwsOYXuZDvq6xkVIs5Pn5+1E/o8tlmzl1Oe2A1khmGJv8m0aW5RLb2 QDou+peHP52SenV3fkEBaZy12A9Jjhi86Ly5FTGZZHc1VmLjkwYyn2F0P4KEdXeK5w 4tjOugH24wWBuWxw8igAPfcarh5KkRPl/ACoz4qg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, huhai , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 4.14 046/229] ACPI: LPSS: Fix missing check in register_device_clock() Date: Tue, 23 Aug 2022 10:23:27 +0200 Message-Id: <20220823080055.305291010@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: huhai [ Upstream commit b4f1f61ed5928b1128e60e38d0dffa16966f06dc ] register_device_clock() misses a check for platform_device_register_simple(= ). Add a check to fix it. Signed-off-by: huhai Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/acpi/acpi_lpss.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c index 84b1d30f699c..faa83ff03674 100644 --- a/drivers/acpi/acpi_lpss.c +++ b/drivers/acpi/acpi_lpss.c @@ -396,6 +396,9 @@ static int register_device_clock(struct acpi_device *ad= ev, if (!lpss_clk_dev) lpt_register_clock_device(); =20 + if (IS_ERR(lpss_clk_dev)) + return PTR_ERR(lpss_clk_dev); + clk_data =3D platform_get_drvdata(lpss_clk_dev); if (!clk_data) return -ENODEV; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 471D1C32772 for ; Tue, 23 Aug 2022 09:34:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350684AbiHWJeG (ORCPT ); Tue, 23 Aug 2022 05:34:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38660 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350650AbiHWJc3 (ORCPT ); Tue, 23 Aug 2022 05:32:29 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D6364B0F8; Tue, 23 Aug 2022 01:38:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5F713B81C62; Tue, 23 Aug 2022 08:37:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A4241C433C1; Tue, 23 Aug 2022 08:37:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243866; bh=nNnTUhqNU4YQbcijVe/pezvof71mJ2XPgaNef+hmOY0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jrX2fJVBSB38MPIBb8UNf9rhYMpISbQc0HtGmakpK3RHz+dzsqdh6/YOXbJjg1GWR 2IDmaElvpEHHz8Ey67WV5WOuwSd4L+c/VWatfePGXaZ+qwAiHxITDutBkKMBotfeQ+ hI96IpWRm9YqrWGs43C66J9MFZTCzUje9o/wvWHQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Tetsuo Handa , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 4.14 047/229] PM: hibernate: defer device probing when resuming from hibernation Date: Tue, 23 Aug 2022 10:23:28 +0200 Message-Id: <20220823080055.346898181@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tetsuo Handa [ Upstream commit 8386c414e27caba8501119948e9551e52b527f59 ] syzbot is reporting hung task at misc_open() [1], for there is a race window of AB-BA deadlock which involves probe_count variable. Currently wait_for_device_probe() from snapshot_open() from misc_open() can sleep forever with misc_mtx held if probe_count cannot become 0. When a device is probed by hub_event() work function, probe_count is incremented before the probe function starts, and probe_count is decremented after the probe function completed. There are three cases that can prevent probe_count from dropping to 0. (a) A device being probed stopped responding (i.e. broken/malicious hardware). (b) A process emulating a USB device using /dev/raw-gadget interface stopped responding for some reason. (c) New device probe requests keeps coming in before existing device probe requests complete. The phenomenon syzbot is reporting is (b). A process which is holding system_transition_mutex and misc_mtx is waiting for probe_count to become 0 inside wait_for_device_probe(), but the probe function which is called from hub_event() work function is waiting for the processes which are blocked at mutex_lock(&misc_mtx) to respond via /dev/raw-gadget interface. This patch mitigates (b) by deferring wait_for_device_probe() from snapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that the possibility of (b) remains as long as any thread which is emulating a USB device via /dev/raw-gadget interface can be blocked by uninterruptible blocking operations (e.g. mutex_lock()). Please also note that (a) and (c) are not addressed. Regarding (c), we should change the code to wait for only one device which contains the image for resuming from hibernation. I don't know how to address (a), for use of timeout for wait_for_device_probe() might result in loss of user data in the image. Maybe we should require the userland to wait for the image device before opening /dev/snapshot interface. Link: https://syzkaller.appspot.com/bug?extid=3D358c9ab4c93da7b7238c [1] Reported-by: syzbot Signed-off-by: Tetsuo Handa Tested-by: syzbot Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- kernel/power/user.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/kernel/power/user.c b/kernel/power/user.c index 69017a569f30..add4653477fe 100644 --- a/kernel/power/user.c +++ b/kernel/power/user.c @@ -29,6 +29,7 @@ =20 #include "power.h" =20 +static bool need_wait; =20 #define SNAPSHOT_MINOR 231 =20 @@ -82,7 +83,7 @@ static int snapshot_open(struct inode *inode, struct file= *filp) * Resuming. We may need to wait for the image device to * appear. */ - wait_for_device_probe(); + need_wait =3D true; =20 data->swap =3D -1; data->mode =3D O_WRONLY; @@ -174,6 +175,11 @@ static ssize_t snapshot_write(struct file *filp, const= char __user *buf, ssize_t res; loff_t pg_offp =3D *offp & ~PAGE_MASK; =20 + if (need_wait) { + wait_for_device_probe(); + need_wait =3D false; + } + lock_system_sleep(); =20 data =3D filp->private_data; @@ -209,6 +215,11 @@ static long snapshot_ioctl(struct file *filp, unsigned= int cmd, loff_t size; sector_t offset; =20 + if (need_wait) { + wait_for_device_probe(); + need_wait =3D false; + } + if (_IOC_TYPE(cmd) !=3D SNAPSHOT_IOC_MAGIC) return -ENOTTY; if (_IOC_NR(cmd) > SNAPSHOT_IOC_MAXNR) --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB2B6C32772 for ; Tue, 23 Aug 2022 09:34:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350800AbiHWJer (ORCPT ); Tue, 23 Aug 2022 05:34:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38690 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350660AbiHWJd5 (ORCPT ); Tue, 23 Aug 2022 05:33:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8667E93524; Tue, 23 Aug 2022 01:39:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9A75EB81C54; Tue, 23 Aug 2022 08:37:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E2640C433C1; Tue, 23 Aug 2022 08:37:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243869; bh=FPDq19YmQbyACbhIMdsFfnd/zvD9KE4s0mLFIVXUVOE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kh/+88KRUrgXQtAsSqmJv33ZeCxkvvp/Hp2A5DJpQHZAeZwufw28Ys5e6ve209NrN pH/Cn+mIckMLbL0RidQtUcHVMxuteMINWEn+5SkdBZwrT9u7BbKlFEwDVN7CSrWz/h UofzknpcnJIb5JsA/EEIFnmHaV2N3cPfa7BfAjEI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiu Jianfeng , Paul Moore , Sasha Levin Subject: [PATCH 4.14 048/229] selinux: Add boundary check in put_entry() Date: Tue, 23 Aug 2022 10:23:29 +0200 Message-Id: <20220823080055.382672506@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiu Jianfeng [ Upstream commit 15ec76fb29be31df2bccb30fc09875274cba2776 ] Just like next_entry(), boundary check is necessary to prevent memory out-of-bound access. Signed-off-by: Xiu Jianfeng Signed-off-by: Paul Moore Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- security/selinux/ss/policydb.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/selinux/ss/policydb.h b/security/selinux/ss/policydb.h index 215f8f30ac5a..2a479785ebd4 100644 --- a/security/selinux/ss/policydb.h +++ b/security/selinux/ss/policydb.h @@ -360,6 +360,8 @@ static inline int put_entry(const void *buf, size_t byt= es, int num, struct polic { size_t len =3D bytes * num; =20 + if (len > fp->len) + return -EINVAL; memcpy(fp->data, buf, len); fp->data +=3D len; fp->len -=3D len; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B0C6C32772 for ; Tue, 23 Aug 2022 09:34:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350719AbiHWJeA (ORCPT ); Tue, 23 Aug 2022 05:34:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350625AbiHWJc0 (ORCPT ); Tue, 23 Aug 2022 05:32:26 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7813783BDB; Tue, 23 Aug 2022 01:38:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EA55661517; Tue, 23 Aug 2022 08:37:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DEC77C433B5; Tue, 23 Aug 2022 08:37:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243872; bh=5F3L1hqSN/7exQ2u/UxDEhO+Ah+rnMqDKqPMrqS7AEE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AS1NiJ0q3hxiyZ6zL0nLPlK2gt+XBOcY1VAp6DK6tUpxMHZqU13zRXdh8xEDDkt0n TSIATAzTJTqRNCsQvJu3461MjWAGKz8RqumWQ4xX3Fj7aqmOX1tMTdKNNrWbS1GOwh bcreHCio9YrwV/i57XKzl9n//4QH+HChyqvKOfIs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guenter Roeck , "Russell King (Oracle)" , Sasha Levin Subject: [PATCH 4.14 049/229] ARM: findbit: fix overflowing offset Date: Tue, 23 Aug 2022 10:23:30 +0200 Message-Id: <20220823080055.424373126@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Russell King (Oracle) [ Upstream commit ec85bd369fd2bfaed6f45dd678706429d4f75b48 ] When offset is larger than the size of the bit array, we should not attempt to access the array as we can perform an access beyond the end of the array. Fix this by changing the pre-condition. Using "cmp r2, r1; bhs ..." covers us for the size =3D=3D 0 case, since this will always take the branch when r1 is zero, irrespective of the value of r2. This means we can fix this bug without adding any additional code! Tested-by: Guenter Roeck Signed-off-by: Russell King (Oracle) Signed-off-by: Sasha Levin Tested-by: Linux Kernel Functional Testing --- arch/arm/lib/findbit.S | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/arch/arm/lib/findbit.S b/arch/arm/lib/findbit.S index 7848780e8834..20fef6c41f6f 100644 --- a/arch/arm/lib/findbit.S +++ b/arch/arm/lib/findbit.S @@ -43,8 +43,8 @@ ENDPROC(_find_first_zero_bit_le) * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int = offset) */ ENTRY(_find_next_zero_bit_le) - teq r1, #0 - beq 3b + cmp r2, r1 + bhs 3b ands ip, r2, #7 beq 1b @ If new byte, goto old routine ARM( ldrb r3, [r0, r2, lsr #3] ) @@ -84,8 +84,8 @@ ENDPROC(_find_first_bit_le) * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int = offset) */ ENTRY(_find_next_bit_le) - teq r1, #0 - beq 3b + cmp r2, r1 + bhs 3b ands ip, r2, #7 beq 1b @ If new byte, goto old routine ARM( ldrb r3, [r0, r2, lsr #3] ) @@ -118,8 +118,8 @@ ENTRY(_find_first_zero_bit_be) ENDPROC(_find_first_zero_bit_be) =20 ENTRY(_find_next_zero_bit_be) - teq r1, #0 - beq 3b + cmp r2, r1 + bhs 3b ands ip, r2, #7 beq 1b @ If new byte, goto old routine eor r3, r2, #0x18 @ big endian byte ordering @@ -152,8 +152,8 @@ ENTRY(_find_first_bit_be) ENDPROC(_find_first_bit_be) =20 ENTRY(_find_next_bit_be) - teq r1, #0 - beq 3b + cmp r2, r1 + bhs 3b ands ip, r2, #7 beq 1b @ If new byte, goto old routine eor r3, r2, #0x18 @ big endian byte ordering --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DB5FC32772 for ; Tue, 23 Aug 2022 09:32:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350618AbiHWJcT (ORCPT ); Tue, 23 Aug 2022 05:32:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53446 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350701AbiHWJao (ORCPT ); Tue, 23 Aug 2022 05:30:44 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D4DC92F5E; Tue, 23 Aug 2022 01:37:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2C7CA61544; Tue, 23 Aug 2022 08:37:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38C1CC433D7; Tue, 23 Aug 2022 08:37:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243878; bh=ah1xJbcTpET9sBuUevAzr/FyNFl2c5CRKuewIOVWH6c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dRrqu7Nbeh4JV1V6vZSB5baNpa2E6zHeVUXrmmy6pjAAMOw4gEUEFmok7eHPQg9E4 2Gcu5BKwlki7FTXwmueVr9YJvwqY0sVrL6XvxLKV6HI7oKjnOewtGgxxFWW1sZ4UCH XduCLP8He4IaeHa4lfJ09theR5ezKkIp3Fy469ts= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Florian Fainelli , Sasha Levin Subject: [PATCH 4.14 050/229] ARM: bcm: Fix refcount leak in bcm_kona_smc_init Date: Tue, 23 Aug 2022 10:23:31 +0200 Message-Id: <20220823080055.476822401@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit cb23389a2458c2e4bfd6c86a513cbbe1c4d35e76 ] of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: b8eb35fd594a ("ARM: bcm281xx: Add L2 cache enable code") Signed-off-by: Miaoqian Lin Signed-off-by: Florian Fainelli Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/mach-bcm/bcm_kona_smc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mach-bcm/bcm_kona_smc.c b/arch/arm/mach-bcm/bcm_kona_= smc.c index a55a7ecf146a..dd0b4195e629 100644 --- a/arch/arm/mach-bcm/bcm_kona_smc.c +++ b/arch/arm/mach-bcm/bcm_kona_smc.c @@ -54,6 +54,7 @@ int __init bcm_kona_smc_init(void) return -ENODEV; =20 prop_val =3D of_get_address(node, 0, &prop_size, NULL); + of_node_put(node); if (!prop_val) return -EINVAL; =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EA42C32772 for ; Tue, 23 Aug 2022 09:35:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351235AbiHWJfF (ORCPT ); Tue, 23 Aug 2022 05:35:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44900 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351101AbiHWJeR (ORCPT ); Tue, 23 Aug 2022 05:34:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 813A894ECE; Tue, 23 Aug 2022 01:39:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D3675B81C3B; Tue, 23 Aug 2022 08:38:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0CD66C433D6; Tue, 23 Aug 2022 08:38:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243887; bh=g6tcTm+ZXaW5n+EYtlo3JwpzKEML7hs46wOKet194ys=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JUFv40MF63nsxFRV3N/qJm5dLRGChB0kF0h6ZdMN+YH5l76zeHNfwO83XguW/t0x+ cn0RdeyPdABot0QY5D2W9yA4bWp/D7D/ZYGGDXM5OYBue+AyBwaAaYgooABjf9AbzL /tu2RDk4SoFwx0C+hQlHonPidbOKn5xwmKZXye7s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Borislav Petkov , Sasha Levin Subject: [PATCH 4.14 051/229] x86/pmem: Fix platform-device leak in error path Date: Tue, 23 Aug 2022 10:23:32 +0200 Message-Id: <20220823080055.531533153@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold [ Upstream commit 229e73d46994f15314f58b2d39bf952111d89193 ] Make sure to free the platform device in the unlikely event that registration fails. Fixes: 7a67832c7e44 ("libnvdimm, e820: make CONFIG_X86_PMEM_LEGACY a trista= te option") Signed-off-by: Johan Hovold Signed-off-by: Borislav Petkov Link: https://lore.kernel.org/r/20220620140723.9810-1-johan@kernel.org Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/kernel/pmem.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/pmem.c b/arch/x86/kernel/pmem.c index 3fe690067802..ada7c077ec2f 100644 --- a/arch/x86/kernel/pmem.c +++ b/arch/x86/kernel/pmem.c @@ -27,6 +27,11 @@ static __init int register_e820_pmem(void) * simply here to trigger the module to load on demand. */ pdev =3D platform_device_alloc("e820_pmem", -1); - return platform_device_add(pdev); + + rc =3D platform_device_add(pdev); + if (rc) + platform_device_put(pdev); + + return rc; } device_initcall(register_e820_pmem); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3442C32772 for ; Tue, 23 Aug 2022 09:34:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351197AbiHWJeu (ORCPT ); Tue, 23 Aug 2022 05:34:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43276 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351068AbiHWJeA (ORCPT ); Tue, 23 Aug 2022 05:34:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C050E83BC7; Tue, 23 Aug 2022 01:39:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1547A61544; Tue, 23 Aug 2022 08:38:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17294C433C1; Tue, 23 Aug 2022 08:38:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243893; bh=UNiwTXmjdQ6KGQtbGIn0zAj/bX+4Qo6BgYbbX6UQpYQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TkTm9lt1Bp0bjjJAQXEI56mlMBZf1PwtC0ZudCSxomLeiFg7BaX52vG3DHw69k0lr GRgJ6BdMqLSf5KHmcaw58/CYXHdJTVyo6Mf+460usX6xqdsajz55yY359O2EQSlfS8 u0d+/PbrQLQjgd9619nTIk+7o/PNKdVOEi5lXZC4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , Sasha Levin Subject: [PATCH 4.14 052/229] ARM: dts: ast2500-evb: fix board compatible Date: Tue, 23 Aug 2022 10:23:33 +0200 Message-Id: <20220823080055.562379798@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski [ Upstream commit 30b276fca5c0644f3cb17bceb1bd6a626c670184 ] The AST2500 EVB board should have dedicated compatible. Fixes: 02440622656d ("arm/dst: Add Aspeed ast2500 device tree") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20220529104928.79636-4-krzysztof.kozlowski@= linaro.org Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/boot/dts/aspeed-ast2500-evb.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/boot/dts/aspeed-ast2500-evb.dts b/arch/arm/boot/dts/a= speed-ast2500-evb.dts index c971cc93f42d..b7ee74a1fd94 100644 --- a/arch/arm/boot/dts/aspeed-ast2500-evb.dts +++ b/arch/arm/boot/dts/aspeed-ast2500-evb.dts @@ -5,7 +5,7 @@ =20 / { model =3D "AST2500 EVB"; - compatible =3D "aspeed,ast2500"; + compatible =3D "aspeed,ast2500-evb", "aspeed,ast2500"; =20 aliases { serial4 =3D &uart5; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C10F9C32772 for ; Tue, 23 Aug 2022 09:38:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348467AbiHWJiV (ORCPT ); Tue, 23 Aug 2022 05:38:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44882 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350610AbiHWJgi (ORCPT ); Tue, 23 Aug 2022 05:36:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A414E9858E; Tue, 23 Aug 2022 01:40:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D736CB81C20; Tue, 23 Aug 2022 08:38:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 204A8C433D6; Tue, 23 Aug 2022 08:38:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243899; bh=q0lwBwOpc6ybYAZdxR23GL4Xf+A9Fy0uKv6IPGQ9w8g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vi3jaAwotS6a8CFmkSGZHEXs4ohEKBDTUWyhgq8NO11eqrhYXJhcdmxoq0azqB81/ +FR8XJ5vsLddtL95mVkds2iR0PSMGGQgwweUJ4zVRTlWQK3XZHLFJBQNCE3ZEDDBcH fiOFqzKidFhIyUxzYH/0B02DAzid4asCWx17/N7g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Walle , Arnd Bergmann , Shawn Guo , Sasha Levin Subject: [PATCH 4.14 053/229] soc: fsl: guts: machine variable might be unset Date: Tue, 23 Aug 2022 10:23:34 +0200 Message-Id: <20220823080055.600279021@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Walle [ Upstream commit ab3f045774f704c4e7b6a878102f4e9d4ae7bc74 ] If both the model and the compatible properties are missing, then machine will not be set. Initialize it with NULL. Fixes: 34c1c21e94ac ("soc: fsl: fix section mismatch build warnings") Signed-off-by: Michael Walle Acked-by: Arnd Bergmann Signed-off-by: Shawn Guo Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/soc/fsl/guts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/soc/fsl/guts.c b/drivers/soc/fsl/guts.c index 6af7a11f09a5..affc38a92166 100644 --- a/drivers/soc/fsl/guts.c +++ b/drivers/soc/fsl/guts.c @@ -136,7 +136,7 @@ static int fsl_guts_probe(struct platform_device *pdev) struct device *dev =3D &pdev->dev; struct resource *res; const struct fsl_soc_die_attr *soc_die; - const char *machine; + const char *machine =3D NULL; u32 svr; =20 /* Initialize guts */ --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 64E44C32774 for ; Tue, 23 Aug 2022 09:36:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351101AbiHWJgp (ORCPT ); Tue, 23 Aug 2022 05:36:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39454 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351242AbiHWJfG (ORCPT ); Tue, 23 Aug 2022 05:35:06 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CDF7E95E5F; Tue, 23 Aug 2022 01:39:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CF7C4B81C6D; Tue, 23 Aug 2022 08:38:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3FD88C433D6; Tue, 23 Aug 2022 08:38:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243905; bh=JLgT1YjRQoCyfhyImHJaeFjmVBeCtSn+RgWnOxdaFZI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GI3O3i8sb4GMGEWsb9o52i6/itAK5gQDRF9U5Szbx13lqZkeoBaoBST0RC86xeYSf /pHts2jMJ202u5hsFttmvghL5WaFLfGFQkL262J1eBw92IdPXtsAIb/6Mf3ajhHRzK JKEeoqJcz76yFlyrNGtf3OTk/cFgOpFcoZ8mwO5Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Michal Simek , Sasha Levin Subject: [PATCH 4.14 054/229] cpufreq: zynq: Fix refcount leak in zynq_get_revision Date: Tue, 23 Aug 2022 10:23:35 +0200 Message-Id: <20220823080055.643224062@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit d1ff2559cef0f6f8d97fba6337b28adb10689e16 ] of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: 00f7dc636366 ("ARM: zynq: Add support for SOC_BUS") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220605082807.21526-1-linmq006@gmail.com Signed-off-by: Michal Simek Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/mach-zynq/common.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mach-zynq/common.c b/arch/arm/mach-zynq/common.c index 6aba9ebf8041..a8b1b9c6626e 100644 --- a/arch/arm/mach-zynq/common.c +++ b/arch/arm/mach-zynq/common.c @@ -84,6 +84,7 @@ static int __init zynq_get_revision(void) } =20 zynq_devcfg_base =3D of_iomap(np, 0); + of_node_put(np); if (!zynq_devcfg_base) { pr_err("%s: Unable to map I/O memory\n", __func__); return -1; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5E270C32774 for ; Tue, 23 Aug 2022 09:37:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351284AbiHWJhD (ORCPT ); Tue, 23 Aug 2022 05:37:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39194 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351366AbiHWJfa (ORCPT ); Tue, 23 Aug 2022 05:35:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D50B96FEC; Tue, 23 Aug 2022 01:39:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5F7C861377; Tue, 23 Aug 2022 08:38:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5CFDEC433B5; Tue, 23 Aug 2022 08:38:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243911; bh=16N7gqoDhgtgU26/uFo+Xnm3wcLCzPvXEWtJM8/2n9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Izz6ntPeuGcgTQPBjogT6+kSPA2Nkrz1kp1breh76rzaxHIT7EOGv/zZWdNBtAciS xydVrOPcBIB/Rn1j3cW2CgQ5s7j6q6ymAkct0IPKFpVwclmX6mriXiDdLBxtETJowQ CqpXfJeqWKCc+493jRZyFZsOPafHyGdWqLZwhlgw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , Bjorn Andersson , Sasha Levin Subject: [PATCH 4.14 055/229] ARM: dts: qcom: pm8841: add required thermal-sensor-cells Date: Tue, 23 Aug 2022 10:23:36 +0200 Message-Id: <20220823080055.675282770@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski [ Upstream commit e2759fa0676c9a32bbddb9aff955b54bb35066ad ] The PM8841 temperature sensor has to define thermal-sensor-cells. Fixes: dab8134ca072 ("ARM: dts: qcom: Add PM8841 functions device nodes") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220608112702.80873-2-krzysztof.kozlowski@= linaro.org Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm/boot/dts/qcom-pm8841.dtsi | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/boot/dts/qcom-pm8841.dtsi b/arch/arm/boot/dts/qcom-pm= 8841.dtsi index 2fd59c440903..c73e5b149ac5 100644 --- a/arch/arm/boot/dts/qcom-pm8841.dtsi +++ b/arch/arm/boot/dts/qcom-pm8841.dtsi @@ -25,6 +25,7 @@ temp-alarm@2400 { compatible =3D "qcom,spmi-temp-alarm"; reg =3D <0x2400>; interrupts =3D <4 0x24 0 IRQ_TYPE_EDGE_RISING>; + #thermal-sensor-cells =3D <0>; }; }; =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28780C32772 for ; Tue, 23 Aug 2022 09:52:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240848AbiHWJwW (ORCPT ); Tue, 23 Aug 2022 05:52:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39316 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351676AbiHWJuv (ORCPT ); Tue, 23 Aug 2022 05:50:51 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA72E6B146; Tue, 23 Aug 2022 01:45:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6A440B81C35; Tue, 23 Aug 2022 08:38:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C4FCC433D7; Tue, 23 Aug 2022 08:38:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243921; bh=Q+Ic9UXrKxd9vfawZ2Fb/PWbNGzTG3NhwR7SlhSfj8o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cBlLFBzhCkws78UZGlN0GkREEo/gZxrv4qeAb0BTnoHjE9sLUA9hlkwxfiQOqATxw MEB4G+R3jvoOaBrRdEDUOVEU62NcOpcNohAJwoCf1Fht4Utdjho2Ek8j3xQQUCk3CX nnY22vtmobvQTeBDIB7vpNOK54uVnITwpewioC2U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sireesh Kodali , Krzysztof Kozlowski , Stephan Gerhold , Bjorn Andersson , Sasha Levin Subject: [PATCH 4.14 056/229] arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node Date: Tue, 23 Aug 2022 10:23:37 +0200 Message-Id: <20220823080055.726679251@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sireesh Kodali [ Upstream commit 5458d6f2827cd30218570f266b8d238417461f2f ] The smem-state properties for the pronto node were incorrectly labelled, reading `qcom,state*` rather than `qcom,smem-state*`. Fix that, allowing the stop state to be used. Fixes: 88106096cbf8 ("ARM: dts: msm8916: Add and enable wcnss node") Signed-off-by: Sireesh Kodali Reviewed-by: Krzysztof Kozlowski Reviewed-by: Stephan Gerhold Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220526141740.15834-3-sireeshkodali1@gmail= .com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qc= om/msm8916.dtsi index a961b8106000..0f45dd0d36fd 100644 --- a/arch/arm64/boot/dts/qcom/msm8916.dtsi +++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi @@ -980,8 +980,8 @@ pronto: wcnss@a21b000 { vddmx-supply =3D <&pm8916_l3>; vddpx-supply =3D <&pm8916_l7>; =20 - qcom,state =3D <&wcnss_smp2p_out 0>; - qcom,state-names =3D "stop"; + qcom,smem-states =3D <&wcnss_smp2p_out 0>; + qcom,smem-state-names =3D "stop"; =20 pinctrl-names =3D "default"; pinctrl-0 =3D <&wcnss_pin_a>; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BEF87C32774 for ; Tue, 23 Aug 2022 10:19:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354044AbiHWKTv (ORCPT ); Tue, 23 Aug 2022 06:19:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57848 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352720AbiHWKIf (ORCPT ); Tue, 23 Aug 2022 06:08:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D1BD26E2CF; Tue, 23 Aug 2022 01:54:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7B4EFB81C48; Tue, 23 Aug 2022 08:38:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A6E4BC43145; Tue, 23 Aug 2022 08:38:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243927; bh=drOoGIBMOeRwHmzS4ziAXbQ0TDul30Lkh7ed/X2k6Ss=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j7bZ8yo5AO+fJB5yHu/wJE2aT4po1Z+cTg7SjkgnT9U0Wzjk1uYtpptlFPeys6Sz7 LIoTKlMqx8Y0cF0MxvRFk/kfy6z/uS0XodTU+lvX/g11oXTi+jswm4mz+clsagAezp Sc/7k6aaetVm2TXfXOvQrd9xoI88vemY9G8KQZw0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Mark Brown , Sasha Levin Subject: [PATCH 4.14 057/229] regulator: of: Fix refcount leak bug in of_get_regulation_constraints() Date: Tue, 23 Aug 2022 10:23:38 +0200 Message-Id: <20220823080055.767674846@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 66efb665cd5ad69b27dca8571bf89fc6b9c628a4 ] We should call the of_node_put() for the reference returned by of_get_child_by_name() which has increased the refcount. Fixes: 40e20d68bb3f ("regulator: of: Add support for parsing regulator_stat= e for suspend state") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220715111027.391032-1-windhl@126.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/regulator/of_regulator.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regula= tor.c index a3bf7c993723..f82b522bffa7 100644 --- a/drivers/regulator/of_regulator.c +++ b/drivers/regulator/of_regulator.c @@ -158,8 +158,12 @@ static void of_get_regulation_constraints(struct devic= e_node *np, } =20 suspend_np =3D of_get_child_by_name(np, regulator_states[i]); - if (!suspend_np || !suspend_state) + if (!suspend_np) continue; + if (!suspend_state) { + of_node_put(suspend_np); + continue; + } =20 if (!of_property_read_u32(suspend_np, "regulator-mode", &pval)) { --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C30C7C32774 for ; Tue, 23 Aug 2022 09:39:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240796AbiHWJjb (ORCPT ); Tue, 23 Aug 2022 05:39:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52258 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351386AbiHWJig (ORCPT ); Tue, 23 Aug 2022 05:38:36 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C86DB42ADC; Tue, 23 Aug 2022 01:40:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 63153B81C4F; Tue, 23 Aug 2022 08:38:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ACC38C433C1; Tue, 23 Aug 2022 08:38:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243933; bh=xrT7sCDqJzbwaabInFSOooM42pz6YylOw5GrLACf6Gk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OU1qev2kDNnTFj3Pj1fXjLrlVNrTmORpkIxoW56SSAyduxNzElvGxuvx9PL2sw5lq FW9UYM6GV5X1LNEO2V+9CINW1/MLV2trBj/1tDFQDQZI/sITG9XltBT6CLmyUPcyur CVyUuaX0mBooTMj6HSKpZeKJyg/6Q2qZGjqSyj/4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Markus Mayer , Florian Fainelli , Sumeet Pawnikar , =?UTF-8?q?Alejandro=20Gonz=C3=A1lez?= , Daniel Lezcano , Sasha Levin Subject: [PATCH 4.14 058/229] thermal/tools/tmon: Include pthread and time headers in tmon.h Date: Tue, 23 Aug 2022 10:23:39 +0200 Message-Id: <20220823080055.799080088@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Markus Mayer [ Upstream commit 0cf51bfe999524377fbb71becb583b4ca6d07cfc ] Include sys/time.h and pthread.h in tmon.h, so that types "pthread_mutex_t" and "struct timeval tv" are known when tmon.h references them. Without these headers, compiling tmon against musl-libc will fail with these errors: In file included from sysfs.c:31:0: tmon.h:47:8: error: unknown type name 'pthread_mutex_t' extern pthread_mutex_t input_lock; ^~~~~~~~~~~~~~~ make[3]: *** [: sysfs.o] Error 1 make[3]: *** Waiting for unfinished jobs.... In file included from tui.c:31:0: tmon.h:54:17: error: field 'tv' has incomplete type struct timeval tv; ^~ make[3]: *** [: tui.o] Error 1 make[2]: *** [Makefile:83: tmon] Error 2 Signed-off-by: Markus Mayer Acked-by: Florian Fainelli Reviewed-by: Sumeet Pawnikar Acked-by: Alejandro Gonz=C3=A1lez Tested-by: Alejandro Gonz=C3=A1lez Fixes: 94f69966faf8 ("tools/thermal: Introduce tmon, a tool for thermal su= bsystem") Link: https://lore.kernel.org/r/20220718031040.44714-1-f.fainelli@gmail.com Signed-off-by: Daniel Lezcano Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- tools/thermal/tmon/tmon.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/thermal/tmon/tmon.h b/tools/thermal/tmon/tmon.h index 9e3c49c547ac..7b090a6c95b6 100644 --- a/tools/thermal/tmon/tmon.h +++ b/tools/thermal/tmon/tmon.h @@ -36,6 +36,9 @@ #define NR_LINES_TZDATA 1 #define TMON_LOG_FILE "/var/tmp/tmon.log" =20 +#include +#include + extern unsigned long ticktime; extern double time_elapsed; extern unsigned long target_temp_user; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3782CC32772 for ; Tue, 23 Aug 2022 09:34:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351095AbiHWJeQ (ORCPT ); Tue, 23 Aug 2022 05:34:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40356 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1350747AbiHWJcp (ORCPT ); Tue, 23 Aug 2022 05:32:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 096CC94100; Tue, 23 Aug 2022 01:38:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C7851614E7; Tue, 23 Aug 2022 08:38:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D3458C433C1; Tue, 23 Aug 2022 08:38:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243939; bh=jc8IbrhXt3pWx3O2jMG/Q2BCERjfFZ+f+AaSbKN/cBo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GFKlkNlY7Qe4QmFGU/vt8DIHg9YwyE61MElOAJYhq9W8QdnlkuFH7Srypw7m5j2Ue tFbowQ+qDcx/6YCYRhsu+tXciG7nfbWxgj1NdZ/LypSpt+I2yUk5mVbS5Lic/8GW7Z dMRkeBS52x8WC3ZlckzVZdwlNrsgkJVB/iMBoJcA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mike Snitzer , Sasha Levin Subject: [PATCH 4.14 059/229] dm: return early from dm_pr_call() if DM device is suspended Date: Tue, 23 Aug 2022 10:23:40 +0200 Message-Id: <20220823080055.836359364@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Snitzer [ Upstream commit e120a5f1e78fab6223544e425015f393d90d6f0d ] Otherwise PR ops may be issued while the broader DM device is being reconfigured, etc. Fixes: 9c72bad1f31a ("dm: call PR reserve/unreserve on each underlying devi= ce") Signed-off-by: Mike Snitzer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/md/dm.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 94018613b43b..9e6689fd2273 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -2859,6 +2859,11 @@ static int dm_call_pr(struct block_device *bdev, ite= rate_devices_callout_fn fn, goto out; ti =3D dm_table_get_target(table, 0); =20 + if (dm_suspended_md(md)) { + ret =3D -EAGAIN; + goto out; + } + ret =3D -EINVAL; if (!ti->type->iterate_devices) goto out; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F103FC32772 for ; Tue, 23 Aug 2022 09:37:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351419AbiHWJh0 (ORCPT ); Tue, 23 Aug 2022 05:37:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351747AbiHWJf5 (ORCPT ); Tue, 23 Aug 2022 05:35:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F247BE0A9; Tue, 23 Aug 2022 01:40:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A9C1A614E9; Tue, 23 Aug 2022 08:39:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F9F6C433D6; Tue, 23 Aug 2022 08:39:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243946; bh=aBbOxrSRthQiToFIYP2D6uOzkEITHeXp8+xs0ikkYag=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1WcuhgvOH05LSYY4zPnCLWc6elbdCwwjBRzFbVTyocl5j6j/EvhZezkME8uxfWImi dzorIhZUw2QarCuYEUd/rccHiIJpxYYC8xzuMkFrhelF/buM0AureyItViwvXYPhcr pTgCtI7B5jVkneIw0iuasUsH/dHN+wyxf4fz8Wn4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexey Kodanev , Alex Deucher , Sasha Levin Subject: [PATCH 4.14 060/229] drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() Date: Tue, 23 Aug 2022 10:23:41 +0200 Message-Id: <20220823080055.880457049@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexey Kodanev [ Upstream commit 136f614931a2bb73616b292cf542da3a18daefd5 ] The last case label can write two buffers 'mc_reg_address[j]' and 'mc_data[j]' with 'j' offset equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE since there are no checks for this value in both case labels after the last 'j++'. Instead of changing '>' to '>=3D' there, add the bounds check at the start of the second 'case' (the first one already has it). Also, remove redundant last checks for 'j' index bigger than array size. The expression is always false. Moreover, before or after the patch 'table->last' can be equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE and it seems it can be a valid value. Detected using the static analysis tool - Svace. Fixes: 69e0b57a91ad ("drm/radeon/kms: add dpm support for cayman (v5)") Signed-off-by: Alexey Kodanev Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/radeon/ni_dpm.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/radeon/ni_dpm.c b/drivers/gpu/drm/radeon/ni_dp= m.c index d491b3aa124f..fa88c1809946 100644 --- a/drivers/gpu/drm/radeon/ni_dpm.c +++ b/drivers/gpu/drm/radeon/ni_dpm.c @@ -2738,10 +2738,10 @@ static int ni_set_mc_special_registers(struct radeo= n_device *rdev, table->mc_reg_table_entry[k].mc_data[j] |=3D 0x100; } j++; - if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) - return -EINVAL; break; case MC_SEQ_RESERVE_M >> 2: + if (j >=3D SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) + return -EINVAL; temp_reg =3D RREG32(MC_PMG_CMD_MRS1); table->mc_reg_address[j].s1 =3D MC_PMG_CMD_MRS1 >> 2; table->mc_reg_address[j].s0 =3D MC_SEQ_PMG_CMD_MRS1_LP >> 2; @@ -2750,8 +2750,6 @@ static int ni_set_mc_special_registers(struct radeon_= device *rdev, (temp_reg & 0xffff0000) | (table->mc_reg_table_entry[k].mc_data[i] & 0x0000ffff); j++; - if (j > SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE) - return -EINVAL; break; default: break; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60313C32772 for ; Tue, 23 Aug 2022 09:37:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351552AbiHWJhw (ORCPT ); Tue, 23 Aug 2022 05:37:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45938 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351945AbiHWJgJ (ORCPT ); Tue, 23 Aug 2022 05:36:09 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2850C95E67; Tue, 23 Aug 2022 01:40:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 9E2D4CE1B4D; Tue, 23 Aug 2022 08:39:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B1DDBC433D6; Tue, 23 Aug 2022 08:39:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243955; bh=LZkjIvVaPJ5PQVliSAj7ZPU9g5VAT/t9LqW3Bx3TFh0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Du1hVkKaYey64ForIaKbyOOqp9Gml+/VNA5T/qyT9f1EHdesq2lti9BFkY/xLGo5v o0VveL6t43b01YZkm6oQIZa8tJMBFVXRRVUd3e3ZkaycOE3vUGsMsv5DwY6jm3xFHD 19cXO4BJHZFqthPRTnwrhTCfD2GAgevavF4JUPUU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jitao Shi , Xinlei Lee , Rex-BC Chen , Chun-Kuang Hu , Sasha Levin Subject: [PATCH 4.14 061/229] drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function Date: Tue, 23 Aug 2022 10:23:42 +0200 Message-Id: <20220823080055.918335162@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xinlei Lee [ Upstream commit fa5d0a0205c34734c5b8daa77e39ac2817f63a10 ] In the dsi_enable function, mtk_dsi_rxtx_control is to pull up the MIPI signal operation. Before dsi_disable, MIPI should also be pulled down by writing a register instead of disabling dsi. If disable dsi without pulling the mipi signal low, the value of the register will still maintain the setting of the mipi signal being pulled high. After resume, even if the mipi signal is not pulled high, it will still be in the high state. Fixes: 2e54c14e310f ("drm/mediatek: Add DSI sub driver") Link: https://patchwork.kernel.org/project/linux-mediatek/patch/1653012007-= 11854-5-git-send-email-xinlei.lee@mediatek.com/ Signed-off-by: Jitao Shi Signed-off-by: Xinlei Lee Reviewed-by: Rex-BC Chen Signed-off-by: Chun-Kuang Hu Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/mediatek/mtk_dsi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/= mtk_dsi.c index c1b8caad65e6..7ae243122f68 100644 --- a/drivers/gpu/drm/mediatek/mtk_dsi.c +++ b/drivers/gpu/drm/mediatek/mtk_dsi.c @@ -652,6 +652,8 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi) mtk_dsi_reset_engine(dsi); mtk_dsi_lane0_ulp_mode_enter(dsi); mtk_dsi_clk_ulp_mode_enter(dsi); + /* set the lane number as 0 to pull down mipi */ + writel(0, dsi->regs + DSI_TXRX_CTRL); =20 mtk_dsi_disable(dsi); =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88687C32772 for ; Tue, 23 Aug 2022 10:07:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352517AbiHWKHt (ORCPT ); Tue, 23 Aug 2022 06:07:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44338 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352443AbiHWKBy (ORCPT ); Tue, 23 Aug 2022 06:01:54 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 91E417C1A1; Tue, 23 Aug 2022 01:49:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A1639B81C67; Tue, 23 Aug 2022 08:39:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D838CC433C1; Tue, 23 Aug 2022 08:39:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243961; bh=b5WWhPm4tN/qjLDw8OdQq86f6/et3lf3Vl+6V9cC7do=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wpUbZmK/86AM36yZQwWdagXFTMpxbRqHHYejbPFztj5rMAJSfijxk9KXgkjRpKulQ 2l6iNyImSvBCV8BeWvi8lPTPYeOfG44N242ew13zun77V+fRxTStNF2tEp/XgXonBf Mvfxo0ILT+GLEvHqGVJ3lkwGGUgF3DM9wuNO+67Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xu Wang , Wolfram Sang , Sasha Levin Subject: [PATCH 4.14 062/229] i2c: Fix a potential use after free Date: Tue, 23 Aug 2022 10:23:43 +0200 Message-Id: <20220823080055.953083003@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xu Wang [ Upstream commit e4c72c06c367758a14f227c847f9d623f1994ecf ] Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. Fixes: 611e12ea0f12 ("i2c: core: manage i2c bus device refcount in i2c_[get= |put]_adapter") Signed-off-by: Xu Wang [wsa: added comment to the code, added Fixes tag] Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/i2c/i2c-core-base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index b7fe8075f2b8..c1fc49365189 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2243,8 +2243,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) if (!adap) return; =20 - put_device(&adap->dev); module_put(adap->owner); + /* Should be last, otherwise we risk use-after-free with 'adap' */ + put_device(&adap->dev); } EXPORT_SYMBOL(i2c_put_adapter); =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EECABC32792 for ; Tue, 23 Aug 2022 09:36:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352122AbiHWJgc (ORCPT ); Tue, 23 Aug 2022 05:36:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43254 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351157AbiHWJek (ORCPT ); Tue, 23 Aug 2022 05:34:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3452F95AF9; Tue, 23 Aug 2022 01:39:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 99F6EB81C69; Tue, 23 Aug 2022 08:39:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9602C433D6; Tue, 23 Aug 2022 08:39:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243967; bh=59tvkVufFs3JBdPukARV/TssrDo3G4tUPk9jkp5A+2s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wspHXVuczCAzqggz6hSAUDd9TamVzcftfotRxYh1ZwUtYEsw+LcjCAJh56IZS25Cz WhzrHM/20uZBmserxDdnCj/0YFAFtY1acYX5xA2MJ0mJWi3xujLYhUyfXhD21LM1V3 oacadoJw9OWOnRXHD9LZFOmetqKA3tedP/I+uM7Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Kalle Valo , Sasha Levin , syzbot+03110230a11411024147@syzkaller.appspotmail.com, syzbot+c6dde1f690b60e0b9fbe@syzkaller.appspotmail.com Subject: [PATCH 4.14 063/229] ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Date: Tue, 23 Aug 2022 10:23:44 +0200 Message-Id: <20220823080055.986173465@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pavel Skripkin [ Upstream commit 0ac4827f78c7ffe8eef074bc010e7e34bc22f533 ] Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable call trace which can trigger use-after-free: ath9k_htc_probe_device() /* htc_handle->drv_priv =3D priv; */ ath9k_htc_wait_for_target() <--- Failed ieee80211_free_hw() <--- priv pointer is freed ... ath9k_hif_usb_rx_cb() ath9k_hif_usb_rx_stream() RX_STAT_INC() <--- htc_handle->drv_priv access In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make all *_STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1] Link: https://syzkaller.appspot.com/bug?id=3D6ead44e37afb6866ac0c7dd121b4ce= 07cb665f60 [0] Link: https://syzkaller.appspot.com/bug?id=3Db8101ffcec107c0567a0cd8acbbace= c91e9ee8de [1] Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Reported-and-tested-by: syzbot+03110230a11411024147@syzkaller.appspotmail.c= om Reported-and-tested-by: syzbot+c6dde1f690b60e0b9fbe@syzkaller.appspotmail.c= om Signed-off-by: Pavel Skripkin Acked-by: Toke H=C3=B8iland-J=C3=B8rgensen Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/d57bbedc857950659bfacac0ab48790c1eda00c8.16= 55145743.git.paskripkin@gmail.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/wireless/ath/ath9k/htc.h | 10 +++++----- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 3 ++- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/at= h/ath9k/htc.h index 16dff4b89a86..d66d3c9299fb 100644 --- a/drivers/net/wireless/ath/ath9k/htc.h +++ b/drivers/net/wireless/ath/ath9k/htc.h @@ -325,11 +325,11 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(str= uct sk_buff *skb) } =20 #ifdef CONFIG_ATH9K_HTC_DEBUGFS - -#define TX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) -#define TX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c= +=3D a) -#define RX_STAT_INC(c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c= ++) -#define RX_STAT_ADD(c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stat= s.c +=3D a) +#define __STAT_SAFE(expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0) +#define TX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx= _stats.c++) +#define TX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug= .tx_stats.c +=3D a) +#define RX_STAT_INC(c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.sk= brx_stats.c++) +#define RX_STAT_ADD(c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug= .skbrx_stats.c +=3D a) #define CAB_STAT_INC priv->debug.tx_stats.cab_queued++ =20 #define TX_QSTAT_INC(q) (priv->debug.tx_stats.queue_stats[q]++) diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wi= reless/ath/ath9k/htc_drv_init.c index 88e3b4a4de31..9fcdda6f7088 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c @@ -946,7 +946,6 @@ int ath9k_htc_probe_device(struct htc_target *htc_handl= e, struct device *dev, priv->hw =3D hw; priv->htc =3D htc_handle; priv->dev =3D dev; - htc_handle->drv_priv =3D priv; SET_IEEE80211_DEV(hw, priv->dev); =20 ret =3D ath9k_htc_wait_for_target(priv); @@ -967,6 +966,8 @@ int ath9k_htc_probe_device(struct htc_target *htc_handl= e, struct device *dev, if (ret) goto err_init; =20 + htc_handle->drv_priv =3D priv; + return 0; =20 err_init: --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F77DC32772 for ; Tue, 23 Aug 2022 09:39:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351718AbiHWJi7 (ORCPT ); Tue, 23 Aug 2022 05:38:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53222 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351645AbiHWJiR (ORCPT ); Tue, 23 Aug 2022 05:38:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BC36A98591; Tue, 23 Aug 2022 01:40:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 04DE56153A; Tue, 23 Aug 2022 08:39:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0BF13C433C1; Tue, 23 Aug 2022 08:39:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243973; bh=S91jLsmDc1tZj5ujADBa85XorHb6hMV7HBp03U4iFcc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cmTWEp1rfc3tPPHERK1278DiVcwn2dl06BWt9ut5wFKfJ5XQGhlEX+Uj4z5p5lJwU K5kDetjUnxvKUWSUUyBPnB5MwiwjHsFYMNKBNAWOhrysJHdT/HkcIgxtCen6wneQFq Gl+R/tJYeiYrJt3vM4RVnEykXtNxrMLVRKoCA+Zc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexey Kodanev , Kalle Valo , Sasha Levin Subject: [PATCH 4.14 064/229] wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd() Date: Tue, 23 Aug 2022 10:23:45 +0200 Message-Id: <20220823080056.017384397@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexey Kodanev [ Upstream commit a8eb8e6f7159c7c20c0ddac428bde3d110890aa7 ] As a result of the execution of the inner while loop, the value of 'idx' can be equal to LINK_QUAL_MAX_RETRY_NUM. However, this is not checked after the loop and 'idx' is used to write the LINK_QUAL_MAX_RETRY_NUM size array 'lq_cmd->rs_table[idx]' below in the outer loop. The fix is to check the new value of 'idx' inside the nested loop, and break both loops if index equals the size. Checking it at the start is now pointless, so let's remove it. Detected using the static analysis tool - Svace. Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices= 3945/4965") Signed-off-by: Alexey Kodanev Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220608171614.28891-1-aleksei.kodanev@bell= -sw.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/wireless/intel/iwlegacy/4965-rs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlegacy/4965-rs.c b/drivers/net/wi= reless/intel/iwlegacy/4965-rs.c index c055f6da11c6..623ee20b2c19 100644 --- a/drivers/net/wireless/intel/iwlegacy/4965-rs.c +++ b/drivers/net/wireless/intel/iwlegacy/4965-rs.c @@ -2424,7 +2424,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il= _lq_sta *lq_sta, /* Repeat initial/next rate. * For legacy IL_NUMBER_TRY =3D=3D 1, this loop will not execute. * For HT IL_HT_NUMBER_TRY =3D=3D 3, this executes twice. */ - while (repeat_rate > 0 && idx < LINK_QUAL_MAX_RETRY_NUM) { + while (repeat_rate > 0) { if (is_legacy(tbl_type.lq_type)) { if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE) ant_toggle_cnt++; @@ -2443,6 +2443,8 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il= _lq_sta *lq_sta, cpu_to_le32(new_rate); repeat_rate--; idx++; + if (idx >=3D LINK_QUAL_MAX_RETRY_NUM) + goto out; } =20 il4965_rs_get_tbl_info_from_mcs(new_rate, lq_sta->band, @@ -2487,6 +2489,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il= _lq_sta *lq_sta, repeat_rate--; } =20 +out: lq_cmd->agg_params.agg_frame_cnt_limit =3D LINK_QUAL_AGG_FRAME_LIMIT_DEF; lq_cmd->agg_params.agg_dis_start_th =3D LINK_QUAL_AGG_DISABLE_START_DEF; =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 629B2C32792 for ; Tue, 23 Aug 2022 09:48:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344716AbiHWJsZ (ORCPT ); Tue, 23 Aug 2022 05:48:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55376 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352177AbiHWJqB (ORCPT ); Tue, 23 Aug 2022 05:46:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 136992CE16; Tue, 23 Aug 2022 01:43:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DADB661485; Tue, 23 Aug 2022 08:43:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CDB6BC433D6; Tue, 23 Aug 2022 08:43:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244190; bh=FnF15LZwNDPxhljz7cmUOV0fzoKOxDGUuWynoWR/aTM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F2mjt2gxKGOYDEGBKCnyboElcNdJIpHxdsICEZNd3KRvp2Wmo5ZMssnW4/i55M/+8 DzyKxhDf3JveabyneIFRKqzn15fa1LFf1wy/iOSFDqObDnuv6xa85TBuCAa+NIwf4W 6F2yETregWS+uZkkTSPr51T3DPaPY8dXpwLB0dwM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Laurent Pinchart , Sam Ravnborg , Sasha Levin Subject: [PATCH 4.14 065/229] drm: bridge: adv7511: Add check for mipi_dsi_driver_register Date: Tue, 23 Aug 2022 10:23:46 +0200 Message-Id: <20220823080056.049597945@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 831463667b5f4f1e5bce9c3b94e9e794d2bc8923 ] As mipi_dsi_driver_register could return error if fails, it should be better to check the return value and return error if fails. Moreover, if i2c_add_driver fails, mipi_dsi_driver_register should be reverted. Fixes: 1e4d58cd7f88 ("drm/bridge: adv7533: Create a MIPI DSI device") Signed-off-by: Jiasheng Jiang Reviewed-by: Laurent Pinchart Signed-off-by: Sam Ravnborg Link: https://patchwork.freedesktop.org/patch/msgid/20220602103401.2980938-= 1-jiasheng@iscas.ac.cn Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm= /bridge/adv7511/adv7511_drv.c index 3c94d838863e..f5195d9841f8 100644 --- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c @@ -1213,10 +1213,21 @@ static struct i2c_driver adv7511_driver =3D { =20 static int __init adv7511_init(void) { - if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) - mipi_dsi_driver_register(&adv7533_dsi_driver); + int ret; + + if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) { + ret =3D mipi_dsi_driver_register(&adv7533_dsi_driver); + if (ret) + return ret; + } =20 - return i2c_add_driver(&adv7511_driver); + ret =3D i2c_add_driver(&adv7511_driver); + if (ret) { + if (IS_ENABLED(CONFIG_DRM_MIPI_DSI)) + mipi_dsi_driver_unregister(&adv7533_dsi_driver); + } + + return ret; } module_init(adv7511_init); =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 574E7C32772 for ; Tue, 23 Aug 2022 09:39:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241936AbiHWJjp (ORCPT ); Tue, 23 Aug 2022 05:39:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52568 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351689AbiHWJim (ORCPT ); Tue, 23 Aug 2022 05:38:42 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AB43225EB1; Tue, 23 Aug 2022 01:41:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D11D16153C; Tue, 23 Aug 2022 08:39:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B084AC433D6; Tue, 23 Aug 2022 08:39:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661243999; bh=3nNFgxHraRJWA0ShV22x8RUpKDKlePeNDiV/IlDMamg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XQmJUufWNUijtmn5P/GDwEbN+d+WfmB9xU8INGKmbJ4rffpVfEXLB85N8Wa2cHWSM liD/nOlxM1VIZD1QKqQYnLiJ30FPXVS6D9T75s7/2EPmiLsJZPTbGXBkwgDc3F0Dkz jyaRVG12Ign2O+Kf7djQ0ifEklCM+gU+28q3BY+s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Niels Dossche , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.14 066/229] media: hdpvr: fix error value returns in hdpvr_read Date: Tue, 23 Aug 2022 10:23:47 +0200 Message-Id: <20220823080056.079825043@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Niels Dossche [ Upstream commit 359c27c6ddbde404f44a9c0d3ec88ccd1e2042f2 ] Error return values are supposed to be negative in hdpvr_read. Most error returns are currently handled via an unsigned integer "ret". When setting a negative error value to "ret", the value actually becomes a large positive value, because "ret" is unsigned. Later on, the "ret" value is returned. But as ssize_t is a 64-bit signed number, the error return value stays a large positive integer instead of a negative integer. This can cause an error value to be interpreted as the read size, which can cause a buffer overread for applications relying on the returned size. Fixes: 9aba42efe85b ("V4L/DVB (11096): V4L2 Driver for the Hauppauge HD PVR= usb capture device") Signed-off-by: Niels Dossche Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/media/usb/hdpvr/hdpvr-video.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpv= r/hdpvr-video.c index 1cecb37e16d2..59bd44736fae 100644 --- a/drivers/media/usb/hdpvr/hdpvr-video.c +++ b/drivers/media/usb/hdpvr/hdpvr-video.c @@ -413,7 +413,7 @@ static ssize_t hdpvr_read(struct file *file, char __use= r *buffer, size_t count, struct hdpvr_device *dev =3D video_drvdata(file); struct hdpvr_buffer *buf =3D NULL; struct urb *urb; - unsigned int ret =3D 0; + int ret =3D 0; int rem, cnt; =20 if (*pos) --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 036A6C32774 for ; Tue, 23 Aug 2022 09:40:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351727AbiHWJkJ (ORCPT ); Tue, 23 Aug 2022 05:40:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52876 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241877AbiHWJjP (ORCPT ); Tue, 23 Aug 2022 05:39:15 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D52B77EA0; Tue, 23 Aug 2022 01:41:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EDC2A6153A; Tue, 23 Aug 2022 08:41:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DBFEAC433C1; Tue, 23 Aug 2022 08:41:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244065; bh=xhRxOo1GPiaDygVWyNltCZqUz115iKckMGsylEzVE1k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TeanYzm+rEjGQrXKX/nLzp6WEH7Ev5FS+385acPwZ72XQ7PMki49Hxsw+6In1Agpc eBGTURkcolhCwumohw8twWVOxe2d9Ja52WVyUMcjshm0l0EtY1Ieo0bmNY3lCVXnmQ 0QYUY9X2y8C5LhxM7/jnay5f6qKIkDfCBDJblfRo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dave Stevenson , Maxime Ripard , Sasha Levin Subject: [PATCH 4.14 067/229] drm/vc4: dsi: Correct DSI divider calculations Date: Tue, 23 Aug 2022 10:23:48 +0200 Message-Id: <20220823080056.115431219@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dave Stevenson [ Upstream commit 3b45eee87da171caa28f61240ddb5c21170cda53 ] The divider calculations tried to find the divider just faster than the clock requested. However if it required a divider of 7 then the for loop aborted without handling the "error" case, and could end up with a clock lower than requested. The integer divider from parent PLL to DSI clock is also capable of going up to /255, not just /7 that the driver was trying. This allows for slower link frequencies on the DSI bus where the resolution permits. Correct the loop so that we always have a clock greater than requested, and covering the whole range of dividers. Fixes: 86c1b9eff3f2 ("drm/vc4: Adjust modes in DSI to work around the integ= er PLL divider.") Signed-off-by: Dave Stevenson Link: https://lore.kernel.org/r/20220613144800.326124-13-maxime@cerno.tech Signed-off-by: Maxime Ripard Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/vc4/vc4_dsi.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_dsi.c b/drivers/gpu/drm/vc4/vc4_dsi.c index 04796d7d0fdb..33d27f4acec0 100644 --- a/drivers/gpu/drm/vc4/vc4_dsi.c +++ b/drivers/gpu/drm/vc4/vc4_dsi.c @@ -846,11 +846,9 @@ static bool vc4_dsi_encoder_mode_fixup(struct drm_enco= der *encoder, /* Find what divider gets us a faster clock than the requested * pixel clock. */ - for (divider =3D 1; divider < 8; divider++) { - if (parent_rate / divider < pll_clock) { - divider--; + for (divider =3D 1; divider < 255; divider++) { + if (parent_rate / (divider + 1) < pll_clock) break; - } } =20 /* Now that we've picked a PLL divider, calculate back to its --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 801A5C32772 for ; Tue, 23 Aug 2022 09:47:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240352AbiHWJrO (ORCPT ); Tue, 23 Aug 2022 05:47:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352645AbiHWJlm (ORCPT ); Tue, 23 Aug 2022 05:41:42 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 46F9699269; Tue, 23 Aug 2022 01:42:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E952A614E9; Tue, 23 Aug 2022 08:42:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B756C433D6; Tue, 23 Aug 2022 08:42:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244134; bh=3YWFN+XdT8fZR01BOiGHTKj+hLvtm2wKp6jWFyaFJ34=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q+orXx6TQk0XQu3Zqn//M2qVPuoxoKvpX3CG7qJpUo8Newmr9P/U8o+ob508gWhoV P5rY8P0Sg6nXk8xXx73TmNlP2kyRzY7YJJuY/2u4k+TYOkthCBC0TX3QvwWDGQfkVH P2Rcys7qSSfB6cVU9m8JyT6W5+rO6ZUXw5t7zzek= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brian Norris , Sean Paul , Douglas Anderson , Heiko Stuebner , Sasha Levin Subject: [PATCH 4.14 068/229] drm/rockchip: vop: Dont crash for invalid duplicate_state() Date: Tue, 23 Aug 2022 10:23:49 +0200 Message-Id: <20220823080056.147646905@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Brian Norris [ Upstream commit 1449110b0dade8b638d2c17ab7c5b0ff696bfccb ] It's possible for users to try to duplicate the CRTC state even when the state doesn't exist. drm_atomic_helper_crtc_duplicate_state() (and other users of __drm_atomic_helper_crtc_duplicate_state()) already guard this with a WARN_ON() instead of crashing, so let's do that here too. Fixes: 4e257d9eee23 ("drm/rockchip: get rid of rockchip_drm_crtc_mode_confi= g") Signed-off-by: Brian Norris Reviewed-by: Sean Paul Reviewed-by: Douglas Anderson Signed-off-by: Heiko Stuebner Link: https://patchwork.freedesktop.org/patch/msgid/20220617172623.1.I62db2= 28170b1559ada60b8d3e1637e1688424926@changeid Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/= rockchip/rockchip_drm_vop.c index 80a65eaed0be..feb6a458f82d 100644 --- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c @@ -1068,6 +1068,9 @@ static struct drm_crtc_state *vop_crtc_duplicate_stat= e(struct drm_crtc *crtc) { struct rockchip_crtc_state *rockchip_state; =20 + if (WARN_ON(!crtc->state)) + return NULL; + rockchip_state =3D kzalloc(sizeof(*rockchip_state), GFP_KERNEL); if (!rockchip_state) return NULL; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 421D0C32772 for ; Tue, 23 Aug 2022 09:48:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243347AbiHWJsE (ORCPT ); Tue, 23 Aug 2022 05:48:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48066 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351916AbiHWJpl (ORCPT ); Tue, 23 Aug 2022 05:45:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 80DDB2F7; Tue, 23 Aug 2022 01:43:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1EDD4B81C4F; Tue, 23 Aug 2022 08:43:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6A1B2C433D6; Tue, 23 Aug 2022 08:43:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244180; bh=wvDu/ipmfAlirHb5j2FpWgwFya3KrOeJTyYaZnia1G8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CdHDgkxv9ioSHTRq9P0KRjNy/4t4kgWU6FkAj7L2NNPtTA1u8laAXlvFu9n+iTPvF tJErhwXKTCMRGJ6tl5SVxZGywEpu0rcD5/2VGSCMyZGmr8yMyNj9Rnb1++1DDV2adk 7cfS7/35s77wW9XbS8l3SIZOWQFAagdZ06kv4BO4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bo-Chen Chen , Chun-Kuang Hu , Sasha Levin Subject: [PATCH 4.14 069/229] drm/mediatek: dpi: Remove output format of YUV Date: Tue, 23 Aug 2022 10:23:50 +0200 Message-Id: <20220823080056.184219976@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bo-Chen Chen [ Upstream commit c9ed0713b3c35fc45677707ba47f432cad95da56 ] DPI is not support output format as YUV, but there is the setting of configuring output YUV. Therefore, remove them in this patch. Fixes: 9e629c17aa8d ("drm/mediatek: Add DPI sub driver") Signed-off-by: Bo-Chen Chen Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20220701035= 845.16458-5-rex-bc.chen@mediatek.com/ Signed-off-by: Chun-Kuang Hu Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/mediatek/mtk_dpi.c | 31 ++++++------------------------ 1 file changed, 6 insertions(+), 25 deletions(-) diff --git a/drivers/gpu/drm/mediatek/mtk_dpi.c b/drivers/gpu/drm/mediatek/= mtk_dpi.c index e80a603e5fb0..6b12be8ca33e 100644 --- a/drivers/gpu/drm/mediatek/mtk_dpi.c +++ b/drivers/gpu/drm/mediatek/mtk_dpi.c @@ -51,13 +51,7 @@ enum mtk_dpi_out_channel_swap { }; =20 enum mtk_dpi_out_color_format { - MTK_DPI_COLOR_FORMAT_RGB, - MTK_DPI_COLOR_FORMAT_RGB_FULL, - MTK_DPI_COLOR_FORMAT_YCBCR_444, - MTK_DPI_COLOR_FORMAT_YCBCR_422, - MTK_DPI_COLOR_FORMAT_XV_YCC, - MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL, - MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL + MTK_DPI_COLOR_FORMAT_RGB }; =20 struct mtk_dpi { @@ -346,24 +340,11 @@ static void mtk_dpi_config_2n_h_fre(struct mtk_dpi *d= pi) static void mtk_dpi_config_color_format(struct mtk_dpi *dpi, enum mtk_dpi_out_color_format format) { - if ((format =3D=3D MTK_DPI_COLOR_FORMAT_YCBCR_444) || - (format =3D=3D MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL)) { - mtk_dpi_config_yuv422_enable(dpi, false); - mtk_dpi_config_csc_enable(dpi, true); - mtk_dpi_config_swap_input(dpi, false); - mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_BGR); - } else if ((format =3D=3D MTK_DPI_COLOR_FORMAT_YCBCR_422) || - (format =3D=3D MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL)) { - mtk_dpi_config_yuv422_enable(dpi, true); - mtk_dpi_config_csc_enable(dpi, true); - mtk_dpi_config_swap_input(dpi, true); - mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); - } else { - mtk_dpi_config_yuv422_enable(dpi, false); - mtk_dpi_config_csc_enable(dpi, false); - mtk_dpi_config_swap_input(dpi, false); - mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); - } + /* only support RGB888 */ + mtk_dpi_config_yuv422_enable(dpi, false); + mtk_dpi_config_csc_enable(dpi, false); + mtk_dpi_config_swap_input(dpi, false); + mtk_dpi_config_channel_swap(dpi, MTK_DPI_OUT_CHANNEL_SWAP_RGB); } =20 static void mtk_dpi_power_off(struct mtk_dpi *dpi, enum mtk_dpi_power_ctl = pctl) --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E704C32772 for ; Tue, 23 Aug 2022 09:47:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243419AbiHWJru (ORCPT ); Tue, 23 Aug 2022 05:47:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41958 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351767AbiHWJpa (ORCPT ); Tue, 23 Aug 2022 05:45:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6EEBD7A779; Tue, 23 Aug 2022 01:43:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 71950B81C5C; Tue, 23 Aug 2022 08:43:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D8B47C433C1; Tue, 23 Aug 2022 08:43:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244187; bh=VFtKmVcVHFihUMWJ0z4ZSZNShLPoexT9ifPT9YdIUEw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2HfODPPp8sS9sTqnZQnI/iRv3G3jGLnZyebcSCV0S3LmsyzqKDr70zY9tAeCJ/T21 h0pbu6qaRYiFPbdyXHk7JKo269i6h/FmAExmlEmmtnKUyClxl3NKeZKvOEE1ODqi/h mgdSppgrmVw6BiON5QA0QgI3/CNXGxJ66Vux8Nsk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangyu Hua , Andrzej Hajda , Robert Foss , Sasha Levin Subject: [PATCH 4.14 070/229] drm: bridge: sii8620: fix possible off-by-one Date: Tue, 23 Aug 2022 10:23:51 +0200 Message-Id: <20220823080056.229988262@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua [ Upstream commit 21779cc21c732c5eff8ea1624be6590450baa30f ] The next call to sii8620_burst_get_tx_buf will result in off-by-one When ctx->burst.tx_count + size =3D=3D ARRAY_SIZE(ctx->burst.tx_buf). The s= ame thing happens in sii8620_burst_get_rx_buf. This patch also change tx_count and tx_buf to rx_count and rx_buf in sii8620_burst_get_rx_buf. It is unreasonable to check tx_buf's size and use rx_buf. Fixes: e19e9c692f81 ("drm/bridge/sii8620: add support for burst eMSC transm= issions") Signed-off-by: Hangyu Hua Reviewed-by: Andrzej Hajda Signed-off-by: Robert Foss Link: https://patchwork.freedesktop.org/patch/msgid/20220518065856.18936-1-= hbh25y@gmail.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/bridge/sil-sii8620.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/= sil-sii8620.c index b93486892f4a..9edb7af37d1e 100644 --- a/drivers/gpu/drm/bridge/sil-sii8620.c +++ b/drivers/gpu/drm/bridge/sil-sii8620.c @@ -628,7 +628,7 @@ static void *sii8620_burst_get_tx_buf(struct sii8620 *c= tx, int len) u8 *buf =3D &ctx->burst.tx_buf[ctx->burst.tx_count]; int size =3D len + 2; =20 - if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) { + if (ctx->burst.tx_count + size >=3D ARRAY_SIZE(ctx->burst.tx_buf)) { dev_err(ctx->dev, "TX-BLK buffer exhausted\n"); ctx->error =3D -EINVAL; return NULL; @@ -645,7 +645,7 @@ static u8 *sii8620_burst_get_rx_buf(struct sii8620 *ctx= , int len) u8 *buf =3D &ctx->burst.rx_buf[ctx->burst.rx_count]; int size =3D len + 1; =20 - if (ctx->burst.tx_count + size > ARRAY_SIZE(ctx->burst.tx_buf)) { + if (ctx->burst.rx_count + size >=3D ARRAY_SIZE(ctx->burst.rx_buf)) { dev_err(ctx->dev, "RX-BLK buffer exhausted\n"); ctx->error =3D -EINVAL; return NULL; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D866C32772 for ; Tue, 23 Aug 2022 09:39:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351385AbiHWJjZ (ORCPT ); Tue, 23 Aug 2022 05:39:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52214 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351346AbiHWJie (ORCPT ); Tue, 23 Aug 2022 05:38:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 50CF05E314; Tue, 23 Aug 2022 01:40:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A95F5B81C6F; Tue, 23 Aug 2022 08:40:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0410BC433C1; Tue, 23 Aug 2022 08:40:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244005; bh=iEBNwJXJZXuq4CJ5XN0UuXtBxokmOgf2OI7wZs/yPh0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WgD3iZcBL56SbHwBFWqaXL8O6y3MdQEKO9kebGEqVbT0P3dUeyK6Q8ClTKfAlG+q4 jO3yfErGSKCp89ywNzQVyDtlkCY+9e3Ivdx3/Otem8mBQK7sKTFC+9NFGYTrm07kHT PC4wpBwuE1V3Oc5n9yjxOF3NEHbvaB8EEofzx89I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, AngeloGioacchino Del Regno , Houlong Wei , Irui Wang , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.14 071/229] media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment Date: Tue, 23 Aug 2022 10:23:52 +0200 Message-Id: <20220823080056.265603348@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: AngeloGioacchino Del Regno [ Upstream commit ab14c99c035da7156a3b66fa171171295bc4b89a ] The mdp_ipi_comm structure defines a command that is either PROCESS (start processing) or DEINIT (destroy instance); we are using this one to send PROCESS or DEINIT commands from Linux to an MDP instance through a VPU write but, while the first wants us to stay 4-bytes aligned, the VPU instead requires an 8-bytes data alignment. Keeping in mind that these commands are executed immediately after sending them (hence not chained with others before the VPU/MDP "actually" start executing), it is fine to simply add a padding of 4 bytes to this structure: this keeps the same performance as before, as we're still stack-allocating it, while avoiding hackery inside of mtk-vpu to ensure alignment bringing a definitely bigger performance impact. Fixes: c8eb2d7e8202 ("[media] media: Add Mediatek MDP Driver") Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Houlong Wei Reviewed-by: Irui Wang Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h b/drivers/media/p= latform/mtk-mdp/mtk_mdp_ipi.h index 78e2cc0dead1..4f4a51dd48e1 100644 --- a/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h +++ b/drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h @@ -48,12 +48,14 @@ struct mdp_ipi_init { * @ipi_id : IPI_MDP * @ap_inst : AP mtk_mdp_vpu address * @vpu_inst_addr : VPU MDP instance address + * @padding : Alignment padding */ struct mdp_ipi_comm { uint32_t msg_id; uint32_t ipi_id; uint64_t ap_inst; uint32_t vpu_inst_addr; + uint32_t padding; }; =20 /** --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1639C32772 for ; Tue, 23 Aug 2022 09:39:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242398AbiHWJjf (ORCPT ); Tue, 23 Aug 2022 05:39:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52272 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351388AbiHWJig (ORCPT ); Tue, 23 Aug 2022 05:38:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9DDE06FA35; Tue, 23 Aug 2022 01:41:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0BEDE61544; Tue, 23 Aug 2022 08:40:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA9C0C433D6; Tue, 23 Aug 2022 08:40:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244011; bh=MkRRZKl2vWURxdILIjwG6l67FVd+EXKjiW0BFFOjmH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nIzNMtq5TxVt3vby/zDKkjT9B7VMdUS46RECKAzMV1iGU11VwOQpJlHvYC9EiVlsM QYcYzYMYKjrBJ4GbH60xUJ2OZhZbwfjRRT4UCztyxucaaLkjpG8soFeQZJup5WXB4/ PpDeZ4yODH8cHyRCEpnasrJ+ZQF/D/T8cnRkm+6M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yonglong Li , Eric Dumazet , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.14 072/229] tcp: make retransmitted SKB fit into the send window Date: Tue, 23 Aug 2022 10:23:53 +0200 Message-Id: <20220823080056.295762077@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yonglong Li [ Upstream commit 536a6c8e05f95e3d1118c40ae8b3022ee2d05d52 ] current code of __tcp_retransmit_skb only check TCP_SKB_CB(skb)->seq in send window, and TCP_SKB_CB(skb)->seq_end maybe out of send window. If receiver has shrunk his window, and skb is out of new window, it should retransmit a smaller portion of the payload. test packetdrill script: 0 socket(..., SOCK_STREAM, IPPROTO_TCP) =3D 3 +0 fcntl(3, F_GETFL) =3D 0x2 (flags O_RDWR) +0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) =3D 0 +0 connect(3, ..., ...) =3D -1 EINPROGRESS (Operation now in progress) +0 > S 0:0(0) win 65535 +.05 < S. 0:0(0) ack 1 win 6000 +0 > . 1:1(0) ack 1 +0 write(3, ..., 10000) =3D 10000 +0 > . 1:2001(2000) ack 1 win 65535 +0 > . 2001:4001(2000) ack 1 win 65535 +0 > . 4001:6001(2000) ack 1 win 65535 +.05 < . 1:1(0) ack 4001 win 1001 and tcpdump show: 192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 1:2001, ack 1, win 65535= , length 2000 192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 2001:4001, ack 1, win 65= 535, length 2000 192.168.226.67.55 > 192.0.2.1.8080: Flags [P.], seq 4001:5001, ack 1, win 6= 5535, length 1000 192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 5001:6001, ack 1, win 65= 535, length 1000 192.0.2.1.8080 > 192.168.226.67.55: Flags [.], ack 4001, win 1001, length 0 192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 5001:6001, ack 1, win 65= 535, length 1000 192.168.226.67.55 > 192.0.2.1.8080: Flags [P.], seq 4001:5001, ack 1, win 6= 5535, length 1000 when cient retract window to 1001, send window is [4001,5002], but TLP send 5001-6001 packet which is out of send window. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Yonglong Li Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/1657532838-20200-1-git-send-email-liyonglon= g@chinatelecom.cn Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv4/tcp_output.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 5e9b7dfd9d2d..c6548155df83 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2861,7 +2861,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_b= uff *skb, int segs) struct tcp_sock *tp =3D tcp_sk(sk); unsigned int cur_mss; int diff, len, err; - + int avail_wnd; =20 /* Inconclusive MTU probe */ if (icsk->icsk_mtup.probe_size) @@ -2891,17 +2891,25 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk= _buff *skb, int segs) return -EHOSTUNREACH; /* Routing failure or similar. */ =20 cur_mss =3D tcp_current_mss(sk); + avail_wnd =3D tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq; =20 /* If receiver has shrunk his window, and skb is out of * new window, do not retransmit it. The exception is the * case, when window is shrunk to zero. In this case - * our retransmit serves as a zero window probe. + * our retransmit of one segment serves as a zero window probe. */ - if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp)) && - TCP_SKB_CB(skb)->seq !=3D tp->snd_una) - return -EAGAIN; + if (avail_wnd <=3D 0) { + if (TCP_SKB_CB(skb)->seq !=3D tp->snd_una) + return -EAGAIN; + avail_wnd =3D cur_mss; + } =20 len =3D cur_mss * segs; + if (len > avail_wnd) { + len =3D rounddown(avail_wnd, cur_mss); + if (!len) + len =3D avail_wnd; + } if (skb->len > len) { if (tcp_fragment(sk, skb, len, cur_mss, GFP_ATOMIC)) return -ENOMEM; /* We'll try again later. */ @@ -2914,8 +2922,9 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_b= uff *skb, int segs) diff -=3D tcp_skb_pcount(skb); if (diff) tcp_adjust_pcount(sk, skb, diff); - if (skb->len < cur_mss) - tcp_retrans_try_collapse(sk, skb, cur_mss); + avail_wnd =3D min_t(int, avail_wnd, cur_mss); + if (skb->len < avail_wnd) + tcp_retrans_try_collapse(sk, skb, avail_wnd); } =20 /* RFC3168, section 6.1.1.1. ECN fallback */ --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CD80C32796 for ; Tue, 23 Aug 2022 09:41:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243363AbiHWJlx (ORCPT ); Tue, 23 Aug 2022 05:41:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49794 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242879AbiHWJj1 (ORCPT ); Tue, 23 Aug 2022 05:39:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AC23322BC2; Tue, 23 Aug 2022 01:41:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3B57E614E7; Tue, 23 Aug 2022 08:40:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B3EEC433C1; Tue, 23 Aug 2022 08:40:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244017; bh=791j+2hWy8TOd/D1gDSC01GR07M5nk56qoSUdhg5FAU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VIh6GOuSr/7lKgPKH3szZshSvRy3n0eQBEBGdRimYKCEvF4bYP8NrlrzKgWNShkXK T0dFkQ2OTaKe8FVejq0FzxP9uqJhpPEQrcuXZip7ijxrUChUhRGOse3hRfYTppco4E aEmnBAGZ2TH+NmRdEF389Tdv4unUilRMQDoCm3uk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wolfram Sang , John Stultz , Shuah Khan , Sasha Levin Subject: [PATCH 4.14 073/229] selftests: timers: valid-adjtimex: build fix for newer toolchains Date: Tue, 23 Aug 2022 10:23:54 +0200 Message-Id: <20220823080056.336287734@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Wolfram Sang [ Upstream commit 9a162977d20436be5678a8e21a8e58eb4616d86a ] Toolchains with an include file 'sys/timex.h' based on 3.18 will have a 'clock_adjtime' definition added, so it can't be static in the code: valid-adjtimex.c:43:12: error: static declaration of =E2=80=98clock_adjtime= =E2=80=99 follows non-static declaration Fixes: e03a58c320e1 ("kselftests: timers: Add adjtimex SETOFFSET validity t= ests") Signed-off-by: Wolfram Sang Acked-by: John Stultz Signed-off-by: Shuah Khan Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- tools/testing/selftests/timers/valid-adjtimex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/timers/valid-adjtimex.c b/tools/testin= g/selftests/timers/valid-adjtimex.c index 5397de708d3c..48b9a803235a 100644 --- a/tools/testing/selftests/timers/valid-adjtimex.c +++ b/tools/testing/selftests/timers/valid-adjtimex.c @@ -40,7 +40,7 @@ #define ADJ_SETOFFSET 0x0100 =20 #include -static int clock_adjtime(clockid_t id, struct timex *tx) +int clock_adjtime(clockid_t id, struct timex *tx) { return syscall(__NR_clock_adjtime, id, tx); } --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A7E1C3F6B0 for ; Tue, 23 Aug 2022 09:41:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241712AbiHWJlt (ORCPT ); Tue, 23 Aug 2022 05:41:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52398 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242766AbiHWJj1 (ORCPT ); Tue, 23 Aug 2022 05:39:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 016FA78BDF; Tue, 23 Aug 2022 01:41:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 205E7B81C4A; Tue, 23 Aug 2022 08:40:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 628CBC433C1; Tue, 23 Aug 2022 08:40:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244023; bh=/bz97d8eC9tLEAccbjF2RV+Ifl5jlUarddDXwnlxLb8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L4W68bxRP3FofIL6/LDNVmDyopE3TdZhUc8xtI0NkNpc7MhglzpBfPPVg7hDodT0K N0AGaq4IC4+mUlArXxqMROv+k/ikHoFCaWQtnJoBa6Uwkf9Ao1yFGuo1GMDVYI1hv5 leVIxLAjv7Zm5HYLd7Bwg8JGA9IdM5HCVHuu2qhg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wolfram Sang , John Stultz , Shuah Khan , Sasha Levin Subject: [PATCH 4.14 074/229] selftests: timers: clocksource-switch: fix passing errors from child Date: Tue, 23 Aug 2022 10:23:55 +0200 Message-Id: <20220823080056.367643955@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wolfram Sang [ Upstream commit 4d8f52ac5fa9eede7b7aa2f2d67c841d9eeb655f ] The return value from system() is a waitpid-style integer. Do not return it directly because with the implicit masking in exit() it will always return 0. Access it with appropriate macros to really pass on errors. Fixes: 7290ce1423c3 ("selftests/timers: Add clocksource-switch test from ti= metest suite") Signed-off-by: Wolfram Sang Acked-by: John Stultz Signed-off-by: Shuah Khan Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- tools/testing/selftests/timers/clocksource-switch.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/testing/selftests/timers/clocksource-switch.c b/tools/te= sting/selftests/timers/clocksource-switch.c index bfc974b4572d..c18313a5f357 100644 --- a/tools/testing/selftests/timers/clocksource-switch.c +++ b/tools/testing/selftests/timers/clocksource-switch.c @@ -110,10 +110,10 @@ int run_tests(int secs) =20 sprintf(buf, "./inconsistency-check -t %i", secs); ret =3D system(buf); - if (ret) - return ret; + if (WIFEXITED(ret) && WEXITSTATUS(ret)) + return WEXITSTATUS(ret); ret =3D system("./nanosleep"); - return ret; + return WIFEXITED(ret) ? WEXITSTATUS(ret) : 0; } =20 =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 64625C32772 for ; Tue, 23 Aug 2022 09:42:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234181AbiHWJmZ (ORCPT ); Tue, 23 Aug 2022 05:42:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52832 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351676AbiHWJkB (ORCPT ); Tue, 23 Aug 2022 05:40:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 451BA98C9E; Tue, 23 Aug 2022 01:41:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 55B8861540; Tue, 23 Aug 2022 08:40:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E456C433D6; Tue, 23 Aug 2022 08:40:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244029; bh=o680fSd5QgG2dGfNBgWcGxeyA9nWVhvUlqlhj7sYoHI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p1DqDv4j42uJXkt/aSj3FkTEK4SFWS/nbBb1VZiX/1Q0nCXB16iz/YHdyI7Hre+VT Br4ncJWwodvBwNQc0dOxTNu/ON0xdh7wpDg60Kd2R5daVOSWn3G6+rSr8n7kLGLtqK qLqthDCz72z089suhoeM/zC3PMt41qR+hqn+GwQA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jens Axboe , "Jason A. Donenfeld" , Al Viro , Sasha Levin Subject: [PATCH 4.14 075/229] fs: check FMODE_LSEEK to control internal pipe splicing Date: Tue, 23 Aug 2022 10:23:56 +0200 Message-Id: <20220823080056.398968527@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason A. Donenfeld [ Upstream commit 97ef77c52b789ec1411d360ed99dca1efe4b2c81 ] The original direct splicing mechanism from Jens required the input to be a regular file because it was avoiding the special socket case. It also recognized blkdevs as being close enough to a regular file. But it forgot about chardevs, which behave the same way and work fine here. This is an okayish heuristic, but it doesn't totally work. For example, a few chardevs should be spliceable here. And a few regular files shouldn't. This patch fixes this by instead checking whether FMODE_LSEEK is set, which represents decently enough what we need rewinding for when splicing to internal pipes. Fixes: b92ce5589374 ("[PATCH] splice: add direct fd <-> fd splicing support= ") Cc: Jens Axboe Signed-off-by: Jason A. Donenfeld Signed-off-by: Al Viro Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/splice.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/fs/splice.c b/fs/splice.c index c84ac7e97e21..04d25af25a42 100644 --- a/fs/splice.c +++ b/fs/splice.c @@ -898,17 +898,15 @@ ssize_t splice_direct_to_actor(struct file *in, struc= t splice_desc *sd, { struct pipe_inode_info *pipe; long ret, bytes; - umode_t i_mode; size_t len; int i, flags, more; =20 /* - * We require the input being a regular file, as we don't want to - * randomly drop data for eg socket -> socket splicing. Use the - * piped splicing for that! + * We require the input to be seekable, as we don't want to randomly + * drop data for eg socket -> socket splicing. Use the piped splicing + * for that! */ - i_mode =3D file_inode(in)->i_mode; - if (unlikely(!S_ISREG(i_mode) && !S_ISBLK(i_mode))) + if (unlikely(!(in->f_mode & FMODE_LSEEK))) return -EINVAL; =20 /* --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B32CC32772 for ; Tue, 23 Aug 2022 09:42:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236362AbiHWJm4 (ORCPT ); Tue, 23 Aug 2022 05:42:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53152 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351790AbiHWJk2 (ORCPT ); Tue, 23 Aug 2022 05:40:28 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EF27679617; Tue, 23 Aug 2022 01:41:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 01904B81C53; Tue, 23 Aug 2022 08:40:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5160DC433D6; Tue, 23 Aug 2022 08:40:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244035; bh=AisqD+BxsURlxBzqnrALLl/6eXvWjzd6ssr7CqHPOxk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ewAB1kjuiLsY4Sx8v9VQ9JMBKOd3mqWwFGuxIQA8MMW8I/3F66iF4ZQMf+R8q5y9U Gln/AcOPIQo8Y33JwBKMDoDUmrHrrKILswDRYXcMWmOkskiDEe0Cuslrf/h9ScXiIz 62Qzqxa5iZ1wwK3N8k7U2kvHgObw1U1RDCna7FQk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Kalle Valo , Sasha Levin Subject: [PATCH 4.14 076/229] wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() Date: Tue, 23 Aug 2022 10:23:57 +0200 Message-Id: <20220823080056.429146556@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit 7a4836560a6198d245d5732e26f94898b12eb760 ] The simple_write_to_buffer() function will succeed if even a single byte is initialized. However, we need to initialize the whole buffer to prevent information leaks. Just use memdup_user(). Fixes: ff974e408334 ("wil6210: debugfs interface to send raw WMI command") Signed-off-by: Dan Carpenter Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/Ysg14NdKAZF/hcNG@kili Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/wireless/ath/wil6210/debugfs.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wirel= ess/ath/wil6210/debugfs.c index 3a98f75c5d7e..2da52145cb60 100644 --- a/drivers/net/wireless/ath/wil6210/debugfs.c +++ b/drivers/net/wireless/ath/wil6210/debugfs.c @@ -836,18 +836,12 @@ static ssize_t wil_write_file_wmi(struct file *file, = const char __user *buf, u16 cmdid; int rc, rc1; =20 - if (cmdlen < 0) + if (cmdlen < 0 || *ppos !=3D 0) return -EINVAL; =20 - wmi =3D kmalloc(len, GFP_KERNEL); - if (!wmi) - return -ENOMEM; - - rc =3D simple_write_to_buffer(wmi, len, ppos, buf, len); - if (rc < 0) { - kfree(wmi); - return rc; - } + wmi =3D memdup_user(buf, len); + if (IS_ERR(wmi)) + return PTR_ERR(wmi); =20 cmd =3D (cmdlen > 0) ? &wmi[1] : NULL; cmdid =3D le16_to_cpu(wmi->command_id); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48890C32772 for ; Tue, 23 Aug 2022 09:43:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234683AbiHWJnG (ORCPT ); Tue, 23 Aug 2022 05:43:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351818AbiHWJkd (ORCPT ); Tue, 23 Aug 2022 05:40:33 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B600779686; Tue, 23 Aug 2022 01:41:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 103E06152E; Tue, 23 Aug 2022 08:40:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 14DD5C433C1; Tue, 23 Aug 2022 08:40:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244041; bh=UnsYK3CCZV3d4U2OT6f8xJcmMIqfdF3LWGKXGLp2kE4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QeNYWMiPcAU7XSz8sblioW0AFHTwHleTTWA01yyccx8GKInLCtXC9H5uN3wkRx5Xw 4n9F1R3wd6f5V2P7dxqsVQYoB5kdQ0Xck0LCHXBmU+8OZnKt0BU7y8BbGfK/GKvlpt 8HPh5INeZwNKsXdzzI7+bN1gaMt8uus7Br+A9lgE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Christian Lamparter , Kalle Valo , Sasha Levin Subject: [PATCH 4.14 077/229] wifi: p54: Fix an error handling path in p54spi_probe() Date: Tue, 23 Aug 2022 10:23:58 +0200 Message-Id: <20220823080056.464724503@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET [ Upstream commit 83781f0162d080fec7dcb911afd1bc2f5ad04471 ] If an error occurs after a successful call to p54spi_request_firmware(), it must be undone by a corresponding release_firmware() as already done in the error handling path of p54spi_request_firmware() and in the .remove() function. Add the missing call in the error handling path and remove it from p54spi_request_firmware() now that it is the responsibility of the caller to release the firmware Fixes: cd8d3d321285 ("p54spi: p54spi driver") Signed-off-by: Christophe JAILLET Acked-by: Christian Lamparter Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/297d2547ff2ee627731662abceeab9dbdaf23231.16= 55068321.git.christophe.jaillet@wanadoo.fr Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/wireless/intersil/p54/p54spi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intersil/p54/p54spi.c b/drivers/net/wirel= ess/intersil/p54/p54spi.c index e41bf042352e..3dcfad5b61ff 100644 --- a/drivers/net/wireless/intersil/p54/p54spi.c +++ b/drivers/net/wireless/intersil/p54/p54spi.c @@ -177,7 +177,7 @@ static int p54spi_request_firmware(struct ieee80211_hw = *dev) =20 ret =3D p54_parse_firmware(dev, priv->firmware); if (ret) { - release_firmware(priv->firmware); + /* the firmware is released by the caller */ return ret; } =20 @@ -672,6 +672,7 @@ static int p54spi_probe(struct spi_device *spi) return 0; =20 err_free_common: + release_firmware(priv->firmware); free_irq(gpio_to_irq(p54spi_gpio_irq), spi); err_free_gpio_irq: gpio_free(p54spi_gpio_irq); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7FBCC32774 for ; Tue, 23 Aug 2022 09:42:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237065AbiHWJmq (ORCPT ); Tue, 23 Aug 2022 05:42:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52592 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351777AbiHWJk1 (ORCPT ); Tue, 23 Aug 2022 05:40:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 84E8778BFB; Tue, 23 Aug 2022 01:41:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EC25E61545; Tue, 23 Aug 2022 08:40:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0055CC433D6; Tue, 23 Aug 2022 08:40:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244047; bh=aqtmc+GVlURHEGXqXvyfAmByh5SXHExesIF6rdrC7b4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UNFc++1RjHwleYzhDUVN45f9PydspRayrJEqHzEATKiDRk+lXD4Aw2rgeRQIddO1i 7uQc1js3CiFUJW8j8N9uAztbidp4sA1wfexD+kavKIdkkY3FissQrYovg4FhdE60rS 8fdlwhhRB6Xcrq9iLePuruti/Jyk4qASP+teUE2s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rustam Subkhankulov , Christian Lamparter , Kalle Valo , Sasha Levin Subject: [PATCH 4.14 078/229] wifi: p54: add missing parentheses in p54_flush() Date: Tue, 23 Aug 2022 10:23:59 +0200 Message-Id: <20220823080056.504148486@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rustam Subkhankulov [ Upstream commit bcfd9d7f6840b06d5988c7141127795cf405805e ] The assignment of the value to the variable total in the loop condition must be enclosed in additional parentheses, since otherwise, in accordance with the precedence of the operators, the conjunction will be performed first, and only then the assignment. Due to this error, a warning later in the function after the loop may not occur in the situation when it should. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Rustam Subkhankulov Fixes: 0d4171e2153b ("p54: implement flush callback") Acked-by: Christian Lamparter Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220714134831.106004-1-subkhankulov@ispras= .ru Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/wireless/intersil/p54/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireles= s/intersil/p54/main.c index ab6d39e12069..120c3f21f382 100644 --- a/drivers/net/wireless/intersil/p54/main.c +++ b/drivers/net/wireless/intersil/p54/main.c @@ -688,7 +688,7 @@ static void p54_flush(struct ieee80211_hw *dev, struct = ieee80211_vif *vif, * queues have already been stopped and no new frames can sneak * up from behind. */ - while ((total =3D p54_flush_count(priv) && i--)) { + while ((total =3D p54_flush_count(priv)) && i--) { /* waste time */ msleep(20); } --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B52FC32772 for ; Tue, 23 Aug 2022 09:43:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237397AbiHWJnc (ORCPT ); Tue, 23 Aug 2022 05:43:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41146 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352010AbiHWJks (ORCPT ); Tue, 23 Aug 2022 05:40:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B49BE7961A; Tue, 23 Aug 2022 01:41:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 65F0EB81C5C; Tue, 23 Aug 2022 08:40:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B5700C433D6; Tue, 23 Aug 2022 08:40:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244053; bh=DWD3GZq6j5zEbQtORBVne/OcWKHdw1NZa8O3C6p2FYQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z67WTOw1lM1FhrsKn4/dicyMlgPWi9yQQqGXkwGZodtQrE8MC9CPNtVbkkaGg3vYx gxf8XuS/ZluEi+XCJ6hlW1mXGrLs5FfWgWI5Hu6Pxe09rDet+Qbt3Yu03bn0m902DY pHmzgSvrSU7i7u9s0yxHcvKUzPwcw3jEV9NOFSD0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vincent Mailhol , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.14 079/229] can: pch_can: do not report txerr and rxerr during bus-off Date: Tue, 23 Aug 2022 10:24:00 +0200 Message-Id: <20220823080056.547384526@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vincent Mailhol [ Upstream commit 3a5c7e4611ddcf0ef37a3a17296b964d986161a6 ] During bus off, the error count is greater than 255 and can not fit in a u8. Fixes: 0c78ab76a05c ("pch_can: Add setting TEC/REC statistics processing") Link: https://lore.kernel.org/all/20220719143550.3681-2-mailhol.vincent@wan= adoo.fr Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/pch_can.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c index ced11ea89269..3e1d71c70b0d 100644 --- a/drivers/net/can/pch_can.c +++ b/drivers/net/can/pch_can.c @@ -507,6 +507,9 @@ static void pch_can_error(struct net_device *ndev, u32 = status) cf->can_id |=3D CAN_ERR_BUSOFF; priv->can.can_stats.bus_off++; can_bus_off(ndev); + } else { + cf->data[6] =3D errc & PCH_TEC; + cf->data[7] =3D (errc & PCH_REC) >> 8; } =20 errc =3D ioread32(&priv->regs->errc); @@ -567,9 +570,6 @@ static void pch_can_error(struct net_device *ndev, u32 = status) break; } =20 - cf->data[6] =3D errc & PCH_TEC; - cf->data[7] =3D (errc & PCH_REC) >> 8; - priv->can.state =3D state; netif_receive_skb(skb); =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8FEB3C32772 for ; Tue, 23 Aug 2022 09:46:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346705AbiHWJpW (ORCPT ); Tue, 23 Aug 2022 05:45:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39874 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351943AbiHWJkm (ORCPT ); Tue, 23 Aug 2022 05:40:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2FC187960E; Tue, 23 Aug 2022 01:41:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 71C4BB81C3E; Tue, 23 Aug 2022 08:41:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C917BC433C1; Tue, 23 Aug 2022 08:40:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244059; bh=DPuyn0vXH02KiwaX6fibOkAwgcLn6wDShe4JqCjHAHg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KU3cAjPhLcF88hRRiAgE2Q7FBDie9qxf5I3I4SW33LA5d7bcOg8P+YZkQejrOHxJJ qYAWexziG19ZTcx3/eteaNbYC8B7ZkAyARbr0ddsPUWDGEy+FrlMX84/VOgWdsRxjl HlZksYaB3YD/HDtqzn8f8ph5VUAdPFYL022IZX1s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vincent Mailhol , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.14 080/229] can: rcar_can: do not report txerr and rxerr during bus-off Date: Tue, 23 Aug 2022 10:24:01 +0200 Message-Id: <20220823080056.577409346@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vincent Mailhol [ Upstream commit a37b7245e831a641df360ca41db6a71c023d3746 ] During bus off, the error count is greater than 255 and can not fit in a u8. Fixes: fd1159318e55 ("can: add Renesas R-Car CAN driver") Link: https://lore.kernel.org/all/20220719143550.3681-3-mailhol.vincent@wan= adoo.fr Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/rcar/rcar_can.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_ca= n.c index 963da8eda168..0156c18d5a2d 100644 --- a/drivers/net/can/rcar/rcar_can.c +++ b/drivers/net/can/rcar/rcar_can.c @@ -233,11 +233,8 @@ static void rcar_can_error(struct net_device *ndev) if (eifr & (RCAR_CAN_EIFR_EWIF | RCAR_CAN_EIFR_EPIF)) { txerr =3D readb(&priv->regs->tecr); rxerr =3D readb(&priv->regs->recr); - if (skb) { + if (skb) cf->can_id |=3D CAN_ERR_CRTL; - cf->data[6] =3D txerr; - cf->data[7] =3D rxerr; - } } if (eifr & RCAR_CAN_EIFR_BEIF) { int rx_errors =3D 0, tx_errors =3D 0; @@ -337,6 +334,9 @@ static void rcar_can_error(struct net_device *ndev) can_bus_off(ndev); if (skb) cf->can_id |=3D CAN_ERR_BUSOFF; + } else if (skb) { + cf->data[6] =3D txerr; + cf->data[7] =3D rxerr; } if (eifr & RCAR_CAN_EIFR_ORIF) { netdev_dbg(priv->ndev, "Receive overrun error interrupt\n"); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7002C32772 for ; Tue, 23 Aug 2022 09:43:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232043AbiHWJnQ (ORCPT ); Tue, 23 Aug 2022 05:43:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52264 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351922AbiHWJkl (ORCPT ); Tue, 23 Aug 2022 05:40:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EAF1479A48; Tue, 23 Aug 2022 01:41:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BEE60B81C66; Tue, 23 Aug 2022 08:41:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17C65C433D6; Tue, 23 Aug 2022 08:41:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244068; bh=k6l0jTys9X4jNwGOb/WlS1JIPlY5G2K38bc4mbzN3tQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=C59lMywTMRk5BYqFRUy/SxZOBojurhVJeTj8pwlBUIHCpMNDP5+JXiBSn59pssYM/ RKhXPWej4wJNUyfTkMeswJQiojiOBpXZ1PGyXhgIcq3yJlMOEN3x2JRMITiglZl5Re TTbedqXAv0PdEQ0qaC9AO2c9GVcMuQ7C0/3ZK9uY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vincent Mailhol , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.14 081/229] can: sja1000: do not report txerr and rxerr during bus-off Date: Tue, 23 Aug 2022 10:24:02 +0200 Message-Id: <20220823080056.613928207@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vincent Mailhol [ Upstream commit 164d7cb2d5a30f1b3a5ab4fab1a27731fb1494a8 ] During bus off, the error count is greater than 255 and can not fit in a u8. Fixes: 215db1856e83 ("can: sja1000: Consolidate and unify state change hand= ling") Link: https://lore.kernel.org/all/20220719143550.3681-4-mailhol.vincent@wan= adoo.fr Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/sja1000/sja1000.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sj= a1000.c index 9f107798f904..e7327ceabb76 100644 --- a/drivers/net/can/sja1000/sja1000.c +++ b/drivers/net/can/sja1000/sja1000.c @@ -405,9 +405,6 @@ static int sja1000_err(struct net_device *dev, uint8_t = isrc, uint8_t status) txerr =3D priv->read_reg(priv, SJA1000_TXERR); rxerr =3D priv->read_reg(priv, SJA1000_RXERR); =20 - cf->data[6] =3D txerr; - cf->data[7] =3D rxerr; - if (isrc & IRQ_DOI) { /* data overrun interrupt */ netdev_dbg(dev, "data overrun interrupt\n"); @@ -429,6 +426,10 @@ static int sja1000_err(struct net_device *dev, uint8_t= isrc, uint8_t status) else state =3D CAN_STATE_ERROR_ACTIVE; } + if (state !=3D CAN_STATE_BUS_OFF) { + cf->data[6] =3D txerr; + cf->data[7] =3D rxerr; + } if (isrc & IRQ_BEI) { /* bus error interrupt */ priv->can.can_stats.bus_error++; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42324C32772 for ; Tue, 23 Aug 2022 09:44:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242887AbiHWJoX (ORCPT ); Tue, 23 Aug 2022 05:44:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40222 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352234AbiHWJlG (ORCPT ); Tue, 23 Aug 2022 05:41:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E01A379634; Tue, 23 Aug 2022 01:41:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EF33061538; Tue, 23 Aug 2022 08:41:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 037D7C433C1; Tue, 23 Aug 2022 08:41:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244074; bh=XZPsukZTb+hTMSm+/vEq+mEJkXlwXdR0DPErYIV/FtM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NrM3y7AqoNmqtXnElp4NLwNMMBtEH+Kow3n73sTFVdeAn77/ODI/5VzFI263ApZMJ MAkHdct+y440zcK6VuNoca0olCBVHptF7ZQHjuiDPKzuy2lzZRBhSedeTJmIjZgWUO +EqCFaLWyhtrmaGeqE55jeQ2OnE106MnwNQ+A67c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vincent Mailhol , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.14 082/229] can: hi311x: do not report txerr and rxerr during bus-off Date: Tue, 23 Aug 2022 10:24:03 +0200 Message-Id: <20220823080056.666348242@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vincent Mailhol [ Upstream commit a22bd630cfff496b270211745536e50e98eb3a45 ] During bus off, the error count is greater than 255 and can not fit in a u8. Fixes: 57e83fb9b746 ("can: hi311x: Add Holt HI-311x CAN driver") Link: https://lore.kernel.org/all/20220719143550.3681-6-mailhol.vincent@wan= adoo.fr Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/spi/hi311x.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c index 472175e37055..5f730f791c27 100644 --- a/drivers/net/can/spi/hi311x.c +++ b/drivers/net/can/spi/hi311x.c @@ -688,8 +688,6 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) =20 txerr =3D hi3110_read(spi, HI3110_READ_TEC); rxerr =3D hi3110_read(spi, HI3110_READ_REC); - cf->data[6] =3D txerr; - cf->data[7] =3D rxerr; tx_state =3D txerr >=3D rxerr ? new_state : 0; rx_state =3D txerr <=3D rxerr ? new_state : 0; can_change_state(net, cf, tx_state, rx_state); @@ -702,6 +700,9 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) hi3110_hw_sleep(spi); break; } + } else { + cf->data[6] =3D txerr; + cf->data[7] =3D rxerr; } } =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B995AC32772 for ; Tue, 23 Aug 2022 09:44:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242569AbiHWJo0 (ORCPT ); Tue, 23 Aug 2022 05:44:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41990 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352263AbiHWJlI (ORCPT ); Tue, 23 Aug 2022 05:41:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 18D2B98D3D; Tue, 23 Aug 2022 01:42:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 23F71B81C62; Tue, 23 Aug 2022 08:41:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 700BFC433D6; Tue, 23 Aug 2022 08:41:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244080; bh=iYhJD2UgRJR95NPqJWe+oX3OQWhXxLif3i/DPaAugS0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=P7k0Fjq/90i8A4Yw5xGHl+Yy0HymfByh0zT6hybYIP0BxgobgtimJ6OREgZ+cD/uJ hTnY7eMIOpjP8c9S51ktTfejQjcRECe4xgJkFHgWG/TPsVLyma3jQP0wwnUREistbv 8yquOLRv3dmDY+t1ps2fNhjgCfx9iq4iYZiARydw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chen-Yu Tsai , Vincent Mailhol , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.14 083/229] can: sun4i_can: do not report txerr and rxerr during bus-off Date: Tue, 23 Aug 2022 10:24:04 +0200 Message-Id: <20220823080056.698887887@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vincent Mailhol [ Upstream commit 0ac15a8f661b941519379831d09bfb12271b23ee ] During bus off, the error count is greater than 255 and can not fit in a u8. Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kerne= l module") Link: https://lore.kernel.org/all/20220719143550.3681-7-mailhol.vincent@wan= adoo.fr CC: Chen-Yu Tsai Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/sun4i_can.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c index 1ac2090a1721..fea82be623b3 100644 --- a/drivers/net/can/sun4i_can.c +++ b/drivers/net/can/sun4i_can.c @@ -525,11 +525,6 @@ static int sun4i_can_err(struct net_device *dev, u8 is= rc, u8 status) rxerr =3D (errc >> 16) & 0xFF; txerr =3D errc & 0xFF; =20 - if (skb) { - cf->data[6] =3D txerr; - cf->data[7] =3D rxerr; - } - if (isrc & SUN4I_INT_DATA_OR) { /* data overrun interrupt */ netdev_dbg(dev, "data overrun interrupt\n"); @@ -560,6 +555,10 @@ static int sun4i_can_err(struct net_device *dev, u8 is= rc, u8 status) else state =3D CAN_STATE_ERROR_ACTIVE; } + if (skb && state !=3D CAN_STATE_BUS_OFF) { + cf->data[6] =3D txerr; + cf->data[7] =3D rxerr; + } if (isrc & SUN4I_INT_BUS_ERR) { /* bus error interrupt */ netdev_dbg(dev, "bus error interrupt\n"); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BBEBDC32792 for ; Tue, 23 Aug 2022 09:43:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240330AbiHWJn5 (ORCPT ); Tue, 23 Aug 2022 05:43:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53338 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352084AbiHWJkz (ORCPT ); Tue, 23 Aug 2022 05:40:55 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 081F545041; Tue, 23 Aug 2022 01:41:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 75F99B81C69; Tue, 23 Aug 2022 08:41:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9B5FC433C1; Tue, 23 Aug 2022 08:41:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244087; bh=6o7dFMo7ClTdnFjrVOtoQR+dS9HFFHcI3I/lUGs2dLs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=17fsAOGYS3LkFdWTsVaFOCRC+uwAp9DAL9B2UDD6rg19XE1ZMK8EC21dotMlXqKMe K2/sXgVkv26rWp87er0NNmOxP6ELg338TNTAZAeaWenyZgkWauDkaP7j1IDX02RNOk 3ooP05QRGGimmFhbo/WhB4EVv/ByLj3081ihjOck= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vincent Mailhol , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.14 084/229] can: usb_8dev: do not report txerr and rxerr during bus-off Date: Tue, 23 Aug 2022 10:24:05 +0200 Message-Id: <20220823080056.731785849@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vincent Mailhol [ Upstream commit aebe8a2433cd090ccdc222861f44bddb75eb01de ] During bus off, the error count is greater than 255 and can not fit in a u8. Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from= 8 devices") Link: https://lore.kernel.org/all/20220719143550.3681-10-mailhol.vincent@wa= nadoo.fr Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/usb/usb_8dev.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c index 232f45f722f0..5cb5be4dc941 100644 --- a/drivers/net/can/usb/usb_8dev.c +++ b/drivers/net/can/usb/usb_8dev.c @@ -453,9 +453,10 @@ static void usb_8dev_rx_err_msg(struct usb_8dev_priv *= priv, =20 if (rx_errors) stats->rx_errors++; - - cf->data[6] =3D txerr; - cf->data[7] =3D rxerr; + if (priv->can.state !=3D CAN_STATE_BUS_OFF) { + cf->data[6] =3D txerr; + cf->data[7] =3D rxerr; + } =20 priv->bec.txerr =3D txerr; priv->bec.rxerr =3D rxerr; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AF63C32772 for ; Tue, 23 Aug 2022 09:44:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242306AbiHWJoK (ORCPT ); Tue, 23 Aug 2022 05:44:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41624 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352165AbiHWJk7 (ORCPT ); Tue, 23 Aug 2022 05:40:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 605DA79A57; Tue, 23 Aug 2022 01:41:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 72EFDB81C6B; Tue, 23 Aug 2022 08:41:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C22A9C433D7; Tue, 23 Aug 2022 08:41:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244093; bh=xmnsuXtUw8sGw9bxdWq+/4tnHuPDrOAAJeRf/dZAQZ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=co78bTfTD5idZAGbZogxZsT2A2gUKo7D/8iM6xWOQZLLGeD5ni5I9CPWi5jN2u0Sn ppAB8IrTUIV9TLRnN/SjcU9cove7oLKo4U874mTCN1zJe1BisWOHo82vfK+vH6cjcb 9fyAGlTwBVlx2vLJOSuaXMPBbmpq6SA64R/ZPvwQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vincent Mailhol , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.14 085/229] can: error: specify the values of data[5..7] of CAN error frames Date: Tue, 23 Aug 2022 10:24:06 +0200 Message-Id: <20220823080056.762652145@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vincent Mailhol [ Upstream commit e70a3263a7eed768d5f947b8f2aff8d2a79c9d97 ] Currently, data[5..7] of struct can_frame, when used as a CAN error frame, are defined as being "controller specific". Device specific behaviours are problematic because it prevents someone from writing code which is portable between devices. As a matter of fact, data[5] is never used, data[6] is always used to report TX error counter and data[7] is always used to report RX error counter. can-utils also relies on this. This patch updates the comment in the uapi header to specify that data[5] is reserved (and thus should not be used) and that data[6..7] are used for error counters. Fixes: 0d66548a10cb ("[CAN]: Add PF_CAN core module") Link: https://lore.kernel.org/all/20220719143550.3681-11-mailhol.vincent@wa= nadoo.fr Signed-off-by: Vincent Mailhol Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/uapi/linux/can/error.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/can/error.h b/include/uapi/linux/can/error.h index bfc4b5d22a5e..383f3d508a53 100644 --- a/include/uapi/linux/can/error.h +++ b/include/uapi/linux/can/error.h @@ -120,6 +120,9 @@ #define CAN_ERR_TRX_CANL_SHORT_TO_GND 0x70 /* 0111 0000 */ #define CAN_ERR_TRX_CANL_SHORT_TO_CANH 0x80 /* 1000 0000 */ =20 -/* controller specific additional information / data[5..7] */ +/* data[5] is reserved (do not use) */ + +/* TX error counter / data[6] */ +/* RX error counter / data[7] */ =20 #endif /* _UAPI_CAN_ERROR_H */ --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71BB4C32772 for ; Tue, 23 Aug 2022 09:43:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237416AbiHWJnh (ORCPT ); Tue, 23 Aug 2022 05:43:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34852 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352039AbiHWJkw (ORCPT ); Tue, 23 Aug 2022 05:40:52 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EB68379609; Tue, 23 Aug 2022 01:41:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0627AB81C6D; Tue, 23 Aug 2022 08:41:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 67B70C433C1; Tue, 23 Aug 2022 08:41:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244101; bh=64nKZ5znMBqSE8mOqK0YmZCrB6CaXZ+9XWMHssYQUJs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nShx6J9iYMSPdEO7SocxFXpYNDtyTny3BmK32K4LkUIpLpfuVLnK7vi/hP/cM8PZu RQP1+ZN6ebLlSWJkvEGlo1lufdivCgmzBcyGwT8u58PTjlTj5BHNhj1eLf7+kJcB+o hna/kLasZXNemwp0QddAFMMnJy2VvBs8MNTWtFGI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor , Vincent Mailhol , Marc Kleine-Budde , Sasha Levin Subject: [PATCH 4.14 086/229] can: pch_can: pch_can_error(): initialize errc before using it Date: Tue, 23 Aug 2022 10:24:07 +0200 Message-Id: <20220823080056.793489859@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vincent Mailhol [ Upstream commit 9950f11211331180269867aef848c7cf56861742 ] After commit 3a5c7e4611dd, the variable errc is accessed before being initialized, c.f. below W=3D2 warning: | In function 'pch_can_error', | inlined from 'pch_can_poll' at drivers/net/can/pch_can.c:739:4: | drivers/net/can/pch_can.c:501:29: warning: 'errc' may be used uninitializ= ed [-Wmaybe-uninitialized] | 501 | cf->data[6] =3D errc & PCH_TEC; | | ^ | drivers/net/can/pch_can.c: In function 'pch_can_poll': | drivers/net/can/pch_can.c:484:13: note: 'errc' was declared here | 484 | u32 errc, lec; | | ^~~~ Moving errc initialization up solves this issue. Fixes: 3a5c7e4611dd ("can: pch_can: do not report txerr and rxerr during bu= s-off") Reported-by: Nathan Chancellor Signed-off-by: Vincent Mailhol Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/all/20220721160032.9348-1-mailhol.vincent@wan= adoo.fr Signed-off-by: Marc Kleine-Budde Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/pch_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c index 3e1d71c70b0d..25def028a1dc 100644 --- a/drivers/net/can/pch_can.c +++ b/drivers/net/can/pch_can.c @@ -500,6 +500,7 @@ static void pch_can_error(struct net_device *ndev, u32 = status) if (!skb) return; =20 + errc =3D ioread32(&priv->regs->errc); if (status & PCH_BUS_OFF) { pch_can_set_tx_all(priv, 0); pch_can_set_rx_all(priv, 0); @@ -512,7 +513,6 @@ static void pch_can_error(struct net_device *ndev, u32 = status) cf->data[7] =3D (errc & PCH_REC) >> 8; } =20 - errc =3D ioread32(&priv->regs->errc); /* Warning interrupt. */ if (status & PCH_EWARN) { state =3D CAN_STATE_ERROR_WARNING; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 810A6C32772 for ; Tue, 23 Aug 2022 09:44:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241984AbiHWJoE (ORCPT ); Tue, 23 Aug 2022 05:44:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58900 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352120AbiHWJk4 (ORCPT ); Tue, 23 Aug 2022 05:40:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 214327A50E; Tue, 23 Aug 2022 01:41:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D713761257; Tue, 23 Aug 2022 08:41:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BCBB0C433C1; Tue, 23 Aug 2022 08:41:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244108; bh=i6FXr4E8XnfuMt9Ll0SUB8OusLyDbQ0jV4V7ZXzwMAI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qsJjY1fjncRyJXOgFCWKU762V10KhkpguGxo/6vMJLo7m3ENUWoTkS/y3CJ7j6odr tq7MspQvSYhaThC99z5ZyZJpdVjZEpCAz/tyYneCy0dpRvyv2e27ZcEXOlH1XTg/2k SVJXKhy0mVxQrENYNrylSX9riHnZK5ohzvFne/d0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Marcel Holtmann , Sasha Levin Subject: [PATCH 4.14 087/229] Bluetooth: hci_intel: Add check for platform_driver_register Date: Tue, 23 Aug 2022 10:24:08 +0200 Message-Id: <20220823080056.829750151@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit ab2d2a982ff721f4b029282d9a40602ea46a745e ] As platform_driver_register() could fail, it should be better to deal with the return value in order to maintain the code consisitency. Fixes: 1ab1f239bf17 ("Bluetooth: hci_intel: Add support for platform driver= ") Signed-off-by: Jiasheng Jiang Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/bluetooth/hci_intel.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c index c75311d4dd31..cbe4a2159d43 100644 --- a/drivers/bluetooth/hci_intel.c +++ b/drivers/bluetooth/hci_intel.c @@ -1303,7 +1303,11 @@ static struct platform_driver intel_driver =3D { =20 int __init intel_init(void) { - platform_driver_register(&intel_driver); + int err; + + err =3D platform_driver_register(&intel_driver); + if (err) + return err; =20 return hci_uart_register_proto(&intel_proto); } --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A890CC32772 for ; Tue, 23 Aug 2022 09:44:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243490AbiHWJod (ORCPT ); Tue, 23 Aug 2022 05:44:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41968 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352257AbiHWJlH (ORCPT ); Tue, 23 Aug 2022 05:41:07 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 38A1425E8A; Tue, 23 Aug 2022 01:41:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E39DF6123D; Tue, 23 Aug 2022 08:41:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EBEC8C433D7; Tue, 23 Aug 2022 08:41:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244115; bh=go/Haau0lthCUe3VavTCa+hFobbLbcMtiNUfAjzIzeU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EkUxs97cMFc4wpB+QhT175NcEK5CI/o9bBFLchTTue1itYioFaCMQotQY6h+Ehbo8 zmbPLGs4JWN0MbzOcDrtD8u89A38JyGK3CM25e7M3LtCpyTOIB0+8+wu/Uk5nL1j/1 OK2lq4g0tealsMrPKb4/egXP8KuCdVXlpokEovTQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars-Peter Clausen , Shubhrajyoti Datta , Wolfram Sang , Sasha Levin Subject: [PATCH 4.14 088/229] i2c: cadence: Support PEC for SMBus block read Date: Tue, 23 Aug 2022 10:24:09 +0200 Message-Id: <20220823080056.860765245@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lars-Peter Clausen [ Upstream commit 9fdf6d97f03035ad5298e2d1635036c74c2090ed ] SMBus packet error checking (PEC) is implemented by appending one additional byte of checksum data at the end of the message. This provides additional protection and allows to detect data corruption on the I2C bus. SMBus block reads support variable length reads. The first byte in the read message is the number of available data bytes. The combination of PEC and block read is currently not supported by the Cadence I2C driver. * When PEC is enabled the maximum transfer length for block reads increases from 33 to 34 bytes. * The I2C core smbus emulation layer relies on the driver updating the `i2c_msg` `len` field with the number of received bytes. The updated length is used when checking the PEC. Add support to the Cadence I2C driver for handling SMBus block reads with PEC. To determine the maximum transfer length uses the initial `len` value of the `i2c_msg`. When PEC is enabled this will be 2, when it is disabled it will be 1. Once a read transfer is done also increment the `len` field by the amount of received data bytes. This change has been tested with a UCM90320 PMBus power monitor, which requires block reads to access certain data fields, but also has PEC enabled by default. Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller") Signed-off-by: Lars-Peter Clausen Tested-by: Shubhrajyoti Datta Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/i2c/busses/i2c-cadence.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cade= nce.c index 512c61d31fe5..bce7bf93d62a 100644 --- a/drivers/i2c/busses/i2c-cadence.c +++ b/drivers/i2c/busses/i2c-cadence.c @@ -353,8 +353,13 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id) ctrl_reg =3D cdns_i2c_readreg(CDNS_I2C_CR_OFFSET); ctrl_reg |=3D CDNS_I2C_CR_RW | CDNS_I2C_CR_CLR_FIFO; =20 + /* + * Receive up to I2C_SMBUS_BLOCK_MAX data bytes, plus one message length + * byte, plus one checksum byte if PEC is enabled. p_msg->len will be 2 if + * PEC is enabled, otherwise 1. + */ if (id->p_msg->flags & I2C_M_RECV_LEN) - id->recv_count =3D I2C_SMBUS_BLOCK_MAX + 1; + id->recv_count =3D I2C_SMBUS_BLOCK_MAX + id->p_msg->len; =20 id->curr_recv_count =3D id->recv_count; =20 @@ -540,6 +545,9 @@ static int cdns_i2c_process_msg(struct cdns_i2c *id, st= ruct i2c_msg *msg, if (id->err_status & CDNS_I2C_IXR_ARB_LOST) return -EAGAIN; =20 + if (msg->flags & I2C_M_RECV_LEN) + msg->len +=3D min_t(unsigned int, msg->buf[0], I2C_SMBUS_BLOCK_MAX); + return 0; } =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1CE2C32772 for ; Tue, 23 Aug 2022 09:44:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244044AbiHWJor (ORCPT ); Tue, 23 Aug 2022 05:44:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352327AbiHWJlO (ORCPT ); Tue, 23 Aug 2022 05:41:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CE4917A760; Tue, 23 Aug 2022 01:42:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BE4C8B81C4F; Tue, 23 Aug 2022 08:42:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2AA9EC433D6; Tue, 23 Aug 2022 08:42:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244121; bh=n+2iOGiB+qch6T//Hq81dKR36CGWfTGsY3B/xUddBgY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ig+Z7bXSqc/w2f6asXBTYIeonnzw60P3qdYRP8tYmlKU2GfgFLUOuf9ft5bc2dSTR UWUwFmX3EU387236JTnfw2rYwW2Y4Ou3S5q0o5QBp+tvsx6/mN1c6oRxsm+dQ0wu8B J4MbLrAmLkP74PRxJOBgo4YTFgvYNp1wDH7QYtk0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Peter Rosin , Wolfram Sang , Sasha Levin Subject: [PATCH 4.14 089/229] i2c: mux-gpmux: Add of_node_put() when breaking out of loop Date: Tue, 23 Aug 2022 10:24:10 +0200 Message-Id: <20220823080056.892342856@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 6435319c34704994e19b0767f6a4e6f37439867b ] In i2c_mux_probe(), we should call of_node_put() when breaking out of for_each_child_of_node() which will automatically increase and decrease the refcount. Fixes: ac8498f0ce53 ("i2c: i2c-mux-gpmux: new driver") Signed-off-by: Liang He Acked-by: Peter Rosin Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/i2c/muxes/i2c-mux-gpmux.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/i2c/muxes/i2c-mux-gpmux.c b/drivers/i2c/muxes/i2c-mux-= gpmux.c index 92cf5f48afe6..5053f1675a29 100644 --- a/drivers/i2c/muxes/i2c-mux-gpmux.c +++ b/drivers/i2c/muxes/i2c-mux-gpmux.c @@ -141,6 +141,7 @@ static int i2c_mux_probe(struct platform_device *pdev) return 0; =20 err_children: + of_node_put(child); i2c_mux_del_adapters(muxc); err_parent: i2c_put_adapter(parent); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1EFE5C32792 for ; Tue, 23 Aug 2022 09:45:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242153AbiHWJpJ (ORCPT ); Tue, 23 Aug 2022 05:45:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42044 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352510AbiHWJl3 (ORCPT ); Tue, 23 Aug 2022 05:41:29 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 296217A776; Tue, 23 Aug 2022 01:42:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EF052B81C5A; Tue, 23 Aug 2022 08:42:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 347F0C433D6; Tue, 23 Aug 2022 08:42:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244127; bh=0wtt/finx1+7hAbJi3lID1sNUwsIJoWXJGmn7vUrD3I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=s6zu0v84CE/Z/Vn8u3dkkeeR2RV6yoOGl8SiGr3bD+XL0DLqkyt0DwEppS04DSS8a Fpf7BCCtcFp5ET0ka0dfe2kChoqv19YLyZa8hYf5JE5pnnUx/kMCUkByjzUMme9PYz rgfE34YjFzIzdYhbG3ONX82BI0i+owAw03X3gz1A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , kernel test robot , Ammar Faizi , Kalle Valo , Sasha Levin Subject: [PATCH 4.14 090/229] wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()` Date: Tue, 23 Aug 2022 10:24:11 +0200 Message-Id: <20220823080056.923998996@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ammar Faizi [ Upstream commit d578e0af3a003736f6c440188b156483d451b329 ] Commit 7a4836560a61 changes simple_write_to_buffer() with memdup_user() but it forgets to change the value to be returned that came from simple_write_to_buffer() call. It results in the following warning: warning: variable 'rc' is uninitialized when used here [-Wuninitialized] return rc; ^~ Remove rc variable and just return the passed in length if the memdup_user() succeeds. Cc: Dan Carpenter Reported-by: kernel test robot Fixes: 7a4836560a6198d245d5732e26f94898b12eb760 ("wifi: wil6210: debugfs: f= ix info leak in wil_write_file_wmi()") Fixes: ff974e4083341383d3dd4079e52ed30f57f376f0 ("wil6210: debugfs interfac= e to send raw WMI command") Signed-off-by: Ammar Faizi Reviewed-by: Dan Carpenter Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220724202452.61846-1-ammar.faizi@intel.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/wireless/ath/wil6210/debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wirel= ess/ath/wil6210/debugfs.c index 2da52145cb60..12aec63d8c06 100644 --- a/drivers/net/wireless/ath/wil6210/debugfs.c +++ b/drivers/net/wireless/ath/wil6210/debugfs.c @@ -834,7 +834,7 @@ static ssize_t wil_write_file_wmi(struct file *file, co= nst char __user *buf, void *cmd; int cmdlen =3D len - sizeof(struct wmi_cmd_hdr); u16 cmdid; - int rc, rc1; + int rc1; =20 if (cmdlen < 0 || *ppos !=3D 0) return -EINVAL; @@ -851,7 +851,7 @@ static ssize_t wil_write_file_wmi(struct file *file, co= nst char __user *buf, =20 wil_info(wil, "0x%04x[%d] -> %d\n", cmdid, cmdlen, rc1); =20 - return rc; + return len; } =20 static const struct file_operations fops_wmi =3D { --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8CF42C32796 for ; Tue, 23 Aug 2022 09:47:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242031AbiHWJrI (ORCPT ); Tue, 23 Aug 2022 05:47:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42470 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352623AbiHWJlk (ORCPT ); Tue, 23 Aug 2022 05:41:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1BCBA7A52F; Tue, 23 Aug 2022 01:42:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 86FB8B81C20; Tue, 23 Aug 2022 08:42:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF509C433D6; Tue, 23 Aug 2022 08:42:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244137; bh=tczueR9QBrw1L/jEpqXkCntMM2hD+Z9tSAUmw/5z380=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sXmT0FnKtAtFel77Td0/pHjK1QCUPIm18rEFhL0/6DNYIWp+dfcrqxoHWnRrzMP2S 7JqwNg6HaQaN52W4q+7T9XVL8B7+Igxwl1T9DFD1nnfBXI+k5IBg1WK3qZ3U506fB1 lodt+JTTgSuWxKJuRU8+/zx00iB0N+mOwZQJ0Hns= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangyu Hua , Kalle Valo , Sasha Levin Subject: [PATCH 4.14 091/229] wifi: libertas: Fix possible refcount leak in if_usb_probe() Date: Tue, 23 Aug 2022 10:24:12 +0200 Message-Id: <20220823080056.960820374@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua [ Upstream commit 6fd57e1d120bf13d4dc6c200a7cf914e6347a316 ] usb_get_dev will be called before lbs_get_firmware_async which means that usb_put_dev need to be called when lbs_get_firmware_async fails. Fixes: ce84bb69f50e ("libertas USB: convert to asynchronous firmware loadin= g") Signed-off-by: Hangyu Hua Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220620092350.39960-1-hbh25y@gmail.com Link: https://lore.kernel.org/r/20220622113402.16969-1-colin.i.king@gmail.c= om Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/wireless/marvell/libertas/if_usb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/w= ireless/marvell/libertas/if_usb.c index bbfc89d9d65a..40a8003220bb 100644 --- a/drivers/net/wireless/marvell/libertas/if_usb.c +++ b/drivers/net/wireless/marvell/libertas/if_usb.c @@ -283,6 +283,7 @@ static int if_usb_probe(struct usb_interface *intf, return 0; =20 err_get_fw: + usb_put_dev(udev); lbs_remove_card(priv); err_add_card: if_usb_reset_device(cardp); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93A28C3F6B0 for ; Tue, 23 Aug 2022 09:47:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240446AbiHWJq7 (ORCPT ); Tue, 23 Aug 2022 05:46:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59274 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352581AbiHWJlf (ORCPT ); Tue, 23 Aug 2022 05:41:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5137B7A77C; Tue, 23 Aug 2022 01:42:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DE7FC61257; Tue, 23 Aug 2022 08:42:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DEF50C433B5; Tue, 23 Aug 2022 08:42:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244143; bh=CmsG51oJ8EzkSt1t67kltCCBkqFOsG2kjKAsW1x6eOU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sKts0qEuJLGyv7UIJL5tsTlQwpL5ZphB1hRqPF/a1pJb3W+T85iC63jyFUrrc9F7x GeNgB+/kyq3YYJpMaCCW4BZmUjqc19oi/idVOaEVqwxDYsfa0xIK3NKVD4oXiwFXeO r4SVtxKJo4FWfA4DPvJ+388DNaJvGmBFnG4lsucE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bernard Pidoux , Eric Dumazet , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.14 092/229] net: rose: fix netdev reference changes Date: Tue, 23 Aug 2022 10:24:13 +0200 Message-Id: <20220823080057.006498481@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 931027820e4dafabc78aff82af59f8c1c4bd3128 ] Bernard reported that trying to unload rose module would lead to infamous messages: unregistered_netdevice: waiting for rose0 to become free. Usage count =3D xx This patch solves the issue, by making sure each socket referring to a netdevice holds a reference count on it, and properly releases it in rose_release(). rose_dev_first() is also fixed to take a device reference before leaving the rcu_read_locked section. Following patch will add ref_tracker annotations to ease future bug hunting. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Bernard Pidoux Signed-off-by: Eric Dumazet Tested-by: Bernard Pidoux Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/rose/af_rose.c | 11 +++++++++-- net/rose/rose_route.c | 2 ++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c index 6a5c4992cf61..b53468edf35a 100644 --- a/net/rose/af_rose.c +++ b/net/rose/af_rose.c @@ -194,6 +194,7 @@ static void rose_kill_by_device(struct net_device *dev) rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0); if (rose->neighbour) rose->neighbour->use--; + dev_put(rose->device); rose->device =3D NULL; } } @@ -594,6 +595,8 @@ static struct sock *rose_make_new(struct sock *osk) rose->idle =3D orose->idle; rose->defer =3D orose->defer; rose->device =3D orose->device; + if (rose->device) + dev_hold(rose->device); rose->qbitincl =3D orose->qbitincl; =20 return sk; @@ -647,6 +650,7 @@ static int rose_release(struct socket *sock) break; } =20 + dev_put(rose->device); sock->sk =3D NULL; release_sock(sk); sock_put(sk); @@ -721,7 +725,6 @@ static int rose_connect(struct socket *sock, struct soc= kaddr *uaddr, int addr_le struct rose_sock *rose =3D rose_sk(sk); struct sockaddr_rose *addr =3D (struct sockaddr_rose *)uaddr; unsigned char cause, diagnostic; - struct net_device *dev; ax25_uid_assoc *user; int n, err =3D 0; =20 @@ -778,9 +781,12 @@ static int rose_connect(struct socket *sock, struct so= ckaddr *uaddr, int addr_le } =20 if (sock_flag(sk, SOCK_ZAPPED)) { /* Must bind first - autobinding in thi= s may or may not work */ + struct net_device *dev; + sock_reset_flag(sk, SOCK_ZAPPED); =20 - if ((dev =3D rose_dev_first()) =3D=3D NULL) { + dev =3D rose_dev_first(); + if (!dev) { err =3D -ENETUNREACH; goto out_release; } @@ -788,6 +794,7 @@ static int rose_connect(struct socket *sock, struct soc= kaddr *uaddr, int addr_le user =3D ax25_findbyuid(current_euid()); if (!user) { err =3D -EINVAL; + dev_put(dev); goto out_release; } =20 diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c index 1027f52a45ab..25c6d1fa22f3 100644 --- a/net/rose/rose_route.c +++ b/net/rose/rose_route.c @@ -614,6 +614,8 @@ struct net_device *rose_dev_first(void) if (first =3D=3D NULL || strncmp(dev->name, first->name, 3) < 0) first =3D dev; } + if (first) + dev_hold(first); rcu_read_unlock(); =20 return first; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 339ABC32772 for ; Tue, 23 Aug 2022 09:48:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243614AbiHWJr5 (ORCPT ); Tue, 23 Aug 2022 05:47:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42330 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351930AbiHWJpm (ORCPT ); Tue, 23 Aug 2022 05:45:42 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CB3C32AE03; Tue, 23 Aug 2022 01:43:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 102CD61538; Tue, 23 Aug 2022 08:42:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09457C433C1; Tue, 23 Aug 2022 08:42:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244149; bh=6bjpeb1yXqMnkg9+2/fYr7o7Pa+WhVmDu5sIiWvdvEw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HHxHIztraFrj8Ir6NBhJq4+GkpWrEZ/89Nxa1ZUVsdP0G1lwfDPUzMp1Lt7JeD+zY htX/J0qwEcdywRvwLoiZI6w/zDmiwQiEQ2drQm4kZj3khbVS33AYsKIjc2QZxPL4Bu cfNtWFWd94L5JJ/eCq9pCzluhVWgGl4tZtHwOPQY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangyu Hua , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.14 093/229] dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock Date: Tue, 23 Aug 2022 10:24:14 +0200 Message-Id: <20220823080057.037313606@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua [ Upstream commit a41b17ff9dacd22f5f118ee53d82da0f3e52d5e3 ] In the case of sk->dccps_qpolicy =3D=3D DCCPQ_POLICY_PRIO, dccp_qpolicy_full will drop a skb when qpolicy is full. And the lock in dccp_sendmsg is released before sock_alloc_send_skb and then relocked after sock_alloc_send_skb. The following conditions may lead dccp_qpolicy_push to add skb to an already full sk_write_queue: thread1--->lock thread1--->dccp_qpolicy_full: queue is full. drop a skb thread1--->unlock thread2--->lock thread2--->dccp_qpolicy_full: queue is not full. no need to drop. thread2--->unlock thread1--->lock thread1--->dccp_qpolicy_push: add a skb. queue is full. thread1--->unlock thread2--->lock thread2--->dccp_qpolicy_push: add a skb! thread2--->unlock Fix this by moving dccp_qpolicy_full. Fixes: b1308dc015eb ("[DCCP]: Set TX Queue Length Bounds via Sysctl") Signed-off-by: Hangyu Hua Link: https://lore.kernel.org/r/20220729110027.40569-1-hbh25y@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/dccp/proto.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/dccp/proto.c b/net/dccp/proto.c index 936dab12f99f..e552009b6cc5 100644 --- a/net/dccp/proto.c +++ b/net/dccp/proto.c @@ -764,11 +764,6 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, = size_t len) =20 lock_sock(sk); =20 - if (dccp_qpolicy_full(sk)) { - rc =3D -EAGAIN; - goto out_release; - } - timeo =3D sock_sndtimeo(sk, noblock); =20 /* @@ -787,6 +782,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, = size_t len) if (skb =3D=3D NULL) goto out_release; =20 + if (dccp_qpolicy_full(sk)) { + rc =3D -EAGAIN; + goto out_discard; + } + if (sk->sk_state =3D=3D DCCP_CLOSED) { rc =3D -ENOTCONN; goto out_discard; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAE9FC32774 for ; Tue, 23 Aug 2022 09:47:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242731AbiHWJre (ORCPT ); Tue, 23 Aug 2022 05:47:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42218 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241550AbiHWJnT (ORCPT ); Tue, 23 Aug 2022 05:43:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3DAE19A952; Tue, 23 Aug 2022 01:42:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1F6BC614E9; Tue, 23 Aug 2022 08:42:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 25345C43470; Tue, 23 Aug 2022 08:42:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244155; bh=gXJeB+CKeDu7TiKFHWZPHO1BsLZegk9X3IBL5reKvkk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qwy3h5S2xz65uIXq1HogwKneRIQpuFjg0dLbT7Dbma3uj6DMFQ8aFBBh3Hsi+luqM R9PScrulSBilUbQjc4URtYtC9JBcouhZc4z6ac/pMjOcxTGqmaep3W+6CGDv01Upio vwe0M6XAtIriAzkX/smdI6kiiG7avFtyBe9Y2aJw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Linus Walleij , Miquel Raynal , Sasha Levin Subject: [PATCH 4.14 094/229] mtd: maps: Fix refcount leak in of_flash_probe_versatile Date: Tue, 23 Aug 2022 10:24:15 +0200 Message-Id: <20220823080057.068334279@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 33ec82a6d2b119938f26e5c8040ed5d92378eb54 ] of_find_matching_node_and_match() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: b0afd44bc192 ("mtd: physmap_of: add a hook for Versatile write prote= ction") Signed-off-by: Miaoqian Lin Reviewed-by: Linus Walleij Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220523140205.48625-1-linmq006@gma= il.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/mtd/maps/physmap_of_versatile.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/maps/physmap_of_versatile.c b/drivers/mtd/maps/phy= smap_of_versatile.c index 03f2b6e7bc7e..961704228dd2 100644 --- a/drivers/mtd/maps/physmap_of_versatile.c +++ b/drivers/mtd/maps/physmap_of_versatile.c @@ -221,6 +221,7 @@ int of_flash_probe_versatile(struct platform_device *pd= ev, =20 versatile_flashprot =3D (enum versatile_flashprot)devid->data; rmap =3D syscon_node_to_regmap(sysnp); + of_node_put(sysnp); if (IS_ERR(rmap)) return PTR_ERR(rmap); =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8AD9CC32772 for ; Tue, 23 Aug 2022 09:49:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242423AbiHWJtK (ORCPT ); Tue, 23 Aug 2022 05:49:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55908 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352566AbiHWJqd (ORCPT ); Tue, 23 Aug 2022 05:46:33 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 404596050F; Tue, 23 Aug 2022 01:44:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 40838CE1B44; Tue, 23 Aug 2022 08:42:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43B0BC433C1; Tue, 23 Aug 2022 08:42:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244161; bh=iwlSgC6Aa0nWy47+NA8m36MZZmWgMbKUT66h/Y2MjP8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mofMnoaNR2AicMb4hCqphwc93rudAgDjnzO/MNE1FSjNidMDThgEffG3bsv/dLxk+ 5cg5SEAy5WB0I37QgeyIi2TRA6ZjJOy4iWt1t8lofMJqEJkVNh9eLEIg5QO7PwGJXk F0H3Zq1fNhjPdgeZE7IqcZGeWS1sWr7l+Ky5b0Ew= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Linus Walleij , Miquel Raynal , Sasha Levin Subject: [PATCH 4.14 095/229] mtd: maps: Fix refcount leak in ap_flash_init Date: Tue, 23 Aug 2022 10:24:16 +0200 Message-Id: <20220823080057.103541548@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 77087a04c8fd554134bddcb8a9ff87b21f357926 ] of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: b0afd44bc192 ("mtd: physmap_of: add a hook for Versatile write prote= ction") Signed-off-by: Miaoqian Lin Reviewed-by: Linus Walleij Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220523143255.4376-1-linmq006@gmai= l.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/mtd/maps/physmap_of_versatile.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/maps/physmap_of_versatile.c b/drivers/mtd/maps/phy= smap_of_versatile.c index 961704228dd2..7d56e97bd50f 100644 --- a/drivers/mtd/maps/physmap_of_versatile.c +++ b/drivers/mtd/maps/physmap_of_versatile.c @@ -107,6 +107,7 @@ static int ap_flash_init(struct platform_device *pdev) return -ENODEV; } ebi_base =3D of_iomap(ebi, 0); + of_node_put(ebi); if (!ebi_base) return -ENODEV; =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5C83C32772 for ; Tue, 23 Aug 2022 09:47:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241436AbiHWJrg (ORCPT ); Tue, 23 Aug 2022 05:47:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52652 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242056AbiHWJoy (ORCPT ); Tue, 23 Aug 2022 05:44:54 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 750539AF9B; Tue, 23 Aug 2022 01:42:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7BA0BB81C60; Tue, 23 Aug 2022 08:42:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D459CC43150; Tue, 23 Aug 2022 08:42:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244171; bh=lWWSm2syIeIS1boxNmkx/3K1fy055LEE6+NgpxISBaY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1C5DI8ZEYaZREb9bKudFBSYBKdBFV180h2AOcfrNlxVWy65FAkG43Q7/susChAaQD zLS8mc0NmQVz8WimA2uBv+zkBD1Iy5zh2jVrn0/PntzanmXmR23KRlnWLD2wYvexeT jeFV802Q4sym9lrRQWYZ/hMTB0DHm4wmSXM6m/hQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Miquel Raynal , Sasha Levin Subject: [PATCH 4.14 096/229] mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release Date: Tue, 23 Aug 2022 10:24:17 +0200 Message-Id: <20220823080057.134605041@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou [ Upstream commit a61528d997619a518ee8c51cf0ef0513021afaff ] There is a deadlock between sm_release and sm_cache_flush_work which is a work item. The cancel_work_sync in sm_release will not return until sm_cache_flush_work is finished. If we hold mutex_lock and use cancel_work_sync to wait the work item to finish, the work item also requires mutex_lock. As a result, the sm_release will be blocked forever. The race condition is shown below: (Thread 1) | (Thread 2) sm_release | mutex_lock(&ftl->mutex) | sm_cache_flush_work | mutex_lock(&ftl->mutex) cancel_work_sync | ... This patch moves del_timer_sync and cancel_work_sync out of mutex_lock in order to mitigate deadlock. Fixes: 7d17c02a01a1 ("mtd: Add new SmartMedia/xD FTL") Signed-off-by: Duoming Zhou Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220524044841.10517-1-duoming@zju.= edu.cn Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/mtd/sm_ftl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/sm_ftl.c b/drivers/mtd/sm_ftl.c index 3692dd547879..e48718393ddf 100644 --- a/drivers/mtd/sm_ftl.c +++ b/drivers/mtd/sm_ftl.c @@ -1109,9 +1109,9 @@ static void sm_release(struct mtd_blktrans_dev *dev) { struct sm_ftl *ftl =3D dev->priv; =20 - mutex_lock(&ftl->mutex); del_timer_sync(&ftl->timer); cancel_work_sync(&ftl->flush_work); + mutex_lock(&ftl->mutex); sm_cache_flush(ftl); mutex_unlock(&ftl->mutex); } --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC730C32772 for ; Tue, 23 Aug 2022 10:03:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350014AbiHWKDU (ORCPT ); Tue, 23 Aug 2022 06:03:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53130 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242288AbiHWJ5Z (ORCPT ); Tue, 23 Aug 2022 05:57:25 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D383AA1D1A; Tue, 23 Aug 2022 01:47:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D4BFA61517; Tue, 23 Aug 2022 08:42:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CFD7FC433D6; Tue, 23 Aug 2022 08:42:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244177; bh=3atmxHOlsVO/sCQStZvRrlDMdG4NU387RD4hB2VBcwo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LsckLoDu5HeqWuRedCkVuErfVwghX6pPyV2wZNnKWN/SU/abPCJ6VC/mXrGkOyq3N 53fK1sVUa+h4LGiNn67b+K0UvKGNFaL6V/X04O6Q6blU2gmGj2KM4gC0c8qeXpw4gf kY5KNKE7HyT2yqg3vV0lGm72X3lWk2kyEZrUlHL4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= , Miquel Raynal , Sasha Levin Subject: [PATCH 4.14 097/229] mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()s error path Date: Tue, 23 Aug 2022 10:24:18 +0200 Message-Id: <20220823080057.165155498@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Uwe Kleine-K=C3=B6nig [ Upstream commit 28607b426c3d050714f250d0faeb99d2e9106e90 ] For all but one error path clk_disable_unprepare() is already there. Add it to the one location where it's missing. Fixes: 481815a6193b ("mtd: st_spi_fsm: Handle clk_prepare_enable/clk_disabl= e_unprepare.") Fixes: 69d5af8d016c ("mtd: st_spi_fsm: Obtain and use EMI clock") Signed-off-by: Uwe Kleine-K=C3=B6nig Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220607152458.232847-2-u.kleine-ko= enig@pengutronix.de Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/mtd/devices/st_spi_fsm.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/mtd/devices/st_spi_fsm.c b/drivers/mtd/devices/st_spi_= fsm.c index 7bc29d725200..a4ca4987f2a4 100644 --- a/drivers/mtd/devices/st_spi_fsm.c +++ b/drivers/mtd/devices/st_spi_fsm.c @@ -2125,10 +2125,12 @@ static int stfsm_probe(struct platform_device *pdev) (long long)fsm->mtd.size, (long long)(fsm->mtd.size >> 20), fsm->mtd.erasesize, (fsm->mtd.erasesize >> 10)); =20 - return mtd_device_register(&fsm->mtd, NULL, 0); - + ret =3D mtd_device_register(&fsm->mtd, NULL, 0); + if (ret) { err_clk_unprepare: - clk_disable_unprepare(fsm->clk); + clk_disable_unprepare(fsm->clk); + } + return ret; } =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C011DC32772 for ; Tue, 23 Aug 2022 09:54:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241664AbiHWJxt (ORCPT ); Tue, 23 Aug 2022 05:53:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56378 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352176AbiHWJvV (ORCPT ); Tue, 23 Aug 2022 05:51:21 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 083339E2FA; Tue, 23 Aug 2022 01:45:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1C31BB81C55; Tue, 23 Aug 2022 08:45:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 60ED3C433D6; Tue, 23 Aug 2022 08:44:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244298; bh=7hdHv7J+04cx/G4tWWXZvkrtgK+459IewjPVceZKJkE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=puIq5+28ClpO65DHH/ruvepgtorxPgvG4f5dfd14hZF8/3jQqNVMv4EvVMbLpDPXM 3LgmqxQWSPEsY9CjQZLVchf/YbdAk8DnP/khCptkWUqCAfg4xqv4i3RQfS0DUEr2sF jR3fwqXLtMebpoasqv0utP7hxqIvao2xria8lESA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Rix , Xu Yilun , Marco Pagani , Sasha Levin Subject: [PATCH 4.14 098/229] fpga: altera-pr-ip: fix unsigned comparison with less than zero Date: Tue, 23 Aug 2022 10:24:19 +0200 Message-Id: <20220823080057.196214331@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marco Pagani [ Upstream commit 2df84a757d87fd62869fc401119d429735377ec5 ] Fix the "comparison with less than zero" warning reported by cppcheck for the unsigned (size_t) parameter count of the alt_pr_fpga_write() function. Fixes: d201cc17a8a3 ("fpga pr ip: Core driver support for Altera Partial Re= configuration IP") Reviewed-by: Tom Rix Acked-by: Xu Yilun Signed-off-by: Marco Pagani Link: https://lore.kernel.org/r/20220609140520.42662-1-marpagan@redhat.com Signed-off-by: Xu Yilun Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/fpga/altera-pr-ip-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/fpga/altera-pr-ip-core.c b/drivers/fpga/altera-pr-ip-c= ore.c index a7b31f9797ce..0314737d705b 100644 --- a/drivers/fpga/altera-pr-ip-core.c +++ b/drivers/fpga/altera-pr-ip-core.c @@ -119,7 +119,7 @@ static int alt_pr_fpga_write(struct fpga_manager *mgr, = const char *buf, u32 *buffer_32 =3D (u32 *)buf; size_t i =3D 0; =20 - if (count <=3D 0) + if (!count) return -EINVAL; =20 /* Write out the complete 32-bit chunks */ --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 324A9C32792 for ; Tue, 23 Aug 2022 09:57:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344266AbiHWJzd (ORCPT ); Tue, 23 Aug 2022 05:55:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42012 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244585AbiHWJyB (ORCPT ); Tue, 23 Aug 2022 05:54:01 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4CA989F768; Tue, 23 Aug 2022 01:46:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BA3A9B81C3A; Tue, 23 Aug 2022 08:46:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC362C433D6; Tue, 23 Aug 2022 08:46:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244366; bh=d2C7zI3JOKJ5MqjkH9tUElWe9uYNhh5//9mKAug5n1Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RNlkxITg5y66poxcGI3QO3IbDRQ93/3HTwzrdF+kL1bAGfCAi+SCDWvxYi+PfQaH5 zEmeRzbxUq9QxfVSQa+EwP9S61DmYEargZ/DcjXXDk+TIiI+uXXQ3/IHkUdzDBx9bz 4M57Uy6MKuyCl/BKwuHtYrkngNTbC/qrGBKx5mdY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Miaoqian Lin , Sasha Levin Subject: [PATCH 4.14 099/229] usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe Date: Tue, 23 Aug 2022 10:24:20 +0200 Message-Id: <20220823080057.231944046@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit b5c5b13cb45e2c88181308186b0001992cb41954 ] of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: 796bcae7361c ("USB: powerpc: Workaround for the PPC440EPX USBH_23 er= rata [take 3]") Acked-by: Alan Stern Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220602110849.58549-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/host/ehci-ppc-of.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/ehci-ppc-of.c b/drivers/usb/host/ehci-ppc-of.c index 1a10c8d542ca..d36aa2c29d39 100644 --- a/drivers/usb/host/ehci-ppc-of.c +++ b/drivers/usb/host/ehci-ppc-of.c @@ -147,6 +147,7 @@ static int ehci_hcd_ppc_of_probe(struct platform_device= *op) } else { ehci->has_amcc_usb23 =3D 1; } + of_node_put(np); } =20 if (of_get_property(dn, "big-endian", NULL)) { --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B4FFC32772 for ; Tue, 23 Aug 2022 09:58:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237003AbiHWJ6b (ORCPT ); Tue, 23 Aug 2022 05:58:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40994 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244207AbiHWJxQ (ORCPT ); Tue, 23 Aug 2022 05:53:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C52C9E2D1; Tue, 23 Aug 2022 01:46:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6A8A8611DD; Tue, 23 Aug 2022 08:46:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C8087C433C1; Tue, 23 Aug 2022 08:46:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244382; bh=TXrm5cDzcDDv4OSzZzYE5SgfVG6S5vhOnAgTDnaow9o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EXETc7c+0UjsHsjRht/JXpVT+J0nIukh9MFBUYSytP6WJSLDe3CtsptGB/J1dWhuI l9TOs5qEBH38opCtothY6vhaNrVsagxxk3DurGR68MsBjiGNDiFGNNHs4jGbERt5L1 cl4WhVrb2uAe+D3rg6N06fPIlUMrFjh1IAO2D/ak= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Miaoqian Lin , Sasha Levin Subject: [PATCH 4.14 100/229] usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe Date: Tue, 23 Aug 2022 10:24:21 +0200 Message-Id: <20220823080057.274538251@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 302970b4cad3ebfda2c05ce06c322ccdc447d17e ] of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: 73108aa90cbf ("USB: ohci-nxp: Use isp1301 driver") Acked-by: Alan Stern Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220603141231.979-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/host/ohci-nxp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/ohci-nxp.c b/drivers/usb/host/ohci-nxp.c index 6df8e2ed40fd..5162038b794e 100644 --- a/drivers/usb/host/ohci-nxp.c +++ b/drivers/usb/host/ohci-nxp.c @@ -155,6 +155,7 @@ static int ohci_hcd_nxp_probe(struct platform_device *p= dev) } =20 isp1301_i2c_client =3D isp1301_get_client(isp1301_node); + of_node_put(isp1301_node); if (!isp1301_i2c_client) return -EPROBE_DEFER; =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5FD8DC32774 for ; Tue, 23 Aug 2022 09:48:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243977AbiHWJsM (ORCPT ); Tue, 23 Aug 2022 05:48:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352128AbiHWJp6 (ORCPT ); Tue, 23 Aug 2022 05:45:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 14C6343E71; Tue, 23 Aug 2022 01:43:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D89466153A; Tue, 23 Aug 2022 08:43:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DB05DC433C1; Tue, 23 Aug 2022 08:43:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244196; bh=nBECbFiTYqDWMZnWshLEHrVJOnspAGOnYPScHv5uORA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TDuL+OvOtzGIkc5IuOXl9p+1TsISBmgxdz75d499W9UerZjssb5Kj3rqZMLLCB/Kw lZ9LdacHZMHu6kWhJdE71oD4Q+F0rz3DYUP2c/ZlVQpwu8wlvgk4QGqQye6GvdN10Z PDEunl9F4x2uUCgyo2NhcJFF49zlh08eIE+7KUpQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Sasha Levin Subject: [PATCH 4.14 101/229] misc: rtsx: Fix an error handling path in rtsx_pci_probe() Date: Tue, 23 Aug 2022 10:24:22 +0200 Message-Id: <20220823080057.306630618@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET [ Upstream commit 44fd1917314e9d4f53dd95dd65df1c152f503d3a ] If an error occurs after a successful idr_alloc() call, the corresponding resource must be released with idr_remove() as already done in the .remove function. Update the error handling path to add the missing idr_remove() call. Fixes: ada8a8a13b13 ("mfd: Add realtek pcie card reader driver") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/e8dc41716cbf52fb37a12e70d8972848e69df6d6.16= 55271216.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/mfd/rtsx_pcr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c index c9e45b6befac..1c7afd9a14e3 100644 --- a/drivers/mfd/rtsx_pcr.c +++ b/drivers/mfd/rtsx_pcr.c @@ -1223,7 +1223,7 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, pcr->remap_addr =3D ioremap_nocache(base, len); if (!pcr->remap_addr) { ret =3D -ENOMEM; - goto free_handle; + goto free_idr; } =20 pcr->rtsx_resv_buf =3D dma_alloc_coherent(&(pcidev->dev), @@ -1285,6 +1285,10 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, pcr->rtsx_resv_buf, pcr->rtsx_resv_buf_addr); unmap: iounmap(pcr->remap_addr); +free_idr: + spin_lock(&rtsx_pci_lock); + idr_remove(&rtsx_pci_idr, pcr->id); + spin_unlock(&rtsx_pci_lock); free_handle: kfree(handle); free_pcr: --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55F84C32772 for ; Tue, 23 Aug 2022 09:49:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243338AbiHWJtn (ORCPT ); Tue, 23 Aug 2022 05:49:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53116 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240307AbiHWJq7 (ORCPT ); Tue, 23 Aug 2022 05:46:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 98B339C2D7; Tue, 23 Aug 2022 01:44:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4BCE3611DD; Tue, 23 Aug 2022 08:43:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4EAF8C433C1; Tue, 23 Aug 2022 08:43:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244202; bh=bVQGyZY1n80bSzC1lyAdzRMkB8EVvkQLixSXwGrJx/8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LymkP6XvBH03SRpCIyGAty/vRhwrIdf3CrhEdXd/2jHC+E/81rz8acCYtDgTtDPIz C1RCUgnoE7GZYyPUg5d9cm9bK+rDtXuP92vAGE0RsOhLuL5NYIvNvA6IqPW5dcixk4 yAI6EUq9+8bj6SwVQM4N6/napNRZAaJwTUEwi+R4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Ulf Hansson , Sasha Levin Subject: [PATCH 4.14 102/229] mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch Date: Tue, 23 Aug 2022 10:24:23 +0200 Message-Id: <20220823080057.336974286@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit b5899a3e2f783a27b268e38d37f9b24c71bddf45 ] of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. of_node_put() checks null pointer. Fixes: ea35645a3c66 ("mmc: sdhci-of-esdhc: add support for signal voltage s= witch") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220523144255.10310-1-linmq006@gmail.com Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/mmc/host/sdhci-of-esdhc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-= esdhc.c index 3f00a7fc79b5..6bb1f4ad0216 100644 --- a/drivers/mmc/host/sdhci-of-esdhc.c +++ b/drivers/mmc/host/sdhci-of-esdhc.c @@ -671,6 +671,7 @@ static int esdhc_signal_voltage_switch(struct mmc_host = *mmc, scfg_node =3D of_find_matching_node(NULL, scfg_device_ids); if (scfg_node) scfg_base =3D of_iomap(scfg_node, 0); + of_node_put(scfg_node); if (scfg_base) { sdhciovselcr =3D SDHCIOVSELCR_TGLEN | SDHCIOVSELCR_VSELVAL; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85FF1C32772 for ; Tue, 23 Aug 2022 09:49:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242971AbiHWJtQ (ORCPT ); Tue, 23 Aug 2022 05:49:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55812 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352283AbiHWJqM (ORCPT ); Tue, 23 Aug 2022 05:46:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7673D75496; Tue, 23 Aug 2022 01:43:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7F9D2614E9; Tue, 23 Aug 2022 08:43:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 860AAC433C1; Tue, 23 Aug 2022 08:43:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244208; bh=6JrT9EI5+j/PauKm10M95FzvHCL4nLV18Z8dTnkMfVA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=luSQ5yix12WrB4ll19g3qQg5KaA5G0zRmn/axTx6DshsvAK3dYID+YGllXq0DswHs NDgh/3CcyA8Lj/qP89bXQbV3tQjDdw61TlOZTaUdpyoq/5DRCsjDTsIoMP4yOJ8AH/ fydEV01/v/fbDkD0T7OHsnZ60iGuLUInlNx/h/qw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Ulf Hansson , Sasha Levin Subject: [PATCH 4.14 103/229] memstick/ms_block: Fix some incorrect memory allocation Date: Tue, 23 Aug 2022 10:24:24 +0200 Message-Id: <20220823080057.377765792@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET [ Upstream commit 2e531bc3e0d86362fcd8a577b3278d9ef3cc2ba0 ] Some functions of the bitmap API take advantage of the fact that a bitmap is an array of long. So, to make sure this assertion is correct, allocate bitmaps with bitmap_zalloc() instead of kzalloc()+hand-computed number of bytes. While at it, also use bitmap_free() instead of kfree() to keep the semantic. Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/dbf633c48c24ae6d95f852557e8d8b3bbdef65fe.16= 56155715.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/memstick/core/ms_block.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_bl= ock.c index ffe875740671..7138062733ba 100644 --- a/drivers/memstick/core/ms_block.c +++ b/drivers/memstick/core/ms_block.c @@ -1338,16 +1338,16 @@ static int msb_ftl_initialize(struct msb_data *msb) msb->zone_count =3D msb->block_count / MS_BLOCKS_IN_ZONE; msb->logical_block_count =3D msb->zone_count * 496 - 2; =20 - msb->used_blocks_bitmap =3D kzalloc(msb->block_count / 8, GFP_KERNEL); - msb->erased_blocks_bitmap =3D kzalloc(msb->block_count / 8, GFP_KERNEL); + msb->used_blocks_bitmap =3D bitmap_zalloc(msb->block_count, GFP_KERNEL); + msb->erased_blocks_bitmap =3D bitmap_zalloc(msb->block_count, GFP_KERNEL); msb->lba_to_pba_table =3D kmalloc(msb->logical_block_count * sizeof(u16), GFP_KERNEL); =20 if (!msb->used_blocks_bitmap || !msb->lba_to_pba_table || !msb->erased_blocks_bitmap) { - kfree(msb->used_blocks_bitmap); + bitmap_free(msb->used_blocks_bitmap); + bitmap_free(msb->erased_blocks_bitmap); kfree(msb->lba_to_pba_table); - kfree(msb->erased_blocks_bitmap); return -ENOMEM; } =20 @@ -1960,7 +1960,7 @@ static int msb_bd_open(struct block_device *bdev, fmo= de_t mode) static void msb_data_clear(struct msb_data *msb) { kfree(msb->boot_page); - kfree(msb->used_blocks_bitmap); + bitmap_free(msb->used_blocks_bitmap); kfree(msb->lba_to_pba_table); kfree(msb->cache); msb->card =3D NULL; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2EE67C32772 for ; Tue, 23 Aug 2022 09:48:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242045AbiHWJst (ORCPT ); Tue, 23 Aug 2022 05:48:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53680 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352329AbiHWJqQ (ORCPT ); Tue, 23 Aug 2022 05:46:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 09BAA8E996; Tue, 23 Aug 2022 01:43:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6FCDC614E7; Tue, 23 Aug 2022 08:43:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 78081C433C1; Tue, 23 Aug 2022 08:43:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244216; bh=yogE9+4Ce06XGXVLmnH/jr0Qcnm8JpE9HUPjVLFTfMs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1x0yC0kPciJaG77Zh/M5qLxUmJEVxw58nAlfZXKxqvfG8EaWU7ZjhVDjhqHrbw3to ijCxCCg0GVlD7ZQXyLaaamzc3T8En6suxjbyKDvgxc5LeBhQAm4JwGMpiwede0mNdx STd3y7PDMHK+dAMd/zEtvNaI1QWMJCraI1r0aCz4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Ulf Hansson , Sasha Levin Subject: [PATCH 4.14 104/229] memstick/ms_block: Fix a memory leak Date: Tue, 23 Aug 2022 10:24:25 +0200 Message-Id: <20220823080057.408800714@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET [ Upstream commit 54eb7a55be6779c4d0c25eaf5056498a28595049 ] 'erased_blocks_bitmap' is never freed. As it is allocated at the same time as 'used_blocks_bitmap', it is likely that it should be freed also at the same time. Add the corresponding bitmap_free() in msb_data_clear(). Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/b3b78926569445962ea5c3b6e9102418a9effb88.16= 56155715.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/memstick/core/ms_block.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_bl= ock.c index 7138062733ba..55525f696c6c 100644 --- a/drivers/memstick/core/ms_block.c +++ b/drivers/memstick/core/ms_block.c @@ -1961,6 +1961,7 @@ static void msb_data_clear(struct msb_data *msb) { kfree(msb->boot_page); bitmap_free(msb->used_blocks_bitmap); + bitmap_free(msb->erased_blocks_bitmap); kfree(msb->lba_to_pba_table); kfree(msb->cache); msb->card =3D NULL; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EFD75C32772 for ; Tue, 23 Aug 2022 09:49:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241293AbiHWJtG (ORCPT ); Tue, 23 Aug 2022 05:49:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52452 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352506AbiHWJqa (ORCPT ); Tue, 23 Aug 2022 05:46:30 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E81199C234; Tue, 23 Aug 2022 01:44:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 01BEFCE1B2C; Tue, 23 Aug 2022 08:43:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D614BC433C1; Tue, 23 Aug 2022 08:43:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244223; bh=7BvALsoWs5iJliUehLucGEc6+Br7a+GqGnGcUgeAe0w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gDJDdVZ7dWChtrORvG/62huSTS1qbgC9QEbnIdHB0p9ZJQnYZXfl9jCI8XKLNpc+V MsD3LPRxEAFAPAA0OAq8OkWhLZWdcYClDgycneZ9r7nYWLC5//NpIAmJ9QxLqF6Z67 1g/FFWa5r4rOiKWyqCQD2QwrmsDJlVyeFyGN0zNg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eugen Hristev , Karl Olsen , Adrian Hunter , Ulf Hansson , Sasha Levin Subject: [PATCH 4.14 105/229] mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R Date: Tue, 23 Aug 2022 10:24:26 +0200 Message-Id: <20220823080057.440384775@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eugen Hristev [ Upstream commit 5987e6ded29d52e42fc7b06aa575c60a25eee38e ] In set_uhs_signaling, the DDR bit is being set by fully writing the MC1R register. This can lead to accidental erase of certain bits in this register. Avoid this by doing a read-modify-write operation. Fixes: d0918764c17b ("mmc: sdhci-of-at91: fix MMC_DDR_52 timing selection") Signed-off-by: Eugen Hristev Tested-by: Karl Olsen Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20220630090926.15061-1-eugen.hristev@microc= hip.com Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/mmc/host/sdhci-of-at91.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-a= t91.c index 78c9ac33b562..8a5f87bbe393 100644 --- a/drivers/mmc/host/sdhci-of-at91.c +++ b/drivers/mmc/host/sdhci-of-at91.c @@ -116,8 +116,13 @@ static void sdhci_at91_set_power(struct sdhci_host *ho= st, unsigned char mode, =20 void sdhci_at91_set_uhs_signaling(struct sdhci_host *host, unsigned int ti= ming) { - if (timing =3D=3D MMC_TIMING_MMC_DDR52) - sdhci_writeb(host, SDMMC_MC1R_DDR, SDMMC_MC1R); + u8 mc1r; + + if (timing =3D=3D MMC_TIMING_MMC_DDR52) { + mc1r =3D sdhci_readb(host, SDMMC_MC1R); + mc1r |=3D SDMMC_MC1R_DDR; + sdhci_writeb(host, mc1r, SDMMC_MC1R); + } sdhci_set_uhs_signaling(host, timing); } =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ABD71C32772 for ; Tue, 23 Aug 2022 09:49:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243194AbiHWJtr (ORCPT ); Tue, 23 Aug 2022 05:49:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55870 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241981AbiHWJrL (ORCPT ); Tue, 23 Aug 2022 05:47:11 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D220A8E0D1; Tue, 23 Aug 2022 01:44:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0BFA9B81C62; Tue, 23 Aug 2022 08:43:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 112E6C433C1; Tue, 23 Aug 2022 08:43:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244233; bh=ukwapbfI9bnj1qkrK8Q3hXNU2QLw365AmtkZrw2+F0Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WovB5bfCKWi36ckgoYiR/GkAjL5bY7YhN7eb9g6CWMqTEPzLqMgkNdA+yMz4kuI6B H432rz4gXYL2pDKogvINx5bQ3fs6gBCKMeYceke/r59BRxtSeD2OnIpNayXJ8YRSKI gmxVoYEuOEm4hPnnC3ifJWVid2vpr+Cp+uATzMAg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Scott Benesh , Scott Teel , Mike McGowen , Kevin Barnett , Mahesh Rajashekhara , Don Brace , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 4.14 106/229] scsi: smartpqi: Fix DMA direction for RAID requests Date: Tue, 23 Aug 2022 10:24:27 +0200 Message-Id: <20220823080057.470653754@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mahesh Rajashekhara [ Upstream commit 69695aeaa6621bc49cdd7a8e5a8d1042461e496e ] Correct a SOP READ and WRITE DMA flags for some requests. This update corrects DMA direction issues with SCSI commands removed from the controller's internal lookup table. Currently, SCSI READ BLOCK LIMITS (0x5) was removed from the controller lookup table and exposed a DMA direction flag issue. SCSI READ BLOCK LIMITS was recently removed from our controller lookup table so the controller uses the respective IU flag field to set the DMA data direction. Since the DMA direction is incorrect the FW never completes the request causing a hang. Some SCSI commands which use SCSI READ BLOCK LIMITS * sg_map * mt -f /dev/stX status After updating controller firmware, users may notice their tape units failing. This patch resolves the issue. Also, the AIO path DMA direction is correct. The DMA direction flag is a day-one bug with no reported BZ. Fixes: 6c223761eb54 ("smartpqi: initial commit of Microsemi smartpqi driver= ") Link: https://lore.kernel.org/r/165730605618.177165.9054223644512926624.stg= it@brunhilda Reviewed-by: Scott Benesh Reviewed-by: Scott Teel Reviewed-by: Mike McGowen Reviewed-by: Kevin Barnett Signed-off-by: Mahesh Rajashekhara Signed-off-by: Don Brace Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/scsi/smartpqi/smartpqi_init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/= smartpqi_init.c index 4055753b495a..5b1f15720947 100644 --- a/drivers/scsi/smartpqi/smartpqi_init.c +++ b/drivers/scsi/smartpqi/smartpqi_init.c @@ -4652,10 +4652,10 @@ static int pqi_raid_submit_scsi_cmd_with_io_request( } =20 switch (scmd->sc_data_direction) { - case DMA_TO_DEVICE: + case DMA_FROM_DEVICE: request->data_direction =3D SOP_READ_FLAG; break; - case DMA_FROM_DEVICE: + case DMA_TO_DEVICE: request->data_direction =3D SOP_WRITE_FLAG; break; case DMA_NONE: --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83DC5C32774 for ; Tue, 23 Aug 2022 09:49:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243836AbiHWJtv (ORCPT ); Tue, 23 Aug 2022 05:49:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54538 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238966AbiHWJrW (ORCPT ); Tue, 23 Aug 2022 05:47:22 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 899DA9C8CE; Tue, 23 Aug 2022 01:44:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1B12AB81C4A; Tue, 23 Aug 2022 08:44:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9733BC433B5; Tue, 23 Aug 2022 08:43:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244239; bh=azrkHgPOnQs884ZEUGFFFLQT6q0lJFF7yhUhaKnD080=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RWExlh+fyrRuwMbIxKr/2863jpg53DDS8GIMBy9wXUfwpcEfm5lEdzncqx4HV/QIo GFBOPINW6aH4pFTiOpn3xO2LHWozElYjn+OK+n3cOFWu7ez00L8yU+0ggTBIkJUtR7 EyJFUNkXLA7b8cC7QT1I/ALs35hStapQ42VD9cYQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Raviteja Garimella , Felipe Balbi , linux-usb@vger.kernel.org, Randy Dunlap , Sasha Levin Subject: [PATCH 4.14 107/229] usb: gadget: udc: amd5536 depends on HAS_DMA Date: Tue, 23 Aug 2022 10:24:28 +0200 Message-Id: <20220823080057.502281644@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 8097cf2fb3b2205257f1c76f4808e3398d66b6d9 ] USB_AMD5536UDC should depend on HAS_DMA since it selects USB_SNP_CORE, which depends on HAS_DMA and since 'select' does not follow any dependency chains. Fixes this kconfig warning: WARNING: unmet direct dependencies detected for USB_SNP_CORE Depends on [n]: USB_SUPPORT [=3Dy] && USB_GADGET [=3Dy] && (USB_AMD5536UD= C [=3Dy] || USB_SNP_UDC_PLAT [=3Dn]) && HAS_DMA [=3Dn] Selected by [y]: - USB_AMD5536UDC [=3Dy] && USB_SUPPORT [=3Dy] && USB_GADGET [=3Dy] && USB= _PCI [=3Dy] Fixes: 97b3ffa233b9 ("usb: gadget: udc: amd5536: split core and PCI layer") Cc: Raviteja Garimella Cc: Felipe Balbi Cc: linux-usb@vger.kernel.org Cc: Greg Kroah-Hartman Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20220709013601.7536-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/gadget/udc/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig index 3291ea22853c..4c6eaf2a3b73 100644 --- a/drivers/usb/gadget/udc/Kconfig +++ b/drivers/usb/gadget/udc/Kconfig @@ -309,7 +309,7 @@ source "drivers/usb/gadget/udc/bdc/Kconfig" =20 config USB_AMD5536UDC tristate "AMD5536 UDC" - depends on USB_PCI + depends on USB_PCI && HAS_DMA select USB_SNP_CORE help The AMD5536 UDC is part of the AMD Geode CS5536, an x86 southbridge. --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4B7BC32772 for ; Tue, 23 Aug 2022 09:49:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242289AbiHWJs6 (ORCPT ); Tue, 23 Aug 2022 05:48:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56474 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352491AbiHWJq3 (ORCPT ); Tue, 23 Aug 2022 05:46:29 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7E9E092F6C; Tue, 23 Aug 2022 01:44:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 44198614E7; Tue, 23 Aug 2022 08:44:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4EB55C433C1; Tue, 23 Aug 2022 08:44:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244246; bh=Nf3nLV0LGWbKIVOyxXvxMegNYIXmp73WYdm46kgRM34=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gmztlOc05d1Jupx+oDiRzf7L42Ju5oeuy6vuLilt/6GUt1GBX3ZUpgbeCkS5mv0kv J5NHafcCeqZPJ0lGIBRkB6b+BhyOH+AbzjndhoGa6/GzU13V5xU9TpUj0wBkD1d1nk u9Jb2axwdP6ZBIADEWQjJEQmH8fC840ypmxguSUo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jianglei Nie , Dennis Dalessandro , Leon Romanovsky , Sasha Levin Subject: [PATCH 4.14 108/229] RDMA/hfi1: fix potential memory leak in setup_base_ctxt() Date: Tue, 23 Aug 2022 10:24:29 +0200 Message-Id: <20220823080057.538391777@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jianglei Nie [ Upstream commit aa2a1df3a2c85f855af7d54466ac10bd48645d63 ] setup_base_ctxt() allocates a memory chunk for uctxt->groups with hfi1_alloc_ctxt_rcv_groups(). When init_user_ctxt() fails, uctxt->groups is not released, which will lead to a memory leak. We should release the uctxt->groups with hfi1_free_ctxt_rcv_groups() when init_user_ctxt() fails. Fixes: e87473bc1b6c ("IB/hfi1: Only set fd pointer when base context is com= pletely initialized") Link: https://lore.kernel.org/r/20220711070718.2318320-1-niejianglei2021@16= 3.com Signed-off-by: Jianglei Nie Acked-by: Dennis Dalessandro Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/infiniband/hw/hfi1/file_ops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/= hfi1/file_ops.c index 7b8644610feb..d586bd6ddf22 100644 --- a/drivers/infiniband/hw/hfi1/file_ops.c +++ b/drivers/infiniband/hw/hfi1/file_ops.c @@ -1327,8 +1327,10 @@ static int setup_base_ctxt(struct hfi1_filedata *fd, goto done; =20 ret =3D init_user_ctxt(fd, uctxt); - if (ret) + if (ret) { + hfi1_free_ctxt_rcv_groups(uctxt); goto done; + } =20 user_init(uctxt); =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0489AC32772 for ; Tue, 23 Aug 2022 09:50:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243175AbiHWJuG (ORCPT ); Tue, 23 Aug 2022 05:50:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54110 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243336AbiHWJru (ORCPT ); Tue, 23 Aug 2022 05:47:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 59EFD659D7; Tue, 23 Aug 2022 01:44:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 419BF6123D; Tue, 23 Aug 2022 08:44:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4C6CCC433C1; Tue, 23 Aug 2022 08:44:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244252; bh=mpJcz0jiPoaLtBWRMkn60g31PRKqvDk65GI2rFfTWh8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XY1HAlkpxy8pmuEPVcNXuPHgAcp8zlNTnBg9h8jylbgeQ5QAd83pzjCKv4fga9WoD 3zUeF1d/xLBhu3W+dDuqCfYYQ3y79/8H8lD5OxoprcqW1bikkbIQbQZ62k9g1UNbCf DFpAqiTl5hA0ItfycNjdPJLXU8+E+yv3uOiFmgn8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Bartosz Golaszewski , Sasha Levin Subject: [PATCH 4.14 109/229] gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data() Date: Tue, 23 Aug 2022 10:24:30 +0200 Message-Id: <20220823080057.574686008@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 5d07a692f9562f9c06e62cce369e9dd108173a0f ] We should use of_node_get() when a new reference of device_node is created. It is noted that the old reference stored in 'mm_gc->gc.of_node' should also be decreased. This patch is based on the fact that there is a call site in function 'qe_add_gpiochips()' of src file 'drivers\soc\fsl\qe\gpio.c'. In this function, of_mm_gpiochip_add_data() is contained in an iteration of for_each_compatible_node() which will automatically increase and decrease the refcount. So we need additional of_node_get() for the reference escape in of_mm_gpiochip_add_data(). Fixes: a19e3da5bc5f ("of/gpio: Kill of_gpio_chip and add members directly t= o gpio_chip") Signed-off-by: Liang He Signed-off-by: Bartosz Golaszewski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpio/gpiolib-of.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c index d6ed4e891b34..cc1efdbd3db4 100644 --- a/drivers/gpio/gpiolib-of.c +++ b/drivers/gpio/gpiolib-of.c @@ -350,7 +350,8 @@ int of_mm_gpiochip_add_data(struct device_node *np, if (mm_gc->save_regs) mm_gc->save_regs(mm_gc); =20 - mm_gc->gc.of_node =3D np; + of_node_put(mm_gc->gc.of_node); + mm_gc->gc.of_node =3D of_node_get(np); =20 ret =3D gpiochip_add_data(gc, data); if (ret) @@ -358,6 +359,7 @@ int of_mm_gpiochip_add_data(struct device_node *np, =20 return 0; err2: + of_node_put(np); iounmap(mm_gc->regs); err1: kfree(gc->label); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74718C32774 for ; Tue, 23 Aug 2022 09:52:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242834AbiHWJw4 (ORCPT ); Tue, 23 Aug 2022 05:52:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55612 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351896AbiHWJu7 (ORCPT ); Tue, 23 Aug 2022 05:50:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1B1059E2C0; Tue, 23 Aug 2022 01:45:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B5E0461377; Tue, 23 Aug 2022 08:44:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9AFB7C433C1; Tue, 23 Aug 2022 08:44:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244259; bh=SST7BgK6nRiYlNdnB7lLK158LHGtjk/AuY3lc7GNw78=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nl5Fa/4XFJvcjwumtloy/T0pI8AeuHn35MUyuxkuKumPuFDBqHKgwVvDibS95OVFU abTFI+h5ABdF8AKKBdylf4us/DnlWCmek1Kj8JdT3Cj9OWmE+xnUeqKt0jPXZSPpDO L+twpuvxAfsyoASJMCPVPziB8qvCUHi1oJ0nAt8g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Robert Richter , Ulf Hansson , Sasha Levin Subject: [PATCH 4.14 110/229] mmc: cavium-octeon: Add of_node_put() when breaking out of loop Date: Tue, 23 Aug 2022 10:24:31 +0200 Message-Id: <20220823080057.604900868@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 19bbb49acf8d7a03cb83e05624363741a4c3ec6f ] In octeon_mmc_probe(), we should call of_node_put() when breaking out of for_each_child_of_node() which has increased and decreased the refcount during each iteration. Fixes: 01d95843335c ("mmc: cavium: Add MMC support for Octeon SOCs.") Signed-off-by: Liang He Acked-by: Robert Richter Link: https://lore.kernel.org/r/20220719095216.1241601-1-windhl@126.com Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/mmc/host/cavium-octeon.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mmc/host/cavium-octeon.c b/drivers/mmc/host/cavium-oct= eon.c index 22aded1065ae..2245452a44c8 100644 --- a/drivers/mmc/host/cavium-octeon.c +++ b/drivers/mmc/host/cavium-octeon.c @@ -288,6 +288,7 @@ static int octeon_mmc_probe(struct platform_device *pde= v) if (ret) { dev_err(&pdev->dev, "Error populating slots\n"); octeon_mmc_set_shared_power(host, 0); + of_node_put(cn); goto error; } i++; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D17DCC32772 for ; Tue, 23 Aug 2022 09:52:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240363AbiHWJv6 (ORCPT ); Tue, 23 Aug 2022 05:51:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242729AbiHWJu0 (ORCPT ); Tue, 23 Aug 2022 05:50:26 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1E3A69DB47; Tue, 23 Aug 2022 01:45:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7EACEB81C5A; Tue, 23 Aug 2022 08:44:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CFFD6C433C1; Tue, 23 Aug 2022 08:44:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244268; bh=/RaeS7m5dAmIU2S1dxom5JWgLdGUIw6c/w0E9WlM5zo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Hc5Q7/wiBwTCIRDtNrouRBp9CfCrDKgSLVIT/qFoRxTWmk5PeBXwGPbBLbgkSZvqN fDljMV1qgx6D3p6eKB49nac6KGzq3VyvsPfQVQpmmVwwyZum9JeOmidZcM+2Bp3V9t 9qQs2CRUUt89oGFC1a5DhmbTHcLAXOfaEmLdzsIU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Robert Richter , Ulf Hansson , Sasha Levin Subject: [PATCH 4.14 111/229] mmc: cavium-thunderx: Add of_node_put() when breaking out of loop Date: Tue, 23 Aug 2022 10:24:32 +0200 Message-Id: <20220823080057.645464694@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 7ee480795e41db314f2c445c65ed854a5d6e8e32 ] In thunder_mmc_probe(), we should call of_node_put() when breaking out of for_each_child_of_node() which has increased and decreased the refcount during each iteration. Fixes: 166bac38c3c5 ("mmc: cavium: Add MMC PCI driver for ThunderX SOCs") Signed-off-by: Liang He Acked-by: Robert Richter Link: https://lore.kernel.org/r/20220719095216.1241601-2-windhl@126.com Signed-off-by: Ulf Hansson Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/mmc/host/cavium-thunderx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-t= hunderx.c index eee08d81b242..f79806e31e7e 100644 --- a/drivers/mmc/host/cavium-thunderx.c +++ b/drivers/mmc/host/cavium-thunderx.c @@ -138,8 +138,10 @@ static int thunder_mmc_probe(struct pci_dev *pdev, continue; =20 ret =3D cvm_mmc_of_slot_probe(&host->slot_pdev[i]->dev, host); - if (ret) + if (ret) { + of_node_put(child_node); goto error; + } } i++; } --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35A57C32772 for ; Tue, 23 Aug 2022 09:52:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243202AbiHWJwf (ORCPT ); Tue, 23 Aug 2022 05:52:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39342 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351690AbiHWJuv (ORCPT ); Tue, 23 Aug 2022 05:50:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5F9AA6DF9A; Tue, 23 Aug 2022 01:45:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0720761338; Tue, 23 Aug 2022 08:44:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B7FEC433D6; Tue, 23 Aug 2022 08:44:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244274; bh=aolZgR12PUzxTi1PxC82EDK5N5Y8ZmpIPPwJr1pSbSA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rkmck8acNBP9tHM7vZbYO8TDsrh/QBB/azb9mhtrCNM5nr674F9JOgMaCBmAwrwaX PfWvQTytkWIcd399g2QucmN5k53MeGeycGvV5xhIKFt+ZRKRY8Ayj3vLLKeDiUtsCJ X1peLc0aSqRe2r9voQvRkvQNoPZy7aX3N9Ml2/t4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Sasha Levin Subject: [PATCH 4.14 112/229] USB: serial: fix tty-port initialized comments Date: Tue, 23 Aug 2022 10:24:33 +0200 Message-Id: <20220823080057.677023084@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold [ Upstream commit 688ee1d1785c1359f9040f615dd8e6054962bce2 ] Fix up the tty-port initialized comments which got truncated and obfuscated when replacing the old ASYNCB_INITIALIZED flag. Fixes: d41861ca19c9 ("tty: Replace ASYNC_INITIALIZED bit and update atomica= lly") Reviewed-by: Greg Kroah-Hartman Signed-off-by: Johan Hovold Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/sierra.c | 3 ++- drivers/usb/serial/usb-serial.c | 2 +- drivers/usb/serial/usb_wwan.c | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c index a9c5564b6b65..fcbe8a9d2650 100644 --- a/drivers/usb/serial/sierra.c +++ b/drivers/usb/serial/sierra.c @@ -759,7 +759,8 @@ static void sierra_close(struct usb_serial_port *port) =20 /* * Need to take susp_lock to make sure port is not already being - * resumed, but no need to hold it due to initialized + * resumed, but no need to hold it due to the tty-port initialized + * flag. */ spin_lock_irq(&intfdata->susp_lock); if (--intfdata->open_ports =3D=3D 0) diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-seria= l.c index 3dc3464626fb..731bae05d7e5 100644 --- a/drivers/usb/serial/usb-serial.c +++ b/drivers/usb/serial/usb-serial.c @@ -254,7 +254,7 @@ static int serial_open(struct tty_struct *tty, struct f= ile *filp) * * Shut down a USB serial port. Serialized against activate by the * tport mutex and kept to matching open/close pairs - * of calls by the initialized flag. + * of calls by the tty-port initialized flag. * * Not called if tty is console. */ diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c index 4fab7ec9cd3f..bb05c9ea9190 100644 --- a/drivers/usb/serial/usb_wwan.c +++ b/drivers/usb/serial/usb_wwan.c @@ -465,7 +465,8 @@ void usb_wwan_close(struct usb_serial_port *port) =20 /* * Need to take susp_lock to make sure port is not already being - * resumed, but no need to hold it due to initialized + * resumed, but no need to hold it due to the tty-port initialized + * flag. */ spin_lock_irq(&intfdata->susp_lock); if (--intfdata->open_ports =3D=3D 0) --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBAE5C32792 for ; Tue, 23 Aug 2022 09:50:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241707AbiHWJuP (ORCPT ); Tue, 23 Aug 2022 05:50:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55862 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243895AbiHWJsK (ORCPT ); Tue, 23 Aug 2022 05:48:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2CB547A758; Tue, 23 Aug 2022 01:44:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A29CEB81BF8; Tue, 23 Aug 2022 08:44:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F374FC4314A; Tue, 23 Aug 2022 08:44:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244280; bh=CmcPK2lc47Okxh9b7fsrFvpDKb/n652OLhI6HxQ2s24=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mdoSxSMAEvQfdbvlKlhPCuzuB5GiZQIwiydH6mkglSSllZrC4JI4sRNgLL4aP56Yr bN6BDCJv/dhq/IGVWXe1LZL/ZESRKxfpUo5UkM77+yaRocCPS50K35t3/nkodIQWHs MF1wqkcwNPEp6EyIRRl52u/ahWCTO8YjRUbcAhxQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Hans de Goede , Sasha Levin Subject: [PATCH 4.14 113/229] platform/olpc: Fix uninitialized data in debugfs write Date: Tue, 23 Aug 2022 10:24:34 +0200 Message-Id: <20220823080057.723034349@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit 40ec787e1adf302c11668d4cc69838f4d584187d ] The call to: size =3D simple_write_to_buffer(cmdbuf, sizeof(cmdbuf), ppos, buf, size); will succeed if at least one byte is written to the "cmdbuf" buffer. The "*ppos" value controls which byte is written. Another problem is that this code does not check for errors so it's possible for the entire buffer to be uninitialized. Inintialize the struct to zero to prevent reading uninitialized stack data. Debugfs is normally only writable by root so the impact of this bug is very minimal. Fixes: 6cca83d498bd ("Platform: OLPC: move debugfs support from x86 EC driv= er") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YthIKn+TfZSZMEcM@kili Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/platform/olpc/olpc-ec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-e= c.c index 374a8028fec7..b36a000ed969 100644 --- a/drivers/platform/olpc/olpc-ec.c +++ b/drivers/platform/olpc/olpc-ec.c @@ -170,7 +170,7 @@ static ssize_t ec_dbgfs_cmd_write(struct file *file, co= nst char __user *buf, int i, m; unsigned char ec_cmd[EC_MAX_CMD_ARGS]; unsigned int ec_cmd_int[EC_MAX_CMD_ARGS]; - char cmdbuf[64]; + char cmdbuf[64] =3D ""; int ec_cmd_bytes; =20 mutex_lock(&ec_dbgfs_lock); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A0A2C32772 for ; Tue, 23 Aug 2022 09:53:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238318AbiHWJxm (ORCPT ); Tue, 23 Aug 2022 05:53:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42002 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352123AbiHWJvS (ORCPT ); Tue, 23 Aug 2022 05:51:18 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7986F6AA15; Tue, 23 Aug 2022 01:45:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BCB96B8105C; Tue, 23 Aug 2022 08:44:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 007E9C433C1; Tue, 23 Aug 2022 08:44:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244286; bh=sto1LCv4DQGYhbhbX/aWkxvRFogNADA9fty7b01kRcU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=grEEyB++9dHYQtXHBMksoC9DH1UAOm7EbQtRhqAa0ob85dxSiDmRvchXbSXtVNNyo wW5jTMXyFx0dJyHZmjUxcYaMIyPJizwLaVh2V4Wql8e8rLme/dyKkEP+nxItoqnohB U+Hc7/2CrQZx2DZkFfbS/1M6TSAhJZjQ/nim/ZvE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaohe Lin , Andrew Morton , Sasha Levin Subject: [PATCH 4.14 114/229] mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region Date: Tue, 23 Aug 2022 10:24:35 +0200 Message-Id: <20220823080057.754261520@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaohe Lin [ Upstream commit 7f82f922319ede486540e8746769865b9508d2c2 ] Since the beginning, charged is set to 0 to avoid calling vm_unacct_memory twice because vm_unacct_memory will be called by above unmap_region. But since commit 4f74d2c8e827 ("vm: remove 'nr_accounted' calculations from the unmap_vmas() interfaces"), unmap_region doesn't call vm_unacct_memory anymore. So charged shouldn't be set to 0 now otherwise the calling to paired vm_unacct_memory will be missed and leads to imbalanced account. Link: https://lkml.kernel.org/r/20220618082027.43391-1-linmiaohe@huawei.com Fixes: 4f74d2c8e827 ("vm: remove 'nr_accounted' calculations from the unmap= _vmas() interfaces") Signed-off-by: Miaohe Lin Signed-off-by: Andrew Morton Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- mm/mmap.c | 1 - 1 file changed, 1 deletion(-) diff --git a/mm/mmap.c b/mm/mmap.c index 64d1d133af79..a29d5b1fa1a1 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1778,7 +1778,6 @@ unsigned long mmap_region(struct file *file, unsigned= long addr, =20 /* Undo any partial mapping done by a device driver. */ unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); - charged =3D 0; if (vm_flags & VM_SHARED) mapping_unmap_writable(file->f_mapping); allow_write_and_free_vma: --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65EABC3F6B0 for ; Tue, 23 Aug 2022 09:55:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242893AbiHWJzB (ORCPT ); Tue, 23 Aug 2022 05:55:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39320 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352421AbiHWJvn (ORCPT ); Tue, 23 Aug 2022 05:51:43 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A8E7E7AC3B; Tue, 23 Aug 2022 01:46:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 06643B81BF8; Tue, 23 Aug 2022 08:44:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 37933C433D7; Tue, 23 Aug 2022 08:44:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244292; bh=W3VFKsovqPE52cx//52StwJtQgVcG17ZcO2tXb6pBBg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nvprk2L9qmHu0A8Hldvc+jeIflgJYqg4CnvqFHZOCQ9I/Jfm/A6pBuao8Npu4EVZW iaJnSTzHLMh1I5fAn8n4zHw1Cx01uz/6EGfTCi9TtD2oAMZ2y3w+HDZ8eqYEofi149 mNIhxlZ/NSHavdr/z83A43xjDS4Chkf8kwE5LRwo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+833061116fa28df97f3b@syzkaller.appspotmail.com, Zhu Yanjun , Jason Gunthorpe , Sasha Levin Subject: [PATCH 4.14 115/229] RDMA/rxe: Fix error unwind in rxe_create_qp() Date: Tue, 23 Aug 2022 10:24:36 +0200 Message-Id: <20220823080057.796238049@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhu Yanjun [ Upstream commit fd5382c5805c4bcb50fd25b7246247d3f7114733 ] In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like the spin locks are not setup until rxe_qp_init_req(). If an error occures before this point then the unwind will call rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task() which will oops when trying to access the uninitialized spinlock. Move the spinlock initializations earlier before any failures. Fixes: 8700e3e7c485 ("Soft RoCE driver") Link: https://lore.kernel.org/r/20220731063621.298405-1-yanjun.zhu@linux.dev Reported-by: syzbot+833061116fa28df97f3b@syzkaller.appspotmail.com Signed-off-by: Zhu Yanjun Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/infiniband/sw/rxe/rxe_qp.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe= /rxe_qp.c index 28c7b91531b6..6964e843bbae 100644 --- a/drivers/infiniband/sw/rxe/rxe_qp.c +++ b/drivers/infiniband/sw/rxe/rxe_qp.c @@ -220,6 +220,14 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, stru= ct rxe_qp *qp, spin_lock_init(&qp->grp_lock); spin_lock_init(&qp->state_lock); =20 + spin_lock_init(&qp->req.task.state_lock); + spin_lock_init(&qp->resp.task.state_lock); + spin_lock_init(&qp->comp.task.state_lock); + + spin_lock_init(&qp->sq.sq_lock); + spin_lock_init(&qp->rq.producer_lock); + spin_lock_init(&qp->rq.consumer_lock); + atomic_set(&qp->ssn, 0); atomic_set(&qp->skb_out, 0); } @@ -267,7 +275,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct = rxe_qp *qp, qp->req.opcode =3D -1; qp->comp.opcode =3D -1; =20 - spin_lock_init(&qp->sq.sq_lock); skb_queue_head_init(&qp->req_pkts); =20 rxe_init_task(rxe, &qp->req.task, qp, @@ -317,9 +324,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct= rxe_qp *qp, } } =20 - spin_lock_init(&qp->rq.producer_lock); - spin_lock_init(&qp->rq.consumer_lock); - skb_queue_head_init(&qp->resp_pkts); =20 rxe_init_task(rxe, &qp->resp.task, qp, --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A9723C32772 for ; Tue, 23 Aug 2022 09:52:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242675AbiHWJwO (ORCPT ); Tue, 23 Aug 2022 05:52:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55438 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1347526AbiHWJum (ORCPT ); Tue, 23 Aug 2022 05:50:42 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0CBE99D8D7; Tue, 23 Aug 2022 01:45:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AEA316156B; Tue, 23 Aug 2022 08:45:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 71D34C433D6; Tue, 23 Aug 2022 08:45:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244302; bh=YlTI9DmHwU0RitNQw6RsPnRquoOs7ihx7xRrzv0p7Qc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v9j9pYmP9Rawba+ucIGpLFnVqhQv6VuEUDZjrXP80Msa+ChfWBg4pUOyqReRd0GIq /32LquGnbsOd5yWT6WT/gLbwnPRtm114crVrWA3wiZRAJ1ujo1ogY1KmtH+JyOGNU8 eQZfckoPyH51KCfzUL2qY+pSumQ+3MZ109cARmVg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Li Lingfeng , Jan Kara , Theodore Tso , Sasha Levin Subject: [PATCH 4.14 116/229] ext4: recover csum seed of tmp_inode after migrating to extents Date: Tue, 23 Aug 2022 10:24:37 +0200 Message-Id: <20220823080057.826514577@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Li Lingfeng [ Upstream commit 07ea7a617d6b278fb7acedb5cbe1a81ce2de7d0c ] When migrating to extents, the checksum seed of temporary inode need to be replaced by inode's, otherwise the inode checksums will be incorrect when swapping the inodes data. However, the temporary inode can not match it's checksum to itself since it has lost it's own checksum seed. mkfs.ext4 -F /dev/sdc mount /dev/sdc /mnt/sdc xfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/sdc/testfile chattr -e /mnt/sdc/testfile chattr +e /mnt/sdc/testfile umount /dev/sdc fsck -fn /dev/sdc =3D=3D=3D=3D=3D=3D=3D=3D ... Pass 1: Checking inodes, blocks, and sizes Inode 13 passes checks, but checksum does not match inode. Fix? no ... =3D=3D=3D=3D=3D=3D=3D=3D The fix is simple, save the checksum seed of temporary inode, and recover it after migrating to extents. Fixes: e81c9302a6c3 ("ext4: set csum seed in tmp inode while migrating to e= xtents") Signed-off-by: Li Lingfeng Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220617062515.2113438-1-lilingfeng3@huawei= .com Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/ext4/migrate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c index b6e9d56696ef..5849bf2c41ad 100644 --- a/fs/ext4/migrate.c +++ b/fs/ext4/migrate.c @@ -442,7 +442,7 @@ int ext4_ext_migrate(struct inode *inode) struct inode *tmp_inode =3D NULL; struct migrate_struct lb; unsigned long max_entries; - __u32 goal; + __u32 goal, tmp_csum_seed; uid_t owner[2]; =20 /* @@ -490,6 +490,7 @@ int ext4_ext_migrate(struct inode *inode) * the migration. */ ei =3D EXT4_I(inode); + tmp_csum_seed =3D EXT4_I(tmp_inode)->i_csum_seed; EXT4_I(tmp_inode)->i_csum_seed =3D ei->i_csum_seed; i_size_write(tmp_inode, i_size_read(inode)); /* @@ -600,6 +601,7 @@ int ext4_ext_migrate(struct inode *inode) * the inode is not visible to user space. */ tmp_inode->i_blocks =3D 0; + EXT4_I(tmp_inode)->i_csum_seed =3D tmp_csum_seed; =20 /* Reset the extent details */ ext4_ext_tree_init(handle, tmp_inode); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07341C32772 for ; Tue, 23 Aug 2022 09:55:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241964AbiHWJy5 (ORCPT ); Tue, 23 Aug 2022 05:54:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39328 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239498AbiHWJvp (ORCPT ); Tue, 23 Aug 2022 05:51:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 57B739F199; Tue, 23 Aug 2022 01:46:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0FDFE61538; Tue, 23 Aug 2022 08:45:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1C088C433D6; Tue, 23 Aug 2022 08:45:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244308; bh=RV5lvrGojSt03S8hfAZkFwEi+RNIqI0sjsluXw/4lY0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rcunCx1iXGi9M6ZC2V07KBb7hoVFdSI0K955khr1sqboeW5x/NHXEZLN4wK66coBv 6VC1mXnNr/zZjmAtEd5f93ogR6jOXCaBWk3stNwv3sOOqhuG6IHB6UADzNe/x5UuEM R7eHfZBFsAa6v3V4EDGzF+oyrCP5RQeruG4ybr/8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhihao Cheng , Theodore Tso , Sasha Levin Subject: [PATCH 4.14 117/229] jbd2: fix assertion jh->b_frozen_data == NULL failure when journal aborted Date: Tue, 23 Aug 2022 10:24:38 +0200 Message-Id: <20220823080057.872861919@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhihao Cheng [ Upstream commit 4a734f0869f970b8a9b65062ea40b09a5da9dba8 ] Following process will fail assertion 'jh->b_frozen_data =3D=3D NULL' in jbd2_journal_dirty_metadata(): jbd2_journal_commit_transaction unlink(dir/a) jh->b_transaction =3D trans1 jh->b_jlist =3D BJ_Metadata journal->j_running_transaction =3D NULL trans1->t_state =3D T_COMMIT unlink(dir/b) handle->h_trans =3D trans2 do_get_write_access jh->b_modified =3D 0 jh->b_frozen_data =3D frozen_buffer jh->b_next_transaction =3D trans2 jbd2_journal_dirty_metadata is_handle_aborted is_journal_aborted // return false --> jbd2 abort <-- while (commit_transaction->t_buffers) if (is_journal_aborted) jbd2_journal_refile_buffer __jbd2_journal_refile_buffer WRITE_ONCE(jh->b_transaction, jh->b_next_transaction) WRITE_ONCE(jh->b_next_transaction, NULL) __jbd2_journal_file_buffer(jh, BJ_Reserved) J_ASSERT_JH(jh, jh->b_frozen_data =3D=3D NULL) // assertion failure= ! The reproducer (See detail in [Link]) reports: ------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1629! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 2 PID: 584 Comm: unlink Tainted: G W 5.19.0-rc6-00115-g4a57a8400075-dirty #697 RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470 RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202 Call Trace: __ext4_handle_dirty_metadata+0xa0/0x290 ext4_handle_dirty_dirblock+0x10c/0x1d0 ext4_delete_entry+0x104/0x200 __ext4_unlink+0x22b/0x360 ext4_unlink+0x275/0x390 vfs_unlink+0x20b/0x4c0 do_unlinkat+0x42f/0x4c0 __x64_sys_unlink+0x37/0x50 do_syscall_64+0x35/0x80 After journal aborting, __jbd2_journal_refile_buffer() is executed with holding @jh->b_state_lock, we can fix it by moving 'is_handle_aborted()' into the area protected by @jh->b_state_lock. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D216251 Fixes: 470decc613ab20 ("[PATCH] jbd2: initial copy of files from jbd") Signed-off-by: Zhihao Cheng Link: https://lore.kernel.org/r/20220715125152.4022726-1-chengzhihao1@huawe= i.com Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/jbd2/transaction.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index 3311b1e684de..7eb4f7c0a43b 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -1338,8 +1338,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, str= uct buffer_head *bh) struct journal_head *jh; int ret =3D 0; =20 - if (is_handle_aborted(handle)) - return -EROFS; if (!buffer_jbd(bh)) return -EUCLEAN; =20 @@ -1386,6 +1384,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, st= ruct buffer_head *bh) journal =3D transaction->t_journal; jbd_lock_bh_state(bh); =20 + if (is_handle_aborted(handle)) { + /* + * Check journal aborting with @jh->b_state_lock locked, + * since 'jh->b_transaction' could be replaced with + * 'jh->b_next_transaction' during old transaction + * committing if journal aborted, which may fail + * assertion on 'jh->b_frozen_data =3D=3D NULL'. + */ + ret =3D -EROFS; + goto out_unlock_bh; + } + if (jh->b_modified =3D=3D 0) { /* * This buffer's got modified and becoming part --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3D25C38145 for ; Tue, 23 Aug 2022 09:57:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243439AbiHWJ5r (ORCPT ); Tue, 23 Aug 2022 05:57:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37310 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243219AbiHWJwj (ORCPT ); Tue, 23 Aug 2022 05:52:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F04C37B78A; Tue, 23 Aug 2022 01:46:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8282CB81C53; Tue, 23 Aug 2022 08:45:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E690AC433C1; Tue, 23 Aug 2022 08:45:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244314; bh=OIFz9Puy2x0e9AK+d1L7NJn2m8YPZnlzGVGHvm1SSgI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mtK2VeYkMUPGo7bihZHvYN48T03TepmRCSYPYZRsDiKKpypI1P/dEKVAsUV/1rWN+ TOviHoiExTcQv7OUe6crxPABS9510xdvw6EkrmJz0oUWiddmIHcAsxqPajj5ABAE0j /Eo4a09bV1uF+QFr/8Vfi5BVRcP3DXyUSD1qksLE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Mark Brown , Sasha Levin Subject: [PATCH 4.14 118/229] ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe Date: Tue, 23 Aug 2022 10:24:39 +0200 Message-Id: <20220823080057.908983731@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit ae4f11c1ed2d67192fdf3d89db719ee439827c11 ] of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Fix missing of_node_put() in error paths. Fixes: 94319ba10eca ("ASoC: mediatek: Use platform_of_node for machine driv= ers") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220602034144.60159-1-linmq006@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/m= ediatek/mt8173/mt8173-rt5650-rt5676.c index 61b0d8f8678e..90606b177eaf 100644 --- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c @@ -255,14 +255,16 @@ static int mt8173_rt5650_rt5676_dev_probe(struct plat= form_device *pdev) if (!mt8173_rt5650_rt5676_codecs[0].of_node) { dev_err(&pdev->dev, "Property 'audio-codec' missing or invalid\n"); - return -EINVAL; + ret =3D -EINVAL; + goto put_node; } mt8173_rt5650_rt5676_codecs[1].of_node =3D of_parse_phandle(pdev->dev.of_node, "mediatek,audio-codec", 1); if (!mt8173_rt5650_rt5676_codecs[1].of_node) { dev_err(&pdev->dev, "Property 'audio-codec' missing or invalid\n"); - return -EINVAL; + ret =3D -EINVAL; + goto put_node; } mt8173_rt5650_rt5676_codec_conf[0].of_node =3D mt8173_rt5650_rt5676_codecs[1].of_node; @@ -275,7 +277,8 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platfo= rm_device *pdev) if (!mt8173_rt5650_rt5676_dais[DAI_LINK_HDMI_I2S].codec_of_node) { dev_err(&pdev->dev, "Property 'audio-codec' missing or invalid\n"); - return -EINVAL; + ret =3D -EINVAL; + goto put_node; } =20 card->dev =3D &pdev->dev; @@ -285,6 +288,7 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platfo= rm_device *pdev) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); =20 +put_node: of_node_put(platform_node); return ret; } --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA09EC32772 for ; Tue, 23 Aug 2022 09:52:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242701AbiHWJww (ORCPT ); Tue, 23 Aug 2022 05:52:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40562 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351841AbiHWJu5 (ORCPT ); Tue, 23 Aug 2022 05:50:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 04B8E61728; Tue, 23 Aug 2022 01:45:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7D07EB81C6C; Tue, 23 Aug 2022 08:45:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DC41DC433D6; Tue, 23 Aug 2022 08:45:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244320; bh=EjuNj/W6yvY3QRPw/sASGRs/Haf5FAtW1SwjLFbn8ho=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i7uOU+xhTlDzZmi6sIsZ1a1qhCRfratKmUHXgCSrbgnOn7ZsWAn/MU0dKFmT0uZWb pR6p0DnTBmwfqqV0UXOEPZP4xpO0Hpcea5LuLuNeq8yk/EzMabo9tGqGPeOC4NCy7U 7Yzwd5zDmRo0zWzD1BI2iRcy1istRL+p4eXunFmM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , Mark Brown , Sasha Levin Subject: [PATCH 4.14 119/229] ASoC: codecs: da7210: add check for i2c_add_driver Date: Tue, 23 Aug 2022 10:24:40 +0200 Message-Id: <20220823080057.953286886@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 82fa8f581a954ddeec1602bed9f8b4a09d100e6e ] As i2c_add_driver could return error if fails, it should be better to check the return value. However, if the CONFIG_I2C and CONFIG_SPI_MASTER are both true, the return value of i2c_add_driver will be covered by spi_register_driver. Therefore, it is necessary to add check and return error if fails. Fixes: aa0e25caafb7 ("ASoC: da7210: Add support for spi regmap") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20220531094712.2376759-1-jiasheng@iscas.ac.= cn Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/soc/codecs/da7210.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/codecs/da7210.c b/sound/soc/codecs/da7210.c index 1af443ccbc51..ba38ea99b1da 100644 --- a/sound/soc/codecs/da7210.c +++ b/sound/soc/codecs/da7210.c @@ -1351,6 +1351,8 @@ static int __init da7210_modinit(void) int ret =3D 0; #if IS_ENABLED(CONFIG_I2C) ret =3D i2c_add_driver(&da7210_i2c_driver); + if (ret) + return ret; #endif #if defined(CONFIG_SPI_MASTER) ret =3D spi_register_driver(&da7210_spi_driver); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 664BCC32772 for ; Tue, 23 Aug 2022 09:55:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243713AbiHWJzR (ORCPT ); Tue, 23 Aug 2022 05:55:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39318 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352418AbiHWJvn (ORCPT ); Tue, 23 Aug 2022 05:51:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EDB039F1B0; Tue, 23 Aug 2022 01:46:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C4B08611DD; Tue, 23 Aug 2022 08:45:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF40AC433D6; Tue, 23 Aug 2022 08:45:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244326; bh=8/wzdDxwian4GlLzRjVYAvBdcciAwFSp2Nmo8aCwUQs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TKb+ZfCI4W3Uj/EjpdyiME8rb/cWxYkgioCY4VDmjKyGylDxSuJesPZmazyQRIoSn c77R54zs0Thc3iQtJQTYuofDm96bMXc/XMcdJZWjoFZ/b59E/72xIGZBoxqb6+E48M K/QE3aEc/zqKQUUdcBFTFkeOC5xJuxjEE0viooD0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Mark Brown , Sasha Levin Subject: [PATCH 4.14 120/229] ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe Date: Tue, 23 Aug 2022 10:24:41 +0200 Message-Id: <20220823080057.990190594@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit efe2178d1a32492f99e7f1f2568eea5c88a85729 ] of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Fix refcount leak in some error paths. Fixes: 0f83f9296d5c ("ASoC: mediatek: Add machine driver for ALC5650 codec") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220603124243.31358-1-linmq006@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/soc/mediatek/mt8173/mt8173-rt5650.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek= /mt8173/mt8173-rt5650.c index 3492c02f72c1..0d01b0f945d1 100644 --- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c +++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c @@ -270,7 +270,8 @@ static int mt8173_rt5650_dev_probe(struct platform_devi= ce *pdev) if (!mt8173_rt5650_codecs[0].of_node) { dev_err(&pdev->dev, "Property 'audio-codec' missing or invalid\n"); - return -EINVAL; + ret =3D -EINVAL; + goto put_platform_node; } mt8173_rt5650_codecs[1].of_node =3D mt8173_rt5650_codecs[0].of_node; =20 @@ -287,7 +288,7 @@ static int mt8173_rt5650_dev_probe(struct platform_devi= ce *pdev) dev_err(&pdev->dev, "%s codec_capture_dai name fail %d\n", __func__, ret); - return ret; + goto put_platform_node; } mt8173_rt5650_codecs[1].dai_name =3D codec_capture_dai; } @@ -308,7 +309,8 @@ static int mt8173_rt5650_dev_probe(struct platform_devi= ce *pdev) if (!mt8173_rt5650_dais[DAI_LINK_HDMI_I2S].codec_of_node) { dev_err(&pdev->dev, "Property 'audio-codec' missing or invalid\n"); - return -EINVAL; + ret =3D -EINVAL; + goto put_platform_node; } card->dev =3D &pdev->dev; =20 @@ -317,6 +319,7 @@ static int mt8173_rt5650_dev_probe(struct platform_devi= ce *pdev) dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", __func__, ret); =20 +put_platform_node: of_node_put(platform_node); return ret; } --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F372C32792 for ; Tue, 23 Aug 2022 09:55:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244028AbiHWJzX (ORCPT ); Tue, 23 Aug 2022 05:55:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39846 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242564AbiHWJxx (ORCPT ); Tue, 23 Aug 2022 05:53:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E36F6E8A2; Tue, 23 Aug 2022 01:46:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4322B61499; Tue, 23 Aug 2022 08:45:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D07CC433C1; Tue, 23 Aug 2022 08:45:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244335; bh=/+eRUPMPZDWrhSIl0FMK0dBhrrqdcIZx5ZENoVmu4KY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JNE0I+humPVzjic7nZQqey3n0yMA+iqgJJhvqSp8KHJWbI/M2gguelXuFJceP1o1n 8BP4eTWQEa4WSXIVKCwjdju68Lt+QLP7Cw28Nd+zRdiQi2mfSChwUFgPYG/uY6VHiV R7/hosLko1swpAX36KznlY6ebusL5kapMXUJ10Xk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chen Zhongjin , Andrew Morton , Sasha Levin Subject: [PATCH 4.14 121/229] profiling: fix shift too large makes kernel panic Date: Tue, 23 Aug 2022 10:24:42 +0200 Message-Id: <20220823080058.031432587@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chen Zhongjin [ Upstream commit 0fe6ee8f123a4dfb529a5aff07536bb481f34043 ] 2d186afd04d6 ("profiling: fix shift-out-of-bounds bugs") limits shift value by [0, BITS_PER_LONG -1], which means [0, 63]. However, syzbot found that the max shift value should be the bit number of (_etext - _stext). If shift is outside of this, the "buffer_bytes" will be zero and will cause kzalloc(0). Then the kernel panics due to dereferencing the returned pointer 16. This can be easily reproduced by passing a large number like 60 to enable profiling and then run readprofile. LOGS: BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 6148067 P4D 6148067 PUD 6142067 PMD 0 PREEMPT SMP CPU: 4 PID: 184 Comm: readprofile Not tainted 5.18.0+ #162 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g= 2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_profile+0x104/0x220 RSP: 0018:ffffc900006fbe80 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff888006150000 RSI: 0000000000000001 RDI: ffffffff82aba4a0 RBP: 000000000188bb60 R08: 0000000000000010 R09: ffff888006151000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82aba4a0 R13: 0000000000000000 R14: ffffc900006fbf08 R15: 0000000000020c30 FS: 000000000188a8c0(0000) GS:ffff88803ed00000(0000) knlGS:00000000000000= 00 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 0000000006144000 CR4: 00000000000006e0 Call Trace: proc_reg_read+0x56/0x70 vfs_read+0x9a/0x1b0 ksys_read+0xa1/0xe0 ? fpregs_assert_state_consistent+0x1e/0x40 do_syscall_64+0x3a/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x4d4b4e RSP: 002b:00007ffebb668d58 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 000000000188a8a0 RCX: 00000000004d4b4e RDX: 0000000000000400 RSI: 000000000188bb60 RDI: 0000000000000003 RBP: 0000000000000003 R08: 000000000000006e R09: 0000000000000000 R10: 0000000000000041 R11: 0000000000000246 R12: 000000000188bb60 R13: 0000000000000400 R14: 0000000000000000 R15: 000000000188bb60 Modules linked in: CR2: 0000000000000010 Killed ---[ end trace 0000000000000000 ]--- Check prof_len in profile_init() to prevent it be zero. Link: https://lkml.kernel.org/r/20220531012854.229439-1-chenzhongjin@huawei= .com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Chen Zhongjin Signed-off-by: Andrew Morton Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- kernel/profile.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/profile.c b/kernel/profile.c index efa58f63dc1b..7fc621404230 100644 --- a/kernel/profile.c +++ b/kernel/profile.c @@ -108,6 +108,13 @@ int __ref profile_init(void) =20 /* only text is profiled */ prof_len =3D (_etext - _stext) >> prof_shift; + + if (!prof_len) { + pr_warn("profiling shift: %u too large\n", prof_shift); + prof_on =3D 0; + return -EINVAL; + } + buffer_bytes =3D prof_len*sizeof(atomic_t); =20 if (!alloc_cpumask_var(&prof_cpu_mask, GFP_KERNEL)) --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 594D2C32774 for ; Tue, 23 Aug 2022 09:57:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347526AbiHWJzl (ORCPT ); Tue, 23 Aug 2022 05:55:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40638 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245198AbiHWJyC (ORCPT ); Tue, 23 Aug 2022 05:54:02 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 993D19F771; Tue, 23 Aug 2022 01:46:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BB8AFB81C6B; Tue, 23 Aug 2022 08:45:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 29C6AC433D7; Tue, 23 Aug 2022 08:45:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244341; bh=O2zDbn/v9sPZbQ0Nub00ZEFgWG8A0udaqDTyS4cKKv4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KX3NWqZiL3RExFgU34fKOivjQxm19Cr8/BS3S+Q15PCBo8j5qJbfFftsxv9c/u5rA kVumWzgRHXwUB9qp5dGuJpMQHWlSPvz24AhvuLZBqeAqL4TRtmrVjSCvCQDb9BTMzL hiku1PWPE3QVS0A9yMiuBt3zvI+cRxJBLLj4+vik= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke , Sasha Levin Subject: [PATCH 4.14 122/229] tty: n_gsm: fix non flow control frames during mux flow off Date: Tue, 23 Aug 2022 10:24:43 +0200 Message-Id: <20220823080058.071747004@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke [ Upstream commit bec0224816d19abe4fe503586d16d51890540615 ] n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.4.6.3.6 states that FCoff stops the transmission on all channels except the control channel. This is already implemented in gsm_data_kick(). However, chapter 5.4.8.1 explains that this shall result in the same behavior as software flow control on the ldisc in advanced option mode. That means only flow control frames shall be sent during flow off. The current implementation does not consider this case. Change gsm_data_kick() to send only flow control frames if constipated to abide the standard. gsm_read_ea_val() and gsm_is_flow_ctrl_msg() are introduced as helper functions for this. It is planned to use gsm_read_ea_val() in later code cleanups for other functions, too. Fixes: c01af4fec2c8 ("n_gsm : Flow control handling in Mux driver") Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220701061652.39604-5-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 54 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 53 insertions(+), 1 deletion(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index c6cb185a5bdf..a838ec4f2715 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -422,6 +422,27 @@ static int gsm_read_ea(unsigned int *val, u8 c) return c & EA; } =20 +/** + * gsm_read_ea_val - read a value until EA + * @val: variable holding value + * @data: buffer of data + * @dlen: length of data + * + * Processes an EA value. Updates the passed variable and + * returns the processed data length. + */ +static unsigned int gsm_read_ea_val(unsigned int *val, const u8 *data, int= dlen) +{ + unsigned int len =3D 0; + + for (; dlen > 0; dlen--) { + len++; + if (gsm_read_ea(val, *data++)) + break; + } + return len; +} + /** * gsm_encode_modem - encode modem data bits * @dlci: DLCI to encode from @@ -669,6 +690,37 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *= gsm, u8 addr, int len, return m; } =20 +/** + * gsm_is_flow_ctrl_msg - checks if flow control message + * @msg: message to check + * + * Returns true if the given message is a flow control command of the + * control channel. False is returned in any other case. + */ +static bool gsm_is_flow_ctrl_msg(struct gsm_msg *msg) +{ + unsigned int cmd; + + if (msg->addr > 0) + return false; + + switch (msg->ctrl & ~PF) { + case UI: + case UIH: + cmd =3D 0; + if (gsm_read_ea_val(&cmd, msg->data + 2, msg->len - 2) < 1) + break; + switch (cmd & ~PF) { + case CMD_FCOFF: + case CMD_FCON: + return true; + } + break; + } + + return false; +} + /** * gsm_data_kick - poke the queue * @gsm: GSM Mux @@ -687,7 +739,7 @@ static void gsm_data_kick(struct gsm_mux *gsm, struct g= sm_dlci *dlci) int len; =20 list_for_each_entry_safe(msg, nmsg, &gsm->tx_list, list) { - if (gsm->constipated && msg->addr) + if (gsm->constipated && !gsm_is_flow_ctrl_msg(msg)) continue; if (gsm->encoding !=3D 0) { gsm->txframe[0] =3D GSM1_SOF; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EEF56C32774 for ; Tue, 23 Aug 2022 09:58:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244038AbiHWJ6J (ORCPT ); Tue, 23 Aug 2022 05:58:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41306 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243431AbiHWJwo (ORCPT ); Tue, 23 Aug 2022 05:52:44 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BCACF9E108; Tue, 23 Aug 2022 01:46:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 2FAC7CE1B51; Tue, 23 Aug 2022 08:45:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 47555C433C1; Tue, 23 Aug 2022 08:45:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244347; bh=0knbD/ImRv9PdrlmhmwIx+OgZjRdA+sNf0/I295lEzQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eOBW/kErdfoQGS9ZVZe79gQ6SxL6Az9dAVEb4pGVdCh8UBWhniE0RiqowtGA3LK14 wGaM2EObjdsC8ekUM9/jORo57BqxhlTd95mIOWlNbi+4MXc3ZoBJINYi1dlsVqi2r0 +bfZM0xilTcUwQCTlGkNjJnGVJooI0YecCgcsFHk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke , Sasha Levin Subject: [PATCH 4.14 123/229] tty: n_gsm: fix packet re-transmission without open control channel Date: Tue, 23 Aug 2022 10:24:44 +0200 Message-Id: <20220823080058.112909767@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke [ Upstream commit 4fae831b3a71fc5a44cc5c7d0b8c1267ee7659f5 ] In the current implementation control packets are re-transmitted even if the control channel closed down during T2. This is wrong. Check whether the control channel is open before re-transmitting any packets. Note that control channel open/close is handled by T1 and not T2 and remains unaffected by this. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220701061652.39604-7-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index a838ec4f2715..62af08e5caa5 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1394,7 +1394,7 @@ static void gsm_control_retransmit(unsigned long data) spin_lock_irqsave(&gsm->control_lock, flags); ctrl =3D gsm->pending_cmd; if (ctrl) { - if (gsm->cretries =3D=3D 0) { + if (gsm->cretries =3D=3D 0 || !gsm->dlci[0] || gsm->dlci[0]->dead) { gsm->pending_cmd =3D NULL; ctrl->error =3D -ETIMEDOUT; ctrl->done =3D 1; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B52ACC32774 for ; Tue, 23 Aug 2022 09:57:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241895AbiHWJ5V (ORCPT ); Tue, 23 Aug 2022 05:57:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42388 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346083AbiHWJyJ (ORCPT ); Tue, 23 Aug 2022 05:54:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4748D9FA90; Tue, 23 Aug 2022 01:46:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9427261377; Tue, 23 Aug 2022 08:45:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90B47C433C1; Tue, 23 Aug 2022 08:45:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244354; bh=THXOj36MzhJ+yi1Yw0TX0gh0da2JWEUKFOzW1NHTs9Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YlyTN1TWwfhfXVVVAVO97J18kVHm5B6NVnNCjYF8C10TKnRL455pC6TM5DvJgnKD7 FBP0uyNN5grk+eyK5sBmlI+v67PiXbGEEbIs22gFUhryFXiLA1C8EswGL1wSNziVf0 h/xFZ5KIVdRp4h2gsmAHzWRE56YetOEo7f1TcpVQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke , Sasha Levin Subject: [PATCH 4.14 124/229] tty: n_gsm: fix race condition in gsmld_write() Date: Tue, 23 Aug 2022 10:24:45 +0200 Message-Id: <20220823080058.148785851@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke [ Upstream commit 32dd59f96924f45e33bc79854f7a00679c0fa28e ] The function may be used by the user directly and also by the n_gsm internal functions. They can lead into a race condition which results in interleaved frames if both are writing at the same time. The receiving side is not able to decode those interleaved frames correctly. Add a lock around the low side tty write to avoid race conditions and frame interleaving between user originated writes and n_gsm writes. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220701061652.39604-9-daniel.starke@siemen= s.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 62af08e5caa5..18878ab707af 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2533,11 +2533,24 @@ static ssize_t gsmld_read(struct tty_struct *tty, s= truct file *file, static ssize_t gsmld_write(struct tty_struct *tty, struct file *file, const unsigned char *buf, size_t nr) { - int space =3D tty_write_room(tty); + struct gsm_mux *gsm =3D tty->disc_data; + unsigned long flags; + int space; + int ret; + + if (!gsm) + return -ENODEV; + + ret =3D -ENOBUFS; + spin_lock_irqsave(&gsm->tx_lock, flags); + space =3D tty_write_room(tty); if (space >=3D nr) - return tty->ops->write(tty, buf, nr); - set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); - return -ENOBUFS; + ret =3D tty->ops->write(tty, buf, nr); + else + set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); + spin_unlock_irqrestore(&gsm->tx_lock, flags); + + return ret; } =20 /** --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 58051C32772 for ; Tue, 23 Aug 2022 09:57:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243149AbiHWJ5k (ORCPT ); Tue, 23 Aug 2022 05:57:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41962 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243182AbiHWJw0 (ORCPT ); Tue, 23 Aug 2022 05:52:26 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5B28F6E2CE; Tue, 23 Aug 2022 01:46:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B577D6155E; Tue, 23 Aug 2022 08:46:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B8BF0C433C1; Tue, 23 Aug 2022 08:45:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244360; bh=sU7kMdmw1T09diqjB56YXbqQYh3v9L7FstmGIRDNvRE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zMw3wJRGH1XfcLV7tRs/DVnqA/5DPZ/Ag2xcrhp3fGyQLRnBDmXfRsAMWN+GM7Agj OVwOjv1vsojLK3UIOMXrg9z6Lo81RCOuezB8eXaHhLTxfgS+rRBzQxM1bxPxj+xh+n +nrjq64riDSAAqniImMFFEGprHsqtDUvNsHaL6AI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sireesh Kodali , Bjorn Andersson , Sasha Levin Subject: [PATCH 4.14 125/229] remoteproc: qcom: wcnss: Fix handling of IRQs Date: Tue, 23 Aug 2022 10:24:46 +0200 Message-Id: <20220823080058.188394524@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sireesh Kodali [ Upstream commit bed0adac1ded4cb486ba19a3a7e730fbd9a1c9c6 ] The wcnss_get_irq function is expected to return a value > 0 in the event that an IRQ is succssfully obtained, but it instead returns 0. This causes the stop and ready IRQs to never actually be used despite being defined in the device-tree. This patch fixes that. Fixes: aed361adca9f ("remoteproc: qcom: Introduce WCNSS peripheral image lo= ader") Signed-off-by: Sireesh Kodali Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220526141740.15834-2-sireeshkodali1@gmail= .com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/remoteproc/qcom_wcnss.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcns= s.c index bc399fb29592..bb11419ff151 100644 --- a/drivers/remoteproc/qcom_wcnss.c +++ b/drivers/remoteproc/qcom_wcnss.c @@ -418,6 +418,7 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss, irq_handler_t thread_fn) { int ret; + int irq_number; =20 ret =3D platform_get_irq_byname(pdev, name); if (ret < 0 && optional) { @@ -428,14 +429,19 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss, return ret; } =20 + irq_number =3D ret; + ret =3D devm_request_threaded_irq(&pdev->dev, ret, NULL, thread_fn, IRQF_TRIGGER_RISING | IRQF_ONESHOT, "wcnss", wcnss); - if (ret) + if (ret) { dev_err(&pdev->dev, "request %s IRQ failed\n", name); + return ret; + } =20 - return ret; + /* Return the IRQ number if the IRQ was successfully acquired */ + return irq_number; } =20 static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss) --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20FCCC32772 for ; Tue, 23 Aug 2022 09:57:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244202AbiHWJz2 (ORCPT ); Tue, 23 Aug 2022 05:55:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41876 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242379AbiHWJx5 (ORCPT ); Tue, 23 Aug 2022 05:53:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C8939F740; Tue, 23 Aug 2022 01:46:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4A36B6155F; Tue, 23 Aug 2022 08:46:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3FA32C433C1; Tue, 23 Aug 2022 08:46:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244369; bh=TaPJ4kc6OvyZg5v07Qk2Re/qWXyqol4GpwkVdT9s3g8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qi88/mNYd76D474uq1KgZeyk1TdomcRnL2p+rnvl1oTzRWEtft2gdckcU8zunspl5 PUWMmDNzejdFtrjqn/l6zeBOvpGBTUqcNJKnvX8Zimu+AUClwtu/1IE790OcYH4gZ1 +a9GeknrZ+hz6cIvXIcVu/sdETuA0qK6nQ0/jVJE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Farman , Matthew Rosato , Alex Williamson , Sasha Levin Subject: [PATCH 4.14 126/229] vfio/ccw: Do not change FSM state in subchannel event Date: Tue, 23 Aug 2022 10:24:47 +0200 Message-Id: <20220823080058.227731798@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Farman [ Upstream commit cffcc109fd682075dee79bade3d60a07152a8fd1 ] The routine vfio_ccw_sch_event() is tasked with handling subchannel events, specifically machine checks, on behalf of vfio-ccw. It correctly calls cio_update_schib(), and if that fails (meaning the subchannel is gone) it makes an FSM event call to mark the subchannel Not Operational. If that worked, however, then it decides that if the FSM state was already Not Operational (implying the subchannel just came back), then it should simply change the FSM to partially- or fully-open. Remove this trickery, since a subchannel returning will require more probing than simply "oh all is well again" to ensure it works correctly. Fixes: bbe37e4cb8970 ("vfio: ccw: introduce a finite state machine") Signed-off-by: Eric Farman Reviewed-by: Matthew Rosato Link: https://lore.kernel.org/r/20220707135737.720765-4-farman@linux.ibm.com Signed-off-by: Alex Williamson Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/s390/cio/vfio_ccw_drv.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_dr= v.c index 6cd41086f23e..4b5cdbdcd843 100644 --- a/drivers/s390/cio/vfio_ccw_drv.c +++ b/drivers/s390/cio/vfio_ccw_drv.c @@ -193,19 +193,11 @@ static int vfio_ccw_sch_event(struct subchannel *sch,= int process) if (work_pending(&sch->todo_work)) goto out_unlock; =20 - if (cio_update_schib(sch)) { - vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER); - rc =3D 0; - goto out_unlock; - } - - private =3D dev_get_drvdata(&sch->dev); - if (private->state =3D=3D VFIO_CCW_STATE_NOT_OPER) { - private->state =3D private->mdev ? VFIO_CCW_STATE_IDLE : - VFIO_CCW_STATE_STANDBY; - } rc =3D 0; =20 + if (cio_update_schib(sch)) + vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_NOT_OPER); + out_unlock: spin_unlock_irqrestore(sch->lock, flags); =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A100C3F6B0 for ; Tue, 23 Aug 2022 09:57:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346130AbiHWJzg (ORCPT ); Tue, 23 Aug 2022 05:55:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42056 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245098AbiHWJyB (ORCPT ); Tue, 23 Aug 2022 05:54:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4CCF09F76C; Tue, 23 Aug 2022 01:46:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0BDF56123D; Tue, 23 Aug 2022 08:46:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 16BFEC433D6; Tue, 23 Aug 2022 08:46:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244375; bh=3mDep3EEArUyGh+iEsrWRUzpbM71FoBb0/Y1L3xRGi0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kXtligK/Scd3GaqhcqiRY3tm+VF/UoTnL+iqds+Pw1Iy1h8B2HyCbuXJC2mB89+s1 qS3fmVjJpLNOVwLFaVzwdxC6Bk4EjnnfBV1+RWfSH4K8YTDRSkmLeY4osGm093PCQB s5fmPeOk5so8fs5x96Z2LW/Wqci/q85XErlrLe7k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke , Sasha Levin Subject: [PATCH 4.14 127/229] tty: n_gsm: fix wrong T1 retry count handling Date: Tue, 23 Aug 2022 10:24:48 +0200 Message-Id: <20220823080058.268266364@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke [ Upstream commit f30e10caa80aa1f35508bc17fc302dbbde9a833c ] n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.7.3 states that the valid range for the maximum number of retransmissions (N2) is from 0 to 255 (both including). gsm_dlci_t1() handles this number incorrectly by performing N2 - 1 retransmission attempts. Setting N2 to zero results in more than 255 retransmission attempts. Fix gsm_dlci_t1() to comply with 3GPP 27.010. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220707113223.3685-1-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 18878ab707af..5f5a7ad4c46a 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1546,8 +1546,8 @@ static void gsm_dlci_t1(unsigned long data) =20 switch (dlci->state) { case DLCI_OPENING: - dlci->retries--; if (dlci->retries) { + dlci->retries--; gsm_command(dlci->gsm, dlci->addr, SABM|PF); mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); } else if (!dlci->addr && gsm->control =3D=3D (DM | PF)) { @@ -1562,8 +1562,8 @@ static void gsm_dlci_t1(unsigned long data) =20 break; case DLCI_CLOSING: - dlci->retries--; if (dlci->retries) { + dlci->retries--; gsm_command(dlci->gsm, dlci->addr, DISC|PF); mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); } else --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5D67C3F6B0 for ; Tue, 23 Aug 2022 10:04:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352200AbiHWKEp (ORCPT ); Tue, 23 Aug 2022 06:04:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351769AbiHWKAg (ORCPT ); Tue, 23 Aug 2022 06:00:36 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9884FCD2; Tue, 23 Aug 2022 01:48:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E48BBB81C28; Tue, 23 Aug 2022 08:48:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 144D0C433C1; Tue, 23 Aug 2022 08:48:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244496; bh=urTZsfCXeDz7WoRcA6SCxIYIvurGxHNJ0Xuosy9QH3E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JWXSq3BMOH938qrTOe9PffYlIYyFX84Th0EDh7rFUhwT/byMisNKS1h7drqh1hcr0 O4tMs/e3MEHgLslTitYZygo8dYLMBZP7LLswqurIwocnEIVaQV+phc1tXGUhmSKzim k/1dspRg/8PhfS0AQdztgHRJDQ16g5WiDVrGLf60= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke , Sasha Levin Subject: [PATCH 4.14 128/229] tty: n_gsm: fix DM command Date: Tue, 23 Aug 2022 10:24:49 +0200 Message-Id: <20220823080058.298743401@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Starke [ Upstream commit 18a948c7d90995d127785e308fa7b701df4c499f ] n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.3.3 defines the DM response. There exists no DM command. However, the current implementation incorrectly sends DM as command in case of unexpected UIH frames in gsm_queue(). Correct this behavior by always sending DM as response. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220707113223.3685-2-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/n_gsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c index 5f5a7ad4c46a..1d50f3ab4e5a 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1906,7 +1906,7 @@ static void gsm_queue(struct gsm_mux *gsm) goto invalid; #endif if (dlci =3D=3D NULL || dlci->state !=3D DLCI_OPEN) { - gsm_command(gsm, address, DM|PF); + gsm_response(gsm, address, DM|PF); return; } dlci->data(dlci, gsm->buf, gsm->len); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F612C32792 for ; Tue, 23 Aug 2022 10:06:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352130AbiHWKG5 (ORCPT ); Tue, 23 Aug 2022 06:06:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43776 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352379AbiHWKBt (ORCPT ); Tue, 23 Aug 2022 06:01:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 796A49AFB3; Tue, 23 Aug 2022 01:49:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 31C5461377; Tue, 23 Aug 2022 08:49:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 25230C433C1; Tue, 23 Aug 2022 08:49:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244565; bh=sxbDryvPEIEmBnIz8HeE+kR0f8qisaLYYvklp0l/9+8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fKGGTZ0Pt6e6UtMOnmI/YXvyKbzIbRK8oCNztkkwF4QQHPa3MqxBNZEho+oSChKWr CZ4oDzz0LlMVw27X9stBFRHDeWphwzKF9QGPA/2lwMzUqsGmfJnK7cf1EG7AOiRp43 AL87kq0TvHhePUg8aQaETIOFtiLLvUKKbtCVOnmw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sam Protsenko , Krzysztof Kozlowski , Marek Szyprowski , Joerg Roedel , Sasha Levin Subject: [PATCH 4.14 129/229] iommu/exynos: Handle failed IOMMU device registration properly Date: Tue, 23 Aug 2022 10:24:50 +0200 Message-Id: <20220823080058.330949128@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sam Protsenko [ Upstream commit fce398d2d02c0a9a2bedf7c7201b123e153e8963 ] If iommu_device_register() fails in exynos_sysmmu_probe(), the previous calls have to be cleaned up. In this case, the iommu_device_sysfs_add() should be cleaned up, by calling its remove counterpart call. Fixes: d2c302b6e8b1 ("iommu/exynos: Make use of iommu_device_register inter= face") Signed-off-by: Sam Protsenko Reviewed-by: Krzysztof Kozlowski Acked-by: Marek Szyprowski Link: https://lore.kernel.org/r/20220714165550.8884-3-semen.protsenko@linar= o.org Signed-off-by: Joerg Roedel Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/iommu/exynos-iommu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c index f4ebef29c644..b1b797fd9d3b 100644 --- a/drivers/iommu/exynos-iommu.c +++ b/drivers/iommu/exynos-iommu.c @@ -638,7 +638,7 @@ static int __init exynos_sysmmu_probe(struct platform_d= evice *pdev) =20 ret =3D iommu_device_register(&data->iommu); if (ret) - return ret; + goto err_iommu_register; =20 platform_set_drvdata(pdev, data); =20 @@ -665,6 +665,10 @@ static int __init exynos_sysmmu_probe(struct platform_= device *pdev) pm_runtime_enable(dev); =20 return 0; + +err_iommu_register: + iommu_device_sysfs_remove(&data->iommu); + return ret; } =20 static int __maybe_unused exynos_sysmmu_suspend(struct device *dev) --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84F19C32796 for ; Tue, 23 Aug 2022 10:07:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352334AbiHWKH0 (ORCPT ); Tue, 23 Aug 2022 06:07:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59032 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352419AbiHWKBx (ORCPT ); Tue, 23 Aug 2022 06:01:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 803518689D; Tue, 23 Aug 2022 01:49:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 89FC361377; Tue, 23 Aug 2022 08:49:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8C835C433C1; Tue, 23 Aug 2022 08:49:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244581; bh=qg+/edhD8Dj7xYw7+5T+IE/jl2tVylbiDANkfdB+QyI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XWActTxssoXAYItvce5FDiHp084N0SO/fLQzjev1KwE4YE3bBvfQ6BD/Uv31Toyss Mj3EvA1JMi0oFP+t4CtLMYreIyyPINwR8McAmpz3swzIhmtbLvhX8hbpdqDy6B0C9j Hjv2ovIn0XNsvsfky/UOLDfuPmA2vIZH2Qp9J42g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Stefani Seibold , Randy Dunlap , Andrew Morton , Sasha Levin Subject: [PATCH 4.14 130/229] kfifo: fix kfifo_to_user() return type Date: Tue, 23 Aug 2022 10:24:51 +0200 Message-Id: <20220823080058.362416018@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit 045ed31e23aea840648c290dbde04797064960db ] The kfifo_to_user() macro is supposed to return zero for success or negative error codes. Unfortunately, there is a signedness bug so it returns unsigned int. This only affects callers which try to save the result in ssize_t and as far as I can see the only place which does that is line6_hwdep_read(). TL;DR: s/_uint/_int/. Link: https://lkml.kernel.org/r/YrVL3OJVLlNhIMFs@kili Fixes: 144ecf310eb5 ("kfifo: fix kfifo_alloc() to return a signed int value= ") Signed-off-by: Dan Carpenter Cc: Stefani Seibold Cc: Randy Dunlap Signed-off-by: Andrew Morton Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/linux/kfifo.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/kfifo.h b/include/linux/kfifo.h index 86b5fb08e96c..d1781f35dea4 100644 --- a/include/linux/kfifo.h +++ b/include/linux/kfifo.h @@ -629,7 +629,7 @@ __kfifo_uint_must_check_helper( \ * writer, you don't need extra locking to use these macro. */ #define kfifo_to_user(fifo, to, len, copied) \ -__kfifo_uint_must_check_helper( \ +__kfifo_int_must_check_helper( \ ({ \ typeof((fifo) + 1) __tmp =3D (fifo); \ void __user *__to =3D (to); \ --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A8AFC32772 for ; Tue, 23 Aug 2022 09:59:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346072AbiHWJ7D (ORCPT ); Tue, 23 Aug 2022 05:59:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39318 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243444AbiHWJzL (ORCPT ); Tue, 23 Aug 2022 05:55:11 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 561B59FAB4; Tue, 23 Aug 2022 01:46:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 676176123D; Tue, 23 Aug 2022 08:46:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 635A0C433D6; Tue, 23 Aug 2022 08:46:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244395; bh=Wzr+JB/02qNfpc37gBcPQ8swNJmNAsWFgLjpwRHAugI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rgHnh8ppKdG/z3celZZ/uCVA5qzIH7VZQwIyaUReawTdK/p+rV9DHvx9lRiVyt67K sawSj0aBtPHjHSPYrcVPb8pkuRw4k83iePLwPRhmEEzkRb0+KRIUECMDyl55Z9rs8z cej/w6LUVfHxFSL6jjdqLA1PAezHaCh5dHskA1jw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= , Lee Jones , Sasha Levin Subject: [PATCH 4.14 131/229] mfd: t7l66xb: Drop platform disable callback Date: Tue, 23 Aug 2022 10:24:52 +0200 Message-Id: <20220823080058.392543628@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Uwe Kleine-K=C3=B6nig [ Upstream commit 128ac294e1b437cb8a7f2ff8ede1cde9082bddbe ] None of the in-tree instantiations of struct t7l66xb_platform_data provides a disable callback. So better don't dereference this function pointer unconditionally. As there is no user, drop it completely instead of calling it conditional. This is a preparation for making platform remove callbacks return void. Fixes: 1f192015ca5b ("mfd: driver for the T7L66XB TMIO SoC") Signed-off-by: Uwe Kleine-K=C3=B6nig Signed-off-by: Lee Jones Link: https://lore.kernel.org/r/20220530192430.2108217-3-u.kleine-koenig@pe= ngutronix.de Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/mfd/t7l66xb.c | 6 +----- include/linux/mfd/t7l66xb.h | 1 - 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/drivers/mfd/t7l66xb.c b/drivers/mfd/t7l66xb.c index 43d8683266de..caa61649fe79 100644 --- a/drivers/mfd/t7l66xb.c +++ b/drivers/mfd/t7l66xb.c @@ -412,11 +412,8 @@ static int t7l66xb_probe(struct platform_device *dev) =20 static int t7l66xb_remove(struct platform_device *dev) { - struct t7l66xb_platform_data *pdata =3D dev_get_platdata(&dev->dev); struct t7l66xb *t7l66xb =3D platform_get_drvdata(dev); - int ret; =20 - ret =3D pdata->disable(dev); clk_disable_unprepare(t7l66xb->clk48m); clk_put(t7l66xb->clk48m); clk_disable_unprepare(t7l66xb->clk32k); @@ -427,8 +424,7 @@ static int t7l66xb_remove(struct platform_device *dev) mfd_remove_devices(&dev->dev); kfree(t7l66xb); =20 - return ret; - + return 0; } =20 static struct platform_driver t7l66xb_platform_driver =3D { diff --git a/include/linux/mfd/t7l66xb.h b/include/linux/mfd/t7l66xb.h index b4629818aea5..d4e7f0453c91 100644 --- a/include/linux/mfd/t7l66xb.h +++ b/include/linux/mfd/t7l66xb.h @@ -16,7 +16,6 @@ =20 struct t7l66xb_platform_data { int (*enable)(struct platform_device *dev); - int (*disable)(struct platform_device *dev); int (*suspend)(struct platform_device *dev); int (*resume)(struct platform_device *dev); =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88E27C32772 for ; Tue, 23 Aug 2022 09:59:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242395AbiHWJ72 (ORCPT ); Tue, 23 Aug 2022 05:59:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42174 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351651AbiHWJzv (ORCPT ); Tue, 23 Aug 2022 05:55:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA64C7B79C; Tue, 23 Aug 2022 01:46:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 31391611DD; Tue, 23 Aug 2022 08:46:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A025C433C1; Tue, 23 Aug 2022 08:46:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244402; bh=N9LI/p3/ykPwVyJdtF3lXCtojiqsjqPQIXbLITIPqhk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uGVDTExJuqYajGh9p7Px+R4eIX5lUKMRDQVQqnDHW00gXhQI2373lS3JrIxXRFT7w SmmAux0oy5lAttULTIEJtX840moEMl7IJOJKn4UEACpa3zGyc1PU9eCwVd6EgaKC6r SKyDaA0MidBArOfNNRK8nEGeWziMh/VysuJNOv0c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Will Deacon , Sasha Levin Subject: [PATCH 4.14 132/229] iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop Date: Tue, 23 Aug 2022 10:24:53 +0200 Message-Id: <20220823080058.423359732@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit a91eb6803c1c715738682fece095145cbd68fe0b ] In qcom_iommu_has_secure_context(), we should call of_node_put() for the reference 'child' when breaking out of for_each_child_of_node() which will automatically increase and decrease the refcount. Fixes: d051f28c8807 ("iommu/qcom: Initialize secure page table") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220719124955.1242171-1-windhl@126.com Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/iommu/qcom_iommu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/qcom_iommu.c b/drivers/iommu/qcom_iommu.c index 920a5df319bc..ad74f64d8876 100644 --- a/drivers/iommu/qcom_iommu.c +++ b/drivers/iommu/qcom_iommu.c @@ -745,9 +745,12 @@ static bool qcom_iommu_has_secure_context(struct qcom_= iommu_dev *qcom_iommu) { struct device_node *child; =20 - for_each_child_of_node(qcom_iommu->dev->of_node, child) - if (of_device_is_compatible(child, "qcom,msm-iommu-v1-sec")) + for_each_child_of_node(qcom_iommu->dev->of_node, child) { + if (of_device_is_compatible(child, "qcom,msm-iommu-v1-sec")) { + of_node_put(child); return true; + } + } =20 return false; } --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC885C32774 for ; Tue, 23 Aug 2022 09:59:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346836AbiHWJ7H (ORCPT ); Tue, 23 Aug 2022 05:59:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42568 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346985AbiHWJzh (ORCPT ); Tue, 23 Aug 2022 05:55:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 505689FAB6; Tue, 23 Aug 2022 01:46:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 18BA161485; Tue, 23 Aug 2022 08:46:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21ADFC433D6; Tue, 23 Aug 2022 08:46:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244408; bh=hKuHHiLafn/QwQz1nmKb0m+Sc2+ysGzFRZNdqguwTrI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lEq/DUBlLJs/KwS4ScFSMuWmSgWf8lZyUfDcKVcBmcVbvJiRb4vl5W2qpct0F57hq /mrPyDUjBxwOjrlLyw2s3r6FMBVMEy+WVk96AOCQdMHHJjWX9hkV55TKgqxU6/Rrmh 0eP+pJb+kqQcE5donPW1feJcKUioVip6KwEul09Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Matthew Wilcox , Heiko Carstens , Alexander Egorenkov , Alexander Gordeev , Sasha Levin Subject: [PATCH 4.14 133/229] s390/zcore: fix race when reading from hardware system area Date: Tue, 23 Aug 2022 10:24:54 +0200 Message-Id: <20220823080058.454139478@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Gordeev [ Upstream commit 9ffed254d938c9e99eb7761c7f739294c84e0367 ] Memory buffer used for reading out data from hardware system area is not protected against concurrent access. Reported-by: Matthew Wilcox Fixes: 411ed3225733 ("[S390] zfcpdump support.") Acked-by: Heiko Carstens Tested-by: Alexander Egorenkov Link: https://lore.kernel.org/r/e68137f0f9a0d2558f37becc20af18e2939934f6.16= 58206891.git.agordeev@linux.ibm.com Signed-off-by: Alexander Gordeev Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/s390/char/zcore.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c index aaed778f67c4..9748ef463233 100644 --- a/drivers/s390/char/zcore.c +++ b/drivers/s390/char/zcore.c @@ -53,6 +53,7 @@ static struct dentry *zcore_reipl_file; static struct dentry *zcore_hsa_file; static struct ipl_parameter_block *ipl_block; =20 +static DEFINE_MUTEX(hsa_buf_mutex); static char hsa_buf[PAGE_SIZE] __aligned(PAGE_SIZE); =20 /* @@ -69,19 +70,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long sr= c, size_t count) if (!hsa_available) return -ENODATA; =20 + mutex_lock(&hsa_buf_mutex); while (count) { if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { TRACE("sclp_sdias_copy() failed\n"); + mutex_unlock(&hsa_buf_mutex); return -EIO; } offset =3D src % PAGE_SIZE; bytes =3D min(PAGE_SIZE - offset, count); - if (copy_to_user(dest, hsa_buf + offset, bytes)) + if (copy_to_user(dest, hsa_buf + offset, bytes)) { + mutex_unlock(&hsa_buf_mutex); return -EFAULT; + } src +=3D bytes; dest +=3D bytes; count -=3D bytes; } + mutex_unlock(&hsa_buf_mutex); return 0; } =20 @@ -99,9 +105,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, si= ze_t count) if (!hsa_available) return -ENODATA; =20 + mutex_lock(&hsa_buf_mutex); while (count) { if (sclp_sdias_copy(hsa_buf, src / PAGE_SIZE + 2, 1)) { TRACE("sclp_sdias_copy() failed\n"); + mutex_unlock(&hsa_buf_mutex); return -EIO; } offset =3D src % PAGE_SIZE; @@ -111,6 +119,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, si= ze_t count) dest +=3D bytes; count -=3D bytes; } + mutex_unlock(&hsa_buf_mutex); return 0; } =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 017EAC32772 for ; Tue, 23 Aug 2022 09:59:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245098AbiHWJ7w (ORCPT ); Tue, 23 Aug 2022 05:59:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41814 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351921AbiHWJ4H (ORCPT ); Tue, 23 Aug 2022 05:56:07 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 646A8A0243; Tue, 23 Aug 2022 01:47:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EB304B81C28; Tue, 23 Aug 2022 08:46:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 51856C433D6; Tue, 23 Aug 2022 08:46:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244414; bh=UvjwmRJ+Iy/3UibiCRCyZWexNjPggbBD70mBSvpah3g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Cch7YNp0T0TL1qwWTO2jQXngLa0XirO+TvBjGM0AV1Hhs2jWlo9i7Ezxrj7PgSraa qoBHl6stNoNAfitU49efz1Gu+5OM/kk0xkXKbJ8mrmL5d7R5o//TnEbA6CBUeWgEg3 FwZSQtZe5blEGkapCVdai+fm7QxgmmDlIcwdHTAM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Helge Deller , Sasha Levin Subject: [PATCH 4.14 134/229] video: fbdev: amba-clcd: Fix refcount leak bugs Date: Tue, 23 Aug 2022 10:24:55 +0200 Message-Id: <20220823080058.486095665@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 26c2b7d9fac42eb8317f3ceefa4c1a9a9170ca69 ] In clcdfb_of_init_display(), we should call of_node_put() for the references returned by of_graph_get_next_endpoint() and of_graph_get_remote_port_parent() which have increased the refcount. Besides, we should call of_node_put() both in fail path or when the references are not used anymore. Fixes: d10715be03bd ("video: ARM CLCD: Add DT support") Signed-off-by: Liang He Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/video/fbdev/amba-clcd.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clc= d.c index 66c7d766e330..6e9c40cd820d 100644 --- a/drivers/video/fbdev/amba-clcd.c +++ b/drivers/video/fbdev/amba-clcd.c @@ -772,8 +772,10 @@ static int clcdfb_of_init_display(struct clcd_fb *fb) return -ENODEV; =20 panel =3D of_graph_get_remote_port_parent(endpoint); - if (!panel) - return -ENODEV; + if (!panel) { + err =3D -ENODEV; + goto out_endpoint_put; + } =20 if (fb->vendor->init_panel) { err =3D fb->vendor->init_panel(fb, panel); @@ -783,11 +785,11 @@ static int clcdfb_of_init_display(struct clcd_fb *fb) =20 err =3D clcdfb_of_get_backlight(panel, fb->panel); if (err) - return err; + goto out_panel_put; =20 err =3D clcdfb_of_get_mode(&fb->dev->dev, panel, fb->panel); if (err) - return err; + goto out_panel_put; =20 err =3D of_property_read_u32(fb->dev->dev.of_node, "max-memory-bandwidth", &max_bandwidth); @@ -816,11 +818,21 @@ static int clcdfb_of_init_display(struct clcd_fb *fb) =20 if (of_property_read_u32_array(endpoint, "arm,pl11x,tft-r0g0b0-pads", - tft_r0b0g0, ARRAY_SIZE(tft_r0b0g0)) !=3D 0) - return -ENOENT; + tft_r0b0g0, ARRAY_SIZE(tft_r0b0g0)) !=3D 0) { + err =3D -ENOENT; + goto out_panel_put; + } + + of_node_put(panel); + of_node_put(endpoint); =20 return clcdfb_of_init_tft_panel(fb, tft_r0b0g0[0], tft_r0b0g0[1], tft_r0b0g0[2]); +out_panel_put: + of_node_put(panel); +out_endpoint_put: + of_node_put(endpoint); + return err; } =20 static int clcdfb_of_vram_setup(struct clcd_fb *fb) --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8B08C32772 for ; Tue, 23 Aug 2022 10:00:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245327AbiHWKAG (ORCPT ); Tue, 23 Aug 2022 06:00:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42508 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351931AbiHWJ4H (ORCPT ); Tue, 23 Aug 2022 05:56:07 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1B2277B787; Tue, 23 Aug 2022 01:47:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3C15AB81C3A; Tue, 23 Aug 2022 08:47:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 652AEC433C1; Tue, 23 Aug 2022 08:46:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244421; bh=2gIMAlHBijR6NYq4wraQ4wNTunf1yxbOHYK0ZS1AzLE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=enGoV/+CTGqSxJc4LTtJjhras8Fr/Ir0lDnO47Lqp3NrDxn5gpnN0rEoaVbI83jfa Tp/cCFqSm8xMVwe3sD7QBDye1oFIHxZSnmcmxoEdVYwYdof4z+qyxxEDTrKWInDRYd 3BDY+efMSni+p8whS9XhIXM94VzFnVvLQ+8NzTKg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rustam Subkhankulov , Helge Deller , Sasha Levin Subject: [PATCH 4.14 135/229] video: fbdev: sis: fix typos in SiS_GetModeID() Date: Tue, 23 Aug 2022 10:24:56 +0200 Message-Id: <20220823080058.516562063@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rustam Subkhankulov [ Upstream commit 3eb8fccc244bfb41a7961969e4db280d44911226 ] The second operand of a '&&' operator has no impact on expression result for cases 400 and 512 in SiS_GetModeID(). Judging by the logic and the names of the variables, in both cases a typo was made. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Rustam Subkhankulov Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/video/fbdev/sis/init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c index fde27feae5d0..d6b2ce95a859 100644 --- a/drivers/video/fbdev/sis/init.c +++ b/drivers/video/fbdev/sis/init.c @@ -355,12 +355,12 @@ SiS_GetModeID(int VGAEngine, unsigned int VBFlags, in= t HDisplay, int VDisplay, } break; case 400: - if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >=3D 800) && (LCDwidth >=3D 60= 0))) { + if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >=3D 800) && (LCDheight >=3D 6= 00))) { if(VDisplay =3D=3D 300) ModeIndex =3D ModeIndex_400x300[Depth]; } break; case 512: - if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >=3D 1024) && (LCDwidth >=3D 7= 68))) { + if((!(VBFlags & CRT1_LCDA)) || ((LCDwidth >=3D 1024) && (LCDheight >=3D = 768))) { if(VDisplay =3D=3D 384) ModeIndex =3D ModeIndex_512x384[Depth]; } break; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3F6EC3F6B0 for ; Tue, 23 Aug 2022 10:00:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348024AbiHWKAV (ORCPT ); Tue, 23 Aug 2022 06:00:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56174 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351985AbiHWJ4M (ORCPT ); Tue, 23 Aug 2022 05:56:12 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9B723A0304; Tue, 23 Aug 2022 01:47:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 14C66CE1B51; Tue, 23 Aug 2022 08:47:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 27A0CC43470; Tue, 23 Aug 2022 08:47:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244430; bh=3B+TuonAqc41dsDgKO24WXZ1YqKkDx1ow3hiarHvoNU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CK6tzJF/e/7qTsU7Ku8k3hTVjd0Ftrqq8jo1LLCeAVKlHn3ZIe/yMSWKlV1BXbrkS ptLQJd61ReIISO+M7Y3KSj2/D39gdEHNSUnQtrxdrw6meM8dJETW6xzLm8aPna+ikq g8+l6kKKslOrdVTvi3ZrAaCDs9bHsF5LBA4NGQe0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Pali=20Roh=C3=A1r?= , Michael Ellerman , Sasha Levin Subject: [PATCH 4.14 136/229] powerpc/pci: Prefer PCI domain assignment via DT linux,pci-domain and alias Date: Tue, 23 Aug 2022 10:24:57 +0200 Message-Id: <20220823080058.547331087@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pali Roh=C3=A1r [ Upstream commit 0fe1e96fef0a5c53b4c0d1500d356f3906000f81 ] Other Linux architectures use DT property 'linux,pci-domain' for specifying fixed PCI domain of PCI controller specified in Device-Tree. And lot of Freescale powerpc boards have defined numbered pci alias in Device-Tree for every PCIe controller which number specify preferred PCI domain. So prefer usage of DT property 'linux,pci-domain' (via function of_get_pci_domain_nr()) and DT pci alias (via function of_alias_get_id()) on powerpc architecture for assigning PCI domain to PCI controller. Fixes: 63a72284b159 ("powerpc/pci: Assign fixed PHB number based on device-= tree properties") Signed-off-by: Pali Roh=C3=A1r Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220706102148.5060-2-pali@kernel.org Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/powerpc/kernel/pci-common.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-com= mon.c index 02831a396419..2e2cc80bf592 100644 --- a/arch/powerpc/kernel/pci-common.c +++ b/arch/powerpc/kernel/pci-common.c @@ -80,16 +80,30 @@ EXPORT_SYMBOL(get_pci_dma_ops); static int get_phb_number(struct device_node *dn) { int ret, phb_id =3D -1; - u32 prop_32; u64 prop; =20 /* * Try fixed PHB numbering first, by checking archs and reading - * the respective device-tree properties. Firstly, try powernv by - * reading "ibm,opal-phbid", only present in OPAL environment. + * the respective device-tree properties. Firstly, try reading + * standard "linux,pci-domain", then try reading "ibm,opal-phbid" + * (only present in powernv OPAL environment), then try device-tree + * alias and as the last try to use lower bits of "reg" property. */ - ret =3D of_property_read_u64(dn, "ibm,opal-phbid", &prop); + ret =3D of_get_pci_domain_nr(dn); + if (ret >=3D 0) { + prop =3D ret; + ret =3D 0; + } + if (ret) + ret =3D of_property_read_u64(dn, "ibm,opal-phbid", &prop); + if (ret) + ret =3D of_alias_get_id(dn, "pci"); + if (ret >=3D 0) { + prop =3D ret; + ret =3D 0; + } if (ret) { + u32 prop_32; ret =3D of_property_read_u32_index(dn, "reg", 1, &prop_32); prop =3D prop_32; } @@ -101,10 +115,7 @@ static int get_phb_number(struct device_node *dn) if ((phb_id >=3D 0) && !test_and_set_bit(phb_id, phb_bitmap)) return phb_id; =20 - /* - * If not pseries nor powernv, or if fixed PHB numbering tried to add - * the same PHB number twice, then fallback to dynamic PHB numbering. - */ + /* If everything fails then fallback to dynamic PHB numbering. */ phb_id =3D find_first_zero_bit(phb_bitmap, MAX_PHBS); BUG_ON(phb_id >=3D MAX_PHBS); set_bit(phb_id, phb_bitmap); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9A49C32796 for ; Tue, 23 Aug 2022 10:02:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351813AbiHWKAl (ORCPT ); Tue, 23 Aug 2022 06:00:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52674 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352190AbiHWJ4a (ORCPT ); Tue, 23 Aug 2022 05:56:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F3676A0332; Tue, 23 Aug 2022 01:47:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F3CC5B81C35; Tue, 23 Aug 2022 08:47:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B8F9C4347C; Tue, 23 Aug 2022 08:47:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244436; bh=teXgXwagCJhheI7Y+/QuiPceXborMnBt0F32WtrSM8E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xEjzXuya6OYYWVwFFGgsSQXB88X9n6rkg4dnu4/dmk0onySCZLcJfHKSif/yxv2Gm bHrN+rdc7ZzUjojOZbg05rNGl1xYeb4eEWAltQlifeZU1nA6MTGzVVdfcErw8MJoSY ef7to1si416t6DZTGdr7EWeqSY+DvWl+dWxPPH7I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Arnd Bergmann , Michael Ellerman , Sasha Levin Subject: [PATCH 4.14 137/229] powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader Date: Tue, 23 Aug 2022 10:24:58 +0200 Message-Id: <20220823080058.586853140@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 6ac059dacffa8ab2f7798f20e4bd3333890c541c ] of_find_node_by_path() returns remote device nodepointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: 0afacde3df4c ("[POWERPC] spufs: allow isolated mode apps by starting= the SPE loader") Signed-off-by: Miaoqian Lin Acked-by: Arnd Bergmann Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220603121543.22884-1-linmq006@gmail.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/powerpc/platforms/cell/spufs/inode.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platf= orms/cell/spufs/inode.c index 9558d725a99b..37ba89f2fd80 100644 --- a/arch/powerpc/platforms/cell/spufs/inode.c +++ b/arch/powerpc/platforms/cell/spufs/inode.c @@ -684,6 +684,7 @@ spufs_init_isolated_loader(void) return; =20 loader =3D of_get_property(dn, "loader", &size); + of_node_put(dn); if (!loader) return; =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 257C8C38145 for ; Tue, 23 Aug 2022 10:02:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351939AbiHWKA4 (ORCPT ); Tue, 23 Aug 2022 06:00:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56642 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352320AbiHWJ4n (ORCPT ); Tue, 23 Aug 2022 05:56:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 51F80A0300; Tue, 23 Aug 2022 01:47:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DC50B611DD; Tue, 23 Aug 2022 08:47:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E0335C433C1; Tue, 23 Aug 2022 08:47:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244444; bh=+EWlPLXccA8DIb+f4YN3r+iDOk1ctotMAa2U6XA4CPg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m3N1onIKnCCPtSUTvG5odikgIhNvyfQ9Nlm3ej8NtMO2gB+oYdt/uzW/Y+d04mgy4 Hx1g/1TNdZPxxpVvFae/BZoEaYGI5pkijQSWVviq8iKDx2jn4x5eWPJIxM3YYvYfHu NZSlWRbQFv3gMljPGU9czxhAqcaI+CV2vUcdgrZk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Michael Ellerman , Sasha Levin Subject: [PATCH 4.14 138/229] powerpc/xive: Fix refcount leak in xive_get_max_prio Date: Tue, 23 Aug 2022 10:24:59 +0200 Message-Id: <20220823080058.616954930@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 255b650cbec6849443ce2e0cdd187fd5e61c218c ] of_find_node_by_path() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Fixes: eac1e731b59e ("powerpc/xive: guest exploitation of the XIVE interrup= t controller") Signed-off-by: Miaoqian Lin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220605053225.56125-1-linmq006@gmail.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/powerpc/sysdev/xive/spapr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/sp= apr.c index 10235098a726..e9b8e06c9dce 100644 --- a/arch/powerpc/sysdev/xive/spapr.c +++ b/arch/powerpc/sysdev/xive/spapr.c @@ -569,6 +569,7 @@ static bool xive_get_max_prio(u8 *max_prio) } =20 reg =3D of_get_property(rootdn, "ibm,plat-res-int-priorities", &len); + of_node_put(rootdn); if (!reg) { pr_err("Failed to read 'ibm,plat-res-int-priorities' property\n"); return false; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54197C32772 for ; Tue, 23 Aug 2022 10:02:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352070AbiHWKBL (ORCPT ); Tue, 23 Aug 2022 06:01:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55800 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352382AbiHWJ4v (ORCPT ); Tue, 23 Aug 2022 05:56:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A689BA1A59; Tue, 23 Aug 2022 01:47:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 21C376155E; Tue, 23 Aug 2022 08:47:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 213C5C433C1; Tue, 23 Aug 2022 08:47:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244450; bh=PYhSPsobpJ6kkl+Qsx5f0HgJelQ0xIq3RmooO9CvX2I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jUJym/ModyYir2k1KqEWiEY4UP2fdakpTc2z5dyHj8qqjNWoqeHUfkhj40blHyto/ 8FPH0lltya8FV3cUyuMuR5K7DH3ByHtj/V4uZBTctp+M2t/qBTwCAaH4MHZgXprQvZ RRQQZIWz2RP1AXAV1qIywL4PJx7N/b2Dmu07JzB8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Michael Ellerman , Sasha Levin Subject: [PATCH 4.14 139/229] powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address Date: Tue, 23 Aug 2022 10:25:00 +0200 Message-Id: <20220823080058.655478858@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit df5d4b616ee76abc97e5bd348e22659c2b095b1c ] of_get_next_parent() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() in the error path to avoid refcount leak. Fixes: ce21b3c9648a ("[CELL] add support for MSI on Axon-based Cell systems= ") Signed-off-by: Miaoqian Lin Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220605065129.63906-1-linmq006@gmail.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/powerpc/platforms/cell/axon_msi.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/cell/axon_msi.c b/arch/powerpc/platform= s/cell/axon_msi.c index 6ea3f248b155..e98b61c06a81 100644 --- a/arch/powerpc/platforms/cell/axon_msi.c +++ b/arch/powerpc/platforms/cell/axon_msi.c @@ -230,6 +230,7 @@ static int setup_msi_msg_address(struct pci_dev *dev, s= truct msi_msg *msg) if (!prop) { dev_dbg(&dev->dev, "axon_msi: no msi-address-(32|64) properties found\n"); + of_node_put(dn); return -ENOENT; } =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CC7B0C32774 for ; Tue, 23 Aug 2022 10:02:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243967AbiHWKCx (ORCPT ); Tue, 23 Aug 2022 06:02:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59018 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352462AbiHWJ47 (ORCPT ); Tue, 23 Aug 2022 05:56:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 46053A1A64; Tue, 23 Aug 2022 01:47:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 132AFB81C28; Tue, 23 Aug 2022 08:47:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 61054C433D6; Tue, 23 Aug 2022 08:47:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244456; bh=5W9S8KSf9oP4xZJYWjinORLtbpUFU6U4C0Ne61cmBMQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L4ffls+5gTUPk2XaC0IX1idj3OjcHTA7lPhWqdf9fo28hX6y3xUDBChMQEduzSUhm skAGxn/4tMoxoiD+ixz/0DUnlAtZOXgEKqD0mxJffn5z9DSVyeLvJxFHhzItggIhT9 9gHkTpnq4Tyw/NwGpR2B45zJgBY4zO2IXjSnbbZM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chen Zhongjin , Ingo Molnar , "Masami Hiramatsu (Google)" , Sasha Levin Subject: [PATCH 4.14 140/229] kprobes: Forbid probing on trampoline and BPF code areas Date: Tue, 23 Aug 2022 10:25:01 +0200 Message-Id: <20220823080058.685732796@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chen Zhongjin [ Upstream commit 28f6c37a2910f565b4f5960df52b2eccae28c891 ] kernel_text_address() treats ftrace_trampoline, kprobe_insn_slot and bpf_text_address as valid kprobe addresses - which is not ideal. These text areas are removable and changeable without any notification to kprobes, and probing on them can trigger unexpected behavior: https://lkml.org/lkml/2022/7/26/1148 Considering that jump_label and static_call text are already forbiden to probe, kernel_text_address() should be replaced with core_kernel_text() and is_module_text_address() to check other text areas which are unsafe to kprobe. [ mingo: Rewrote the changelog. ] Fixes: 5b485629ba0d ("kprobes, extable: Identify kprobes trampolines as ker= nel text area") Fixes: 74451e66d516 ("bpf: make jited programs visible in traces") Signed-off-by: Chen Zhongjin Signed-off-by: Ingo Molnar Acked-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/r/20220801033719.228248-1-chenzhongjin@huawei= .com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- kernel/kprobes.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index 4f918dd28fb7..b8e14aa6d496 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1551,7 +1551,8 @@ static int check_kprobe_address_safe(struct kprobe *p, preempt_disable(); =20 /* Ensure it is not in reserved area nor out of text */ - if (!kernel_text_address((unsigned long) p->addr) || + if (!(core_kernel_text((unsigned long) p->addr) || + is_module_text_address((unsigned long) p->addr)) || within_kprobe_blacklist((unsigned long) p->addr) || jump_label_text_reserved(p->addr, p->addr) || find_bug((unsigned long)p->addr)) { --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7F11C32772 for ; Tue, 23 Aug 2022 10:03:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351886AbiHWKDn (ORCPT ); Tue, 23 Aug 2022 06:03:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45940 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243699AbiHWJ56 (ORCPT ); Tue, 23 Aug 2022 05:57:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E75CEA1D1E; Tue, 23 Aug 2022 01:47:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6191AB81C3B; Tue, 23 Aug 2022 08:47:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A09D7C433D7; Tue, 23 Aug 2022 08:47:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244466; bh=cGv9YYiCAnF/hXVtpd8NFHpulmJj4WgT2Ko+E71vVug=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OP8SxbLdDrD5qcxJT8qXnaJQyhxyQ/UayEBZi5fMwoGZF+IohwWczYNN7ZWHtmyFq f0aIts7KgSZfesKZFkf9/+eayiGqKCThxL1RbvrxRkxUWqWklskI/Cw2Yc+03/1+TX b5sTZPKfkS12M+30Xmeu2YdpShxlnRbngZHKJIVQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Pali=20Roh=C3=A1r?= , Michael Ellerman , Sasha Levin Subject: [PATCH 4.14 141/229] powerpc/pci: Fix PHB numbering when using opal-phbid Date: Tue, 23 Aug 2022 10:25:02 +0200 Message-Id: <20220823080058.719989060@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Michael Ellerman [ Upstream commit f4b39e88b42d13366b831270306326b5c20971ca ] The recent change to the PHB numbering logic has a logic error in the handling of "ibm,opal-phbid". When an "ibm,opal-phbid" property is present, &prop is written to and ret is set to zero. The following call to of_alias_get_id() is skipped because ret =3D=3D 0. But then the if (ret >=3D 0) is true, and the body of that if statement sets prop =3D ret which throws away the value that was just read from "ibm,opal-phbid". Fix the logic by only doing the ret >=3D 0 check in the of_alias_get_id() case. Fixes: 0fe1e96fef0a ("powerpc/pci: Prefer PCI domain assignment via DT 'lin= ux,pci-domain' and alias") Reviewed-by: Pali Roh=C3=A1r Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220802105723.1055178-1-mpe@ellerman.id.au Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/powerpc/kernel/pci-common.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-com= mon.c index 2e2cc80bf592..936f24d7ab4c 100644 --- a/arch/powerpc/kernel/pci-common.c +++ b/arch/powerpc/kernel/pci-common.c @@ -96,11 +96,13 @@ static int get_phb_number(struct device_node *dn) } if (ret) ret =3D of_property_read_u64(dn, "ibm,opal-phbid", &prop); - if (ret) + + if (ret) { ret =3D of_alias_get_id(dn, "pci"); - if (ret >=3D 0) { - prop =3D ret; - ret =3D 0; + if (ret >=3D 0) { + prop =3D ret; + ret =3D 0; + } } if (ret) { u32 prop_32; --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 718A4C32772 for ; Tue, 23 Aug 2022 10:03:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351817AbiHWKDf (ORCPT ); Tue, 23 Aug 2022 06:03:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56420 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242856AbiHWJ5v (ORCPT ); Tue, 23 Aug 2022 05:57:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 944F0A1D04; Tue, 23 Aug 2022 01:47:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A0640614E9; Tue, 23 Aug 2022 08:47:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 70653C433D6; Tue, 23 Aug 2022 08:47:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244472; bh=CY49xwXKB0Rto104rE1C9k3u/W9bO7VSoKqt0iyrc0Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oE+o2AH+ofoVRpg8lTA/E6/6C2Vsz/Jb+oT7jRzXHYEBJyuE/SzNdQEBUZXxbt/Zr 3kpqUHW2rF6cDLdcu3tkzmo5gDmTYqarM56kM+XpLNEYawP1ajnrKGRxwW5XYz3tlX ptFxnH1HVbYhZHSXNNnarLdYaMhJc8Voir0k7QV4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?=E8=B0=AD=E6=A2=93=E7=85=8A?= , Alexei Starovoitov , Andrii Nakryiko , Daniel Borkmann , Jiri Olsa , John Fastabend , KP Singh , Martin KaFai Lau , Nick Terrell , Song Liu , Stephane Eranian , Arnaldo Carvalho de Melo , Sasha Levin Subject: [PATCH 4.14 142/229] genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO Date: Tue, 23 Aug 2022 10:25:03 +0200 Message-Id: <20220823080058.751627291@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Arnaldo Carvalho de Melo [ Upstream commit 91cea6be90e436c55cde8770a15e4dac9d3032d0 ] When genelf was introduced it tested for HAVE_LIBCRYPTO not HAVE_LIBCRYPTO_SUPPORT, which is the define the feature test for openssl defines, fix it. This also adds disables the deprecation warning, someone has to fix this to build with openssl 3.0 before the warning becomes a hard error. Fixes: 9b07e27f88b9cd78 ("perf inject: Add jitdump mmap injection support") Reported-by: =E8=B0=AD=E6=A2=93=E7=85=8A Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: Daniel Borkmann Cc: Jiri Olsa Cc: John Fastabend Cc: KP Singh Cc: Martin KaFai Lau Cc: Nick Terrell Cc: Song Liu Cc: Stephane Eranian Link: http://lore.kernel.org/lkml/YulpPqXSOG0Q4J1o@kernel.org Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- tools/perf/util/genelf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c index c540d47583e7..ad64ff620c75 100644 --- a/tools/perf/util/genelf.c +++ b/tools/perf/util/genelf.c @@ -35,7 +35,11 @@ =20 #define BUILD_ID_URANDOM /* different uuid for each run */ =20 -#ifdef HAVE_LIBCRYPTO +// FIXME, remove this and fix the deprecation warnings before its removed = and +// We'll break for good here... +#pragma GCC diagnostic ignored "-Wdeprecated-declarations" + +#ifdef HAVE_LIBCRYPTO_SUPPORT =20 #define BUILD_ID_MD5 #undef BUILD_ID_SHA /* does not seem to work well when linked with Java */ --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA799C32774 for ; Tue, 23 Aug 2022 10:04:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352038AbiHWKEN (ORCPT ); Tue, 23 Aug 2022 06:04:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55732 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242970AbiHWJ6y (ORCPT ); Tue, 23 Aug 2022 05:58:54 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D3C8FA1D4E; Tue, 23 Aug 2022 01:47:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A3353611DD; Tue, 23 Aug 2022 08:47:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9A979C433D6; Tue, 23 Aug 2022 08:47:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244478; bh=wlLI3R6AsjmybxTmr2wsmDEIhKG+ZcYSErdm8BeCEe0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LB3tA9dtp8X2nhZfswl6/KsuhgsSR3GyUYstwcQc/amVgs+67ziYFSoyGkE5gUKXa UDr6fXTJonfAXtXZ6B54TK9DiDViBEQn+5BQkXkk8r2Pw7XInJ/qePd5TFjb8FXz5A c9w4r7WRCdAPR1oxIbLQ88LEk/TY0txKKVO5DfSc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Siddh Raman Pant , Ingo Molnar , Sasha Levin Subject: [PATCH 4.14 143/229] x86/numa: Use cpumask_available instead of hardcoded NULL check Date: Tue, 23 Aug 2022 10:25:04 +0200 Message-Id: <20220823080058.782793063@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Siddh Raman Pant [ Upstream commit 625395c4a0f4775e0fe00f616888d2e6c1ba49db ] GCC-12 started triggering a new warning: arch/x86/mm/numa.c: In function =E2=80=98cpumask_of_node=E2=80=99: arch/x86/mm/numa.c:916:39: warning: the comparison will always evaluate a= s =E2=80=98false=E2=80=99 for the address of =E2=80=98node_to_cpumask_map= =E2=80=99 will never be NULL [-Waddress] 916 | if (node_to_cpumask_map[node] =3D=3D NULL) { | ^~ node_to_cpumask_map is of type cpumask_var_t[]. When CONFIG_CPUMASK_OFFSTACK is set, cpumask_var_t is typedef'd to a pointer for dynamic allocation, else to an array of one element. The "wicked game" can be checked on line 700 of include/linux/cpumask.h. The original code in debug_cpumask_set_cpu() and cpumask_of_node() were probably written by the original authors with CONFIG_CPUMASK_OFFSTACK=3Dy (i.e. dynamic allocation) in mind, checking if the cpumask was available via a direct NULL check. When CONFIG_CPUMASK_OFFSTACK is not set, GCC gives the above warning while compiling the kernel. Fix that by using cpumask_available(), which does the NULL check when CONFIG_CPUMASK_OFFSTACK is set, otherwise returns true. Use it wherever such checks are made. Conditional definitions of cpumask_available() can be found along with the definition of cpumask_var_t. Check the cpumask.h reference mentioned above. Fixes: c032ef60d1aa ("cpumask: convert node_to_cpumask_map[] to cpumask_var= _t") Fixes: de2d9445f162 ("x86: Unify node_to_cpumask_map handling between 32 an= d 64bit") Signed-off-by: Siddh Raman Pant Signed-off-by: Ingo Molnar Link: https://lore.kernel.org/r/20220731160913.632092-1-code@siddh.me Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/mm/numa.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c index 25504d5aa816..15661129794c 100644 --- a/arch/x86/mm/numa.c +++ b/arch/x86/mm/numa.c @@ -826,7 +826,7 @@ void debug_cpumask_set_cpu(int cpu, int node, bool enab= le) return; } mask =3D node_to_cpumask_map[node]; - if (!mask) { + if (!cpumask_available(mask)) { pr_err("node_to_cpumask_map[%i] NULL\n", node); dump_stack(); return; @@ -872,7 +872,7 @@ const struct cpumask *cpumask_of_node(int node) dump_stack(); return cpu_none_mask; } - if (node_to_cpumask_map[node] =3D=3D NULL) { + if (!cpumask_available(node_to_cpumask_map[node])) { printk(KERN_WARNING "cpumask_of_node(%d): no node_to_cpumask_map!\n", node); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 04857C32772 for ; Tue, 23 Aug 2022 10:04:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352074AbiHWKEX (ORCPT ); Tue, 23 Aug 2022 06:04:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56304 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348019AbiHWJ70 (ORCPT ); Tue, 23 Aug 2022 05:59:26 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CA1B0A1D77; Tue, 23 Aug 2022 01:48:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E96A161517; Tue, 23 Aug 2022 08:48:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D066BC433D7; Tue, 23 Aug 2022 08:48:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244484; bh=wTxpJY+B15fweHM9fBmoHGEdTlkxs3vXb9rtlhbnw7k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2LpBY1G3OjsVCwZh+3mf6tgtB+lygOAQT/uPPs7liC9EBlwqkRfyf8kFpxPqh/q0r fWEHAT2CXu1w5zLYA4Ez2y6KU1BoWHXPa6UMDuxuDi7UIBhTqC7ZD3p9sCIzsFsnM0 Xr1vY/en0tlw0VdYzw64DSNy2vhN4C27em1UKw3A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Helge Deller , Sasha Levin Subject: [PATCH 4.14 144/229] video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock() Date: Tue, 23 Aug 2022 10:25:05 +0200 Message-Id: <20220823080058.812832833@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit 2f1c4523f7a3aaabe7e53d3ebd378292947e95c8 ] Since the user can control the arguments of the ioctl() from the user space, under special arguments that may result in a divide-by-zero bug in: drivers/video/fbdev/arkfb.c:784: ark_set_pixclock(info, (hdiv * info->var= .pixclock) / hmul); with hdiv=3D1, pixclock=3D1 and hmul=3D2 you end up with (1*1)/2 =3D (int) = 0. and then in: drivers/video/fbdev/arkfb.c:504: rv =3D dac_set_freq(par->dac, 0, 1000000= 000 / pixclock); we'll get a division-by-zero. The following log can reveal it: divide error: 0000 [#1] PREEMPT SMP KASAN PTI RIP: 0010:ark_set_pixclock drivers/video/fbdev/arkfb.c:504 [inline] RIP: 0010:arkfb_set_par+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784 Call Trace: fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 Fix this by checking the argument of ark_set_pixclock() first. Fixes: 681e14730c73 ("arkfb: new framebuffer driver for ARK Logic cards") Signed-off-by: Zheyu Ma Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/video/fbdev/arkfb.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/arkfb.c b/drivers/video/fbdev/arkfb.c index 13ba371e70aa..bfa221b68d71 100644 --- a/drivers/video/fbdev/arkfb.c +++ b/drivers/video/fbdev/arkfb.c @@ -778,7 +778,12 @@ static int arkfb_set_par(struct fb_info *info) return -EINVAL; } =20 - ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul); + value =3D (hdiv * info->var.pixclock) / hmul; + if (!value) { + fb_dbg(info, "invalid pixclock\n"); + value =3D 1; + } + ark_set_pixclock(info, value); svga_set_timings(par->state.vgabase, &ark_timing_regs, &(info->var), hmul= , hdiv, (info->var.vmode & FB_VMODE_DOUBLE) ? 2 : 1, (info->var.vmode & FB_VMODE_INTERLACED) ? 2 : 1, --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79F9BC32792 for ; Tue, 23 Aug 2022 10:04:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242826AbiHWKEl (ORCPT ); Tue, 23 Aug 2022 06:04:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56642 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245198AbiHWKAF (ORCPT ); Tue, 23 Aug 2022 06:00:05 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D329F286; Tue, 23 Aug 2022 01:48:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id C0EAACE1B44; Tue, 23 Aug 2022 08:48:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D88D2C433D6; Tue, 23 Aug 2022 08:48:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244490; bh=Tmyi9bk+1bbxmTO9xBpQGKNVA74gTxDUx72W9Ihj6ig=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xJhurhNjc+q3PvqRdCSAoxtH0YahNK1fO+m/09EvtsZAmuum530tcjeVBB6mJ4vsd l4tVrsXurwf7bhW8CR4lm/B+gKimBH5im+f17qkpvguVxPFmsN7WuvJYAcE0JuBTWI qqYhEYZctsKJL+r8stzSn+EYgMChvAIHeUt6TQ6E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Florian Fainelli , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 4.14 145/229] tools/thermal: Fix possible path truncations Date: Tue, 23 Aug 2022 10:25:06 +0200 Message-Id: <20220823080058.853476989@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Fainelli [ Upstream commit 6c58cf40e3a1d2f47c09d3489857e9476316788a ] A build with -D_FORTIFY_SOURCE=3D2 enabled will produce the following warni= ngs: sysfs.c:63:30: warning: '%s' directive output may be truncated writing up t= o 255 bytes into a region of size between 0 and 255 [-Wformat-truncation=3D] snprintf(filepath, 256, "%s/%s", path, filename); ^~ Bump up the buffer to PATH_MAX which is the limit and account for all of the possible NUL and separators that could lead to exceeding the allocated buffer sizes. Fixes: 94f69966faf8 ("tools/thermal: Introduce tmon, a tool for thermal sub= system") Signed-off-by: Florian Fainelli Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- tools/thermal/tmon/sysfs.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/tools/thermal/tmon/sysfs.c b/tools/thermal/tmon/sysfs.c index 18f523557983..1b17cbc54c9d 100644 --- a/tools/thermal/tmon/sysfs.c +++ b/tools/thermal/tmon/sysfs.c @@ -22,6 +22,7 @@ #include #include #include +#include #include #include #include @@ -42,9 +43,9 @@ int sysfs_set_ulong(char *path, char *filename, unsigned = long val) { FILE *fd; int ret =3D -1; - char filepath[256]; + char filepath[PATH_MAX + 2]; /* NUL and '/' */ =20 - snprintf(filepath, 256, "%s/%s", path, filename); + snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); =20 fd =3D fopen(filepath, "w"); if (!fd) { @@ -66,9 +67,9 @@ static int sysfs_get_ulong(char *path, char *filename, un= signed long *p_ulong) { FILE *fd; int ret =3D -1; - char filepath[256]; + char filepath[PATH_MAX + 2]; /* NUL and '/' */ =20 - snprintf(filepath, 256, "%s/%s", path, filename); + snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); =20 fd =3D fopen(filepath, "r"); if (!fd) { @@ -85,9 +86,9 @@ static int sysfs_get_string(char *path, char *filename, c= har *str) { FILE *fd; int ret =3D -1; - char filepath[256]; + char filepath[PATH_MAX + 2]; /* NUL and '/' */ =20 - snprintf(filepath, 256, "%s/%s", path, filename); + snprintf(filepath, sizeof(filepath), "%s/%s", path, filename); =20 fd =3D fopen(filepath, "r"); if (!fd) { @@ -208,8 +209,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_= name, { unsigned long trip_instance =3D 0; char cdev_name_linked[256]; - char cdev_name[256]; - char cdev_trip_name[256]; + char cdev_name[PATH_MAX]; + char cdev_trip_name[PATH_MAX]; int cdev_id; =20 if (nl->d_type =3D=3D DT_LNK) { @@ -222,7 +223,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_= name, return -EINVAL; } /* find the link to real cooling device record binding */ - snprintf(cdev_name, 256, "%s/%s", tz_name, nl->d_name); + snprintf(cdev_name, sizeof(cdev_name) - 2, "%s/%s", + tz_name, nl->d_name); memset(cdev_name_linked, 0, sizeof(cdev_name_linked)); if (readlink(cdev_name, cdev_name_linked, sizeof(cdev_name_linked) - 1) !=3D -1) { @@ -235,8 +237,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_= name, /* find the trip point in which the cdev is binded to * in this tzone */ - snprintf(cdev_trip_name, 256, "%s%s", nl->d_name, - "_trip_point"); + snprintf(cdev_trip_name, sizeof(cdev_trip_name) - 1, + "%s%s", nl->d_name, "_trip_point"); sysfs_get_ulong(tz_name, cdev_trip_name, &trip_instance); /* validate trip point range, e.g. trip could return -1 --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6687C32792 for ; Tue, 23 Aug 2022 10:05:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352238AbiHWKFB (ORCPT ); Tue, 23 Aug 2022 06:05:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43770 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351893AbiHWKAq (ORCPT ); Tue, 23 Aug 2022 06:00:46 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A741B219C; Tue, 23 Aug 2022 01:48:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 549C6B81C39; Tue, 23 Aug 2022 08:48:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B8874C433D6; Tue, 23 Aug 2022 08:48:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244500; bh=dS14W8ecUphTKxvCQBorbBcTsP8koOnv//b1T3gJMZU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1oeYgn0CguyaJHkL3MYF8Ny/yxeUCuz+bS6xJDMf8uip1R0rYdt/ddl408rVhunSN 1tjw5HFJxJCXB9GNE3/JIytXTkSFoeHZ9Y9A5CBkoJSTDyWDJQR2I2kXMoEoLx8ykg OwZvKkQ+xGvi0RWRN0oUZ1NgJaEhvwElF06wKlV4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Helge Deller , Sasha Levin Subject: [PATCH 4.14 146/229] video: fbdev: vt8623fb: Check the size of screen before memset_io() Date: Tue, 23 Aug 2022 10:25:07 +0200 Message-Id: <20220823080058.894853891@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit ec0754c60217248fa77cc9005d66b2b55200ac06 ] In the function vt8623fb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug: [ 583.339036] BUG: unable to handle page fault for address: ffffc900050000= 00 [ 583.339049] #PF: supervisor write access in kernel mode [ 583.339052] #PF: error_code(0x0002) - not-present page [ 583.339074] RIP: 0010:memset_orig+0x33/0xb0 [ 583.339110] Call Trace: [ 583.339118] vt8623fb_set_par+0x11cd/0x21e0 [ 583.339146] fb_set_var+0x604/0xeb0 [ 583.339181] do_fb_ioctl+0x234/0x670 [ 583.339209] fb_ioctl+0xdd/0x130 Fix the this by checking the value of 'screen_size' before memset_io(). Fixes: 558b7bd86c32 ("vt8623fb: new framebuffer driver for VIA VT8623") Signed-off-by: Zheyu Ma Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/video/fbdev/vt8623fb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/video/fbdev/vt8623fb.c b/drivers/video/fbdev/vt8623fb.c index 5cac871db3ee..cbae9c510092 100644 --- a/drivers/video/fbdev/vt8623fb.c +++ b/drivers/video/fbdev/vt8623fb.c @@ -504,6 +504,8 @@ static int vt8623fb_set_par(struct fb_info *info) (info->var.vmode & FB_VMODE_DOUBLE) ? 2 : 1, 1, 1, info->node); =20 + if (screen_size > info->screen_size) + screen_size =3D info->screen_size; memset_io(info->screen_base, 0x00, screen_size); =20 /* Device and screen back on */ --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F075C32772 for ; Tue, 23 Aug 2022 10:06:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351828AbiHWKFV (ORCPT ); Tue, 23 Aug 2022 06:05:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351996AbiHWKA7 (ORCPT ); Tue, 23 Aug 2022 06:00:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 61F4513DD7; Tue, 23 Aug 2022 01:48:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A64F1B8105C; Tue, 23 Aug 2022 08:48:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E75A6C433D6; Tue, 23 Aug 2022 08:48:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244506; bh=Lveu6uFlMWa/CVBVxi5kfsSkEcxc8ilbail2ZMSOKDk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J2fByFeA7SaV816YCfUC8vglBrhkKXx/7PatnOfSMP1q/5GoeWkQnrZ0NvLpById6 ykyiDhKETGGTfnOFRDhg1DVPFUGX5TAUds0Y7SGS+bga8+pldiF+f19Al+nQgx/7Ha KEsvNRFKkCw9BiF65jWScodJgk3msUEZyFGoIl5w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Helge Deller , Sasha Levin Subject: [PATCH 4.14 147/229] video: fbdev: arkfb: Check the size of screen before memset_io() Date: Tue, 23 Aug 2022 10:25:08 +0200 Message-Id: <20220823080058.930157019@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit 96b550971c65d54d64728d8ba973487878a06454 ] In the function arkfb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug: [ 659.399066] BUG: unable to handle page fault for address: ffffc900030000= 00 [ 659.399077] #PF: supervisor write access in kernel mode [ 659.399079] #PF: error_code(0x0002) - not-present page [ 659.399094] RIP: 0010:memset_orig+0x33/0xb0 [ 659.399116] Call Trace: [ 659.399122] arkfb_set_par+0x143f/0x24c0 [ 659.399130] fb_set_var+0x604/0xeb0 [ 659.399161] do_fb_ioctl+0x234/0x670 [ 659.399189] fb_ioctl+0xdd/0x130 Fix the this by checking the value of 'screen_size' before memset_io(). Fixes: 681e14730c73 ("arkfb: new framebuffer driver for ARK Logic cards") Signed-off-by: Zheyu Ma Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/video/fbdev/arkfb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/video/fbdev/arkfb.c b/drivers/video/fbdev/arkfb.c index bfa221b68d71..f7920987dd24 100644 --- a/drivers/video/fbdev/arkfb.c +++ b/drivers/video/fbdev/arkfb.c @@ -794,6 +794,8 @@ static int arkfb_set_par(struct fb_info *info) value =3D ((value * hmul / hdiv) / 8) - 5; vga_wcrt(par->state.vgabase, 0x42, (value + 1) / 2); =20 + if (screen_size > info->screen_size) + screen_size =3D info->screen_size; memset_io(info->screen_base, 0x00, screen_size); /* Device and screen back on */ svga_wcrt_mask(par->state.vgabase, 0x17, 0x80, 0x80); --=20 2.35.1 From nobody Fri Dec 19 20:52:40 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 235FCC3F6B0 for ; Tue, 23 Aug 2022 10:06:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352329AbiHWKFa (ORCPT ); Tue, 23 Aug 2022 06:05:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352049AbiHWKBK (ORCPT ); Tue, 23 Aug 2022 06:01:10 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6513422B0A; Tue, 23 Aug 2022 01:48:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0D1AD61538; Tue, 23 Aug 2022 08:48:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 002E3C433D6; Tue, 23 Aug 2022 08:48:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244512; bh=HW8oSDo9+AP0Lh/FOT/cK/fI51j5qkfr5A+LITh7TqM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=f0aAi0u6uPstrM22zJhT5JrZrPeaZ2lL7swExrgSyelmeOgDLcAidVr7UaiU1q7Hx 9e6TSO5D8Mglg5umhgS1NFcAxSRUpCfnVmLmHqte0SYsRjGhLX807jkfyXMu+HUYaJ /4ln8O/zDvx2ZLIpiH0MddkCIjUsF+P6Ao0xnBRE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Helge Deller , Sasha Levin Subject: [PATCH 4.14 148/229] video: fbdev: s3fb: Check the size of screen before memset_io() Date: Tue, 23 Aug 2022 10:25:09 +0200 Message-Id: <20220823080058.960774264@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit 6ba592fa014f21f35a8ee8da4ca7b95a018f13e8 ] In the function s3fb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug: [ 54.083733] BUG: unable to handle page fault for address: ffffc900030000= 00 [ 54.083742] #PF: supervisor write access in kernel mode [ 54.083744] #PF: error_code(0x0002) - not-present page [ 54.083760] RIP: 0010:memset_orig+0x33/0xb0 [ 54.083782] Call Trace: [ 54.083788] s3fb_set_par+0x1ec6/0x4040 [ 54.083806] fb_set_var+0x604/0xeb0 [ 54.083836] do_fb_ioctl+0x234/0x670 Fix the this by checking the value of 'screen_size' before memset_io(). Fixes: a268422de8bf ("fbdev driver for S3 Trio/Virge") Signed-off-by: Zheyu Ma Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/video/fbdev/s3fb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/video/fbdev/s3fb.c b/drivers/video/fbdev/s3fb.c index d63f23e26f7d..b17b806b4187 100644 --- a/drivers/video/fbdev/s3fb.c +++ b/drivers/video/fbdev/s3fb.c @@ -902,6 +902,8 @@ static int s3fb_set_par(struct fb_info *info) value =3D clamp((htotal + hsstart + 1) / 2 + 2, hsstart + 4, htotal + 1); svga_wcrt_multi(par->state.vgabase, s3_dtpc_regs, value); =20 + if (screen_size > info->screen_size) + screen_size =3D info->screen_size; memset_io(info->screen_base, 0x00, screen_size); /* Device and screen back on */ svga_wcrt_mask(par->state.vgabase, 0x17, 0x80, 0x80); --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34936C32774 for ; Tue, 23 Aug 2022 10:06:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352366AbiHWKFg (ORCPT ); Tue, 23 Aug 2022 06:05:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57674 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352082AbiHWKBM (ORCPT ); Tue, 23 Aug 2022 06:01:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D82C52F016; Tue, 23 Aug 2022 01:48:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0439CB8105C; Tue, 23 Aug 2022 08:48:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4F3B5C433C1; Tue, 23 Aug 2022 08:48:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244518; bh=76x/PYbCef/1x1xTsTj2lJe+zN3yFkjFLFKuGq8IY5M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NdP4P/j0dEphdEoOHZlL5Ykr/RlVc8zBcDlRCoClg20HsLQGoN1HLghVwJaS6+u8W JIonU6IJ0gZ3Ym0cu+Nl1JMRiSy2fRk12hAa4B/8bAWRMQzUAmH3noTzjPHtXCKvma iOJg7WY2CqdLMe9C0dLdHiGUdBvBcN51nyOrxVT8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Benjamin Block , Steffen Maier , "Martin K. Petersen" Subject: [PATCH 4.14 149/229] scsi: zfcp: Fix missing auto port scan and thus missing target ports Date: Tue, 23 Aug 2022 10:25:10 +0200 Message-Id: <20220823080058.994087995@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Steffen Maier commit 4da8c5f76825269f28d6a89fa752934a4bcb6dfa upstream. Case (1): The only waiter on wka_port->completion_wq is zfcp_fc_wka_port_get() trying to open a WKA port. As such it should only be woken up by WKA port *open* responses, not by WKA port close responses. Case (2): A close WKA port response coming in just after having sent a new open WKA port request and before blocking for the open response with wait_event() in zfcp_fc_wka_port_get() erroneously renders the wait_event a NOP because the close handler overwrites wka_port->status. Hence the wait_event condition is erroneously true and it does not enter blocking state. With non-negligible probability, the following time space sequence happens depending on timing without this fix: user process ERP thread zfcp work queue tasklet system work queue =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D =3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D $ echo 1 > online zfcp_ccw_set_online zfcp_ccw_activate zfcp_erp_adapter_reopen msleep scan backoff zfcp_erp_strategy | ... | zfcp_erp_action_cleanup | ... | queue delayed scan_work | queue ns_up_work | ns_up_work: | zfcp_fc_wka_port_get | open wka request | open response | GSPN FC-GS | RSPN FC-GS [NPIV-only] | zfcp_fc_wka_port_put | (--wka->refcount=3D=3D0) | sched delayed wka->work | ~~~Case (1)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ zfcp_erp_wait flush scan_work | wka->work: | wka->status=3DCLOSING | close wka request | scan_work: | zfcp_fc_wka_port_get | (wka->status=3D=3DCLOSING) | wka->status=3DOPENING | open wka request | wait_event | | close response | | wka->status=3DOFFLINE | | wake_up /*WRONG*/ ~~~Case (2)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | wka->work: | wka->status=3DCLOSING | close wka request zfcp_erp_wait flush scan_work | scan_work: | zfcp_fc_wka_port_get | (wka->status=3D=3DCLOSING) | wka->status=3DOPENING | open wka request | close response | wka->status=3DOFFLINE | wake_up /*WRONG&NOP*/ | wait_event /*NOP*/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | (wka->status!=3DONLINE) | return -EIO | return early open response wka->status=3DONLINE wake_up /*NOP*/ So we erroneously end up with no automatic port scan. This is a big problem when it happens during boot. The timing is influenced by v3.19 commit 18f87a67e6d6 ("zfcp: auto port scan resiliency"). Fix it by fully mutually excluding zfcp_fc_wka_port_get() and zfcp_fc_wka_port_offline(). For that to work, we make the latter block until we got the response for a close WKA port. In order not to penalize the system workqueue, we move wka_port->work to our own adapter workqueue. Note that before v2.6.30 commit 828bc1212a68 ("[SCSI] zfcp: Set WKA-port to offline on adapter deactivation"), zfcp did block in zfcp_fc_wka_port_offline() as well, but with a different condition. While at it, make non-functional cleanups to improve code reading in zfcp_fc_wka_port_get(). If we cannot send the WKA port open request, don't rely on the subsequent wait_event condition to immediately let this case pass without blocking. Also don't want to rely on the additional condition handling the refcount to be skipped just to finally return with -EIO. Link: https://lore.kernel.org/r/20220729162529.1620730-1-maier@linux.ibm.com Fixes: 5ab944f97e09 ("[SCSI] zfcp: attach and release SAN nameserver port o= n demand") Cc: #v2.6.28+ Reviewed-by: Benjamin Block Signed-off-by: Steffen Maier Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/s390/scsi/zfcp_fc.c | 29 ++++++++++++++++++++--------- drivers/s390/scsi/zfcp_fc.h | 6 ++++-- drivers/s390/scsi/zfcp_fsf.c | 4 ++-- 3 files changed, 26 insertions(+), 13 deletions(-) --- a/drivers/s390/scsi/zfcp_fc.c +++ b/drivers/s390/scsi/zfcp_fc.c @@ -146,27 +146,33 @@ void zfcp_fc_enqueue_event(struct zfcp_a =20 static int zfcp_fc_wka_port_get(struct zfcp_fc_wka_port *wka_port) { + int ret =3D -EIO; + if (mutex_lock_interruptible(&wka_port->mutex)) return -ERESTARTSYS; =20 if (wka_port->status =3D=3D ZFCP_FC_WKA_PORT_OFFLINE || wka_port->status =3D=3D ZFCP_FC_WKA_PORT_CLOSING) { wka_port->status =3D ZFCP_FC_WKA_PORT_OPENING; - if (zfcp_fsf_open_wka_port(wka_port)) + if (zfcp_fsf_open_wka_port(wka_port)) { + /* could not even send request, nothing to wait for */ wka_port->status =3D ZFCP_FC_WKA_PORT_OFFLINE; + goto out; + } } =20 - mutex_unlock(&wka_port->mutex); - - wait_event(wka_port->completion_wq, + wait_event(wka_port->opened, wka_port->status =3D=3D ZFCP_FC_WKA_PORT_ONLINE || wka_port->status =3D=3D ZFCP_FC_WKA_PORT_OFFLINE); =20 if (wka_port->status =3D=3D ZFCP_FC_WKA_PORT_ONLINE) { atomic_inc(&wka_port->refcount); - return 0; + ret =3D 0; + goto out; } - return -EIO; +out: + mutex_unlock(&wka_port->mutex); + return ret; } =20 static void zfcp_fc_wka_port_offline(struct work_struct *work) @@ -182,9 +188,12 @@ static void zfcp_fc_wka_port_offline(str =20 wka_port->status =3D ZFCP_FC_WKA_PORT_CLOSING; if (zfcp_fsf_close_wka_port(wka_port)) { + /* could not even send request, nothing to wait for */ wka_port->status =3D ZFCP_FC_WKA_PORT_OFFLINE; - wake_up(&wka_port->completion_wq); + goto out; } + wait_event(wka_port->closed, + wka_port->status =3D=3D ZFCP_FC_WKA_PORT_OFFLINE); out: mutex_unlock(&wka_port->mutex); } @@ -194,13 +203,15 @@ static void zfcp_fc_wka_port_put(struct if (atomic_dec_return(&wka_port->refcount) !=3D 0) return; /* wait 10 milliseconds, other reqs might pop in */ - schedule_delayed_work(&wka_port->work, HZ / 100); + queue_delayed_work(wka_port->adapter->work_queue, &wka_port->work, + msecs_to_jiffies(10)); } =20 static void zfcp_fc_wka_port_init(struct zfcp_fc_wka_port *wka_port, u32 d= _id, struct zfcp_adapter *adapter) { - init_waitqueue_head(&wka_port->completion_wq); + init_waitqueue_head(&wka_port->opened); + init_waitqueue_head(&wka_port->closed); =20 wka_port->adapter =3D adapter; wka_port->d_id =3D d_id; --- a/drivers/s390/scsi/zfcp_fc.h +++ b/drivers/s390/scsi/zfcp_fc.h @@ -170,7 +170,8 @@ enum zfcp_fc_wka_status { /** * struct zfcp_fc_wka_port - representation of well-known-address (WKA) FC= port * @adapter: Pointer to adapter structure this WKA port belongs to - * @completion_wq: Wait for completion of open/close command + * @opened: Wait for completion of open command + * @closed: Wait for completion of close command * @status: Current status of WKA port * @refcount: Reference count to keep port open as long as it is in use * @d_id: FC destination id or well-known-address @@ -180,7 +181,8 @@ enum zfcp_fc_wka_status { */ struct zfcp_fc_wka_port { struct zfcp_adapter *adapter; - wait_queue_head_t completion_wq; + wait_queue_head_t opened; + wait_queue_head_t closed; enum zfcp_fc_wka_status status; atomic_t refcount; u32 d_id; --- a/drivers/s390/scsi/zfcp_fsf.c +++ b/drivers/s390/scsi/zfcp_fsf.c @@ -1582,7 +1582,7 @@ static void zfcp_fsf_open_wka_port_handl wka_port->status =3D ZFCP_FC_WKA_PORT_ONLINE; } out: - wake_up(&wka_port->completion_wq); + wake_up(&wka_port->opened); } =20 /** @@ -1640,7 +1640,7 @@ static void zfcp_fsf_close_wka_port_hand } =20 wka_port->status =3D ZFCP_FC_WKA_PORT_OFFLINE; - wake_up(&wka_port->completion_wq); + wake_up(&wka_port->closed); } =20 /** From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 650DBC38145 for ; Tue, 23 Aug 2022 10:06:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352462AbiHWKFp (ORCPT ); Tue, 23 Aug 2022 06:05:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43736 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352153AbiHWKBR (ORCPT ); Tue, 23 Aug 2022 06:01:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 27C903C16F; Tue, 23 Aug 2022 01:48:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 48B0DB81BF8; Tue, 23 Aug 2022 08:48:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7468AC433D6; Tue, 23 Aug 2022 08:48:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244525; bh=ttLvW3MfLOd5HkB/xUpnfI6bCZM/YFhvYh+VBRclgbE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vRc2FLltCCjPKAOQdwG2g0yFCFLztXQWuZWrJWu6m+Y/sgnxrs6wqlRmVkO91tB49 Znhm8a/53UvYK8QKw2n/vAmM7CdM3bz2CPUM8xsW6WUpdhdKUuVRd7JQDQHZMG2jO6 ux3WwtGbbCs12+4oB2GL+JFJLAVa541A8wKwDLn4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guenter Roeck , kernel test robot , Alexander Lobakin , Yury Norov Subject: [PATCH 4.14 150/229] x86/olpc: fix logical not is only applied to the left hand side Date: Tue, 23 Aug 2022 10:25:11 +0200 Message-Id: <20220823080059.035353456@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Lobakin commit 3a2ba42cbd0b669ce3837ba400905f93dd06c79f upstream. The bitops compile-time optimization series revealed one more problem in olpc-xo1-sci.c:send_ebook_state(), resulted in GCC warnings: arch/x86/platform/olpc/olpc-xo1-sci.c: In function 'send_ebook_state': arch/x86/platform/olpc/olpc-xo1-sci.c:83:63: warning: logical not is only a= pplied to the left hand side of comparison [-Wlogical-not-parentheses] 83 | if (!!test_bit(SW_TABLET_MODE, ebook_switch_idev->sw) =3D= =3D state) | ^~ arch/x86/platform/olpc/olpc-xo1-sci.c:83:13: note: add parentheses around l= eft hand side expression to silence this warning Despite this code working as intended, this redundant double negation of boolean value, together with comparing to `char` with no explicit conversion to bool, makes compilers think the author made some unintentional logical mistakes here. Make it the other way around and negate the char instead to silence the warnings. Fixes: d2aa37411b8e ("x86/olpc/xo1/sci: Produce wakeup events for buttons a= nd switches") Cc: stable@vger.kernel.org # 3.5+ Reported-by: Guenter Roeck Reported-by: kernel test robot Reviewed-and-tested-by: Guenter Roeck Signed-off-by: Alexander Lobakin Signed-off-by: Yury Norov Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/platform/olpc/olpc-xo1-sci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/x86/platform/olpc/olpc-xo1-sci.c +++ b/arch/x86/platform/olpc/olpc-xo1-sci.c @@ -85,7 +85,7 @@ static void send_ebook_state(void) return; } =20 - if (!!test_bit(SW_TABLET_MODE, ebook_switch_idev->sw) =3D=3D state) + if (test_bit(SW_TABLET_MODE, ebook_switch_idev->sw) =3D=3D !!state) return; /* Nothing new to report. */ =20 input_report_switch(ebook_switch_idev, SW_TABLET_MODE, state); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6E06C48BE4 for ; Tue, 23 Aug 2022 10:06:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352650AbiHWKGE (ORCPT ); Tue, 23 Aug 2022 06:06:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43910 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352204AbiHWKBW (ORCPT ); Tue, 23 Aug 2022 06:01:22 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BB65C4AD59; Tue, 23 Aug 2022 01:48:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 46C13B81BF8; Tue, 23 Aug 2022 08:48:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 96A05C433D6; Tue, 23 Aug 2022 08:48:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244534; bh=SmZYZEpOelWUIJG7oTgTHs2s9xh0YRCxcCr5ctiy6do=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CYpoE2KamfcVHSsCAzlDap3rg3SkmLu0/GLxYvm5kWPBP+ge5jFMCJEyJ74c8KyIG 7u6TMoAstAiHhBh+AwhlYjKTWnatjQja72jlBKrcJkKt7A/TVJ3elshfg4BBVarbq0 uZWUn+7gC+M8nExOxsv+FWspo7SU1xeN20urebAw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stephen Boyd , "Steven Rostedt (Google)" , David Collins Subject: [PATCH 4.14 151/229] spmi: trace: fix stack-out-of-bound access in SPMI tracing functions Date: Tue, 23 Aug 2022 10:25:12 +0200 Message-Id: <20220823080059.066422030@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Collins commit 2af28b241eea816e6f7668d1954f15894b45d7e3 upstream. trace_spmi_write_begin() and trace_spmi_read_end() both call memcpy() with a length of "len + 1". This leads to one extra byte being read beyond the end of the specified buffer. Fix this out-of-bound memory access by using a length of "len" instead. Here is a KASAN log showing the issue: BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_spmi_read_end+0x1d= 0/0x234 Read of size 2 at addr ffffffc0265b7540 by task thermal@2.0-ser/1314 ... Call trace: dump_backtrace+0x0/0x3e8 show_stack+0x2c/0x3c dump_stack_lvl+0xdc/0x11c print_address_description+0x74/0x384 kasan_report+0x188/0x268 kasan_check_range+0x270/0x2b0 memcpy+0x90/0xe8 trace_event_raw_event_spmi_read_end+0x1d0/0x234 spmi_read_cmd+0x294/0x3ac spmi_ext_register_readl+0x84/0x9c regmap_spmi_ext_read+0x144/0x1b0 [regmap_spmi] _regmap_raw_read+0x40c/0x754 regmap_raw_read+0x3a0/0x514 regmap_bulk_read+0x418/0x494 adc5_gen3_poll_wait_hs+0xe8/0x1e0 [qcom_spmi_adc5_gen3] ... __arm64_sys_read+0x4c/0x60 invoke_syscall+0x80/0x218 el0_svc_common+0xec/0x1c8 ... addr ffffffc0265b7540 is located in stack of task thermal@2.0-ser/1314 at o= ffset 32 in frame: adc5_gen3_poll_wait_hs+0x0/0x1e0 [qcom_spmi_adc5_gen3] this frame has 1 object: [32, 33) 'status' Memory state around the buggy address: ffffffc0265b7400: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 ffffffc0265b7480: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffc0265b7500: 00 00 00 00 f1 f1 f1 f1 01 f3 f3 f3 00 00 00 00 ^ ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2 f2 01 f3 00 00 00 00 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Fixes: a9fce374815d ("spmi: add command tracepoints for SPMI") Cc: stable@vger.kernel.org Reviewed-by: Stephen Boyd Acked-by: Steven Rostedt (Google) Signed-off-by: David Collins Link: https://lore.kernel.org/r/20220627235512.2272783-1-quic_collinsd@quic= inc.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/trace/events/spmi.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) --- a/include/trace/events/spmi.h +++ b/include/trace/events/spmi.h @@ -21,15 +21,15 @@ TRACE_EVENT(spmi_write_begin, __field ( u8, sid ) __field ( u16, addr ) __field ( u8, len ) - __dynamic_array ( u8, buf, len + 1 ) + __dynamic_array ( u8, buf, len ) ), =20 TP_fast_assign( __entry->opcode =3D opcode; __entry->sid =3D sid; __entry->addr =3D addr; - __entry->len =3D len + 1; - memcpy(__get_dynamic_array(buf), buf, len + 1); + __entry->len =3D len; + memcpy(__get_dynamic_array(buf), buf, len); ), =20 TP_printk("opc=3D%d sid=3D%02d addr=3D0x%04x len=3D%d buf=3D0x[%*phD]", @@ -92,7 +92,7 @@ TRACE_EVENT(spmi_read_end, __field ( u16, addr ) __field ( int, ret ) __field ( u8, len ) - __dynamic_array ( u8, buf, len + 1 ) + __dynamic_array ( u8, buf, len ) ), =20 TP_fast_assign( @@ -100,8 +100,8 @@ TRACE_EVENT(spmi_read_end, __entry->sid =3D sid; __entry->addr =3D addr; __entry->ret =3D ret; - __entry->len =3D len + 1; - memcpy(__get_dynamic_array(buf), buf, len + 1); + __entry->len =3D len; + memcpy(__get_dynamic_array(buf), buf, len); ), =20 TP_printk("opc=3D%d sid=3D%02d addr=3D0x%04x ret=3D%d len=3D%02d buf=3D0x= [%*phD]", From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E69EBC38159 for ; Tue, 23 Aug 2022 10:06:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352737AbiHWKGL (ORCPT ); Tue, 23 Aug 2022 06:06:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59034 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352210AbiHWKBW (ORCPT ); Tue, 23 Aug 2022 06:01:22 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 56210491EF; Tue, 23 Aug 2022 01:49:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E57A861386; Tue, 23 Aug 2022 08:49:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D16E5C433D6; Tue, 23 Aug 2022 08:48:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244540; bh=xwMDHTFnMLKH4+U7KF18c69Qbn3zdxCc6asbHfolpLg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L+O1h4soKm8xnkdjVbxazgIsv7qfOe8CKsElg++CN70Ck0lzi+laQyxlvC9uRIc9+ p8bj7fGN9CB87IH6+oRyn3GWz22IUALZqxpRq50BK0xetVpqG+mCgmdydMAHwPESt8 qxTlVJNNB+oks0FFZUTEi17uCmkqd5gTi6iVvEFM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Baokun Li , Jan Kara , "Ritesh Harjani (IBM)" , Theodore Tso Subject: [PATCH 4.14 152/229] ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h Date: Tue, 23 Aug 2022 10:25:13 +0200 Message-Id: <20220823080059.101216471@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Baokun Li commit 179b14152dcb6a24c3415200603aebca70ff13af upstream. When adding an xattr to an inode, we must ensure that the inode_size is not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. Otherwise, the end position may be greater than the start position, resulting in UAF. Signed-off-by: Baokun Li Reviewed-by: Jan Kara Reviewed-by: Ritesh Harjani (IBM) Link: https://lore.kernel.org/r/20220616021358.2504451-2-libaokun1@huawei.c= om Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/ext4/xattr.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) --- a/fs/ext4/xattr.h +++ b/fs/ext4/xattr.h @@ -95,6 +95,19 @@ struct ext4_xattr_entry { =20 #define EXT4_ZERO_XATTR_VALUE ((void *)-1) =20 +/* + * If we want to add an xattr to the inode, we should make sure that + * i_extra_isize is not 0 and that the inode size is not less than + * EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. + * EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data + * |--------------------------|------------|------|---------|---|-------| + */ +#define EXT4_INODE_HAS_XATTR_SPACE(inode) \ + ((EXT4_I(inode)->i_extra_isize !=3D 0) && \ + (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \ + sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <=3D \ + EXT4_INODE_SIZE((inode)->i_sb))) + struct ext4_xattr_info { const char *name; const void *value; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03840C49EC0 for ; Tue, 23 Aug 2022 10:06:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352787AbiHWKGR (ORCPT ); Tue, 23 Aug 2022 06:06:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44340 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352243AbiHWKB3 (ORCPT ); Tue, 23 Aug 2022 06:01:29 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4588F6FA21; Tue, 23 Aug 2022 01:49:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BEEF9B81BF8; Tue, 23 Aug 2022 08:49:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 19F70C433C1; Tue, 23 Aug 2022 08:49:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244546; bh=X80genjRvM2BQRqho1Zf4KlpLP+VqAoEYc/fqf6UN7M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fgfJzE0fVZUaOJyJqRc0kkKkWNPsrd65BcMekk05FqYIhE3VHWgC/IkbDhkFcVKup hnXhT2JloLeYZulHGWvJJJeYTsh276H1GzJadE6PkE5WpdACvFCEs/8QwTsRz31cJB jipgwTVXfYClF+yuevvjlFotgG7zBTa/D7ctjnJU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Lukas Czerner , Andreas Dilger , Theodore Tso Subject: [PATCH 4.14 153/229] ext4: make sure ext4_append() always allocates new block Date: Tue, 23 Aug 2022 10:25:14 +0200 Message-Id: <20220823080059.141504689@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lukas Czerner commit b8a04fe77ef1360fbf73c80fddbdfeaa9407ed1b upstream. ext4_append() must always allocate a new block, otherwise we run the risk of overwriting existing directory block corrupting the directory tree in the process resulting in all manner of problems later on. Add a sanity check to see if the logical block is already allocated and error out if it is. Cc: stable@kernel.org Signed-off-by: Lukas Czerner Reviewed-by: Andreas Dilger Link: https://lore.kernel.org/r/20220704142721.157985-2-lczerner@redhat.com Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/ext4/namei.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -52,6 +52,7 @@ static struct buffer_head *ext4_append(h struct inode *inode, ext4_lblk_t *block) { + struct ext4_map_blocks map; struct buffer_head *bh; int err; =20 @@ -61,6 +62,21 @@ static struct buffer_head *ext4_append(h return ERR_PTR(-ENOSPC); =20 *block =3D inode->i_size >> inode->i_sb->s_blocksize_bits; + map.m_lblk =3D *block; + map.m_len =3D 1; + + /* + * We're appending new directory block. Make sure the block is not + * allocated yet, otherwise we will end up corrupting the + * directory. + */ + err =3D ext4_map_blocks(NULL, inode, &map, 0); + if (err < 0) + return ERR_PTR(err); + if (err) { + EXT4_ERROR_INODE(inode, "Logical block already allocated"); + return ERR_PTR(-EFSCORRUPTED); + } =20 bh =3D ext4_bread(handle, inode, *block, EXT4_GET_BLOCKS_CREATE); if (IS_ERR(bh)) From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55CBBC49EC1 for ; Tue, 23 Aug 2022 10:06:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352950AbiHWKGc (ORCPT ); Tue, 23 Aug 2022 06:06:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44742 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352292AbiHWKBh (ORCPT ); Tue, 23 Aug 2022 06:01:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 29F346FA02; Tue, 23 Aug 2022 01:49:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 675826123D; Tue, 23 Aug 2022 08:49:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 55C1DC433D7; Tue, 23 Aug 2022 08:49:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244552; bh=ni6ObB8BSmrgRUfLxsjpKg0QLDB03CLLxasGXLG5qYQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nM/XMjWpT15p0SpJM600ripyMGK8+pBIyK54RgdW/1npU1x2Rw+sgywKcttz+hw7K XsKINvcxIK0t6vvKDEKZr/oZ01BDZlS2Svu62dPx9zlxrdYbxO+uy7EXkNdsSgQi63 r0lPEaCvRHhQYiPzMceiqUxOJqllLZ1qjgqMubN8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Hulk Robot , Baokun Li , "Ritesh Harjani (IBM)" , Jan Kara , Theodore Tso Subject: [PATCH 4.14 154/229] ext4: fix use-after-free in ext4_xattr_set_entry Date: Tue, 23 Aug 2022 10:25:15 +0200 Message-Id: <20220823080059.177265884@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Baokun Li commit 67d7d8ad99beccd9fe92d585b87f1760dc9018e3 upstream. Hulk Robot reported a issue: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x18ab/0x3500 Write of size 4105 at addr ffff8881675ef5f4 by task syz-executor.0/7092 CPU: 1 PID: 7092 Comm: syz-executor.0 Not tainted 4.19.90-dirty #17 Call Trace: [...] memcpy+0x34/0x50 mm/kasan/kasan.c:303 ext4_xattr_set_entry+0x18ab/0x3500 fs/ext4/xattr.c:1747 ext4_xattr_ibody_inline_set+0x86/0x2a0 fs/ext4/xattr.c:2205 ext4_xattr_set_handle+0x940/0x1300 fs/ext4/xattr.c:2386 ext4_xattr_set+0x1da/0x300 fs/ext4/xattr.c:2498 __vfs_setxattr+0x112/0x170 fs/xattr.c:149 __vfs_setxattr_noperm+0x11b/0x2a0 fs/xattr.c:180 __vfs_setxattr_locked+0x17b/0x250 fs/xattr.c:238 vfs_setxattr+0xed/0x270 fs/xattr.c:255 setxattr+0x235/0x330 fs/xattr.c:520 path_setxattr+0x176/0x190 fs/xattr.c:539 __do_sys_lsetxattr fs/xattr.c:561 [inline] __se_sys_lsetxattr fs/xattr.c:557 [inline] __x64_sys_lsetxattr+0xc2/0x160 fs/xattr.c:557 do_syscall_64+0xdf/0x530 arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x459fe9 RSP: 002b:00007fa5e54b4c08 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd RAX: ffffffffffffffda RBX: 000000000051bf60 RCX: 0000000000459fe9 RDX: 00000000200003c0 RSI: 0000000020000180 RDI: 0000000020000140 RBP: 000000000051bf60 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc73c93fc0 R14: 000000000051bf60 R15: 00007fa5e54b4d80 [...] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Above issue may happen as follows: Reported-by: Hulk Robot Reviewed-by: Jan Kara Reviewed-by: Ritesh Harjani (IBM) Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing ------------------------------------- ext4_xattr_set ext4_xattr_set_handle ext4_xattr_ibody_find >> s->end < s->base >> no EXT4_STATE_XATTR >> xattr_check_inode is not executed ext4_xattr_ibody_set ext4_xattr_set_entry >> size_t min_offs =3D s->end - s->base >> UAF in memcpy we can easily reproduce this problem with the following commands: mkfs.ext4 -F /dev/sda mount -o debug_want_extra_isize=3D128 /dev/sda /mnt touch /mnt/file setfattr -n user.cat -v `seq -s z 4096|tr -d '[:digit:]'` /mnt/file In ext4_xattr_ibody_find, we have the following assignment logic: header =3D IHDR(inode, raw_inode) =3D raw_inode + EXT4_GOOD_OLD_INODE_SIZE + i_extra_isize is->s.base =3D IFIRST(header) =3D header + sizeof(struct ext4_xattr_ibody_header) is->s.end =3D raw_inode + s_inode_size In ext4_xattr_set_entry min_offs =3D s->end - s->base =3D s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize - sizeof(struct ext4_xattr_ibody_header) last =3D s->first free =3D min_offs - ((void *)last - s->base) - sizeof(__u32) =3D s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize - sizeof(struct ext4_xattr_ibody_header) - sizeof(__u32) In the calculation formula, all values except s_inode_size and i_extra_size are fixed values. When i_extra_size is the maximum value s_inode_size - EXT4_GOOD_OLD_INODE_SIZE, min_offs is -4 and free is -8. The value overflows. As a result, the preceding issue is triggered when memcpy is executed. Therefore, when finding xattr or setting xattr, check whether there is space for storing xattr in the inode to resolve this issue. Cc: stable@kernel.org Reported-by: Hulk Robot Signed-off-by: Baokun Li Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220616021358.2504451-3-libaokun1@huawei.c= om Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman --- fs/ext4/xattr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -2187,8 +2187,9 @@ int ext4_xattr_ibody_find(struct inode * struct ext4_inode *raw_inode; int error; =20 - if (EXT4_I(inode)->i_extra_isize =3D=3D 0) + if (!EXT4_INODE_HAS_XATTR_SPACE(inode)) return 0; + raw_inode =3D ext4_raw_inode(&is->iloc); header =3D IHDR(inode, raw_inode); is->s.base =3D is->s.first =3D IFIRST(header); @@ -2216,8 +2217,9 @@ int ext4_xattr_ibody_inline_set(handle_t struct ext4_xattr_search *s =3D &is->s; int error; =20 - if (EXT4_I(inode)->i_extra_isize =3D=3D 0) + if (!EXT4_INODE_HAS_XATTR_SPACE(inode)) return -ENOSPC; + error =3D ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */); if (error) return error; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7ED6C38147 for ; Tue, 23 Aug 2022 10:06:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243211AbiHWKGh (ORCPT ); Tue, 23 Aug 2022 06:06:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45832 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352322AbiHWKBl (ORCPT ); Tue, 23 Aug 2022 06:01:41 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 13F127B7B0; Tue, 23 Aug 2022 01:49:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 198046122F; Tue, 23 Aug 2022 08:49:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C3BEEC433D6; Tue, 23 Aug 2022 08:49:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244559; bh=7o9wGdshU5JpHoJS4v5+Ldi10mCK71DBv3aRF5U5Y9A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OwQr2xjwdwIEDhl0F2/2xg5dVXaQbk46eBmLzkcTZWlaxvDiOuqeAgzW9vGLcSDbG CXmj9xL0pyo7Bd9RVE13fbQ6l20Kt8Dl7L2LWRB4QJpbvnhiuZUNnYofc+rm6ljtCi w0Y77nlG8fAJrbJ41Ly4Or4Y35Cdzetpdm/aXAjM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Theodore Tso , stable@kernel.org, Andreas Dilger Subject: [PATCH 4.14 155/229] ext4: update s_overhead_clusters in the superblock during an on-line resize Date: Tue, 23 Aug 2022 10:25:16 +0200 Message-Id: <20220823080059.208458416@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Theodore Ts'o commit de394a86658ffe4e89e5328fd4993abfe41b7435 upstream. When doing an online resize, the on-disk superblock on-disk wasn't updated. This means that when the file system is unmounted and remounted, and the on-disk overhead value is non-zero, this would result in the results of statfs(2) to be incorrect. This was partially fixed by Commits 10b01ee92df5 ("ext4: fix overhead calculation to account for the reserved gdt blocks"), 85d825dbf489 ("ext4: force overhead calculation if the s_overhead_cluster makes no sense"), and eb7054212eac ("ext4: update the cached overhead value in the superblock"). However, since it was too expensive to forcibly recalculate the overhead for bigalloc file systems at every mount, this didn't fix the problem for bigalloc file systems. This commit should address the problem when resizing file systems with the bigalloc feature enabled. Signed-off-by: Theodore Ts'o Cc: stable@kernel.org Reviewed-by: Andreas Dilger Link: https://lore.kernel.org/r/20220629040026.112371-1-tytso@mit.edu Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/ext4/resize.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1456,6 +1456,7 @@ static void ext4_update_super(struct sup * Update the fs overhead information */ ext4_calculate_overhead(sb); + es->s_overhead_clusters =3D cpu_to_le32(sbi->s_overhead); =20 if (test_opt(sb, DEBUG)) printk(KERN_DEBUG "EXT4-fs: added group %u:" From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D835C32774 for ; Tue, 23 Aug 2022 10:07:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352228AbiHWKHG (ORCPT ); Tue, 23 Aug 2022 06:07:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43874 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352401AbiHWKBw (ORCPT ); Tue, 23 Aug 2022 06:01:52 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 75F3182FB9; Tue, 23 Aug 2022 01:49:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0158EB81BF8; Tue, 23 Aug 2022 08:49:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 35CD2C433C1; Tue, 23 Aug 2022 08:49:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244568; bh=CVSo7CjZGkrDLL6BVK+W8HD7/XYyGy3iyIB5aosrHrs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fKrSMzYZWVRAnqLrREASiOHOz5WqPMCaJf0KOL+Kpl065iLSYM69/nNzr9/SP33ls J08uc4TnC8zmmcjW5Rc0wHnYQ831+9YljU6eFGqtykUMpmftYTlV35I9yQWsaqtln7 AQ4AZcZlvI44nsd0bNccMzZhiZddJo97KxkZrUJA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Ye Bin , Eric Whitney , Theodore Tso Subject: [PATCH 4.14 156/229] ext4: fix extent status tree race in writeback error recovery path Date: Tue, 23 Aug 2022 10:25:17 +0200 Message-Id: <20220823080059.248175868@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Whitney commit 7f0d8e1d607c1a4fa9a27362a108921d82230874 upstream. A race can occur in the unlikely event ext4 is unable to allocate a physical cluster for a delayed allocation in a bigalloc file system during writeback. Failure to allocate a cluster forces error recovery that includes a call to mpage_release_unused_pages(). That function removes any corresponding delayed allocated blocks from the extent status tree. If a new delayed write is in progress on the same cluster simultaneously, resulting in the addition of an new extent containing one or more blocks in that cluster to the extent status tree, delayed block accounting can be thrown off if that delayed write then encounters a similar cluster allocation failure during future writeback. Write lock the i_data_sem in mpage_release_unused_pages() to fix this problem. Ext4's block/cluster accounting code for bigalloc relies on i_data_sem for mutual exclusion, as is found in the delayed write path, and the locking in mpage_release_unused_pages() is missing. Cc: stable@kernel.org Reported-by: Ye Bin Signed-off-by: Eric Whitney Link: https://lore.kernel.org/r/20220615160530.1928801-1-enwlinux@gmail.com Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/ext4/inode.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -1754,7 +1754,14 @@ static void mpage_release_unused_pages(s ext4_lblk_t start, last; start =3D index << (PAGE_SHIFT - inode->i_blkbits); last =3D end << (PAGE_SHIFT - inode->i_blkbits); + + /* + * avoid racing with extent status tree scans made by + * ext4_insert_delayed_block() + */ + down_write(&EXT4_I(inode)->i_data_sem); ext4_es_remove_extent(inode, start, last - start + 1); + up_write(&EXT4_I(inode)->i_data_sem); } =20 pagevec_init(&pvec, 0); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ECC75C32774 for ; Tue, 23 Aug 2022 10:07:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352270AbiHWKHP (ORCPT ); Tue, 23 Aug 2022 06:07:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43886 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352409AbiHWKBw (ORCPT ); Tue, 23 Aug 2022 06:01:52 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 28DB81408A; Tue, 23 Aug 2022 01:49:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 82C736123D; Tue, 23 Aug 2022 08:49:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7600EC433D6; Tue, 23 Aug 2022 08:49:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244574; bh=fMHn/Vf6sz9I5BG9XFOTBqc05WPfoxjFlUueGrdfOEI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FHcv5Cpwutkflnnd1wgE7PkI2tV4BZI1YSTb0ki3OrRYx15wq9t35AcK7pTWeZ09+ Tmj7HCNtjzMv8R5bKt8gvA7tPcRwkrPmunmgjTWD3hwIeAkCGyZ5XvzjUE9+nIvTGA E2S5BrFaviElXxBBr638gD6zUR+RDz5HVxm1XPoU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Baokun Li , "Ritesh Harjani (IBM)" , Jan Kara , Theodore Tso Subject: [PATCH 4.14 157/229] ext4: correct max_inline_xattr_value_size computing Date: Tue, 23 Aug 2022 10:25:18 +0200 Message-Id: <20220823080059.288334047@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Baokun Li commit c9fd167d57133c5b748d16913c4eabc55e531c73 upstream. If the ext4 inode does not have xattr space, 0 is returned in the get_max_inline_xattr_value_size function. Otherwise, the function returns a negative value when the inode does not contain EXT4_STATE_XATTR. Cc: stable@kernel.org Signed-off-by: Baokun Li Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220616021358.2504451-4-libaokun1@huawei.c= om Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/ext4/inline.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -40,6 +40,9 @@ static int get_max_inline_xattr_value_si struct ext4_inode *raw_inode; int free, min_offs; =20 + if (!EXT4_INODE_HAS_XATTR_SPACE(inode)) + return 0; + min_offs =3D EXT4_SB(inode->i_sb)->s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - EXT4_I(inode)->i_extra_isize - From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 734EEC32792 for ; Tue, 23 Aug 2022 10:12:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353156AbiHWKK6 (ORCPT ); Tue, 23 Aug 2022 06:10:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46732 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352830AbiHWKCe (ORCPT ); Tue, 23 Aug 2022 06:02:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CFC177C53D; Tue, 23 Aug 2022 01:51:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2D172B81BF8; Tue, 23 Aug 2022 08:51:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7EBC8C433D6; Tue, 23 Aug 2022 08:50:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244659; bh=N+m636UE15ZLpNywr+fbVOB/mn0j1i9xnTyDMEwWYMI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LLs/IQvyHSYSOkHyvbTklvz2/yz03xVVVKIu2mtXJCfAyMcwleEh4u1vC7GOZBsV5 9DrEs3go+hMuHBpWuW7wrl7IicjhL1WMEWGlY3eTCjo+GWLwk3j+49HkTK2599Eo0j DeO1lGLOs4U47KWc6+feVW6mTZtzIFLQJfk3vj3Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Baokun Li , "Ritesh Harjani (IBM)" , Jan Kara , Theodore Tso Subject: [PATCH 4.14 158/229] ext4: correct the misjudgment in ext4_iget_extra_inode Date: Tue, 23 Aug 2022 10:25:19 +0200 Message-Id: <20220823080059.324006952@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Baokun Li commit fd7e672ea98b95b9d4c9dae316639f03c16a749d upstream. Use the EXT4_INODE_HAS_XATTR_SPACE macro to more accurately determine whether the inode have xattr space. Cc: stable@kernel.org Signed-off-by: Baokun Li Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220616021358.2504451-5-libaokun1@huawei.c= om Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/ext4/inode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -4735,8 +4735,7 @@ static inline int ext4_iget_extra_inode( __le32 *magic =3D (void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize; =20 - if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32) <=3D - EXT4_INODE_SIZE(inode->i_sb) && + if (EXT4_INODE_HAS_XATTR_SPACE(inode) && *magic =3D=3D cpu_to_le32(EXT4_XATTR_MAGIC)) { ext4_set_inode_state(inode, EXT4_STATE_XATTR); return ext4_find_inline_data_nolock(inode); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00C56C3F6B0 for ; Tue, 23 Aug 2022 10:12:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348371AbiHWKMa (ORCPT ); Tue, 23 Aug 2022 06:12:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46770 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352560AbiHWKFx (ORCPT ); Tue, 23 Aug 2022 06:05:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 792647CB76; Tue, 23 Aug 2022 01:52:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 177C66153F; Tue, 23 Aug 2022 08:52:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 11B01C433D6; Tue, 23 Aug 2022 08:52:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244728; bh=gAK/bD2X6hGbVms0l+HlrerCqZ+aLR/eW/P8dzw0fvI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mohZQMffAWJ/8GbF1LhTrkFvFpzJjjGkaycJCmEJRjSAuVCbqAAqZvIiSQQxfT6sR 9yvkdRNDKUcd1QUb0Ej15kn8qCgrPpLvhusv7NCWOlrSRO6puXFoLCpgY9EMS96IbO bCwwyBmgMD8ceK17GyAFXaWM3ghShQ3bhBzazpww= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Shevchenko , stable , Alexander Shishkin Subject: [PATCH 4.14 159/229] intel_th: pci: Add Raptor Lake-S CPU support Date: Tue, 23 Aug 2022 10:25:20 +0200 Message-Id: <20220823080059.355619362@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Shishkin commit ff46a601afc5a66a81c3945b83d0a2caeb88e8bc upstream. Add support for the Trace Hub in Raptor Lake-S CPU. Reviewed-by: Andy Shevchenko Cc: stable Signed-off-by: Alexander Shishkin Link: https://lore.kernel.org/r/20220705082637.59979-7-alexander.shishkin@l= inux.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/hwtracing/intel_th/pci.c +++ b/drivers/hwtracing/intel_th/pci.c @@ -254,6 +254,11 @@ static const struct pci_device_id intel_ .driver_data =3D (kernel_ulong_t)&intel_th_2x, }, { + /* Raptor Lake-S CPU */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa76f), + .driver_data =3D (kernel_ulong_t)&intel_th_2x, + }, + { /* Rocket Lake CPU */ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4c19), .driver_data =3D (kernel_ulong_t)&intel_th_2x, From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A675AC32772 for ; Tue, 23 Aug 2022 10:14:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353051AbiHWKOe (ORCPT ); Tue, 23 Aug 2022 06:14:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57892 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352783AbiHWKGR (ORCPT ); Tue, 23 Aug 2022 06:06:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 48E141706D; Tue, 23 Aug 2022 01:52:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D057D611DD; Tue, 23 Aug 2022 08:52:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DA989C433D6; Tue, 23 Aug 2022 08:52:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244777; bh=xTE+WIlYlbFUxAgf1adSZ4BmPtJbzXnhoxEqVKDjqtY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2redC4PLBOIMzkRDTcs/nC3Fycya5j5+h708IY+xIazAajYT/rWDf8+K6Qv+gOmHf hnX8xJPlIrgtXgf7O037qCgmphJSQpBrYzPBZywoXGf/LQmu3zeHlBVw29RMhDIXVj VQF+EgCnXZkGlqNwRpAfRUTldR+teIP9WbPpg7wY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Shevchenko , stable , Alexander Shishkin Subject: [PATCH 4.14 160/229] intel_th: pci: Add Raptor Lake-S PCH support Date: Tue, 23 Aug 2022 10:25:21 +0200 Message-Id: <20220823080059.391832934@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Shishkin commit 23e2de5826e2fc4dd43e08bab3a2ea1a5338b063 upstream. Add support for the Trace Hub in Raptor Lake-S PCH. Reviewed-by: Andy Shevchenko Cc: stable Signed-off-by: Alexander Shishkin Link: https://lore.kernel.org/r/20220705082637.59979-6-alexander.shishkin@l= inux.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/hwtracing/intel_th/pci.c +++ b/drivers/hwtracing/intel_th/pci.c @@ -259,6 +259,11 @@ static const struct pci_device_id intel_ .driver_data =3D (kernel_ulong_t)&intel_th_2x, }, { + /* Raptor Lake-S */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7a26), + .driver_data =3D (kernel_ulong_t)&intel_th_2x, + }, + { /* Rocket Lake CPU */ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4c19), .driver_data =3D (kernel_ulong_t)&intel_th_2x, From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0139DC32772 for ; Tue, 23 Aug 2022 10:14:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353350AbiHWKOq (ORCPT ); Tue, 23 Aug 2022 06:14:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57952 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352806AbiHWKGS (ORCPT ); Tue, 23 Aug 2022 06:06:18 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EFDCF25C59; Tue, 23 Aug 2022 01:53:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 51E6461377; Tue, 23 Aug 2022 08:53:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50BF5C433C1; Tue, 23 Aug 2022 08:53:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244783; bh=Wm76leAtdAQRADGFxpYZND+YCExrA9wLWggAG8r2BQE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jNdW4woIuuMuxxiNnfbcA+w3E6Uv0/zAru4vTU/iaE5bN7fvsjozSWx0Fl3BqVn5M sepbMt6xNomyeCOQUovuuL2OA1pM/7vLLIE5A8XhaVFpW9aMHyl+vqLFxMH3zPWrmp 3ELoGx/AB4cDBiJ8Gv090+W24t33XsruUpki5ZFM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Shevchenko , stable , Alexander Shishkin Subject: [PATCH 4.14 161/229] intel_th: pci: Add Meteor Lake-P support Date: Tue, 23 Aug 2022 10:25:22 +0200 Message-Id: <20220823080059.422115503@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Shishkin commit 802a9a0b1d91274ef10d9fe429b4cc1e8c200aef upstream. Add support for the Trace Hub in Meteor Lake-P. Reviewed-by: Andy Shevchenko Cc: stable Signed-off-by: Alexander Shishkin Link: https://lore.kernel.org/r/20220705082637.59979-5-alexander.shishkin@l= inux.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/hwtracing/intel_th/pci.c +++ b/drivers/hwtracing/intel_th/pci.c @@ -264,6 +264,11 @@ static const struct pci_device_id intel_ .driver_data =3D (kernel_ulong_t)&intel_th_2x, }, { + /* Meteor Lake-P */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7e24), + .driver_data =3D (kernel_ulong_t)&intel_th_2x, + }, + { /* Rocket Lake CPU */ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4c19), .driver_data =3D (kernel_ulong_t)&intel_th_2x, From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F23ADC32772 for ; Tue, 23 Aug 2022 10:08:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351960AbiHWKIp (ORCPT ); Tue, 23 Aug 2022 06:08:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44784 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352526AbiHWKCB (ORCPT ); Tue, 23 Aug 2022 06:02:01 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3DBE8A260B; Tue, 23 Aug 2022 01:49:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A08F2B81B90; Tue, 23 Aug 2022 08:49:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 014EEC433C1; Tue, 23 Aug 2022 08:49:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244597; bh=BONo5jgRyauoo1vO9FpGyfO7DzEIhl66XISMXw96hok=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i0SILXfmAfUUYPHFm1Q5gl1NA98kNdK9H6Dd5F/aJBvwTB+4X2klp1xEeF6XgRD6F g2io4jfG1Avh1hClHfRA8D8FgBFApDpW3mFo4L5BPFfPP24WDKCYC1zfde9Za+OHBn DFylVDsY36IU0dMjKT885J3AgR1dS1BIZzis99dA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Mike Snitzer Subject: [PATCH 4.14 162/229] dm raid: fix address sanitizer warning in raid_resume Date: Tue, 23 Aug 2022 10:25:23 +0200 Message-Id: <20220823080059.462238932@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit 7dad24db59d2d2803576f2e3645728866a056dab upstream. There is a KASAN warning in raid_resume when running the lvm test lvconvert-raid.sh. The reason for the warning is that mddev->raid_disks is greater than rs->raid_disks, so the loop touches one entry beyond the allocated length. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/md/dm-raid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -3669,7 +3669,7 @@ static void attempt_restore_of_faulty_de =20 memset(cleared_failed_devices, 0, sizeof(cleared_failed_devices)); =20 - for (i =3D 0; i < mddev->raid_disks; i++) { + for (i =3D 0; i < rs->raid_disks; i++) { r =3D &rs->dev[i].rdev; /* HM FIXME: enhance journal device recovery processing */ if (test_bit(Journal, &r->flags)) From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A68C2C32772 for ; Tue, 23 Aug 2022 10:08:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352762AbiHWKIu (ORCPT ); Tue, 23 Aug 2022 06:08:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43446 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352563AbiHWKCH (ORCPT ); Tue, 23 Aug 2022 06:02:07 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D2907C330; Tue, 23 Aug 2022 01:50:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 012F761386; Tue, 23 Aug 2022 08:50:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E4854C43470; Tue, 23 Aug 2022 08:50:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244603; bh=e+yJzTQerwJUBXmocqiz1bulRsPaY47NFWa5KTCk2WM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EG+bqQhUiDnE6DM745jBTJu6SKoQ+Vuoz4AvQn3Uie0qQ+mrC5Al/I6VFV9GxYQRS 8g9MYWXzWJFbRAJoklzS+ZGh8QwqVHUjp2YOzbPZMQ79OUDEUnCaDO+605TsQnT8Ex F3NCgQi3eFUx3UOWGppFM29QZh4IcRKVw0mF3lWA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Mike Snitzer Subject: [PATCH 4.14 163/229] dm raid: fix address sanitizer warning in raid_status Date: Tue, 23 Aug 2022 10:25:24 +0200 Message-Id: <20220823080059.492496579@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit 1fbeea217d8f297fe0e0956a1516d14ba97d0396 upstream. There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi= _raid =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid] Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319 CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3. #1 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: dump_stack_lvl+0x6a/0x9c print_address_description.constprop.0+0x1f/0x1e0 print_report.cold+0x55/0x244 kasan_report+0xc9/0x100 raid_status+0x1747/0x2820 [dm_raid] dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod] table_load+0x35c/0x630 [dm_mod] ctl_ioctl+0x411/0x630 [dm_mod] dm_ctl_ioctl+0xa/0x10 [dm_mod] __x64_sys_ioctl+0x12a/0x1a0 do_syscall_64+0x5b/0x80 The warning is caused by reading conf->max_nr_stripes in raid_status. The code in raid_status reads mddev->private, casts it to struct r5conf and reads the entry max_nr_stripes. However, if we have different raid type than 4/5/6, mddev->private doesn't point to struct r5conf; it may point to struct r0conf, struct r1conf, struct r10conf or struct mpconf. If we cast a pointer to one of these structs to struct r5conf, we will be reading invalid memory and KASAN warns about it. Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6. Cc: stable@vger.kernel.org Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/md/dm-raid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -3394,7 +3394,7 @@ static void raid_status(struct dm_target { struct raid_set *rs =3D ti->private; struct mddev *mddev =3D &rs->md; - struct r5conf *conf =3D mddev->private; + struct r5conf *conf =3D rs_is_raid456(rs) ? mddev->private : NULL; int i, max_nr_stripes =3D conf ? conf->max_nr_stripes : 0; bool array_in_sync; unsigned int raid_param_cnt =3D 1; /* at least 1 for chunksize */ From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E963C32772 for ; Tue, 23 Aug 2022 10:09:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352799AbiHWKI5 (ORCPT ); Tue, 23 Aug 2022 06:08:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45054 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352608AbiHWKCM (ORCPT ); Tue, 23 Aug 2022 06:02:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DD3A8481E5; Tue, 23 Aug 2022 01:50:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3892DB81BF8; Tue, 23 Aug 2022 08:50:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6E49CC433C1; Tue, 23 Aug 2022 08:50:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244609; bh=aBpW8P6JAzg18R0ex/FMrFPmZRwmlbCx0SvikDrfELc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pSuosgHa4tngWMaHWBjNnp/QMZ92ygjD/r8O+PSB25eWEjDZK75lxthvd0ibOF1VM MTSmFQSao6MJyoVY23ZEew4wDZHNWMXGWLcmLJVhHlQbagf5PrIlVqi6YqKZtQamD8 etq5DxsS+EXU77ElmbIgH/ZnPVRJu+7bN+2OnKmM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhenpeng Lin , Thadeu Lima de Souza Cascardo , Kamal Mostafa , Jamal Hadi Salim , Jakub Kicinski Subject: [PATCH 4.14 164/229] net_sched: cls_route: remove from list when handle is 0 Date: Tue, 23 Aug 2022 10:25:25 +0200 Message-Id: <20220823080059.527782547@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thadeu Lima de Souza Cascardo commit 9ad36309e2719a884f946678e0296be10f0bb4c1 upstream. When a route filter is replaced and the old filter has a 0 handle, the old one won't be removed from the hashtable, while it will still be freed. The test was there since before commit 1109c00547fc ("net: sched: RCU cls_route"), when a new filter was not allocated when there was an old one. The old filter was reused and the reinserting would only be necessary if an old filter was replaced. That was still wrong for the same case where the old handle was 0. Remove the old filter from the list independently from its handle value. This fixes CVE-2022-2588, also reported as ZDI-CAN-17440. Reported-by: Zhenpeng Lin Signed-off-by: Thadeu Lima de Souza Cascardo Reviewed-by: Kamal Mostafa Cc: Acked-by: Jamal Hadi Salim Link: https://lore.kernel.org/r/20220809170518.164662-1-cascardo@canonical.= com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sched/cls_route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/sched/cls_route.c +++ b/net/sched/cls_route.c @@ -531,7 +531,7 @@ static int route4_change(struct net *net rcu_assign_pointer(f->next, f1); rcu_assign_pointer(*fp, f); =20 - if (fold && fold->handle && f->handle !=3D fold->handle) { + if (fold) { th =3D to_hash(fold->handle); h =3D from_hash(fold->handle >> 16); b =3D rtnl_dereference(head->table[th]); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2DFA1C32772 for ; Tue, 23 Aug 2022 10:09:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352846AbiHWKJO (ORCPT ); Tue, 23 Aug 2022 06:09:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45178 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352633AbiHWKCO (ORCPT ); Tue, 23 Aug 2022 06:02:14 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8CBC97C509; Tue, 23 Aug 2022 01:50:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 94BA56123D; Tue, 23 Aug 2022 08:50:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9DCF4C433D6; Tue, 23 Aug 2022 08:50:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244617; bh=fqxtpDYui42e3oAumHWuDp8Hl2ILf0kVXWlvW13h+cU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hAJXefLtUpO2qMYr4yPCTqAC0g07eg7rXihZ7o/Yt5ZyZyKSa5jjrTWCwLYchyTMk 3XC3X0UtnWrySS+0nO5XiMftoC5AT/1rpxzlHgk6VZhr+ONxUzM7Hnddw53YyhOQjJ HOt+6ctP+gifysQX0OCSOQ03mYAZ17YVKzV8vYes= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qu Wenruo , David Sterba Subject: [PATCH 4.14 165/229] btrfs: reject log replay if there is unsupported RO compat flag Date: Tue, 23 Aug 2022 10:25:26 +0200 Message-Id: <20220823080059.557577359@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Qu Wenruo commit dc4d31684974d140250f3ee612c3f0cab13b3146 upstream. [BUG] If we have a btrfs image with dirty log, along with an unsupported RO compatible flag: log_root 30474240 ... compat_flags 0x0 compat_ro_flags 0x40000003 ( FREE_SPACE_TREE | FREE_SPACE_TREE_VALID | unknown flag: 0x40000000 ) Then even if we can only mount it RO, we will still cause metadata update for log replay: BTRFS info (device dm-1): flagging fs with big metadata feature BTRFS info (device dm-1): using free space tree BTRFS info (device dm-1): has skinny extents BTRFS info (device dm-1): start tree-log replay This is definitely against RO compact flag requirement. [CAUSE] RO compact flag only forces us to do RO mount, but we will still do log replay for plain RO mount. Thus this will result us to do log replay and update metadata. This can be very problematic for new RO compat flag, for example older kernel can not understand v2 cache, and if we allow metadata update on RO mount and invalidate/corrupt v2 cache. [FIX] Just reject the mount unless rescue=3Dnologreplay is provided: BTRFS error (device dm-1): cannot replay dirty log with unsupport optiona= l features (0x40000000), try rescue=3Dnologreplay instead We don't want to set rescue=3Dnologreply directly, as this would make the end user to read the old data, and cause confusion. Since the such case is really rare, we're mostly fine to just reject the mount with an error message, which also includes the proper workaround. CC: stable@vger.kernel.org #4.9+ Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/btrfs/disk-io.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -2718,6 +2718,20 @@ int open_ctree(struct super_block *sb, err =3D -EINVAL; goto fail_alloc; } + /* + * We have unsupported RO compat features, although RO mounted, we + * should not cause any metadata write, including log replay. + * Or we could screw up whatever the new feature requires. + */ + if (unlikely(features && btrfs_super_log_root(disk_super) && + !btrfs_test_opt(fs_info, NOLOGREPLAY))) { + btrfs_err(fs_info, +"cannot replay dirty log with unsupported compat_ro features (0x%llx), try= rescue=3Dnologreplay", + features); + err =3D -EINVAL; + goto fail_alloc; + } + =20 max_active =3D fs_info->thread_pool_size; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 422B5C32793 for ; Tue, 23 Aug 2022 10:09:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352372AbiHWKJc (ORCPT ); Tue, 23 Aug 2022 06:09:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46770 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352663AbiHWKCR (ORCPT ); Tue, 23 Aug 2022 06:02:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 845067C50B; Tue, 23 Aug 2022 01:50:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8B9D86123D; Tue, 23 Aug 2022 08:50:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9373AC433D6; Tue, 23 Aug 2022 08:50:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244623; bh=pYv0s+DA1pMeJor9ECUWgdPYc8ygXV2JEQzucavj7a4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uuf6xfXW1BL6vwju9nthOqfJM+qqRon1NG7OzTOXmWdAkzBDOYIQ4BCuCEneFQWqr IVAT8wpv7kBbs49pyHb3gjCSWZmNMjJGn99TTTaXzdT//ZACW9aumWYYB1z7DKgxQe hBhBrAtPetjNJiRrZ5pwdrzpOCj2KvnsepM3YC0w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Sean Christopherson , Isaku Yamahata , Paolo Bonzini , Stefan Ghinea Subject: [PATCH 4.14 166/229] KVM: Add infrastructure and macro to mark VM as bugged Date: Tue, 23 Aug 2022 10:25:27 +0200 Message-Id: <20220823080059.589456877@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Christopherson commit 0b8f11737cffc1a406d1134b58687abc29d76b52 upstream Signed-off-by: Sean Christopherson Signed-off-by: Isaku Yamahata Reviewed-by: Paolo Bonzini Message-Id: <3a0998645c328bf0895f1290e61821b70f048549.1625186503.git.isaku.= yamahata@intel.com> Signed-off-by: Paolo Bonzini [SG: Adjusted context for kernel version 4.14] Signed-off-by: Stefan Ghinea Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/linux/kvm_host.h | 28 +++++++++++++++++++++++++++- virt/kvm/kvm_main.c | 10 +++++----- 2 files changed, 32 insertions(+), 6 deletions(-) --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -127,6 +127,7 @@ static inline bool is_error_page(struct #define KVM_REQ_MMU_RELOAD (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_W= AKEUP) #define KVM_REQ_PENDING_TIMER 2 #define KVM_REQ_UNHALT 3 +#define KVM_REQ_VM_BUGGED (4 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_W= AKEUP) #define KVM_REQUEST_ARCH_BASE 8 =20 #define KVM_ARCH_REQ_FLAGS(nr, flags) ({ \ @@ -446,6 +447,7 @@ struct kvm { struct kvm_stat_data **debugfs_stat_data; struct srcu_struct srcu; struct srcu_struct irq_srcu; + bool vm_bugged; pid_t userspace_pid; }; =20 @@ -475,6 +477,31 @@ struct kvm { #define vcpu_err(vcpu, fmt, ...) \ kvm_err("vcpu%i " fmt, (vcpu)->vcpu_id, ## __VA_ARGS__) =20 +bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); +static inline void kvm_vm_bugged(struct kvm *kvm) +{ + kvm->vm_bugged =3D true; + kvm_make_all_cpus_request(kvm, KVM_REQ_VM_BUGGED); +} + +#define KVM_BUG(cond, kvm, fmt...) \ +({ \ + int __ret =3D (cond); \ + \ + if (WARN_ONCE(__ret && !(kvm)->vm_bugged, fmt)) \ + kvm_vm_bugged(kvm); \ + unlikely(__ret); \ +}) + +#define KVM_BUG_ON(cond, kvm) \ +({ \ + int __ret =3D (cond); \ + \ + if (WARN_ON_ONCE(__ret && !(kvm)->vm_bugged)) \ + kvm_vm_bugged(kvm); \ + unlikely(__ret); \ +}) + static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus= idx) { return srcu_dereference_check(kvm->buses[idx], &kvm->srcu, @@ -732,7 +759,6 @@ void kvm_put_guest_fpu(struct kvm_vcpu * =20 void kvm_flush_remote_tlbs(struct kvm *kvm); void kvm_reload_remote_mmus(struct kvm *kvm); -bool kvm_make_all_cpus_request(struct kvm *kvm, unsigned int req); =20 long kvm_arch_dev_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg); --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -2660,7 +2660,7 @@ static long kvm_vcpu_ioctl(struct file * struct kvm_fpu *fpu =3D NULL; struct kvm_sregs *kvm_sregs =3D NULL; =20 - if (vcpu->kvm->mm !=3D current->mm) + if (vcpu->kvm->mm !=3D current->mm || vcpu->kvm->vm_bugged) return -EIO; =20 if (unlikely(_IOC_TYPE(ioctl) !=3D KVMIO)) @@ -2864,7 +2864,7 @@ static long kvm_vcpu_compat_ioctl(struct void __user *argp =3D compat_ptr(arg); int r; =20 - if (vcpu->kvm->mm !=3D current->mm) + if (vcpu->kvm->mm !=3D current->mm || vcpu->kvm->vm_bugged) return -EIO; =20 switch (ioctl) { @@ -2922,7 +2922,7 @@ static long kvm_device_ioctl(struct file { struct kvm_device *dev =3D filp->private_data; =20 - if (dev->kvm->mm !=3D current->mm) + if (dev->kvm->mm !=3D current->mm || dev->kvm->vm_bugged) return -EIO; =20 switch (ioctl) { @@ -3087,7 +3087,7 @@ static long kvm_vm_ioctl(struct file *fi void __user *argp =3D (void __user *)arg; int r; =20 - if (kvm->mm !=3D current->mm) + if (kvm->mm !=3D current->mm || kvm->vm_bugged) return -EIO; switch (ioctl) { case KVM_CREATE_VCPU: @@ -3264,7 +3264,7 @@ static long kvm_vm_compat_ioctl(struct f struct kvm *kvm =3D filp->private_data; int r; =20 - if (kvm->mm !=3D current->mm) + if (kvm->mm !=3D current->mm || kvm->vm_bugged) return -EIO; switch (ioctl) { case KVM_GET_DIRTY_LOG: { From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9363CC32796 for ; Tue, 23 Aug 2022 10:09:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352993AbiHWKJz (ORCPT ); Tue, 23 Aug 2022 06:09:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44684 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352717AbiHWKCZ (ORCPT ); Tue, 23 Aug 2022 06:02:25 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 31B3F7C53E; Tue, 23 Aug 2022 01:50:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B5F07B8105C; Tue, 23 Aug 2022 08:50:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0619FC433C1; Tue, 23 Aug 2022 08:50:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244632; bh=KHKdcDR1KcGMN127IkrwnlFmcCyodJnypzzaBS50q94=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mGOuJUTltSaEgam8ToqSubkZgGtl4VNAlzLrKDYzfgT7Xl6UTjkKahx/tzMzQWLEk fAJFI7m2tKUD39zU8VHbjKn3JJkUh9lh2vMYWD/fSAhCz1gMEEQt9MqhlVUydsKe+7 KuL2X/3CAMMXqxwedx2q3WLgoKzOG+aBzKiJTukM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Vitaly Kuznetsov , Paolo Bonzini , Stefan Ghinea Subject: [PATCH 4.14 167/229] KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq Date: Tue, 23 Aug 2022 10:25:28 +0200 Message-Id: <20220823080059.622082211@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vitaly Kuznetsov commit 7ec37d1cbe17d8189d9562178d8b29167fe1c31a upstream When KVM_CAP_HYPERV_SYNIC{,2} is activated, KVM already checks for irqchip_in_kernel() so normally SynIC irqs should never be set. It is, however, possible for a misbehaving VMM to write to SYNIC/STIMER MSRs causing erroneous behavior. The immediate issue being fixed is that kvm_irq_delivery_to_apic() (kvm_irq_delivery_to_apic_fast()) crashes when called with 'irq.shorthand =3D APIC_DEST_SELF' and 'src =3D=3D NULL'. Signed-off-by: Vitaly Kuznetsov Message-Id: <20220325132140.25650-2-vkuznets@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini Signed-off-by: Stefan Ghinea Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/kvm/hyperv.c | 3 +++ 1 file changed, 3 insertions(+) --- a/arch/x86/kvm/hyperv.c +++ b/arch/x86/kvm/hyperv.c @@ -317,6 +317,9 @@ static int synic_set_irq(struct kvm_vcpu struct kvm_lapic_irq irq; int ret, vector; =20 + if (KVM_BUG_ON(!lapic_in_kernel(vcpu), vcpu->kvm)) + return -EINVAL; + if (sint >=3D ARRAY_SIZE(synic->sint)) return -EINVAL; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AFA70C32793 for ; Tue, 23 Aug 2022 10:10:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353020AbiHWKKE (ORCPT ); Tue, 23 Aug 2022 06:10:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44750 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352733AbiHWKC0 (ORCPT ); Tue, 23 Aug 2022 06:02:26 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 716CF7C52E; Tue, 23 Aug 2022 01:50:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C6C34B8105C; Tue, 23 Aug 2022 08:50:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0C41CC433D6; Tue, 23 Aug 2022 08:50:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244638; bh=hEUNJb7IAicBZVfgahbqM6ydvks3bcoQGC/znlVEVbs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=blqU+WJEeTRoc+wRKaC3rGKTfq243USOROI3zycNs5NcT0eFL7yMIu6rz+dCrbXeX KtA+ZUdrojxer0kNvG+vKB4L47S16h8PbqxH5p30mDlQU03Ca3ay+wyV8EjFNfxLcn q2/4+Bv9pD+TxRR+bOzWCp+Z0cV0YAq3FWFGwEhg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Vitaly Kuznetsov , Paolo Bonzini , Stefan Ghinea Subject: [PATCH 4.14 168/229] KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast() Date: Tue, 23 Aug 2022 10:25:29 +0200 Message-Id: <20220823080059.653148604@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vitaly Kuznetsov commit 00b5f37189d24ac3ed46cb7f11742094778c46ce upstream When kvm_irq_delivery_to_apic_fast() is called with APIC_DEST_SELF shorthand, 'src' must not be NULL. Crash the VM with KVM_BUG_ON() instead of crashing the host. Signed-off-by: Vitaly Kuznetsov Message-Id: <20220325132140.25650-3-vkuznets@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini Signed-off-by: Stefan Ghinea Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/x86/kvm/lapic.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/arch/x86/kvm/lapic.c +++ b/arch/x86/kvm/lapic.c @@ -894,6 +894,10 @@ bool kvm_irq_delivery_to_apic_fast(struc *r =3D -1; =20 if (irq->shorthand =3D=3D APIC_DEST_SELF) { + if (KVM_BUG_ON(!src, kvm)) { + *r =3D 0; + return true; + } *r =3D kvm_apic_set_irq(src->vcpu, irq, dest_map); return true; } From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F816C32772 for ; Tue, 23 Aug 2022 10:10:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353040AbiHWKKR (ORCPT ); Tue, 23 Aug 2022 06:10:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46510 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352749AbiHWKC1 (ORCPT ); Tue, 23 Aug 2022 06:02:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 804907C748; Tue, 23 Aug 2022 01:50:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F05E8B8105C; Tue, 23 Aug 2022 08:50:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5AB8AC433D6; Tue, 23 Aug 2022 08:50:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244644; bh=MJ9PmoMD6d/lpjd/2z9GkI5gkqaZpktyZICEJxlwDDY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ImyXeCIhxzUKEjemGlRiPqOwF/W59dv9lJXIc+6wa5+9IX1/qy+gaa+L2jbLIXi5x ydxRRxVRbonMN73+WRth9kSkmGvsNZIFq+B3UZELfR7G6x6NYHmBi9YOIf0CTHFIkf PjFg08r5tTVt3M4oVDgeKgJv0jfmKs9/OFlZz01M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Soheil Hassas Yeganeh , Shakeel Butt , Wei Wang , "David S. Miller" Subject: [PATCH 4.14 169/229] tcp: fix over estimation in sk_forced_mem_schedule() Date: Tue, 23 Aug 2022 10:25:30 +0200 Message-Id: <20220823080059.684450676@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit c4ee118561a0f74442439b7b5b486db1ac1ddfeb upstream. sk_forced_mem_schedule() has a bug similar to ones fixed in commit 7c80b038d23e ("net: fix sk_wmem_schedule() and sk_rmem_schedule() errors") While this bug has little chance to trigger in old kernels, we need to fix it before the following patch. Fixes: d83769a580f1 ("tcp: fix possible deadlock in tcp_send_fin()") Signed-off-by: Eric Dumazet Acked-by: Soheil Hassas Yeganeh Reviewed-by: Shakeel Butt Reviewed-by: Wei Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv4/tcp_output.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -3086,11 +3086,12 @@ void tcp_xmit_retransmit_queue(struct so */ void sk_forced_mem_schedule(struct sock *sk, int size) { - int amt; + int delta, amt; =20 - if (size <=3D sk->sk_forward_alloc) + delta =3D size - sk->sk_forward_alloc; + if (delta <=3D 0) return; - amt =3D sk_mem_pages(size); + amt =3D sk_mem_pages(delta); sk->sk_forward_alloc +=3D amt * SK_MEM_QUANTUM; sk_memory_allocated_add(sk, amt); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E1FAC3F6B0 for ; Tue, 23 Aug 2022 10:12:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1351874AbiHWKKZ (ORCPT ); Tue, 23 Aug 2022 06:10:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46040 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352768AbiHWKC3 (ORCPT ); Tue, 23 Aug 2022 06:02:29 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 915637B7BD; Tue, 23 Aug 2022 01:50:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B04386123D; Tue, 23 Aug 2022 08:50:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A0630C433C1; Tue, 23 Aug 2022 08:50:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244651; bh=PBt7CMEjjSJnz42jZq6jLSJAqz/KxiL3mKGMUFZmvrI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XlUPJTxP7QRv7l8XbmrHziUAAB6uqz0G3pnqAXME3WyeqSAFz6uWf2ZrGruzAobLQ BiA2NP8Er8aMQNJi4Mz0SIVHKfdKiIFlVpTwlS2tEKdlv+L3ztL3BQuiimZJfmYqJd jiF7g+M4USD2A0oCY6EWMnlrp+kLSbdvK2G6v71M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Douglas Gilbert , Tony Battersby , "Martin K. Petersen" Subject: [PATCH 4.14 170/229] scsi: sg: Allow waiting for commands to complete on removed device Date: Tue, 23 Aug 2022 10:25:31 +0200 Message-Id: <20220823080059.714289917@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tony Battersby commit 3455607fd7be10b449f5135c00dc306b85dc0d21 upstream. When a SCSI device is removed while in active use, currently sg will immediately return -ENODEV on any attempt to wait for active commands that were sent before the removal. This is problematic for commands that use SG_FLAG_DIRECT_IO since the data buffer may still be in use by the kernel when userspace frees or reuses it after getting ENODEV, leading to corrupted userspace memory (in the case of READ-type commands) or corrupted data being sent to the device (in the case of WRITE-type commands). This has been seen in practice when logging out of a iscsi_tcp session, where the iSCSI driver may still be processing commands after the device has been marked for removal. Change the policy to allow userspace to wait for active sg commands even when the device is being removed. Return -ENODEV only when there are no more responses to read. Link: https://lore.kernel.org/r/5ebea46f-fe83-2d0b-233d-d0dcb362dd0a@cybern= etics.com Cc: Acked-by: Douglas Gilbert Signed-off-by: Tony Battersby Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/scsi/sg.c | 57 ++++++++++++++++++++++++++++++++-----------------= ----- 1 file changed, 34 insertions(+), 23 deletions(-) --- a/drivers/scsi/sg.c +++ b/drivers/scsi/sg.c @@ -196,7 +196,7 @@ static void sg_link_reserve(Sg_fd * sfp, static void sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp); static Sg_fd *sg_add_sfp(Sg_device * sdp); static void sg_remove_sfp(struct kref *); -static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id); +static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy); static Sg_request *sg_add_request(Sg_fd * sfp); static int sg_remove_request(Sg_fd * sfp, Sg_request * srp); static Sg_device *sg_get_dev(int dev); @@ -418,6 +418,7 @@ sg_read(struct file *filp, char __user * Sg_fd *sfp; Sg_request *srp; int req_pack_id =3D -1; + bool busy; sg_io_hdr_t *hp; struct sg_header *old_hdr =3D NULL; int retval =3D 0; @@ -465,25 +466,19 @@ sg_read(struct file *filp, char __user * } else req_pack_id =3D old_hdr->pack_id; } - srp =3D sg_get_rq_mark(sfp, req_pack_id); + srp =3D sg_get_rq_mark(sfp, req_pack_id, &busy); if (!srp) { /* now wait on packet to arrive */ - if (atomic_read(&sdp->detaching)) { - retval =3D -ENODEV; - goto free_old_hdr; - } if (filp->f_flags & O_NONBLOCK) { retval =3D -EAGAIN; goto free_old_hdr; } retval =3D wait_event_interruptible(sfp->read_wait, - (atomic_read(&sdp->detaching) || - (srp =3D sg_get_rq_mark(sfp, req_pack_id)))); - if (atomic_read(&sdp->detaching)) { - retval =3D -ENODEV; - goto free_old_hdr; - } - if (retval) { - /* -ERESTARTSYS as signal hit process */ + ((srp =3D sg_get_rq_mark(sfp, req_pack_id, &busy)) || + (!busy && atomic_read(&sdp->detaching)))); + if (!srp) { + /* signal or detaching */ + if (!retval) + retval =3D -ENODEV; goto free_old_hdr; } } @@ -934,9 +929,7 @@ sg_ioctl(struct file *filp, unsigned int if (result < 0) return result; result =3D wait_event_interruptible(sfp->read_wait, - (srp_done(sfp, srp) || atomic_read(&sdp->detaching))); - if (atomic_read(&sdp->detaching)) - return -ENODEV; + srp_done(sfp, srp)); write_lock_irq(&sfp->rq_list_lock); if (srp->done) { srp->done =3D 2; @@ -2096,19 +2089,28 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_reques } =20 static Sg_request * -sg_get_rq_mark(Sg_fd * sfp, int pack_id) +sg_get_rq_mark(Sg_fd * sfp, int pack_id, bool *busy) { Sg_request *resp; unsigned long iflags; =20 + *busy =3D false; write_lock_irqsave(&sfp->rq_list_lock, iflags); list_for_each_entry(resp, &sfp->rq_list, entry) { - /* look for requests that are ready + not SG_IO owned */ - if ((1 =3D=3D resp->done) && (!resp->sg_io_owned) && + /* look for requests that are not SG_IO owned */ + if ((!resp->sg_io_owned) && ((-1 =3D=3D pack_id) || (resp->header.pack_id =3D=3D pack_id))) { - resp->done =3D 2; /* guard against other readers */ - write_unlock_irqrestore(&sfp->rq_list_lock, iflags); - return resp; + switch (resp->done) { + case 0: /* request active */ + *busy =3D true; + break; + case 1: /* request done; response ready to return */ + resp->done =3D 2; /* guard against other readers */ + write_unlock_irqrestore(&sfp->rq_list_lock, iflags); + return resp; + case 2: /* response already being returned */ + break; + } } } write_unlock_irqrestore(&sfp->rq_list_lock, iflags); @@ -2162,6 +2164,15 @@ sg_remove_request(Sg_fd * sfp, Sg_reques res =3D 1; } write_unlock_irqrestore(&sfp->rq_list_lock, iflags); + + /* + * If the device is detaching, wakeup any readers in case we just + * removed the last response, which would leave nothing for them to + * return other than -ENODEV. + */ + if (unlikely(atomic_read(&sfp->parentdp->detaching))) + wake_up_interruptible_all(&sfp->read_wait); + return res; } From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61AFEC32772 for ; Tue, 23 Aug 2022 10:12:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353135AbiHWKKz (ORCPT ); Tue, 23 Aug 2022 06:10:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43776 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352792AbiHWKCb (ORCPT ); Tue, 23 Aug 2022 06:02:31 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 648427C326; Tue, 23 Aug 2022 01:50:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 72C7E6123D; Tue, 23 Aug 2022 08:50:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6F355C433D6; Tue, 23 Aug 2022 08:50:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244656; bh=OXoMqLlZZZMsi5G+sDeP4/86SNRjwZBF89nVavGfgew=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zFqnopMjTA8+J5sx6ytpqgo3FA2/QCk1qm+y67hWJ56uqwL6uKYdRb7vW6Pzyvtsv UFwzQm1hjy8aFBJIS097q7RTC0SMcv1kt5TLmdB718IiQEQhTbrwO2y+74eAMly2AS sB70oVp/n3KJ16qO8iWGDcptAoKqelp6aUFSXY/w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ronald Wahl , Jose Alonso , "David S. Miller" Subject: [PATCH 4.14 171/229] Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP" Date: Tue, 23 Aug 2022 10:25:32 +0200 Message-Id: <20220823080059.743742261@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jose Alonso commit 6fd2c17fb6e02a8c0ab51df1cfec82ce96b8e83d upstream. This reverts commit 36a15e1cb134c0395261ba1940762703f778438c. The usage of FLAG_SEND_ZLP causes problems to other firmware/hardware versions that have no issues. The FLAG_SEND_ZLP is not safe to use in this context. See: https://patchwork.ozlabs.org/project/netdev/patch/1270599787.8900.8.camel@L= inuxdev4-laptop/#118378 The original problem needs another way to solve. Fixes: 36a15e1cb134 ("net: usb: ax88179_178a needs FLAG_SEND_ZLP") Cc: stable@vger.kernel.org Reported-by: Ronald Wahl Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D216327 Link: https://bugs.archlinux.org/task/75491 Signed-off-by: Jose Alonso Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/usb/ax88179_178a.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) --- a/drivers/net/usb/ax88179_178a.c +++ b/drivers/net/usb/ax88179_178a.c @@ -1707,7 +1707,7 @@ static const struct driver_info ax88179_ .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1720,7 +1720,7 @@ static const struct driver_info ax88178a .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1733,7 +1733,7 @@ static const struct driver_info cypress_ .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1746,7 +1746,7 @@ static const struct driver_info dlink_du .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1759,7 +1759,7 @@ static const struct driver_info sitecom_ .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1772,7 +1772,7 @@ static const struct driver_info samsung_ .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1785,7 +1785,7 @@ static const struct driver_info lenovo_i .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1798,7 +1798,7 @@ static const struct driver_info belkin_i .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A286BC3F6B0 for ; Tue, 23 Aug 2022 10:12:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353225AbiHWKLF (ORCPT ); Tue, 23 Aug 2022 06:11:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352320AbiHWKCh (ORCPT ); Tue, 23 Aug 2022 06:02:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EC7CFA2630; Tue, 23 Aug 2022 01:51:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C5D256150F; Tue, 23 Aug 2022 08:51:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A2674C433C1; Tue, 23 Aug 2022 08:51:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244666; bh=t9EAyhTB6WaOrs6vp1R5UqNAeAWhZro/XkIxBgAHZao=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cfANHe7ae8ki5YsgBBeVvRiXmM/xOgZ/CR4W1WYJUAUEl/Yv1qaKjauTYFU42m9VP FAjzgsbXqwLKh+EiQsR2R/1Uq8zStnG8dEWt5OUv0qyEG8SXMkFYb267XwRKyRXqDL hT3N/Uakmq8Xbi9Zyl1aCg6CUfN3o+jS+B+ogI0s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Luiz Augusto von Dentz Subject: [PATCH 4.14 172/229] Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression Date: Tue, 23 Aug 2022 10:25:33 +0200 Message-Id: <20220823080059.774255146@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Luiz Augusto von Dentz commit 332f1795ca202489c665a75e62e18ff6284de077 upstream. The patch d0be8347c623: "Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch static checker warning: net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm() error: we previously assumed 'c' could be null (see line 1996) Fixes: d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_= chan_put") Reported-by: Dan Carpenter Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/bluetooth/l2cap_core.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -1804,11 +1804,11 @@ static struct l2cap_chan *l2cap_global_c bdaddr_t *dst, u8 link_type) { - struct l2cap_chan *c, *c1 =3D NULL; + struct l2cap_chan *c, *tmp, *c1 =3D NULL; =20 read_lock(&chan_list_lock); =20 - list_for_each_entry(c, &chan_list, global_l) { + list_for_each_entry_safe(c, tmp, &chan_list, global_l) { if (state && c->state !=3D state) continue; =20 @@ -1827,11 +1827,10 @@ static struct l2cap_chan *l2cap_global_c dst_match =3D !bacmp(&c->dst, dst); if (src_match && dst_match) { c =3D l2cap_chan_hold_unless_zero(c); - if (!c) - continue; - - read_unlock(&chan_list_lock); - return c; + if (c) { + read_unlock(&chan_list_lock); + return c; + } } =20 /* Closest match */ From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1782C32796 for ; Tue, 23 Aug 2022 10:12:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353335AbiHWKLQ (ORCPT ); Tue, 23 Aug 2022 06:11:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46390 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348491AbiHWKDM (ORCPT ); Tue, 23 Aug 2022 06:03:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 874387CA8E; Tue, 23 Aug 2022 01:51:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DCDF6614E7; Tue, 23 Aug 2022 08:51:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ED8B4C433D6; Tue, 23 Aug 2022 08:51:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244672; bh=JzZG4pcuoEvTsta1MebeIACcpqiLUb2VanMsjFEAJdI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y04HyKlwpv5oSvMxWQVhmY1JcAT6tKwoa2KwLkBxQ8rmGolhCSqYWyxrWaOPb2xUe l0fcKcj4QRzTLs4yGjnVEckGnGq6Mt+QCgLMd8d8Rm/m9J/1FHJXp4UZlH8pnjazyy Iggd6ZkUOuTgKRTBct5KijFniSnIZsS5Gdex7KvY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tyler Hicks , Christian Schoenebeck , Dominique Martinet Subject: [PATCH 4.14 173/229] net/9p: Initialize the iounit field during fid creation Date: Tue, 23 Aug 2022 10:25:34 +0200 Message-Id: <20220823080059.804303496@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tyler Hicks commit aa7aeee169480e98cf41d83c01290a37e569be6d upstream. Ensure that the fid's iounit field is set to zero when a new fid is created. Certain 9P operations, such as OPEN and CREATE, allow the server to reply with an iounit size which the client code assigns to the p9_fid struct shortly after the fid is created by p9_fid_create(). On the other hand, an XATTRWALK operation doesn't allow for the server to specify an iounit value. The iounit field of the newly allocated p9_fid struct remained uninitialized in that case. Depending on allocation patterns, the iounit value could have been something reasonable that was carried over from previously freed fids or, in the worst case, could have been arbitrary values from non-fid related usages of the memory location. The bug was detected in the Windows Subsystem for Linux 2 (WSL2) kernel after the uninitialized iounit field resulted in the typical sequence of two getxattr(2) syscalls, one to get the size of an xattr and another after allocating a sufficiently sized buffer to fit the xattr value, to hit an unexpected ERANGE error in the second call to getxattr(2). An uninitialized iounit field would sometimes force rsize to be smaller than the xattr value size in p9_client_read_once() and the 9P server in WSL refused to chunk up the READ on the attr_fid and, instead, returned ERANGE to the client. The virtfs server in QEMU seems happy to chunk up the READ and this problem goes undetected there. Link: https://lkml.kernel.org/r/20220710141402.803295-1-tyhicks@linux.micro= soft.com Fixes: ebf46264a004 ("fs/9p: Add support user. xattr") Cc: stable@vger.kernel.org Signed-off-by: Tyler Hicks Reviewed-by: Christian Schoenebeck Signed-off-by: Dominique Martinet [tyhicks: Adjusted context due to: - Lack of fid refcounting introduced in v5.11 commit 6636b6dcc3db ("9p: add refcount to p9_fid struct") - Difference in how buffer sizes are specified v5.16 commit 6e195b0f7c8e ("9p: fix a bunch of checkpatch warnings") - Reimplementation of the fidlist as an IDR in v4.19 commit f28cdf0430fc ("9p: Replace the fidlist with an IDR")] Signed-off-by: Tyler Hicks Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/9p/client.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) --- a/net/9p/client.c +++ b/net/9p/client.c @@ -915,7 +915,7 @@ static struct p9_fid *p9_fid_create(stru unsigned long flags; =20 p9_debug(P9_DEBUG_FID, "clnt %p\n", clnt); - fid =3D kmalloc(sizeof(struct p9_fid), GFP_KERNEL); + fid =3D kzalloc(sizeof(struct p9_fid), GFP_KERNEL); if (!fid) return ERR_PTR(-ENOMEM); =20 @@ -926,11 +926,9 @@ static struct p9_fid *p9_fid_create(stru } fid->fid =3D ret; =20 - memset(&fid->qid, 0, sizeof(struct p9_qid)); fid->mode =3D -1; fid->uid =3D current_fsuid(); fid->clnt =3D clnt; - fid->rdir =3D NULL; spin_lock_irqsave(&clnt->lock, flags); list_add(&fid->flist, &clnt->fidlist); spin_unlock_irqrestore(&clnt->lock, flags); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36371C48BE4 for ; Tue, 23 Aug 2022 10:12:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353436AbiHWKL3 (ORCPT ); Tue, 23 Aug 2022 06:11:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46710 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351993AbiHWKEQ (ORCPT ); Tue, 23 Aug 2022 06:04:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BDC947CAAE; Tue, 23 Aug 2022 01:51:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CF892B81C39; Tue, 23 Aug 2022 08:51:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17DC1C433C1; Tue, 23 Aug 2022 08:51:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244678; bh=Jy32Zh/HlrBFPGofS56r9APlpigQ81Lcmqyu53Rlg4g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vtzKxhBRTdrMDJnoSobxXUkkIxisa62IuO1HK50dIZ9l2LHXUdCplzVhS6Vgio1t8 rOFkXeEJQ9jCZ6iO6/nbxppFfE68RifUsfDf4bBECLyry0URSJZAfmjijPwR45UMIg 2QiZN7IwS96mO39tdUC0xOHigdoCfVANqLUbTVro= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jamal Hadi Salim , Stephen Hemminger , "David S. Miller" Subject: [PATCH 4.14 174/229] net_sched: cls_route: disallow handle of 0 Date: Tue, 23 Aug 2022 10:25:35 +0200 Message-Id: <20220823080059.835003991@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jamal Hadi Salim commit 02799571714dc5dd6948824b9d080b44a295f695 upstream. Follows up on: https://lore.kernel.org/all/20220809170518.164662-1-cascardo@canonical.com/ handle of 0 implies from/to of universe realm which is not very sensible. Lets see what this patch will do: $sudo tc qdisc add dev $DEV root handle 1:0 prio //lets manufacture a way to insert handle of 0 $sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 \ route to 0 from 0 classid 1:10 action ok //gets rejected... Error: handle of 0 is not valid. We have an error talking to the kernel, -1 //lets create a legit entry.. sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 route from 10 \ classid 1:10 action ok //what did the kernel insert? $sudo tc filter ls dev $DEV parent 1:0 filter protocol ip pref 100 route chain 0 filter protocol ip pref 100 route chain 0 fh 0x000a8000 flowid 1:10 from 10 action order 1: gact action pass random type none pass val 0 index 1 ref 1 bind 1 //Lets try to replace that legit entry with a handle of 0 $ sudo tc filter replace dev $DEV parent 1:0 protocol ip prio 100 \ handle 0x000a8000 route to 0 from 0 classid 1:10 action drop Error: Replacing with handle of 0 is invalid. We have an error talking to the kernel, -1 And last, lets run Cascardo's POC: $ ./poc 0 0 -22 -22 -22 Signed-off-by: Jamal Hadi Salim Acked-by: Stephen Hemminger Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sched/cls_route.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/net/sched/cls_route.c +++ b/net/sched/cls_route.c @@ -431,6 +431,9 @@ static int route4_set_parms(struct net * return -EINVAL; } =20 + if (!nhandle) + return -EINVAL; + h1 =3D to_hash(nhandle); b =3D rtnl_dereference(head->table[h1]); if (!b) { @@ -483,6 +486,9 @@ static int route4_change(struct net *net int err; bool new =3D true; =20 + if (!handle) + return -EINVAL; + if (opt =3D=3D NULL) return handle ? -EINVAL : 0; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 998A6C54796 for ; Tue, 23 Aug 2022 10:12:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353403AbiHWKL1 (ORCPT ); Tue, 23 Aug 2022 06:11:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45178 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352123AbiHWKEe (ORCPT ); Tue, 23 Aug 2022 06:04:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9E9437CAB3; Tue, 23 Aug 2022 01:51:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 82C53611DD; Tue, 23 Aug 2022 08:51:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6908BC433D6; Tue, 23 Aug 2022 08:51:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244684; bh=940HAywEM73UL70jDkF4U0wYf98SJc6UM4UQiogCvyg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R+5wkFIx6o0gmkcPMR9WGjcVB5WW9NPVr/E76sSq8D8J5ykdIBTZWxtcghhdgUtrN 79JZVvfne0L+c24sdiYJCcR4VSAS0G2h49KYNxGtnQHSn6AR4ihc8U3lUMqUZdc9ti ZTm7VQYjaiVe6O196/kci8Zdr2sSzOAeKaZvHK5I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe Leroy , Michael Ellerman Subject: [PATCH 4.14 175/229] powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E Date: Tue, 23 Aug 2022 10:25:36 +0200 Message-Id: <20220823080059.865938476@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe Leroy commit dd8de84b57b02ba9c1fe530a6d916c0853f136bd upstream. On FSL_BOOK3E, _PAGE_RW is defined with two bits, one for user and one for supervisor. As soon as one of the two bits is set, the page has to be display as RW. But the way it is implemented today requires both bits to be set in order to display it as RW. Instead of display RW when _PAGE_RW bits are set and R otherwise, reverse the logic and display R when _PAGE_RW bits are all 0 and RW otherwise. This change has no impact on other platforms as _PAGE_RW is a single bit on all of them. Fixes: 8eb07b187000 ("powerpc/mm: Dump linux pagetables") Cc: stable@vger.kernel.org Signed-off-by: Christophe Leroy Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/0c33b96317811edf691e81698aaee8fa45ec3449.16= 56427391.git.christophe.leroy@csgroup.eu Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/powerpc/mm/dump_linuxpagetables.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) --- a/arch/powerpc/mm/dump_linuxpagetables.c +++ b/arch/powerpc/mm/dump_linuxpagetables.c @@ -123,15 +123,10 @@ static const struct flag_info flag_array .set =3D "user", .clear =3D " ", }, { -#if _PAGE_RO =3D=3D 0 - .mask =3D _PAGE_RW, - .val =3D _PAGE_RW, -#else - .mask =3D _PAGE_RO, - .val =3D 0, -#endif - .set =3D "rw", - .clear =3D "ro", + .mask =3D _PAGE_RW | _PAGE_RO, + .val =3D _PAGE_RO, + .set =3D "ro", + .clear =3D "rw", }, { .mask =3D _PAGE_EXEC, .val =3D _PAGE_EXEC, From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2E69C49EC1 for ; Tue, 23 Aug 2022 10:12:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353612AbiHWKLn (ORCPT ); Tue, 23 Aug 2022 06:11:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352161AbiHWKEh (ORCPT ); Tue, 23 Aug 2022 06:04:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4119671724; Tue, 23 Aug 2022 01:51:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A0A086150F; Tue, 23 Aug 2022 08:51:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A8494C433D6; Tue, 23 Aug 2022 08:51:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244691; bh=IKMkzTsYh/OjMKBcBRBsOD5re4x3laIipvrW/22RXUE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rivc/sPXU4ei2BrY2oMC7jqOgq8fvjvCR23NaPQPnie+yy5nP5Ogx8E/U8TNLV1b8 xBUOa4tUe+B2SqBlB8J0B/9PKlPCbqjPls0DRYskrQLusJdHpZS9FTRm8kJ7b4S+GT mKQALecrGHSQ7zn5Lx6AM9Q0LZiVANdtmY1tC9AQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= , Takashi Iwai Subject: [PATCH 4.14 176/229] ALSA: info: Fix llseek return value when using callback Date: Tue, 23 Aug 2022 10:25:37 +0200 Message-Id: <20220823080059.901302464@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Amadeusz S=C5=82awi=C5=84ski commit 9be080edcca330be4af06b19916c35227891e8bc upstream. When using callback there was a flow of ret =3D -EINVAL if (callback) { offset =3D callback(); goto out; } ... offset =3D some other value in case of no callback; ret =3D offset; out: return ret; which causes the snd_info_entry_llseek() to return -EINVAL when there is callback handler. Fix this by setting "ret" directly to callback return value before jumping to "out". Fixes: 73029e0ff18d ("ALSA: info - Implement common llseek for binary mode") Signed-off-by: Amadeusz S=C5=82awi=C5=84ski Cc: Link: https://lore.kernel.org/r/20220817124924.3974577-1-amadeuszx.slawinsk= i@linux.intel.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/core/info.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/sound/core/info.c +++ b/sound/core/info.c @@ -127,9 +127,9 @@ static loff_t snd_info_entry_llseek(stru entry =3D data->entry; mutex_lock(&entry->access); if (entry->c.ops->llseek) { - offset =3D entry->c.ops->llseek(entry, - data->file_private_data, - file, offset, orig); + ret =3D entry->c.ops->llseek(entry, + data->file_private_data, + file, offset, orig); goto out; } =20 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F158FC49EC6 for ; Tue, 23 Aug 2022 10:12:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353762AbiHWKME (ORCPT ); Tue, 23 Aug 2022 06:12:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44576 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241953AbiHWKEj (ORCPT ); Tue, 23 Aug 2022 06:04:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 00D976FA0B; Tue, 23 Aug 2022 01:51:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0F9336123D; Tue, 23 Aug 2022 08:51:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 02754C433D6; Tue, 23 Aug 2022 08:51:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244700; bh=eQhmZHt5ptWLP7a417Uv9ecOnBX2k8sOFo408lcOWcc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yHqV+wTBNT+HGKhqVm+lJF/8nOyxwA8ScEf0ldJjB8Wv3V3LD7LSIaHv8jnUlARi5 j9PPl9edrJDuPKU5h3VX07Fc7elS8YnG/CBjpuPZmRhL3PnEEbrdxZZbsxIybTDEWx aDFJFAH2XwvIYqZamq8ESRN5KopgIglnBdFZbsoM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , "David S. Miller" Subject: [PATCH 4.14 177/229] rds: add missing barrier to release_refill Date: Tue, 23 Aug 2022 10:25:38 +0200 Message-Id: <20220823080059.937304247@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit 9f414eb409daf4f778f011cf8266d36896bb930b upstream. The functions clear_bit and set_bit do not imply a memory barrier, thus it may be possible that the waitqueue_active function (which does not take any locks) is moved before clear_bit and it could miss a wakeup event. Fix this bug by adding a memory barrier after clear_bit. Signed-off-by: Mikulas Patocka Cc: stable@vger.kernel.org Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/rds/ib_recv.c | 1 + 1 file changed, 1 insertion(+) --- a/net/rds/ib_recv.c +++ b/net/rds/ib_recv.c @@ -362,6 +362,7 @@ static int acquire_refill(struct rds_con static void release_refill(struct rds_connection *conn) { clear_bit(RDS_RECV_REFILL, &conn->c_flags); + smp_mb__after_atomic(); =20 /* We don't use wait_on_bit()/wake_up_bit() because our waking is in a * hot path and finding waiters is very rare. We don't want to walk From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B508C52D78 for ; Tue, 23 Aug 2022 10:12:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353847AbiHWKMN (ORCPT ); Tue, 23 Aug 2022 06:12:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46358 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352185AbiHWKEm (ORCPT ); Tue, 23 Aug 2022 06:04:42 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B81657CA94; Tue, 23 Aug 2022 01:51:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 21B5F6123D; Tue, 23 Aug 2022 08:51:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 22CCBC433C1; Tue, 23 Aug 2022 08:51:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244706; bh=AjgnwwxWXyifvjdcv6mNmWstwjabtaeunnP3qT+/RTo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jZpudA5ioEUAfQ8UcG5PBCrJAKVOuAU3mP5KUsmcZDzNHN7MftTfqr0hF9iX/L/bh m9ZO1ENgd+b4ew9njg+mxr3KsKe1WE1mtt6Sv4nQG3Ori/c8MKqjiEDH2uZ2HNz61e pjzdhmH2APX0lVnhyW4nviC9asuQLwYjSuojX7Fo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Damien Le Moal , Hannes Reinecke Subject: [PATCH 4.14 178/229] ata: libata-eh: Add missing command name Date: Tue, 23 Aug 2022 10:25:39 +0200 Message-Id: <20220823080059.973330551@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Damien Le Moal commit d3122bf9aa4c974f5e2c0112f799757b3a2779da upstream. Add the missing command name for ATA_CMD_NCQ_NON_DATA to ata_get_cmd_name(). Fixes: 661ce1f0c4a6 ("libata/libsas: Define ATA_CMD_NCQ_NON_DATA") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/ata/libata-eh.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/ata/libata-eh.c +++ b/drivers/ata/libata-eh.c @@ -2374,6 +2374,7 @@ const char *ata_get_cmd_descript(u8 comm { ATA_CMD_WRITE_QUEUED_FUA_EXT, "WRITE DMA QUEUED FUA EXT" }, { ATA_CMD_FPDMA_READ, "READ FPDMA QUEUED" }, { ATA_CMD_FPDMA_WRITE, "WRITE FPDMA QUEUED" }, + { ATA_CMD_NCQ_NON_DATA, "NCQ NON-DATA" }, { ATA_CMD_FPDMA_SEND, "SEND FPDMA QUEUED" }, { ATA_CMD_FPDMA_RECV, "RECEIVE FPDMA QUEUED" }, { ATA_CMD_PIO_READ, "READ SECTOR(S)" }, From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B47C2C52D79 for ; Tue, 23 Aug 2022 10:12:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353928AbiHWKMS (ORCPT ); Tue, 23 Aug 2022 06:12:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352252AbiHWKFI (ORCPT ); Tue, 23 Aug 2022 06:05:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2DC577CB5E; Tue, 23 Aug 2022 01:51:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 39F516150F; Tue, 23 Aug 2022 08:51:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3ED85C433D6; Tue, 23 Aug 2022 08:51:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244712; bh=l1hHllYzgE1Bcw27PDIeyRbRqgXZ1yIg4OE0bNPY3QE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qtBtKD8P56WqTsBtGD9/zPKl9Qx5K/7elZmvcwi5uJmglXefJ+vnsSzX8F/mtpXIQ j5gupnDa7MBHNSCkneFfsFu/qFDU18UK0R2ElYooY7ZBMCmhps9S4jOgR7ljjTZjF9 WFy5yZBFn7x9L4seW5snyy2fBfHe3d1WJ3bqT170= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Filipe Manana , David Sterba Subject: [PATCH 4.14 179/229] btrfs: fix lost error handling when looking up extended ref on log replay Date: Tue, 23 Aug 2022 10:25:40 +0200 Message-Id: <20220823080100.012041778@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Filipe Manana commit 7a6b75b79902e47f46328b57733f2604774fa2d9 upstream. During log replay, when processing inode references, if we get an error when looking up for an extended reference at __add_inode_ref(), we ignore it and proceed, returning success (0) if no other error happens after the lookup. This is obviously wrong because in case an extended reference exists and it encodes some name not in the log, we need to unlink it, otherwise the filesystem state will not match the state it had after the last fsync. So just make __add_inode_ref() return an error it gets from the extended reference lookup. Fixes: f186373fef005c ("btrfs: extended inode refs") CC: stable@vger.kernel.org # 4.9+ Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/btrfs/tree-log.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/fs/btrfs/tree-log.c +++ b/fs/btrfs/tree-log.c @@ -1100,7 +1100,9 @@ again: extref =3D btrfs_lookup_inode_extref(NULL, root, path, name, namelen, inode_objectid, parent_objectid, 0, 0); - if (!IS_ERR_OR_NULL(extref)) { + if (IS_ERR(extref)) { + return PTR_ERR(extref); + } else if (extref) { u32 item_size; u32 cur_offset =3D 0; unsigned long base; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2EB8C54EEA for ; Tue, 23 Aug 2022 10:12:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233335AbiHWKMX (ORCPT ); Tue, 23 Aug 2022 06:12:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43774 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352408AbiHWKFk (ORCPT ); Tue, 23 Aug 2022 06:05:40 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A9678A2858; Tue, 23 Aug 2022 01:52:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id D14B2CE1B4B; Tue, 23 Aug 2022 08:52:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D22B0C433D6; Tue, 23 Aug 2022 08:51:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244719; bh=xbUiAn6roGKlOVmttkOBenGDG4+k4twIaoCVAlzAAPA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=chVUCmH6Bd2UQVMUaUOTQys6q6HYYcivPsreQkDiA5NIkCze0sKzSVsIAIh3ZaM6w /jYa5BdDWHJklO5c7pqD4VJ21Nq+2RkuPxw46toiie24Wu8+rEU5VgsIp+l0yd37Za li5kTp6dGcOlP9X7nGMdxzjq+H2Ls9mz+fq/TJJ8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gerhard Uttenthaler , Sebastian Haas , Marc Kleine-Budde Subject: [PATCH 4.14 180/229] can: ems_usb: fix clangs -Wunaligned-access warning Date: Tue, 23 Aug 2022 10:25:41 +0200 Message-Id: <20220823080100.047311786@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marc Kleine-Budde commit a4cb6e62ea4d36e53fb3c0f18ea4503d7b76674f upstream. clang emits a -Wunaligned-access warning on struct __packed ems_cpc_msg. The reason is that the anonymous union msg (not declared as packed) is being packed right after some non naturally aligned variables (3*8 bits + 2*32) inside a packed struct: | struct __packed ems_cpc_msg { | u8 type; /* type of message */ | u8 length; /* length of data within union 'msg' */ | u8 msgid; /* confirmation handle */ | __le32 ts_sec; /* timestamp in seconds */ | __le32 ts_nsec; /* timestamp in nano seconds */ | /* ^ not naturally aligned */ | | union { | /* ^ not declared as packed */ | u8 generic[64]; | struct cpc_can_msg can_msg; | struct cpc_can_params can_params; | struct cpc_confirm confirmation; | struct cpc_overrun overrun; | struct cpc_can_error error; | struct cpc_can_err_counter err_counter; | u8 can_state; | } msg; | }; Starting from LLVM 14, having an unpacked struct nested in a packed struct triggers a warning. c.f. [1]. Fix the warning by marking the anonymous union as packed. [1] https://github.com/llvm/llvm-project/issues/55520 Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB i= nterface") Link: https://lore.kernel.org/all/20220802094021.959858-1-mkl@pengutronix.de Cc: Gerhard Uttenthaler Cc: Sebastian Haas Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/can/usb/ems_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/can/usb/ems_usb.c +++ b/drivers/net/can/usb/ems_usb.c @@ -206,7 +206,7 @@ struct __packed ems_cpc_msg { __le32 ts_sec; /* timestamp in seconds */ __le32 ts_nsec; /* timestamp in nano seconds */ =20 - union { + union __packed { u8 generic[64]; struct cpc_can_msg can_msg; struct cpc_can_params can_params; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90130C32772 for ; Tue, 23 Aug 2022 10:15:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353194AbiHWKO4 (ORCPT ); Tue, 23 Aug 2022 06:14:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44152 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352529AbiHWKFv (ORCPT ); Tue, 23 Aug 2022 06:05:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9069F6B672; Tue, 23 Aug 2022 01:52:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2504E6150F; Tue, 23 Aug 2022 08:52:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 342ADC433D6; Tue, 23 Aug 2022 08:52:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244725; bh=o5kMqKGNeYaD1QjftcGevNh2DTWdrdudlXdleTnx8zM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eejVIGHQ3sBSZ7nONPs8Dfsd3ZCO9M9lBjgpj1fBjP/AcYUdfepBfKq92z2O1nH+h xBvCCHm+XpiuqPS+IsYoC/qFhsm1AL5npbE7gV2l/khvlJoVIntt5FZQpeosQvdz3X gQiRSPtyYO5dmMKt9OlQWA8MDmVwxUY7+/pzqvSc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Johansen Subject: [PATCH 4.14 181/229] apparmor: fix quiet_denied for file rules Date: Tue, 23 Aug 2022 10:25:42 +0200 Message-Id: <20220823080100.081326681@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: John Johansen commit 68ff8540cc9e4ab557065b3f635c1ff4c96e1f1c upstream. Global quieting of denied AppArmor generated file events is not handled correctly. Unfortunately the is checking if quieting of all audit events is set instead of just denied events. Fixes: 67012e8209df ("AppArmor: basic auditing infrastructure.") Signed-off-by: John Johansen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- security/apparmor/audit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/security/apparmor/audit.c +++ b/security/apparmor/audit.c @@ -143,7 +143,7 @@ int aa_audit(int type, struct aa_profile } if (AUDIT_MODE(profile) =3D=3D AUDIT_QUIET || (type =3D=3D AUDIT_APPARMOR_DENIED && - AUDIT_MODE(profile) =3D=3D AUDIT_QUIET)) + AUDIT_MODE(profile) =3D=3D AUDIT_QUIET_DENIED)) return aad(sa)->error; =20 if (KILL_MODE(profile) && type =3D=3D AUDIT_APPARMOR_DENIED) From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1CD2CC32772 for ; Tue, 23 Aug 2022 10:12:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352955AbiHWKMq (ORCPT ); Tue, 23 Aug 2022 06:12:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44686 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352622AbiHWKF6 (ORCPT ); Tue, 23 Aug 2022 06:05:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 419C97171C; Tue, 23 Aug 2022 01:52:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7E478611DD; Tue, 23 Aug 2022 08:52:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 804EFC433C1; Tue, 23 Aug 2022 08:52:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244734; bh=j8glXLaB887gBfr17FRE16vXIkJMGlKP3T3etGltaow=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=K1lNCSg7S1h2dg2TnTjSwL2vTbltGikzDzuAlyw+2rsrUjoxFBU0P80c3Km+1Lr2v DsWSqQ8GUM9alkanKq/YGnJqYQiWpkb9pIX6Ja9lhR4wD3DJGl1fTt6/cQMR5DvujR z0GBXim9U/WbQUUp6y/oGwU1BqVOskUcE5WtmogM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Johansen Subject: [PATCH 4.14 182/229] apparmor: Fix failed mount permission check error message Date: Tue, 23 Aug 2022 10:25:43 +0200 Message-Id: <20220823080100.111525150@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: John Johansen commit ec240b5905bbb09a03dccffee03062cf39e38dc2 upstream. When the mount check fails due to a permission check failure instead of explicitly at one of the subcomponent checks, AppArmor is reporting a failure in the flags match. However this is not true and AppArmor can not attribute the error at this point to any particular component, and should only indicate the mount failed due to missing permissions. Fixes: 2ea3ffb7782a ("apparmor: add mount mediation") Signed-off-by: John Johansen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- security/apparmor/mount.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/security/apparmor/mount.c +++ b/security/apparmor/mount.c @@ -233,7 +233,8 @@ static const char * const mnt_info_table "failed srcname match", "failed type match", "failed flags match", - "failed data match" + "failed data match", + "failed perms check" }; =20 /* @@ -288,8 +289,8 @@ static int do_match_mnt(struct aa_dfa *d return 0; } =20 - /* failed at end of flags match */ - return 4; + /* failed at perms check, don't confuse with flags match */ + return 6; } From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 641B1C32792 for ; Tue, 23 Aug 2022 10:13:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353185AbiHWKNE (ORCPT ); Tue, 23 Aug 2022 06:13:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352684AbiHWKGG (ORCPT ); Tue, 23 Aug 2022 06:06:06 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5213EA346D; Tue, 23 Aug 2022 01:52:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 8A162CE1B4A; Tue, 23 Aug 2022 08:52:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87FEFC433B5; Tue, 23 Aug 2022 08:52:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244741; bh=CjtXXraJnpmkjJ5WxA/lShwJHkaI3lD9zw4GIsjBwAY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=r1iT6+oGoukfsN6aHKCqhM5tWP+YiAGxsbpmpR5OoytroDJs9qR0SdXnpqnJPEPUn n67X54ZUfY5lOzBRQM7K7/eOIhkKSJnXyZB8fTNbL9HkNWkyCiVAoj6LDOIdS1WTDH hGvXGuLNdEUh4GU5AnCqFFdpO5U6GrXRAWrQksA0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Rix , John Johansen Subject: [PATCH 4.14 183/229] apparmor: fix aa_label_asxprint return check Date: Tue, 23 Aug 2022 10:25:44 +0200 Message-Id: <20220823080100.146601150@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tom Rix commit 3e2a3a0830a2090e766d0d887d52c67de2a6f323 upstream. Clang static analysis reports this issue label.c:1802:3: warning: 2nd function call argument is an uninitialized value pr_info("%s", str); ^~~~~~~~~~~~~~~~~~ str is set from a successful call to aa_label_asxprint(&str, ...) On failure a negative value is returned, not a -1. So change the check. Fixes: f1bd904175e8 ("apparmor: add the base fns() for domain labels") Signed-off-by: Tom Rix Signed-off-by: John Johansen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- security/apparmor/label.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/security/apparmor/label.c +++ b/security/apparmor/label.c @@ -1722,7 +1722,7 @@ void aa_label_xaudit(struct audit_buffer if (!use_label_hname(ns, label, flags) || display_mode(ns, label, flags)) { len =3D aa_label_asxprint(&name, ns, label, flags, gfp); - if (len =3D=3D -1) { + if (len < 0) { AA_DEBUG("label print error"); return; } @@ -1750,7 +1750,7 @@ void aa_label_seq_xprint(struct seq_file int len; =20 len =3D aa_label_asxprint(&str, ns, label, flags, gfp); - if (len =3D=3D -1) { + if (len < 0) { AA_DEBUG("label print error"); return; } @@ -1773,7 +1773,7 @@ void aa_label_xprintk(struct aa_ns *ns, int len; =20 len =3D aa_label_asxprint(&str, ns, label, flags, gfp); - if (len =3D=3D -1) { + if (len < 0) { AA_DEBUG("label print error"); return; } From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1DDF2C32792 for ; Tue, 23 Aug 2022 10:13:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353276AbiHWKNR (ORCPT ); Tue, 23 Aug 2022 06:13:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45832 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352707AbiHWKGI (ORCPT ); Tue, 23 Aug 2022 06:06:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AC59B7D785; Tue, 23 Aug 2022 01:52:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 11C7C6123D; Tue, 23 Aug 2022 08:52:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0304CC433C1; Tue, 23 Aug 2022 08:52:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244747; bh=thibkoY1vJoCkfi1Ybho7TQwoOG2KHM67rYyFifPu9s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eVJdRCMUxkr2pQlNaDpMo12CkxYlRGTWnaMkm1hZ4c6prE7HCcDssumSPkRCK3hBD y7mjMiUx1DDj0Qv/JRZIGsQDPnFtyIyrgGMdAeCnkiNXkPu2fJhfSrSCFhpd8Upo+Q 996cxx19Fdds0n3psGAIX8iNEOzuvrQYvGIUzXpo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiyu Yang , Xin Tan , Xin Xiong , John Johansen Subject: [PATCH 4.14 184/229] apparmor: fix reference count leak in aa_pivotroot() Date: Tue, 23 Aug 2022 10:25:45 +0200 Message-Id: <20220823080100.177336614@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Xin Xiong commit 11c3627ec6b56c1525013f336f41b79a983b4d46 upstream. The aa_pivotroot() function has a reference counting bug in a specific path. When aa_replace_current_label() returns on success, the function forgets to decrement the reference count of =E2=80=9Ctarget=E2=80=9D, which= is increased earlier by build_pivotroot(), causing a reference leak. Fix it by decreasing the refcount of =E2=80=9Ctarget=E2=80=9D in that path. Fixes: 2ea3ffb7782a ("apparmor: add mount mediation") Co-developed-by: Xiyu Yang Signed-off-by: Xiyu Yang Co-developed-by: Xin Tan Signed-off-by: Xin Tan Signed-off-by: Xin Xiong Signed-off-by: John Johansen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- security/apparmor/mount.c | 1 + 1 file changed, 1 insertion(+) --- a/security/apparmor/mount.c +++ b/security/apparmor/mount.c @@ -687,6 +687,7 @@ int aa_pivotroot(struct aa_label *label, aa_put_label(target); goto out; } + aa_put_label(target); } else /* already audited error */ error =3D PTR_ERR(target); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C660C32772 for ; Tue, 23 Aug 2022 10:13:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353390AbiHWKNa (ORCPT ); Tue, 23 Aug 2022 06:13:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57576 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352729AbiHWKGI (ORCPT ); Tue, 23 Aug 2022 06:06:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A5F217CB55; Tue, 23 Aug 2022 01:52:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4FFCE6123D; Tue, 23 Aug 2022 08:52:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5CDF8C433C1; Tue, 23 Aug 2022 08:52:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244753; bh=VVOGpGuRObIIU3JAdx4GBxXudbBcNeXZlSAeDAsUEUQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wA/8wU2a0uicnU3BFQaHTaXvbFn7m0skK9md7Wd7+Wsp+EyLLC+kjRSHUDNO9fj2B Rij64nZvIzDYTLJeBQqnvU+dUyjTpI44Rr7Uf/XtT+Z/byi3z/GTJ32g2r5/7xBFmf sTXzkoasmr4mGR1sneU3Eq+rNiA3yLhEMbClcqFA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Trond Myklebust Subject: [PATCH 4.14 185/229] NFSv4: Fix races in the legacy idmapper upcall Date: Tue, 23 Aug 2022 10:25:46 +0200 Message-Id: <20220823080100.222924440@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Trond Myklebust commit 51fd2eb52c0ca8275a906eed81878ef50ae94eb0 upstream. nfs_idmap_instantiate() will cause the process that is waiting in request_key_with_auxdata() to wake up and exit. If there is a second process waiting for the idmap->idmap_mutex, then it may wake up and start a new call to request_key_with_auxdata(). If the call to idmap_pipe_downcall() from the first process has not yet finished calling nfs_idmap_complete_pipe_upcall_locked(), then we may end up triggering the WARN_ON_ONCE() in nfs_idmap_prepare_pipe_upcall(). The fix is to ensure that we clear idmap->idmap_upcall_data before calling nfs_idmap_instantiate(). Fixes: e9ab41b620e4 ("NFSv4: Clean up the legacy idmapper upcall") Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/nfs/nfs4idmap.c | 46 ++++++++++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 22 deletions(-) --- a/fs/nfs/nfs4idmap.c +++ b/fs/nfs/nfs4idmap.c @@ -543,22 +543,20 @@ nfs_idmap_prepare_pipe_upcall(struct idm return true; } =20 -static void -nfs_idmap_complete_pipe_upcall_locked(struct idmap *idmap, int ret) +static void nfs_idmap_complete_pipe_upcall(struct idmap_legacy_upcalldata = *data, + int ret) { - struct key *authkey =3D idmap->idmap_upcall_data->authkey; - - kfree(idmap->idmap_upcall_data); - idmap->idmap_upcall_data =3D NULL; - complete_request_key(authkey, ret); - key_put(authkey); + complete_request_key(data->authkey, ret); + key_put(data->authkey); + kfree(data); } =20 -static void -nfs_idmap_abort_pipe_upcall(struct idmap *idmap, int ret) +static void nfs_idmap_abort_pipe_upcall(struct idmap *idmap, + struct idmap_legacy_upcalldata *data, + int ret) { - if (idmap->idmap_upcall_data !=3D NULL) - nfs_idmap_complete_pipe_upcall_locked(idmap, ret); + if (cmpxchg(&idmap->idmap_upcall_data, data, NULL) =3D=3D data) + nfs_idmap_complete_pipe_upcall(data, ret); } =20 static int nfs_idmap_legacy_upcall(struct key *authkey, void *aux) @@ -595,7 +593,7 @@ static int nfs_idmap_legacy_upcall(struc =20 ret =3D rpc_queue_upcall(idmap->idmap_pipe, msg); if (ret < 0) - nfs_idmap_abort_pipe_upcall(idmap, ret); + nfs_idmap_abort_pipe_upcall(idmap, data, ret); =20 return ret; out2: @@ -651,6 +649,7 @@ idmap_pipe_downcall(struct file *filp, c struct request_key_auth *rka; struct rpc_inode *rpci =3D RPC_I(file_inode(filp)); struct idmap *idmap =3D (struct idmap *)rpci->private; + struct idmap_legacy_upcalldata *data; struct key *authkey; struct idmap_msg im; size_t namelen_in; @@ -660,10 +659,11 @@ idmap_pipe_downcall(struct file *filp, c * will have been woken up and someone else may now have used * idmap_key_cons - so after this point we may no longer touch it. */ - if (idmap->idmap_upcall_data =3D=3D NULL) + data =3D xchg(&idmap->idmap_upcall_data, NULL); + if (data =3D=3D NULL) goto out_noupcall; =20 - authkey =3D idmap->idmap_upcall_data->authkey; + authkey =3D data->authkey; rka =3D get_request_key_auth(authkey); =20 if (mlen !=3D sizeof(im)) { @@ -685,18 +685,17 @@ idmap_pipe_downcall(struct file *filp, c if (namelen_in =3D=3D 0 || namelen_in =3D=3D IDMAP_NAMESZ) { ret =3D -EINVAL; goto out; -} + } =20 - ret =3D nfs_idmap_read_and_verify_message(&im, - &idmap->idmap_upcall_data->idmap_msg, - rka->target_key, authkey); + ret =3D nfs_idmap_read_and_verify_message(&im, &data->idmap_msg, + rka->target_key, authkey); if (ret >=3D 0) { key_set_timeout(rka->target_key, nfs_idmap_cache_timeout); ret =3D mlen; } =20 out: - nfs_idmap_complete_pipe_upcall_locked(idmap, ret); + nfs_idmap_complete_pipe_upcall(data, ret); out_noupcall: return ret; } @@ -710,7 +709,7 @@ idmap_pipe_destroy_msg(struct rpc_pipe_m struct idmap *idmap =3D data->idmap; =20 if (msg->errno) - nfs_idmap_abort_pipe_upcall(idmap, msg->errno); + nfs_idmap_abort_pipe_upcall(idmap, data, msg->errno); } =20 static void @@ -718,8 +717,11 @@ idmap_release_pipe(struct inode *inode) { struct rpc_inode *rpci =3D RPC_I(inode); struct idmap *idmap =3D (struct idmap *)rpci->private; + struct idmap_legacy_upcalldata *data; =20 - nfs_idmap_abort_pipe_upcall(idmap, -EPIPE); + data =3D xchg(&idmap->idmap_upcall_data, NULL); + if (data) + nfs_idmap_complete_pipe_upcall(data, -EPIPE); } =20 int nfs_map_name_to_uid(const struct nfs_server *server, const char *name,= size_t namelen, kuid_t *uid) From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A4B6C32774 for ; Tue, 23 Aug 2022 10:13:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353449AbiHWKNf (ORCPT ); Tue, 23 Aug 2022 06:13:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352739AbiHWKGN (ORCPT ); Tue, 23 Aug 2022 06:06:13 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 761CD7D1E0; Tue, 23 Aug 2022 01:52:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 022DDB81C1C; Tue, 23 Aug 2022 08:52:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53EAEC433C1; Tue, 23 Aug 2022 08:52:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244759; bh=3kW5zkmIQhfzV/FZ21DIxuwrovQVfGfLbePBlM5UX/s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y91aMxgnjtKzO995JZfL7goBKWQOlG8elAK6yYuZXOuIIp59JVHqcuryv90+6YlWj kyQVayRVXLgLM7nFjBl395iHNlT4c6CGZfor2MOqmgH38WgSIXu4VaHSKRJcLq80jy vsRZ1xN2CECiaXeziSORaLCPXXjE5LDHlfTkLI9s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhang Xianwei , Yi Wang , Trond Myklebust Subject: [PATCH 4.14 186/229] NFSv4.1: RECLAIM_COMPLETE must handle EACCES Date: Tue, 23 Aug 2022 10:25:47 +0200 Message-Id: <20220823080100.258722355@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhang Xianwei commit e35a5e782f67ed76a65ad0f23a484444a95f000f upstream. A client should be able to handle getting an EACCES error while doing a mount operation to reclaim state due to NFS4CLNT_RECLAIM_REBOOT being set. If the server returns RPC_AUTH_BADCRED because authentication failed when we execute "exportfs -au", then RECLAIM_COMPLETE will go a wrong way. After mount succeeds, all OPEN call will fail due to an NFS4ERR_GRACE error being returned. This patch is to fix it by resending a RPC request. Signed-off-by: Zhang Xianwei Signed-off-by: Yi Wang Fixes: aa5190d0ed7d ("NFSv4: Kill nfs4_async_handle_error() abuses by NFSv4= .1") Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/nfs/nfs4proc.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -8371,6 +8371,9 @@ static int nfs41_reclaim_complete_handle rpc_delay(task, NFS4_POLL_RETRY_MAX); /* fall through */ case -NFS4ERR_RETRY_UNCACHED_REP: + case -EACCES: + dprintk("%s: failed to reclaim complete error %d for server %s, retrying= \n", + __func__, task->tk_status, clp->cl_hostname); return -EAGAIN; case -NFS4ERR_BADSESSION: case -NFS4ERR_DEADSESSION: From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3686C32772 for ; Tue, 23 Aug 2022 10:14:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353336AbiHWKN6 (ORCPT ); Tue, 23 Aug 2022 06:13:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46214 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352759AbiHWKGP (ORCPT ); Tue, 23 Aug 2022 06:06:15 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 33DCCB1C4; Tue, 23 Aug 2022 01:52:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B2E95B81C28; Tue, 23 Aug 2022 08:52:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 06CBAC433C1; Tue, 23 Aug 2022 08:52:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244768; bh=OQlvZM+K22KXk20z/y80Vu43gP5UH4g2hFg4EP4s7Wc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XVGVL3PilQvNhE0Tef1DKIM5ZEtOvW7dZm/fnQRYC58h+A4WDvNDIxA8gvXP7ZpA+ FG1MN/d9g3n+lwi719CH4gNz3d1ZRpiElhAY/2rh5Pyq2bavA2rziokC291BfbJ6pU yrG6NFs2gMmH8/NqOH2DJM8zQZO09sljfON8+o5Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Trond Myklebust Subject: [PATCH 4.14 187/229] SUNRPC: Reinitialise the backchannel request buffers before reuse Date: Tue, 23 Aug 2022 10:25:48 +0200 Message-Id: <20220823080100.290060127@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Trond Myklebust commit 6622e3a73112fc336c1c2c582428fb5ef18e456a upstream. When we're reusing the backchannel requests instead of freeing them, then we should reinitialise any values of the send/receive xdr_bufs so that they reflect the available space. Fixes: 0d2a970d0ae5 ("SUNRPC: Fix a backchannel race") Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sunrpc/backchannel_rqst.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) --- a/net/sunrpc/backchannel_rqst.c +++ b/net/sunrpc/backchannel_rqst.c @@ -69,6 +69,17 @@ static void xprt_free_allocation(struct kfree(req); } =20 +static void xprt_bc_reinit_xdr_buf(struct xdr_buf *buf) +{ + buf->head[0].iov_len =3D PAGE_SIZE; + buf->tail[0].iov_len =3D 0; + buf->pages =3D NULL; + buf->page_len =3D 0; + buf->flags =3D 0; + buf->len =3D 0; + buf->buflen =3D PAGE_SIZE; +} + static int xprt_alloc_xdr_buf(struct xdr_buf *buf, gfp_t gfp_flags) { struct page *page; @@ -291,6 +302,9 @@ void xprt_free_bc_rqst(struct rpc_rqst * */ spin_lock_bh(&xprt->bc_pa_lock); if (xprt_need_to_requeue(xprt)) { + xprt_bc_reinit_xdr_buf(&req->rq_snd_buf); + xprt_bc_reinit_xdr_buf(&req->rq_rcv_buf); + req->rq_rcv_buf.len =3D PAGE_SIZE; list_add_tail(&req->rq_bc_pa_list, &xprt->bc_pa_list); xprt->bc_alloc_count++; req =3D NULL; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13F0DC32772 for ; Tue, 23 Aug 2022 10:14:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353113AbiHWKOW (ORCPT ); Tue, 23 Aug 2022 06:14:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46704 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352782AbiHWKGQ (ORCPT ); Tue, 23 Aug 2022 06:06:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0FAB4BC0F; Tue, 23 Aug 2022 01:52:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A87BBB81C28; Tue, 23 Aug 2022 08:52:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E4CF4C433D6; Tue, 23 Aug 2022 08:52:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244774; bh=ROwYacelnhogMjbaFhx5Z+LfPE39x335YCVt9z0dvRA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MRn1ejosB9+EBAl7NaJJ5n3KpQoDgDmQHwcAjLCxCejVq7LYKtDl09qB2tIpHu6KS lJ7hZkr7PFQ/w+IsNS9S9e1KBI4eAtDzO2gIV9vB5bPMCb8KOFBvu71YHAgoNDiqHO JiqAaCWwho5bSQfUxk4G78/qSS7HFCtMEcEm5q/A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Linus Walleij Subject: [PATCH 4.14 188/229] pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map Date: Tue, 23 Aug 2022 10:25:49 +0200 Message-Id: <20220823080100.324783308@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin commit 4b32e054335ea0ce50967f63a7bfd4db058b14b9 upstream. of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak." Fixes: c2f6d059abfc ("pinctrl: nomadik: refactor DT parser to take two path= s") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220607111602.57355-1-linmq006@gmail.com Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c +++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c @@ -1455,8 +1455,10 @@ static int nmk_pinctrl_dt_subnode_to_map =20 has_config =3D nmk_pinctrl_dt_get_config(np, &configs); np_config =3D of_parse_phandle(np, "ste,config", 0); - if (np_config) + if (np_config) { has_config |=3D nmk_pinctrl_dt_get_config(np_config, &configs); + of_node_put(np_config); + } if (has_config) { const char *gpio_name; const char *pin; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DCB60C32792 for ; Tue, 23 Aug 2022 10:18:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353738AbiHWKSQ (ORCPT ); Tue, 23 Aug 2022 06:18:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58332 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352516AbiHWKHs (ORCPT ); Tue, 23 Aug 2022 06:07:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 946BB57570; Tue, 23 Aug 2022 01:54:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3EFE4B81C35; Tue, 23 Aug 2022 08:54:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 880E9C433C1; Tue, 23 Aug 2022 08:54:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244856; bh=fdew62UuZcMsFie8kfqEEAZhB9kWdQ/7hAK9yJC/+Ls=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GF/jLQv3VBTNHKBxj2i1XqwuckzgRG/qFGKvLgpmqFb3d41C7YE9RLDqkqWPeUfvH Sy/dlxzkh0zyAE4gz/xvoKNuoaSVnFn8eceeGM0tvCqqIx1uOADRnVdiUJxOc2p4kL 2fxLXyv5Nz5U2SVh57lnWfJA6DZG0Em7eA7eMsE8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nikita Travkin , Linus Walleij Subject: [PATCH 4.14 189/229] pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed Date: Tue, 23 Aug 2022 10:25:50 +0200 Message-Id: <20220823080100.366382378@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nikita Travkin commit 44339391c666e46cba522d19c65a6ad1071c68b7 upstream. GPIO 31, 32 can be muxed to GCC_CAMSS_GP(1,2)_CLK respectively but the function was never assigned to the pingroup (even though the function exists already). Add this mode to the related pins. Fixes: 5373a2c5abb6 ("pinctrl: qcom: Add msm8916 pinctrl driver") Signed-off-by: Nikita Travkin Link: https://lore.kernel.org/r/20220612145955.385787-4-nikita@trvn.ru Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/pinctrl/qcom/pinctrl-msm8916.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/pinctrl/qcom/pinctrl-msm8916.c +++ b/drivers/pinctrl/qcom/pinctrl-msm8916.c @@ -852,8 +852,8 @@ static const struct msm_pingroup msm8916 PINGROUP(28, pwr_modem_enabled_a, NA, NA, NA, NA, NA, qdss_tracedata_b, N= A, atest_combodac), PINGROUP(29, cci_i2c, NA, NA, NA, NA, NA, qdss_tracedata_b, NA, atest_com= bodac), PINGROUP(30, cci_i2c, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b), - PINGROUP(31, cci_timer0, NA, NA, NA, NA, NA, NA, NA, NA), - PINGROUP(32, cci_timer1, NA, NA, NA, NA, NA, NA, NA, NA), + PINGROUP(31, cci_timer0, flash_strobe, NA, NA, NA, NA, NA, NA, NA), + PINGROUP(32, cci_timer1, flash_strobe, NA, NA, NA, NA, NA, NA, NA), PINGROUP(33, cci_async, NA, NA, NA, NA, NA, NA, NA, qdss_tracedata_b), PINGROUP(34, pwr_nav_enabled_a, NA, NA, NA, NA, NA, NA, NA, qdss_tracedat= a_b), PINGROUP(35, pwr_crypto_enabled_a, NA, NA, NA, NA, NA, NA, NA, qdss_trace= data_b), From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0599EC32796 for ; Tue, 23 Aug 2022 10:23:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354286AbiHWKVI (ORCPT ); Tue, 23 Aug 2022 06:21:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60872 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352912AbiHWKJd (ORCPT ); Tue, 23 Aug 2022 06:09:33 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 464DE6B65A; Tue, 23 Aug 2022 01:55:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 03BF2B81C28; Tue, 23 Aug 2022 08:55:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D7A07C433C1; Tue, 23 Aug 2022 08:55:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244924; bh=HOXCiQRCue+WqyhD977c9T+bU9sdz6fgKX43vY6tDYk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iAs6PntlpGWwH7/UEl6nPjniqxps2CXEASynQkM1niMdcs8mvxg2Km3vZ3H5iNYKV MaoKe6zw0bLTkxP9LWI67J8KuKHfsEs/cVV24IbTgUfe+QbcpIu0j4nrGSaH3Mgwpt 6MSFAuMcJJf1Y3vyAeEx0f2s1rVz5Yhc811GQq6I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sakari Ailus , Andy Shevchenko , "Rafael J. Wysocki" Subject: [PATCH 4.14 190/229] ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool Date: Tue, 23 Aug 2022 10:25:51 +0200 Message-Id: <20220823080100.397245393@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sakari Ailus commit 85140ef275f577f64e8a2c5789447222dfc14fc4 upstream. The value acpi_add_nondev_subnodes() returns is bool so change the return type of the function to match that. Fixes: 445b0eb058f5 ("ACPI / property: Add support for data-only subnodes") Signed-off-by: Sakari Ailus Reviewed-by: Andy Shevchenko Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/acpi/property.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/acpi/property.c +++ b/drivers/acpi/property.c @@ -132,10 +132,10 @@ static bool acpi_nondev_subnode_ok(acpi_ return acpi_nondev_subnode_data_ok(handle, link, list, parent); } =20 -static int acpi_add_nondev_subnodes(acpi_handle scope, - const union acpi_object *links, - struct list_head *list, - struct fwnode_handle *parent) +static bool acpi_add_nondev_subnodes(acpi_handle scope, + const union acpi_object *links, + struct list_head *list, + struct fwnode_handle *parent) { bool ret =3D false; int i; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ABF5DC49EC0 for ; Tue, 23 Aug 2022 10:23:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354908AbiHWKWY (ORCPT ); Tue, 23 Aug 2022 06:22:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58122 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353164AbiHWKK7 (ORCPT ); Tue, 23 Aug 2022 06:10:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 83F5A7E308; Tue, 23 Aug 2022 01:56:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D849A61555; Tue, 23 Aug 2022 08:56:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D5189C433C1; Tue, 23 Aug 2022 08:56:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244969; bh=JI/03GeTwMgOsMygXf7J1KB/3ZHFrEc0d5hp42a4KF4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xejPmJxDRYfafbP7wSz/wX/4BZBUMadfJDyZEIPYJ+wKr4CAzfXtemD0dWEgoHX4b uqJ6A4ryrJNlcW5ArGGx6usZ1AGj2X95XQDru/2clclJ9ziOM3c1AZx6/FVQxcYorb iMbOOqnIbjCC26VITXA4ME+1v/Zm0X7cIyXsI8Tg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guillaume Nault , Matthias May , Jakub Kicinski Subject: [PATCH 4.14 191/229] geneve: do not use RT_TOS for IPv6 flowlabel Date: Tue, 23 Aug 2022 10:25:52 +0200 Message-Id: <20220823080100.429142200@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Matthias May commit ca2bb69514a8bc7f83914122f0d596371352416c upstream. According to Guillaume Nault RT_TOS should never be used for IPv6. Quote: RT_TOS() is an old macro used to interprete IPv4 TOS as described in the obsolete RFC 1349. It's conceptually wrong to use it even in IPv4 code, although, given the current state of the code, most of the existing calls have no consequence. But using RT_TOS() in IPv6 code is always a bug: IPv6 never had a "TOS" field to be interpreted the RFC 1349 way. There's no historical compatibility to worry about. Fixes: 3a56f86f1be6 ("geneve: handle ipv6 priority like ipv4 tos") Acked-by: Guillaume Nault Signed-off-by: Matthias May Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/geneve.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/drivers/net/geneve.c +++ b/drivers/net/geneve.c @@ -795,8 +795,7 @@ static struct dst_entry *geneve_get_v6_d use_cache =3D false; } =20 - fl6->flowlabel =3D ip6_make_flowinfo(RT_TOS(prio), - info->key.label); + fl6->flowlabel =3D ip6_make_flowinfo(prio, info->key.label); dst_cache =3D (struct dst_cache *)&info->dst_cache; if (use_cache) { dst =3D dst_cache_get_ip6(dst_cache, &fl6->saddr); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 91B5DC32774 for ; Tue, 23 Aug 2022 10:23:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355029AbiHWKWo (ORCPT ); Tue, 23 Aug 2022 06:22:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35636 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353279AbiHWKLL (ORCPT ); Tue, 23 Aug 2022 06:11:11 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF5BA7E82B; Tue, 23 Aug 2022 01:56:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5A0F7B81C39; Tue, 23 Aug 2022 08:56:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9EFB6C433C1; Tue, 23 Aug 2022 08:56:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244975; bh=kmauTnMR3HAoOyBOAkL6MvXio1F+6vYPbBFtfh7SbRs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I4Cq9PPdPETk+l65Ey2Qy0m2AJWxEbT6StX8f6tsrGLfHVd8CVxzjOwTADQK0QkXf 0z7o3VWhwjnUtDQ9DxLYNGPY44AzoD2zqyc4H3pHDebDfe//5F9Jh1LUwYCXOblJzs yUUHY+CXeiO3P1hJm3BUtnaLd9jg4T7LUksSq7ms= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stefano Garzarella , Peilin Ye , "David S. Miller" , syzbot+b03f55bf128f9a38f064@syzkaller.appspotmail.com Subject: [PATCH 4.14 192/229] vsock: Fix memory leak in vsock_connect() Date: Tue, 23 Aug 2022 10:25:53 +0200 Message-Id: <20220823080100.470225294@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peilin Ye commit 7e97cfed9929eaabc41829c395eb0d1350fccb9d upstream. An O_NONBLOCK vsock_connect() request may try to reschedule @connect_work. Imagine the following sequence of vsock_connect() requests: 1. The 1st, non-blocking request schedules @connect_work, which will expire after 200 jiffies. Socket state is now SS_CONNECTING; 2. Later, the 2nd, blocking request gets interrupted by a signal after a few jiffies while waiting for the connection to be established. Socket state is back to SS_UNCONNECTED, but @connect_work is still pending, and will expire after 100 jiffies. 3. Now, the 3rd, non-blocking request tries to schedule @connect_work again. Since @connect_work is already scheduled, schedule_delayed_work() silently returns. sock_hold() is called twice, but sock_put() will only be called once in vsock_connect_timeout(), causing a memory leak reported by syzbot: BUG: memory leak unreferenced object 0xffff88810ea56a40 (size 1232): comm "syz-executor756", pid 3604, jiffies 4294947681 (age 12.350s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 28 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 (..@............ backtrace: [] sk_prot_alloc+0x3e/0x1b0 net/core/sock.c:1930 [] sk_alloc+0x32/0x2e0 net/core/sock.c:1989 [] __vsock_create.constprop.0+0x38/0x320 net/vmw_vs= ock/af_vsock.c:734 [] vsock_create+0xc1/0x2d0 net/vmw_vsock/af_vsock.c= :2203 [] __sock_create+0x1ab/0x2b0 net/socket.c:1468 [] sock_create net/socket.c:1519 [inline] [] __sys_socket+0x6f/0x140 net/socket.c:1561 [] __do_sys_socket net/socket.c:1570 [inline] [] __se_sys_socket net/socket.c:1568 [inline] [] __x64_sys_socket+0x1a/0x20 net/socket.c:1568 [] do_syscall_x64 arch/x86/entry/common.c:50 [inlin= e] [] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:= 80 [] entry_SYSCALL_64_after_hwframe+0x44/0xae <...> Use mod_delayed_work() instead: if @connect_work is already scheduled, reschedule it, and undo sock_hold() to keep the reference count balanced. Reported-and-tested-by: syzbot+b03f55bf128f9a38f064@syzkaller.appspotmail.c= om Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Co-developed-by: Stefano Garzarella Signed-off-by: Stefano Garzarella Reviewed-by: Stefano Garzarella Signed-off-by: Peilin Ye Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/vmw_vsock/af_vsock.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1222,7 +1222,14 @@ static int vsock_stream_connect(struct s * timeout fires. */ sock_hold(sk); - schedule_delayed_work(&vsk->connect_work, timeout); + + /* If the timeout function is already scheduled, + * reschedule it, then ungrab the socket refcount to + * keep it balanced. + */ + if (mod_delayed_work(system_wq, &vsk->connect_work, + timeout)) + sock_put(sk); =20 /* Skip ahead to preserve error code set above. */ goto out_wait; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F20CC32796 for ; Tue, 23 Aug 2022 10:17:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353681AbiHWKPi (ORCPT ); Tue, 23 Aug 2022 06:15:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58148 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352848AbiHWKGW (ORCPT ); Tue, 23 Aug 2022 06:06:22 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 673752DEF; Tue, 23 Aug 2022 01:53:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 578F6B8105C; Tue, 23 Aug 2022 08:53:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ADEC6C433C1; Tue, 23 Aug 2022 08:53:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244797; bh=1I0ofOchYddj05pVP0sCfvBSf9N7V0uSneCL4SeRj2U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AZtWrZ3RshjFZXxQ88cTnTJCsWTbyK4FV8HaCgw3mdaYG/B99DJ9ztcaKgr9JdCG7 OwftvFZ4rcWv52DC1syLn+alSPb5Tc3lTdAUBko6h7/WbZqX4FzUJpXtOqr5C64U6M pro6ylN2i3MEq1OUlsJHn3IqbEphA1mvFLz1cll8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stefano Garzarella , Peilin Ye , "David S. Miller" Subject: [PATCH 4.14 193/229] vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() Date: Tue, 23 Aug 2022 10:25:54 +0200 Message-Id: <20220823080100.511422086@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peilin Ye commit a3e7b29e30854ed67be0d17687e744ad0c769c4b upstream. Imagine two non-blocking vsock_connect() requests on the same socket. The first request schedules @connect_work, and after it times out, vsock_connect_timeout() sets *sock* state back to TCP_CLOSE, but keeps *socket* state as SS_CONNECTING. Later, the second request returns -EALREADY, meaning the socket "already has a pending connection in progress", even though the first request has already timed out. As suggested by Stefano, fix it by setting *socket* state back to SS_UNCONNECTED, so that the second request will return -ETIMEDOUT. Suggested-by: Stefano Garzarella Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reviewed-by: Stefano Garzarella Signed-off-by: Peilin Ye Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/vmw_vsock/af_vsock.c | 1 + 1 file changed, 1 insertion(+) --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -1125,6 +1125,7 @@ static void vsock_connect_timeout(struct if (sk->sk_state =3D=3D TCP_SYN_SENT && (sk->sk_shutdown !=3D SHUTDOWN_MASK)) { sk->sk_state =3D TCP_CLOSE; + sk->sk_socket->state =3D SS_UNCONNECTED; sk->sk_err =3D ETIMEDOUT; sk->sk_error_report(sk); vsock_transport_cancel_pkt(vsk); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25546C32793 for ; Tue, 23 Aug 2022 10:17:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353711AbiHWKPr (ORCPT ); Tue, 23 Aug 2022 06:15:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58286 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352867AbiHWKGZ (ORCPT ); Tue, 23 Aug 2022 06:06:25 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2DB856408; Tue, 23 Aug 2022 01:53:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 90C76B81BF8; Tue, 23 Aug 2022 08:53:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C022BC433C1; Tue, 23 Aug 2022 08:53:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244803; bh=69ovCRcumfGslh/oGLivZ4DIr8oJgQGwFuXGEqHGW5k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BFGcUPhy3FdlJSs4xPaJ6Isyeg9C7IGbrGfh01GoRRPeTMr2xXjgGHHYvg2ih2GyQ jlBFXGAln7J1kUeFcuOc/a91Uqn+LtrSqUBOGyk1o017DjQ3O6Vr7D4nNBldzZEIPi 7f6I4SVPUjKg4eT0rCUGVeXftPNCTixV0LlMi/mI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Roberto Sassu , Alexei Starovoitov , Andrii Nakryiko , bpf@vger.kernel.org, Daniel Borkmann , Ingo Molnar , John Fastabend , KP Singh , llvm@lists.linux.dev, Martin KaFai Lau , Nathan Chancellor , Nick Desaulniers , Nick Terrell , Peter Zijlstra , Quentin Monnet , Song Liu , Stanislav Fomichev , Arnaldo Carvalho de Melo Subject: [PATCH 4.14 194/229] tools build: Switch to new openssl API for test-libcrypto Date: Tue, 23 Aug 2022 10:25:55 +0200 Message-Id: <20220823080100.563952280@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Roberto Sassu commit 5b245985a6de5ac18b5088c37068816d413fb8ed upstream. Switch to new EVP API for detecting libcrypto, as Fedora 36 returns an error when it encounters the deprecated function MD5_Init() and the others. The error would be interpreted as missing libcrypto, while in reality it is not. Fixes: 6e8ccb4f624a73c5 ("tools/bpf: properly account for libbfd variations= ") Signed-off-by: Roberto Sassu Cc: Alexei Starovoitov Cc: Andrii Nakryiko Cc: bpf@vger.kernel.org Cc: Daniel Borkmann Cc: Ingo Molnar Cc: John Fastabend Cc: KP Singh Cc: llvm@lists.linux.dev Cc: Martin KaFai Lau Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Nick Terrell Cc: Peter Zijlstra Cc: Quentin Monnet Cc: Song Liu Cc: Stanislav Fomichev Link: https://lore.kernel.org/r/20220719170555.2576993-4-roberto.sassu@huaw= ei.com Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- tools/build/feature/test-libcrypto.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) --- a/tools/build/feature/test-libcrypto.c +++ b/tools/build/feature/test-libcrypto.c @@ -1,16 +1,23 @@ // SPDX-License-Identifier: GPL-2.0 +#include #include #include =20 int main(void) { - MD5_CTX context; + EVP_MD_CTX *mdctx; unsigned char md[MD5_DIGEST_LENGTH + SHA_DIGEST_LENGTH]; unsigned char dat[] =3D "12345"; + unsigned int digest_len; =20 - MD5_Init(&context); - MD5_Update(&context, &dat[0], sizeof(dat)); - MD5_Final(&md[0], &context); + mdctx =3D EVP_MD_CTX_new(); + if (!mdctx) + return 0; + + EVP_DigestInit_ex(mdctx, EVP_md5(), NULL); + EVP_DigestUpdate(mdctx, &dat[0], sizeof(dat)); + EVP_DigestFinal_ex(mdctx, &md[0], &digest_len); + EVP_MD_CTX_free(mdctx); =20 SHA1(&dat[0], sizeof(dat), &md[0]); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 492ACC38145 for ; Tue, 23 Aug 2022 10:17:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353780AbiHWKPy (ORCPT ); Tue, 23 Aug 2022 06:15:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46510 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352893AbiHWKG0 (ORCPT ); Tue, 23 Aug 2022 06:06:26 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 37928A460; Tue, 23 Aug 2022 01:53:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 93ACB611DD; Tue, 23 Aug 2022 08:53:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9FCBCC433D6; Tue, 23 Aug 2022 08:53:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244809; bh=WZrmzVPJBdBpw6UfrkbPuq4sZK3uUvd+tAu+0nNF+wo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TkjziN5ReaDaR45VxPUrCgobgl2VmDvTnjNNpj4KGTpJpPomhkDqjd1A3irXPMUXB QWRTQiBO7giSMftLoX+TQcukGJea6TbV4LqAv62sTLamss4oIOT9ArsEUHe039mHmh rkJxwv/9mtreEt48XlBzKW7W1vjBvnQWrKjRAsYM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Oleksandr Tyshchenko , Juergen Gross Subject: [PATCH 4.14 195/229] xen/xenbus: fix return type in xenbus_file_read() Date: Tue, 23 Aug 2022 10:25:56 +0200 Message-Id: <20220823080100.609879614@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit 32ad11127b95236dfc52375f3707853194a7f4b4 upstream. This code tries to store -EFAULT in an unsigned int. The xenbus_file_read() function returns type ssize_t so the negative value is returned as a positive value to the user. This change forces another change to the min() macro. Originally, the min() macro used "unsigned" type which checkpatch complains about. Also unsigned type would break if "len" were not capped at MAX_RW_COUNT. Use size_t for the min(). (No effect on runtime for the min_t() change). Fixes: 2fb3683e7b16 ("xen: Add xenbus device driver") Signed-off-by: Dan Carpenter Reviewed-by: Oleksandr Tyshchenko Link: https://lore.kernel.org/r/YutxJUaUYRG/VLVc@kili Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/xen/xenbus/xenbus_dev_frontend.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/xen/xenbus/xenbus_dev_frontend.c +++ b/drivers/xen/xenbus/xenbus_dev_frontend.c @@ -125,7 +125,7 @@ static ssize_t xenbus_file_read(struct f { struct xenbus_file_priv *u =3D filp->private_data; struct read_buffer *rb; - unsigned i; + ssize_t i; int ret; =20 mutex_lock(&u->reply_mutex); @@ -145,7 +145,7 @@ again: rb =3D list_entry(u->read_buffers.next, struct read_buffer, list); i =3D 0; while (i < len) { - unsigned sz =3D min((unsigned)len - i, rb->len - rb->cons); + size_t sz =3D min_t(size_t, len - i, rb->len - rb->cons); =20 ret =3D copy_to_user(ubuf + i, &rb->msg[rb->cons], sz); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74E38C48BE4 for ; Tue, 23 Aug 2022 10:17:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353836AbiHWKQD (ORCPT ); Tue, 23 Aug 2022 06:16:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45832 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352917AbiHWKG2 (ORCPT ); Tue, 23 Aug 2022 06:06:28 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF11311A04; Tue, 23 Aug 2022 01:53:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7C4566150F; Tue, 23 Aug 2022 08:53:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F700C433D6; Tue, 23 Aug 2022 08:53:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244814; bh=J7X6JkqhBQZ4uPFVbB5ZJDafAFxRbMj5SQrCvRAb4HU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Dc6sGkZLsXhu1mSS7T2FACrqFnyYiK7osKLjsBtHLhXDvCfP41fRv8/0K0I9HrU/T MmHmjvpaqCS8Z5LUAik1tsst+e2He2iViww9qLtKpqxNISBYO8wzGZKrGMhV+eFypL P2Yk3W9ng8b/icLKS7ZgOo0H9vqAn93ezM3K5/as= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Jakub Kicinski Subject: [PATCH 4.14 196/229] atm: idt77252: fix use-after-free bugs caused by tst_timer Date: Tue, 23 Aug 2022 10:25:57 +0200 Message-Id: <20220823080100.644156508@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 3f4093e2bf4673f218c0bf17d8362337c400e77b upstream. There are use-after-free bugs caused by tst_timer. The root cause is that there are no functions to stop tst_timer in idt77252_exit(). One of the possible race conditions is shown below: (thread 1) | (thread 2) | idt77252_init_one | init_card | fill_tst | mod_timer(&card->tst_timer, ...) idt77252_exit | (wait a time) | tst_timer | | ... kfree(card) // FREE | | card->soft_tst[e] // USE The idt77252_dev is deallocated in idt77252_exit() and used in timer handler. This patch adds del_timer_sync() in idt77252_exit() in order that the timer handler could be stopped before the idt77252_dev is deallocated. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou Link: https://lore.kernel.org/r/20220805070008.18007-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/atm/idt77252.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/atm/idt77252.c +++ b/drivers/atm/idt77252.c @@ -3768,6 +3768,7 @@ static void __exit idt77252_exit(void) card =3D idt77252_chain; dev =3D card->atmdev; idt77252_chain =3D card->next; + del_timer_sync(&card->tst_timer); =20 if (dev->phy->stop) dev->phy->stop(dev); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C226C49EC0 for ; Tue, 23 Aug 2022 10:17:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353918AbiHWKQS (ORCPT ); Tue, 23 Aug 2022 06:16:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57576 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352937AbiHWKGa (ORCPT ); Tue, 23 Aug 2022 06:06:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A0D11181C; Tue, 23 Aug 2022 01:53:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 94721611DD; Tue, 23 Aug 2022 08:53:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 904CEC433D6; Tue, 23 Aug 2022 08:53:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244821; bh=FiKJFq3p3hNMNAz/G+j1Jr63XmO/Uxj1ECLA2jSv+YM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IwbrROQBIx4qKcDS5FKwYjMOaBy6G8q7o0yJWS+9+mZi1A7u1TSS0g4HO/8dzV5L9 RTDU6cKwy9dZTyuHDw3PI3QRudDD2y8b1edSmY9WPLI4gPa1r7ulFWW7JjAFFQhIOM +KAUFU6q9rWvTTgKDyW9WWZ7wEvyiY/jDRgdpJXg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro , Dinh Nguyen Subject: [PATCH 4.14 197/229] nios2: page fault et.al. are *not* restartable syscalls... Date: Tue, 23 Aug 2022 10:25:58 +0200 Message-Id: <20220823080100.683561191@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Al Viro commit 8535c239ac674f7ead0f2652932d35c52c4123b2 upstream. make sure that ->orig_r2 is negative for everything except the syscalls. Fixes: 82ed08dd1b0e ("nios2: Exception handling") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/nios2/include/asm/entry.h | 3 ++- arch/nios2/kernel/entry.S | 4 +--- 2 files changed, 3 insertions(+), 4 deletions(-) --- a/arch/nios2/include/asm/entry.h +++ b/arch/nios2/include/asm/entry.h @@ -50,7 +50,8 @@ stw r13, PT_R13(sp) stw r14, PT_R14(sp) stw r15, PT_R15(sp) - stw r2, PT_ORIG_R2(sp) + movi r24, -1 + stw r24, PT_ORIG_R2(sp) stw r7, PT_ORIG_R7(sp) =20 stw ra, PT_RA(sp) --- a/arch/nios2/kernel/entry.S +++ b/arch/nios2/kernel/entry.S @@ -185,6 +185,7 @@ ENTRY(handle_system_call) ldw r5, PT_R5(sp) =20 local_restart: + stw r2, PT_ORIG_R2(sp) /* Check that the requested system call is within limits */ movui r1, __NR_syscalls bgeu r2, r1, ret_invsyscall @@ -336,9 +337,6 @@ external_interrupt: /* skip if no interrupt is pending */ beq r12, r0, ret_from_interrupt =20 - movi r24, -1 - stw r24, PT_ORIG_R2(sp) - /* * Process an external hardware interrupt. */ From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C664FC49EC2 for ; Tue, 23 Aug 2022 10:17:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353999AbiHWKQe (ORCPT ); Tue, 23 Aug 2022 06:16:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46712 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351945AbiHWKGl (ORCPT ); Tue, 23 Aug 2022 06:06:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B52B73B963; Tue, 23 Aug 2022 01:53:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4F48CB81C3B; Tue, 23 Aug 2022 08:53:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F385C433C1; Tue, 23 Aug 2022 08:53:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244830; bh=ZhkPRONPRsdklvEmDO5ZqnezVhTgjCAugxYUuo/Z7Lg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oz4GWj0q2h25/wJGgiHghE+UUVrWL9EqPVfkUcP0wTl82W8J2gGF3zPIW2E+2We0K yB2O3qnRkhMqf4lbP1G4Ns3BL7UEuruNF/JCPf3lRX6TkPzH0Gh1KCRcvSgJ+LmDru TXYEITS2A/OtVBixMva97IgNHRMDdCqcWxFRtBP4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro , Dinh Nguyen Subject: [PATCH 4.14 198/229] nios2: dont leave NULLs in sys_call_table[] Date: Tue, 23 Aug 2022 10:25:59 +0200 Message-Id: <20220823080100.713752961@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Al Viro commit 45ec746c65097c25e77d24eae8fee0def5b6cc5d upstream. fill the gaps in there with sys_ni_syscall, as everyone does... Fixes: 82ed08dd1b0e ("nios2: Exception handling") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/nios2/kernel/entry.S | 1 - arch/nios2/kernel/syscall_table.c | 1 + 2 files changed, 1 insertion(+), 1 deletion(-) --- a/arch/nios2/kernel/entry.S +++ b/arch/nios2/kernel/entry.S @@ -193,7 +193,6 @@ local_restart: movhi r11, %hiadj(sys_call_table) add r1, r1, r11 ldw r1, %lo(sys_call_table)(r1) - beq r1, r0, ret_invsyscall =20 /* Check if we are being traced */ GET_THREAD_INFO r11 --- a/arch/nios2/kernel/syscall_table.c +++ b/arch/nios2/kernel/syscall_table.c @@ -25,5 +25,6 @@ #define __SYSCALL(nr, call) [nr] =3D (call), =20 void *sys_call_table[__NR_syscalls] =3D { + [0 ... __NR_syscalls-1] =3D sys_ni_syscall, #include }; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5DE3FC32774 for ; Tue, 23 Aug 2022 10:17:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354407AbiHWKR0 (ORCPT ); Tue, 23 Aug 2022 06:17:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60644 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352341AbiHWKH0 (ORCPT ); Tue, 23 Aug 2022 06:07:26 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D77AE3F336; Tue, 23 Aug 2022 01:53:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 68B0FB81B90; Tue, 23 Aug 2022 08:53:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A8993C433C1; Tue, 23 Aug 2022 08:53:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244836; bh=fxlNh0LwhOpWUkF19exROe077tMNe7vdcr/NJnAVD5A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jWZWPJr5uIgDPUnfRj/X0FT4ZZ5hWIbSl3JOQRn+cgIltBEesyIQZoxrZX2PMvaFD UfjgsVsZtKnXLAU9FfqoHJ2569sjd42TbsDc9kkIwhLh5VwTn5iqA8Bb5jZBm58QAM xabpB4jbqXVa8nTHlPvnYS1RLJ6h2aLYWqasudt0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro , Dinh Nguyen Subject: [PATCH 4.14 199/229] nios2: traced syscall does need to check the syscall number Date: Tue, 23 Aug 2022 10:26:00 +0200 Message-Id: <20220823080100.745222101@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Al Viro commit 25ba820ef36bdbaf9884adeac69b6e1821a7df76 upstream. all checks done before letting the tracer modify the register state are worthless... Fixes: 82ed08dd1b0e ("nios2: Exception handling") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/nios2/kernel/entry.S | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/arch/nios2/kernel/entry.S +++ b/arch/nios2/kernel/entry.S @@ -255,9 +255,9 @@ traced_system_call: ldw r6, PT_R6(sp) ldw r7, PT_R7(sp) =20 - /* Fetch the syscall function, we don't need to check the boundaries - * since this is already done. - */ + /* Fetch the syscall function. */ + movui r1, __NR_syscalls + bgeu r2, r1, traced_invsyscall slli r1, r2, 2 movhi r11,%hiadj(sys_call_table) add r1, r1, r11 @@ -287,6 +287,11 @@ end_translate_rc_and_ret2: RESTORE_SWITCH_STACK br ret_from_exception =20 + /* If the syscall number was invalid return ENOSYS */ +traced_invsyscall: + movi r2, -ENOSYS + br translate_rc_and_ret2 + Luser_return: GET_THREAD_INFO r11 /* get thread_info pointer */ ldw r10, TI_FLAGS(r11) /* get thread_info->flags */ From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69E51C32772 for ; Tue, 23 Aug 2022 10:17:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353103AbiHWKRd (ORCPT ); Tue, 23 Aug 2022 06:17:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58142 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352361AbiHWKH1 (ORCPT ); Tue, 23 Aug 2022 06:07:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B1A4926546; Tue, 23 Aug 2022 01:54:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 669FEB81B90; Tue, 23 Aug 2022 08:54:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B08CAC433D6; Tue, 23 Aug 2022 08:54:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244842; bh=74BDVeIvMBWQuIu/Rh+9XV75YMCsgnfcdiv4ClaKEQU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nZT/9W9T+yeK1n6cW7kt1MKiwWLoGfmcD/k1j5zqfgC5GA6983OajMIf8TFa2fBQS YwD5zl79fckpUpIhdHVBAPmfKs+6j0QpVgmYHnhp3eC7Z46Jnc9oL7wSd1YxQUzweE vJrPXkEUQP9yLcb/Dbzy59NynTAoYThvyHBcluHY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro , Dinh Nguyen Subject: [PATCH 4.14 200/229] nios2: fix syscall restart checks Date: Tue, 23 Aug 2022 10:26:01 +0200 Message-Id: <20220823080100.783428681@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Al Viro commit 2d631bd58fe0ea3e3350212e23c9aba1fb606514 upstream. sys_foo() returns -512 (aka -ERESTARTSYS) =3D> do_signal() sees 512 in r2 and 1 in r1. sys_foo() returns 512 =3D> do_signal() sees 512 in r2 and 0 in r1. The former is restart-worthy; the latter obviously isn't. Fixes: b53e906d255d ("nios2: Signal handling support") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/nios2/kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/nios2/kernel/signal.c +++ b/arch/nios2/kernel/signal.c @@ -240,7 +240,7 @@ static int do_signal(struct pt_regs *reg /* * If we were from a system call, check for system call restarting... */ - if (regs->orig_r2 >=3D 0) { + if (regs->orig_r2 >=3D 0 && regs->r1) { continue_addr =3D regs->ea; restart_addr =3D continue_addr - 4; retval =3D regs->r2; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09EFBC32792 for ; Tue, 23 Aug 2022 10:18:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353591AbiHWKR6 (ORCPT ); Tue, 23 Aug 2022 06:17:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58192 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352403AbiHWKHc (ORCPT ); Tue, 23 Aug 2022 06:07:32 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AD4F657542; Tue, 23 Aug 2022 01:54:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 47CF7B81C35; Tue, 23 Aug 2022 08:54:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A6888C433D7; Tue, 23 Aug 2022 08:54:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244848; bh=fy9Hbiarz6gfSjxp30zSLiolvV9NwPqMSdgxPIu22Qs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SaOSsC4fQNpa8SDVKnoDIjfJ/4Ux3h56f28Q62b0sUxBbvW/tYH7colvQ00zJySHg i/ZFhD4PxZFr1WLI3jIA6povl59yX8M7jZADGvdaQTsJdqOowcJVcOZFRc/HslhDhh 2l+tCbzAwE0CI4+ugk4oS19TLQxNgH7Vs8J5PmXA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro , Dinh Nguyen Subject: [PATCH 4.14 201/229] nios2: restarts apply only to the first sigframe we build... Date: Tue, 23 Aug 2022 10:26:02 +0200 Message-Id: <20220823080100.819429975@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Al Viro commit 411a76b7219555c55867466c82d70ce928d6c9e1 upstream. Fixes: b53e906d255d ("nios2: Signal handling support") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/nios2/kernel/signal.c | 1 + 1 file changed, 1 insertion(+) --- a/arch/nios2/kernel/signal.c +++ b/arch/nios2/kernel/signal.c @@ -261,6 +261,7 @@ static int do_signal(struct pt_regs *reg regs->ea =3D restart_addr; break; } + regs->orig_r2 =3D -1; } =20 if (get_signal(&ksig)) { From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B7EDC32772 for ; Tue, 23 Aug 2022 10:18:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353744AbiHWKSY (ORCPT ); Tue, 23 Aug 2022 06:18:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54178 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352417AbiHWKHc (ORCPT ); Tue, 23 Aug 2022 06:07:32 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DE6D34A813; Tue, 23 Aug 2022 01:54:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7C40C614E7; Tue, 23 Aug 2022 08:54:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7DA5EC433C1; Tue, 23 Aug 2022 08:54:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244853; bh=UlzcKidXqLG4HmGSEd5gPKAWOKksFX8ym+DBmzhofjk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2AkRMm350zKwdMSalu8qz6JCvfRMeIBgOOm2RkaFxL6zD3HwvuXQxu5wxCsdLGHGs Zrt3Q4pHioDH1+fS1eSWVCYUrfQ7RnvIA/0roeaZ+dKAijzRUCd3kRmyS9xmBvJXpL sVMqpOTC/zzCnjSUMHrLw97W7u8hcppJ+KNRrJ1A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro , Dinh Nguyen Subject: [PATCH 4.14 202/229] nios2: add force_successful_syscall_return() Date: Tue, 23 Aug 2022 10:26:03 +0200 Message-Id: <20220823080100.858856218@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Al Viro commit fd0c153daad135d0ec1a53c5dbe6936a724d6ae1 upstream. If we use the ancient SysV syscall ABI, we'd better have tell the kernel how to claim that a negative return value is a success. Use ->orig_r2 for that - it's inaccessible via ptrace, so it's a fair game for changes and it's normally[*] non-negative on return from syscall. Set to -1; syscall is not going to be restart-worthy by definition, so we won't interfere with that use either. [*] the only exception is rt_sigreturn(), where we skip the entire messing with r1/r2 anyway. Fixes: 82ed08dd1b0e ("nios2: Exception handling") Signed-off-by: Al Viro Signed-off-by: Dinh Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/nios2/include/asm/ptrace.h | 2 ++ arch/nios2/kernel/entry.S | 6 ++++++ 2 files changed, 8 insertions(+) --- a/arch/nios2/include/asm/ptrace.h +++ b/arch/nios2/include/asm/ptrace.h @@ -74,6 +74,8 @@ extern void show_regs(struct pt_regs *); ((struct pt_regs *)((unsigned long)current_thread_info() + THREAD_SIZE)\ - 1) =20 +#define force_successful_syscall_return() (current_pt_regs()->orig_r2 =3D = -1) + int do_syscall_trace_enter(void); void do_syscall_trace_exit(void); #endif /* __ASSEMBLY__ */ --- a/arch/nios2/kernel/entry.S +++ b/arch/nios2/kernel/entry.S @@ -213,6 +213,9 @@ local_restart: translate_rc_and_ret: movi r1, 0 bge r2, zero, 3f + ldw r1, PT_ORIG_R2(sp) + addi r1, r1, 1 + beq r1, zero, 3f sub r2, zero, r2 movi r1, 1 3: @@ -276,6 +279,9 @@ traced_system_call: translate_rc_and_ret2: movi r1, 0 bge r2, zero, 4f + ldw r1, PT_ORIG_R2(sp) + addi r1, r1, 1 + beq r1, zero, 4f sub r2, zero, r2 movi r1, 1 4: From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7704C32772 for ; Tue, 23 Aug 2022 10:18:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353704AbiHWKSb (ORCPT ); Tue, 23 Aug 2022 06:18:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33934 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352558AbiHWKIE (ORCPT ); Tue, 23 Aug 2022 06:08:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5E1C45A2E8; Tue, 23 Aug 2022 01:54:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C1A036150F; Tue, 23 Aug 2022 08:54:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C3474C433D6; Tue, 23 Aug 2022 08:54:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244863; bh=GEkDlFdYejgeBRE8yTQaw/+MTKzDAMTi3p29YjlsrMw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nh9XG+JhwsHb/LfruR06+fRs8aT7Bl7L79CyK4hTg/N/UUVsNo8qS0WgMXLljRNTF Glm+uDjU13XzMIICMfO7cczdnZ0GSexPTRZCl/e8NpzuhV/HL4nxJEMPruWwFc0bqx I1yApGaja+HfKjcKVAMmSGv66+L7EwDHl9qu5rvM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pablo Neira Ayuso Subject: [PATCH 4.14 203/229] netfilter: nf_tables: really skip inactive sets when allocating name Date: Tue, 23 Aug 2022 10:26:04 +0200 Message-Id: <20220823080100.902840174@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pablo Neira Ayuso commit 271c5ca826e0c3c53e0eb4032f8eaedea1ee391c upstream. While looping to build the bitmap of used anonymous set names, check the current set in the iteration, instead of the one that is being created. Fixes: 37a9cc525525 ("netfilter: nf_tables: add generation mask to sets") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2797,7 +2797,7 @@ cont: list_for_each_entry(i, &ctx->table->sets, list) { int tmp; =20 - if (!nft_is_active_next(ctx->net, set)) + if (!nft_is_active_next(ctx->net, i)) continue; if (!sscanf(i->name, name, &tmp)) continue; From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83A87C32792 for ; Tue, 23 Aug 2022 10:19:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240189AbiHWKTH (ORCPT ); Tue, 23 Aug 2022 06:19:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34314 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352589AbiHWKIM (ORCPT ); Tue, 23 Aug 2022 06:08:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 595A15A814; Tue, 23 Aug 2022 01:54:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EC5FD614E7; Tue, 23 Aug 2022 08:54:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EE709C433C1; Tue, 23 Aug 2022 08:54:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244869; bh=wHY68nJcyo2katdIxL+WELqzCPei9l12nIZdOUziNv0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y+168JPCPzowtSf3/HLkwfCPZpDFOxUx/DSxRXTJhgtqaU2JWLlJP7kkwGT7/m83J nBkGhs1yQXvtQUr7NseMjR/4M8KC44r9CgvYjKz8h9vfAsN3kh7ZuzYG7GTDnIa5W6 uxhBxAgdrYqSs+pob6yLJAXbeyjE0QahZzViIS88= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guenter Roeck , Michael Ellerman Subject: [PATCH 4.14 204/229] powerpc/pci: Fix get_phb_number() locking Date: Tue, 23 Aug 2022 10:26:05 +0200 Message-Id: <20220823080100.943073812@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Ellerman commit 8d48562a2729742f767b0fdd994d6b2a56a49c63 upstream. The recent change to get_phb_number() causes a DEBUG_ATOMIC_SLEEP warning on some systems: BUG: sleeping function called from invalid context at kernel/locking/mute= x.c:580 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by swapper/1: #0: c157efb0 (hose_spinlock){+.+.}-{2:2}, at: pcibios_alloc_controller+0= x64/0x220 Preemption disabled at: [<00000000>] 0x0 CPU: 0 PID: 1 Comm: swapper Not tainted 5.19.0-yocto-standard+ #1 Call Trace: [d101dc90] [c073b264] dump_stack_lvl+0x50/0x8c (unreliable) [d101dcb0] [c0093b70] __might_resched+0x258/0x2a8 [d101dcd0] [c0d3e634] __mutex_lock+0x6c/0x6ec [d101dd50] [c0a84174] of_alias_get_id+0x50/0xf4 [d101dd80] [c002ec78] pcibios_alloc_controller+0x1b8/0x220 [d101ddd0] [c140c9dc] pmac_pci_init+0x198/0x784 [d101de50] [c140852c] discover_phbs+0x30/0x4c [d101de60] [c0007fd4] do_one_initcall+0x94/0x344 [d101ded0] [c1403b40] kernel_init_freeable+0x1a8/0x22c [d101df10] [c00086e0] kernel_init+0x34/0x160 [d101df30] [c001b334] ret_from_kernel_thread+0x5c/0x64 This is because pcibios_alloc_controller() holds hose_spinlock but of_alias_get_id() takes of_mutex which can sleep. The hose_spinlock protects the phb_bitmap, and also the hose_list, but it doesn't need to be held while get_phb_number() calls the OF routines, because those are only looking up information in the device tree. So fix it by having get_phb_number() take the hose_spinlock itself, only where required, and then dropping the lock before returning. pcibios_alloc_controller() then needs to take the lock again before the list_add() but that's safe, the order of the list is not important. Fixes: 0fe1e96fef0a ("powerpc/pci: Prefer PCI domain assignment via DT 'lin= ux,pci-domain' and alias") Reported-by: Guenter Roeck Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220815065550.1303620-1-mpe@ellerman.id.au Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/powerpc/kernel/pci-common.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) --- a/arch/powerpc/kernel/pci-common.c +++ b/arch/powerpc/kernel/pci-common.c @@ -73,10 +73,6 @@ const struct dma_map_ops *get_pci_dma_op } EXPORT_SYMBOL(get_pci_dma_ops); =20 -/* - * This function should run under locking protection, specifically - * hose_spinlock. - */ static int get_phb_number(struct device_node *dn) { int ret, phb_id =3D -1; @@ -113,15 +109,20 @@ static int get_phb_number(struct device_ if (!ret) phb_id =3D (int)(prop & (MAX_PHBS - 1)); =20 + spin_lock(&hose_spinlock); + /* We need to be sure to not use the same PHB number twice. */ if ((phb_id >=3D 0) && !test_and_set_bit(phb_id, phb_bitmap)) - return phb_id; + goto out_unlock; =20 /* If everything fails then fallback to dynamic PHB numbering. */ phb_id =3D find_first_zero_bit(phb_bitmap, MAX_PHBS); BUG_ON(phb_id >=3D MAX_PHBS); set_bit(phb_id, phb_bitmap); =20 +out_unlock: + spin_unlock(&hose_spinlock); + return phb_id; } =20 @@ -132,10 +133,13 @@ struct pci_controller *pcibios_alloc_con phb =3D zalloc_maybe_bootmem(sizeof(struct pci_controller), GFP_KERNEL); if (phb =3D=3D NULL) return NULL; - spin_lock(&hose_spinlock); + phb->global_number =3D get_phb_number(dev); + + spin_lock(&hose_spinlock); list_add_tail(&phb->list_node, &hose_list); spin_unlock(&hose_spinlock); + phb->dn =3D dev; phb->is_dynamic =3D slab_is_available(); #ifdef CONFIG_PPC64 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A25FCC3F6B0 for ; Tue, 23 Aug 2022 10:19:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353683AbiHWKTN (ORCPT ); Tue, 23 Aug 2022 06:19:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35388 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352649AbiHWKIY (ORCPT ); Tue, 23 Aug 2022 06:08:24 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5B94859269; Tue, 23 Aug 2022 01:54:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E7E66614E7; Tue, 23 Aug 2022 08:54:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 02FDAC433D6; Tue, 23 Aug 2022 08:54:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244875; bh=4Us83UT6ZbV3aktWVPiRZSjSNlBE3K0H6ZYvOyN1SBU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=x57DpT2Mu5Y4ELKQYuU9qHURxjNRLJUEFRxHOxKITRYRxvRwR3RtBR8e752dfASYI xZsmjFPnkhUlQDelJnSJ1hNdyi/D3Ydhas0hiVgawzt2yJNjE14BOUjmA+SIBfiTpn v/KL5CZvukn3tXUjFJgMuOZJrTKE6o2QDT4Z+rmg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Brady , Mateusz Palczewski , Tony Nguyen , Gurucharan Subject: [PATCH 4.14 205/229] i40e: Fix to stop tx_timeout recovery if GLOBR fails Date: Tue, 23 Aug 2022 10:26:06 +0200 Message-Id: <20220823080100.981537291@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Brady commit 57c942bc3bef0970f0b21f8e0998e76a900ea80d upstream. When a tx_timeout fires, the PF attempts to recover by incrementally resetting. First we try a PFR, then CORER and finally a GLOBR. If the GLOBR fails, then we keep hitting the tx_timeout and incrementing the recovery level and issuing dmesgs, which is both annoying to the user and accomplishes nothing. If the GLOBR fails, then we're pretty much totally hosed, and there's not much else we can do to recover, so this makes it such that we just kill the VSI and stop hitting the tx_timeout in such a case. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Alan Brady Signed-off-by: Mateusz Palczewski Tested-by: Gurucharan (A Contingent worker at Int= el) Signed-off-by: Tony Nguyen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -405,7 +405,9 @@ static void i40e_tx_timeout(struct net_d set_bit(__I40E_GLOBAL_RESET_REQUESTED, pf->state); break; default: - netdev_err(netdev, "tx_timeout recovery unsuccessful\n"); + netdev_err(netdev, "tx_timeout recovery unsuccessful, device is in non-r= ecoverable state.\n"); + set_bit(__I40E_DOWN_REQUESTED, pf->state); + set_bit(__I40E_VSI_DOWN_REQUESTED, vsi->state); break; } From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42C23C32774 for ; Tue, 23 Aug 2022 10:19:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353971AbiHWKT0 (ORCPT ); Tue, 23 Aug 2022 06:19:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352697AbiHWKIc (ORCPT ); Tue, 23 Aug 2022 06:08:32 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D0A396CD14; Tue, 23 Aug 2022 01:54:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E1D916150F; Tue, 23 Aug 2022 08:54:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7D7EC433C1; Tue, 23 Aug 2022 08:54:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244881; bh=wzYSU7PSI22ZxSnt8HJeG089qUc1YXYvyYmqR9gjY2Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0G8ftpogScWYLBsQ65gS1XJLwqB4hVrS5IC0Tu7P4jSOnAT7iFb1Jxfe+IRKC83g1 8BYf+fVIYowtZymn7YjR3JuDwYeR19+NPToYqt8w7Wtt8yDkh4ZLgSPMsZuLy0H+KK 5n2XiGRfQKmmbeGlxwkHo/lpIKltXD3CX1HkMHf0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Cs=C3=B3k=C3=A1s=20Bence?= , Jakub Kicinski Subject: [PATCH 4.14 206/229] fec: Fix timer capture timing in `fec_ptp_enable_pps()` Date: Tue, 23 Aug 2022 10:26:07 +0200 Message-Id: <20220823080101.012155497@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Cs=C3=B3k=C3=A1s Bence commit 61d5e2a251fb20c2c5e998c3f1d52ed6d5360319 upstream. Code reimplements functionality already in `fec_ptp_read()`, but misses check for FEC_QUIRK_BUG_CAPTURE. Replace with function call. Fixes: 28b5f058cf1d ("net: fec: ptp: fix convergence issue to support Linux= PTP stack") Signed-off-by: Cs=C3=B3k=C3=A1s Bence Link: https://lore.kernel.org/r/20220811101348.13755-1-csokas.bence@prolan.= hu Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/freescale/fec_ptp.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) --- a/drivers/net/ethernet/freescale/fec_ptp.c +++ b/drivers/net/ethernet/freescale/fec_ptp.c @@ -155,11 +155,7 @@ static int fec_ptp_enable_pps(struct fec * NSEC_PER_SEC - ts.tv_nsec. Add the remaining nanoseconds * to current timer would be next second. */ - tempval =3D readl(fep->hwp + FEC_ATIME_CTRL); - tempval |=3D FEC_T_CTRL_CAPTURE; - writel(tempval, fep->hwp + FEC_ATIME_CTRL); - - tempval =3D readl(fep->hwp + FEC_ATIME); + tempval =3D fep->cc.read(&fep->cc); /* Convert the ptp local counter to 1588 timestamp */ ns =3D timecounter_cyc2time(&fep->tc, tempval); ts =3D ns_to_timespec64(ns); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03F85C32772 for ; Tue, 23 Aug 2022 10:20:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354052AbiHWKT7 (ORCPT ); Tue, 23 Aug 2022 06:19:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36378 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352743AbiHWKIf (ORCPT ); Tue, 23 Aug 2022 06:08:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6DF7774B9D; Tue, 23 Aug 2022 01:54:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0D3896150F; Tue, 23 Aug 2022 08:54:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0236DC433D7; Tue, 23 Aug 2022 08:54:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244887; bh=Nr9MU1aWeCZRzw+WNli+oOXAuZYw4b0Bu5Xr7aa39+Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uUeTFN5b4DAYvJ2Px0CNDK226H8TyLsCuafvdthHhl0ofMxCSA1ZwtNDL5Ey3+Kg4 +/jcNSmxme0UECUsSXuYayaWrFXv1olIHtZ2THF7vIoeecW2RYBVG0ypSyHWTROPUi 4nY0iRXbmlphiHHUokfm23YmbWVsAfn65yGV2Sss= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Ma , Konrad Jankowski , Tony Nguyen , Jakub Kicinski Subject: [PATCH 4.14 207/229] igb: Add lock to avoid data race Date: Tue, 23 Aug 2022 10:26:08 +0200 Message-Id: <20220823080101.042772473@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lin Ma commit 6faee3d4ee8be0f0367d0c3d826afb3571b7a5e0 upstream. The commit c23d92b80e0b ("igb: Teardown SR-IOV before unregister_netdev()") places the unregister_netdev() call after the igb_disable_sriov() call to avoid functionality issue. However, it introduces several race conditions when detaching a device. For example, when .remove() is called, the below interleaving leads to use-after-free. (FREE from device detaching) | (USE from netdev core) igb_remove | igb_ndo_get_vf_config igb_disable_sriov | vf >=3D adapter->vfs_allocated_count? kfree(adapter->vf_data) | adapter->vfs_allocated_count =3D 0 | | memcpy(... adapter->vf_data[vf] Moreover, the igb_disable_sriov() also suffers from data race with the requests from VF driver. (FREE from device detaching) | (USE from requests) igb_remove | igb_msix_other igb_disable_sriov | igb_msg_task kfree(adapter->vf_data) | vf < adapter->vfs_allocated_count adapter->vfs_allocated_count =3D 0 | To this end, this commit first eliminates the data races from netdev core by using rtnl_lock (similar to commit 719479230893 ("dpaa2-eth: add MAC/PHY support through phylink")). And then adds a spinlock to eliminate races from driver requests. (similar to commit 1e53834ce541 ("ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero") Fixes: c23d92b80e0b ("igb: Teardown SR-IOV before unregister_netdev()") Signed-off-by: Lin Ma Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen Link: https://lore.kernel.org/r/20220817184921.735244-1-anthony.l.nguyen@in= tel.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/intel/igb/igb.h | 2 ++ drivers/net/ethernet/intel/igb/igb_main.c | 12 +++++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/intel/igb/igb.h +++ b/drivers/net/ethernet/intel/igb/igb.h @@ -599,6 +599,8 @@ struct igb_adapter { struct igb_mac_addr *mac_table; struct vf_mac_filter vf_macs; struct vf_mac_filter *vf_mac_list; + /* lock for VF resources */ + spinlock_t vfs_lock; }; =20 /* flags controlling PTP/1588 function */ --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -2805,6 +2805,7 @@ static int igb_disable_sriov(struct pci_ struct net_device *netdev =3D pci_get_drvdata(pdev); struct igb_adapter *adapter =3D netdev_priv(netdev); struct e1000_hw *hw =3D &adapter->hw; + unsigned long flags; =20 /* reclaim resources allocated to VFs */ if (adapter->vf_data) { @@ -2817,12 +2818,13 @@ static int igb_disable_sriov(struct pci_ pci_disable_sriov(pdev); msleep(500); } - + spin_lock_irqsave(&adapter->vfs_lock, flags); kfree(adapter->vf_mac_list); adapter->vf_mac_list =3D NULL; kfree(adapter->vf_data); adapter->vf_data =3D NULL; adapter->vfs_allocated_count =3D 0; + spin_unlock_irqrestore(&adapter->vfs_lock, flags); wr32(E1000_IOVCTL, E1000_IOVCTL_REUSE_VFQ); wrfl(); msleep(100); @@ -2984,7 +2986,9 @@ static void igb_remove(struct pci_dev *p igb_release_hw_control(adapter); =20 #ifdef CONFIG_PCI_IOV + rtnl_lock(); igb_disable_sriov(pdev); + rtnl_unlock(); #endif =20 unregister_netdev(netdev); @@ -3137,6 +3141,9 @@ static int igb_sw_init(struct igb_adapte =20 spin_lock_init(&adapter->nfc_lock); spin_lock_init(&adapter->stats64_lock); + + /* init spinlock to avoid concurrency of VF resources */ + spin_lock_init(&adapter->vfs_lock); #ifdef CONFIG_PCI_IOV switch (hw->mac.type) { case e1000_82576: @@ -6776,8 +6783,10 @@ unlock: static void igb_msg_task(struct igb_adapter *adapter) { struct e1000_hw *hw =3D &adapter->hw; + unsigned long flags; u32 vf; =20 + spin_lock_irqsave(&adapter->vfs_lock, flags); for (vf =3D 0; vf < adapter->vfs_allocated_count; vf++) { /* process any reset requests */ if (!igb_check_for_rst(hw, vf)) @@ -6791,6 +6800,7 @@ static void igb_msg_task(struct igb_adap if (!igb_check_for_ack(hw, vf)) igb_rcv_ack_from_vf(adapter, vf); } + spin_unlock_irqrestore(&adapter->vfs_lock, flags); } =20 /** From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C90DC32772 for ; Tue, 23 Aug 2022 10:20:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354092AbiHWKUS (ORCPT ); Tue, 23 Aug 2022 06:20:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37890 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352812AbiHWKI7 (ORCPT ); Tue, 23 Aug 2022 06:08:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E38EE7D7B7; Tue, 23 Aug 2022 01:54:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 96D02B81C39; Tue, 23 Aug 2022 08:54:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 00F8AC433C1; Tue, 23 Aug 2022 08:54:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244896; bh=R9WSvWCXx76BsI8euW0jKufvJkvEvjle4/TwJ7m2w88=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rZcXDAF6LatjQAn7IBTSx3aEF/Z3a8NeoQ1lQ29JSo820zohGqHOtcW6zVHjBMa47 xPz4SZEd0r9Y4uRrnCZpE57o7QsTAeUu6mum8w8uJpVNcpPfqQPb/sMMjFEdfEKSaQ JWHc46iqpxbn7Z97+4MfGOa036YQMxrQ+3KIOxf0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Masahiro Yamada , Nicolas Pitre Subject: [PATCH 4.14 208/229] kbuild: clear LDFLAGS in the top Makefile Date: Tue, 23 Aug 2022 10:26:09 +0200 Message-Id: <20220823080101.073098690@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Masahiro Yamada commit ce99d0bf312daf0178e640da9e3c93b773a67e7d upstream. Currently LDFLAGS is not cleared, so same flags are accumulated in LDFLAGS when the top Makefile is recursively invoked. I found unneeded rebuild for ARCH=3Darm64 when CONFIG_TRIM_UNUSED_KSYMS is enabled. If include/generated/autoksyms.h is updated, the top Makefile is recursively invoked, then arch/arm64/Makefile adds one more '-maarch64linux'. Due to the command line change, modules are rebuilt needlessly. Signed-off-by: Masahiro Yamada Acked-by: Nicolas Pitre Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- Makefile | 1 + 1 file changed, 1 insertion(+) --- a/Makefile +++ b/Makefile @@ -426,6 +426,7 @@ KBUILD_CFLAGS_KERNEL :=3D KBUILD_AFLAGS_MODULE :=3D -DMODULE KBUILD_CFLAGS_MODULE :=3D -DMODULE KBUILD_LDFLAGS_MODULE :=3D -T $(srctree)/scripts/module-common.lds +LDFLAGS :=3D GCC_PLUGINS_CFLAGS :=3D CLANG_FLAGS :=3D From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7B09C32772 for ; Tue, 23 Aug 2022 10:23:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354142AbiHWKUe (ORCPT ); Tue, 23 Aug 2022 06:20:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56938 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352818AbiHWKJE (ORCPT ); Tue, 23 Aug 2022 06:09:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 26D5C6B8CD; Tue, 23 Aug 2022 01:55:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C95A4B81C39; Tue, 23 Aug 2022 08:55:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1C903C433D6; Tue, 23 Aug 2022 08:55:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244902; bh=03o8XUXP7UAjx6AQTbs0AGKRD8xZsQaZLgJmXYyTFSI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=o7Mu0WhFmdlnvzs0HH8iKLWi9QT/qzNUbQGO/IyzMpsBWjCEL46uQNbe14fjDipj6 NY3e0RFYUd+PJ1ATMRflrVKtFXCKisD3P1EgHxwaM0VuDz3krO+wXYyCbVGknief7v 7owAac0M9ieZ9c8sH3xuKtxs5UJcZSMtlpWOWoRg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Sterba , Qu Wenruo Subject: [PATCH 4.14 209/229] btrfs: only write the sectors in the vertical stripe which has data stripes Date: Tue, 23 Aug 2022 10:26:10 +0200 Message-Id: <20220823080101.111287001@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Qu Wenruo commit bd8f7e627703ca5707833d623efcd43f104c7b3f upstream. If we have only 8K partial write at the beginning of a full RAID56 stripe, we will write the following contents: 0 8K 32K 64K Disk 1 (data): |XX| | | Disk 2 (data): | | | Disk 3 (parity): |XXXXXXXXXXXXXXX|XXXXXXXXXXXXXXX| |X| means the sector will be written back to disk. Note that, although we won't write any sectors from disk 2, but we will write the full 64KiB of parity to disk. This behavior is fine for now, but not for the future (especially for RAID56J, as we waste quite some space to journal the unused parity stripes). So here we will also utilize the btrfs_raid_bio::dbitmap, anytime we queue a higher level bio into an rbio, we will update rbio::dbitmap to indicate which vertical stripes we need to writeback. And at finish_rmw(), we also check dbitmap to see if we need to write any sector in the vertical stripe. So after the patch, above example will only lead to the following writeback pattern: 0 8K 32K 64K Disk 1 (data): |XX| | | Disk 2 (data): | | | Disk 3 (parity): |XX| | | Acked-by: David Sterba Signed-off-by: Qu Wenruo Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/btrfs/raid56.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++= +---- 1 file changed, 51 insertions(+), 4 deletions(-) --- a/fs/btrfs/raid56.c +++ b/fs/btrfs/raid56.c @@ -334,6 +334,9 @@ static void merge_rbio(struct btrfs_raid { bio_list_merge(&dest->bio_list, &victim->bio_list); dest->bio_list_bytes +=3D victim->bio_list_bytes; + /* Also inherit the bitmaps from @victim. */ + bitmap_or(dest->dbitmap, victim->dbitmap, dest->dbitmap, + dest->stripe_npages); dest->generic_bio_cnt +=3D victim->generic_bio_cnt; bio_list_init(&victim->bio_list); } @@ -882,6 +885,12 @@ static void rbio_orig_end_io(struct btrf =20 if (rbio->generic_bio_cnt) btrfs_bio_counter_sub(rbio->fs_info, rbio->generic_bio_cnt); + /* + * Clear the data bitmap, as the rbio may be cached for later usage. + * do this before before unlock_stripe() so there will be no new bio + * for this bio. + */ + bitmap_clear(rbio->dbitmap, 0, rbio->stripe_npages); =20 /* * At this moment, rbio->bio_list is empty, however since rbio does not @@ -1204,6 +1213,9 @@ static noinline void finish_rmw(struct b else BUG(); =20 + /* We should have at least one data sector. */ + ASSERT(bitmap_weight(rbio->dbitmap, rbio->stripe_npages)); + /* at this point we either have a full stripe, * or we've read the full stripe from the drive. * recalculate the parity and write the new results. @@ -1277,6 +1289,11 @@ static noinline void finish_rmw(struct b for (stripe =3D 0; stripe < rbio->real_stripes; stripe++) { for (pagenr =3D 0; pagenr < rbio->stripe_npages; pagenr++) { struct page *page; + + /* This vertical stripe has no data, skip it. */ + if (!test_bit(pagenr, rbio->dbitmap)) + continue; + if (stripe < rbio->nr_data) { page =3D page_in_rbio(rbio, stripe, pagenr, 1); if (!page) @@ -1301,6 +1318,11 @@ static noinline void finish_rmw(struct b =20 for (pagenr =3D 0; pagenr < rbio->stripe_npages; pagenr++) { struct page *page; + + /* This vertical stripe has no data, skip it. */ + if (!test_bit(pagenr, rbio->dbitmap)) + continue; + if (stripe < rbio->nr_data) { page =3D page_in_rbio(rbio, stripe, pagenr, 1); if (!page) @@ -1745,6 +1767,33 @@ static void btrfs_raid_unplug(struct blk run_plug(plug); } =20 +/* Add the original bio into rbio->bio_list, and update rbio::dbitmap. */ +static void rbio_add_bio(struct btrfs_raid_bio *rbio, struct bio *orig_bio) +{ + const struct btrfs_fs_info *fs_info =3D rbio->fs_info; + const u64 orig_logical =3D orig_bio->bi_iter.bi_sector << SECTOR_SHIFT; + const u64 full_stripe_start =3D rbio->bbio->raid_map[0]; + const u32 orig_len =3D orig_bio->bi_iter.bi_size; + const u32 sectorsize =3D fs_info->sectorsize; + u64 cur_logical; + + ASSERT(orig_logical >=3D full_stripe_start && + orig_logical + orig_len <=3D full_stripe_start + + rbio->nr_data * rbio->stripe_len); + + bio_list_add(&rbio->bio_list, orig_bio); + rbio->bio_list_bytes +=3D orig_bio->bi_iter.bi_size; + + /* Update the dbitmap. */ + for (cur_logical =3D orig_logical; cur_logical < orig_logical + orig_len; + cur_logical +=3D sectorsize) { + int bit =3D ((u32)(cur_logical - full_stripe_start) >> + PAGE_SHIFT) % rbio->stripe_npages; + + set_bit(bit, rbio->dbitmap); + } +} + /* * our main entry point for writes from the rest of the FS. */ @@ -1761,9 +1810,8 @@ int raid56_parity_write(struct btrfs_fs_ btrfs_put_bbio(bbio); return PTR_ERR(rbio); } - bio_list_add(&rbio->bio_list, bio); - rbio->bio_list_bytes =3D bio->bi_iter.bi_size; rbio->operation =3D BTRFS_RBIO_WRITE; + rbio_add_bio(rbio, bio); =20 btrfs_bio_counter_inc_noblocked(fs_info); rbio->generic_bio_cnt =3D 1; @@ -2146,8 +2194,7 @@ int raid56_parity_recover(struct btrfs_f } =20 rbio->operation =3D BTRFS_RBIO_READ_REBUILD; - bio_list_add(&rbio->bio_list, bio); - rbio->bio_list_bytes =3D bio->bi_iter.bi_size; + rbio_add_bio(rbio, bio); =20 rbio->faila =3D find_logical_bio_stripe(rbio, bio); if (rbio->faila =3D=3D -1) { From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39537C3814E for ; Tue, 23 Aug 2022 10:23:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354164AbiHWKUj (ORCPT ); Tue, 23 Aug 2022 06:20:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58068 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352865AbiHWKJX (ORCPT ); Tue, 23 Aug 2022 06:09:23 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 66AFB6B677; Tue, 23 Aug 2022 01:55:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EE778B81C28; Tue, 23 Aug 2022 08:55:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 49BCFC433D6; Tue, 23 Aug 2022 08:55:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244908; bh=ssAWNueqDfuuf/S7Vyeylygry3pLHpNKG4ybc1WcwPQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=o3ilnL7QG9fqWAKCMF5cOzkYwKTrvXeZXaVO2svyfoT20X5AvVWYtDMzPrbZAGl4+ AvnIIBwrWAqXDbrmHKNPYPRLzk3ian3RNwVXm6cs+o/ob/hrlNSq4DCT0UochqG+Na U1N/I0Ztsvn0f0K1T2dP9/wVQ9y9bqAi+VwrffS4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Sterba , Qu Wenruo Subject: [PATCH 4.14 210/229] btrfs: raid56: dont trust any cached sector in __raid56_parity_recover() Date: Tue, 23 Aug 2022 10:26:11 +0200 Message-Id: <20220823080101.141317930@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Qu Wenruo commit f6065f8edeb25f4a9dfe0b446030ad995a84a088 upstream. [BUG] There is a small workload which will always fail with recent kernel: (A simplified version from btrfs/125 test case) mkfs.btrfs -f -m raid5 -d raid5 -b 1G $dev1 $dev2 $dev3 mount $dev1 $mnt xfs_io -f -c "pwrite -S 0xee 0 1M" $mnt/file1 sync umount $mnt btrfs dev scan -u $dev3 mount -o degraded $dev1 $mnt xfs_io -f -c "pwrite -S 0xff 0 128M" $mnt/file2 umount $mnt btrfs dev scan mount $dev1 $mnt btrfs balance start --full-balance $mnt umount $mnt The failure is always failed to read some tree blocks: BTRFS info (device dm-4): relocating block group 217710592 flags data|rai= d5 BTRFS error (device dm-4): parent transid verify failed on 38993920 wante= d 9 found 7 BTRFS error (device dm-4): parent transid verify failed on 38993920 wante= d 9 found 7 ... [CAUSE] With the recently added debug output, we can see all RAID56 operations related to full stripe 38928384: 56.1183: raid56_read_partial: full_stripe=3D38928384 devid=3D2 type=3DDAT= A1 offset=3D0 opf=3D0x0 physical=3D9502720 len=3D65536 56.1185: raid56_read_partial: full_stripe=3D38928384 devid=3D3 type=3DDAT= A2 offset=3D16384 opf=3D0x0 physical=3D9519104 len=3D16384 56.1185: raid56_read_partial: full_stripe=3D38928384 devid=3D3 type=3DDAT= A2 offset=3D49152 opf=3D0x0 physical=3D9551872 len=3D16384 56.1187: raid56_write_stripe: full_stripe=3D38928384 devid=3D3 type=3DDAT= A2 offset=3D0 opf=3D0x1 physical=3D9502720 len=3D16384 56.1188: raid56_write_stripe: full_stripe=3D38928384 devid=3D3 type=3DDAT= A2 offset=3D32768 opf=3D0x1 physical=3D9535488 len=3D16384 56.1188: raid56_write_stripe: full_stripe=3D38928384 devid=3D1 type=3DPQ1= offset=3D0 opf=3D0x1 physical=3D30474240 len=3D16384 56.1189: raid56_write_stripe: full_stripe=3D38928384 devid=3D1 type=3DPQ1= offset=3D32768 opf=3D0x1 physical=3D30507008 len=3D16384 56.1218: raid56_write_stripe: full_stripe=3D38928384 devid=3D3 type=3DDAT= A2 offset=3D49152 opf=3D0x1 physical=3D9551872 len=3D16384 56.1219: raid56_write_stripe: full_stripe=3D38928384 devid=3D1 type=3DPQ1= offset=3D49152 opf=3D0x1 physical=3D30523392 len=3D16384 56.2721: raid56_parity_recover: full stripe=3D38928384 eb=3D39010304 mirr= or=3D2 56.2723: raid56_parity_recover: full stripe=3D38928384 eb=3D39010304 mirr= or=3D2 56.2724: raid56_parity_recover: full stripe=3D38928384 eb=3D39010304 mirr= or=3D2 Before we enter raid56_parity_recover(), we have triggered some metadata write for the full stripe 38928384, this leads to us to read all the sectors from disk. Furthermore, btrfs raid56 write will cache its calculated P/Q sectors to avoid unnecessary read. This means, for that full stripe, after any partial write, we will have stale data, along with P/Q calculated using that stale data. Thankfully due to patch "btrfs: only write the sectors in the vertical stri= pe which has data stripes" we haven't submitted all the corrupted P/Q to disk. When we really need to recover certain range, aka in raid56_parity_recover(), we will use the cached rbio, along with its cached sectors (the full stripe is all cached). This explains why we have no event raid56_scrub_read_recover() triggered. Since we have the cached P/Q which is calculated using the stale data, the recovered one will just be stale. In our particular test case, it will always return the same incorrect metadata, thus causing the same error message "parent transid verify failed on 39010304 wanted 9 found 7" again and again. [BTRFS DESTRUCTIVE RMW PROBLEM] Test case btrfs/125 (and above workload) always has its trouble with the destructive read-modify-write (RMW) cycle: 0 32K 64K Data1: | Good | Good | Data2: | Bad | Bad | Parity: | Good | Good | In above case, if we trigger any write into Data1, we will use the bad data in Data2 to re-generate parity, killing the only chance to recovery Data2, thus Data2 is lost forever. This destructive RMW cycle is not specific to btrfs RAID56, but there are some btrfs specific behaviors making the case even worse: - Btrfs will cache sectors for unrelated vertical stripes. In above example, if we're only writing into 0~32K range, btrfs will still read data range (32K ~ 64K) of Data1, and (64K~128K) of Data2. This behavior is to cache sectors for later update. Incidentally commit d4e28d9b5f04 ("btrfs: raid56: make steal_rbio() subpage compatible") has a bug which makes RAID56 to never trust the cached sectors, thus slightly improve the situation for recovery. Unfortunately, follow up fix "btrfs: update stripe_sectors::uptodate in steal_rbio" will revert the behavior back to the old one. - Btrfs raid56 partial write will update all P/Q sectors and cache them This means, even if data at (64K ~ 96K) of Data2 is free space, and only (96K ~ 128K) of Data2 is really stale data. And we write into that (96K ~ 128K), we will update all the parity sectors for the full stripe. This unnecessary behavior will completely kill the chance of recovery. Thankfully, an unrelated optimization "btrfs: only write the sectors in the vertical stripe which has data stripes" will prevent submitting the write bio for untouched vertical sectors. That optimization will keep the on-disk P/Q untouched for a chance for later recovery. [FIX] Although we have no good way to completely fix the destructive RMW (unless we go full scrub for each partial write), we can still limit the damage. With patch "btrfs: only write the sectors in the vertical stripe which has data stripes" now we won't really submit the P/Q of unrelated vertical stripes, so the on-disk P/Q should still be fine. Now we really need to do is just drop all the cached sectors when doing recovery. By this, we have a chance to read the original P/Q from disk, and have a chance to recover the stale data, while still keep the cache to speed up regular write path. In fact, just dropping all the cache for recovery path is good enough to allow the test case btrfs/125 along with the small script to pass reliably. The lack of metadata write after the degraded mount, and forced metadata COW is saving us this time. So this patch will fix the behavior by not trust any cache in __raid56_parity_recover(), to solve the problem while still keep the cache useful. But please note that this test pass DOES NOT mean we have solved the destructive RMW problem, we just do better damage control a little better. Related patches: - btrfs: only write the sectors in the vertical stripe - d4e28d9b5f04 ("btrfs: raid56: make steal_rbio() subpage compatible") - btrfs: update stripe_sectors::uptodate in steal_rbio Acked-by: David Sterba Signed-off-by: Qu Wenruo Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/btrfs/raid56.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) --- a/fs/btrfs/raid56.c +++ b/fs/btrfs/raid56.c @@ -2096,9 +2096,12 @@ static int __raid56_parity_recover(struc atomic_set(&rbio->error, 0); =20 /* - * read everything that hasn't failed. Thanks to the - * stripe cache, it is possible that some or all of these - * pages are going to be uptodate. + * Read everything that hasn't failed. However this time we will + * not trust any cached sector. + * As we may read out some stale data but higher layer is not reading + * that stale part. + * + * So here we always re-read everything in recovery path. */ for (stripe =3D 0; stripe < rbio->real_stripes; stripe++) { if (rbio->faila =3D=3D stripe || rbio->failb =3D=3D stripe) { @@ -2107,16 +2110,6 @@ static int __raid56_parity_recover(struc } =20 for (pagenr =3D 0; pagenr < rbio->stripe_npages; pagenr++) { - struct page *p; - - /* - * the rmw code may have already read this - * page in - */ - p =3D rbio_stripe_page(rbio, stripe, pagenr); - if (PageUptodate(p)) - continue; - ret =3D rbio_add_io_page(rbio, &bio_list, rbio_stripe_page(rbio, stripe, pagenr), stripe, pagenr, rbio->stripe_len); From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA6AEC32774 for ; Tue, 23 Aug 2022 10:23:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354261AbiHWKVD (ORCPT ); Tue, 23 Aug 2022 06:21:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60680 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352885AbiHWKJ2 (ORCPT ); Tue, 23 Aug 2022 06:09:28 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 041547D7A0; Tue, 23 Aug 2022 01:55:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 82CF6B81C35; Tue, 23 Aug 2022 08:55:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E1856C433C1; Tue, 23 Aug 2022 08:55:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244914; bh=bN3EKTlsIxDcvLIM4ArOYD58V+iKRrzDHbCvOFH9Ogw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j0vdfaWXkCSzGDH9fcwtxgJQqF+PqtR7W+gn0yVUYt/ydqx6RMeJElwq+Ra7uFteE o9ntCAB2zl/LbUi0pHe3HgskvVkBS/R4fyHX+dOTFb1Gi3AsFMYReQGebn1tDmAty1 FwGyKDb6rHfBaDELUsC+4UEre5NK9qAklzAe/RT8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Martin Blumenstingl , Neil Armstrong , Sasha Levin Subject: [PATCH 4.14 211/229] drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() Date: Tue, 23 Aug 2022 10:26:12 +0200 Message-Id: <20220823080101.180969502@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 91b3c8dbe898df158fd2a84675f3a284ff6666f7 ] In this function, there are two refcount leak bugs: (1) when breaking out of for_each_endpoint_of_node(), we need call the of_node_put() for the 'ep'; (2) we should call of_node_put() for the reference returned by of_graph_get_remote_port() when it is not used anymore. Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller= ") Signed-off-by: Liang He Acked-by: Martin Blumenstingl Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://patchwork.freedesktop.org/patch/msgid/20220726010722.1319416-= 1-windhl@126.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/meson/meson_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meso= n_drv.c index 2d5f2ed3b0b2..0da33f7af654 100644 --- a/drivers/gpu/drm/meson/meson_drv.c +++ b/drivers/gpu/drm/meson/meson_drv.c @@ -136,8 +136,11 @@ static bool meson_vpu_has_available_connectors(struct = device *dev) for_each_endpoint_of_node(dev->of_node, ep) { /* If the endpoint node exists, consider it enabled */ remote =3D of_graph_get_remote_port(ep); - if (remote) + if (remote) { + of_node_put(remote); + of_node_put(ep); return true; + } } =20 return false; --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BEB5C38145 for ; Tue, 23 Aug 2022 10:23:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354366AbiHWKVU (ORCPT ); Tue, 23 Aug 2022 06:21:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58194 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352899AbiHWKJc (ORCPT ); Tue, 23 Aug 2022 06:09:32 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BA935101A; Tue, 23 Aug 2022 01:55:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6BDF7B81C28; Tue, 23 Aug 2022 08:55:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 85182C433D6; Tue, 23 Aug 2022 08:55:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244921; bh=CZzuY3a27j4F+CBOVWD7MeVGBQoD3tKsr9GhoUeeke8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yEmWpu9Mdt84IVcXApBygCnemvkbzxr88LPPDv+Jzy6nKW352C33CEd/PaWnTeqNU E7GkXr2Nd7/8nJOIVLAOqSMln0lFPLgDguOJeBwaUPP6kOFMtXhfBQ3wworNQWDc8H wCgSoW+lqdVdNcrn5U9RuPH8jXLG5zCtLNdAgC1E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavan Chebbi , Michael Chan , Bjorn Helgaas , Sasha Levin Subject: [PATCH 4.14 212/229] PCI: Add ACS quirk for Broadcom BCM5750x NICs Date: Tue, 23 Aug 2022 10:26:13 +0200 Message-Id: <20220823080101.216525898@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pavan Chebbi [ Upstream commit afd306a65cedb9589564bdb23a0c368abc4215fd ] The Broadcom BCM5750x NICs may be multi-function devices. They do not advertise ACS capability. Peer-to-peer transactions are not possible between the individual functions, so it is safe to treat them as fully isolated. Add an ACS quirk for these devices so the functions can be in independent IOMMU groups and attached individually to userspace applications using VFIO. Link: https://lore.kernel.org/r/1654796507-28610-1-git-send-email-michael.c= han@broadcom.com Signed-off-by: Pavan Chebbi Signed-off-by: Michael Chan Signed-off-by: Bjorn Helgaas Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/pci/quirks.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index 98327966e5b4..0a116359b5c7 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -4760,6 +4760,9 @@ static const struct pci_dev_acs_enabled { { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs }, /* Broadcom multi-function device */ { PCI_VENDOR_ID_BROADCOM, 0x16D7, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs }, + { PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs }, { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs }, { 0 } }; --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68EEFC3814E for ; Tue, 23 Aug 2022 10:23:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354432AbiHWKV3 (ORCPT ); Tue, 23 Aug 2022 06:21:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54178 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352919AbiHWKJe (ORCPT ); Tue, 23 Aug 2022 06:09:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7D9477DF5D; Tue, 23 Aug 2022 01:55:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 19B126155E; Tue, 23 Aug 2022 08:55:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2455BC433C1; Tue, 23 Aug 2022 08:55:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244930; bh=yx3F4GWmfbblmgPgIsm34N4nZ3rzz+7Tif+D4H6tSck=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=V9HygLq8Zg1xlIekN1N741nqHfKBoNC1KYZMbW8m+MzYQdQIlrfQV5N0dKJDtTgSl 1oK/YU6rljiTXvCYpdi7pIKuVGN/A7bWwGCUmudKDI7h0GPEdexXo4us4FcZ4qdLYt 8wrFqsfKI2Am2ak2dj4xC105G5WIGKoS5VC/Nnqk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Zyngier , Sai Prakash Ranjan , Arnd Bergmann , Sasha Levin Subject: [PATCH 4.14 213/229] irqchip/tegra: Fix overflow implicit truncation warnings Date: Tue, 23 Aug 2022 10:26:14 +0200 Message-Id: <20220823080101.247244113@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Sai Prakash Ranjan [ Upstream commit 443685992bda9bb4f8b17fc02c9f6c60e62b1461 ] Fix -Woverflow warnings for tegra irqchip driver which is a result of moving arm64 custom MMIO accessor macros to asm-generic function implementations giving a bonus type-checking now and uncovering these overflow warnings. drivers/irqchip/irq-tegra.c: In function =E2=80=98tegra_ictlr_suspend=E2=80= =99: drivers/irqchip/irq-tegra.c:151:18: warning: large integer implicitly trunc= ated to unsigned type [-Woverflow] writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); ^ Suggested-by: Marc Zyngier Signed-off-by: Sai Prakash Ranjan Reviewed-by: Arnd Bergmann Cc: Marc Zyngier Signed-off-by: Arnd Bergmann Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/irqchip/irq-tegra.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/irqchip/irq-tegra.c b/drivers/irqchip/irq-tegra.c index 0abc0cd1c32e..1b3048ecb600 100644 --- a/drivers/irqchip/irq-tegra.c +++ b/drivers/irqchip/irq-tegra.c @@ -157,10 +157,10 @@ static int tegra_ictlr_suspend(void) lic->cop_iep[i] =3D readl_relaxed(ictlr + ICTLR_COP_IEP_CLASS); =20 /* Disable COP interrupts */ - writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); + writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); =20 /* Disable CPU interrupts */ - writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); + writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); =20 /* Enable the wakeup sources of ictlr */ writel_relaxed(lic->ictlr_wake_mask[i], ictlr + ICTLR_CPU_IER_SET); @@ -181,12 +181,12 @@ static void tegra_ictlr_resume(void) =20 writel_relaxed(lic->cpu_iep[i], ictlr + ICTLR_CPU_IEP_CLASS); - writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR); + writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR); writel_relaxed(lic->cpu_ier[i], ictlr + ICTLR_CPU_IER_SET); writel_relaxed(lic->cop_iep[i], ictlr + ICTLR_COP_IEP_CLASS); - writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR); + writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR); writel_relaxed(lic->cop_ier[i], ictlr + ICTLR_COP_IER_SET); } @@ -321,7 +321,7 @@ static int __init tegra_ictlr_init(struct device_node *= node, lic->base[i] =3D base; =20 /* Disable all interrupts */ - writel_relaxed(~0UL, base + ICTLR_CPU_IER_CLR); + writel_relaxed(GENMASK(31, 0), base + ICTLR_CPU_IER_CLR); /* All interrupts target IRQ */ writel_relaxed(0, base + ICTLR_CPU_IEP_CLASS); =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9A5FFC48BE4 for ; Tue, 23 Aug 2022 10:23:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354524AbiHWKVk (ORCPT ); Tue, 23 Aug 2022 06:21:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33088 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352921AbiHWKJe (ORCPT ); Tue, 23 Aug 2022 06:09:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2729C53D24; Tue, 23 Aug 2022 01:55:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DB542B81C35; Tue, 23 Aug 2022 08:55:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2580BC433D6; Tue, 23 Aug 2022 08:55:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244936; bh=X32xtPBWcVE6Z6gxu3/jbMLK/pP7I1mcOKV4OxfaTWk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=maxTmvhmmOBUaFgfuEr1C6DkOvDjS+a0HB4sVe5i9Xq+pvKk3Eb4h3Y/U1jWziOdL DhSVDBCR9/Ha6lIybBh2XEE978U5CEzAeuRWf00lnueSoTirKrfUnnuNQqwsqFG98b YjZEp2bNb7Ks+UWac4Q0TOed3YjUOz8SdPlxLpAk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Liang He , Sasha Levin Subject: [PATCH 4.14 214/229] usb: host: ohci-ppc-of: Fix refcount leak bug Date: Tue, 23 Aug 2022 10:26:15 +0200 Message-Id: <20220823080101.279637578@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 40a959d7042bb7711e404ad2318b30e9f92c6b9b ] In ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Acked-by: Alan Stern Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220617034637.4003115-1-windhl@126.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/host/ohci-ppc-of.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/ohci-ppc-of.c b/drivers/usb/host/ohci-ppc-of.c index 4f87a5c61b08..d22a70363fbf 100644 --- a/drivers/usb/host/ohci-ppc-of.c +++ b/drivers/usb/host/ohci-ppc-of.c @@ -168,6 +168,7 @@ static int ohci_hcd_ppc_of_probe(struct platform_device= *op) release_mem_region(res.start, 0x4); } else pr_debug("%s: cannot get ehci offset from fdt\n", __FILE__); + of_node_put(np); } =20 irq_dispose_mapping(irq); --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D780FC49EC2 for ; Tue, 23 Aug 2022 10:23:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354695AbiHWKWA (ORCPT ); Tue, 23 Aug 2022 06:22:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58334 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352924AbiHWKJe (ORCPT ); Tue, 23 Aug 2022 06:09:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BA06D7DF63; Tue, 23 Aug 2022 01:55:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7A1AEB81C3A; Tue, 23 Aug 2022 08:55:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D0CC1C433D6; Tue, 23 Aug 2022 08:55:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244942; bh=qpMce4X14YaBqpkXmmNkQSu120Ovx78wfAHgf+sshmU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tdPG6OP/wibTvvfIvcXy1VhUfWq1KwwMSlNq3sAxKfMK0lZDjMEdT5cerVGXA5rEE g1iVDA9nibStMb0aYgbfKDOomx6Ul/vps8St6ypfkQsmwAwzpcFtZKmsS1Hzy1i1q9 VSzZdse9/y/L0KDssC3Jp5vo6gtAlAOoIyiNCfgs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert Marko , Bjorn Andersson , Sasha Levin Subject: [PATCH 4.14 215/229] clk: qcom: ipq8074: dont disable gcc_sleep_clk_src Date: Tue, 23 Aug 2022 10:26:16 +0200 Message-Id: <20220823080101.314375700@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Robert Marko [ Upstream commit 1bf7305e79aab095196131bdc87a97796e0e3fac ] Once the usb sleep clocks are disabled, clock framework is trying to disable the sleep clock source also. However, it seems that it cannot be disabled and trying to do so produces: [ 245.436390] ------------[ cut here ]------------ [ 245.441233] gcc_sleep_clk_src status stuck at 'on' [ 245.441254] WARNING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140 [ 245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_qcom led= s_gpio [ 245.456601] CPU: 2 PID: 223 Comm: sh Not tainted 5.18.0-rc4 #215 [ 245.463889] Hardware name: Xiaomi AX9000 (DT) [ 245.470050] pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE= =3D--) [ 245.474307] pc : clk_branch_wait+0x130/0x140 [ 245.481073] lr : clk_branch_wait+0x130/0x140 [ 245.485588] sp : ffffffc009f2bad0 [ 245.489838] x29: ffffffc009f2bad0 x28: ffffff8003e6c800 x27: 00000000000= 00000 [ 245.493057] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff80022= 6ef20 [ 245.500175] x23: ffffffc0089ff550 x22: 0000000000000000 x21: ffffffc0084= 76ad0 [ 245.507294] x20: 0000000000000000 x19: ffffffc00965ac70 x18: fffffffffff= c51a7 [ 245.514413] x17: 68702e3030303837 x16: 3a6d726f6674616c x15: ffffffc089f= 2b777 [ 245.521531] x14: ffffffc0095c9d18 x13: 0000000000000129 x12: 00000000000= 00129 [ 245.528649] x11: 00000000ffffffea x10: ffffffc009621d18 x9 : 00000000000= 00001 [ 245.535767] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : 00000000000= 00001 [ 245.542885] x5 : ffffff803fdca6d8 x4 : 0000000000000000 x3 : 00000000000= 00027 [ 245.550002] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 00000000000= 00026 [ 245.557122] Call trace: [ 245.564229] clk_branch_wait+0x130/0x140 [ 245.566490] clk_branch2_disable+0x2c/0x40 [ 245.570656] clk_core_disable+0x60/0xb0 [ 245.574561] clk_core_disable+0x68/0xb0 [ 245.578293] clk_disable+0x30/0x50 [ 245.582113] dwc3_qcom_remove+0x60/0xc0 [dwc3_qcom] [ 245.585588] platform_remove+0x28/0x60 [ 245.590361] device_remove+0x4c/0x80 [ 245.594179] device_release_driver_internal+0x1dc/0x230 [ 245.597914] device_driver_detach+0x18/0x30 [ 245.602861] unbind_store+0xec/0x110 [ 245.607027] drv_attr_store+0x24/0x40 [ 245.610847] sysfs_kf_write+0x44/0x60 [ 245.614405] kernfs_fop_write_iter+0x128/0x1c0 [ 245.618052] new_sync_write+0xc0/0x130 [ 245.622391] vfs_write+0x1d4/0x2a0 [ 245.626123] ksys_write+0x58/0xe0 [ 245.629508] __arm64_sys_write+0x1c/0x30 [ 245.632895] invoke_syscall.constprop.0+0x5c/0x110 [ 245.636890] do_el0_svc+0xa0/0x150 [ 245.641488] el0_svc+0x18/0x60 [ 245.644872] el0t_64_sync_handler+0xa4/0x130 [ 245.647914] el0t_64_sync+0x174/0x178 [ 245.652340] ---[ end trace 0000000000000000 ]--- So, add CLK_IS_CRITICAL flag to the clock so that the kernel won't try to disable the sleep clock. Signed-off-by: Robert Marko Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220515210048.483898-10-robimarko@gmail.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/clk/qcom/gcc-ipq8074.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c index 0f735d37690f..97a951990103 100644 --- a/drivers/clk/qcom/gcc-ipq8074.c +++ b/drivers/clk/qcom/gcc-ipq8074.c @@ -139,6 +139,7 @@ static struct clk_branch gcc_sleep_clk_src =3D { }, .num_parents =3D 1, .ops =3D &clk_branch2_ops, + .flags =3D CLK_IS_CRITICAL, }, }, }; --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67A1EC48BE4 for ; Tue, 23 Aug 2022 10:23:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354597AbiHWKVr (ORCPT ); Tue, 23 Aug 2022 06:21:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33934 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352555AbiHWKJk (ORCPT ); Tue, 23 Aug 2022 06:09:40 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 013C37DF6C; Tue, 23 Aug 2022 01:55:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 924C16155E; Tue, 23 Aug 2022 08:55:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9729EC433D6; Tue, 23 Aug 2022 08:55:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244948; bh=2IANWfcDXn8gdk1Z4gv51ItWI+UvkHS6CpqklXgJFeg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HVHvHTDwPpUwJrQeq0MmZbPc9f+4Zz0GEzkb1MsrIAIl/QNh/wIYMeVUkrn6gZZPo GrWdhDRCNq15ibtqiI6XwCqrUHF8nZxexW0DO8sSUZHwDO1A6a9OOWlowbW5le61XR trEuAW2Sbl+1L1kZtMefQmc0fBUZLL9XMZNnupc0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jozef Martiniak , Sasha Levin Subject: [PATCH 4.14 216/229] gadgetfs: ep_io - wait until IRQ finishes Date: Tue, 23 Aug 2022 10:26:17 +0200 Message-Id: <20220823080101.366251007@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jozef Martiniak [ Upstream commit 04cb742d4d8f30dc2e83b46ac317eec09191c68e ] after usb_ep_queue() if wait_for_completion_interruptible() is interrupted we need to wait until IRQ gets finished. Otherwise complete() from epio_complete() can corrupt stack. Signed-off-by: Jozef Martiniak Link: https://lore.kernel.org/r/20220708070645.6130-1-jomajm@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/gadget/legacy/inode.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/= inode.c index 53d17e1bb65a..f0f41cc8b2f1 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -365,6 +365,7 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len) spin_unlock_irq (&epdata->dev->lock); =20 DBG (epdata->dev, "endpoint gone\n"); + wait_for_completion(&done); epdata->status =3D -ENODEV; } } --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E63DEC49EC1 for ; Tue, 23 Aug 2022 10:23:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354726AbiHWKWH (ORCPT ); Tue, 23 Aug 2022 06:22:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34236 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352946AbiHWKJn (ORCPT ); Tue, 23 Aug 2022 06:09:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0CC1D7DF6E; Tue, 23 Aug 2022 01:55:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9D1F661561; Tue, 23 Aug 2022 08:55:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9ACB8C433D6; Tue, 23 Aug 2022 08:55:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244954; bh=BvpZ9+z3PwhwVDxWUyHfXYsBLSq0+ghAeah0uQ9gcoE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QZz3L2AXR5uqp2lmp8A1BjhdVOo5Ea+9FxF1T5HLg2p2/AxRuabHRPMtgINeQTZvv a0i42epi0iGVMAXbawrtdzRwIVbndISkZlYHuogg2XrzGxpSUMwS4zmvyQVmVEset0 wNrgIf5d8icfXdApSBooDk4r9Rm4bD9dlxL9ml8Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrew Donnellan , Christophe JAILLET , Sasha Levin Subject: [PATCH 4.14 217/229] cxl: Fix a memory leak in an error handling path Date: Tue, 23 Aug 2022 10:26:18 +0200 Message-Id: <20220823080101.396665634@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET [ Upstream commit 3a15b45b5454da862376b5d69a4967f5c6fa1368 ] A bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the error handling path of afu_allocate_irqs(). Acked-by: Andrew Donnellan Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/ce5869418f5838187946eb6b11a52715a93ece3d.16= 57566849.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/misc/cxl/irq.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c index ce08a9f22308..0dbe78383f8f 100644 --- a/drivers/misc/cxl/irq.c +++ b/drivers/misc/cxl/irq.c @@ -353,6 +353,7 @@ int afu_allocate_irqs(struct cxl_context *ctx, u32 coun= t) =20 out: cxl_ops->release_irq_ranges(&ctx->irqs, ctx->afu->adapter); + bitmap_free(ctx->irq_bitmap); afu_irq_name_free(ctx); return -ENOMEM; } --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 585C6C49EC5 for ; Tue, 23 Aug 2022 10:23:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354840AbiHWKWT (ORCPT ); Tue, 23 Aug 2022 06:22:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57872 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1352717AbiHWKJz (ORCPT ); Tue, 23 Aug 2022 06:09:55 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 076927E022; Tue, 23 Aug 2022 01:56:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7D74AB81C28; Tue, 23 Aug 2022 08:56:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D0F94C433D6; Tue, 23 Aug 2022 08:56:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244963; bh=9+9TAGae0fTA/X972osI2oujsoHgyW6Ylmjy3Vai+/w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t2ToNMwaudLlzle8Ttqe+SCy0YjY1gvdsO4HghECzGttD4lRoB93c7KNcFsi4Wzru 4lGtfCdNdbVxGyHtvI3w0dccKg1plvKDuaYhteCt9qdo4jFE+Ii7SMw05YhDYODmFz XgazA3jAu2x6Y5lb89qt7z3Go3QEcoKLMYLXcw9s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wentao_Liang , Song Liu , Jens Axboe , Sasha Levin Subject: [PATCH 4.14 218/229] drivers:md:fix a potential use-after-free bug Date: Tue, 23 Aug 2022 10:26:19 +0200 Message-Id: <20220823080101.432971186@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wentao_Liang [ Upstream commit 104212471b1c1817b311771d817fb692af983173 ] In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and may cause sh to be released. However, sh is subsequently used in lines 2886 "if (sh->batch_head && sh !=3D sh->batch_head)". This may result in an use-after-free bug. It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of the function. Signed-off-by: Wentao_Liang Signed-off-by: Song Liu Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/md/raid5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index 1e52443f3aca..866ba1743f9f 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -2668,10 +2668,10 @@ static void raid5_end_write_request(struct bio *bi) if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags)) clear_bit(R5_LOCKED, &sh->dev[i].flags); set_bit(STRIPE_HANDLE, &sh->state); - raid5_release_stripe(sh); =20 if (sh->batch_head && sh !=3D sh->batch_head) raid5_release_stripe(sh->batch_head); + raid5_release_stripe(sh); } =20 static void raid5_error(struct mddev *mddev, struct md_rdev *rdev) --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C90CCC32772 for ; Tue, 23 Aug 2022 10:27:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354259AbiHWK1a (ORCPT ); Tue, 23 Aug 2022 06:27:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47190 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353912AbiHWKMR (ORCPT ); Tue, 23 Aug 2022 06:12:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 516312C675; Tue, 23 Aug 2022 01:58:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DE267B81C3B; Tue, 23 Aug 2022 08:58:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 39AD1C433C1; Tue, 23 Aug 2022 08:58:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661245114; bh=W5thjdNhmcdbfx2aKtOkCtX5IKQ/BpSrlifsGJ0KU9k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=u8APzQHeirtONSv95I8CZhDSWDjYMt0i+LyKHxePdQzC5jVAhWOUR+udZqxsyylwz U6DsjV/Rvag+jguZUw/fmT3FINfOU7oY42VrKTwOM76po6VNK2i63Sv/TVrq5NsJ0n NoZAa41j5X4SJ3pyV3xWbAy69y1aiqe/Cgi1SSjk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ye Bin , Jan Kara , Theodore Tso , Sasha Levin Subject: [PATCH 4.14 219/229] ext4: avoid remove directory when directory is corrupted Date: Tue, 23 Aug 2022 10:26:20 +0200 Message-Id: <20220823080101.469565686@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Bin [ Upstream commit b24e77ef1c6d4dbf42749ad4903c97539cc9755a ] Now if check directoy entry is corrupted, ext4_empty_dir may return true then directory will be removed when file system mounted with "errors=3Dcont= inue". In order not to make things worse just return false when directory is corru= pted. Signed-off-by: Ye Bin Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20220622090223.682234-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/ext4/namei.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index 4b78fa4dbcc1..e1cade9dbd30 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -2820,11 +2820,8 @@ bool ext4_empty_dir(struct inode *inode) de =3D (struct ext4_dir_entry_2 *) (bh->b_data + (offset & (sb->s_blocksize - 1))); if (ext4_check_dir_entry(inode, NULL, de, bh, - bh->b_data, bh->b_size, offset)) { - offset =3D (offset | (sb->s_blocksize - 1)) + 1; - continue; - } - if (le32_to_cpu(de->inode)) { + bh->b_data, bh->b_size, offset) || + le32_to_cpu(de->inode)) { brelse(bh); return false; } --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE9C8C3F6B0 for ; Tue, 23 Aug 2022 10:23:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355086AbiHWKWu (ORCPT ); Tue, 23 Aug 2022 06:22:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35704 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353286AbiHWKLM (ORCPT ); Tue, 23 Aug 2022 06:11:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DADF87E83D; Tue, 23 Aug 2022 01:56:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8B835B81C3E; Tue, 23 Aug 2022 08:56:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C256BC433C1; Tue, 23 Aug 2022 08:56:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244981; bh=EKvWYv2oRvwWVhIgF6Am3ZkEka/EGkblTHkR/o9hnYc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kLCJqtpsf9rymknU6mpEGEka4n/vvo5m5hRLXdoJweM7ojHO8hBvKXXdaZX8Z1Bst RfrUvtnBhlnqiRKvATzGLSYGzEO4Q2ugw9PTatnZeAmH0YXsM8cd3YTQwsBlDgcMd+ 3Ce2nrEXHeZQGyPJ93luzNLAQAn5fEv33wrd/HSA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oleg Kiselev , Theodore Tso , Sasha Levin Subject: [PATCH 4.14 220/229] ext4: avoid resizing to a partial cluster size Date: Tue, 23 Aug 2022 10:26:21 +0200 Message-Id: <20220823080101.500040103@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kiselev, Oleg [ Upstream commit 69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd ] This patch avoids an attempt to resize the filesystem to an unaligned cluster boundary. An online resize to a size that is not integral to cluster size results in the last iteration attempting to grow the fs by a negative amount, which trips a BUG_ON and leaves the fs with a corrupted in-memory superblock. Signed-off-by: Oleg Kiselev Link: https://lore.kernel.org/r/0E92A0AB-4F16-4F1A-94B7-702CC6504FDE@amazon= .com Signed-off-by: Theodore Ts'o Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/ext4/resize.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index a50eabffa411..30b2798244fa 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -1951,6 +1951,16 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsbl= k_t n_blocks_count) } brelse(bh); =20 + /* + * For bigalloc, trim the requested size to the nearest cluster + * boundary to avoid creating an unusable filesystem. We do this + * silently, instead of returning an error, to avoid breaking + * callers that blindly resize the filesystem to the full size of + * the underlying block device. + */ + if (ext4_has_feature_bigalloc(sb)) + n_blocks_count &=3D ~((1 << EXT4_CLUSTER_BITS(sb)) - 1); + retry: o_blocks_count =3D ext4_blocks_count(es); =20 --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85134C32772 for ; Tue, 23 Aug 2022 10:23:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241254AbiHWKXp (ORCPT ); Tue, 23 Aug 2022 06:23:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35350 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353479AbiHWKLd (ORCPT ); Tue, 23 Aug 2022 06:11:33 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1AEFB7F111; Tue, 23 Aug 2022 01:56:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D2756B81C28; Tue, 23 Aug 2022 08:56:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3B762C433C1; Tue, 23 Aug 2022 08:56:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661245014; bh=TcBl72HrHmjDRathhtjfFih6aIlKLd2vED0J2ncQORk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WXSoR1m5wYZQB2Rf4Scl0MI3NhH21bH+oDjqn4R/gwjPtgKMXzFMwkPwVNGHZOf6Z 4qt7EHItRVL0nDE25MLCAmPJoUA6YTyIg/LDSfkFdQQErL8ymXEthi/4l8S7Hb+mPi h8UDcOrL9KEim3EeIyyX4wMgMesVaJ9M7ACTb09Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Timur Tabi , Liang He , Sasha Levin Subject: [PATCH 4.14 221/229] tty: serial: Fix refcount leak bug in ucc_uart.c Date: Tue, 23 Aug 2022 10:26:22 +0200 Message-Id: <20220823080101.530122222@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit d24d7bb2cd947676f9b71fb944d045e09b8b282f ] In soc_info(), of_find_node_by_type() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Acked-by: Timur Tabi Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220618060850.4058525-1-windhl@126.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/serial/ucc_uart.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c index 55b702775786..40b8e414f48f 100644 --- a/drivers/tty/serial/ucc_uart.c +++ b/drivers/tty/serial/ucc_uart.c @@ -1143,6 +1143,8 @@ static unsigned int soc_info(unsigned int *rev_h, uns= igned int *rev_l) /* No compatible property, so try the name. */ soc_string =3D np->name; =20 + of_node_put(np); + /* Extract the SOC number from the "PowerPC," string */ if ((sscanf(soc_string, "PowerPC,%u", &soc) !=3D 1) || !soc) return 0; --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A0442C38159 for ; Tue, 23 Aug 2022 10:26:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354685AbiHWK0G (ORCPT ); Tue, 23 Aug 2022 06:26:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46880 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353655AbiHWKLs (ORCPT ); Tue, 23 Aug 2022 06:11:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3EB42AC4; Tue, 23 Aug 2022 01:58:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5F296B81C3B; Tue, 23 Aug 2022 08:58:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8E3B2C433C1; Tue, 23 Aug 2022 08:58:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661245084; bh=/rrdra+UNE0LoJsFdhBak/JV5VbATvgQuE34YKLAAEA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YTkenXUP2X3s4SUwxsggpIYLFeFrrzFLEa8Kb+KJY6J5qZGWpkyfRZynKt2JA6NMK zGsJpjZqUylQ4z5WDPgCEzXAuV/1o/DBPMbqKV4zxVdEylye22q8Pp/S8LnSAbN5LP NYt8b98gQJ38g3P/DvnC5CVyrwyXNb0jRweN3B7Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Schspa Shi , Cornelia Huck , Alex Williamson , Sasha Levin Subject: [PATCH 4.14 222/229] vfio: Clear the caps->buf to NULL after free Date: Tue, 23 Aug 2022 10:26:23 +0200 Message-Id: <20220823080101.560890277@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Schspa Shi [ Upstream commit 6641085e8d7b3f061911517f79a2a15a0a21b97b ] On buffer resize failure, vfio_info_cap_add() will free the buffer, report zero for the size, and return -ENOMEM. As additional hardening, also clear the buffer pointer to prevent any chance of a double free. Signed-off-by: Schspa Shi Reviewed-by: Cornelia Huck Link: https://lore.kernel.org/r/20220629022948.55608-1-schspa@gmail.com Signed-off-by: Alex Williamson Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/vfio/vfio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c index 0d73d913c18b..747eb5c70238 100644 --- a/drivers/vfio/vfio.c +++ b/drivers/vfio/vfio.c @@ -1813,6 +1813,7 @@ struct vfio_info_cap_header *vfio_info_cap_add(struct= vfio_info_cap *caps, buf =3D krealloc(caps->buf, caps->size + size, GFP_KERNEL); if (!buf) { kfree(caps->buf); + caps->buf =3D NULL; caps->size =3D 0; return ERR_PTR(-ENOMEM); } --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74E5FC49EC3 for ; Tue, 23 Aug 2022 10:26:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354923AbiHWK0u (ORCPT ); Tue, 23 Aug 2022 06:26:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60868 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353790AbiHWKMH (ORCPT ); Tue, 23 Aug 2022 06:12:07 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8391CAE43; Tue, 23 Aug 2022 01:58:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0FDFAB81C39; Tue, 23 Aug 2022 08:58:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4DECEC433D6; Tue, 23 Aug 2022 08:58:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661245102; bh=EDm+cXKravyMKJOtAFbZaSk7wAygPsVXHZEc10Upyg8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z5fJS9XQWaWnNrTgVUaGlP/Hm6J9TV69ActYBvJtS4BWd2dQfe+UAyjcYThX04rWL X6nLqh4fOpFjiY8n5P/XqHbyp9ItnzlRHW+YL5+4F7PGs/Jd7VIAjHybwYOKjmzS37 nlGahhpaPwDFN2nxTFuxlXKVVNUIB08yQ8GvDfhw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.14 223/229] mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start Date: Tue, 23 Aug 2022 10:26:24 +0200 Message-Id: <20220823080101.605361180@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 7a9f743ceead60ed454c46fbc3085ee9a79cbebb ] We should call of_node_put() for the reference 'uctl_node' returned by of_get_parent() which will increase the refcount. Otherwise, there will be a refcount leak bug. Signed-off-by: Liang He Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/mips/cavium-octeon/octeon-platform.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-o= cteon/octeon-platform.c index ed42fc27033c..f2a1c316608a 100644 --- a/arch/mips/cavium-octeon/octeon-platform.c +++ b/arch/mips/cavium-octeon/octeon-platform.c @@ -86,11 +86,12 @@ static void octeon2_usb_clocks_start(struct device *dev) "refclk-frequency", &clock_rate); if (i) { dev_err(dev, "No UCTL \"refclk-frequency\"\n"); + of_node_put(uctl_node); goto exit; } i =3D of_property_read_string(uctl_node, "refclk-type", &clock_type); - + of_node_put(uctl_node); if (!i && strcmp("crystal", clock_type) =3D=3D 0) is_crystal_clock =3D true; } --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05599C32772 for ; Tue, 23 Aug 2022 10:27:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353379AbiHWK1I (ORCPT ); Tue, 23 Aug 2022 06:27:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47050 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353860AbiHWKMO (ORCPT ); Tue, 23 Aug 2022 06:12:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9027A1E3C0; Tue, 23 Aug 2022 01:58:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F21C2B81C39; Tue, 23 Aug 2022 08:58:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B9D2C433C1; Tue, 23 Aug 2022 08:58:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661245108; bh=52X8ueirCEs1RRLjzB6/6HU1F5t+GkJ8GyQeQKlbkq8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QMrGSHcYq+ZNKd3Z5azKuYfWErFpLrhiJCnm6jMSQjviuuyTZV79S3QuLZ0svgAON +y8WjtuH6eKjnv8HvDK/OUddzODcOUzjXgNiQszuUdTd8ZTQWJ85ZRj9xx3piMEnas 4N6VJrgxMkE0NovsVHsDnHiSKF/rFXIXkzjfNaTc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 4.14 224/229] ALSA: core: Add async signal helpers Date: Tue, 23 Aug 2022 10:26:25 +0200 Message-Id: <20220823080101.640634307@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit ef34a0ae7a2654bc9e58675e36898217fb2799d8 ] Currently the call of kill_fasync() from an interrupt handler might lead to potential spin deadlocks, as spotted by syzkaller. Unfortunately, it's not so trivial to fix this lock chain as it's involved with the tasklist_lock that is touched in allover places. As a temporary workaround, this patch provides the way to defer the async signal notification in a work. The new helper functions, snd_fasync_helper() and snd_kill_faync() are replacements for fasync_helper() and kill_fasync(), respectively. In addition, snd_fasync_free() needs to be called at the destructor of the relevant file object. Link: https://lore.kernel.org/r/20220728125945.29533-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/sound/core.h | 8 ++++ sound/core/misc.c | 94 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 102 insertions(+) diff --git a/include/sound/core.h b/include/sound/core.h index 4104a9d1001f..9d04e700b855 100644 --- a/include/sound/core.h +++ b/include/sound/core.h @@ -442,4 +442,12 @@ snd_pci_quirk_lookup_id(u16 vendor, u16 device, } #endif =20 +/* async signal helpers */ +struct snd_fasync; + +int snd_fasync_helper(int fd, struct file *file, int on, + struct snd_fasync **fasyncp); +void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll); +void snd_fasync_free(struct snd_fasync *fasync); + #endif /* __SOUND_CORE_H */ diff --git a/sound/core/misc.c b/sound/core/misc.c index 0f818d593c9e..d100feba26b5 100644 --- a/sound/core/misc.c +++ b/sound/core/misc.c @@ -25,6 +25,7 @@ #include #include #include +#include #include =20 #ifdef CONFIG_SND_DEBUG @@ -160,3 +161,96 @@ snd_pci_quirk_lookup(struct pci_dev *pci, const struct= snd_pci_quirk *list) } EXPORT_SYMBOL(snd_pci_quirk_lookup); #endif + +/* + * Deferred async signal helpers + * + * Below are a few helper functions to wrap the async signal handling + * in the deferred work. The main purpose is to avoid the messy deadlock + * around tasklist_lock and co at the kill_fasync() invocation. + * fasync_helper() and kill_fasync() are replaced with snd_fasync_helper() + * and snd_kill_fasync(), respectively. In addition, snd_fasync_free() has + * to be called at releasing the relevant file object. + */ +struct snd_fasync { + struct fasync_struct *fasync; + int signal; + int poll; + int on; + struct list_head list; +}; + +static DEFINE_SPINLOCK(snd_fasync_lock); +static LIST_HEAD(snd_fasync_list); + +static void snd_fasync_work_fn(struct work_struct *work) +{ + struct snd_fasync *fasync; + + spin_lock_irq(&snd_fasync_lock); + while (!list_empty(&snd_fasync_list)) { + fasync =3D list_first_entry(&snd_fasync_list, struct snd_fasync, list); + list_del_init(&fasync->list); + spin_unlock_irq(&snd_fasync_lock); + if (fasync->on) + kill_fasync(&fasync->fasync, fasync->signal, fasync->poll); + spin_lock_irq(&snd_fasync_lock); + } + spin_unlock_irq(&snd_fasync_lock); +} + +static DECLARE_WORK(snd_fasync_work, snd_fasync_work_fn); + +int snd_fasync_helper(int fd, struct file *file, int on, + struct snd_fasync **fasyncp) +{ + struct snd_fasync *fasync =3D NULL; + + if (on) { + fasync =3D kzalloc(sizeof(*fasync), GFP_KERNEL); + if (!fasync) + return -ENOMEM; + INIT_LIST_HEAD(&fasync->list); + } + + spin_lock_irq(&snd_fasync_lock); + if (*fasyncp) { + kfree(fasync); + fasync =3D *fasyncp; + } else { + if (!fasync) { + spin_unlock_irq(&snd_fasync_lock); + return 0; + } + *fasyncp =3D fasync; + } + fasync->on =3D on; + spin_unlock_irq(&snd_fasync_lock); + return fasync_helper(fd, file, on, &fasync->fasync); +} +EXPORT_SYMBOL_GPL(snd_fasync_helper); + +void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll) +{ + unsigned long flags; + + if (!fasync || !fasync->on) + return; + spin_lock_irqsave(&snd_fasync_lock, flags); + fasync->signal =3D signal; + fasync->poll =3D poll; + list_move(&fasync->list, &snd_fasync_list); + schedule_work(&snd_fasync_work); + spin_unlock_irqrestore(&snd_fasync_lock, flags); +} +EXPORT_SYMBOL_GPL(snd_kill_fasync); + +void snd_fasync_free(struct snd_fasync *fasync) +{ + if (!fasync) + return; + fasync->on =3D 0; + flush_work(&snd_fasync_work); + kfree(fasync); +} +EXPORT_SYMBOL_GPL(snd_fasync_free); --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC612C32796 for ; Tue, 23 Aug 2022 10:23:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355057AbiHWKWr (ORCPT ); Tue, 23 Aug 2022 06:22:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353290AbiHWKLM (ORCPT ); Tue, 23 Aug 2022 06:11:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 61C3C7EFC7; Tue, 23 Aug 2022 01:56:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 020376150F; Tue, 23 Aug 2022 08:56:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E86F7C433D7; Tue, 23 Aug 2022 08:56:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244984; bh=4yS/bWF1VfDmwPHBya2eTtx13bO3K83w8kHuwOh/Kz4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EpDfJHGI87b7oNLR7eN1Y3y749/p0DgsUdFF8SUzaUNiRkP9aR5K+8t1oNaRPiHLP pw6tWpjFgGfQRBs7/9ReIRbDJ84gsgOHlaFzN577Pdc0pNYfLq2pUxEpvXHCx+dYY3 STbvVZjI/W3RV1ZbqPFEqXfC/9kMqjxF0ikoI8AQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+1ee0910eca9c94f71f25@syzkaller.appspotmail.com, syzbot+49b10793b867871ee26f@syzkaller.appspotmail.com, syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com, Takashi Iwai , Sasha Levin Subject: [PATCH 4.14 225/229] ALSA: timer: Use deferred fasync helper Date: Tue, 23 Aug 2022 10:26:26 +0200 Message-Id: <20220823080101.675000241@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 95cc637c1afd83fb7dd3d7c8a53710488f4caf9c ] For avoiding the potential deadlock via kill_fasync() call, use the new fasync helpers to defer the invocation from PCI API. Note that it's merely a workaround. Reported-by: syzbot+1ee0910eca9c94f71f25@syzkaller.appspotmail.com Reported-by: syzbot+49b10793b867871ee26f@syzkaller.appspotmail.com Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220728125945.29533-3-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/core/timer.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/sound/core/timer.c b/sound/core/timer.c index c333ceb80d5f..720d63574bfb 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -75,7 +75,7 @@ struct snd_timer_user { unsigned int filter; struct timespec tstamp; /* trigger tstamp */ wait_queue_head_t qchange_sleep; - struct fasync_struct *fasync; + struct snd_fasync *fasync; struct mutex ioctl_lock; }; =20 @@ -1295,7 +1295,7 @@ static void snd_timer_user_interrupt(struct snd_timer= _instance *timeri, } __wake: spin_unlock(&tu->qlock); - kill_fasync(&tu->fasync, SIGIO, POLL_IN); + snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); wake_up(&tu->qchange_sleep); } =20 @@ -1332,7 +1332,7 @@ static void snd_timer_user_ccallback(struct snd_timer= _instance *timeri, spin_lock_irqsave(&tu->qlock, flags); snd_timer_user_append_to_tqueue(tu, &r1); spin_unlock_irqrestore(&tu->qlock, flags); - kill_fasync(&tu->fasync, SIGIO, POLL_IN); + snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); wake_up(&tu->qchange_sleep); } =20 @@ -1399,7 +1399,7 @@ static void snd_timer_user_tinterrupt(struct snd_time= r_instance *timeri, spin_unlock(&tu->qlock); if (append =3D=3D 0) return; - kill_fasync(&tu->fasync, SIGIO, POLL_IN); + snd_kill_fasync(tu->fasync, SIGIO, POLL_IN); wake_up(&tu->qchange_sleep); } =20 @@ -1465,6 +1465,7 @@ static int snd_timer_user_release(struct inode *inode= , struct file *file) if (tu->timeri) snd_timer_close(tu->timeri); mutex_unlock(&tu->ioctl_lock); + snd_fasync_free(tu->fasync); kfree(tu->queue); kfree(tu->tqueue); kfree(tu); @@ -2017,7 +2018,7 @@ static int snd_timer_user_fasync(int fd, struct file = * file, int on) struct snd_timer_user *tu; =20 tu =3D file->private_data; - return fasync_helper(fd, file, on, &tu->fasync); + return snd_fasync_helper(fd, file, on, &tu->fasync); } =20 static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3A17C38145 for ; Tue, 23 Aug 2022 10:23:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355156AbiHWKXD (ORCPT ); Tue, 23 Aug 2022 06:23:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36374 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353316AbiHWKLO (ORCPT ); Tue, 23 Aug 2022 06:11:14 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 793A610A; Tue, 23 Aug 2022 01:56:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 16602614E7; Tue, 23 Aug 2022 08:56:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1D408C433D6; Tue, 23 Aug 2022 08:56:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244990; bh=aYnBnfGUaEEa3RlKev2F+dQui8GePYWC7nN4kwgsqF0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DrbMX9IYej7wZHvaSrZVjF1Vq/Y4N2jxdLrELV1YVD2xQ6OAdiReHpXNSpYf7cxa0 iPlvEEOAdd9x/Ztyxyg3NYdMi/2VKNUPLoK1rVgdus+1jYey/McE4q2OTVBLLXmzZr K3J40xmBc9v3hcTCz3TJ1DnQcOU/edpOloE1XpMo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ronnie Sahlberg , Steve French , Sasha Levin Subject: [PATCH 4.14 226/229] smb3: check xattr value length earlier Date: Tue, 23 Aug 2022 10:26:27 +0200 Message-Id: <20220823080101.714839062@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Steve French [ Upstream commit 5fa2cffba0b82336a2244d941322eb1627ff787b ] Coverity complains about assigning a pointer based on value length before checking that value length goes beyond the end of the SMB. Although this is even more unlikely as value length is a single byte, and the pointer is not dereferenced until laterm, it is clearer to check the lengths first. Addresses-Coverity: 1467704 ("Speculative execution data leak") Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- fs/cifs/smb2ops.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 3280a801b1d7..069eb2533e7f 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -463,9 +463,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, size_t name_len, value_len, user_name_len; =20 while (src_size > 0) { - name =3D &src->ea_data[0]; name_len =3D (size_t)src->ea_name_length; - value =3D &src->ea_data[src->ea_name_length + 1]; value_len =3D (size_t)le16_to_cpu(src->ea_value_length); =20 if (name_len =3D=3D 0) { @@ -478,6 +476,9 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, goto out; } =20 + name =3D &src->ea_data[0]; + value =3D &src->ea_data[src->ea_name_length + 1]; + if (ea_name) { if (ea_name_len =3D=3D name_len && memcmp(ea_name, name, name_len) =3D=3D 0) { --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3DA8CC52D79 for ; Tue, 23 Aug 2022 10:23:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355226AbiHWKXQ (ORCPT ); Tue, 23 Aug 2022 06:23:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60644 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353379AbiHWKLV (ORCPT ); Tue, 23 Aug 2022 06:11:21 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 27F297F086; Tue, 23 Aug 2022 01:56:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C3475B81C35; Tue, 23 Aug 2022 08:56:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A68FC433C1; Tue, 23 Aug 2022 08:56:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661244996; bh=SMPKi7JYN8lXUwX1rq7vek4IGXoJO6A+YLX7BvVgKCE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1yFNHqw9V63m3CwyBOX+oBxcn/UqOytTIqNEhIYiKqpkbgNI1odLYUaMAoUP81p5N raXaUj2fsRiMNrZGbEXBhCE6Mcw7zmtG3d04EoYF4vAYzOoJVmH0x2HH+QK+w3GAT9 NLDtGhRDVkTgZQ26t9C1uazq+PIRrFqqsU28lgjw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Ellerman , Zhouyi Zhou , Sasha Levin Subject: [PATCH 4.14 227/229] powerpc/64: Init jump labels before parse_early_param() Date: Tue, 23 Aug 2022 10:26:28 +0200 Message-Id: <20220823080101.744991620@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhouyi Zhou [ Upstream commit ca829e05d3d4f728810cc5e4b468d9ebc7745eb3 ] On 64-bit, calling jump_label_init() in setup_feature_keys() is too late because static keys may be used in subroutines of parse_early_param() which is again subroutine of early_init_devtree(). For example booting with "threadirqs": static_key_enable_cpuslocked(): static key '0xc000000002953260' used befo= re call to jump_label_init() WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpusl= ocked+0xfc/0x120 ... NIP static_key_enable_cpuslocked+0xfc/0x120 LR static_key_enable_cpuslocked+0xf8/0x120 Call Trace: static_key_enable_cpuslocked+0xf8/0x120 (unreliable) static_key_enable+0x30/0x50 setup_forced_irqthreads+0x28/0x40 do_early_param+0xa0/0x108 parse_args+0x290/0x4e0 parse_early_options+0x48/0x5c parse_early_param+0x58/0x84 early_init_devtree+0xd4/0x518 early_setup+0xb4/0x214 So call jump_label_init() just before parse_early_param() in early_init_devtree(). Suggested-by: Michael Ellerman Signed-off-by: Zhouyi Zhou [mpe: Add call trace to change log and minor wording edits.] Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20220726015747.11754-1-zhouzhouyi@gmail.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/powerpc/kernel/prom.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c index 99409d0420d2..ffc571edac28 100644 --- a/arch/powerpc/kernel/prom.c +++ b/arch/powerpc/kernel/prom.c @@ -710,6 +710,13 @@ void __init early_init_devtree(void *params) of_scan_flat_dt(early_init_dt_scan_root, NULL); of_scan_flat_dt(early_init_dt_scan_memory_ppc, NULL); =20 + /* + * As generic code authors expect to be able to use static keys + * in early_param() handlers, we initialize the static keys just + * before parsing early params (it's fine to call jump_label_init() + * more than once). + */ + jump_label_init(); parse_early_param(); =20 /* make sure we've parsed cmdline for mem=3D before this */ --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0225FC49EC3 for ; Tue, 23 Aug 2022 10:23:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1352818AbiHWKXj (ORCPT ); Tue, 23 Aug 2022 06:23:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60872 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353420AbiHWKL2 (ORCPT ); Tue, 23 Aug 2022 06:11:28 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E92A46B8C4; Tue, 23 Aug 2022 01:56:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 66E0D614E7; Tue, 23 Aug 2022 08:56:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 73641C433D6; Tue, 23 Aug 2022 08:56:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661245002; bh=QJRKZeqWyHOAMgpIQr673Jjz8RQb1Y0LVJw0ylK1rRM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uZjzfcVj17Q2NjcWjUd6657A6LQhoLhdtZiOVMBRVbyuHxxp0D18XeMmzEASClMXM XXQFWDEK0iT9VZAdn3Tg5XzoeiR6NSC8SvPVFkCntd1ZjnHQktAulmS8zj7T4zi0Or XTd149syJ47LdE7B7rEFOfre7UsoCbN4FRut+3PQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Helge Deller , Sasha Levin Subject: [PATCH 4.14 228/229] video: fbdev: i740fb: Check the argument of i740_calc_vclk() Date: Tue, 23 Aug 2022 10:26:29 +0200 Message-Id: <20220823080101.775619886@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit 40bf722f8064f50200b8c4f8946cd625b441dda9 ] Since the user can control the arguments of the ioctl() from the user space, under special arguments that may result in a divide-by-zero bug. If the user provides an improper 'pixclock' value that makes the argumet of i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a divide-by-zero bug in: drivers/video/fbdev/i740fb.c:353 p_best =3D min(15, ilog2(I740_MAX_VCO_= FREQ / (freq / I740_RFREQ_FIX))); The following log can reveal it: divide error: 0000 [#1] PREEMPT SMP KASAN PTI RIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline] RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline] RIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742 Call Trace: fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 Fix this by checking the argument of i740_calc_vclk() first. Signed-off-by: Zheyu Ma Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/video/fbdev/i740fb.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c index 7bc5f6056c77..4147a9534179 100644 --- a/drivers/video/fbdev/i740fb.c +++ b/drivers/video/fbdev/i740fb.c @@ -399,7 +399,7 @@ static int i740fb_decode_var(const struct fb_var_screen= info *var, u32 xres, right, hslen, left, xtotal; u32 yres, lower, vslen, upper, ytotal; u32 vxres, xoffset, vyres, yoffset; - u32 bpp, base, dacspeed24, mem; + u32 bpp, base, dacspeed24, mem, freq; u8 r7; int i; =20 @@ -641,7 +641,12 @@ static int i740fb_decode_var(const struct fb_var_scree= ninfo *var, par->atc[VGA_ATC_OVERSCAN] =3D 0; =20 /* Calculate VCLK that most closely matches the requested dot clock */ - i740_calc_vclk((((u32)1e9) / var->pixclock) * (u32)(1e3), par); + freq =3D (((u32)1e9) / var->pixclock) * (u32)(1e3); + if (freq < I740_RFREQ_FIX) { + fb_dbg(info, "invalid pixclock\n"); + freq =3D I740_RFREQ_FIX; + } + i740_calc_vclk(freq, par); =20 /* Since we program the clocks ourselves, always use VCLK2. */ par->misc |=3D 0x0C; --=20 2.35.1 From nobody Fri Dec 19 20:52:41 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97AB5C38159 for ; Tue, 23 Aug 2022 10:23:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355332AbiHWKXe (ORCPT ); Tue, 23 Aug 2022 06:23:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46862 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1353458AbiHWKLa (ORCPT ); Tue, 23 Aug 2022 06:11:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AC429B1CB; Tue, 23 Aug 2022 01:56:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4273C61377; Tue, 23 Aug 2022 08:56:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5181CC433D6; Tue, 23 Aug 2022 08:56:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1661245008; bh=NQE+D1YIAmhEbIgHZMr35QDB/H8Pj1G4SuYfoV8s4vQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gAG7lYrZE7p1flRzjjlnwzSvv9gL+JB6XUJzlcOqIz43eCT/KxXS28YSvSZng3u0I b2IQGB2zh61b/FAnYm18F0PcQS+JJZv13ibMTdf8Bbbdq2uK4o3PNOFi6gfQqsP+Hs 1oWz9mtdHBeSW7tJV4WO0cc6+ulyo++sNjNgqNHQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Sudip Mukherjee (Codethink)" , Nathan Chancellor , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.14 229/229] MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 Date: Tue, 23 Aug 2022 10:26:30 +0200 Message-Id: <20220823080101.806263541@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220823080053.202747790@linuxfoundation.org> References: <20220823080053.202747790@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nathan Chancellor [ Upstream commit 74de14fe05dd6b151d73cb0c73c8ec874cbdcde6 ] When CONFIG_XPA is enabled, Clang warns: arch/mips/mm/tlbex.c:629:24: error: converting the result of '<<' to a bo= olean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) !=3D 0'? [-Werror,-Wint-in-= bool-context] if (cpu_has_rixi && !!_PAGE_NO_EXEC) { ^ arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_= PAGE_NO_EXEC' # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT) ^ arch/mips/mm/tlbex.c:2568:24: error: converting the result of '<<' to a b= oolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) !=3D 0'? [-Werror,-Wint-in= -bool-context] if (!cpu_has_rixi || !_PAGE_NO_EXEC) { ^ arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_= PAGE_NO_EXEC' # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT) ^ 2 errors generated. _PAGE_NO_EXEC can be '0' or '1 << _PAGE_NO_EXEC_SHIFT' depending on the build and runtime configuration, which is what the negation operators are trying to convey. To silence the warning, explicitly compare against 0 so the result of the '<<' operator is not implicitly converted to a boolean. According to its documentation, GCC enables -Wint-in-bool-context with -Wall but this warning is not visible when building the same configuration with GCC. It appears GCC only warns when compiling C++, not C, although the documentation makes no note of this: https://godbolt.org/z/x39q3brxf Reported-by: Sudip Mukherjee (Codethink) Signed-off-by: Nathan Chancellor Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/mips/mm/tlbex.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c index b55c74a7f7a4..82cd14e7b20d 100644 --- a/arch/mips/mm/tlbex.c +++ b/arch/mips/mm/tlbex.c @@ -634,7 +634,7 @@ static __maybe_unused void build_convert_pte_to_entrylo= (u32 **p, return; } =20 - if (cpu_has_rixi && !!_PAGE_NO_EXEC) { + if (cpu_has_rixi && _PAGE_NO_EXEC !=3D 0) { if (fill_includes_sw_bits) { UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL)); } else { @@ -2577,7 +2577,7 @@ static void check_pabits(void) unsigned long entry; unsigned pabits, fillbits; =20 - if (!cpu_has_rixi || !_PAGE_NO_EXEC) { + if (!cpu_has_rixi || _PAGE_NO_EXEC =3D=3D 0) { /* * We'll only be making use of the fact that we can rotate bits * into the fill if the CPU supports RIXI, so don't bother --=20 2.35.1