From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BAE4C54EE9 for ; Tue, 13 Sep 2022 15:46:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236409AbiIMPqo (ORCPT ); Tue, 13 Sep 2022 11:46:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47614 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235187AbiIMPqQ (ORCPT ); Tue, 13 Sep 2022 11:46:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 67A1761117; Tue, 13 Sep 2022 07:49:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A1C06614DD; Tue, 13 Sep 2022 14:36:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A7E53C433D7; Tue, 13 Sep 2022 14:36:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079776; bh=ewjM1BrwHLoUjdjEdTDRh7w4U0gFebvbGA8DOUk9mgU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MsFnSNFny9IaDrQ1EEaAJs8WOMGJIRC/6ZchNy7RjJAS8uhTflMj77mq2SCmrjrGf r2pwegVQpo07RubwgPfISXkxYWDmcv3sVsjWx7DR+PPj8JoJpXfpmqEt8XB7XyeTuk ECKKmhEImzYDMWudyJFFWA8QPHdk0aGbvWIbI8B8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Letu Ren , Helge Deller , Sasha Levin Subject: [PATCH 4.9 01/42] fbdev: fb_pm2fb: Avoid potential divide by zero error Date: Tue, 13 Sep 2022 16:07:32 +0200 Message-Id: <20220913140342.308723271@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Letu Ren commit 19f953e7435644b81332dd632ba1b2d80b1e37af upstream. In `do_fb_ioctl()` of fbmem.c, if cmd is FBIOPUT_VSCREENINFO, var will be copied from user, then go through `fb_set_var()` and `info->fbops->fb_check_var()` which could may be `pm2fb_check_var()`. Along the path, `var->pixclock` won't be modified. This function checks whether reciprocal of `var->pixclock` is too high. If `var->pixclock` is zero, there will be a divide by zero error. So, it is necessary to check whether denominator is zero to avoid crash. As this bug is found by Syzkaller, logs are listed below. divide error in pm2fb_check_var Call Trace: fb_set_var+0x367/0xeb0 drivers/video/fbdev/core/fbmem.c:1015 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189 Reported-by: Zheyu Ma Signed-off-by: Letu Ren Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/video/fbdev/pm2fb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/video/fbdev/pm2fb.c b/drivers/video/fbdev/pm2fb.c index 9b32b9fc44a5c..50b569d047b10 100644 --- a/drivers/video/fbdev/pm2fb.c +++ b/drivers/video/fbdev/pm2fb.c @@ -619,6 +619,11 @@ static int pm2fb_check_var(struct fb_var_screeninfo *v= ar, struct fb_info *info) return -EINVAL; } =20 + if (!var->pixclock) { + DPRINTK("pixclock is zero\n"); + return -EINVAL; + } + if (PICOS2KHZ(var->pixclock) > PM2_MAX_PIXCLOCK) { DPRINTK("pixclock too high (%ldKHz)\n", PICOS2KHZ(var->pixclock)); --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C01AC54EE9 for ; Tue, 13 Sep 2022 15:32:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236457AbiIMPce (ORCPT ); Tue, 13 Sep 2022 11:32:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45664 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232336AbiIMPbz (ORCPT ); Tue, 13 Sep 2022 11:31:55 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6E43C7E33B; Tue, 13 Sep 2022 07:40:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E852EB80FA7; Tue, 13 Sep 2022 14:36:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4391EC433D6; Tue, 13 Sep 2022 14:36:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079804; bh=xMSwEH5Zbbo81dk0MZ1TiWQtLZ4jkd2it9alHaMkfx4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VK7soWWoB13uJGOCJZc3Ok6NrBlZz+8PNyXEX9O0ahEIQG/t+ulHyNUgUqRFNhKVq oN7q1xD8cNJqtNyy3wOTHvdNZyjD6H09wpCchwIQaRLvCsEk3lpcC5etn+ispy1Ezd IOlfhQ2lz7G5ncN5eGy/AthfH2nKVIQTK6HmBqzM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Shevchenko , Hans de Goede , Sasha Levin Subject: [PATCH 4.9 02/42] platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask Date: Tue, 13 Sep 2022 16:07:33 +0200 Message-Id: <20220913140342.354720387@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andy Shevchenko [ Upstream commit 0a90ed8d0cfa29735a221eba14d9cb6c735d35b6 ] On Intel hardware the SLP_TYPx bitfield occupies bits 10-12 as per ACPI specification (see Table 4.13 "PM1 Control Registers Fixed Hardware Feature Control Bits" for the details). Fix the mask and other related definitions accordingly. Fixes: 93e5eadd1f6e ("x86/platform: New Intel Atom SOC power management con= troller driver") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220801113734.36131-1-andriy.shevchenko@li= nux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- arch/x86/include/asm/pmc_atom.h | 6 ++++-- arch/x86/platform/atom/pmc_atom.c | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/x86/include/asm/pmc_atom.h b/arch/x86/include/asm/pmc_ato= m.h index aa8744c77c6d9..b25ac6eb1fdee 100644 --- a/arch/x86/include/asm/pmc_atom.h +++ b/arch/x86/include/asm/pmc_atom.h @@ -16,6 +16,8 @@ #ifndef PMC_ATOM_H #define PMC_ATOM_H =20 +#include + /* ValleyView Power Control Unit PCI Device ID */ #define PCI_DEVICE_ID_VLV_PMC 0x0F1C /* CherryTrail Power Control Unit PCI Device ID */ @@ -148,9 +150,9 @@ #define ACPI_MMIO_REG_LEN 0x100 =20 #define PM1_CNT 0x4 -#define SLEEP_TYPE_MASK 0xFFFFECFF +#define SLEEP_TYPE_MASK GENMASK(12, 10) #define SLEEP_TYPE_S5 0x1C00 -#define SLEEP_ENABLE 0x2000 +#define SLEEP_ENABLE BIT(13) =20 extern int pmc_atom_read(int offset, u32 *value); extern int pmc_atom_write(int offset, u32 value); diff --git a/arch/x86/platform/atom/pmc_atom.c b/arch/x86/platform/atom/pmc= _atom.c index 964ff4fc61f9b..b5b371d959141 100644 --- a/arch/x86/platform/atom/pmc_atom.c +++ b/arch/x86/platform/atom/pmc_atom.c @@ -213,7 +213,7 @@ static void pmc_power_off(void) pm1_cnt_port =3D acpi_base_addr + PM1_CNT; =20 pm1_cnt_value =3D inl(pm1_cnt_port); - pm1_cnt_value &=3D SLEEP_TYPE_MASK; + pm1_cnt_value &=3D ~SLEEP_TYPE_MASK; pm1_cnt_value |=3D SLEEP_TYPE_S5; pm1_cnt_value |=3D SLEEP_ENABLE; =20 --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85BF3ECAAD8 for ; Tue, 13 Sep 2022 16:18:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231906AbiIMQSz (ORCPT ); Tue, 13 Sep 2022 12:18:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60360 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231254AbiIMQSX (ORCPT ); Tue, 13 Sep 2022 12:18:23 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C780C78217; Tue, 13 Sep 2022 08:13:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F086F614E5; Tue, 13 Sep 2022 14:36:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B1EAC433C1; Tue, 13 Sep 2022 14:36:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079812; bh=8qsHYCJV1ZTyzzOv+TkfjsHrwXn5+dFsnO0D33wFLSc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eNm268IkcoCm6xJA8GzBu8wF4gWgmch1mGZNzs4uJlE861Rp2pjhUev6uTsMGaLRy eAXYK/m2LcOycP6I4nA9N8iAV+Ex6p8PB/kPsI3qy0KkCT/l9W5/CUwdrBQyLJURBL 7w3Eo6HkkQDo6q1ng2+LJ9zob0Dkgoog+iuHhR58= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Johannes Berg , Sasha Levin Subject: [PATCH 4.9 03/42] wifi: cfg80211: debugfs: fix return type in ht40allow_map_read() Date: Tue, 13 Sep 2022 16:07:34 +0200 Message-Id: <20220913140342.404648165@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit d776763f48084926b5d9e25507a3ddb7c9243d5e ] The return type is supposed to be ssize_t, which is signed long, but "r" was declared as unsigned int. This means that on 64 bit systems we return positive values instead of negative error codes. Fixes: 80a3511d70e8 ("cfg80211: add debugfs HT40 allow map") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YutvOQeJm0UjLhwU@kili Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/wireless/debugfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c index 5d453916a4179..6a7f4432440a5 100644 --- a/net/wireless/debugfs.c +++ b/net/wireless/debugfs.c @@ -68,9 +68,10 @@ static ssize_t ht40allow_map_read(struct file *file, { struct wiphy *wiphy =3D file->private_data; char *buf; - unsigned int offset =3D 0, buf_size =3D PAGE_SIZE, i, r; + unsigned int offset =3D 0, buf_size =3D PAGE_SIZE, i; enum nl80211_band band; struct ieee80211_supported_band *sband; + ssize_t r; =20 buf =3D kzalloc(buf_size, GFP_KERNEL); if (!buf) --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C79FC54EE9 for ; Tue, 13 Sep 2022 15:29:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236138AbiIMP3j (ORCPT ); Tue, 13 Sep 2022 11:29:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45668 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236337AbiIMP1q (ORCPT ); Tue, 13 Sep 2022 11:27:46 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DC8457DF6F; Tue, 13 Sep 2022 07:38:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1D528B8100F; Tue, 13 Sep 2022 14:36:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82E6FC433C1; Tue, 13 Sep 2022 14:36:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079814; bh=kTlwYCdkvEMfgQrk4jUIzACSTPPkBkveoQ3qvraNI+I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v8u7tUxaRVwMklX678qmZudeIYFF5jd/QK9Z2AaS2s+CbaaPRY8C2o0qAdKoxL5Sn WmnGE7xEwSy0cieYyD7fgNhSEiSziEH3JZCbVdHkj5hMQeHuFYfWYxQrCk83OfOOR0 JtFWpztR7xNpOEANgC1rC4hokQVeRloEWquUzM5I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Nicolas Diaz , Shenwei Wang Subject: [PATCH 4.9 04/42] serial: fsl_lpuart: RS485 RTS polariy is inverse Date: Tue, 13 Sep 2022 16:07:35 +0200 Message-Id: <20220913140342.463369308@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Shenwei Wang commit 846651eca073e2e02e37490a4a52752415d84781 upstream. The setting of RS485 RTS polarity is inverse in the current driver. When the property of 'rs485-rts-active-low' is enabled in the dts node, the RTS signal should be LOW during sending. Otherwise, if there is no such a property, the RTS should be HIGH during sending. Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485") Cc: stable Signed-off-by: Nicolas Diaz Signed-off-by: Shenwei Wang Link: https://lore.kernel.org/r/20220805144529.604856-1-shenwei.wang@nxp.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/tty/serial/fsl_lpuart.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -951,9 +951,9 @@ static int lpuart_config_rs485(struct ua * Note: UART is assumed to be active high. */ if (rs485->flags & SER_RS485_RTS_ON_SEND) - modem &=3D ~UARTMODEM_TXRTSPOL; - else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) modem |=3D UARTMODEM_TXRTSPOL; + else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) + modem &=3D ~UARTMODEM_TXRTSPOL; } =20 /* Store the new configuration */ From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5AC48C6FA82 for ; Tue, 13 Sep 2022 15:25:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236173AbiIMPZI (ORCPT ); Tue, 13 Sep 2022 11:25:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45336 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236044AbiIMPXC (ORCPT ); Tue, 13 Sep 2022 11:23:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9C6697C74F; Tue, 13 Sep 2022 07:37:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D95BB614A3; Tue, 13 Sep 2022 14:36:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0DBFC433D6; Tue, 13 Sep 2022 14:36:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079817; bh=AQoDADaLPKvNoQ0TH0wMcQHRuHBQaajr4jYWAN6BNKw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1d0bkPvjE2YjukTE10guc1zs17mdJgCj0FgfN4VhVkRXSKoSyd7bb3pGv1UJ7Olwv 4GiFGLq20WX7Jn++8zclW3fcQwZpRHricRmmsy48AuWxnoQNyBFSgqKVPEYXaUXgJ1 /cIxdHJ4/aN0LQqIUJY7mClY6UdNajTMDNAub2/8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Zheng Wang , Dan Carpenter Subject: [PATCH 4.9 05/42] staging: rtl8712: fix use after free bugs Date: Tue, 13 Sep 2022 16:07:36 +0200 Message-Id: <20220913140342.516250467@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit e230a4455ac3e9b112f0367d1b8e255e141afae0 upstream. _Read/Write_MACREG callbacks are NULL so the read/write_macreg_hdl() functions don't do anything except free the "pcmd" pointer. It results in a use after free. Delete them. Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline k= ernel") Cc: stable Reported-by: Zheng Wang Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Yw4ASqkYcUhUfoY2@kili Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/staging/rtl8712/rtl8712_cmd.c | 36 -----------------------------= ----- 1 file changed, 36 deletions(-) --- a/drivers/staging/rtl8712/rtl8712_cmd.c +++ b/drivers/staging/rtl8712/rtl8712_cmd.c @@ -128,34 +128,6 @@ static void r871x_internal_cmd_hdl(struc kfree(pdrvcmd->pbuf); } =20 -static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf) -{ - void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); - struct cmd_obj *pcmd =3D (struct cmd_obj *)pbuf; - - /* invoke cmd->callback function */ - pcmd_callback =3D cmd_callback[pcmd->cmdcode].callback; - if (!pcmd_callback) - r8712_free_cmd_obj(pcmd); - else - pcmd_callback(padapter, pcmd); - return H2C_SUCCESS; -} - -static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf) -{ - void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); - struct cmd_obj *pcmd =3D (struct cmd_obj *)pbuf; - - /* invoke cmd->callback function */ - pcmd_callback =3D cmd_callback[pcmd->cmdcode].callback; - if (!pcmd_callback) - r8712_free_cmd_obj(pcmd); - else - pcmd_callback(padapter, pcmd); - return H2C_SUCCESS; -} - static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf) { struct cmd_obj *pcmd =3D (struct cmd_obj *)pbuf; @@ -224,14 +196,6 @@ static struct cmd_obj *cmd_hdl_filter(st pcmd_r =3D NULL; =20 switch (pcmd->cmdcode) { - case GEN_CMD_CODE(_Read_MACREG): - read_macreg_hdl(padapter, (u8 *)pcmd); - pcmd_r =3D pcmd; - break; - case GEN_CMD_CODE(_Write_MACREG): - write_macreg_hdl(padapter, (u8 *)pcmd); - pcmd_r =3D pcmd; - break; case GEN_CMD_CODE(_Read_BBREG): read_bbreg_hdl(padapter, (u8 *)pcmd); break; From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0EFF8C54EE9 for ; Tue, 13 Sep 2022 15:33:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236550AbiIMPdP (ORCPT ); Tue, 13 Sep 2022 11:33:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48714 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236479AbiIMPcR (ORCPT ); Tue, 13 Sep 2022 11:32:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1243D6CF60; Tue, 13 Sep 2022 07:40:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5509FB80FA1; Tue, 13 Sep 2022 14:37:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AD1C3C43147; Tue, 13 Sep 2022 14:36:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079820; bh=e28Tqsl9X5LrOAMbqEPA8WEGAyDGwUMRE/iZx5Q4Yck=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aa+tKaQOl16/2ds1gSCEuJVgkR4fkK8buQ7+oGyZpxgaKha47FSQcM1sAK9U2yJa3 MBeRuXhv/URF2WyN1iU82bHRdLSaFPGfAx8ZgPuQBSpD4iHRBzLqe5kfma47siBAtM Q+FtSFq2GwiDSBHXtCV4aEsQUSJaSfPEW+ihoeqA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com, stable , Khalid Masum , Helge Deller Subject: [PATCH 4.9 06/42] vt: Clear selection before changing the font Date: Tue, 13 Sep 2022 16:07:37 +0200 Message-Id: <20220913140342.566361976@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller commit 566f9c9f89337792070b5a6062dff448b3e7977f upstream. When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-memory accesses by dropping the selection before the various con_font_set() console handlers are called. Reported-by: syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com Cc: stable Tested-by: Khalid Masum Signed-off-by: Helge Deller Link: https://lore.kernel.org/r/YuV9apZGNmGfjcor@p100 Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/tty/vt/vt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4183,9 +4183,11 @@ static int con_font_set(struct vc_data * console_lock(); if (vc->vc_mode !=3D KD_TEXT) rc =3D -EINVAL; - else if (vc->vc_sw->con_font_set) + else if (vc->vc_sw->con_font_set) { + if (vc_is_sel(vc)) + clear_selection(); rc =3D vc->vc_sw->con_font_set(vc, &font, op->flags); - else + } else rc =3D -ENOSYS; console_unlock(); kfree(font.data); @@ -4212,9 +4214,11 @@ static int con_font_default(struct vc_da console_unlock(); return -EINVAL; } - if (vc->vc_sw->con_font_default) + if (vc->vc_sw->con_font_default) { + if (vc_is_sel(vc)) + clear_selection(); rc =3D vc->vc_sw->con_font_default(vc, &font, s); - else + } else rc =3D -ENOSYS; console_unlock(); if (!rc) { From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBFE7C54EE9 for ; Tue, 13 Sep 2022 15:30:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236494AbiIMPaj (ORCPT ); Tue, 13 Sep 2022 11:30:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46646 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236501AbiIMP2x (ORCPT ); Tue, 13 Sep 2022 11:28:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1B213229; Tue, 13 Sep 2022 07:39:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 12931614C2; Tue, 13 Sep 2022 14:37:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D6B0C433D6; Tue, 13 Sep 2022 14:37:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079822; bh=yncqrQpyzgj+vKIvrbJMO5mYWUXmnL5KckJVKPgN1Vk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xouu6KLAmheeirHMAaejvcCB/tGFujMoftrH9UvgqFf01JvcMrXEYjhVcGJZuII8w 6gslvgZ+3WG7YvL2AfR7Psio8BkQTGgqrYvs2QqvOjSGptp2z/JuPxBE1FgIQ3VrKH 9/3ha9o9iuT//DYJA0CoZqHgtVvot8HdT8sWKt44= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Niek Nooijens , Johan Hovold Subject: [PATCH 4.9 07/42] USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id Date: Tue, 13 Sep 2022 16:07:38 +0200 Message-Id: <20220913140342.633559937@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Niek Nooijens commit 001047ea241a9646010b2744451dfbc7289542f3 upstream. works perfectly with: modprobe ftdi_sio echo "0590 00b2" | tee /sys/module/ftdi_sio/drivers/usb-serial\:ftdi_sio/new_id > /dev/null but doing this every reboot is a pain in the ass. Signed-off-by: Niek Nooijens Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 8 insertions(+) --- a/drivers/usb/serial/ftdi_sio.c +++ b/drivers/usb/serial/ftdi_sio.c @@ -1040,6 +1040,8 @@ static const struct usb_device_id id_tab /* IDS GmbH devices */ { USB_DEVICE(IDS_VID, IDS_SI31A_PID) }, { USB_DEVICE(IDS_VID, IDS_CM31A_PID) }, + /* Omron devices */ + { USB_DEVICE(OMRON_VID, OMRON_CS1W_CIF31_PID) }, /* U-Blox devices */ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, --- a/drivers/usb/serial/ftdi_sio_ids.h +++ b/drivers/usb/serial/ftdi_sio_ids.h @@ -661,6 +661,12 @@ #define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0= */ =20 /* + * Omron corporation (https://www.omron.com) + */ + #define OMRON_VID 0x0590 + #define OMRON_CS1W_CIF31_PID 0x00b2 + +/* * Acton Research Corp. */ #define ACTON_VID 0x0647 /* Vendor ID */ From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08023C6FA82 for ; Tue, 13 Sep 2022 15:30:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236378AbiIMPaB (ORCPT ); Tue, 13 Sep 2022 11:30:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46744 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236146AbiIMP2N (ORCPT ); Tue, 13 Sep 2022 11:28:13 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ED5E37DF67; Tue, 13 Sep 2022 07:39:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 387E2B81023; Tue, 13 Sep 2022 14:37:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 843C6C433C1; Tue, 13 Sep 2022 14:37:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079824; bh=xb/kDkB5vl+8gb6N6n6DpXSufRWAX6XRdb2BtOxI2rs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SiqVKc93EJ2bl6/8eO+sistP9n0JojUYwAmFFm+aAn2YMCWZx96PwezQPIthTzmuV 42+hvfn+cabi4Ngec/4GjAOGcR1O4vof9GyvBiFGv+7/wn9iH9H9Qik0gkDcIQwvgq ihzJ1GtYJWEpAZu/MrQEuenOrsPh6DjU8wvD9MH0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Armin Wolf , Guenter Roeck , Sasha Levin Subject: [PATCH 4.9 08/42] hwmon: (gpio-fan) Fix array out of bounds access Date: Tue, 13 Sep 2022 16:07:39 +0200 Message-Id: <20220913140342.697010061@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Armin Wolf [ Upstream commit f233d2be38dbbb22299192292983037f01ab363c ] The driver does not check if the cooling state passed to gpio_fan_set_cur_state() exceeds the maximum cooling state as stored in fan_data->num_speeds. Since the cooling state is later used as an array index in set_fan_speed(), an array out of bounds access can occur. This can be exploited by setting the state of the thermal cooling device to arbitrary values, causing for example a kernel oops when unavailable memory is accessed this way. Example kernel oops: [ 807.987276] Unable to handle kernel paging request at virtual address ff= ffff80d0588064 [ 807.987369] Mem abort info: [ 807.987398] ESR =3D 0x96000005 [ 807.987428] EC =3D 0x25: DABT (current EL), IL =3D 32 bits [ 807.987477] SET =3D 0, FnV =3D 0 [ 807.987507] EA =3D 0, S1PTW =3D 0 [ 807.987536] FSC =3D 0x05: level 1 translation fault [ 807.987570] Data abort info: [ 807.987763] ISV =3D 0, ISS =3D 0x00000005 [ 807.987801] CM =3D 0, WnR =3D 0 [ 807.987832] swapper pgtable: 4k pages, 39-bit VAs, pgdp=3D00000000011650= 00 [ 807.987872] [ffffff80d0588064] pgd=3D0000000000000000, p4d=3D00000000000= 00000, pud=3D0000000000000000 [ 807.987961] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 807.987992] Modules linked in: cmac algif_hash aes_arm64 algif_skcipher = af_alg bnep hci_uart btbcm bluetooth ecdh_generic ecc 8021q garp stp llc sn= d_soc_hdmi_codec brcmfmac vc4 brcmutil cec drm_kms_helper snd_soc_core cfg8= 0211 snd_compress bcm2835_codec(C) snd_pcm_dmaengine syscopyarea bcm2835_is= p(C) bcm2835_v4l2(C) sysfillrect v4l2_mem2mem bcm2835_mmal_vchiq(C) raspber= rypi_hwmon sysimgblt videobuf2_dma_contig videobuf2_vmalloc fb_sys_fops vid= eobuf2_memops rfkill videobuf2_v4l2 videobuf2_common i2c_bcm2835 snd_bcm283= 5(C) videodev snd_pcm snd_timer snd mc vc_sm_cma(C) gpio_fan uio_pdrv_genir= q uio drm fuse drm_panel_orientation_quirks backlight ip_tables x_tables ip= v6 [ 807.988508] CPU: 0 PID: 1321 Comm: bash Tainted: G C 5.15= .56-v8+ #1575 [ 807.988548] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) [ 807.988574] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE= =3D--) [ 807.988608] pc : set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.988654] lr : gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.988691] sp : ffffffc008cf3bd0 [ 807.988710] x29: ffffffc008cf3bd0 x28: ffffff80019edac0 x27: 00000000000= 00000 [ 807.988762] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff80074= 7c920 [ 807.988787] x23: 000000000000000a x22: ffffff800369f000 x21: 00000000199= 9997c [ 807.988854] x20: ffffff800369f2e8 x19: ffffff8002ae8080 x18: 00000000000= 00000 [ 807.988877] x17: 0000000000000000 x16: 0000000000000000 x15: 000000559e2= 71b70 [ 807.988938] x14: 0000000000000000 x13: 0000000000000000 x12: 00000000000= 00000 [ 807.988960] x11: 0000000000000000 x10: ffffffc008cf3c20 x9 : ffffffcfb60= c741c [ 807.989018] x8 : 000000000000000a x7 : 00000000ffffffc9 x6 : 00000000000= 00009 [ 807.989040] x5 : 000000000000002a x4 : 0000000000000000 x3 : ffffff80036= 9f2e8 [ 807.989062] x2 : 000000000000e780 x1 : 0000000000000001 x0 : ffffff80d05= 88060 [ 807.989084] Call trace: [ 807.989091] set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.989113] gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.989199] cur_state_store+0x84/0xd0 [ 807.989221] dev_attr_store+0x20/0x38 [ 807.989262] sysfs_kf_write+0x4c/0x60 [ 807.989282] kernfs_fop_write_iter+0x130/0x1c0 [ 807.989298] new_sync_write+0x10c/0x190 [ 807.989315] vfs_write+0x254/0x378 [ 807.989362] ksys_write+0x70/0xf8 [ 807.989379] __arm64_sys_write+0x24/0x30 [ 807.989424] invoke_syscall+0x4c/0x110 [ 807.989442] el0_svc_common.constprop.3+0xfc/0x120 [ 807.989458] do_el0_svc+0x2c/0x90 [ 807.989473] el0_svc+0x24/0x60 [ 807.989544] el0t_64_sync_handler+0x90/0xb8 [ 807.989558] el0t_64_sync+0x1a0/0x1a4 [ 807.989579] Code: b9403801 f9402800 7100003f 8b35cc00 (b9400416) [ 807.989627] ---[ end trace 8ded4c918658445b ]--- Fix this by checking the cooling state and return an error if it exceeds the maximum cooling state. Tested on a Raspberry Pi 3. Fixes: b5cf88e46bad ("(gpio-fan): Add thermal control hooks") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20220830011101.178843-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/hwmon/gpio-fan.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c index 685568b1236d4..f78e677b858e8 100644 --- a/drivers/hwmon/gpio-fan.c +++ b/drivers/hwmon/gpio-fan.c @@ -422,6 +422,9 @@ static int gpio_fan_set_cur_state(struct thermal_coolin= g_device *cdev, if (!fan_data) return -EINVAL; =20 + if (state >=3D fan_data->num_speed) + return -EINVAL; + set_fan_speed(fan_data, state); return 0; } --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E8A2C54EE9 for ; Tue, 13 Sep 2022 15:25:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236238AbiIMPZ3 (ORCPT ); Tue, 13 Sep 2022 11:25:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59196 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235980AbiIMPXE (ORCPT ); Tue, 13 Sep 2022 11:23:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7AA0D7C75B; Tue, 13 Sep 2022 07:37:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1296D614C0; Tue, 13 Sep 2022 14:37:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0E34EC433C1; Tue, 13 Sep 2022 14:37:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079827; bh=FNQL4f90Hhbis1flO43W5RzCiLMjOungG55WPTLAx7w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VjsKGT3Yks5IFPwkR6J+ic4VSCHhFKxrmxwoa0BgoGOY/29aBBrXr2ojaJ0+5ooSe asq7K/ed4Q0f9zEv7SnzW7NNwFdKF/UQrOhcFoMylpM4DweHbD5d9x1lFP7orpwJ/n B8nfaSyhNQJvcTu+JYk7DTwp24nhzBcIt8zDpOB8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mathias Nyman Subject: [PATCH 4.9 09/42] xhci: Add grace period after xHC start to prevent premature runtime suspend. Date: Tue, 13 Sep 2022 16:07:40 +0200 Message-Id: <20220913140342.750028767@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mathias Nyman commit 33e321586e37b642ad10594b9ef25a613555cd08 upstream. After xHC controller is started, either in probe or resume, it can take a while before any of the connected usb devices are visible to the roothub due to link training. It's possible xhci driver loads, sees no acivity and suspends the host before the USB device is visible. In one testcase with a hotplugged xHC controller the host finally detected the connected USB device and generated a wake 500ms after host initial start. If hosts didn't suspend the device duringe training it probablty wouldn't take up to 500ms to detect it, but looking at specs reveal USB3 link training has a couple long timeout values, such as 120ms RxDetectQuietTimeout, and 360ms PollingLFPSTimeout. So Add a 500ms grace period that keeps polling the roothub for 500ms after start, preventing runtime suspend until USB devices are detected. Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220825150840.132216-3-mathias.nyman@linux= .intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/usb/host/xhci-hub.c | 11 +++++++++++ drivers/usb/host/xhci.c | 4 +++- drivers/usb/host/xhci.h | 2 +- 3 files changed, 15 insertions(+), 2 deletions(-) --- a/drivers/usb/host/xhci-hub.c +++ b/drivers/usb/host/xhci-hub.c @@ -1297,6 +1297,17 @@ int xhci_hub_status_data(struct usb_hcd =20 status =3D bus_state->resuming_ports; =20 + /* + * SS devices are only visible to roothub after link training completes. + * Keep polling roothubs for a grace period after xHC start + */ + if (xhci->run_graceperiod) { + if (time_before(jiffies, xhci->run_graceperiod)) + status =3D 1; + else + xhci->run_graceperiod =3D 0; + } + mask =3D PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC; =20 /* For each port, did anything change? If so, set that bit in buf. */ --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -144,9 +144,11 @@ static int xhci_start(struct xhci_hcd *x xhci_err(xhci, "Host took too long to start, " "waited %u microseconds.\n", XHCI_MAX_HALT_USEC); - if (!ret) + if (!ret) { /* clear state flags. Including dying, halted or removing */ xhci->xhc_state =3D 0; + xhci->run_graceperiod =3D jiffies + msecs_to_jiffies(500); + } =20 return ret; } --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -1607,7 +1607,7 @@ struct xhci_hcd { =20 /* Host controller watchdog timer structures */ unsigned int xhc_state; - + unsigned long run_graceperiod; u32 command; struct s3_save s3; /* Host controller is dying - not responding to commands. "I'm not dead ye= t!" From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8486AC6FA8A for ; Tue, 13 Sep 2022 16:18:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230508AbiIMQSP (ORCPT ); Tue, 13 Sep 2022 12:18:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59676 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232363AbiIMQR4 (ORCPT ); Tue, 13 Sep 2022 12:17:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B4F9978218; Tue, 13 Sep 2022 08:13:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2A471614D3; Tue, 13 Sep 2022 14:36:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3E296C433C1; Tue, 13 Sep 2022 14:36:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079778; bh=qrPdVakPiVxnhLPaPvRPEDfXlnH+En01EAUaYp/+zrs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NNzSuwIQJw5JaTlU+C9C0lHrx2/He8/byMc4A0IfwERbKuwo3e2Y+WBtcewdbTgYF ifqxFjMbYoU7FCqwbJe9Vqbb0kW/O2VMNjBPm6VTn8OaXop7oeFfX4XjO6xkfdc9KF 66haQIGhtD+Kc+j2zOPgaP3jVr6VTSeQCMMzIkUA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold Subject: [PATCH 4.9 10/42] USB: serial: cp210x: add Decagon UCA device id Date: Tue, 13 Sep 2022 16:07:41 +0200 Message-Id: <20220913140342.791971764@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit ceb4038472a4803e7046ed488b03d11551991514 upstream. Add the device id for Decagon Devices USB Cable Adapter. Link: https://lore.kernel.org/r/trinity-819f9db2-d3e1-40e9-a669-9c245817c04= 6-1661523546680@msvc-mesg-web108 Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/serial/cp210x.c +++ b/drivers/usb/serial/cp210x.c @@ -128,6 +128,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */ { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenu= ator */ { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */ + { USB_DEVICE(0x10C4, 0x8414) }, /* Decagon USB Cable Adapter */ { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS= Modem */ { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Cons= ole */ From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BEEA7C6FA82 for ; Tue, 13 Sep 2022 15:33:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234778AbiIMPdE (ORCPT ); Tue, 13 Sep 2022 11:33:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59312 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236596AbiIMPcE (ORCPT ); Tue, 13 Sep 2022 11:32:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 60E7D7F107; Tue, 13 Sep 2022 07:40:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F3E12B80FEC; Tue, 13 Sep 2022 14:36:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 42898C433C1; Tue, 13 Sep 2022 14:36:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079781; bh=0Otgjmjs0QZEBqk0/JZe3v3faTABsG+OObMfsoFLB28=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=x1C1sHPNmGTq3RXhoYphT+VyLfrReUiSddUuPoka/GtaAXNJK8PfnOTZDLSn8ls8D KX09SaQ8RM+riBXmFs9xCDKIkGlAYubY49aAtm/hfYtjt7rJShkx4rBde2fVWQv/qB kaZzcrpExqmz3Y5hzqVOYski74NHGgwfCykHtMu0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yan Xinyu , Johan Hovold Subject: [PATCH 4.9 11/42] USB: serial: option: add support for OPPO R11 diag port Date: Tue, 13 Sep 2022 16:07:42 +0200 Message-Id: <20220913140342.840901678@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yan Xinyu commit 8d5fc280392735e4441b35de14f2f4860fa8d83c upstream. Add support for OPPO R11 USB diag serial port to option driver. This phone uses Qualcomm Snapdragon 660 SoC. usb-devices output: T: Bus=3D03 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 10 Spd=3D480 MxC= h=3D 0 D: Ver=3D 2.00 Cls=3D00(>ifc ) Sub=3D00 Prot=3D00 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D22d9 ProdID=3D276c Rev=3D04.04 S: Manufacturer=3DOPPO S: Product=3DSDM660-MTP _SN:09C6BCA7 S: SerialNumber=3Dbeb2c403 C: #Ifs=3D 2 Cfg#=3D 1 Atr=3D80 MxPwr=3D500mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption I: If#=3D0x1 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3D42 Prot=3D01 Driver= =3Dusbfs Signed-off-by: Yan Xinyu Link: https://lore.kernel.org/r/20220714102037.4113889-1-sdlyyxy@bupt.edu.cn Link: https://lore.kernel.org/r/Yt1WfSZk03Plpnan@hovoldconsulting.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/usb/serial/option.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -569,6 +569,10 @@ static void option_instat_callback(struc #define WETELECOM_PRODUCT_6802 0x6802 #define WETELECOM_PRODUCT_WMD300 0x6803 =20 +/* OPPO products */ +#define OPPO_VENDOR_ID 0x22d9 +#define OPPO_PRODUCT_R11 0x276c + =20 /* Device flags */ =20 @@ -2126,6 +2130,7 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 = RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 = MBIM */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 = ECM/NCM */ + { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0= xff, 0x30) }, { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 597F4C6FA82 for ; Tue, 13 Sep 2022 15:27:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231154AbiIMP16 (ORCPT ); Tue, 13 Sep 2022 11:27:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55998 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236339AbiIMP0M (ORCPT ); Tue, 13 Sep 2022 11:26:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7A18C6B64F; Tue, 13 Sep 2022 07:38:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B0D62B81014; Tue, 13 Sep 2022 14:36:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1AFEBC43149; Tue, 13 Sep 2022 14:36:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079784; bh=TuR7ntBRToNf3Lk4Jw/T3atOC9jEKeAgxsyThZuSlpo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jSmiqXVVJQ5ebNVeJg14HhnhmfBMG56w+30mqamjV4Avg3uYfqStq15ENxqDSm4vQ DNx7x5pUS5dU+iwiPWMhZ4uaqjRoPIbGCz7+cqBnQxKPh8PgCaLjShJA8wD2i1weqh 4ah1Z0PEVM6gcv0Ft7hLE3esznbMLh9bRFpPEmA4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Slark Xiao , Johan Hovold Subject: [PATCH 4.9 12/42] USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode Date: Tue, 13 Sep 2022 16:07:43 +0200 Message-Id: <20220913140342.893875731@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Slark Xiao commit 8ffe20d08f2c95d702c453020d03a4c568a988f0 upstream. We added PIDs for MV32-WA/WB MBIM mode before, now we need to add support for RmNet mode. Test evidence as below: T: Bus=3D03 Lev=3D01 Prnt=3D01 Port=3D02 Cnt=3D03 Dev#=3D 3 Spd=3D480 MxC= h=3D 0 D: Ver=3D 2.10 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f3 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F3 USB Mobile Broadband S: SerialNumber=3Dd7b4be8d C: #Ifs=3D 4 Cfg#=3D 1 Atr=3Da0 MxPwr=3D500mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D50 Driver= =3Dqmi_wwan I: If#=3D0x1 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption T: Bus=3D03 Lev=3D01 Prnt=3D01 Port=3D02 Cnt=3D03 Dev#=3D 10 Spd=3D480 MxC= h=3D 0 D: Ver=3D 2.10 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f4 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F4 USB Mobile Broadband S: SerialNumber=3Dd095087d C: #Ifs=3D 4 Cfg#=3D 1 Atr=3Da0 MxPwr=3D500mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D50 Driver= =3Dqmi_wwan I: If#=3D0x1 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption Signed-off-by: Slark Xiao [ johan: sort entries ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -434,6 +434,8 @@ static void option_instat_callback(struc #define CINTERION_PRODUCT_MV31_2_RMNET 0x00b9 #define CINTERION_PRODUCT_MV32_WA 0x00f1 #define CINTERION_PRODUCT_MV32_WB 0x00f2 +#define CINTERION_PRODUCT_MV32_WA_RMNET 0x00f3 +#define CINTERION_PRODUCT_MV32_WB_RMNET 0x00f4 =20 /* Olivetti products */ #define OLIVETTI_VENDOR_ID 0x0b3c @@ -1966,8 +1968,12 @@ static const struct usb_device_id option .driver_info =3D RSVD(0)}, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WA, 0xff), .driver_info =3D RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WA_RMNET, 0xff), + .driver_info =3D RSVD(0) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WB, 0xff), .driver_info =3D RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WB_RMNET, 0xff), + .driver_info =3D RSVD(0) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), .driver_info =3D RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF4FEC54EE9 for ; Tue, 13 Sep 2022 15:27:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235958AbiIMP1u (ORCPT ); Tue, 13 Sep 2022 11:27:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236212AbiIMP0L (ORCPT ); Tue, 13 Sep 2022 11:26:11 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A87D47D1E7; Tue, 13 Sep 2022 07:38:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 60653B81012; Tue, 13 Sep 2022 14:36:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF512C433D6; Tue, 13 Sep 2022 14:36:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079787; bh=b65si5HoAEXck2HfEfAqj9RwQescYO6j4pI01pWjtYY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DJ3jCKzy9jJOLN9w41MjcNF6BYf44VplZh0eTjYw5G1bKoZDkZQBq8zChVEZgLwg8 Bo4ghOG34eKL3MXydP9cNelY3PyilsCFnIpG109e4uxr2D1GeXQuWlk5gNmcq7R4eg WN+WmTdQLYbITC5d1AgI8sA4gMYl8O9FzQzcXZzU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thierry GUIBERT , stable Subject: [PATCH 4.9 13/42] USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020) Date: Tue, 13 Sep 2022 16:07:44 +0200 Message-Id: <20220913140342.938657114@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thierry GUIBERT commit a10bc71729b236fe36de0d8e4d35c959fd8dec3a upstream. Supports for ICOM F3400 and ICOM F4400 PMR radios in CDC-ACM driver enabling the AT serial port. The Vendor Id is 0x0C26 The Product ID is 0x0020 Output of lsusb : Bus 001 Device 009: ID 0c26:0020 Prolific Technology Inc. ICOM Radio Couldn't open device, some information will be missing Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 2 Communications bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x0c26 Prolific Technology Inc. idProduct 0x0020 bcdDevice 0.00 iManufacturer 1 ICOM Inc. iProduct 2 ICOM Radio iSerial 3 *obfuscated* bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 0x0030 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xc0 Self Powered MaxPower 0mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 2 Communications bInterfaceSubClass 2 Abstract (modem) bInterfaceProtocol 1 AT-commands (v.25ter) iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 12 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 10 CDC Data bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Signed-off-by: Thierry GUIBERT Cc: stable Link: https://lore.kernel.org/r/20220819081702.84118-1-thierry.guibert@croi= x-rouge.fr Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/usb/class/cdc-acm.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -1774,6 +1774,9 @@ static const struct usb_device_id acm_id { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */ .driver_info =3D NO_UNION_NORMAL, /* has misplaced union descriptor */ }, + { USB_DEVICE(0x0c26, 0x0020), /* Icom ICF3400 Serie */ + .driver_info =3D NO_UNION_NORMAL, /* reports zero length descriptor */ + }, { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */ .driver_info =3D NO_UNION_NORMAL, /* reports zero length descriptor */ }, From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD56AC6FA86 for ; Tue, 13 Sep 2022 15:28:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236399AbiIMP2P (ORCPT ); Tue, 13 Sep 2022 11:28:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56892 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236138AbiIMP0k (ORCPT ); Tue, 13 Sep 2022 11:26:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 926E86BD74; Tue, 13 Sep 2022 07:38:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 012A6B81022; Tue, 13 Sep 2022 14:36:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4A2DEC4314B; Tue, 13 Sep 2022 14:36:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079789; bh=Z53+ckARtH0s5Nl9QFrNbDMEuPCBLrRitoYcxC1toyk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wTsJtSDKYLwg1ka8Z0ip13EXf+tWzNC8xLdoWSBhmQG6f6uYhu/4fmPMb+VeCKcgE Grwa1xh3McM6HZaaFLNJUJBv7E9IzqFWs76X2I3lfWK26QUjkMYdGzCQKgqV/sh0KP lxA2opjEf02Vj40e/8Te5n09oLjNKQD/c+lxrEmo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , stable , Witold Lipieta Subject: [PATCH 4.9 14/42] usb-storage: Add ignore-residue quirk for NXP PN7462AU Date: Tue, 13 Sep 2022 16:07:45 +0200 Message-Id: <20220913140342.997939573@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Witold Lipieta commit 2aa48857ad52236a9564c71183d6cc8893becd41 upstream. This is USB mass storage primary boot loader for code download on NXP PN7462AU. Without the quirk it is impossible to write whole memory at once as device restarts during the write due to bogus residue values reported. Acked-by: Alan Stern Cc: stable Signed-off-by: Witold Lipieta Link: https://lore.kernel.org/r/20220809112911.462776-1-witold.lipieta@thau= matec.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/usb/storage/unusual_devs.h +++ b/drivers/usb/storage/unusual_devs.h @@ -2301,6 +2301,13 @@ UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ), =20 +/* Reported by Witold Lipieta */ +UNUSUAL_DEV( 0x1fc9, 0x0117, 0x0100, 0x0100, + "NXP Semiconductors", + "PN7462AU", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_RESIDUE ), + /* Supplied with some Castlewood ORB removable drives */ UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x9999, "Double-H Technology", From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B410BC6FA82 for ; Tue, 13 Sep 2022 15:28:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236246AbiIMP2U (ORCPT ); Tue, 13 Sep 2022 11:28:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33936 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236166AbiIMP07 (ORCPT ); Tue, 13 Sep 2022 11:26:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 366C67DF42; Tue, 13 Sep 2022 07:38:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5D9CEB80FD4; Tue, 13 Sep 2022 14:36:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CFAC4C433D6; Tue, 13 Sep 2022 14:36:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079792; bh=gchE756EGWcW1rccoQrGb//dG3EomodFgahAjrBoEfw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pGPCMITzFEJXJuoS8ZU4JHjsaA4XZB+6V6wIn3SqJ8+A+P7z9Apk6HmTddjTRtAV7 F0IfGOLLM6EoZCgFH1jdqdDDCzPkoG0nzcfMlr1+Eoq7O0WKyyfEhIkZARo18usd8u /CxAgCYFAC6JHB7SyPQJDc/U+8pQLU0ZkT0hJSaY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Gordeev , Gerald Schaefer , Vasily Gorbik Subject: [PATCH 4.9 15/42] s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages Date: Tue, 13 Sep 2022 16:07:46 +0200 Message-Id: <20220913140343.042256434@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Gerald Schaefer commit 7c8d42fdf1a84b1a0dd60d6528309c8ec127e87c upstream. The alignment check in prepare_hugepage_range() is wrong for 2 GB hugepages, it only checks for 1 MB hugepage alignment. This can result in kernel crash in __unmap_hugepage_range() at the BUG_ON(start & ~huge_page_mask(h)) alignment check, for mappings created with MAP_FIXED at unaligned address. Fix this by correctly handling multiple hugepage sizes, similar to the generic version of prepare_hugepage_range(). Fixes: d08de8e2d867 ("s390/mm: add support for 2GB hugepages") Cc: # 4.8+ Acked-by: Alexander Gordeev Signed-off-by: Gerald Schaefer Signed-off-by: Vasily Gorbik Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- arch/s390/include/asm/hugetlb.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/arch/s390/include/asm/hugetlb.h +++ b/arch/s390/include/asm/hugetlb.h @@ -29,9 +29,11 @@ pte_t huge_ptep_get_and_clear(struct mm_ static inline int prepare_hugepage_range(struct file *file, unsigned long addr, unsigned long len) { - if (len & ~HPAGE_MASK) + struct hstate *h =3D hstate_file(file); + + if (len & ~huge_page_mask(h)) return -EINVAL; - if (addr & ~HPAGE_MASK) + if (addr & ~huge_page_mask(h)) return -EINVAL; return 0; } From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8507C54EE9 for ; Tue, 13 Sep 2022 15:29:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236434AbiIMP2i (ORCPT ); Tue, 13 Sep 2022 11:28:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45384 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236149AbiIMP1h (ORCPT ); Tue, 13 Sep 2022 11:27:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4A2BF6BD6A; Tue, 13 Sep 2022 07:38:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 16E5E61495; Tue, 13 Sep 2022 14:36:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 35AF8C433D7; Tue, 13 Sep 2022 14:36:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079794; bh=vMW+pqOmhVGx/UWY7SCss0U4zHeQ5mDNhUutEPbJDZs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oEUVfoO2vpDFhqdYiSDibJTLK3mWuKLwBGpgjinvV5evY2S8C2j81CZD4ClgWR9NG CWUZ5nWS1RRpEebJqY7DCL8UNfGfynPEvA5idbjdja/2OYQ/XjPjgv7sdrF0aPVRhn /t+EJA5uoo9AXpPPuEZ9u9kYrnOs1QD12Klmc9n8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josh Poimboeuf , Heiko Carstens , Vasily Gorbik Subject: [PATCH 4.9 16/42] s390: fix nospec table alignments Date: Tue, 13 Sep 2022 16:07:47 +0200 Message-Id: <20220913140343.085198775@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Josh Poimboeuf commit c9305b6c1f52060377c72aebe3a701389e9f3172 upstream. Add proper alignment for .nospec_call_table and .nospec_return_table in vmlinux. [hca@linux.ibm.com]: The problem with the missing alignment of the nospec tables exist since a long time, however only since commit e6ed91fd0768 ("s390/alternatives: remove padding generation code") and with CONFIG_RELOCATABLE=3Dn the kernel may also crash at boot time. The above named commit reduced the size of struct alt_instr by one byte, so its new size is 11 bytes. Therefore depending on the number of cpu alternatives the size of the __alt_instructions array maybe odd, which again also causes that the addresses of the nospec tables will be odd. If the address of __nospec_call_start is odd and the kernel is compiled With CONFIG_RELOCATABLE=3Dn the compiler may generate code that loads the address of __nospec_call_start with a 'larl' instruction. This will generate incorrect code since the 'larl' instruction only works with even addresses. In result the members of the nospec tables will be accessed with an off-by-one offset, which subsequently may lead to addressing exceptions within __nospec_revert(). Fixes: f19fbd5ed642 ("s390: introduce execute-trampolines for branches") Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/8719bf1ce4a72ebdeb575200290094e9ce047bcc.16= 61557333.git.jpoimboe@kernel.org Cc: # 4.16 Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- arch/s390/kernel/vmlinux.lds.S | 1 + 1 file changed, 1 insertion(+) --- a/arch/s390/kernel/vmlinux.lds.S +++ b/arch/s390/kernel/vmlinux.lds.S @@ -125,6 +125,7 @@ SECTIONS /* * Table with the patch locations to undo expolines */ + . =3D ALIGN(4); .nospec_call_table : { __nospec_call_start =3D . ; *(.s390_indirect*) From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1021BC6FA8D for ; Tue, 13 Sep 2022 15:29:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232198AbiIMP3g (ORCPT ); Tue, 13 Sep 2022 11:29:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41784 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231656AbiIMP1q (ORCPT ); Tue, 13 Sep 2022 11:27:46 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 36D377DF60; Tue, 13 Sep 2022 07:38:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3162CB80FE1; Tue, 13 Sep 2022 14:36:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8E7EDC433B5; Tue, 13 Sep 2022 14:36:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079796; bh=ysz1jOKMvZYF00xca0bynzbiuGanz8aiYjGSU62Dn08=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FRFVrDegazDo/gh4iUCyY4irmkTuNXG+C1D9PmNeMG7Ec+A/KT+FBUNtKKhviB8ru 7dGAwNwXp8doRsa5sZN+tC8tdHGwNn91zKBrQs0pVPa9oHvzKfz+IAdp6+UK4+nSMU WPv9yVzZm5zG3DZEDSweU6rIpnMyECub06I8X73w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Rondreis Subject: [PATCH 4.9 17/42] USB: core: Prevent nested device-reset calls Date: Tue, 13 Sep 2022 16:07:48 +0200 Message-Id: <20220913140343.138541841@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 9c6d778800b921bde3bff3cff5003d1650f942d1 upstream. Automatic kernel fuzzing revealed a recursive locking violation in usb-storage: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D WARNING: possible recursive locking detected 5.18.0 #3 Not tainted Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) -------------------------------------------- kworker/1:3/1205 is trying to acquire lock: ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 but task is already holding lock: ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 ... stack backtrace: CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_deadlock_bug kernel/locking/lockdep.c:2988 [inline] check_deadlock kernel/locking/lockdep.c:3031 [inline] validate_chain kernel/locking/lockdep.c:3816 [inline] __lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053 lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630 __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747 usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 usb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109 r871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622 usb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:545 [inline] device_remove+0x11f/0x170 drivers/base/dd.c:537 __device_release_driver drivers/base/dd.c:1222 [inline] device_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248 usb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627 usb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118 usb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114 This turned out not to be an error in usb-storage but rather a nested device reset attempt. That is, as the rtl8712 driver was being unbound from a composite device in preparation for an unrelated USB reset (that driver does not have pre_reset or post_reset callbacks), its ->remove routine called usb_reset_device() -- thus nesting one reset call within another. Performing a reset as part of disconnect processing is a questionable practice at best. However, the bug report points out that the USB core does not have any protection against nested resets. Adding a reset_in_progress flag and testing it will prevent such errors in the future. Link: https://lore.kernel.org/all/CAB7eexKUpvX-JNiLzhXBDWgfg2T9e9_0Tw4HQ6ke= N=3D=3DvoRbP0g@mail.gmail.com/ Cc: stable@vger.kernel.org Reported-and-tested-by: Rondreis Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YwkflDxvg0KWqyZK@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/hub.c | 10 ++++++++++ include/linux/usb.h | 2 ++ 2 files changed, 12 insertions(+) --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -5701,6 +5701,11 @@ re_enumerate_no_bos: * the reset is over (using their post_reset method). * * Return: The same as for usb_reset_and_verify_device(). + * However, if a reset is already in progress (for instance, if a + * driver doesn't have pre_ or post_reset() callbacks, and while + * being unbound or re-bound during the ongoing reset its disconnect() + * or probe() routine tries to perform a second, nested reset), the + * routine returns -EINPROGRESS. * * Note: * The caller must own the device lock. For example, it's safe to use @@ -5734,6 +5739,10 @@ int usb_reset_device(struct usb_device * return -EISDIR; } =20 + if (udev->reset_in_progress) + return -EINPROGRESS; + udev->reset_in_progress =3D 1; + port_dev =3D hub->ports[udev->portnum - 1]; =20 /* @@ -5798,6 +5807,7 @@ int usb_reset_device(struct usb_device * =20 usb_autosuspend_device(udev); memalloc_noio_restore(noio_flag); + udev->reset_in_progress =3D 0; return ret; } EXPORT_SYMBOL_GPL(usb_reset_device); --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -531,6 +531,7 @@ struct usb3_lpm_parameters { * @level: number of USB hub ancestors * @can_submit: URBs may be submitted * @persist_enabled: USB_PERSIST enabled for this device + * @reset_in_progress: the device is being reset * @have_langid: whether string_langid is valid * @authorized: policy has said we can use it; * (user space) policy determines if we authorize this device to be @@ -609,6 +610,7 @@ struct usb_device { =20 unsigned can_submit:1; unsigned persist_enabled:1; + unsigned reset_in_progress:1; unsigned have_langid:1; unsigned authorized:1; unsigned authenticated:1; From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D305C6FA82 for ; Tue, 13 Sep 2022 15:28:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236413AbiIMP20 (ORCPT ); Tue, 13 Sep 2022 11:28:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43928 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236179AbiIMP1B (ORCPT ); Tue, 13 Sep 2022 11:27:01 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 360007D7BA; Tue, 13 Sep 2022 07:38:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CABEBB80F9D; Tue, 13 Sep 2022 14:36:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1FFF4C433D7; Tue, 13 Sep 2022 14:36:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079799; bh=0PyzWKGgacvE+hrA7uAAPic9Xb5y/v5fYZvJrGxE2Bo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yBUJAR/tCzJHT7YOOtlsAE7fKI38Y5gmkcI3cFBnX4ZgYkVAN6X3DBuuYm9XAT/+U avNoucH3afzMDTSRiFhJq5m9CeYLr3OqpfJlaoFbKNoielWcb5pIr7BzCK05F2B7gM QylisbVxc1DhLoMX7y8WjKViIP8u/MuIYrWVUwoM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Krishna Kurapati Subject: [PATCH 4.9 18/42] usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS Date: Tue, 13 Sep 2022 16:07:49 +0200 Message-Id: <20220913140343.184916758@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krishna Kurapati commit 9d4dc16ec71bd6368548e9743223e449b4377fc7 upstream. During cdrom emulation, the response to read_toc command must contain the cdrom address as the number of sectors (2048 byte sized blocks) represented either as an absolute value (when MSF bit is '0') or in terms of PMin/PSec/PFrame (when MSF bit is set to '1'). Incase of cdrom, the fsg_lun_open call sets the sector size to 2048 bytes. When MAC OS sends a read_toc request with MSF set to '1', the store_cdrom_address assumes that the address being provided is the LUN size represented in 512 byte sized blocks instead of 2048. It tries to modify the address further to convert it to 2048 byte sized blocks and store it in MSF format. This results in data transfer failures as the cdrom address being provided in the read_toc response is incorrect. Fixes: 3f565a363cee ("usb: gadget: storage: adapt logic block size to bound= block devices") Cc: stable@vger.kernel.org Acked-by: Alan Stern Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/1661570110-19127-1-git-send-email-quic_kris= kura@quicinc.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/usb/gadget/function/storage_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/usb/gadget/function/storage_common.c +++ b/drivers/usb/gadget/function/storage_common.c @@ -298,8 +298,10 @@ EXPORT_SYMBOL_GPL(fsg_lun_fsync_sub); void store_cdrom_address(u8 *dest, int msf, u32 addr) { if (msf) { - /* Convert to Minutes-Seconds-Frames */ - addr >>=3D 2; /* Convert to 2048-byte frames */ + /* + * Convert to Minutes-Seconds-Frames. + * Sector size is already set to 2048 bytes. + */ addr +=3D 2*75; /* Lead-in occupies 2 seconds */ dest[3] =3D addr % 75; /* Frames */ addr /=3D 75; From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AC86C6FA86 for ; Tue, 13 Sep 2022 15:29:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236274AbiIMP3p (ORCPT ); Tue, 13 Sep 2022 11:29:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36354 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235966AbiIMP2H (ORCPT ); Tue, 13 Sep 2022 11:28:07 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 91FA76B176; Tue, 13 Sep 2022 07:38:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 63FA4B8101B; Tue, 13 Sep 2022 14:36:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CCEEBC433D7; Tue, 13 Sep 2022 14:36:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079802; bh=exZdNZWzP0dOHve55ZJWQ3kh4qj940fegArBrUQhtkE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hIupgOi5VX3Zuf0iP7FB4KWP1FJWJfZihxnAhaxqL/ujgn6j7XF/6xFewVsHNOv8i xaGEdzNhDf3lEJAW26ufcyeOyg20gK/FElrLBRFgRRCruJ0KteyhQTkjRaLKcyKZii wrYEptOd5ssKKp++45wrUYZyh7hg7id2+iPlt988= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com, Siddh Raman Pant , Johannes Berg Subject: [PATCH 4.9 19/42] wifi: mac80211: Dont finalize CSA in IBSS mode if state is disconnected Date: Tue, 13 Sep 2022 16:07:50 +0200 Message-Id: <20220913140343.240378340@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Siddh Raman Pant commit 15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0 upstream. When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa(). Cc: stable@vger.kernel.org Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode") Link: https://syzkaller.appspot.com/bug?id=3D05603ef4ae8926761b678d2939a3b2= ad28ab9ca6 Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com Signed-off-by: Siddh Raman Pant Tested-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220814151512.9985-1-code@siddh.me Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/mac80211/ibss.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/net/mac80211/ibss.c +++ b/net/mac80211/ibss.c @@ -544,6 +544,10 @@ int ieee80211_ibss_finish_csa(struct iee =20 sdata_assert_lock(sdata); =20 + /* When not connected/joined, sending CSA doesn't make sense. */ + if (ifibss->state !=3D IEEE80211_IBSS_MLME_JOINED) + return -ENOLINK; + /* update cfg80211 bss information with the new channel */ if (!is_zero_ether_addr(ifibss->bssid)) { cbss =3D cfg80211_get_bss(sdata->local->hw.wiphy, From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77515C54EE9 for ; Tue, 13 Sep 2022 16:26:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231252AbiIMQ0I (ORCPT ); Tue, 13 Sep 2022 12:26:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58472 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230089AbiIMQZh (ORCPT ); Tue, 13 Sep 2022 12:25:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2A4EAA3FD; Tue, 13 Sep 2022 08:20:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C6524614EC; Tue, 13 Sep 2022 14:36:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DBCB2C433D7; Tue, 13 Sep 2022 14:36:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079807; bh=JYuxi9O3FdJnifusqhvtJkC+4XphOyrht8mntGp0LCI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lNHxiGUxe2YxoN7gLRFklohgWuvT6FRkelY+fYchztdB+vpOnRkLWuI466/Spl/vr mppfY22RZZWkZgO2xmQzRXQvBYtYDTrurheLnmJOj2PNwSM02fts6YX2ca9fYMf5EI uSQeEGgJH5gN40KHGzY0R5EUTCe0UN1CtZntu/6U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miquel Raynal , Stefan Schmidt Subject: [PATCH 4.9 20/42] net: mac802154: Fix a condition in the receive path Date: Tue, 13 Sep 2022 16:07:51 +0200 Message-Id: <20220913140343.292944929@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miquel Raynal commit f0da47118c7e93cdbbc6fb403dd729a5f2c90ee3 upstream. Upon reception, a packet must be categorized, either it's destination is the host, or it is another host. A packet with no destination addressing fields may be valid in two situations: - the packet has no source field: only ACKs are built like that, we consider the host as the destination. - the packet has a valid source field: it is directed to the PAN coordinator, as for know we don't have this information we consider we are not the PAN coordinator. There was likely a copy/paste error made during a previous cleanup because the if clause is now containing exactly the same condition as in the switch case, which can never be true. In the past the destination address was used in the switch and the source address was used in the if, which matches what the spec says. Cc: stable@vger.kernel.org Fixes: ae531b9475f6 ("ieee802154: use ieee802154_addr instead of *_sa varia= nts") Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20220826142954.254853-1-miquel.raynal@bootl= in.com Signed-off-by: Stefan Schmidt Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/mac802154/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/mac802154/rx.c +++ b/net/mac802154/rx.c @@ -52,7 +52,7 @@ ieee802154_subif_frame(struct ieee802154 =20 switch (mac_cb(skb)->dest.mode) { case IEEE802154_ADDR_NONE: - if (mac_cb(skb)->dest.mode !=3D IEEE802154_ADDR_NONE) + if (hdr->source.mode !=3D IEEE802154_ADDR_NONE) /* FIXME: check if we are PAN coordinator */ skb->pkt_type =3D PACKET_OTHERHOST; else From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2B45C54EE9 for ; Tue, 13 Sep 2022 15:45:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234471AbiIMPpd (ORCPT ); Tue, 13 Sep 2022 11:45:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45218 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234609AbiIMPor (ORCPT ); Tue, 13 Sep 2022 11:44:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A8B1540555; Tue, 13 Sep 2022 07:48:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3E7C7614EF; Tue, 13 Sep 2022 14:36:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5073DC433D6; Tue, 13 Sep 2022 14:36:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079809; bh=+XPBrIOIZ3AEbHVdiyGfUYR8D1RWCPPH5kCaPunTPDE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oEXoUr7GVMYKlCG8iFevTanV3TAPWuOjl8JFe5z1EHP1Brgp5vIf0PAO6ELPEL717 R7DAv6IAnWru5c0PNviE37HkiRN+AxxdnRXCgnFsV7va6NAkanw5M1EQ8F0LgpoOQ+ zBjz+Iz9/NP//psP+E3aFcP3T8NwoB+IDP3mmZCw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Abhishek Shah , Takashi Iwai Subject: [PATCH 4.9 21/42] ALSA: seq: oss: Fix data-race for max_midi_devs access Date: Tue, 13 Sep 2022 16:07:52 +0200 Message-Id: <20220913140343.344878143@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 22dec134dbfa825b963f8a1807ad19b943e46a56 upstream. ALSA OSS sequencer refers to a global variable max_midi_devs at creating a new port, storing it to its own field. Meanwhile this variable may be changed by other sequencer events at snd_seq_oss_midi_check_exit_port() in parallel, which may cause a data race. OTOH, this data race itself is almost harmless, as the access to the MIDI device is done via get_mdev() and it's protected with a refcount, hence its presence is guaranteed. Though, it's sill better to address the data-race from the code sanity POV, and this patch adds the proper spinlock for the protection. Reported-by: Abhishek Shah Cc: Link: https://lore.kernel.org/r/CAEHB2493pZRXs863w58QWnUTtv3HHfg85aYhLn5HJH= CwxqtHQg@mail.gmail.com Link: https://lore.kernel.org/r/20220823072717.1706-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- sound/core/seq/oss/seq_oss_midi.c | 2 ++ 1 file changed, 2 insertions(+) --- a/sound/core/seq/oss/seq_oss_midi.c +++ b/sound/core/seq/oss/seq_oss_midi.c @@ -280,7 +280,9 @@ snd_seq_oss_midi_clear_all(void) void snd_seq_oss_midi_setup(struct seq_oss_devinfo *dp) { + spin_lock_irq(®ister_lock); dp->max_mididev =3D max_midi_devs; + spin_unlock_irq(®ister_lock); } =20 /* From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F94EC54EE9 for ; Tue, 13 Sep 2022 15:31:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234668AbiIMPbc (ORCPT ); Tue, 13 Sep 2022 11:31:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49466 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236689AbiIMP3Y (ORCPT ); Tue, 13 Sep 2022 11:29:24 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 50186E2D; Tue, 13 Sep 2022 07:39:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 06796B80F91; Tue, 13 Sep 2022 14:38:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6D396C433C1; Tue, 13 Sep 2022 14:38:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079885; bh=2jMSUEghuLlu/1D6x2idR7tJj/F/ZgljozPqFgP5Eq4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=y3HqdwspAoKvlwfWPCbQg56Ujfs3lWcsDTmqw6X+tclWtSiPU8Wsfkn4zg7yhg+xr OtLeNAEr9/VgPiSQGexhdLlR1BPXXEEh00VKdSBCToKf1FBCa/reYWRsIiDbobLEJF frPq7NQQxKVZX0L0VaWoMGWwba+rgxJmzFUz0xE4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Abhishek Shah , Takashi Iwai Subject: [PATCH 4.9 22/42] ALSA: seq: Fix data-race at module auto-loading Date: Tue, 13 Sep 2022 16:07:53 +0200 Message-Id: <20220913140343.398413497@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 3e7e04b747adea36f349715d9f0998eeebf15d72 upstream. It's been reported that there is a possible data-race accessing to the global card_requested[] array at ALSA sequencer core, which is used for determining whether to call request_module() for the card or not. This data race itself is almost harmless, as it might end up with one extra request_module() call for the already loaded module at most. But it's still better to fix. This patch addresses the possible data race of card_requested[] and client_requested[] arrays by replacing them with bitmask. It's an atomic operation and can work without locks. Reported-by: Abhishek Shah Cc: Link: https://lore.kernel.org/r/CAEHB24_ay6YzARpA1zgCsE7=3DH9CSJJzux618E=3D= Ka4h0YdKn=3DqA@mail.gmail.com Link: https://lore.kernel.org/r/20220823072717.1706-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- sound/core/seq/seq_clientmgr.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -136,13 +136,13 @@ struct snd_seq_client *snd_seq_client_us spin_unlock_irqrestore(&clients_lock, flags); #ifdef CONFIG_MODULES if (!in_interrupt()) { - static char client_requested[SNDRV_SEQ_GLOBAL_CLIENTS]; - static char card_requested[SNDRV_CARDS]; + static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS); + static DECLARE_BITMAP(card_requested, SNDRV_CARDS); + if (clientid < SNDRV_SEQ_GLOBAL_CLIENTS) { int idx; =09 - if (!client_requested[clientid]) { - client_requested[clientid] =3D 1; + if (!test_and_set_bit(clientid, client_requested)) { for (idx =3D 0; idx < 15; idx++) { if (seq_client_load[idx] < 0) break; @@ -157,10 +157,8 @@ struct snd_seq_client *snd_seq_client_us int card =3D (clientid - SNDRV_SEQ_GLOBAL_CLIENTS) / SNDRV_SEQ_CLIENTS_PER_CARD; if (card < snd_ecards_limit) { - if (! card_requested[card]) { - card_requested[card] =3D 1; + if (!test_and_set_bit(card, card_requested)) snd_request_card(card); - } snd_seq_device_load_drivers(); } } From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47B05C54EE9 for ; Tue, 13 Sep 2022 15:29:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236353AbiIMP34 (ORCPT ); Tue, 13 Sep 2022 11:29:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46646 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236383AbiIMP2K (ORCPT ); Tue, 13 Sep 2022 11:28:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 638FF7E006; Tue, 13 Sep 2022 07:39:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DB5BDB81015; Tue, 13 Sep 2022 14:37:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A768C433D6; Tue, 13 Sep 2022 14:37:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079832; bh=j3mm+5ftkKBM9jkSvpuIjuAE+kdUVLGUV9i9lxkAxOc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SmT2ncFNxzVObi7P4Ni9hnfoPMCwnHIa0vbXnMCkcRaDVT+F04WVLlMA+xKN3ptbi 11vMEGPKGOecPRE3M1RYVTrMhrt1eFvYLFZuJNo4/TCVt6NM2nuX7NXT6uZdUKBBCv PtKJXJD213fzO3Iks/I4IO+ik+00PLkEvZOjPJDI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Fengwei Yin , Mikulas Patocka , "Matthew Wilcox (Oracle)" , stable@kernel.org, Linus Torvalds Subject: [PATCH 4.9 23/42] fs: only do a memory barrier for the first set_buffer_uptodate() Date: Tue, 13 Sep 2022 16:07:54 +0200 Message-Id: <20220913140343.461661642@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Torvalds commit 2f79cdfe58c13949bbbb65ba5926abfe9561d0ec upstream. Commit d4252071b97d ("add barriers to buffer_uptodate and set_buffer_uptodate") added proper memory barriers to the buffer head BH_Uptodate bit, so that anybody who tests a buffer for being up-to-date will be guaranteed to actually see initialized state. However, that commit didn't _just_ add the memory barrier, it also ended up dropping the "was it already set" logic that the BUFFER_FNS() macro had. That's conceptually the right thing for a generic "this is a memory barrier" operation, but in the case of the buffer contents, we really only care about the memory barrier for the _first_ time we set the bit, in that the only memory ordering protection we need is to avoid anybody seeing uninitialized memory contents. Any other access ordering wouldn't be about the BH_Uptodate bit anyway, and would require some other proper lock (typically BH_Lock or the folio lock). A reader that races with somebody invalidating the buffer head isn't an issue wrt the memory ordering, it's a serialization issue. Now, you'd think that the buffer head operations don't matter in this day and age (and I certainly thought so), but apparently some loads still end up being heavy users of buffer heads. In particular, the kernel test robot reported that not having this bit access optimization in place caused a noticeable direct IO performance regression on ext4: fxmark.ssd_ext4_no_jnl_DWTL_54_directio.works/sec -26.5% regression although you presumably need a fast disk and a lot of cores to actually notice. Link: https://lore.kernel.org/all/Yw8L7HTZ%2FdE2%2Fo9C@xsang-OptiPlex-9020/ Reported-by: kernel test robot Tested-by: Fengwei Yin Cc: Mikulas Patocka Cc: Matthew Wilcox (Oracle) Cc: stable@kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- include/linux/buffer_head.h | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@ -133,6 +133,17 @@ BUFFER_FNS(Defer_Completion, defer_compl static __always_inline void set_buffer_uptodate(struct buffer_head *bh) { /* + * If somebody else already set this uptodate, they will + * have done the memory barrier, and a reader will thus + * see *some* valid buffer state. + * + * Any other serialization (with IO errors or whatever that + * might clear the bit) has to come from other state (eg BH_Lock). + */ + if (test_bit(BH_Uptodate, &bh->b_state)) + return; + + /* * make it consistent with folio_mark_uptodate * pairs with smp_load_acquire in buffer_uptodate */ From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7940C54EE9 for ; Tue, 13 Sep 2022 15:45:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231448AbiIMPpZ (ORCPT ); Tue, 13 Sep 2022 11:45:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57558 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235839AbiIMPog (ORCPT ); Tue, 13 Sep 2022 11:44:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8CE042ACA; Tue, 13 Sep 2022 07:48:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5058B614A3; Tue, 13 Sep 2022 14:37:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69395C433C1; Tue, 13 Sep 2022 14:37:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079861; bh=3mnMXcJ1JR2zRL724pWgzy9GrDeUP+GY3DLcHW2IKn4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TQqp0QizyqjisFo01CiqSjHFZEIBFkZqSW/HFbmqUY+q/WTa9s6MLf+NnhN/0g8EM 7bXbf3sLG/2xDKrBFjHEfhEA2NYbCmu6N7+phqdZyHPeFprY5FG5V+yjYc2C6dXW/I U5XSIxvGybZKxawkvrlKFlLCrGTFHjJmr8EBXDa8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yee Lee Subject: [PATCH 4.9 24/42] Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" Date: Tue, 13 Sep 2022 16:07:55 +0200 Message-Id: <20220913140343.512632876@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yee Lee This reverts commit 23c2d497de21f25898fbea70aeb292ab8acc8c94. Commit 23c2d497de21 ("mm: kmemleak: take a full lowmem check in kmemleak_*_phys()") brought false leak alarms on some archs like arm64 that does not init pfn boundary in early booting. The final solution lands on linux-6.0: commit 0c24e061196c ("mm: kmemleak: add rbtree and store physical address for objects allocated with PA"). Revert this commit before linux-6.0. The original issue of invalid PA can be mitigated by additional check in devicetree. The false alarm report is as following: Kmemleak output: (Qemu/arm64) unreferenced object 0xffff0000c0170a00 (size 128): comm "swapper/0", pid 1, jiffies 4294892404 (age 126.208s) hex dump (first 32 bytes): 62 61 73 65 00 00 00 00 00 00 00 00 00 00 00 00 base............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<(____ptrval____)>] __kmalloc_track_caller+0x1b0/0x2e4 [<(____ptrval____)>] kstrdup_const+0x8c/0xc4 [<(____ptrval____)>] kvasprintf_const+0xbc/0xec [<(____ptrval____)>] kobject_set_name_vargs+0x58/0xe4 [<(____ptrval____)>] kobject_add+0x84/0x100 [<(____ptrval____)>] __of_attach_node_sysfs+0x78/0xec [<(____ptrval____)>] of_core_init+0x68/0x104 [<(____ptrval____)>] driver_init+0x28/0x48 [<(____ptrval____)>] do_basic_setup+0x14/0x28 [<(____ptrval____)>] kernel_init_freeable+0x110/0x178 [<(____ptrval____)>] kernel_init+0x20/0x1a0 [<(____ptrval____)>] ret_from_fork+0x10/0x20 This pacth is also applicable to linux-5.17.y/linux-5.18.y/linux-5.19.y Cc: Signed-off-by: Yee Lee Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- mm/kmemleak.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/mm/kmemleak.c +++ b/mm/kmemleak.c @@ -1130,7 +1130,7 @@ EXPORT_SYMBOL(kmemleak_no_scan); void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_coun= t, gfp_t gfp) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_alloc(__va(phys), size, min_count, gfp); } EXPORT_SYMBOL(kmemleak_alloc_phys); @@ -1141,7 +1141,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys); */ void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_free_part(__va(phys), size); } EXPORT_SYMBOL(kmemleak_free_part_phys); @@ -1152,7 +1152,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys); */ void __ref kmemleak_not_leak_phys(phys_addr_t phys) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_not_leak(__va(phys)); } EXPORT_SYMBOL(kmemleak_not_leak_phys); @@ -1163,7 +1163,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys); */ void __ref kmemleak_ignore_phys(phys_addr_t phys) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_ignore(__va(phys)); } EXPORT_SYMBOL(kmemleak_ignore_phys); From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1A83C6FA82 for ; Tue, 13 Sep 2022 15:31:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236557AbiIMPbE (ORCPT ); Tue, 13 Sep 2022 11:31:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45650 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236571AbiIMP3I (ORCPT ); Tue, 13 Sep 2022 11:29:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 88D985B796; Tue, 13 Sep 2022 07:39:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5DE6EB81029; Tue, 13 Sep 2022 14:37:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B4541C433C1; Tue, 13 Sep 2022 14:37:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079867; bh=b06b0l8kwYRi7e3XNh/w/6ReSmTYreK4a3sgVSKi4b4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uX2LYjWFbGoU/6tg7CaLR72UD9Srw4SmEUp2MFCln4fu3b3OTiOoO4wkND/3kk8pR RsnpOmLPL+1ATNtTpneM59GaL2HEM8p1I7QJx8eQ8gz23fLcj9ZAkejCkWmOnB7vbp l4NHAk/Ul0ft4K9hdu3inpi8ED2+5w5bGe7X0+NY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Christian=20K=C3=B6nig?= , Zhenneng Li , Alex Deucher , Sasha Levin Subject: [PATCH 4.9 25/42] drm/radeon: add a force flush to delay work when radeon Date: Tue, 13 Sep 2022 16:07:56 +0200 Message-Id: <20220913140343.578497793@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Zhenneng Li [ Upstream commit f461950fdc374a3ada5a63c669d997de4600dffe ] Although radeon card fence and wait for gpu to finish processing current ba= tch rings, there is still a corner case that radeon lockup work queue may not be fully= flushed, and meanwhile the radeon_suspend_kms() function has called pci_set_power_st= ate() to put device in D3hot state. Per PCI spec rev 4.0 on 5.3.1.4.1 D3hot State. > Configuration and Message requests are the only TLPs accepted by a Functi= on in > the D3hot state. All other received Requests must be handled as Unsupport= ed Requests, > and all received Completions may optionally be handled as Unexpected Comp= letions. This issue will happen in following logs: Unable to handle kernel paging request at virtual address 00008800e0008010 CPU 0 kworker/0:3(131): Oops 0 pc =3D [] ra =3D [] ps =3D 0000 Taint= ed: G W pc is at si_gpu_check_soft_reset+0x3c/0x240 ra is at si_dma_is_lockup+0x34/0xd0 v0 =3D 0000000000000000 t0 =3D fff08800e0008010 t1 =3D 0000000000010000 t2 =3D 0000000000008010 t3 =3D fff00007e3c00000 t4 =3D fff00007e3c00258 t5 =3D 000000000000ffff t6 =3D 0000000000000001 t7 =3D fff00007ef078000 s0 =3D fff00007e3c016e8 s1 =3D fff00007e3c00000 s2 =3D fff00007e3c00018 s3 =3D fff00007e3c00000 s4 =3D fff00007fff59d80 s5 =3D 0000000000000000 s6 =3D fff00007ef07bd98 a0 =3D fff00007e3c00000 a1 =3D fff00007e3c016e8 a2 =3D 0000000000000008 a3 =3D 0000000000000001 a4 =3D 8f5c28f5c28f5c29 a5 =3D ffffffff810f4338 t8 =3D 0000000000000275 t9 =3D ffffffff809b66f8 t10 =3D ff6769c5d964b800 t11=3D 000000000000b886 pv =3D ffffffff811bea20 at =3D 0000000000000000 gp =3D ffffffff81d89690 sp =3D 00000000aa814126 Disabling lock debugging due to kernel taint Trace: [] si_dma_is_lockup+0x34/0xd0 [] radeon_fence_check_lockup+0xd0/0x290 [] process_one_work+0x280/0x550 [] worker_thread+0x70/0x7c0 [] worker_thread+0x130/0x7c0 [] kthread+0x200/0x210 [] worker_thread+0x0/0x7c0 [] kthread+0x14c/0x210 [] ret_from_kernel_thread+0x18/0x20 [] kthread+0x0/0x210 Code: ad3e0008 43f0074a ad7e0018 ad9e0020 8c3001e8 40230101 <88210000> 4821ed21 So force lockup work queue flush to fix this problem. Acked-by: Christian K=C3=B6nig Signed-off-by: Zhenneng Li Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/gpu/drm/radeon/radeon_device.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeo= n/radeon_device.c index 82b01123c3868..227c4733de2ea 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c @@ -1661,6 +1661,9 @@ int radeon_suspend_kms(struct drm_device *dev, bool s= uspend, if (r) { /* delay GPU reset to resume */ radeon_fence_driver_force_completion(rdev, i); + } else { + /* finish executing delayed work */ + flush_delayed_work(&rdev->fence_drv[i].lockup_work); } } =20 --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AAD2EC6FA82 for ; Tue, 13 Sep 2022 15:26:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236364AbiIMP0U (ORCPT ); Tue, 13 Sep 2022 11:26:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58494 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236233AbiIMPX4 (ORCPT ); Tue, 13 Sep 2022 11:23:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 65C857CABE; Tue, 13 Sep 2022 07:37:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0D2DE614C1; Tue, 13 Sep 2022 14:37:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 26FB6C433D6; Tue, 13 Sep 2022 14:37:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079869; bh=Y5wq0g3mZu2wF+NTvQYKTtZ113Sd6gEawyb/vEOcDYk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mnbyvfa6BlsF0KBYA2oIX7ZL0D5DyF0LHP3pm2QsFOLqaeBm0gul5U9NEAWc70DLd gnSXnKPIBrOhKYcQhztVmaD9SxCOarfqGhN3fUHhkXPM8TMn2XeNWKNdP9GNoed65m kM5NEKy77euIcHADu2NPt3wq6cT6GfzRmmtafyco= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Li Qiong , Helge Deller , Sasha Levin Subject: [PATCH 4.9 26/42] parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources() Date: Tue, 13 Sep 2022 16:07:57 +0200 Message-Id: <20220913140343.634106854@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Li Qiong [ Upstream commit d46c742f827fa2326ab1f4faa1cccadb56912341 ] As the possible failure of the kmalloc(), it should be better to fix this error path, check and return '-ENOMEM' error code. Signed-off-by: Li Qiong Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/parisc/ccio-dma.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c index f6ef5952e94b3..633762f8d7755 100644 --- a/drivers/parisc/ccio-dma.c +++ b/drivers/parisc/ccio-dma.c @@ -1408,15 +1408,17 @@ ccio_init_resource(struct resource *res, char *name= , void __iomem *ioaddr) } } =20 -static void __init ccio_init_resources(struct ioc *ioc) +static int __init ccio_init_resources(struct ioc *ioc) { struct resource *res =3D ioc->mmio_region; char *name =3D kmalloc(14, GFP_KERNEL); - + if (unlikely(!name)) + return -ENOMEM; snprintf(name, 14, "GSC Bus [%d/]", ioc->hw_path); =20 ccio_init_resource(res, name, &ioc->ioc_regs->io_io_low); ccio_init_resource(res + 1, name, &ioc->ioc_regs->io_io_low_hv); + return 0; } =20 static int new_ioc_area(struct resource *res, unsigned long size, @@ -1566,7 +1568,10 @@ static int __init ccio_probe(struct parisc_device *d= ev) ioc->hw_path =3D dev->hw_path; ioc->ioc_regs =3D ioremap_nocache(dev->hpa.start, 4096); ccio_ioc_init(ioc); - ccio_init_resources(ioc); + if (ccio_init_resources(ioc)) { + kfree(ioc); + return -ENOMEM; + } hppa_dma_ops =3D &ccio_ops; dev->dev.platform_data =3D kzalloc(sizeof(struct pci_hba_data), GFP_KERNE= L); =20 --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 02E01C54EE9 for ; Tue, 13 Sep 2022 15:31:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236587AbiIMPbS (ORCPT ); Tue, 13 Sep 2022 11:31:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46544 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236611AbiIMP3N (ORCPT ); Tue, 13 Sep 2022 11:29:13 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0C6C86CD17; Tue, 13 Sep 2022 07:39:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7847DB81025; Tue, 13 Sep 2022 14:37:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CEFF0C433B5; Tue, 13 Sep 2022 14:37:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079872; bh=0cH85VvIYBOZ+pBLS98yG/BMwMyFTJk/yyn7iuR9B+E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pCwvpqoHc+i8eQz6qgJPmroQ88KWWJR5o0KM3SaoFDhY31cYRGjaFjTfqoALZCcqR Z0IiLpLSXtp0U69ia9urwgP0wEEtkkJ9wBxww9PXjI/tX00fy994KCIvLtgz95/XFY 0DyoYzXu9qCP8KcKGvh1oGxLmnRH+C6VFRyim6j0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller , Sasha Levin Subject: [PATCH 4.9 27/42] parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines Date: Tue, 13 Sep 2022 16:07:58 +0200 Message-Id: <20220913140343.691058185@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller [ Upstream commit 591d2108f3abc4db9f9073cae37cf3591fd250d6 ] If a 32-bit kernel was compiled for PA2.0 CPUs, it won't be able to run on machines with PA1.x CPUs. Add a check and bail out early if a PA1.x machine is detected. Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- arch/parisc/kernel/head.S | 43 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-) diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S index 9b99eb0712ad1..2f570a5205866 100644 --- a/arch/parisc/kernel/head.S +++ b/arch/parisc/kernel/head.S @@ -22,7 +22,7 @@ #include #include =20 - .level PA_ASM_LEVEL + .level 1.1 =20 __INITDATA ENTRY(boot_args) @@ -69,6 +69,47 @@ $bss_loop: stw,ma %arg2,4(%r1) stw,ma %arg3,4(%r1) =20 +#if !defined(CONFIG_64BIT) && defined(CONFIG_PA20) + /* This 32-bit kernel was compiled for PA2.0 CPUs. Check current CPU + * and halt kernel if we detect a PA1.x CPU. */ + ldi 32,%r10 + mtctl %r10,%cr11 + .level 2.0 + mfctl,w %cr11,%r10 + .level 1.1 + comib,<>,n 0,%r10,$cpu_ok + + load32 PA(msg1),%arg0 + ldi msg1_end-msg1,%arg1 +$iodc_panic: + copy %arg0, %r10 + copy %arg1, %r11 + load32 PA(init_stack),%sp +#define MEM_CONS 0x3A0 + ldw MEM_CONS+32(%r0),%arg0 // HPA + ldi ENTRY_IO_COUT,%arg1 + ldw MEM_CONS+36(%r0),%arg2 // SPA + ldw MEM_CONS+8(%r0),%arg3 // layers + load32 PA(__bss_start),%r1 + stw %r1,-52(%sp) // arg4 + stw %r0,-56(%sp) // arg5 + stw %r10,-60(%sp) // arg6 =3D ptr to text + stw %r11,-64(%sp) // arg7 =3D len + stw %r0,-68(%sp) // arg8 + load32 PA(.iodc_panic_ret), %rp + ldw MEM_CONS+40(%r0),%r1 // ENTRY_IODC + bv,n (%r1) +.iodc_panic_ret: + b . /* wait endless with ... */ + or %r10,%r10,%r10 /* qemu idle sleep */ +msg1: .ascii "Can't boot kernel which was built for PA8x00 CPUs on this ma= chine.\r\n" +msg1_end: + +$cpu_ok: +#endif + + .level PA_ASM_LEVEL + /* Initialize startup VM. Just map first 16/32 MB of memory */ load32 PA(swapper_pg_dir),%r4 mtctl %r4,%cr24 /* Initialize kernel root pointer */ --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89CAEC54EE9 for ; Tue, 13 Sep 2022 15:26:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236349AbiIMP0h (ORCPT ); Tue, 13 Sep 2022 11:26:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56660 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236319AbiIMPYN (ORCPT ); Tue, 13 Sep 2022 11:24:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8F3117C1D1; Tue, 13 Sep 2022 07:37:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3E9E9614A1; Tue, 13 Sep 2022 14:37:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A938C433D6; Tue, 13 Sep 2022 14:37:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079874; bh=tjMui3/sZ+L+ZhPIM7/IALO8nmLeCVVbPByfLgaGHUs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IHw+Cu8Q1Gr71ARTp20ttInULCmYt1GTit4lM82aibug2aw5/F5cloQaOYfaIH0SK qxdnUyUId5+jjVC1yRpEdA/E3Db7Wh7wJdysl3OLlrdg9AkqGbshRhF5tRrvWENaso AQOUBc3euEYcfTgfiU+vH9za8ip+9Xuw1gJkZXDc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Yingliang , Helge Deller , Sasha Levin Subject: [PATCH 4.9 28/42] fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() Date: Tue, 13 Sep 2022 16:07:59 +0200 Message-Id: <20220913140343.751986286@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang [ Upstream commit 07c55c9803dea748d17a054000cbf1913ce06399 ] Add missing pci_disable_device() in error path in chipsfb_pci_init(). Signed-off-by: Yang Yingliang Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/video/fbdev/chipsfb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c index 84a3778552eba..ec1f8af165e9e 100644 --- a/drivers/video/fbdev/chipsfb.c +++ b/drivers/video/fbdev/chipsfb.c @@ -432,6 +432,7 @@ static int chipsfb_pci_init(struct pci_dev *dp, const s= truct pci_device_id *ent) err_release_fb: framebuffer_release(p); err_disable: + pci_disable_device(dp); err_out: return rc; } --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21764ECAAD8 for ; Tue, 13 Sep 2022 17:46:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233427AbiIMRqY (ORCPT ); Tue, 13 Sep 2022 13:46:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41884 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233365AbiIMRqA (ORCPT ); Tue, 13 Sep 2022 13:46:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6969F6DFA2; Tue, 13 Sep 2022 09:41:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AE8EC614B2; Tue, 13 Sep 2022 14:37:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C635BC433C1; Tue, 13 Sep 2022 14:37:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079877; bh=9BgiPP6OCpWvSkGqFHD61EJ8AiegDO/o1o7/clXSep4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=umO5zN1zmYJMY1PU/oCfjH1xV5sYAYSjY/ENk+j1lb1w6zAKWxqqUqklQqBSExBUr fyNxWyXzA99+V+3zGBXFHIoFFrZOlzML2k+1Mpi82ZrvofmuqNTk8RfGmilHkLd+DU gAi34GBwfWhhBG/ApE53eTDNRUwd5tfLna+tX+Yk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tasos Sahanidis , Takashi Iwai Subject: [PATCH 4.9 29/42] ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() Date: Tue, 13 Sep 2022 16:08:00 +0200 Message-Id: <20220913140343.802205913@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tasos Sahanidis commit d29f59051d3a07b81281b2df2b8c9dfe4716067f upstream. The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around. This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur. This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=3DLive,DEV=3D3 -c 16 /dev/zero UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k= 1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 = 07/22/2010 Call Trace: dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Signed-off-by: Tasos Sahanidis Cc: Link: https://lore.kernel.org/r/3707dcab-320a-62ff-63c0-73fc201ef756@tasoss= ah.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- sound/pci/emu10k1/emupcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/pci/emu10k1/emupcm.c +++ b/sound/pci/emu10k1/emupcm.c @@ -137,7 +137,7 @@ static int snd_emu10k1_pcm_channel_alloc epcm->voices[0]->epcm =3D epcm; if (voices > 1) { for (i =3D 1; i < voices; i++) { - epcm->voices[i] =3D &epcm->emu->voices[epcm->voices[0]->number + i]; + epcm->voices[i] =3D &epcm->emu->voices[(epcm->voices[0]->number + i) % = NUM_G]; epcm->voices[i]->epcm =3D epcm; } } From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89135C6FA82 for ; Tue, 13 Sep 2022 15:31:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236604AbiIMPbV (ORCPT ); Tue, 13 Sep 2022 11:31:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36514 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236618AbiIMP3O (ORCPT ); Tue, 13 Sep 2022 11:29:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5FF046CD26; Tue, 13 Sep 2022 07:39:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7F055B8101F; Tue, 13 Sep 2022 14:38:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D00E1C433D6; Tue, 13 Sep 2022 14:37:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079880; bh=c+8isZ6YTFjQhAE68z6WOk1AgkqlsJDOpn1OWpRm7yg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sLtMoaSa9OBnb0sOkOxe+x6Y4u4Q7Pf7NqkUDefXDML1QacdQLQnwv9sZLNzjHp/h MrvJdGrvCY1AbQQTrGMoG0CHSzLSFz0YlFmzM8LejNCPF3yrwy01RkSJ+py5INy9kQ v3CDZdUNO6KJnYv8sPkIrRA/v364Mm+fLutbD+HI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pattara Teerapong , Takashi Iwai Subject: [PATCH 4.9 30/42] ALSA: aloop: Fix random zeros in capture data when using jiffies timer Date: Tue, 13 Sep 2022 16:08:01 +0200 Message-Id: <20220913140343.856407916@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pattara Teerapong commit 3e48940abee88b8dbbeeaf8a07e7b2b6be1271b3 upstream. In loopback_jiffies_timer_pos_update(), we are getting jiffies twice. First time for playback, second time for capture. Jiffies can be updated between these two calls and if the capture jiffies is larger, extra zeros will be filled in the capture buffer. Change to get jiffies once and use it for both playback and capture. Signed-off-by: Pattara Teerapong Cc: Link: https://lore.kernel.org/r/20220901144036.4049060-1-pteerapong@chromiu= m.org Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- sound/drivers/aloop.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/sound/drivers/aloop.c +++ b/sound/drivers/aloop.c @@ -477,17 +477,18 @@ static unsigned int loopback_pos_update( cable->streams[SNDRV_PCM_STREAM_PLAYBACK]; struct loopback_pcm *dpcm_capt =3D cable->streams[SNDRV_PCM_STREAM_CAPTURE]; - unsigned long delta_play =3D 0, delta_capt =3D 0; + unsigned long delta_play =3D 0, delta_capt =3D 0, cur_jiffies; unsigned int running, count1, count2; =20 + cur_jiffies =3D jiffies; running =3D cable->running ^ cable->pause; if (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) { - delta_play =3D jiffies - dpcm_play->last_jiffies; + delta_play =3D cur_jiffies - dpcm_play->last_jiffies; dpcm_play->last_jiffies +=3D delta_play; } =20 if (running & (1 << SNDRV_PCM_STREAM_CAPTURE)) { - delta_capt =3D jiffies - dpcm_capt->last_jiffies; + delta_capt =3D cur_jiffies - dpcm_capt->last_jiffies; dpcm_capt->last_jiffies +=3D delta_capt; } From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89260C54EE9 for ; Tue, 13 Sep 2022 15:32:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236608AbiIMPcI (ORCPT ); Tue, 13 Sep 2022 11:32:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43150 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236610AbiIMPbZ (ORCPT ); Tue, 13 Sep 2022 11:31:25 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 617787DF71; Tue, 13 Sep 2022 07:40:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BE86E614AE; Tue, 13 Sep 2022 14:38:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1471C43143; Tue, 13 Sep 2022 14:38:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079883; bh=sZQYElcGS/DOQWicjtPM/97X2vpvcYwfPlGU+gxOP9w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e13lwEDcR6QS1to75aAob5WPqUSFs323ZQXgv/QgGWNvv1rKlbGUCmlsPMQY52pJv d8gjpjf6pC9JsHb0Lhrc7M8X4ZofUvCdnbm4l9g2431Oq4W/edUqsoyDulv+B4VFmo tzqZ34SXxeTsuMrQA+Zfwu3Lz2ZJjewdvk0oXYuU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dongxiang Ke , Takashi Iwai Subject: [PATCH 4.9 31/42] ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() Date: Tue, 13 Sep 2022 16:08:02 +0200 Message-Id: <20220913140343.923046119@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dongxiang Ke commit e53f47f6c1a56d2af728909f1cb894da6b43d9bf upstream. There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces. Signed-off-by: Dongxiang Ke Link: https://lore.kernel.org/r/20220906024928.10951-1-kdx.glider@gmail.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- sound/usb/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -502,7 +502,7 @@ int snd_usb_parse_audio_interface(struct * Dallas DS4201 workaround: It presents 5 altsettings, but the last * one misses syncpipe, and does not produce any sound. */ - if (chip->usb_id =3D=3D USB_ID(0x04fa, 0x4201)) + if (chip->usb_id =3D=3D USB_ID(0x04fa, 0x4201) && num >=3D 4) num =3D 4; =20 for (i =3D 0; i < num; i++) { From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78FF2C6FA82 for ; Tue, 13 Sep 2022 15:30:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232225AbiIMPaa (ORCPT ); Tue, 13 Sep 2022 11:30:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41560 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236448AbiIMP2m (ORCPT ); Tue, 13 Sep 2022 11:28:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2D0087E024; Tue, 13 Sep 2022 07:39:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 47196B81028; Tue, 13 Sep 2022 14:37:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BEA5BC433D6; Tue, 13 Sep 2022 14:37:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079835; bh=UeHv/2YhX2iYZyWaL3dsktPLTRlG4WzUCdAc14li1Jo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QUU3+9Vuw5hD8iywgKR3wuz1xxzXo+Jwfvw2HGpqKao9x1+N2qHsokTLjmMbDVe++ ENEuORNIcwtasm3/2K1sk/fOK6OBIPX8LhHTeyc6QWZXGmgc5U5Qk/fIJKegsJorpy qJ35XniLHUfB+WTV4ct0WZIEOzrzDdWg1zUqcw7s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sreekanth Reddy , "Martin K. Petersen" Subject: [PATCH 4.9 32/42] scsi: mpt3sas: Fix use-after-free warning Date: Tue, 13 Sep 2022 16:08:03 +0200 Message-Id: <20220913140343.988546211@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sreekanth Reddy commit 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34 upstream. Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6= /0xf0 Link: https://lore.kernel.org/r/20220906134908.1039-2-sreekanth.reddy@broad= com.com Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c @@ -2776,6 +2776,7 @@ static struct fw_event_work *dequeue_nex fw_event =3D list_first_entry(&ioc->fw_event_list, struct fw_event_work, list); list_del_init(&fw_event->list); + fw_event_work_put(fw_event); } spin_unlock_irqrestore(&ioc->fw_event_lock, flags); =20 @@ -2812,7 +2813,6 @@ _scsih_fw_event_cleanup_queue(struct MPT if (cancel_work_sync(&fw_event->work)) fw_event_work_put(fw_event); =20 - fw_event_work_put(fw_event); } } From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2150CC6FA82 for ; Tue, 13 Sep 2022 15:25:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236267AbiIMPZm (ORCPT ); Tue, 13 Sep 2022 11:25:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56892 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235906AbiIMPXP (ORCPT ); Tue, 13 Sep 2022 11:23:15 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E483A7C76C; Tue, 13 Sep 2022 07:37:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 75C4461497; Tue, 13 Sep 2022 14:37:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 800E7C433D6; Tue, 13 Sep 2022 14:37:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079837; bh=UdEWgUayR1c1F44NFCT/U/oo6sgvgxYMIIsL8AFPoV4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fUMFYhyn4iwqshgYfmcVFa9/urkQoHIGPnvV+je3OPXQGm4HEMUos+QEc88HW+iew RdN8KpBE3wUhAiqBWYZW/bIR9tz0z9TFLmfRfuUpaA4HUIKjvua8yNfna02KEqrouG J+vboYAA3sb+A+O+mc0fJJH462HyuGvfYU8zqoSk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Saravana Kannan , Guenter Roeck , Linus Walleij , "Isaac J. Manjarres" Subject: [PATCH 4.9 33/42] driver core: Dont probe devices after bus_type.match() probe deferral Date: Tue, 13 Sep 2022 16:08:04 +0200 Message-Id: <20220913140344.041278326@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Isaac J. Manjarres commit 25e9fbf0fd38868a429feabc38abebfc6dbf6542 upstream. Both __device_attach_driver() and __driver_attach() check the return code of the bus_type.match() function to see if the device needs to be added to the deferred probe list. After adding the device to the list, the logic attempts to bind the device to the driver anyway, as if the device had matched with the driver, which is not correct. If __device_attach_driver() detects that the device in question is not ready to match with a driver on the bus, then it doesn't make sense for the device to attempt to bind with the current driver or continue attempting to match with any of the other drivers on the bus. So, update the logic in __device_attach_driver() to reflect this. If __driver_attach() detects that a driver tried to match with a device that is not ready to match yet, then the driver should not attempt to bind with the device. However, the driver can still attempt to match and bind with other devices on the bus, as drivers can be bound to multiple devices. So, update the logic in __driver_attach() to reflect this. Fixes: 656b8035b0ee ("ARM: 8524/1: driver cohandle -EPROBE_DEFER from bus_t= ype.match()") Cc: stable@vger.kernel.org Cc: Saravana Kannan Reported-by: Guenter Roeck Tested-by: Guenter Roeck Tested-by: Linus Walleij Reviewed-by: Saravana Kannan Signed-off-by: Isaac J. Manjarres Link: https://lore.kernel.org/r/20220817184026.3468620-1-isaacmanjarres@goo= gle.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/base/dd.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -590,6 +590,11 @@ static int __device_attach_driver(struct } else if (ret =3D=3D -EPROBE_DEFER) { dev_dbg(dev, "Device match requests probe deferral\n"); driver_deferred_probe_add(dev); + /* + * Device can't match with a driver right now, so don't attempt + * to match or bind with other drivers on the bus. + */ + return ret; } else if (ret < 0) { dev_dbg(dev, "Bus failed to match device: %d", ret); return ret; @@ -732,6 +737,11 @@ static int __driver_attach(struct device } else if (ret =3D=3D -EPROBE_DEFER) { dev_dbg(dev, "Device match requests probe deferral\n"); driver_deferred_probe_add(dev); + /* + * Driver could not match with device, but may match with + * another device on the bus. + */ + return 0; } else if (ret < 0) { dev_dbg(dev, "Bus failed to match device: %d", ret); return ret; From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 41548C6FA82 for ; Tue, 13 Sep 2022 15:30:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236421AbiIMPaQ (ORCPT ); Tue, 13 Sep 2022 11:30:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236405AbiIMP2Q (ORCPT ); Tue, 13 Sep 2022 11:28:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B75917E02A; Tue, 13 Sep 2022 07:39:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A1923B80FA3; Tue, 13 Sep 2022 14:37:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 00FDCC433D7; Tue, 13 Sep 2022 14:37:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079840; bh=7ZrUN5zfnkKmXyFUuuhSFt6n4LXxlZEioAODx00t/9o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=A7feDNdoQYnqbI0UJkhkDFFy5GzOczs0j5/i6CSfpHTSYWTEefM13gVskCO5V66WX I8nuCFMSqChe8l8/nErlSVZ1VI2kWW/OzKxJdyS9OYw2cv7RVk8z9p2DIPkvAohmOt L/nzp76jeaXo7eFpWmj9x/QBMYMCf32czQbbefpk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Harsh Modi , Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.9 34/42] netfilter: br_netfilter: Drop dst references before setting. Date: Tue, 13 Sep 2022 16:08:05 +0200 Message-Id: <20220913140344.087722465@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Harsh Modi [ Upstream commit d047283a7034140ea5da759a494fd2274affdd46 ] The IPv6 path already drops dst in the daddr changed case, but the IPv4 path does not. This change makes the two code paths consistent. Further, it is possible that there is already a metadata_dst allocated from ingress that might already be attached to skbuff->dst while following the bridge path. If it is not released before setting a new metadata_dst, it will be leaked. This is similar to what is done in bpf_set_tunnel_key() or ip6_route_input(). It is important to note that the memory being leaked is not the dst being set in the bridge code, but rather memory allocated from some other code path that is not being freed correctly before the skb dst is overwritten. An example of the leakage fixed by this commit found using kmemleak: unreferenced object 0xffff888010112b00 (size 256): comm "softirq", pid 0, jiffies 4294762496 (age 32.012s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 80 16 f1 83 ff ff ff ff ................ e1 4e f6 82 ff ff ff ff 00 00 00 00 00 00 00 00 .N.............. backtrace: [<00000000d79567ea>] metadata_dst_alloc+0x1b/0xe0 [<00000000be113e13>] udp_tun_rx_dst+0x174/0x1f0 [<00000000a36848f4>] geneve_udp_encap_recv+0x350/0x7b0 [<00000000d4afb476>] udp_queue_rcv_one_skb+0x380/0x560 [<00000000ac064aea>] udp_unicast_rcv_skb+0x75/0x90 [<000000009a8ee8c5>] ip_protocol_deliver_rcu+0xd8/0x230 [<00000000ef4980bb>] ip_local_deliver_finish+0x7a/0xa0 [<00000000d7533c8c>] __netif_receive_skb_one_core+0x89/0xa0 [<00000000a879497d>] process_backlog+0x93/0x190 [<00000000e41ade9f>] __napi_poll+0x28/0x170 [<00000000b4c0906b>] net_rx_action+0x14f/0x2a0 [<00000000b20dd5d4>] __do_softirq+0xf4/0x305 [<000000003a7d7e15>] __irq_exit_rcu+0xc3/0x140 [<00000000968d39a2>] sysvec_apic_timer_interrupt+0x9e/0xc0 [<000000009e920794>] asm_sysvec_apic_timer_interrupt+0x16/0x20 [<000000008942add0>] native_safe_halt+0x13/0x20 Florian Westphal says: "Original code was likely fine because nothing ever did set a skb->dst entry earlier than bridge in those days." Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Harsh Modi Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/bridge/br_netfilter_hooks.c | 2 ++ net/bridge/br_netfilter_ipv6.c | 1 + 2 files changed, 3 insertions(+) diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hook= s.c index 11d4d18012fed..560a36c68be20 100644 --- a/net/bridge/br_netfilter_hooks.c +++ b/net/bridge/br_netfilter_hooks.c @@ -382,6 +382,7 @@ static int br_nf_pre_routing_finish(struct net *net, st= ruct sock *sk, struct sk_ /* - Bridged-and-DNAT'ed traffic doesn't * require ip_forwarding. */ if (rt->dst.dev =3D=3D dev) { + skb_dst_drop(skb); skb_dst_set(skb, &rt->dst); goto bridged_dnat; } @@ -411,6 +412,7 @@ static int br_nf_pre_routing_finish(struct net *net, st= ruct sock *sk, struct sk_ kfree_skb(skb); return 0; } + skb_dst_drop(skb); skb_dst_set_noref(skb, &rt->dst); } =20 diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c index 8c08dd07419f6..54dcead37dfd0 100644 --- a/net/bridge/br_netfilter_ipv6.c +++ b/net/bridge/br_netfilter_ipv6.c @@ -201,6 +201,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *ne= t, struct sock *sk, struc kfree_skb(skb); return 0; } + skb_dst_drop(skb); skb_dst_set_noref(skb, &rt->dst); } =20 --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 187D7C54EE9 for ; Tue, 13 Sep 2022 15:29:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236338AbiIMP3t (ORCPT ); Tue, 13 Sep 2022 11:29:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59196 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233537AbiIMP2D (ORCPT ); Tue, 13 Sep 2022 11:28:03 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BDB577E00F; Tue, 13 Sep 2022 07:39:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 72883614CA; Tue, 13 Sep 2022 14:37:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83218C433D6; Tue, 13 Sep 2022 14:37:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079842; bh=BLBfV+1nH+k/x9oc66dvDyZereog3bqBuCBlo+jNS6o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zHuEwBfYS7R8klPiny/7bXpjvZ7hLCGxOTTstBILhw5RNag47tYohN9Yn8xubIKm/ 5pEhzqo55VnX1fbaJDinQR8h9dsQQS6+x7CfXc6t7c/S6U/s+wTi50RSIENES0QYQa J95DRxG6Y7RF5YWw7dL5K6kXt2uYjfjUhrTESiaU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Leadbeater , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.9 35/42] netfilter: nf_conntrack_irc: Fix forged IP logic Date: Tue, 13 Sep 2022 16:08:06 +0200 Message-Id: <20220913140344.151883075@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Leadbeater [ Upstream commit 0efe125cfb99e6773a7434f3463f7c2fa28f3a43 ] Ensure the match happens in the right direction, previously the destination used was the server, not the NAT host, as the comment shows the code intended. Additionally nf_nat_irc uses port 0 as a signal and there's no valid way it can appear in a DCC message, so consider port 0 also forged. Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port= ") Signed-off-by: David Leadbeater Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/netfilter/nf_conntrack_irc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_= irc.c index 1972a149f9583..c6a8bdc3a226d 100644 --- a/net/netfilter/nf_conntrack_irc.c +++ b/net/netfilter/nf_conntrack_irc.c @@ -187,8 +187,9 @@ static int help(struct sk_buff *skb, unsigned int proto= ff, =20 /* dcc_ip can be the internal OR external (NAT'ed) IP */ tuple =3D &ct->tuplehash[dir].tuple; - if (tuple->src.u3.ip !=3D dcc_ip && - tuple->dst.u3.ip !=3D dcc_ip) { + if ((tuple->src.u3.ip !=3D dcc_ip && + ct->tuplehash[!dir].tuple.dst.u3.ip !=3D dcc_ip) || + dcc_port =3D=3D 0) { net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n", &tuple->src.u3.ip, &dcc_ip, dcc_port); --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 939ECC6FA82 for ; Tue, 13 Sep 2022 15:26:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236331AbiIMP0L (ORCPT ); Tue, 13 Sep 2022 11:26:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58396 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236212AbiIMPXx (ORCPT ); Tue, 13 Sep 2022 11:23:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E492F7C76D; Tue, 13 Sep 2022 07:37:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DBC4C614B2; Tue, 13 Sep 2022 14:37:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1B8EC433D6; Tue, 13 Sep 2022 14:37:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079845; bh=qp9sJ4HEq5Md2IUIQHJCUdCQwwxXTwpuwjFmU978NYs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yVEGhrlNMOkKBG4dbG+btZzkhZttbSvA3e1lAJl85Oed/lo3jlLz41XjBY3pjZVwm zYHBXk5uClUzS2m+40e4pc7Y9d/o4rky4uZylpqYE4axDcpY1j9A7U1wHLlIyRhwJP lb5cHgblIsM40nsqaZBSng8OgQKwkI/2YeeEc7Hs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , "David S. Miller" , Sasha Levin , zdi-disclosures@trendmicro.com Subject: [PATCH 4.9 36/42] sch_sfb: Dont assume the skb is still around after enqueueing to child Date: Tue, 13 Sep 2022 16:08:07 +0200 Message-Id: <20220913140344.198422215@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Toke H=C3=B8iland-J=C3=B8rgensen [ Upstream commit 9efd23297cca530bb35e1848665805d3fcdd7889 ] The sch_sfb enqueue() routine assumes the skb is still alive after it has been enqueued into a child qdisc, using the data in the skb cb field in the increment_qlen() routine after enqueue. However, the skb may in fact have been freed, causing a use-after-free in this case. In particular, this happens if sch_cake is used as a child of sfb, and the GSO splitting mode of CAKE is enabled (in which case the skb will be split into segments and the original skb freed). Fix this by copying the sfb cb data to the stack before enqueueing the skb, and using this stack copy in increment_qlen() instead of the skb pointer itself. Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18231 Fixes: e13e02a3c68d ("net_sched: SFB flow scheduler") Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/sched/sch_sfb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c index bc176bd48c026..592189427a09f 100644 --- a/net/sched/sch_sfb.c +++ b/net/sched/sch_sfb.c @@ -137,15 +137,15 @@ static void increment_one_qlen(u32 sfbhash, u32 slot,= struct sfb_sched_data *q) } } =20 -static void increment_qlen(const struct sk_buff *skb, struct sfb_sched_dat= a *q) +static void increment_qlen(const struct sfb_skb_cb *cb, struct sfb_sched_d= ata *q) { u32 sfbhash; =20 - sfbhash =3D sfb_hash(skb, 0); + sfbhash =3D cb->hashes[0]; if (sfbhash) increment_one_qlen(sfbhash, 0, q); =20 - sfbhash =3D sfb_hash(skb, 1); + sfbhash =3D cb->hashes[1]; if (sfbhash) increment_one_qlen(sfbhash, 1, q); } @@ -283,6 +283,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, struct sfb_sched_data *q =3D qdisc_priv(sch); struct Qdisc *child =3D q->qdisc; struct tcf_proto *fl; + struct sfb_skb_cb cb; int i; u32 p_min =3D ~0; u32 minqlen =3D ~0; @@ -399,11 +400,12 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qd= isc *sch, } =20 enqueue: + memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); ret =3D qdisc_enqueue(skb, child, to_free); if (likely(ret =3D=3D NET_XMIT_SUCCESS)) { qdisc_qstats_backlog_inc(sch, skb); sch->q.qlen++; - increment_qlen(skb, q); + increment_qlen(&cb, q); } else if (net_xmit_drop_count(ret)) { q->stats.childdrop++; qdisc_qstats_drop(sch); --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23D51C6FA82 for ; Tue, 13 Sep 2022 15:25:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231860AbiIMPZq (ORCPT ); Tue, 13 Sep 2022 11:25:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55624 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236134AbiIMPXl (ORCPT ); Tue, 13 Sep 2022 11:23:41 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6597D7C305; Tue, 13 Sep 2022 07:37:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 69C2B614D6; Tue, 13 Sep 2022 14:37:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 779A4C433D6; Tue, 13 Sep 2022 14:37:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079847; bh=4+equcMSVsvlDigrHSBn3+6PX2um0qAua8MysF0xSW0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fyI2aLIJ2/EHujR9hHuXzUlIL7cDw3PEzYil+rzuxNaunTy9T9KJ0/42veA+L6yTq q1Gnt0PaeaQPEtHIAdzb58DF/KJJ2vIPDAgXzONM3B96DAA1s/IekoI93ZVVQnUAyg eNxiiGsLUnXXTlg3UE9/S9pPQpPgw5eCYfLUuF6s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 37/42] tipc: fix shift wrapping bug in map_get() Date: Tue, 13 Sep 2022 16:08:08 +0200 Message-Id: <20220913140344.252776985@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit e2b224abd9bf45dcb55750479fc35970725a430b ] There is a shift wrapping bug in this code so anything thing above 31 will return false. Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/tipc/monitor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c index e1f4538b16532..7efcbd11a907a 100644 --- a/net/tipc/monitor.c +++ b/net/tipc/monitor.c @@ -130,7 +130,7 @@ static void map_set(u64 *up_map, int i, unsigned int v) =20 static int map_get(u64 up_map, int i) { - return (up_map & (1 << i)) >> i; + return (up_map & (1ULL << i)) >> i; } =20 static struct tipc_peer *peer_prev(struct tipc_peer *peer) --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 520E1C6FA82 for ; Tue, 13 Sep 2022 15:41:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236638AbiIMPlv (ORCPT ); Tue, 13 Sep 2022 11:41:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46380 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236633AbiIMPlG (ORCPT ); Tue, 13 Sep 2022 11:41:06 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4FA6A6EF30; Tue, 13 Sep 2022 07:45:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8B25DB80EF6; Tue, 13 Sep 2022 14:37:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E132EC43470; Tue, 13 Sep 2022 14:37:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079850; bh=WaNPt8DgDcAAGHC/eVu+ppxYDcbPx1MGvrDNITczGCY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BuHcUCt1ePMjF5m4bRiRvP6J+dzxxNhyjX+V5p7oIw1ytkyjh4iVXclR2mTVB44sM CGM0Pz44vaiEC8b+QsOaXR+SzlkBS4SexqRDrhSDsFSy46VtyrQhL9HWBW7XAYemIZ /uWmYq5zS5oFSj0jOC0DprISzLwZDU4DSgPCip9s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nagaraj Arankal , Neal Cardwell , Yuchung Cheng , Eric Dumazet , Paolo Abeni , Sasha Levin Subject: [PATCH 4.9 38/42] tcp: fix early ETIMEDOUT after spurious non-SACK RTO Date: Tue, 13 Sep 2022 16:08:09 +0200 Message-Id: <20220913140344.314740964@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Neal Cardwell [ Upstream commit 686dc2db2a0fdc1d34b424ec2c0a735becd8d62b ] Fix a bug reported and analyzed by Nagaraj Arankal, where the handling of a spurious non-SACK RTO could cause a connection to fail to clear retrans_stamp, causing a later RTO to very prematurely time out the connection with ETIMEDOUT. Here is the buggy scenario, expanding upon Nagaraj Arankal's excellent report: (*1) Send one data packet on a non-SACK connection (*2) Because no ACK packet is received, the packet is retransmitted and we enter CA_Loss; but this retransmission is spurious. (*3) The ACK for the original data is received. The transmitted packet is acknowledged. The TCP timestamp is before the retrans_stamp, so tcp_may_undo() returns true, and tcp_try_undo_loss() returns true without changing state to Open (because tcp_is_sack() is false), and tcp_process_loss() returns without calling tcp_try_undo_recovery(). Normally after undoing a CA_Loss episode, tcp_fastretrans_alert() would see that the connection has returned to CA_Open and fall through and call tcp_try_to_open(), which would set retrans_stamp to 0. However, for non-SACK connections we hold the connection in CA_Loss, so do not fall through to call tcp_try_to_open() and do not set retrans_stamp to 0. So retrans_stamp is (erroneously) still non-zero. At this point the first "retransmission event" has passed and been recovered from. Any future retransmission is a completely new "event". However, retrans_stamp is erroneously still set. (And we are still in CA_Loss, which is correct.) (*4) After 16 minutes (to correspond with tcp_retries2=3D15), a new data packet is sent. Note: No data is transmitted between (*3) and (*4) and we disabled keep alives. The socket's timeout SHOULD be calculated from this point in time, but instead it's calculated from the prior "event" 16 minutes ago (step (*2)). (*5) Because no ACK packet is received, the packet is retransmitted. (*6) At the time of the 2nd retransmission, the socket returns ETIMEDOUT, prematurely, because retrans_stamp is (erroneously) too far in the past (set at the time of (*2)). This commit fixes this bug by ensuring that we reuse in tcp_try_undo_loss() the same careful logic for non-SACK connections that we have in tcp_try_undo_recovery(). To avoid duplicating logic, we factor out that logic into a new tcp_is_non_sack_preventing_reopen() helper and call that helper from both undo functions. Fixes: da34ac7626b5 ("tcp: only undo on partial ACKs in CA_Loss") Reported-by: Nagaraj Arankal Link: https://lore.kernel.org/all/SJ0PR84MB1847BE6C24D274C46A1B9B0EB27A9@SJ= 0PR84MB1847.NAMPRD84.PROD.OUTLOOK.COM/ Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220903121023.866900-1-ncardwell.kernel@gm= ail.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/ipv4/tcp_input.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index b12a329ef1873..2029e7a36cbb4 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -2468,6 +2468,21 @@ static inline bool tcp_may_undo(const struct tcp_soc= k *tp) return tp->undo_marker && (!tp->undo_retrans || tcp_packet_delayed(tp)); } =20 +static bool tcp_is_non_sack_preventing_reopen(struct sock *sk) +{ + struct tcp_sock *tp =3D tcp_sk(sk); + + if (tp->snd_una =3D=3D tp->high_seq && tcp_is_reno(tp)) { + /* Hold old state until something *above* high_seq + * is ACKed. For Reno it is MUST to prevent false + * fast retransmits (RFC2582). SACK TCP is safe. */ + if (!tcp_any_retrans_done(sk)) + tp->retrans_stamp =3D 0; + return true; + } + return false; +} + /* People celebrate: "We love our President!" */ static bool tcp_try_undo_recovery(struct sock *sk) { @@ -2488,14 +2503,8 @@ static bool tcp_try_undo_recovery(struct sock *sk) =20 NET_INC_STATS(sock_net(sk), mib_idx); } - if (tp->snd_una =3D=3D tp->high_seq && tcp_is_reno(tp)) { - /* Hold old state until something *above* high_seq - * is ACKed. For Reno it is MUST to prevent false - * fast retransmits (RFC2582). SACK TCP is safe. */ - if (!tcp_any_retrans_done(sk)) - tp->retrans_stamp =3D 0; + if (tcp_is_non_sack_preventing_reopen(sk)) return true; - } tcp_set_ca_state(sk, TCP_CA_Open); tp->is_sack_reneg =3D 0; return false; @@ -2529,6 +2538,8 @@ static bool tcp_try_undo_loss(struct sock *sk, bool f= rto_undo) NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSPURIOUSRTOS); inet_csk(sk)->icsk_retransmits =3D 0; + if (tcp_is_non_sack_preventing_reopen(sk)) + return true; if (frto_undo || tcp_is_sack(tp)) { tcp_set_ca_state(sk, TCP_CA_Open); tp->is_sack_reneg =3D 0; --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B623CC6FA82 for ; Tue, 13 Sep 2022 15:30:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236476AbiIMPae (ORCPT ); Tue, 13 Sep 2022 11:30:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37040 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236496AbiIMP2w (ORCPT ); Tue, 13 Sep 2022 11:28:52 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 16CAC7E02E; Tue, 13 Sep 2022 07:39:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 047D4B8101C; Tue, 13 Sep 2022 14:37:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B154C433C1; Tue, 13 Sep 2022 14:37:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079853; bh=euhJ2/TXn6UNvyYTMzYZxk1kZI9hiKpv+HLAgyL+0lg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R2M3HDyI4aH2vxucO0PtViyxfsCTOFsDVRnYKiz6E6czfSufd1Cfr+FY9Z90n2tkj DeEm4hH4Aao1pMTBYN2qn9Q9uNk2XyQaJMczSe324TSi04MVNeDWkOO+k9Dk+D7edm P8cszJHIk+ioEUu/RautAH+Ngc2At1E4UQZIfpeg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Cong Wang , Paolo Abeni , Sasha Levin Subject: [PATCH 4.9 39/42] sch_sfb: Also store skb len before calling child enqueue Date: Tue, 13 Sep 2022 16:08:10 +0200 Message-Id: <20220913140344.361017922@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Toke H=C3=B8iland-J=C3=B8rgensen [ Upstream commit 2f09707d0c972120bf794cfe0f0c67e2c2ddb252 ] Cong Wang noticed that the previous fix for sch_sfb accessing the queued skb after enqueueing it to a child qdisc was incomplete: the SFB enqueue function was also calling qdisc_qstats_backlog_inc() after enqueue, which reads the pkt len from the skb cb field. Fix this by also storing the skb len, and using the stored value to increment the backlog after enqueueing. Fixes: 9efd23297cca ("sch_sfb: Don't assume the skb is still around after e= nqueueing to child") Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen Acked-by: Cong Wang Link: https://lore.kernel.org/r/20220905192137.965549-1-toke@toke.dk Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/sched/sch_sfb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c index 592189427a09f..2973d82fb21cc 100644 --- a/net/sched/sch_sfb.c +++ b/net/sched/sch_sfb.c @@ -281,6 +281,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, { =20 struct sfb_sched_data *q =3D qdisc_priv(sch); + unsigned int len =3D qdisc_pkt_len(skb); struct Qdisc *child =3D q->qdisc; struct tcf_proto *fl; struct sfb_skb_cb cb; @@ -403,7 +404,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); ret =3D qdisc_enqueue(skb, child, to_free); if (likely(ret =3D=3D NET_XMIT_SUCCESS)) { - qdisc_qstats_backlog_inc(sch, skb); + sch->qstats.backlog +=3D len; sch->q.qlen++; increment_qlen(&cb, q); } else if (net_xmit_drop_count(ret)) { --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15E96C6FA82 for ; Tue, 13 Sep 2022 15:30:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236543AbiIMPaz (ORCPT ); Tue, 13 Sep 2022 11:30:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48714 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236548AbiIMP3E (ORCPT ); Tue, 13 Sep 2022 11:29:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D1175632E; Tue, 13 Sep 2022 07:39:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C1CA2B80FEF; Tue, 13 Sep 2022 14:37:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2C710C433C1; Tue, 13 Sep 2022 14:37:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079856; bh=FYzMawFm0/iJq4Jp+STVVe+Ezs1eDH3PxeUV24THizo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JhcEYhCLjIcKizZyhnC+k8lqd+hrYwDDEaMrU/qaOQaQk1WflXONZ4nu1uEvIlC+d ars57VLU0vojQBvm5/JcxPHhn3lT/CUN1K6lpgNswkBYasfKbT3w08t77oiUlrzv4F Efv0fVyX2Vmd0hITj7Ipfb+Zywz8ufE32/WZWgBA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrew Halaney , Matthias Kaehlcke , Manivannan Sadhasivam , Johan Hovold Subject: [PATCH 4.9 40/42] usb: dwc3: fix PHY disable sequence Date: Tue, 13 Sep 2022 16:08:11 +0200 Message-Id: <20220913140344.414340526@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit d2ac7bef95c9ead307801ccb6cb6dfbeb14247bf upstream. Generic PHYs must be powered-off before they can be tore down. Similarly, suspending legacy PHYs after having powered them off makes no sense. Fix the dwc3_core_exit() (e.g. called during suspend) and open-coded dwc3_probe() error-path sequences that got this wrong. Note that this makes dwc3_core_exit() match the dwc3_core_init() error path with respect to powering off the PHYs. Fixes: 03c1fd622f72 ("usb: dwc3: core: add phy cleanup for probe error hand= ling") Fixes: c499ff71ff2a ("usb: dwc3: core: re-factor init and exit paths") Cc: stable@vger.kernel.org # 4.8 Reviewed-by: Andrew Halaney Reviewed-by: Matthias Kaehlcke Reviewed-by: Manivannan Sadhasivam Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-2-johan+linaro@kernel.= org [ johan: adjust context to 4.9 ] Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- drivers/usb/dwc3/core.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -602,15 +602,15 @@ static void dwc3_core_exit(struct dwc3 * { dwc3_event_buffers_cleanup(dwc); =20 - usb_phy_shutdown(dwc->usb2_phy); - usb_phy_shutdown(dwc->usb3_phy); - phy_exit(dwc->usb2_generic_phy); - phy_exit(dwc->usb3_generic_phy); - usb_phy_set_suspend(dwc->usb2_phy, 1); usb_phy_set_suspend(dwc->usb3_phy, 1); phy_power_off(dwc->usb2_generic_phy); phy_power_off(dwc->usb3_generic_phy); + + usb_phy_shutdown(dwc->usb2_phy); + usb_phy_shutdown(dwc->usb3_phy); + phy_exit(dwc->usb2_generic_phy); + phy_exit(dwc->usb3_generic_phy); } =20 /** @@ -1149,16 +1149,16 @@ static int dwc3_probe(struct platform_de err5: dwc3_event_buffers_cleanup(dwc); =20 - usb_phy_shutdown(dwc->usb2_phy); - usb_phy_shutdown(dwc->usb3_phy); - phy_exit(dwc->usb2_generic_phy); - phy_exit(dwc->usb3_generic_phy); - usb_phy_set_suspend(dwc->usb2_phy, 1); usb_phy_set_suspend(dwc->usb3_phy, 1); phy_power_off(dwc->usb2_generic_phy); phy_power_off(dwc->usb3_generic_phy); =20 + usb_phy_shutdown(dwc->usb2_phy); + usb_phy_shutdown(dwc->usb3_phy); + phy_exit(dwc->usb2_generic_phy); + phy_exit(dwc->usb3_generic_phy); + dwc3_ulpi_exit(dwc); =20 err4: From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 901C9ECAAD8 for ; Tue, 13 Sep 2022 16:59:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232077AbiIMQ71 (ORCPT ); Tue, 13 Sep 2022 12:59:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55442 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231955AbiIMQ7E (ORCPT ); Tue, 13 Sep 2022 12:59:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 74BDE89CFB; Tue, 13 Sep 2022 08:50:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7CAA1B80FA6; Tue, 13 Sep 2022 14:37:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D98F8C433B5; Tue, 13 Sep 2022 14:37:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079859; bh=ojvWfJ+hbalWUIRKhw1goJH5jDX4yV0o04EEXy313Js=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nHD9VkkE+lXIl9v+xR7UdSwi/pPD+14CfP0EtqiueVpb1P5J6kOBvZNk+NxI0zFzd UeNcYFtyIFRm7NWll6YVs8OLhSSuTdTy2tU4glDxRnzQaYivtwvtH2w5JdcKuhr5yx H3BoP0yupjTNqiT7D/tGf8ku3dHkywJdNPZY7B3k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Ling , Keguang Zhang , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.9 41/42] MIPS: loongson32: ls1c: Fix hang during startup Date: Tue, 13 Sep 2022 16:08:12 +0200 Message-Id: <20220913140344.468916704@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Ling [ Upstream commit 35508d2424097f9b6a1a17aac94f702767035616 ] The RTCCTRL reg of LS1C is obselete. Writing this reg will cause system hang. Fixes: 60219c563c9b6 ("MIPS: Add RTC support for Loongson1C board") Signed-off-by: Yang Ling Tested-by: Keguang Zhang Acked-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- arch/mips/loongson32/ls1c/board.c | 1 - 1 file changed, 1 deletion(-) diff --git a/arch/mips/loongson32/ls1c/board.c b/arch/mips/loongson32/ls1c/= board.c index a96bed5e3ea60..ac1c5e6572d5f 100644 --- a/arch/mips/loongson32/ls1c/board.c +++ b/arch/mips/loongson32/ls1c/board.c @@ -18,7 +18,6 @@ static struct platform_device *ls1c_platform_devices[] __= initdata =3D { static int __init ls1c_platform_init(void) { ls1x_serial_set_uartclk(&ls1x_uart_pdev); - ls1x_rtc_set_extclk(&ls1x_rtc_pdev); =20 return platform_add_devices(ls1c_platform_devices, ARRAY_SIZE(ls1c_platform_devices)); --=20 2.35.1 From nobody Sun Apr 5 22:50:48 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09361C54EE9 for ; Tue, 13 Sep 2022 15:31:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236575AbiIMPbO (ORCPT ); Tue, 13 Sep 2022 11:31:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35262 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236587AbiIMP3K (ORCPT ); Tue, 13 Sep 2022 11:29:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5AB7012AE6; Tue, 13 Sep 2022 07:39:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BD3FDB80FB3; Tue, 13 Sep 2022 14:37:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 273ECC433D6; Tue, 13 Sep 2022 14:37:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079864; bh=Zz20S2iYhS1C8p2637bUqpeyAzUowHY50lpZhR3aER8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S/lcnBYcHAGp0tPR30/l75KCVrx1RDc1KqwndTcySYa9YCnNuzIT2+B6j/U49hQ+g L8ClIcXqwpeFcwQZX11Gc+6DOw0+4jlqq2Xqb4JLZfDns1fc82tS5VfeenloqJibjj ls81ILG3Gdnp9Z2e+Cy95z6/1EVOdBak6mRqD264= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, NeilBrown , Eugeniu Rosca Subject: [PATCH 4.9 42/42] SUNRPC: use _bh spinlocking on ->transport_lock Date: Tue, 13 Sep 2022 16:08:13 +0200 Message-Id: <20220913140344.525654708@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140342.228397194@linuxfoundation.org> References: <20220913140342.228397194@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: "NeilBrown" Prior to Linux 5.3, ->transport_lock in sunrpc required the _bh style spinlocks (when not called from a bottom-half handler). When upstream 3848e96edf4788f772d83990022fa7023a233d83 was backported to stable kernels, the spin_lock/unlock calls should have been changed to the _bh version, but this wasn't noted in the patch and didn't happen. So convert these lock/unlock calls to the _bh versions. This patch is required for any stable kernel prior to 5.3 to which the above mentioned patch was backported. Namely 4.9.y, 4.14.y, 4.19.y. Signed-off-by: NeilBrown Reported-by: Eugeniu Rosca Reviewed-by: Eugeniu Rosca Tested-by: Eugeniu Rosca Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) --- net/sunrpc/xprt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/sunrpc/xprt.c +++ b/net/sunrpc/xprt.c @@ -1451,9 +1451,9 @@ static void xprt_destroy(struct rpc_xprt * is cleared. We use ->transport_lock to ensure the mod_timer() * can only run *before* del_time_sync(), never after. */ - spin_lock(&xprt->transport_lock); + spin_lock_bh(&xprt->transport_lock); del_timer_sync(&xprt->timer); - spin_unlock(&xprt->transport_lock); + spin_unlock_bh(&xprt->transport_lock); =20 rpc_xprt_debugfs_unregister(xprt); rpc_destroy_wait_queue(&xprt->binding);