From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1E24C6FA82 for ; Tue, 13 Sep 2022 15:41:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232450AbiIMPln (ORCPT ); Tue, 13 Sep 2022 11:41:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52536 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236724AbiIMPlF (ORCPT ); Tue, 13 Sep 2022 11:41:05 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E39FD8287F; Tue, 13 Sep 2022 07:45:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3C547B80ECE; Tue, 13 Sep 2022 14:33:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A85FEC433D6; Tue, 13 Sep 2022 14:33:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079619; bh=PZSImN124wNr3us3+Y8nvBFBloECDt4+TqCOelhU4Wk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=B2Lcm99PvAZBFTWu4F7Zqk0G7iniiU4zeMu+aXJxi+5vFO4oT2gvzbpN7wZcbCfaX Dph7J3yOKu1ggRvyYrF/cuZE4R1P/9KydLrtuEHM8dm0yiQtXdYDd0lRmcMTJw0BXh Rnetd4dO6GxkE/YK6leRd6W9cfAY9Cmc6MLhNvuM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , John Fastabend , Alexei Starovoitov , Ovidiu Panait Subject: [PATCH 4.14 01/61] bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() Date: Tue, 13 Sep 2022 16:07:03 +0200 Message-Id: <20220913140346.518913754@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: John Fastabend commit 294f2fc6da27620a506e6c050241655459ccd6bd upstream. Currently, for all op verification we call __red_deduce_bounds() and __red_bound_offset() but we only call __update_reg_bounds() in bitwise ops. However, we could benefit from calling __update_reg_bounds() in BPF_ADD, BPF_SUB, and BPF_MUL cases as well. For example, a register with state 'R1_w=3DinvP0' when we subtract from it, w1 -=3D 2 Before coerce we will now have an smin_value=3DS64_MIN, smax_value=3DU64_MAX and unsigned bounds umin_value=3D0, umax_value=3DU64_MAX. These will then be clamped to S32_MIN, U32_MAX values by coerce in the case of alu32 op as done in above example. However tnum will be a constant because the ALU op is done on a constant. Without update_reg_bounds() we have a scenario where tnum is a const but our unsigned bounds do not reflect this. By calling update_reg_bounds after coerce to 32bit we further refine the umin_value to U64_MAX in the alu64 case or U32_MAX in the alu32 case above. Signed-off-by: John Fastabend Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/158507151689.15666.566796274289413203.stg= it@john-Precision-5820-Tower Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- kernel/bpf/verifier.c | 1 + 1 file changed, 1 insertion(+) --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2739,6 +2739,7 @@ static int adjust_scalar_min_max_vals(st coerce_reg_to_size(dst_reg, 4); } =20 + __update_reg_bounds(dst_reg); __reg_deduce_bounds(dst_reg); __reg_bound_offset(dst_reg); return 0; From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F266AC6FA82 for ; Tue, 13 Sep 2022 15:38:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236646AbiIMPi0 (ORCPT ); Tue, 13 Sep 2022 11:38:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36874 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234707AbiIMPh5 (ORCPT ); Tue, 13 Sep 2022 11:37:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3278E6EF35; Tue, 13 Sep 2022 07:44:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2F5AE614AD; Tue, 13 Sep 2022 14:34:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4A7ECC433C1; Tue, 13 Sep 2022 14:34:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079646; bh=xtZY2Rh9XWiksXaL7CsIpnesPNdLcKc1pCjq63/TKWg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m6QAZhZKurJP3ySxD3Fd15DSh+42Zm3Vlvc23Vb/X8i5uFul5R/1ean4+WjduEWB5 BQ+PEuqNqRTCxbv/sqqQ+sn/XWlJ5Y3/b8V0Gq8gmbwQ0B+a3B1usXCxMuqfsoguB5 Z1Mh4LKeTQmSsFJNUEUN3uux9CX2A/AaK16uLUX8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Stanislav Fomichev , Daniel Borkmann , Ovidiu Panait Subject: [PATCH 4.14 02/61] selftests/bpf: Fix test_align verifier log patterns Date: Tue, 13 Sep 2022 16:07:04 +0200 Message-Id: <20220913140346.573702332@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Stanislav Fomichev commit 5366d2269139ba8eb6a906d73a0819947e3e4e0a upstream. Commit 294f2fc6da27 ("bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()") changed the way verifier logs some of its state, adjust the test_align accordingly. Where possible, I tried to not copy-paste the entire log line and resorted to dropping the last closing brace instead. Fixes: 294f2fc6da27 ("bpf: Verifer, adjust_scalar_min_max_vals to always ca= ll update_reg_bounds()") Signed-off-by: Stanislav Fomichev Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20200515194904.229296-1-sdf@google.com [OP: adjust for 4.14 selftests, apply only the relevant diffs] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- tools/testing/selftests/bpf/test_align.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) --- a/tools/testing/selftests/bpf/test_align.c +++ b/tools/testing/selftests/bpf/test_align.c @@ -363,15 +363,15 @@ static struct bpf_align_test tests[] =3D { * is still (4n), fixed offset is not changed. * Also, we create a new reg->id. */ - {29, "R5=3Dpkt(id=3D4,off=3D18,r=3D0,umax_value=3D2040,var_off=3D(0x0; = 0x7fc))"}, + {29, "R5=3Dpkt(id=3D4,off=3D18,r=3D0,umax_value=3D2040,var_off=3D(0x0; = 0x7fc)"}, /* At the time the word size load is performed from R5, * its total fixed offset is NET_IP_ALIGN + reg->off (18) * which is 20. Then the variable offset is (4n), so * the total offset is 4-byte aligned and meets the * load's requirements. */ - {33, "R4=3Dpkt(id=3D4,off=3D22,r=3D22,umax_value=3D2040,var_off=3D(0x0;= 0x7fc))"}, - {33, "R5=3Dpkt(id=3D4,off=3D18,r=3D22,umax_value=3D2040,var_off=3D(0x0;= 0x7fc))"}, + {33, "R4=3Dpkt(id=3D4,off=3D22,r=3D22,umax_value=3D2040,var_off=3D(0x0;= 0x7fc)"}, + {33, "R5=3Dpkt(id=3D4,off=3D18,r=3D22,umax_value=3D2040,var_off=3D(0x0;= 0x7fc)"}, }, }, { @@ -414,15 +414,15 @@ static struct bpf_align_test tests[] =3D { /* Adding 14 makes R6 be (4n+2) */ {9, "R6=3Dinv(id=3D0,umin_value=3D14,umax_value=3D1034,var_off=3D(0x2; = 0x7fc))"}, /* Packet pointer has (4n+2) offset */ - {11, "R5=3Dpkt(id=3D1,off=3D0,r=3D0,umin_value=3D14,umax_value=3D1034,v= ar_off=3D(0x2; 0x7fc))"}, - {13, "R4=3Dpkt(id=3D1,off=3D4,r=3D0,umin_value=3D14,umax_value=3D1034,v= ar_off=3D(0x2; 0x7fc))"}, + {11, "R5=3Dpkt(id=3D1,off=3D0,r=3D0,umin_value=3D14,umax_value=3D1034,v= ar_off=3D(0x2; 0x7fc)"}, + {13, "R4=3Dpkt(id=3D1,off=3D4,r=3D0,umin_value=3D14,umax_value=3D1034,v= ar_off=3D(0x2; 0x7fc)"}, /* At the time the word size load is performed from R5, * its total fixed offset is NET_IP_ALIGN + reg->off (0) * which is 2. Then the variable offset is (4n+2), so * the total offset is 4-byte aligned and meets the * load's requirements. */ - {15, "R5=3Dpkt(id=3D1,off=3D0,r=3D4,umin_value=3D14,umax_value=3D1034,v= ar_off=3D(0x2; 0x7fc))"}, + {15, "R5=3Dpkt(id=3D1,off=3D0,r=3D4,umin_value=3D14,umax_value=3D1034,v= ar_off=3D(0x2; 0x7fc)"}, /* Newly read value in R6 was shifted left by 2, so has * known alignment of 4. */ @@ -430,15 +430,15 @@ static struct bpf_align_test tests[] =3D { /* Added (4n) to packet pointer's (4n+2) var_off, giving * another (4n+2). */ - {19, "R5=3Dpkt(id=3D2,off=3D0,r=3D0,umin_value=3D14,umax_value=3D2054,v= ar_off=3D(0x2; 0xffc))"}, - {21, "R4=3Dpkt(id=3D2,off=3D4,r=3D0,umin_value=3D14,umax_value=3D2054,v= ar_off=3D(0x2; 0xffc))"}, + {19, "R5=3Dpkt(id=3D2,off=3D0,r=3D0,umin_value=3D14,umax_value=3D2054,v= ar_off=3D(0x2; 0xffc)"}, + {21, "R4=3Dpkt(id=3D2,off=3D4,r=3D0,umin_value=3D14,umax_value=3D2054,v= ar_off=3D(0x2; 0xffc)"}, /* At the time the word size load is performed from R5, * its total fixed offset is NET_IP_ALIGN + reg->off (0) * which is 2. Then the variable offset is (4n+2), so * the total offset is 4-byte aligned and meets the * load's requirements. */ - {23, "R5=3Dpkt(id=3D2,off=3D0,r=3D4,umin_value=3D14,umax_value=3D2054,v= ar_off=3D(0x2; 0xffc))"}, + {23, "R5=3Dpkt(id=3D2,off=3D0,r=3D4,umin_value=3D14,umax_value=3D2054,v= ar_off=3D(0x2; 0xffc)"}, }, }, { @@ -473,11 +473,11 @@ static struct bpf_align_test tests[] =3D { .matches =3D { {4, "R5=3Dpkt_end(id=3D0,off=3D0,imm=3D0)"}, /* (ptr - ptr) << 2 =3D=3D unknown, (4n) */ - {6, "R5=3Dinv(id=3D0,smax_value=3D9223372036854775804,umax_value=3D1844= 6744073709551612,var_off=3D(0x0; 0xfffffffffffffffc))"}, + {6, "R5=3Dinv(id=3D0,smax_value=3D9223372036854775804,umax_value=3D1844= 6744073709551612,var_off=3D(0x0; 0xfffffffffffffffc)"}, /* (4n) + 14 =3D=3D (4n+2). We blow our bounds, because * the add could overflow. */ - {7, "R5=3Dinv(id=3D0,var_off=3D(0x2; 0xfffffffffffffffc))"}, + {7, "R5=3Dinv(id=3D0,smin_value=3D-9223372036854775806,smax_value=3D922= 3372036854775806,umin_value=3D2,umax_value=3D18446744073709551614,var_off= =3D(0x2; 0xfffffffffffffffc)"}, /* Checked s>=3D0 */ {9, "R5=3Dinv(id=3D0,umin_value=3D2,umax_value=3D9223372036854775806,va= r_off=3D(0x2; 0x7ffffffffffffffc))"}, /* packet pointer + nonnegative (4n+2) */ @@ -532,7 +532,7 @@ static struct bpf_align_test tests[] =3D { /* New unknown value in R7 is (4n) */ {11, "R7=3Dinv(id=3D0,umax_value=3D1020,var_off=3D(0x0; 0x3fc))"}, /* Subtracting it from R6 blows our unsigned bounds */ - {12, "R6=3Dinv(id=3D0,smin_value=3D-1006,smax_value=3D1034,var_off=3D(0= x2; 0xfffffffffffffffc))"}, + {12, "R6=3Dinv(id=3D0,smin_value=3D-1006,smax_value=3D1034,umin_value= =3D2,umax_value=3D18446744073709551614,var_off=3D(0x2; 0xfffffffffffffffc)"= }, /* Checked s>=3D 0 */ {14, "R6=3Dinv(id=3D0,umin_value=3D2,umax_value=3D1034,var_off=3D(0x2; = 0x7fc))"}, /* At the time the word size load is performed from R5, @@ -541,7 +541,8 @@ static struct bpf_align_test tests[] =3D { * the total offset is 4-byte aligned and meets the * load's requirements. */ - {20, "R5=3Dpkt(id=3D1,off=3D0,r=3D4,umin_value=3D2,umax_value=3D1034,va= r_off=3D(0x2; 0x7fc))"}, + {20, "R5=3Dpkt(id=3D1,off=3D0,r=3D4,umin_value=3D2,umax_value=3D1034,va= r_off=3D(0x2; 0x7fc)"}, + }, }, { From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20970C54EE9 for ; Tue, 13 Sep 2022 17:52:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232919AbiIMRwN (ORCPT ); Tue, 13 Sep 2022 13:52:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52978 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232311AbiIMRvm (ORCPT ); Tue, 13 Sep 2022 13:51:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0613E89CDD; Tue, 13 Sep 2022 09:50:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8BD92B80F88; Tue, 13 Sep 2022 14:34:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0CD0C433D6; Tue, 13 Sep 2022 14:34:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079651; bh=K70JH39tiKRwFDLY7T6ypiwg3RtOS38zHWLLT8EoT0o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IRMk/zv8DJ8dSXveia2ySIfjkSoY22vUuX0TWc439Pr8g5fWD3TWWiiB40sz4Qd82 0BipyLcVH6I8idvTpZPEUdSH/O3DRiwnQexbisSCRU23veQRMllhKW+haRtC73uQKS nhQP+zRg0AxDuEJyVtyK/6eovQ6/eY3zW1oPPwe0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Maxim Mikityanskiy , Daniel Borkmann , Ovidiu Panait Subject: [PATCH 4.14 03/61] bpf: Fix the off-by-two error in range markings Date: Tue, 13 Sep 2022 16:07:05 +0200 Message-Id: <20220913140346.623139487@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maxim Mikityanskiy commit 2fa7d94afc1afbb4d702760c058dc2d7ed30f226 upstream. The first commit cited below attempts to fix the off-by-one error that appeared in some comparisons with an open range. Due to this error, arithmetically equivalent pieces of code could get different verdicts from the verifier, for example (pseudocode): // 1. Passes the verifier: if (data + 8 > data_end) return early read *(u64 *)data, i.e. [data; data+7] // 2. Rejected by the verifier (should still pass): if (data + 7 >=3D data_end) return early read *(u64 *)data, i.e. [data; data+7] The attempted fix, however, shifts the range by one in a wrong direction, so the bug not only remains, but also such piece of code starts failing in the verifier: // 3. Rejected by the verifier, but the check is stricter than in #1. if (data + 8 >=3D data_end) return early read *(u64 *)data, i.e. [data; data+7] The change performed by that fix converted an off-by-one bug into off-by-two. The second commit cited below added the BPF selftests written to ensure than code chunks like #3 are rejected, however, they should be accepted. This commit fixes the off-by-two error by adjusting new_range in the right direction and fixes the tests by changing the range into the one that should actually fail. Fixes: fb2a311a31d3 ("bpf: fix off by one for range markings with L{T, E} p= atterns") Fixes: b37242c773b2 ("bpf: add test cases to bpf selftests to cover all acc= ess tests") Signed-off-by: Maxim Mikityanskiy Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20211130181607.593149-1-maximmi@nvidia.com [OP: only cherry-pick selftest changes applicable to 4.14] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- tools/testing/selftests/bpf/test_verifier.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) --- a/tools/testing/selftests/bpf/test_verifier.c +++ b/tools/testing/selftests/bpf/test_verifier.c @@ -7438,10 +7438,10 @@ static struct bpf_test tests[] =3D { BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data_end)), BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), - BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), + BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1), BPF_JMP_IMM(BPF_JA, 0, 0, 1), - BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), BPF_MOV64_IMM(BPF_REG_0, 0), BPF_EXIT_INSN(), }, @@ -7494,10 +7494,10 @@ static struct bpf_test tests[] =3D { BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data_end)), BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), - BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), + BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1), BPF_JMP_IMM(BPF_JA, 0, 0, 1), - BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), BPF_MOV64_IMM(BPF_REG_0, 0), BPF_EXIT_INSN(), }, @@ -7603,9 +7603,9 @@ static struct bpf_test tests[] =3D { BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data_end)), BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), - BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), + BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1), - BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), BPF_MOV64_IMM(BPF_REG_0, 0), BPF_EXIT_INSN(), }, @@ -7770,9 +7770,9 @@ static struct bpf_test tests[] =3D { BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data_end)), BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), - BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), + BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6), BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1), - BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8), + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6), BPF_MOV64_IMM(BPF_REG_0, 0), BPF_EXIT_INSN(), }, From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D8A7C6FA82 for ; Tue, 13 Sep 2022 15:21:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236057AbiIMPU6 (ORCPT ); Tue, 13 Sep 2022 11:20:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57620 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236114AbiIMPTI (ORCPT ); Tue, 13 Sep 2022 11:19:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4E879796A0; Tue, 13 Sep 2022 07:35:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 689F1614BF; Tue, 13 Sep 2022 14:34:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82591C433D6; Tue, 13 Sep 2022 14:34:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079653; bh=ugfdGp3JBSQjReIJgLxbE+2mLWsveMB2VlQK38ZTsLI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WSn6BgQEryL9BgAHjeEIfbBU8UCxEnjkDszY1u/9qO0H//mPwNMIJVxgv5qX/3OU+ TcGOOO4FEUdiuw9anOuYWnHA4Wq6mIgyA07X0w/2HVJnoCp8EZYizl0Ea1OzOcBp6J nrP7OqdWAQFW8gqA1Nn3pMm7zHQ7+PBgnzLVDJtk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Douglas Anderson , Dmitry Baryshkov , Abhinav Kumar , Sasha Levin Subject: [PATCH 4.14 04/61] drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg Date: Tue, 13 Sep 2022 16:07:06 +0200 Message-Id: <20220913140346.683132965@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Douglas Anderson [ Upstream commit 1e00d6ac8a3422765bae37aeac2002dfd3c0bda6 ] 3 regulators are listed but the number 2 is specified. Fix it. Fixes: 3a3ff88a0fc1 ("drm/msm/dsi: Add 8x96 info in dsi_cfg") Signed-off-by: Douglas Anderson Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/496318/ Link: https://lore.kernel.org/r/20220804073608.v4.1.I1056ee3f77f71287f33327= 9efe4c85f88d403f65@changeid Signed-off-by: Abhinav Kumar Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/ds= i_cfg.c index a5d75c9b3a737..2b8c39a1f7484 100644 --- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c +++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c @@ -105,7 +105,7 @@ static const char * const dsi_8996_bus_clk_names[] =3D { static const struct msm_dsi_config msm8996_dsi_cfg =3D { .io_offset =3D DSI_6G_REG_SHIFT, .reg_cfg =3D { - .num =3D 2, + .num =3D 3, .regs =3D { {"vdda", 18160, 1 }, /* 1.25 V */ {"vcca", 17000, 32 }, /* 0.925 V */ --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30E4BC6FA82 for ; Tue, 13 Sep 2022 15:17:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235738AbiIMPRv (ORCPT ); Tue, 13 Sep 2022 11:17:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35238 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235801AbiIMPQp (ORCPT ); Tue, 13 Sep 2022 11:16:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4620F6333; Tue, 13 Sep 2022 07:34:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CBB92614D9; Tue, 13 Sep 2022 14:34:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E3249C433C1; Tue, 13 Sep 2022 14:34:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079656; bh=OgNLZQbLYG0PFPAla9vnK6+hvEdOJb/YODxN6g9h4w4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZgqC0k7Iv09IKk2WGlUnFGv28hVlsTDe/cbLIam1q5HkhTnBdeANlxFjTnDVFLdFi 2uQ0NSE3uAUnuVEgT0ACIDGr6rtNfAHwfEjXCI0vKOIVX/A5qDvMZRL8RJEn04oaWo 4LRUY1AOciqIBhStHhqsj1UkFoszSlGCmwSLUgnw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Shevchenko , Hans de Goede , Sasha Levin Subject: [PATCH 4.14 05/61] platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask Date: Tue, 13 Sep 2022 16:07:07 +0200 Message-Id: <20220913140346.737144158@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andy Shevchenko [ Upstream commit 0a90ed8d0cfa29735a221eba14d9cb6c735d35b6 ] On Intel hardware the SLP_TYPx bitfield occupies bits 10-12 as per ACPI specification (see Table 4.13 "PM1 Control Registers Fixed Hardware Feature Control Bits" for the details). Fix the mask and other related definitions accordingly. Fixes: 93e5eadd1f6e ("x86/platform: New Intel Atom SOC power management con= troller driver") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220801113734.36131-1-andriy.shevchenko@li= nux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/platform/x86/pmc_atom.c | 2 +- include/linux/platform_data/x86/pmc_atom.h | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_ato= m.c index d1d5ec3c0f141..d1f10354c3550 100644 --- a/drivers/platform/x86/pmc_atom.c +++ b/drivers/platform/x86/pmc_atom.c @@ -253,7 +253,7 @@ static void pmc_power_off(void) pm1_cnt_port =3D acpi_base_addr + PM1_CNT; =20 pm1_cnt_value =3D inl(pm1_cnt_port); - pm1_cnt_value &=3D SLEEP_TYPE_MASK; + pm1_cnt_value &=3D ~SLEEP_TYPE_MASK; pm1_cnt_value |=3D SLEEP_TYPE_S5; pm1_cnt_value |=3D SLEEP_ENABLE; =20 diff --git a/include/linux/platform_data/x86/pmc_atom.h b/include/linux/pla= tform_data/x86/pmc_atom.h index e4905fe69c381..e4cfcb6f16633 100644 --- a/include/linux/platform_data/x86/pmc_atom.h +++ b/include/linux/platform_data/x86/pmc_atom.h @@ -16,6 +16,8 @@ #ifndef PMC_ATOM_H #define PMC_ATOM_H =20 +#include + /* ValleyView Power Control Unit PCI Device ID */ #define PCI_DEVICE_ID_VLV_PMC 0x0F1C /* CherryTrail Power Control Unit PCI Device ID */ @@ -148,9 +150,9 @@ #define ACPI_MMIO_REG_LEN 0x100 =20 #define PM1_CNT 0x4 -#define SLEEP_TYPE_MASK 0xFFFFECFF +#define SLEEP_TYPE_MASK GENMASK(12, 10) #define SLEEP_TYPE_S5 0x1C00 -#define SLEEP_ENABLE 0x2000 +#define SLEEP_ENABLE BIT(13) =20 extern int pmc_atom_read(int offset, u32 *value); extern int pmc_atom_write(int offset, u32 value); --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2306CC54EE9 for ; Tue, 13 Sep 2022 15:21:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236093AbiIMPVN (ORCPT ); Tue, 13 Sep 2022 11:21:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35908 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235650AbiIMPTV (ORCPT ); Tue, 13 Sep 2022 11:19:21 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9B2D77A762; Tue, 13 Sep 2022 07:35:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E306FB80FBD; Tue, 13 Sep 2022 14:34:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43F08C433C1; Tue, 13 Sep 2022 14:34:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079658; bh=+JRUnhSsb3qZnjCJWE7V6Qy4eCV8rMWMOG6/1fnFw8Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CHI2SNN6zDkRd7mSSFATdtm3TF6wDQ0rE9c9Gp9fORx7d2BR+2OuZRm3h6kevc2c4 p4y1BVf5ui8zncu24L36c65oRT5sl/A3g6/e+ok1NWyUdIi9QlP9FlpLAO6sL6RwMR F5rsSwLO5rmEGGjM+969oi1w8m/XBAGG26cfEcsM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Johannes Berg , Sasha Levin Subject: [PATCH 4.14 06/61] wifi: cfg80211: debugfs: fix return type in ht40allow_map_read() Date: Tue, 13 Sep 2022 16:07:08 +0200 Message-Id: <20220913140346.780417203@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit d776763f48084926b5d9e25507a3ddb7c9243d5e ] The return type is supposed to be ssize_t, which is signed long, but "r" was declared as unsigned int. This means that on 64 bit systems we return positive values instead of negative error codes. Fixes: 80a3511d70e8 ("cfg80211: add debugfs HT40 allow map") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YutvOQeJm0UjLhwU@kili Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/wireless/debugfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c index 30fc6eb352bcc..e6410487e25da 100644 --- a/net/wireless/debugfs.c +++ b/net/wireless/debugfs.c @@ -68,9 +68,10 @@ static ssize_t ht40allow_map_read(struct file *file, { struct wiphy *wiphy =3D file->private_data; char *buf; - unsigned int offset =3D 0, buf_size =3D PAGE_SIZE, i, r; + unsigned int offset =3D 0, buf_size =3D PAGE_SIZE, i; enum nl80211_band band; struct ieee80211_supported_band *sband; + ssize_t r; =20 buf =3D kzalloc(buf_size, GFP_KERNEL); if (!buf) --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 696C1C6FA82 for ; Tue, 13 Sep 2022 15:21:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236097AbiIMPVW (ORCPT ); Tue, 13 Sep 2022 11:21:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41900 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235782AbiIMPTW (ORCPT ); Tue, 13 Sep 2022 11:19:22 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 33E337AC37; Tue, 13 Sep 2022 07:36:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5DA43B80F9D; Tue, 13 Sep 2022 14:34:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A263FC433C1; Tue, 13 Sep 2022 14:34:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079661; bh=fl+1UOIJlFEE2wyNt2W4lBZHymVKH/kugNQe66C4Z6U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qw0qJYEyS/kEYm8morrU2ImrdBBQJeOI4dcoigJHY3AIN3ysKukEg0QjJG+V+WWb3 Z3eHrYpAyNAcOb5CQ/hVg/LKQwM+WiqR4k8GkYpvp+B23I1v9D/XgXJcx4f31e5gID Ss+9f+m4hKSKyOS4xEv1ZpN7rNZ8lvbHFNl4L3hM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 07/61] ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler Date: Tue, 13 Sep 2022 16:07:09 +0200 Message-Id: <20220913140346.835357179@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou [ Upstream commit c0955bf957be4bead01fae1d791476260da7325d ] The function neigh_timer_handler() is a timer handler that runs in an atomic context. When used by rocker, neigh_timer_handler() calls "kzalloc(.., GFP_KERNEL)" that may sleep. As a result, the sleep in atomic context bug will happen. One of the processes is shown below: ofdpa_fib4_add() ... neigh_add_timer() (wait a timer) neigh_timer_handler() neigh_release() neigh_destroy() rocker_port_neigh_destroy() rocker_world_port_neigh_destroy() ofdpa_port_neigh_destroy() ofdpa_port_ipv4_neigh() kzalloc(sizeof(.., GFP_KERNEL) //may sleep This patch changes the gfp_t parameter of kzalloc() from GFP_KERNEL to GFP_ATOMIC in order to mitigate the bug. Fixes: 00fc0c51e35b ("rocker: Change world_ops API and implementation to be= switchdev independant") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/ethernet/rocker/rocker_ofdpa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ether= net/rocker/rocker_ofdpa.c index 0653b70723a34..5dad40257e12e 100644 --- a/drivers/net/ethernet/rocker/rocker_ofdpa.c +++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c @@ -1277,7 +1277,7 @@ static int ofdpa_port_ipv4_neigh(struct ofdpa_port *o= fdpa_port, bool removing; int err =3D 0; =20 - entry =3D kzalloc(sizeof(*entry), GFP_KERNEL); + entry =3D kzalloc(sizeof(*entry), GFP_ATOMIC); if (!entry) return -ENOMEM; =20 --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BA5BC54EE9 for ; Tue, 13 Sep 2022 16:59:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232009AbiIMQ7u (ORCPT ); Tue, 13 Sep 2022 12:59:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56200 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232149AbiIMQ7K (ORCPT ); Tue, 13 Sep 2022 12:59:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 41B388A1FF; Tue, 13 Sep 2022 08:50:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B8F0EB80FC0; Tue, 13 Sep 2022 14:34:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A8A5C433D6; Tue, 13 Sep 2022 14:34:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079663; bh=2uvRCFgfjdnlareJsJ7jncDl07VoGKLaINWdgnupRwM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LcFDT6RmT0QyUZR5PWeVHEq7C+vE6hDalH7oTb/S4uJe7clVS5wfcxeyJ4gz+pGsi DBuDECxPC31qDOjCbnpIqGpCVaynlYK2U3XvPncJ+jaqtRlJh81G7koTmaH2Pgp6kn A4AWKccpsKNHzCkl4QRoXDuzoFXRiapJbwj/0Lho= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+e696806ef96cdd2d87cd@syzkaller.appspotmail.com, Tom Herbert , Cong Wang , Jakub Kicinski , Sasha Levin , syzbot+9fc084a4348493ef65d2@syzkaller.appspotmail.com Subject: [PATCH 4.14 08/61] kcm: fix strp_init() order and cleanup Date: Tue, 13 Sep 2022 16:07:10 +0200 Message-Id: <20220913140346.885420616@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Cong Wang [ Upstream commit 8fc29ff3910f3af08a7c40a75d436b5720efe2bf ] strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check. This also makes a lockdep warning reported by syzbot go away. Reported-and-tested-by: syzbot+9fc084a4348493ef65d2@syzkaller.appspotmail.c= om Reported-by: syzbot+e696806ef96cdd2d87cd@syzkaller.appspotmail.com Fixes: e5571240236c ("kcm: Check if sk_user_data already set in kcm_attach") Fixes: dff8baa26117 ("kcm: Call strp_stop before strp_done in kcm_attach") Cc: Tom Herbert Signed-off-by: Cong Wang Link: https://lore.kernel.org/r/20220827181314.193710-1-xiyou.wangcong@gmai= l.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/kcm/kcmsock.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index 7b4f3f8658617..c364d849e7c3d 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1412,12 +1412,6 @@ static int kcm_attach(struct socket *sock, struct so= cket *csock, psock->sk =3D csk; psock->bpf_prog =3D prog; =20 - err =3D strp_init(&psock->strp, csk, &cb); - if (err) { - kmem_cache_free(kcm_psockp, psock); - goto out; - } - write_lock_bh(&csk->sk_callback_lock); =20 /* Check if sk_user_data is aready by KCM or someone else. @@ -1425,13 +1419,18 @@ static int kcm_attach(struct socket *sock, struct s= ocket *csock, */ if (csk->sk_user_data) { write_unlock_bh(&csk->sk_callback_lock); - strp_stop(&psock->strp); - strp_done(&psock->strp); kmem_cache_free(kcm_psockp, psock); err =3D -EALREADY; goto out; } =20 + err =3D strp_init(&psock->strp, csk, &cb); + if (err) { + write_unlock_bh(&csk->sk_callback_lock); + kmem_cache_free(kcm_psockp, psock); + goto out; + } + psock->save_data_ready =3D csk->sk_data_ready; psock->save_write_space =3D csk->sk_write_space; psock->save_state_change =3D csk->sk_state_change; --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4703FC54EE9 for ; Tue, 13 Sep 2022 15:43:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235169AbiIMPnH (ORCPT ); Tue, 13 Sep 2022 11:43:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52710 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236627AbiIMPmj (ORCPT ); Tue, 13 Sep 2022 11:42:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3888265806; Tue, 13 Sep 2022 07:46:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 426B2B80FD3; Tue, 13 Sep 2022 14:34:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9AB52C433B5; Tue, 13 Sep 2022 14:34:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079665; bh=EBD/uRGnid9f/eQA+YR/a315JnnSHdbyyJVR57L4o00=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dP3y5AoAx6eOuPnH8pi+SdekBnYLOzY836ssxeAEZp2PVMTHB5wU8LWJa2WYf9uqe cTd2sDex9Nc1w3idnSu6YdXLTrvwngwbRCktc9IYvn67Su8ohwnlvzuwIQq0BCrKwr cp2l1x/JxS8UeNVDb58/3Obk50m/CXDe01ULevv0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Nicolas Diaz , Shenwei Wang Subject: [PATCH 4.14 09/61] serial: fsl_lpuart: RS485 RTS polariy is inverse Date: Tue, 13 Sep 2022 16:07:11 +0200 Message-Id: <20220913140346.938446978@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Shenwei Wang commit 846651eca073e2e02e37490a4a52752415d84781 upstream. The setting of RS485 RTS polarity is inverse in the current driver. When the property of 'rs485-rts-active-low' is enabled in the dts node, the RTS signal should be LOW during sending. Otherwise, if there is no such a property, the RTS should be HIGH during sending. Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485") Cc: stable Signed-off-by: Nicolas Diaz Signed-off-by: Shenwei Wang Link: https://lore.kernel.org/r/20220805144529.604856-1-shenwei.wang@nxp.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/serial/fsl_lpuart.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -1106,9 +1106,9 @@ static int lpuart_config_rs485(struct ua * Note: UART is assumed to be active high. */ if (rs485->flags & SER_RS485_RTS_ON_SEND) - modem &=3D ~UARTMODEM_TXRTSPOL; - else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) modem |=3D UARTMODEM_TXRTSPOL; + else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) + modem &=3D ~UARTMODEM_TXRTSPOL; } =20 /* Store the new configuration */ From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD85CC6FA82 for ; Tue, 13 Sep 2022 15:26:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235960AbiIMP0Y (ORCPT ); Tue, 13 Sep 2022 11:26:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55348 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236244AbiIMPX5 (ORCPT ); Tue, 13 Sep 2022 11:23:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DE3F77C773; Tue, 13 Sep 2022 07:37:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B21E8B80F91; Tue, 13 Sep 2022 14:33:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1F03BC433C1; Tue, 13 Sep 2022 14:33:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079621; bh=6QeIICB9afA+06gQQvIaQmzK9vuCVqdguqf5PTujeGk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=a/jbgOyAi9a177hgx8wi3vvZXMcIh1cBuOLRMZnYQ7Q8aeiQLOxIFzO6f57uXJELy SZNqvXTJGkQap1cdw10yT9G1rf671NBCh5kOeL0/1WXJfuUoVDIByREe7kZ5SjnM8T QEZzFp59oyL1PAbDSyy6HsLNS3oypeIKUJ7NYZi0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Zheng Wang , Dan Carpenter Subject: [PATCH 4.14 10/61] staging: rtl8712: fix use after free bugs Date: Tue, 13 Sep 2022 16:07:12 +0200 Message-Id: <20220913140347.002041437@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit e230a4455ac3e9b112f0367d1b8e255e141afae0 upstream. _Read/Write_MACREG callbacks are NULL so the read/write_macreg_hdl() functions don't do anything except free the "pcmd" pointer. It results in a use after free. Delete them. Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline k= ernel") Cc: stable Reported-by: Zheng Wang Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Yw4ASqkYcUhUfoY2@kili Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/staging/rtl8712/rtl8712_cmd.c | 36 -----------------------------= ----- 1 file changed, 36 deletions(-) --- a/drivers/staging/rtl8712/rtl8712_cmd.c +++ b/drivers/staging/rtl8712/rtl8712_cmd.c @@ -129,34 +129,6 @@ static void r871x_internal_cmd_hdl(struc kfree(pdrvcmd->pbuf); } =20 -static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf) -{ - void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); - struct cmd_obj *pcmd =3D (struct cmd_obj *)pbuf; - - /* invoke cmd->callback function */ - pcmd_callback =3D cmd_callback[pcmd->cmdcode].callback; - if (!pcmd_callback) - r8712_free_cmd_obj(pcmd); - else - pcmd_callback(padapter, pcmd); - return H2C_SUCCESS; -} - -static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf) -{ - void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); - struct cmd_obj *pcmd =3D (struct cmd_obj *)pbuf; - - /* invoke cmd->callback function */ - pcmd_callback =3D cmd_callback[pcmd->cmdcode].callback; - if (!pcmd_callback) - r8712_free_cmd_obj(pcmd); - else - pcmd_callback(padapter, pcmd); - return H2C_SUCCESS; -} - static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf) { struct cmd_obj *pcmd =3D (struct cmd_obj *)pbuf; @@ -225,14 +197,6 @@ static struct cmd_obj *cmd_hdl_filter(st pcmd_r =3D NULL; =20 switch (pcmd->cmdcode) { - case GEN_CMD_CODE(_Read_MACREG): - read_macreg_hdl(padapter, (u8 *)pcmd); - pcmd_r =3D pcmd; - break; - case GEN_CMD_CODE(_Write_MACREG): - write_macreg_hdl(padapter, (u8 *)pcmd); - pcmd_r =3D pcmd; - break; case GEN_CMD_CODE(_Read_BBREG): read_bbreg_hdl(padapter, (u8 *)pcmd); break; From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A1B2C6FA82 for ; Tue, 13 Sep 2022 15:17:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235820AbiIMPQ7 (ORCPT ); Tue, 13 Sep 2022 11:16:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42466 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235898AbiIMPOH (ORCPT ); Tue, 13 Sep 2022 11:14:07 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 25B1111C10; Tue, 13 Sep 2022 07:33:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5DBC2614D8; Tue, 13 Sep 2022 14:33:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7692FC433C1; Tue, 13 Sep 2022 14:33:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079623; bh=GcjtwSEugB1O2z4YUmCKyKLq83SW/UG+NvZNEfKsXmI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J0BmLaf8RuJOkxr3UAltXH6IStqzVSKXNOjP8NUnqCBn7XiBFKfA479uow69MU7p+ YdZjSbzQ6pwkFQ1FWo8BneRWqZdz6TD2icP40rwfXGL9MKW9ub55HkgCpZ30Za3am8 c3XuLn6qNsuI+AxwP1+2eGENM0Va046NHheKIz1E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com, stable , Khalid Masum , Helge Deller Subject: [PATCH 4.14 11/61] vt: Clear selection before changing the font Date: Tue, 13 Sep 2022 16:07:13 +0200 Message-Id: <20220913140347.056052738@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller commit 566f9c9f89337792070b5a6062dff448b3e7977f upstream. When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-memory accesses by dropping the selection before the various con_font_set() console handlers are called. Reported-by: syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com Cc: stable Tested-by: Khalid Masum Signed-off-by: Helge Deller Link: https://lore.kernel.org/r/YuV9apZGNmGfjcor@p100 Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/tty/vt/vt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4175,9 +4175,11 @@ static int con_font_set(struct vc_data * console_lock(); if (vc->vc_mode !=3D KD_TEXT) rc =3D -EINVAL; - else if (vc->vc_sw->con_font_set) + else if (vc->vc_sw->con_font_set) { + if (vc_is_sel(vc)) + clear_selection(); rc =3D vc->vc_sw->con_font_set(vc, &font, op->flags); - else + } else rc =3D -ENOSYS; console_unlock(); kfree(font.data); @@ -4204,9 +4206,11 @@ static int con_font_default(struct vc_da console_unlock(); return -EINVAL; } - if (vc->vc_sw->con_font_default) + if (vc->vc_sw->con_font_default) { + if (vc_is_sel(vc)) + clear_selection(); rc =3D vc->vc_sw->con_font_default(vc, &font, s); - else + } else rc =3D -ENOSYS; console_unlock(); if (!rc) { From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 151FCC54EE9 for ; Tue, 13 Sep 2022 15:17:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229890AbiIMPRR (ORCPT ); Tue, 13 Sep 2022 11:17:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42882 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235956AbiIMPOP (ORCPT ); Tue, 13 Sep 2022 11:14:15 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F35BB77568; Tue, 13 Sep 2022 07:33:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 102CE614D6; Tue, 13 Sep 2022 14:33:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1A7D3C433D6; Tue, 13 Sep 2022 14:33:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079626; bh=rNla5KB33iDgL9vlDyODC/IPoBiMerBDac53Obu/e6s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d3QeXdP5huTjGX94eB7hkOAGS0ak/Lk746HU0MpJp0c4qOP1Xn6KAZ167PpxjqGjz 1yEQXa7MarhZuaLFHOsiI3bx/x6E6hTC4Ckd3MOSNOT2fD+Cb7imAilcrZPJFIqgHy yYXCZdvMFFfGfJ1lxAf1ISuFvzCfJUOChdmetfEo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Niek Nooijens , Johan Hovold Subject: [PATCH 4.14 12/61] USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id Date: Tue, 13 Sep 2022 16:07:14 +0200 Message-Id: <20220913140347.108295398@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Niek Nooijens commit 001047ea241a9646010b2744451dfbc7289542f3 upstream. works perfectly with: modprobe ftdi_sio echo "0590 00b2" | tee /sys/module/ftdi_sio/drivers/usb-serial\:ftdi_sio/new_id > /dev/null but doing this every reboot is a pain in the ass. Signed-off-by: Niek Nooijens Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 8 insertions(+) --- a/drivers/usb/serial/ftdi_sio.c +++ b/drivers/usb/serial/ftdi_sio.c @@ -1040,6 +1040,8 @@ static const struct usb_device_id id_tab /* IDS GmbH devices */ { USB_DEVICE(IDS_VID, IDS_SI31A_PID) }, { USB_DEVICE(IDS_VID, IDS_CM31A_PID) }, + /* Omron devices */ + { USB_DEVICE(OMRON_VID, OMRON_CS1W_CIF31_PID) }, /* U-Blox devices */ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, --- a/drivers/usb/serial/ftdi_sio_ids.h +++ b/drivers/usb/serial/ftdi_sio_ids.h @@ -662,6 +662,12 @@ #define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0= */ =20 /* + * Omron corporation (https://www.omron.com) + */ + #define OMRON_VID 0x0590 + #define OMRON_CS1W_CIF31_PID 0x00b2 + +/* * Acton Research Corp. */ #define ACTON_VID 0x0647 /* Vendor ID */ From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2D946C54EE9 for ; Tue, 13 Sep 2022 15:20:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236045AbiIMPUy (ORCPT ); Tue, 13 Sep 2022 11:20:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236111AbiIMPTH (ORCPT ); Tue, 13 Sep 2022 11:19:07 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4A44979A6F; Tue, 13 Sep 2022 07:35:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6DF14B80F9B; Tue, 13 Sep 2022 14:33:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C8DB1C433D6; Tue, 13 Sep 2022 14:33:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079629; bh=lALr4hqlVC7Kb7k9HX5nHMySYO7Fi/3h4fhul+LgTps=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gZY7vVPqaS0tWBINKhkS+NwLEmWFal5uhfMBeQnSbdNhSiOc3IjzjDZQHFk/t8uV4 Iqpl0YmOzt1Cp+WQxO7QAhXdhnhtQR7x0JZ2+iYjy7XPaBSD0GxU8S1tkZXoNxk89J Lp4221jI0kJhgB34Bx/8Iw1b65hqFhqJxUnT3sgM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Christian Brauner (Microsoft)" , Carlos Llamas , stable Subject: [PATCH 4.14 13/61] binder: fix UAF of ref->proc caused by race condition Date: Tue, 13 Sep 2022 16:07:15 +0200 Message-Id: <20220913140347.164651613@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Carlos Llamas commit a0e44c64b6061dda7e00b7c458e4523e2331b739 upstream. A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the reference for a node. In this case, the target proc normally releases the failed reference upon close as expected. However, if the target is dying in parallel the call will race with binder_deferred_release(), so the target could have released all of its references by now leaving the cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by cleaning up the failed reference on the spot instead of relying on the target to do so. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4 __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20 Acked-by: Christian Brauner (Microsoft) Signed-off-by: Carlos Llamas Cc: stable # 4.14+ Link: https://lore.kernel.org/r/20220801182511.3371447-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/android/binder.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -1757,6 +1757,18 @@ static int binder_inc_ref_for_node(struc } ret =3D binder_inc_ref_olocked(ref, strong, target_list); *rdata =3D ref->data; + if (ret && ref =3D=3D new_ref) { + /* + * Cleanup the failed reference here as the target + * could now be dead and have already released its + * references by now. Calling on the new reference + * with strong=3D0 and a tmp_refs will not decrement + * the node. The new_ref gets kfree'd below. + */ + binder_cleanup_ref_olocked(new_ref); + ref =3D NULL; + } + binder_proc_unlock(proc); if (new_ref && ref !=3D new_ref) /* From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA4C4C6FA82 for ; Tue, 13 Sep 2022 15:17:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235851AbiIMPRV (ORCPT ); Tue, 13 Sep 2022 11:17:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56914 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235499AbiIMPOY (ORCPT ); Tue, 13 Sep 2022 11:14:24 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1601678BCA; Tue, 13 Sep 2022 07:33:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4A2F8614CE; Tue, 13 Sep 2022 14:33:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 41740C433D6; Tue, 13 Sep 2022 14:33:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079631; bh=vFvwAh1oiOsmNqlxm7mbIjC5CoxMOKLwzRwiX9I8R4Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hXVdYWVl1YV86FABIcnRV0kMHWrEJfnOsCrP1H3cy7hJw6ugIdtD56MFn8tVCQllv KFE/Pr1jrgetb+h6pBcvRWSB6iu5idwaBQAxF5zIWL57Th7pm6Rl0/vXyuxG4HbT3a xRjdin+fZeA6lTKgKUlnZ3BCxLAzlcLaXO+hRT5g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Colin Ian King , Zhi Wang , Zhenyu Wang , Sasha Levin Subject: [PATCH 4.14 14/61] drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported" Date: Tue, 13 Sep 2022 16:07:16 +0200 Message-Id: <20220913140347.227530651@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Colin Ian King [ Upstream commit 233f56745be446b289edac2ba8184c09365c005e ] There is a spelling mistake in a gvt_vgpu_err error message. Fix it. Fixes: 695fbc08d80f ("drm/i915/gvt: replace the gvt_err with gvt_vgpu_err") Signed-off-by: Colin Ian King Signed-off-by: Zhi Wang Link: http://patchwork.freedesktop.org/patch/msgid/20220315202449.2952845-1= -colin.i.king@gmail.com Reviewed-by: Zhi Wang Signed-off-by: Zhenyu Wang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/i915/gvt/handlers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt= /handlers.c index a5bed2e71b926..2a6c3004ff6d9 100644 --- a/drivers/gpu/drm/i915/gvt/handlers.c +++ b/drivers/gpu/drm/i915/gvt/handlers.c @@ -601,7 +601,7 @@ static int update_fdi_rx_iir_status(struct intel_vgpu *= vgpu, else if (FDI_RX_IMR_TO_PIPE(offset) !=3D INVALID_INDEX) index =3D FDI_RX_IMR_TO_PIPE(offset); else { - gvt_vgpu_err("Unsupport registers %x\n", offset); + gvt_vgpu_err("Unsupported registers %x\n", offset); return -EINVAL; } =20 --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BBA22ECAAD8 for ; Tue, 13 Sep 2022 17:00:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232105AbiIMRAY (ORCPT ); Tue, 13 Sep 2022 13:00:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57838 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232168AbiIMQ7c (ORCPT ); Tue, 13 Sep 2022 12:59:32 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 17F798A1EC; Tue, 13 Sep 2022 08:51:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9A690B80FAF; Tue, 13 Sep 2022 14:33:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 02CB3C433C1; Tue, 13 Sep 2022 14:33:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079634; bh=XXC+a3xq5qAP/usGFnXD3rfC/OQss3BaSL/hh1UlkMY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iJJyBhn5TZNEDaTUu9hZ4s/V1S9cc+a4msZw+cM1PGt2BBI0jTh1XesC6noDF7aAz hbg1/4+Y66GZm0HRTmKM6ikYPPqtCvL2yE1sLwu846qbLOj0JgeD/U3Ht6wxHim+Bl T+HIv0QxR5M/TMGVPMSwc4aC0xYnsdqMSvQ1Ylbw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peter Robinson , Javier Martinez Canillas , Dmitry Torokhov , Sasha Levin Subject: [PATCH 4.14 15/61] Input: rk805-pwrkey - fix module autoloading Date: Tue, 13 Sep 2022 16:07:17 +0200 Message-Id: <20220913140347.280518499@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peter Robinson [ Upstream commit 99077ad668ddd9b4823cc8ce3f3c7a3fc56f6fd9 ] Add the module alias so the rk805-pwrkey driver will autoload when built as a module. Fixes: 5a35b85c2d92 ("Input: add power key driver for Rockchip RK805 PMIC") Signed-off-by: Peter Robinson Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20220612225437.3628788-1-pbrobinson@gmail.c= om Signed-off-by: Dmitry Torokhov Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/input/misc/rk805-pwrkey.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/input/misc/rk805-pwrkey.c b/drivers/input/misc/rk805-p= wrkey.c index 921003963a53c..cdcad5c01e3c0 100644 --- a/drivers/input/misc/rk805-pwrkey.c +++ b/drivers/input/misc/rk805-pwrkey.c @@ -106,6 +106,7 @@ static struct platform_driver rk805_pwrkey_driver =3D { }; module_platform_driver(rk805_pwrkey_driver); =20 +MODULE_ALIAS("platform:rk805-pwrkey"); MODULE_AUTHOR("Joseph Chen "); MODULE_DESCRIPTION("RK805 PMIC Power Key driver"); MODULE_LICENSE("GPL"); --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1D52FC6FA89 for ; Tue, 13 Sep 2022 15:20:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234250AbiIMPUt (ORCPT ); Tue, 13 Sep 2022 11:20:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40350 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236000AbiIMPSp (ORCPT ); Tue, 13 Sep 2022 11:18:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 62EF2796A3; Tue, 13 Sep 2022 07:35:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 586F9614C1; Tue, 13 Sep 2022 14:33:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6E2B9C433C1; Tue, 13 Sep 2022 14:33:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079636; bh=fwCZWdOyCDS6UONenHmEV250O9wKOBrXLdEiwoMjMAY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GDx5NEhNQaTLQci9A8fwxgzarCrWygfc/xPdc2p+nxWlLut6CrlJPvZ1MT/HzO4zS S4CrHqKK/xMZjLzmsCBtohAX/VQ7Hv/HQ8gozPZZT9Ip1lfXrY4GaGaXNBo2HhLLAq WrVoMrQ9WdBt3FmAD4VOahci3z+C94oGXaDMMfp8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Armin Wolf , Guenter Roeck , Sasha Levin Subject: [PATCH 4.14 16/61] hwmon: (gpio-fan) Fix array out of bounds access Date: Tue, 13 Sep 2022 16:07:18 +0200 Message-Id: <20220913140347.332169099@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Armin Wolf [ Upstream commit f233d2be38dbbb22299192292983037f01ab363c ] The driver does not check if the cooling state passed to gpio_fan_set_cur_state() exceeds the maximum cooling state as stored in fan_data->num_speeds. Since the cooling state is later used as an array index in set_fan_speed(), an array out of bounds access can occur. This can be exploited by setting the state of the thermal cooling device to arbitrary values, causing for example a kernel oops when unavailable memory is accessed this way. Example kernel oops: [ 807.987276] Unable to handle kernel paging request at virtual address ff= ffff80d0588064 [ 807.987369] Mem abort info: [ 807.987398] ESR =3D 0x96000005 [ 807.987428] EC =3D 0x25: DABT (current EL), IL =3D 32 bits [ 807.987477] SET =3D 0, FnV =3D 0 [ 807.987507] EA =3D 0, S1PTW =3D 0 [ 807.987536] FSC =3D 0x05: level 1 translation fault [ 807.987570] Data abort info: [ 807.987763] ISV =3D 0, ISS =3D 0x00000005 [ 807.987801] CM =3D 0, WnR =3D 0 [ 807.987832] swapper pgtable: 4k pages, 39-bit VAs, pgdp=3D00000000011650= 00 [ 807.987872] [ffffff80d0588064] pgd=3D0000000000000000, p4d=3D00000000000= 00000, pud=3D0000000000000000 [ 807.987961] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 807.987992] Modules linked in: cmac algif_hash aes_arm64 algif_skcipher = af_alg bnep hci_uart btbcm bluetooth ecdh_generic ecc 8021q garp stp llc sn= d_soc_hdmi_codec brcmfmac vc4 brcmutil cec drm_kms_helper snd_soc_core cfg8= 0211 snd_compress bcm2835_codec(C) snd_pcm_dmaengine syscopyarea bcm2835_is= p(C) bcm2835_v4l2(C) sysfillrect v4l2_mem2mem bcm2835_mmal_vchiq(C) raspber= rypi_hwmon sysimgblt videobuf2_dma_contig videobuf2_vmalloc fb_sys_fops vid= eobuf2_memops rfkill videobuf2_v4l2 videobuf2_common i2c_bcm2835 snd_bcm283= 5(C) videodev snd_pcm snd_timer snd mc vc_sm_cma(C) gpio_fan uio_pdrv_genir= q uio drm fuse drm_panel_orientation_quirks backlight ip_tables x_tables ip= v6 [ 807.988508] CPU: 0 PID: 1321 Comm: bash Tainted: G C 5.15= .56-v8+ #1575 [ 807.988548] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) [ 807.988574] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE= =3D--) [ 807.988608] pc : set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.988654] lr : gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.988691] sp : ffffffc008cf3bd0 [ 807.988710] x29: ffffffc008cf3bd0 x28: ffffff80019edac0 x27: 00000000000= 00000 [ 807.988762] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff80074= 7c920 [ 807.988787] x23: 000000000000000a x22: ffffff800369f000 x21: 00000000199= 9997c [ 807.988854] x20: ffffff800369f2e8 x19: ffffff8002ae8080 x18: 00000000000= 00000 [ 807.988877] x17: 0000000000000000 x16: 0000000000000000 x15: 000000559e2= 71b70 [ 807.988938] x14: 0000000000000000 x13: 0000000000000000 x12: 00000000000= 00000 [ 807.988960] x11: 0000000000000000 x10: ffffffc008cf3c20 x9 : ffffffcfb60= c741c [ 807.989018] x8 : 000000000000000a x7 : 00000000ffffffc9 x6 : 00000000000= 00009 [ 807.989040] x5 : 000000000000002a x4 : 0000000000000000 x3 : ffffff80036= 9f2e8 [ 807.989062] x2 : 000000000000e780 x1 : 0000000000000001 x0 : ffffff80d05= 88060 [ 807.989084] Call trace: [ 807.989091] set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.989113] gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.989199] cur_state_store+0x84/0xd0 [ 807.989221] dev_attr_store+0x20/0x38 [ 807.989262] sysfs_kf_write+0x4c/0x60 [ 807.989282] kernfs_fop_write_iter+0x130/0x1c0 [ 807.989298] new_sync_write+0x10c/0x190 [ 807.989315] vfs_write+0x254/0x378 [ 807.989362] ksys_write+0x70/0xf8 [ 807.989379] __arm64_sys_write+0x24/0x30 [ 807.989424] invoke_syscall+0x4c/0x110 [ 807.989442] el0_svc_common.constprop.3+0xfc/0x120 [ 807.989458] do_el0_svc+0x2c/0x90 [ 807.989473] el0_svc+0x24/0x60 [ 807.989544] el0t_64_sync_handler+0x90/0xb8 [ 807.989558] el0t_64_sync+0x1a0/0x1a4 [ 807.989579] Code: b9403801 f9402800 7100003f 8b35cc00 (b9400416) [ 807.989627] ---[ end trace 8ded4c918658445b ]--- Fix this by checking the cooling state and return an error if it exceeds the maximum cooling state. Tested on a Raspberry Pi 3. Fixes: b5cf88e46bad ("(gpio-fan): Add thermal control hooks") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20220830011101.178843-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/hwmon/gpio-fan.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c index 9c355b9d31c57..d1b47d20f2fab 100644 --- a/drivers/hwmon/gpio-fan.c +++ b/drivers/hwmon/gpio-fan.c @@ -422,6 +422,9 @@ static int gpio_fan_set_cur_state(struct thermal_coolin= g_device *cdev, if (!fan_data) return -EINVAL; =20 + if (state >=3D fan_data->num_speed) + return -EINVAL; + set_fan_speed(fan_data, state); return 0; } --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D15E2C6FA82 for ; Tue, 13 Sep 2022 15:21:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235792AbiIMPVK (ORCPT ); Tue, 13 Sep 2022 11:21:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57366 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231443AbiIMPTS (ORCPT ); Tue, 13 Sep 2022 11:19:18 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 835937A755; Tue, 13 Sep 2022 07:35:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7C72FB80FA1; Tue, 13 Sep 2022 14:34:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7E21C433C1; Tue, 13 Sep 2022 14:33:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079639; bh=O5f0jtSE1uRp2jrEftSCTllACyDU9RvDwCQ38tjT/Uk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=brn7s/hkvqvhvVKf6OYAsNMRGtfHnU1Bqs/tMP6o0q+Dszetm8OGS+csQxOFw7L2w vjWcMmTpJSIGWrzdA8zRYO2xK899BR38g8vaB6s3KYPqDqqS7dA4/64CluafsV0nam cf63g9D2B6UT6xzcvGjWC3JgVg4pTP2v/yAGYQVc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mika Westerberg Subject: [PATCH 4.14 17/61] thunderbolt: Use the actual buffer in tb_async_error() Date: Tue, 13 Sep 2022 16:07:19 +0200 Message-Id: <20220913140347.385907952@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mika Westerberg commit eb100b8fa8e8b59eb3e5fc7a5fd4a1e3c5950f64 upstream. The received notification packet is held in pkg->buffer and not in pkg itself. Fix this by using the correct buffer. Fixes: 81a54b5e1986 ("thunderbolt: Let the connection manager handle all no= tifications") Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/thunderbolt/ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/thunderbolt/ctl.c +++ b/drivers/thunderbolt/ctl.c @@ -401,7 +401,7 @@ static void tb_ctl_rx_submit(struct ctl_ =20 static int tb_async_error(const struct ctl_pkg *pkg) { - const struct cfg_error_pkg *error =3D (const struct cfg_error_pkg *)pkg; + const struct cfg_error_pkg *error =3D pkg->buffer; =20 if (pkg->frame.eof !=3D TB_CFG_PKG_ERROR) return false; From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4ABE3C54EE9 for ; Tue, 13 Sep 2022 15:37:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236631AbiIMPhd (ORCPT ); Tue, 13 Sep 2022 11:37:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48622 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236473AbiIMPhL (ORCPT ); Tue, 13 Sep 2022 11:37:11 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D38CF6E2C8; Tue, 13 Sep 2022 07:43:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4B087614C6; Tue, 13 Sep 2022 14:34:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5AC02C433C1; Tue, 13 Sep 2022 14:34:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079641; bh=cHqHfBxYoB0DF7kwYMzPTnj1QgRAzdbCWJQubENN888=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=de+SSuN6fnLgU/8OzEgLpV5zmJqr5MgLwGBeCE1LHb7ITGVpJwuobdlv0ZJCEjha4 t2GDCsNISDcZqDLNN8DqxiuoXpuNr/8L3JCPbYFwMQarAFiiczj93LfpChEuW2lg8C saeJb8C4pR1pZgLpGDnERQzI/JDhhB8BCoItc5Jk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mathias Nyman Subject: [PATCH 4.14 18/61] xhci: Add grace period after xHC start to prevent premature runtime suspend. Date: Tue, 13 Sep 2022 16:07:20 +0200 Message-Id: <20220913140347.432905205@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mathias Nyman commit 33e321586e37b642ad10594b9ef25a613555cd08 upstream. After xHC controller is started, either in probe or resume, it can take a while before any of the connected usb devices are visible to the roothub due to link training. It's possible xhci driver loads, sees no acivity and suspends the host before the USB device is visible. In one testcase with a hotplugged xHC controller the host finally detected the connected USB device and generated a wake 500ms after host initial start. If hosts didn't suspend the device duringe training it probablty wouldn't take up to 500ms to detect it, but looking at specs reveal USB3 link training has a couple long timeout values, such as 120ms RxDetectQuietTimeout, and 360ms PollingLFPSTimeout. So Add a 500ms grace period that keeps polling the roothub for 500ms after start, preventing runtime suspend until USB devices are detected. Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220825150840.132216-3-mathias.nyman@linux= .intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/host/xhci-hub.c | 11 +++++++++++ drivers/usb/host/xhci.c | 4 +++- drivers/usb/host/xhci.h | 2 +- 3 files changed, 15 insertions(+), 2 deletions(-) --- a/drivers/usb/host/xhci-hub.c +++ b/drivers/usb/host/xhci-hub.c @@ -1455,6 +1455,17 @@ int xhci_hub_status_data(struct usb_hcd =20 status =3D bus_state->resuming_ports; =20 + /* + * SS devices are only visible to roothub after link training completes. + * Keep polling roothubs for a grace period after xHC start + */ + if (xhci->run_graceperiod) { + if (time_before(jiffies, xhci->run_graceperiod)) + status =3D 1; + else + xhci->run_graceperiod =3D 0; + } + mask =3D PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC; =20 /* For each port, did anything change? If so, set that bit in buf. */ --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -159,9 +159,11 @@ int xhci_start(struct xhci_hcd *xhci) xhci_err(xhci, "Host took too long to start, " "waited %u microseconds.\n", XHCI_MAX_HALT_USEC); - if (!ret) + if (!ret) { /* clear state flags. Including dying, halted or removing */ xhci->xhc_state =3D 0; + xhci->run_graceperiod =3D jiffies + msecs_to_jiffies(500); + } =20 return ret; } --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -1780,7 +1780,7 @@ struct xhci_hcd { =20 /* Host controller watchdog timer structures */ unsigned int xhc_state; - + unsigned long run_graceperiod; u32 command; struct s3_save s3; /* Host controller is dying - not responding to commands. "I'm not dead ye= t!" From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA3FDC54EE9 for ; Tue, 13 Sep 2022 15:20:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233385AbiIMPUU (ORCPT ); Tue, 13 Sep 2022 11:20:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39378 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235951AbiIMPSi (ORCPT ); Tue, 13 Sep 2022 11:18:38 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0606D79A41; Tue, 13 Sep 2022 07:35:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CEF40614CF; Tue, 13 Sep 2022 14:34:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E1EB1C433D6; Tue, 13 Sep 2022 14:34:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079644; bh=wvX/8tER1vYek1vzOBoKyRvWRfxfMD8tTbBrb7D4Zgg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wrm/V0EfKX9qPpW1tri+F3NVMia8SuPe/WK9/EfzkZKLdvYfxowermCQfyZcv6wCx yQXMN+DqhZPyzZ/v2+gRG5w8zPqRhHEWLV5OyQu+72FUZugVHC+vw3nrQh8ZlFGb/a dJzN9WQQcQhixsweEtFoRGoEcIvQLVjilRToXw80= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold Subject: [PATCH 4.14 19/61] USB: serial: cp210x: add Decagon UCA device id Date: Tue, 13 Sep 2022 16:07:21 +0200 Message-Id: <20220913140347.478966094@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit ceb4038472a4803e7046ed488b03d11551991514 upstream. Add the device id for Decagon Devices USB Cable Adapter. Link: https://lore.kernel.org/r/trinity-819f9db2-d3e1-40e9-a669-9c245817c04= 6-1661523546680@msvc-mesg-web108 Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/serial/cp210x.c +++ b/drivers/usb/serial/cp210x.c @@ -134,6 +134,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */ { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenu= ator */ { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */ + { USB_DEVICE(0x10C4, 0x8414) }, /* Decagon USB Cable Adapter */ { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS= Modem */ { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Cons= ole */ From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81D77C54EE9 for ; Tue, 13 Sep 2022 15:40:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233602AbiIMPko (ORCPT ); Tue, 13 Sep 2022 11:40:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47426 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236911AbiIMPjW (ORCPT ); Tue, 13 Sep 2022 11:39:22 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ABEA56B67B; Tue, 13 Sep 2022 07:45:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7EB24614D8; Tue, 13 Sep 2022 14:34:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9B91CC433C1; Tue, 13 Sep 2022 14:34:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079648; bh=TCIma7NPREKAXuZtFQo3nopI/p7CcBG1rtrR+ZyVvq8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=O1loZK9+GrXtqY8l3sjXFCe1cI6L4WkjP+SDgPSkxEyGfLUJ+tVNLkSFupwzwVV3z UMWgeEruGACxQdGTqsj4jB07dNh8UeLuFYXTqdML5XxQyqUdMvgbO58RxRSPMeCWmR rh2Me5KbmXYfRUF6rRjsexKy6rCXtUICweBFP1rY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yan Xinyu , Johan Hovold Subject: [PATCH 4.14 20/61] USB: serial: option: add support for OPPO R11 diag port Date: Tue, 13 Sep 2022 16:07:22 +0200 Message-Id: <20220913140347.523762859@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yan Xinyu commit 8d5fc280392735e4441b35de14f2f4860fa8d83c upstream. Add support for OPPO R11 USB diag serial port to option driver. This phone uses Qualcomm Snapdragon 660 SoC. usb-devices output: T: Bus=3D03 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 10 Spd=3D480 MxC= h=3D 0 D: Ver=3D 2.00 Cls=3D00(>ifc ) Sub=3D00 Prot=3D00 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D22d9 ProdID=3D276c Rev=3D04.04 S: Manufacturer=3DOPPO S: Product=3DSDM660-MTP _SN:09C6BCA7 S: SerialNumber=3Dbeb2c403 C: #Ifs=3D 2 Cfg#=3D 1 Atr=3D80 MxPwr=3D500mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption I: If#=3D0x1 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3D42 Prot=3D01 Driver= =3Dusbfs Signed-off-by: Yan Xinyu Link: https://lore.kernel.org/r/20220714102037.4113889-1-sdlyyxy@bupt.edu.cn Link: https://lore.kernel.org/r/Yt1WfSZk03Plpnan@hovoldconsulting.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/option.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -576,6 +576,10 @@ static void option_instat_callback(struc #define WETELECOM_PRODUCT_6802 0x6802 #define WETELECOM_PRODUCT_WMD300 0x6803 =20 +/* OPPO products */ +#define OPPO_VENDOR_ID 0x22d9 +#define OPPO_PRODUCT_R11 0x276c + =20 /* Device flags */ =20 @@ -2157,6 +2161,7 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 = RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 = MBIM */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 = ECM/NCM */ + { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0= xff, 0x30) }, { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD04CC54EE9 for ; Tue, 13 Sep 2022 15:32:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236573AbiIMPcD (ORCPT ); Tue, 13 Sep 2022 11:32:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42408 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236546AbiIMPa5 (ORCPT ); Tue, 13 Sep 2022 11:30:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 56B4F7E01F; Tue, 13 Sep 2022 07:40:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A22D0B80EFA; Tue, 13 Sep 2022 14:35:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 090AFC433D6; Tue, 13 Sep 2022 14:35:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079742; bh=GP8bB4GoEKQbkETmiGkLqQvZEtcKLOUXlRA//mYizk0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xQkPdilaLnaEaOK4LyhuEScwo62ombJ14dMo97OMxLqr2BLV8Xp0CcLzYNHshgnFc 1AEguKFyX1N8XddYVhsGbZjJ+tELxQ7qI1s4bvbNluw5fqrbGLtnJF+ZPausjIsKXI IPfc3otjEUbIQWWp70hBJ6mk5k8WEIq/5PKY+okA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yonglin Tan , Johan Hovold Subject: [PATCH 4.14 21/61] USB: serial: option: add Quectel EM060K modem Date: Tue, 13 Sep 2022 16:07:23 +0200 Message-Id: <20220913140347.575256956@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yonglin Tan commit f766f3abe6dbc9bf8b56a5d53c87e5a17942c154 upstream. Add usb product id entry for the Quectel EM060K module. "MBIM mode": DIAG + NMEA + AT + MODEM + MBIM + QDSS T: Bus=3D01 Lev=3D01 Prnt=3D01 Port=3D00 Cnt=3D01 Dev#=3D 8 Spd=3D480 Mx= Ch=3D 0 D: Ver=3D 2.00 Cls=3D00(>ifc ) Sub=3D00 Prot=3D00 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D2c7c ProdID=3D030b Rev=3D 5.04 S: Manufacturer=3DQuectel S: Product=3DEM060K-GL S: SerialNumber=3D89fb57db C:* #Ifs=3D 7 Cfg#=3D 1 Atr=3Da0 MxPwr=3D500mA A: FirstIf#=3D 8 IfCount=3D 2 Cls=3D02(comm.) Sub=3D0e Prot=3D00 I:* If#=3D 0 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption E: Ad=3D01(O) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms E: Ad=3D81(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms I:* If#=3D 1 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D40 Driver= =3Doption E: Ad=3D83(I) Atr=3D03(Int.) MxPS=3D 10 Ivl=3D32ms E: Ad=3D82(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms E: Ad=3D02(O) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms I:* If#=3D 2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption E: Ad=3D85(I) Atr=3D03(Int.) MxPS=3D 10 Ivl=3D32ms E: Ad=3D84(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms E: Ad=3D03(O) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms I:* If#=3D 3 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption E: Ad=3D87(I) Atr=3D03(Int.) MxPS=3D 10 Ivl=3D32ms E: Ad=3D86(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms E: Ad=3D04(O) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms I:* If#=3D 8 Alt=3D 0 #EPs=3D 1 Cls=3D02(comm.) Sub=3D0e Prot=3D00 Driver= =3Dcdc_mbim E: Ad=3D88(I) Atr=3D03(Int.) MxPS=3D 64 Ivl=3D32ms I: If#=3D 9 Alt=3D 0 #EPs=3D 0 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim I:* If#=3D 9 Alt=3D 1 #EPs=3D 2 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim E: Ad=3D8e(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms E: Ad=3D0f(O) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms I:* If#=3D12 Alt=3D 0 #EPs=3D 1 Cls=3Dff(vend.) Sub=3Dff Prot=3D70 Driver= =3D(none) E: Ad=3D89(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms Signed-off-by: Yonglin Tan [ johan: mention QDSS port and sort entries ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -256,6 +256,7 @@ static void option_instat_callback(struc #define QUECTEL_PRODUCT_BG96 0x0296 #define QUECTEL_PRODUCT_EP06 0x0306 #define QUECTEL_PRODUCT_EM05G 0x030a +#define QUECTEL_PRODUCT_EM060K 0x030b #define QUECTEL_PRODUCT_EM12 0x0512 #define QUECTEL_PRODUCT_RM500Q 0x0800 #define QUECTEL_PRODUCT_EC200S_CN 0x6002 @@ -1145,6 +1146,9 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, = 0xff, 0, 0) }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0x= ff), .driver_info =3D RSVD(6) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K= , 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K= , 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K= , 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, = 0xff, 0xff, 0xff), .driver_info =3D RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, = 0xff, 0, 0) }, From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7742DC6FA82 for ; Tue, 13 Sep 2022 15:18:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235885AbiIMPSM (ORCPT ); Tue, 13 Sep 2022 11:18:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55590 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232215AbiIMPRh (ORCPT ); Tue, 13 Sep 2022 11:17:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 117442654C; Tue, 13 Sep 2022 07:34:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 78218614A8; Tue, 13 Sep 2022 14:34:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90A3EC433D6; Tue, 13 Sep 2022 14:34:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079670; bh=cvrnkMDrCx/9uSbW8vjSxlgM/zSoFk03KZdXYfrkIn0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=n4JoRGDP+Jata0d5FB/yBqz2JNKF1n2roHfoExbhY3dPnnmVQaAMHgZaV+IAyJj2F Iugps+RTcUpdF8iJUj4CS1Vi1GMkX7hgnN/xtUYghfErkBeydCKDdKM6dV0BL4AiYh 4zj2cVzdobmZvQbCekfHetdAICD5lVqgc+2K7nNw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Slark Xiao , Johan Hovold Subject: [PATCH 4.14 22/61] USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode Date: Tue, 13 Sep 2022 16:07:24 +0200 Message-Id: <20220913140347.618295577@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Slark Xiao commit 8ffe20d08f2c95d702c453020d03a4c568a988f0 upstream. We added PIDs for MV32-WA/WB MBIM mode before, now we need to add support for RmNet mode. Test evidence as below: T: Bus=3D03 Lev=3D01 Prnt=3D01 Port=3D02 Cnt=3D03 Dev#=3D 3 Spd=3D480 MxC= h=3D 0 D: Ver=3D 2.10 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f3 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F3 USB Mobile Broadband S: SerialNumber=3Dd7b4be8d C: #Ifs=3D 4 Cfg#=3D 1 Atr=3Da0 MxPwr=3D500mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D50 Driver= =3Dqmi_wwan I: If#=3D0x1 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption T: Bus=3D03 Lev=3D01 Prnt=3D01 Port=3D02 Cnt=3D03 Dev#=3D 10 Spd=3D480 MxC= h=3D 0 D: Ver=3D 2.10 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f4 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F4 USB Mobile Broadband S: SerialNumber=3Dd095087d C: #Ifs=3D 4 Cfg#=3D 1 Atr=3Da0 MxPwr=3D500mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D50 Driver= =3Dqmi_wwan I: If#=3D0x1 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption Signed-off-by: Slark Xiao [ johan: sort entries ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -442,6 +442,8 @@ static void option_instat_callback(struc #define CINTERION_PRODUCT_MV31_2_RMNET 0x00b9 #define CINTERION_PRODUCT_MV32_WA 0x00f1 #define CINTERION_PRODUCT_MV32_WB 0x00f2 +#define CINTERION_PRODUCT_MV32_WA_RMNET 0x00f3 +#define CINTERION_PRODUCT_MV32_WB_RMNET 0x00f4 =20 /* Olivetti products */ #define OLIVETTI_VENDOR_ID 0x0b3c @@ -2004,8 +2006,12 @@ static const struct usb_device_id option .driver_info =3D RSVD(0)}, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WA, 0xff), .driver_info =3D RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WA_RMNET, 0xff), + .driver_info =3D RSVD(0) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WB, 0xff), .driver_info =3D RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WB_RMNET, 0xff), + .driver_info =3D RSVD(0) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), .driver_info =3D RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D533C6FA82 for ; Tue, 13 Sep 2022 15:22:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235943AbiIMPWJ (ORCPT ); Tue, 13 Sep 2022 11:22:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40832 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235783AbiIMPVG (ORCPT ); Tue, 13 Sep 2022 11:21:06 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7F6687B286; Tue, 13 Sep 2022 07:36:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 96067B80FF0; Tue, 13 Sep 2022 14:34:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01310C433D6; Tue, 13 Sep 2022 14:34:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079698; bh=M85DBPo+sC6ssrj+uPVSPX8PREwvyuTPkPj0UmY4iNM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZWOiE4qsNEo6uuatiFBaMnwQCNDj1wpNTdJD97ujP/tm1Bln/Rpgoys/dSArkIAWx mohIaUyPbTWBCUsoxtnoKLKXmnP3MAwYUXkZDh9v1kp6DXJWtOUjhFTxrQ49Vkm8ES Olx9bEHUdDqJqXH5W/g5cX8MlBeDGurzyBvIeIhw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Minas Harutyunyan , Marek Szyprowski , Heiner Kallweit Subject: [PATCH 4.14 23/61] usb: dwc2: fix wrong order of phy_power_on and phy_init Date: Tue, 13 Sep 2022 16:07:25 +0200 Message-Id: <20220913140347.666168775@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Heiner Kallweit commit f9b995b49a07bd0d43b0e490f59be84415c745ae upstream. Since 1599069a62c6 ("phy: core: Warn when phy_power_on is called before phy_init") the driver complains. In my case (Amlogic SoC) the warning is: phy phy-fe03e000.phy.2: phy_power_on was called before phy_init So change the order of the two calls. The same change has to be done to the order of phy_exit() and phy_power_off(). Fixes: 09a75e857790 ("usb: dwc2: refactor common low-level hw code to platf= orm.c") Cc: stable@vger.kernel.org Acked-by: Minas Harutyunyan Acked-by: Marek Szyprowski Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/dfcc6b40-2274-4e86-e73c-5c5e6aa3e046@gmail.= com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/dwc2/platform.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/usb/dwc2/platform.c +++ b/drivers/usb/dwc2/platform.c @@ -141,9 +141,9 @@ static int __dwc2_lowlevel_hw_enable(str } else if (hsotg->plat && hsotg->plat->phy_init) { ret =3D hsotg->plat->phy_init(pdev, hsotg->plat->phy_type); } else { - ret =3D phy_power_on(hsotg->phy); + ret =3D phy_init(hsotg->phy); if (ret =3D=3D 0) - ret =3D phy_init(hsotg->phy); + ret =3D phy_power_on(hsotg->phy); } =20 return ret; @@ -175,9 +175,9 @@ static int __dwc2_lowlevel_hw_disable(st } else if (hsotg->plat && hsotg->plat->phy_exit) { ret =3D hsotg->plat->phy_exit(pdev, hsotg->plat->phy_type); } else { - ret =3D phy_exit(hsotg->phy); + ret =3D phy_power_off(hsotg->phy); if (ret =3D=3D 0) - ret =3D phy_power_off(hsotg->phy); + ret =3D phy_exit(hsotg->phy); } if (ret) return ret; From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4DBF9C6FA82 for ; Tue, 13 Sep 2022 15:26:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236164AbiIMP0n (ORCPT ); Tue, 13 Sep 2022 11:26:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53588 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236325AbiIMPYO (ORCPT ); Tue, 13 Sep 2022 11:24:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D213D7C1A5; Tue, 13 Sep 2022 07:37:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9DDCFB80FEE; Tue, 13 Sep 2022 14:35:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 03C3EC433C1; Tue, 13 Sep 2022 14:35:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079724; bh=tWzG590uEIEitmjFsZ094gdzV7rD+8143d/TW415kbs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=clKaaefwZGti/IaaGN79yQgF0IIHCj2vDjyzLAeZyKwjqX3Gak+uiEcFka8tasEce z/IpjUzLVXGdapAlLfDbBddqBSrqZoRjFwAipPez13oVoh8CQnD9ZEsUggqhi2hgV9 yL0yFuz/yMNtigFhHN2ghjMvcz1j/oG5EJgUVwZA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thierry GUIBERT , stable Subject: [PATCH 4.14 24/61] USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020) Date: Tue, 13 Sep 2022 16:07:26 +0200 Message-Id: <20220913140347.714231441@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thierry GUIBERT commit a10bc71729b236fe36de0d8e4d35c959fd8dec3a upstream. Supports for ICOM F3400 and ICOM F4400 PMR radios in CDC-ACM driver enabling the AT serial port. The Vendor Id is 0x0C26 The Product ID is 0x0020 Output of lsusb : Bus 001 Device 009: ID 0c26:0020 Prolific Technology Inc. ICOM Radio Couldn't open device, some information will be missing Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 2 Communications bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x0c26 Prolific Technology Inc. idProduct 0x0020 bcdDevice 0.00 iManufacturer 1 ICOM Inc. iProduct 2 ICOM Radio iSerial 3 *obfuscated* bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 0x0030 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xc0 Self Powered MaxPower 0mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 2 Communications bInterfaceSubClass 2 Abstract (modem) bInterfaceProtocol 1 AT-commands (v.25ter) iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 12 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 10 CDC Data bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Signed-off-by: Thierry GUIBERT Cc: stable Link: https://lore.kernel.org/r/20220819081702.84118-1-thierry.guibert@croi= x-rouge.fr Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/class/cdc-acm.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -1894,6 +1894,9 @@ static const struct usb_device_id acm_id { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */ .driver_info =3D NO_UNION_NORMAL, /* has misplaced union descriptor */ }, + { USB_DEVICE(0x0c26, 0x0020), /* Icom ICF3400 Serie */ + .driver_info =3D NO_UNION_NORMAL, /* reports zero length descriptor */ + }, { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */ .driver_info =3D NO_UNION_NORMAL, /* reports zero length descriptor */ }, From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2D751C6FA86 for ; Tue, 13 Sep 2022 15:26:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236320AbiIMP0F (ORCPT ); Tue, 13 Sep 2022 11:26:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58446 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236218AbiIMPXy (ORCPT ); Tue, 13 Sep 2022 11:23:54 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9C9207C776; Tue, 13 Sep 2022 07:37:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 66BCCB80FF2; Tue, 13 Sep 2022 14:35:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AEF43C433D7; Tue, 13 Sep 2022 14:35:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079727; bh=2hBL8XigB4HHBKerBlukkri/okODgJyoejnjyoF4k9U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Cxy8gO0xlwArwt6xptp8KgdtN0CcOqBRSuo2YOipFINF62qpn6OTVLkq9d4lMjzxZ IeNqsKKQHOlaznSTN1z8h53l6TNxrBEbJ0jqZG/9QKN5v6JRxedu3UwXnUWjgcuUh5 d1KXPspxDIo9OOm29w5GcwZ5BqJ3gjCcNBlAYv4s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , stable , Witold Lipieta Subject: [PATCH 4.14 25/61] usb-storage: Add ignore-residue quirk for NXP PN7462AU Date: Tue, 13 Sep 2022 16:07:27 +0200 Message-Id: <20220913140347.759074778@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Witold Lipieta commit 2aa48857ad52236a9564c71183d6cc8893becd41 upstream. This is USB mass storage primary boot loader for code download on NXP PN7462AU. Without the quirk it is impossible to write whole memory at once as device restarts during the write due to bogus residue values reported. Acked-by: Alan Stern Cc: stable Signed-off-by: Witold Lipieta Link: https://lore.kernel.org/r/20220809112911.462776-1-witold.lipieta@thau= matec.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/usb/storage/unusual_devs.h +++ b/drivers/usb/storage/unusual_devs.h @@ -2313,6 +2313,13 @@ UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ), =20 +/* Reported by Witold Lipieta */ +UNUSUAL_DEV( 0x1fc9, 0x0117, 0x0100, 0x0100, + "NXP Semiconductors", + "PN7462AU", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_RESIDUE ), + /* Supplied with some Castlewood ORB removable drives */ UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x9999, "Double-H Technology", From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F60CC54EE9 for ; Tue, 13 Sep 2022 15:26:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236174AbiIMP0f (ORCPT ); Tue, 13 Sep 2022 11:26:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45214 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236292AbiIMPYJ (ORCPT ); Tue, 13 Sep 2022 11:24:09 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7DA7E7CA86; Tue, 13 Sep 2022 07:37:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 30F59B80FC9; Tue, 13 Sep 2022 14:35:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8137AC433D6; Tue, 13 Sep 2022 14:35:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079730; bh=wbhwPkgVfB0u/ecYJDpzWyQrjPmGXlonw19X6uHaZ7w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G6InT2Cy+yXBKvFeUgj3ujnPXC7320pL+wqHwJlpwauiWssveWgYRQxNUAuXdrsID m/df/FMT02HiiafY0p48OGdR5FL37G35PETOHhZHpoCfMsrlJ3J4C/esKa4AgQy1Xc LR/sGJ+fTCmySzc93MaHPNpLKfR0zE9TbkyyPx6k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Gordeev , Gerald Schaefer , Vasily Gorbik Subject: [PATCH 4.14 26/61] s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages Date: Tue, 13 Sep 2022 16:07:28 +0200 Message-Id: <20220913140347.807108405@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Gerald Schaefer commit 7c8d42fdf1a84b1a0dd60d6528309c8ec127e87c upstream. The alignment check in prepare_hugepage_range() is wrong for 2 GB hugepages, it only checks for 1 MB hugepage alignment. This can result in kernel crash in __unmap_hugepage_range() at the BUG_ON(start & ~huge_page_mask(h)) alignment check, for mappings created with MAP_FIXED at unaligned address. Fix this by correctly handling multiple hugepage sizes, similar to the generic version of prepare_hugepage_range(). Fixes: d08de8e2d867 ("s390/mm: add support for 2GB hugepages") Cc: # 4.8+ Acked-by: Alexander Gordeev Signed-off-by: Gerald Schaefer Signed-off-by: Vasily Gorbik Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/s390/include/asm/hugetlb.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/arch/s390/include/asm/hugetlb.h +++ b/arch/s390/include/asm/hugetlb.h @@ -30,9 +30,11 @@ pte_t huge_ptep_get_and_clear(struct mm_ static inline int prepare_hugepage_range(struct file *file, unsigned long addr, unsigned long len) { - if (len & ~HPAGE_MASK) + struct hstate *h =3D hstate_file(file); + + if (len & ~huge_page_mask(h)) return -EINVAL; - if (addr & ~HPAGE_MASK) + if (addr & ~huge_page_mask(h)) return -EINVAL; return 0; } From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7ED2C6FA82 for ; Tue, 13 Sep 2022 15:27:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236176AbiIMP1B (ORCPT ); Tue, 13 Sep 2022 11:27:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49422 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236367AbiIMPYU (ORCPT ); Tue, 13 Sep 2022 11:24:20 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 509A37CB56; Tue, 13 Sep 2022 07:37:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B9109B80FF1; Tue, 13 Sep 2022 14:35:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2C151C433C1; Tue, 13 Sep 2022 14:35:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079732; bh=RxGKZIj8w9RGrU9wWujCqb97C+0o+xW40upbXiX08Jk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kZEm8WRx52ZHrSJ3UOlVbAudC2w1aEi47PKXwnCljcLzBKmhNaJfdlWRMD5/AMgce oOybvruauVBmaarEllVAtV56I2Y3KKRu3JDyapqKvbbFzXonhQ6Y5nHNKnra6n3CAs 69MJ0/HbZ5GMkH/FQZVXn+tKzidvwrZ5KObzKJn8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josh Poimboeuf , Heiko Carstens , Vasily Gorbik Subject: [PATCH 4.14 27/61] s390: fix nospec table alignments Date: Tue, 13 Sep 2022 16:07:29 +0200 Message-Id: <20220913140347.857194457@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Josh Poimboeuf commit c9305b6c1f52060377c72aebe3a701389e9f3172 upstream. Add proper alignment for .nospec_call_table and .nospec_return_table in vmlinux. [hca@linux.ibm.com]: The problem with the missing alignment of the nospec tables exist since a long time, however only since commit e6ed91fd0768 ("s390/alternatives: remove padding generation code") and with CONFIG_RELOCATABLE=3Dn the kernel may also crash at boot time. The above named commit reduced the size of struct alt_instr by one byte, so its new size is 11 bytes. Therefore depending on the number of cpu alternatives the size of the __alt_instructions array maybe odd, which again also causes that the addresses of the nospec tables will be odd. If the address of __nospec_call_start is odd and the kernel is compiled With CONFIG_RELOCATABLE=3Dn the compiler may generate code that loads the address of __nospec_call_start with a 'larl' instruction. This will generate incorrect code since the 'larl' instruction only works with even addresses. In result the members of the nospec tables will be accessed with an off-by-one offset, which subsequently may lead to addressing exceptions within __nospec_revert(). Fixes: f19fbd5ed642 ("s390: introduce execute-trampolines for branches") Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/8719bf1ce4a72ebdeb575200290094e9ce047bcc.16= 61557333.git.jpoimboe@kernel.org Cc: # 4.16 Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/s390/kernel/vmlinux.lds.S | 1 + 1 file changed, 1 insertion(+) --- a/arch/s390/kernel/vmlinux.lds.S +++ b/arch/s390/kernel/vmlinux.lds.S @@ -131,6 +131,7 @@ SECTIONS /* * Table with the patch locations to undo expolines */ + . =3D ALIGN(4); .nospec_call_table : { __nospec_call_start =3D . ; *(.s390_indirect*) From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6F8B2C6FA86 for ; Tue, 13 Sep 2022 15:32:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236542AbiIMPcT (ORCPT ); Tue, 13 Sep 2022 11:32:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52290 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234707AbiIMPbs (ORCPT ); Tue, 13 Sep 2022 11:31:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0765C78599; Tue, 13 Sep 2022 07:40:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3C1BAB8100C; Tue, 13 Sep 2022 14:35:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9D458C433D7; Tue, 13 Sep 2022 14:35:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079734; bh=gIiL6T4LvaFLNHSvjDxv/6KecjXwYvhUtfdxuCANdKg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rZogGtYbcdmWCvcOs/nqZMafDSFIwnMEaJjDgxv6oXF4etOVQZO/zyzkcjMTx6VqM 4cziIigCKcG/GNmiIMBKPMDWqZodgyRN/4r8qiZ8wvCLHFIL9C43+5H0J9Tx3BnSCS L3An3bFKPmBz2irS5WFiElJmx5lNPhIShCC9DmB0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Rondreis Subject: [PATCH 4.14 28/61] USB: core: Prevent nested device-reset calls Date: Tue, 13 Sep 2022 16:07:30 +0200 Message-Id: <20220913140347.905656775@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 9c6d778800b921bde3bff3cff5003d1650f942d1 upstream. Automatic kernel fuzzing revealed a recursive locking violation in usb-storage: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D WARNING: possible recursive locking detected 5.18.0 #3 Not tainted Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing -------------------------------------------- kworker/1:3/1205 is trying to acquire lock: ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 but task is already holding lock: ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 ... stack backtrace: CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_deadlock_bug kernel/locking/lockdep.c:2988 [inline] check_deadlock kernel/locking/lockdep.c:3031 [inline] validate_chain kernel/locking/lockdep.c:3816 [inline] __lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053 lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630 __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747 usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 usb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109 r871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622 usb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:545 [inline] device_remove+0x11f/0x170 drivers/base/dd.c:537 __device_release_driver drivers/base/dd.c:1222 [inline] device_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248 usb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627 usb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118 usb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114 This turned out not to be an error in usb-storage but rather a nested device reset attempt. That is, as the rtl8712 driver was being unbound from a composite device in preparation for an unrelated USB reset (that driver does not have pre_reset or post_reset callbacks), its ->remove routine called usb_reset_device() -- thus nesting one reset call within another. Performing a reset as part of disconnect processing is a questionable practice at best. However, the bug report points out that the USB core does not have any protection against nested resets. Adding a reset_in_progress flag and testing it will prevent such errors in the future. Link: https://lore.kernel.org/all/CAB7eexKUpvX-JNiLzhXBDWgfg2T9e9_0Tw4HQ6ke= N=3D=3DvoRbP0g@mail.gmail.com/ Cc: stable@vger.kernel.org Reported-and-tested-by: Rondreis Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YwkflDxvg0KWqyZK@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/hub.c | 10 ++++++++++ include/linux/usb.h | 2 ++ 2 files changed, 12 insertions(+) --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -5737,6 +5737,11 @@ re_enumerate_no_bos: * the reset is over (using their post_reset method). * * Return: The same as for usb_reset_and_verify_device(). + * However, if a reset is already in progress (for instance, if a + * driver doesn't have pre_ or post_reset() callbacks, and while + * being unbound or re-bound during the ongoing reset its disconnect() + * or probe() routine tries to perform a second, nested reset), the + * routine returns -EINPROGRESS. * * Note: * The caller must own the device lock. For example, it's safe to use @@ -5770,6 +5775,10 @@ int usb_reset_device(struct usb_device * return -EISDIR; } =20 + if (udev->reset_in_progress) + return -EINPROGRESS; + udev->reset_in_progress =3D 1; + port_dev =3D hub->ports[udev->portnum - 1]; =20 /* @@ -5834,6 +5843,7 @@ int usb_reset_device(struct usb_device * =20 usb_autosuspend_device(udev); memalloc_noio_restore(noio_flag); + udev->reset_in_progress =3D 0; return ret; } EXPORT_SYMBOL_GPL(usb_reset_device); --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -568,6 +568,7 @@ struct usb3_lpm_parameters { * @level: number of USB hub ancestors * @can_submit: URBs may be submitted * @persist_enabled: USB_PERSIST enabled for this device + * @reset_in_progress: the device is being reset * @have_langid: whether string_langid is valid * @authorized: policy has said we can use it; * (user space) policy determines if we authorize this device to be @@ -646,6 +647,7 @@ struct usb_device { =20 unsigned can_submit:1; unsigned persist_enabled:1; + unsigned reset_in_progress:1; unsigned have_langid:1; unsigned authorized:1; unsigned authenticated:1; From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F07C9C54EE9 for ; Tue, 13 Sep 2022 15:26:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236142AbiIMP0w (ORCPT ); Tue, 13 Sep 2022 11:26:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55524 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236354AbiIMPYT (ORCPT ); Tue, 13 Sep 2022 11:24:19 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 54F597C302; Tue, 13 Sep 2022 07:38:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BC4F6B8100B; Tue, 13 Sep 2022 14:35:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0AB6DC433D6; Tue, 13 Sep 2022 14:35:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079737; bh=0PyzWKGgacvE+hrA7uAAPic9Xb5y/v5fYZvJrGxE2Bo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Kbc8iKna4SgnXotQNmByERaMbW/Zuk61th+PI0LvMUgPanioPteB2WCrgYLKmFl0h eonvfU3FP2236MTqBM7/H0vhPfhC26otcgSC08/GWwoV5BRRSYdU4nJbw+3oxp0b3o MZqzxb4R0NBR6sNCMkBVyELlPwALoCtLk8Sn3pzY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Krishna Kurapati Subject: [PATCH 4.14 29/61] usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS Date: Tue, 13 Sep 2022 16:07:31 +0200 Message-Id: <20220913140347.955607221@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krishna Kurapati commit 9d4dc16ec71bd6368548e9743223e449b4377fc7 upstream. During cdrom emulation, the response to read_toc command must contain the cdrom address as the number of sectors (2048 byte sized blocks) represented either as an absolute value (when MSF bit is '0') or in terms of PMin/PSec/PFrame (when MSF bit is set to '1'). Incase of cdrom, the fsg_lun_open call sets the sector size to 2048 bytes. When MAC OS sends a read_toc request with MSF set to '1', the store_cdrom_address assumes that the address being provided is the LUN size represented in 512 byte sized blocks instead of 2048. It tries to modify the address further to convert it to 2048 byte sized blocks and store it in MSF format. This results in data transfer failures as the cdrom address being provided in the read_toc response is incorrect. Fixes: 3f565a363cee ("usb: gadget: storage: adapt logic block size to bound= block devices") Cc: stable@vger.kernel.org Acked-by: Alan Stern Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/1661570110-19127-1-git-send-email-quic_kris= kura@quicinc.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/gadget/function/storage_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/usb/gadget/function/storage_common.c +++ b/drivers/usb/gadget/function/storage_common.c @@ -298,8 +298,10 @@ EXPORT_SYMBOL_GPL(fsg_lun_fsync_sub); void store_cdrom_address(u8 *dest, int msf, u32 addr) { if (msf) { - /* Convert to Minutes-Seconds-Frames */ - addr >>=3D 2; /* Convert to 2048-byte frames */ + /* + * Convert to Minutes-Seconds-Frames. + * Sector size is already set to 2048 bytes. + */ addr +=3D 2*75; /* Lead-in occupies 2 seconds */ dest[3] =3D addr % 75; /* Frames */ addr /=3D 75; From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00AF5C6FA82 for ; Tue, 13 Sep 2022 15:26:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236042AbiIMP0b (ORCPT ); Tue, 13 Sep 2022 11:26:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55666 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236280AbiIMPYE (ORCPT ); Tue, 13 Sep 2022 11:24:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B06A87CA80; Tue, 13 Sep 2022 07:37:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6D259614CF; Tue, 13 Sep 2022 14:35:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7CAAEC433D7; Tue, 13 Sep 2022 14:35:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079739; bh=exZdNZWzP0dOHve55ZJWQ3kh4qj940fegArBrUQhtkE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=udBCx8qsHRu66I/cDrQotrnminN7AWQ26+HlrfwKm0tZrJfN2dm6LhLWrTAsvanGV orHzk7PqDmgvH/t2aeGDqJyC9dw3T04tdk68LHKKWahmQsbwBDDUxmCIqFLFlzMGXu M2qGJsoQp3hcZsd9MKnP/Pyv4R0xxmehMsemk5y4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com, Siddh Raman Pant , Johannes Berg Subject: [PATCH 4.14 30/61] wifi: mac80211: Dont finalize CSA in IBSS mode if state is disconnected Date: Tue, 13 Sep 2022 16:07:32 +0200 Message-Id: <20220913140348.000341495@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Siddh Raman Pant commit 15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0 upstream. When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa(). Cc: stable@vger.kernel.org Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode") Link: https://syzkaller.appspot.com/bug?id=3D05603ef4ae8926761b678d2939a3b2= ad28ab9ca6 Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com Signed-off-by: Siddh Raman Pant Tested-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220814151512.9985-1-code@siddh.me Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/mac80211/ibss.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/net/mac80211/ibss.c +++ b/net/mac80211/ibss.c @@ -544,6 +544,10 @@ int ieee80211_ibss_finish_csa(struct iee =20 sdata_assert_lock(sdata); =20 + /* When not connected/joined, sending CSA doesn't make sense. */ + if (ifibss->state !=3D IEEE80211_IBSS_MLME_JOINED) + return -ENOLINK; + /* update cfg80211 bss information with the new channel */ if (!is_zero_ether_addr(ifibss->bssid)) { cbss =3D cfg80211_get_bss(sdata->local->hw.wiphy, From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 12955C6FA8A for ; Tue, 13 Sep 2022 15:27:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236361AbiIMP1r (ORCPT ); Tue, 13 Sep 2022 11:27:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236311AbiIMP0D (ORCPT ); Tue, 13 Sep 2022 11:26:03 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E8CEE7DF4B; Tue, 13 Sep 2022 07:38:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8631CB80FE3; Tue, 13 Sep 2022 14:34:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EEFADC433C1; Tue, 13 Sep 2022 14:34:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079673; bh=JYuxi9O3FdJnifusqhvtJkC+4XphOyrht8mntGp0LCI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UCDqudbAM2Fxy9sT82X0MEDvtjf6rWOCqV0RO8AKYkNLM4BXKVhNfthbahBNlvkHw rzLrYFBaj92m/Plj78l12/OgndJpwXuMPAr84r4BEZl25VgxG+2YNmnhmjBVkDNKa9 klBTzWqENSOVTfoqfJ7z4mRbK6EId+yBLq9t5YII= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miquel Raynal , Stefan Schmidt Subject: [PATCH 4.14 31/61] net: mac802154: Fix a condition in the receive path Date: Tue, 13 Sep 2022 16:07:33 +0200 Message-Id: <20220913140348.048092061@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miquel Raynal commit f0da47118c7e93cdbbc6fb403dd729a5f2c90ee3 upstream. Upon reception, a packet must be categorized, either it's destination is the host, or it is another host. A packet with no destination addressing fields may be valid in two situations: - the packet has no source field: only ACKs are built like that, we consider the host as the destination. - the packet has a valid source field: it is directed to the PAN coordinator, as for know we don't have this information we consider we are not the PAN coordinator. There was likely a copy/paste error made during a previous cleanup because the if clause is now containing exactly the same condition as in the switch case, which can never be true. In the past the destination address was used in the switch and the source address was used in the if, which matches what the spec says. Cc: stable@vger.kernel.org Fixes: ae531b9475f6 ("ieee802154: use ieee802154_addr instead of *_sa varia= nts") Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20220826142954.254853-1-miquel.raynal@bootl= in.com Signed-off-by: Stefan Schmidt Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/mac802154/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/mac802154/rx.c +++ b/net/mac802154/rx.c @@ -52,7 +52,7 @@ ieee802154_subif_frame(struct ieee802154 =20 switch (mac_cb(skb)->dest.mode) { case IEEE802154_ADDR_NONE: - if (mac_cb(skb)->dest.mode !=3D IEEE802154_ADDR_NONE) + if (hdr->source.mode !=3D IEEE802154_ADDR_NONE) /* FIXME: check if we are PAN coordinator */ skb->pkt_type =3D PACKET_OTHERHOST; else From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89C7BC6FA82 for ; Tue, 13 Sep 2022 15:18:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235746AbiIMPSR (ORCPT ); Tue, 13 Sep 2022 11:18:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35238 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235703AbiIMPRk (ORCPT ); Tue, 13 Sep 2022 11:17:40 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 204712BB22; Tue, 13 Sep 2022 07:34:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5ED7B614E6; Tue, 13 Sep 2022 14:34:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77830C4314B; Tue, 13 Sep 2022 14:34:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079675; bh=+XPBrIOIZ3AEbHVdiyGfUYR8D1RWCPPH5kCaPunTPDE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=txesi3/XIjBjG9OsMLMICc5BtrzRoCFc2ZGFdGNx1nYCu3gKcIGYGh1UdLbkxYQ0l Lk59KRnguXH4ojX7se6rxGbUdEEiK7IMMCi/zUHR2VsNMZmvzbLi1Ua+XeBg1upuca vqveO4rJ3cyV8osBKeSah5Yss6ozJUTrRN4GRo/U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Abhishek Shah , Takashi Iwai Subject: [PATCH 4.14 32/61] ALSA: seq: oss: Fix data-race for max_midi_devs access Date: Tue, 13 Sep 2022 16:07:34 +0200 Message-Id: <20220913140348.091996873@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 22dec134dbfa825b963f8a1807ad19b943e46a56 upstream. ALSA OSS sequencer refers to a global variable max_midi_devs at creating a new port, storing it to its own field. Meanwhile this variable may be changed by other sequencer events at snd_seq_oss_midi_check_exit_port() in parallel, which may cause a data race. OTOH, this data race itself is almost harmless, as the access to the MIDI device is done via get_mdev() and it's protected with a refcount, hence its presence is guaranteed. Though, it's sill better to address the data-race from the code sanity POV, and this patch adds the proper spinlock for the protection. Reported-by: Abhishek Shah Cc: Link: https://lore.kernel.org/r/CAEHB2493pZRXs863w58QWnUTtv3HHfg85aYhLn5HJH= CwxqtHQg@mail.gmail.com Link: https://lore.kernel.org/r/20220823072717.1706-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/core/seq/oss/seq_oss_midi.c | 2 ++ 1 file changed, 2 insertions(+) --- a/sound/core/seq/oss/seq_oss_midi.c +++ b/sound/core/seq/oss/seq_oss_midi.c @@ -280,7 +280,9 @@ snd_seq_oss_midi_clear_all(void) void snd_seq_oss_midi_setup(struct seq_oss_devinfo *dp) { + spin_lock_irq(®ister_lock); dp->max_mididev =3D max_midi_devs; + spin_unlock_irq(®ister_lock); } =20 /* From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD788C6FA82 for ; Tue, 13 Sep 2022 15:21:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236102AbiIMPV1 (ORCPT ); Tue, 13 Sep 2022 11:21:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41098 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235872AbiIMPTl (ORCPT ); Tue, 13 Sep 2022 11:19:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5E1647B1DD; Tue, 13 Sep 2022 07:36:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 85CB3B80FC6; Tue, 13 Sep 2022 14:34:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E5008C433D7; Tue, 13 Sep 2022 14:34:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079678; bh=2jMSUEghuLlu/1D6x2idR7tJj/F/ZgljozPqFgP5Eq4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=07uMPzxVzf9Niifmcz3gbCqG9jII2KIlDMGTNxjllX/uTRr4PZPJVC+xS11Bdl5do 4jL7mCxL22fCXzsXgVL0b/lZiQRGfOb3lAZGScaiOAt/rtZ5vNc1YlomxELyk76BbR tsLdqqK8yUGfGqMH1oQKWi1pcPeXZRzDGRJ8I5lI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Abhishek Shah , Takashi Iwai Subject: [PATCH 4.14 33/61] ALSA: seq: Fix data-race at module auto-loading Date: Tue, 13 Sep 2022 16:07:35 +0200 Message-Id: <20220913140348.146108554@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 3e7e04b747adea36f349715d9f0998eeebf15d72 upstream. It's been reported that there is a possible data-race accessing to the global card_requested[] array at ALSA sequencer core, which is used for determining whether to call request_module() for the card or not. This data race itself is almost harmless, as it might end up with one extra request_module() call for the already loaded module at most. But it's still better to fix. This patch addresses the possible data race of card_requested[] and client_requested[] arrays by replacing them with bitmask. It's an atomic operation and can work without locks. Reported-by: Abhishek Shah Cc: Link: https://lore.kernel.org/r/CAEHB24_ay6YzARpA1zgCsE7=3DH9CSJJzux618E=3D= Ka4h0YdKn=3DqA@mail.gmail.com Link: https://lore.kernel.org/r/20220823072717.1706-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/core/seq/seq_clientmgr.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -136,13 +136,13 @@ struct snd_seq_client *snd_seq_client_us spin_unlock_irqrestore(&clients_lock, flags); #ifdef CONFIG_MODULES if (!in_interrupt()) { - static char client_requested[SNDRV_SEQ_GLOBAL_CLIENTS]; - static char card_requested[SNDRV_CARDS]; + static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS); + static DECLARE_BITMAP(card_requested, SNDRV_CARDS); + if (clientid < SNDRV_SEQ_GLOBAL_CLIENTS) { int idx; =09 - if (!client_requested[clientid]) { - client_requested[clientid] =3D 1; + if (!test_and_set_bit(clientid, client_requested)) { for (idx =3D 0; idx < 15; idx++) { if (seq_client_load[idx] < 0) break; @@ -157,10 +157,8 @@ struct snd_seq_client *snd_seq_client_us int card =3D (clientid - SNDRV_SEQ_GLOBAL_CLIENTS) / SNDRV_SEQ_CLIENTS_PER_CARD; if (card < snd_ecards_limit) { - if (! card_requested[card]) { - card_requested[card] =3D 1; + if (!test_and_set_bit(card, card_requested)) snd_request_card(card); - } snd_seq_device_load_drivers(); } } From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3433FC6FA89 for ; Tue, 13 Sep 2022 15:23:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236075AbiIMPXV (ORCPT ); Tue, 13 Sep 2022 11:23:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56660 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236006AbiIMPWb (ORCPT ); Tue, 13 Sep 2022 11:22:31 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6A9097B2AE; Tue, 13 Sep 2022 07:36:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6E953614D6; Tue, 13 Sep 2022 14:34:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 88569C433D6; Tue, 13 Sep 2022 14:34:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079680; bh=wKgCJp3zP3NbNOdKEk+ETPqBa8zJh+si08wG0lof3t0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aHKYbCJRTSbEDdz7qOIo0Qiy/VcdGxjlaYwmEibEsGWMq84zW12qucN3gwb12jBQj AXDhg/ZXidLJLDaozoQdj1ppYphHJB0YCxYNdgm8CI2X5qX8hmchlaPo1WK6ig/ibL UmwgE4+UnaN3VGudtHDVAG35uIIssbmC08xkaevs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hyunwoo Kim , Ard Biesheuvel Subject: [PATCH 4.14 34/61] efi: capsule-loader: Fix use-after-free in efi_capsule_write Date: Tue, 13 Sep 2022 16:07:36 +0200 Message-Id: <20220913140348.194658717@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hyunwoo Kim commit 9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95 upstream. A race condition may occur if the user calls close() on another thread during a write() operation on the device node of the efi capsule. This is a race condition that occurs between the efi_capsule_write() and efi_capsule_flush() functions of efi_capsule_fops, which ultimately results in UAF. So, the page freeing process is modified to be done in efi_capsule_release() instead of efi_capsule_flush(). Cc: # v4.9+ Signed-off-by: Hyunwoo Kim Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/ Signed-off-by: Ard Biesheuvel Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/firmware/efi/capsule-loader.c | 31 +++++++----------------------= -- 1 file changed, 7 insertions(+), 24 deletions(-) --- a/drivers/firmware/efi/capsule-loader.c +++ b/drivers/firmware/efi/capsule-loader.c @@ -238,29 +238,6 @@ failed: } =20 /** - * efi_capsule_flush - called by file close or file flush - * @file: file pointer - * @id: not used - * - * If a capsule is being partially uploaded then calling this function - * will be treated as upload termination and will free those completed - * buffer pages and -ECANCELED will be returned. - **/ -static int efi_capsule_flush(struct file *file, fl_owner_t id) -{ - int ret =3D 0; - struct capsule_info *cap_info =3D file->private_data; - - if (cap_info->index > 0) { - pr_err("capsule upload not complete\n"); - efi_free_all_buff_pages(cap_info); - ret =3D -ECANCELED; - } - - return ret; -} - -/** * efi_capsule_release - called by file close * @inode: not used * @file: file pointer @@ -272,6 +249,13 @@ static int efi_capsule_release(struct in { struct capsule_info *cap_info =3D file->private_data; =20 + if (cap_info->index > 0 && + (cap_info->header.headersize =3D=3D 0 || + cap_info->count < cap_info->total_size)) { + pr_err("capsule upload not complete\n"); + efi_free_all_buff_pages(cap_info); + } + kfree(cap_info->pages); kfree(cap_info->phys); kfree(file->private_data); @@ -319,7 +303,6 @@ static const struct file_operations efi_ .owner =3D THIS_MODULE, .open =3D efi_capsule_open, .write =3D efi_capsule_write, - .flush =3D efi_capsule_flush, .release =3D efi_capsule_release, .llseek =3D no_llseek, }; From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ECED6C6FA82 for ; Tue, 13 Sep 2022 15:23:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236050AbiIMPXL (ORCPT ); Tue, 13 Sep 2022 11:23:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45144 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235950AbiIMPWT (ORCPT ); Tue, 13 Sep 2022 11:22:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A61267B78B; Tue, 13 Sep 2022 07:36:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 15426614E0; Tue, 13 Sep 2022 14:34:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2185EC433C1; Tue, 13 Sep 2022 14:34:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079683; bh=rV+n4kd+7BD+xatHr5rme8y5xnzaeFBry0keN3r8Rlo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z5jgMslu3EH8ymxaAZWvaZZYdElf/C/s5kAiNpwr+jS+2GIAnn1gZ9G/bb6q+tNDb 98wbn3xjyEaSzJwudjnUkapGrDNT7YylHIO/0AS4/slpe9Y8Eh1nrlnM8pHhULLmv/ Pkrxijs5r4Z7at03bAzyGGZkogdbkio40celAgI0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stanislaw Gruszka , Kalle Valo Subject: [PATCH 4.14 35/61] wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd() Date: Tue, 13 Sep 2022 16:07:37 +0200 Message-Id: <20220913140348.244519936@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Stanislaw Gruszka commit 6d0ef7241553f3553a0a2764c69b07892705924c upstream. This reverts commit a8eb8e6f7159c7c20c0ddac428bde3d110890aa7 as it can cause invalid link quality command sent to the firmware and address the off-by-one issue by fixing condition of while loop. Cc: stable@vger.kernel.org Fixes: a8eb8e6f7159 ("wifi: iwlegacy: 4965: fix potential off-by-one overfl= ow in il4965_rs_fill_link_cmd()") Signed-off-by: Stanislaw Gruszka Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220815073737.GA999388@wp.pl Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/net/wireless/intel/iwlegacy/4965-rs.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) --- a/drivers/net/wireless/intel/iwlegacy/4965-rs.c +++ b/drivers/net/wireless/intel/iwlegacy/4965-rs.c @@ -2424,7 +2424,7 @@ il4965_rs_fill_link_cmd(struct il_priv * /* Repeat initial/next rate. * For legacy IL_NUMBER_TRY =3D=3D 1, this loop will not execute. * For HT IL_HT_NUMBER_TRY =3D=3D 3, this executes twice. */ - while (repeat_rate > 0) { + while (repeat_rate > 0 && idx < (LINK_QUAL_MAX_RETRY_NUM - 1)) { if (is_legacy(tbl_type.lq_type)) { if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE) ant_toggle_cnt++; @@ -2443,8 +2443,6 @@ il4965_rs_fill_link_cmd(struct il_priv * cpu_to_le32(new_rate); repeat_rate--; idx++; - if (idx >=3D LINK_QUAL_MAX_RETRY_NUM) - goto out; } =20 il4965_rs_get_tbl_info_from_mcs(new_rate, lq_sta->band, @@ -2489,7 +2487,6 @@ il4965_rs_fill_link_cmd(struct il_priv * repeat_rate--; } =20 -out: lq_cmd->agg_params.agg_frame_cnt_limit =3D LINK_QUAL_AGG_FRAME_LIMIT_DEF; lq_cmd->agg_params.agg_dis_start_th =3D LINK_QUAL_AGG_DISABLE_START_DEF; From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F311FECAAD8 for ; Tue, 13 Sep 2022 17:00:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230241AbiIMRA3 (ORCPT ); Tue, 13 Sep 2022 13:00:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56760 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232138AbiIMQ7l (ORCPT ); Tue, 13 Sep 2022 12:59:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9A3BFC12F0; Tue, 13 Sep 2022 08:51:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2C4E8B80FEA; Tue, 13 Sep 2022 14:34:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9EE58C433C1; Tue, 13 Sep 2022 14:34:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079686; bh=6oKrQHMbUouvKFesVC5x9+vlDyMIL0qPZFyN2v0YdeI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Z7lCGrGAtkGEtkFhu25YQvzlpRoH32xPHtcrBZDEDd47vn6ReJ1UnO2JSgO/d2jVD h8MCUBxY1S1GU2idWUFLqxzXmHX9gjCG3XE8wVlEbeFnbuDB52hS1dqta3uCfsKo3q poCxBbAHZZ6/tTkZTpdFEzZKJOdVJiSViVR2FRdk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Fengwei Yin , Mikulas Patocka , "Matthew Wilcox (Oracle)" , stable@kernel.org, Linus Torvalds Subject: [PATCH 4.14 36/61] fs: only do a memory barrier for the first set_buffer_uptodate() Date: Tue, 13 Sep 2022 16:07:38 +0200 Message-Id: <20220913140348.298766987@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Torvalds commit 2f79cdfe58c13949bbbb65ba5926abfe9561d0ec upstream. Commit d4252071b97d ("add barriers to buffer_uptodate and set_buffer_uptodate") added proper memory barriers to the buffer head BH_Uptodate bit, so that anybody who tests a buffer for being up-to-date will be guaranteed to actually see initialized state. However, that commit didn't _just_ add the memory barrier, it also ended up dropping the "was it already set" logic that the BUFFER_FNS() macro had. That's conceptually the right thing for a generic "this is a memory barrier" operation, but in the case of the buffer contents, we really only care about the memory barrier for the _first_ time we set the bit, in that the only memory ordering protection we need is to avoid anybody seeing uninitialized memory contents. Any other access ordering wouldn't be about the BH_Uptodate bit anyway, and would require some other proper lock (typically BH_Lock or the folio lock). A reader that races with somebody invalidating the buffer head isn't an issue wrt the memory ordering, it's a serialization issue. Now, you'd think that the buffer head operations don't matter in this day and age (and I certainly thought so), but apparently some loads still end up being heavy users of buffer heads. In particular, the kernel test robot reported that not having this bit access optimization in place caused a noticeable direct IO performance regression on ext4: fxmark.ssd_ext4_no_jnl_DWTL_54_directio.works/sec -26.5% regression although you presumably need a fast disk and a lot of cores to actually notice. Link: https://lore.kernel.org/all/Yw8L7HTZ%2FdE2%2Fo9C@xsang-OptiPlex-9020/ Reported-by: kernel test robot Tested-by: Fengwei Yin Cc: Mikulas Patocka Cc: Matthew Wilcox (Oracle) Cc: stable@kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- include/linux/buffer_head.h | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@ -134,6 +134,17 @@ BUFFER_FNS(Defer_Completion, defer_compl static __always_inline void set_buffer_uptodate(struct buffer_head *bh) { /* + * If somebody else already set this uptodate, they will + * have done the memory barrier, and a reader will thus + * see *some* valid buffer state. + * + * Any other serialization (with IO errors or whatever that + * might clear the bit) has to come from other state (eg BH_Lock). + */ + if (test_bit(BH_Uptodate, &bh->b_state)) + return; + + /* * make it consistent with folio_mark_uptodate * pairs with smp_load_acquire in buffer_uptodate */ From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA41EC54EE9 for ; Tue, 13 Sep 2022 15:19:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235311AbiIMPTT (ORCPT ); Tue, 13 Sep 2022 11:19:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41098 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233373AbiIMPSA (ORCPT ); Tue, 13 Sep 2022 11:18:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CD2A04505C; Tue, 13 Sep 2022 07:34:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 00DB1614E2; Tue, 13 Sep 2022 14:34:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17CC1C433B5; Tue, 13 Sep 2022 14:34:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079688; bh=24yPblRFkGOkOo4m+V45Z3dUyMqIgSeTQM78WhGHEaw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bPfoQ7uwkMC78CbtxbYW4WQWehCvE6UN9rkTbgbo5BvsaVAJjLbW1x1ceWD88j0S2 qKxRsKDOtTzwhYop9Zjaa1faav0C+MOR0Q3/QMrc6YPc0adHcHuyv8jmJQsB+74f/m vvJmEh1yORwwRfbnkqhAp5FnPYjyzcizhRr7uzYw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yee Lee Subject: [PATCH 4.14 37/61] Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" Date: Tue, 13 Sep 2022 16:07:39 +0200 Message-Id: <20220913140348.342178327@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yee Lee This reverts commit 23c2d497de21f25898fbea70aeb292ab8acc8c94. Commit 23c2d497de21 ("mm: kmemleak: take a full lowmem check in kmemleak_*_phys()") brought false leak alarms on some archs like arm64 that does not init pfn boundary in early booting. The final solution lands on linux-6.0: commit 0c24e061196c ("mm: kmemleak: add rbtree and store physical address for objects allocated with PA"). Revert this commit before linux-6.0. The original issue of invalid PA can be mitigated by additional check in devicetree. The false alarm report is as following: Kmemleak output: (Qemu/arm64) unreferenced object 0xffff0000c0170a00 (size 128): comm "swapper/0", pid 1, jiffies 4294892404 (age 126.208s) hex dump (first 32 bytes): 62 61 73 65 00 00 00 00 00 00 00 00 00 00 00 00 base............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<(____ptrval____)>] __kmalloc_track_caller+0x1b0/0x2e4 [<(____ptrval____)>] kstrdup_const+0x8c/0xc4 [<(____ptrval____)>] kvasprintf_const+0xbc/0xec [<(____ptrval____)>] kobject_set_name_vargs+0x58/0xe4 [<(____ptrval____)>] kobject_add+0x84/0x100 [<(____ptrval____)>] __of_attach_node_sysfs+0x78/0xec [<(____ptrval____)>] of_core_init+0x68/0x104 [<(____ptrval____)>] driver_init+0x28/0x48 [<(____ptrval____)>] do_basic_setup+0x14/0x28 [<(____ptrval____)>] kernel_init_freeable+0x110/0x178 [<(____ptrval____)>] kernel_init+0x20/0x1a0 [<(____ptrval____)>] ret_from_fork+0x10/0x20 This pacth is also applicable to linux-5.17.y/linux-5.18.y/linux-5.19.y Cc: Signed-off-by: Yee Lee Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- mm/kmemleak.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/mm/kmemleak.c +++ b/mm/kmemleak.c @@ -1192,7 +1192,7 @@ EXPORT_SYMBOL(kmemleak_no_scan); void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_coun= t, gfp_t gfp) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_alloc(__va(phys), size, min_count, gfp); } EXPORT_SYMBOL(kmemleak_alloc_phys); @@ -1203,7 +1203,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys); */ void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_free_part(__va(phys), size); } EXPORT_SYMBOL(kmemleak_free_part_phys); @@ -1214,7 +1214,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys); */ void __ref kmemleak_not_leak_phys(phys_addr_t phys) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_not_leak(__va(phys)); } EXPORT_SYMBOL(kmemleak_not_leak_phys); @@ -1225,7 +1225,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys); */ void __ref kmemleak_ignore_phys(phys_addr_t phys) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_ignore(__va(phys)); } EXPORT_SYMBOL(kmemleak_ignore_phys); From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2897C6FA82 for ; Tue, 13 Sep 2022 15:21:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235965AbiIMPVp (ORCPT ); Tue, 13 Sep 2022 11:21:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49422 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235934AbiIMPUL (ORCPT ); Tue, 13 Sep 2022 11:20:11 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D53665E318; Tue, 13 Sep 2022 07:36:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 07A2EB80FEC; Tue, 13 Sep 2022 14:34:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 75119C43470; Tue, 13 Sep 2022 14:34:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079690; bh=pVGX3lUAokxnhXBJdkUrS/2va8kh1ON7b6FM2FZm/c0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wWXg42sK3iDQphrsQ6O0g5ohNMInGt7ZGgXpfOg8gSenE3wZozJLreI2s7LbuTjc9 ZkJFmA/ohJcZ2vdVKkAbwjUoKtA7HHC3lSOgenljmVQZoktcUfGrUgsy+jcvTnvPHH V3FOZOQxLBXENYHhi3jMJmZafGwkDgZEriO/GtOY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Candice Li , Hawking Zhang , Alex Deucher , Sasha Levin Subject: [PATCH 4.14 38/61] drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup. Date: Tue, 13 Sep 2022 16:07:40 +0200 Message-Id: <20220913140348.387247447@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Candice Li [ Upstream commit c351938350ab9b5e978dede2c321da43de7eb70c ] No need to set up rb when no gfx rings. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/am= dgpu/gfx_v9_0.c index 53186c5e1066b..bb0d32b4be74d 100644 --- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c @@ -1514,7 +1514,8 @@ static void gfx_v9_0_gpu_init(struct amdgpu_device *a= dev) =20 gfx_v9_0_tiling_mode_table_init(adev); =20 - gfx_v9_0_setup_rb(adev); + if (adev->gfx.num_gfx_rings) + gfx_v9_0_setup_rb(adev); gfx_v9_0_get_cu_info(adev, &adev->gfx.cu_info); =20 /* XXX SH_MEM regs */ --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 665E3C6FA82 for ; Tue, 13 Sep 2022 15:39:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232711AbiIMPjh (ORCPT ); Tue, 13 Sep 2022 11:39:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47426 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236678AbiIMPij (ORCPT ); Tue, 13 Sep 2022 11:38:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DB81EF16; Tue, 13 Sep 2022 07:44:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DBAB2614A8; Tue, 13 Sep 2022 14:34:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D3ED0C433C1; Tue, 13 Sep 2022 14:34:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079693; bh=H1P1NwpBXrSvgn+FJ8rzFmWgOGTpyB2pK1CIh8lw4H0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PVWeBGRXVv6X9uXB+badq1JQiKgKFnYxnIEQKWUOjvbSRloWlg/lNwuGzdavHTRuG maLVq55bePVW0jXr9cDcGzmXJaH2XNUx9zhdRO4AhC72t2ap2xjQVpRVwHrlt6HXBJ PVzJ7bEY4HWYi1N8Az5odjiQztp6APXr7IYSs8Gs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Christian=20K=C3=B6nig?= , Zhenneng Li , Alex Deucher , Sasha Levin Subject: [PATCH 4.14 39/61] drm/radeon: add a force flush to delay work when radeon Date: Tue, 13 Sep 2022 16:07:41 +0200 Message-Id: <20220913140348.430044655@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Zhenneng Li [ Upstream commit f461950fdc374a3ada5a63c669d997de4600dffe ] Although radeon card fence and wait for gpu to finish processing current ba= tch rings, there is still a corner case that radeon lockup work queue may not be fully= flushed, and meanwhile the radeon_suspend_kms() function has called pci_set_power_st= ate() to put device in D3hot state. Per PCI spec rev 4.0 on 5.3.1.4.1 D3hot State. > Configuration and Message requests are the only TLPs accepted by a Functi= on in > the D3hot state. All other received Requests must be handled as Unsupport= ed Requests, > and all received Completions may optionally be handled as Unexpected Comp= letions. This issue will happen in following logs: Unable to handle kernel paging request at virtual address 00008800e0008010 CPU 0 kworker/0:3(131): Oops 0 pc =3D [] ra =3D [] ps =3D 0000 Taint= ed: G W pc is at si_gpu_check_soft_reset+0x3c/0x240 ra is at si_dma_is_lockup+0x34/0xd0 v0 =3D 0000000000000000 t0 =3D fff08800e0008010 t1 =3D 0000000000010000 t2 =3D 0000000000008010 t3 =3D fff00007e3c00000 t4 =3D fff00007e3c00258 t5 =3D 000000000000ffff t6 =3D 0000000000000001 t7 =3D fff00007ef078000 s0 =3D fff00007e3c016e8 s1 =3D fff00007e3c00000 s2 =3D fff00007e3c00018 s3 =3D fff00007e3c00000 s4 =3D fff00007fff59d80 s5 =3D 0000000000000000 s6 =3D fff00007ef07bd98 a0 =3D fff00007e3c00000 a1 =3D fff00007e3c016e8 a2 =3D 0000000000000008 a3 =3D 0000000000000001 a4 =3D 8f5c28f5c28f5c29 a5 =3D ffffffff810f4338 t8 =3D 0000000000000275 t9 =3D ffffffff809b66f8 t10 =3D ff6769c5d964b800 t11=3D 000000000000b886 pv =3D ffffffff811bea20 at =3D 0000000000000000 gp =3D ffffffff81d89690 sp =3D 00000000aa814126 Disabling lock debugging due to kernel taint Trace: [] si_dma_is_lockup+0x34/0xd0 [] radeon_fence_check_lockup+0xd0/0x290 [] process_one_work+0x280/0x550 [] worker_thread+0x70/0x7c0 [] worker_thread+0x130/0x7c0 [] kthread+0x200/0x210 [] worker_thread+0x0/0x7c0 [] kthread+0x14c/0x210 [] ret_from_kernel_thread+0x18/0x20 [] kthread+0x0/0x210 Code: ad3e0008 43f0074a ad7e0018 ad9e0020 8c3001e8 40230101 <88210000> 4821ed21 So force lockup work queue flush to fix this problem. Acked-by: Christian K=C3=B6nig Signed-off-by: Zhenneng Li Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/gpu/drm/radeon/radeon_device.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeo= n/radeon_device.c index 58488eac84627..906547b229a9a 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c @@ -1655,6 +1655,9 @@ int radeon_suspend_kms(struct drm_device *dev, bool s= uspend, if (r) { /* delay GPU reset to resume */ radeon_fence_driver_force_completion(rdev, i); + } else { + /* finish executing delayed work */ + flush_delayed_work(&rdev->fence_drv[i].lockup_work); } } =20 --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 594ACC54EE9 for ; Tue, 13 Sep 2022 17:00:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231648AbiIMRAn (ORCPT ); Tue, 13 Sep 2022 13:00:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57778 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232238AbiIMQ7w (ORCPT ); Tue, 13 Sep 2022 12:59:52 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2FB688C014; Tue, 13 Sep 2022 08:51:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1DB27B80FED; Tue, 13 Sep 2022 14:34:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8577EC433C1; Tue, 13 Sep 2022 14:34:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079695; bh=CalIawEmvBT6oJKZ5FkEZ4qq1hGCQEB6V9ztbQ59/Gk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BPzCYiYc5BNjTcpgvGvKD08lelvzKm3wJ9xIMAYoOGP1se21UcMkOJbE/dMA2Vl1N Jztdg/zho3eBlJQvcYvgLTYxyvS4q3f4RAYjt5Fp6ek5ZG9Jfn2CsqrjXdkjEIJE1S mg3LRhvBp8raqEqL5wBl1Fp7LHaFyIs3NsYa1qns= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Li Qiong , Helge Deller , Sasha Levin Subject: [PATCH 4.14 40/61] parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources() Date: Tue, 13 Sep 2022 16:07:42 +0200 Message-Id: <20220913140348.475657349@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Li Qiong [ Upstream commit d46c742f827fa2326ab1f4faa1cccadb56912341 ] As the possible failure of the kmalloc(), it should be better to fix this error path, check and return '-ENOMEM' error code. Signed-off-by: Li Qiong Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/parisc/ccio-dma.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c index 224a364097672..cc23b30337c16 100644 --- a/drivers/parisc/ccio-dma.c +++ b/drivers/parisc/ccio-dma.c @@ -1416,15 +1416,17 @@ ccio_init_resource(struct resource *res, char *name= , void __iomem *ioaddr) } } =20 -static void __init ccio_init_resources(struct ioc *ioc) +static int __init ccio_init_resources(struct ioc *ioc) { struct resource *res =3D ioc->mmio_region; char *name =3D kmalloc(14, GFP_KERNEL); - + if (unlikely(!name)) + return -ENOMEM; snprintf(name, 14, "GSC Bus [%d/]", ioc->hw_path); =20 ccio_init_resource(res, name, &ioc->ioc_regs->io_io_low); ccio_init_resource(res + 1, name, &ioc->ioc_regs->io_io_low_hv); + return 0; } =20 static int new_ioc_area(struct resource *res, unsigned long size, @@ -1578,7 +1580,10 @@ static int __init ccio_probe(struct parisc_device *d= ev) return -ENOMEM; } ccio_ioc_init(ioc); - ccio_init_resources(ioc); + if (ccio_init_resources(ioc)) { + kfree(ioc); + return -ENOMEM; + } hppa_dma_ops =3D &ccio_ops; dev->dev.platform_data =3D kzalloc(sizeof(struct pci_hba_data), GFP_KERNE= L); =20 --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F37A1C54EE9 for ; Tue, 13 Sep 2022 15:19:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235880AbiIMPTr (ORCPT ); Tue, 13 Sep 2022 11:19:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56746 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235867AbiIMPSM (ORCPT ); Tue, 13 Sep 2022 11:18:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C50B66137; Tue, 13 Sep 2022 07:35:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 61D7D614E1; Tue, 13 Sep 2022 14:35:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77CE6C433D6; Tue, 13 Sep 2022 14:35:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079700; bh=0cH85VvIYBOZ+pBLS98yG/BMwMyFTJk/yyn7iuR9B+E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rSNF2zM5abJsNqli1ss+JkIMYc23mpmAsKdyKzp76KOT9p6i6gw4bX3vzr+YSmmfb Q9gtYNWgA2jpPrEHIHS8mFnt4/9ei9/rtFkBEEQa6PipuQfqumxfbj1dz8liL/7TIg Kr7/eDGjg8dGIAbB0psmFbWafCuCJpQSmVNQAqIQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller , Sasha Levin Subject: [PATCH 4.14 41/61] parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines Date: Tue, 13 Sep 2022 16:07:43 +0200 Message-Id: <20220913140348.521918153@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller [ Upstream commit 591d2108f3abc4db9f9073cae37cf3591fd250d6 ] If a 32-bit kernel was compiled for PA2.0 CPUs, it won't be able to run on machines with PA1.x CPUs. Add a check and bail out early if a PA1.x machine is detected. Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/parisc/kernel/head.S | 43 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-) diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S index 9b99eb0712ad1..2f570a5205866 100644 --- a/arch/parisc/kernel/head.S +++ b/arch/parisc/kernel/head.S @@ -22,7 +22,7 @@ #include #include =20 - .level PA_ASM_LEVEL + .level 1.1 =20 __INITDATA ENTRY(boot_args) @@ -69,6 +69,47 @@ $bss_loop: stw,ma %arg2,4(%r1) stw,ma %arg3,4(%r1) =20 +#if !defined(CONFIG_64BIT) && defined(CONFIG_PA20) + /* This 32-bit kernel was compiled for PA2.0 CPUs. Check current CPU + * and halt kernel if we detect a PA1.x CPU. */ + ldi 32,%r10 + mtctl %r10,%cr11 + .level 2.0 + mfctl,w %cr11,%r10 + .level 1.1 + comib,<>,n 0,%r10,$cpu_ok + + load32 PA(msg1),%arg0 + ldi msg1_end-msg1,%arg1 +$iodc_panic: + copy %arg0, %r10 + copy %arg1, %r11 + load32 PA(init_stack),%sp +#define MEM_CONS 0x3A0 + ldw MEM_CONS+32(%r0),%arg0 // HPA + ldi ENTRY_IO_COUT,%arg1 + ldw MEM_CONS+36(%r0),%arg2 // SPA + ldw MEM_CONS+8(%r0),%arg3 // layers + load32 PA(__bss_start),%r1 + stw %r1,-52(%sp) // arg4 + stw %r0,-56(%sp) // arg5 + stw %r10,-60(%sp) // arg6 =3D ptr to text + stw %r11,-64(%sp) // arg7 =3D len + stw %r0,-68(%sp) // arg8 + load32 PA(.iodc_panic_ret), %rp + ldw MEM_CONS+40(%r0),%r1 // ENTRY_IODC + bv,n (%r1) +.iodc_panic_ret: + b . /* wait endless with ... */ + or %r10,%r10,%r10 /* qemu idle sleep */ +msg1: .ascii "Can't boot kernel which was built for PA8x00 CPUs on this ma= chine.\r\n" +msg1_end: + +$cpu_ok: +#endif + + .level PA_ASM_LEVEL + /* Initialize startup VM. Just map first 16/32 MB of memory */ load32 PA(swapper_pg_dir),%r4 mtctl %r4,%cr24 /* Initialize kernel root pointer */ --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DBFCEC54EE9 for ; Tue, 13 Sep 2022 15:20:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235914AbiIMPT7 (ORCPT ); Tue, 13 Sep 2022 11:19:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41900 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235875AbiIMPSQ (ORCPT ); Tue, 13 Sep 2022 11:18:16 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2346696F9; Tue, 13 Sep 2022 07:35:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 081A3614D9; Tue, 13 Sep 2022 14:35:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1016AC433D6; Tue, 13 Sep 2022 14:35:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079703; bh=xdlYmvdwMdSGOG7QzbxeM1ku4krKuvDuV1ZgWmDgk1I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qHjr6YZIPTUGJ3sBp9spCLC5H5xYmOm6j5N+Rpvg732bsFpGFkDl/TWsBpNNIqUqW 6WAUS0zsSapwic6dWewkkEjscIYNjO55loC457JTmSLEEVxf7dRH/Px2UqGfN2Iltc a0tO2FbdesMQ5nKSwKbYyc5+ilGr1ayumdTZw9Bo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Brown , Catalin Marinas , Will Deacon , Sasha Levin Subject: [PATCH 4.14 42/61] arm64/signal: Raise limit on stack frames Date: Tue, 13 Sep 2022 16:07:44 +0200 Message-Id: <20220913140348.573599647@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mark Brown [ Upstream commit 7ddcaf78e93c9282b4d92184f511b4d5bee75355 ] The signal code has a limit of 64K on the size of a stack frame that it will generate, if this limit is exceeded then a process will be killed if it receives a signal. Unfortunately with the advent of SME this limit is too small - the maximum possible size of the ZA register alone is 64K. This is not an issue for practical systems at present but is easily seen using virtual platforms. Raise the limit to 256K, this is substantially more than could be used by any current architecture extension. Signed-off-by: Mark Brown Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20220817182324.638214-2-broonie@kernel.org Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/arm64/kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index 43442b3a463f5..1b3973de417ec 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -97,7 +97,7 @@ static size_t sigframe_size(struct rt_sigframe_user_layou= t const *user) * not taken into account. This limit is not a guarantee and is * NOT ABI. */ -#define SIGFRAME_MAXSZ SZ_64K +#define SIGFRAME_MAXSZ SZ_256K =20 static int __sigframe_alloc(struct rt_sigframe_user_layout *user, unsigned long *offset, size_t size, bool extend) --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1752C6FA82 for ; Tue, 13 Sep 2022 15:26:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236356AbiIMP0Q (ORCPT ); Tue, 13 Sep 2022 11:26:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56892 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236235AbiIMPX4 (ORCPT ); Tue, 13 Sep 2022 11:23:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 082767CA83; Tue, 13 Sep 2022 07:37:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C179B614E2; Tue, 13 Sep 2022 14:35:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D0C4DC433C1; Tue, 13 Sep 2022 14:35:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079706; bh=DnYQUcsVH32s4uZbj997262p3sc1ImMPNTeT3izOTnk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nRJEC2+2MUbq32KdXobp9d6yfXHDMw8h5U36uiW145dipQESHln7CJ3NlEd9X3Mwz D2Y2uwv2ouR0YYy2Xe+RET4RSur49T883BLsITIYShSxvS7tNkOqmz4jcjB+7WJDy8 +qMpEkcMkMkgGlL/JFKPBwV9lzoHasZaHMR0yJKY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Yingliang , Helge Deller , Sasha Levin Subject: [PATCH 4.14 43/61] fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() Date: Tue, 13 Sep 2022 16:07:45 +0200 Message-Id: <20220913140348.623277062@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang [ Upstream commit 07c55c9803dea748d17a054000cbf1913ce06399 ] Add missing pci_disable_device() in error path in chipsfb_pci_init(). Signed-off-by: Yang Yingliang Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/video/fbdev/chipsfb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c index 413b465e69d8e..7ca149ab86d20 100644 --- a/drivers/video/fbdev/chipsfb.c +++ b/drivers/video/fbdev/chipsfb.c @@ -432,6 +432,7 @@ static int chipsfb_pci_init(struct pci_dev *dp, const s= truct pci_device_id *ent) err_release_fb: framebuffer_release(p); err_disable: + pci_disable_device(dp); err_out: return rc; } --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60AB4C54EE9 for ; Tue, 13 Sep 2022 15:22:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235896AbiIMPWR (ORCPT ); Tue, 13 Sep 2022 11:22:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49418 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235897AbiIMPVj (ORCPT ); Tue, 13 Sep 2022 11:21:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 08B727B2A5; Tue, 13 Sep 2022 07:36:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 42086B80FE1; Tue, 13 Sep 2022 14:35:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87577C433C1; Tue, 13 Sep 2022 14:35:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079708; bh=9BgiPP6OCpWvSkGqFHD61EJ8AiegDO/o1o7/clXSep4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2TxUfLfoMnJdS6rbbutrldXM2e0d/J+Mq6Sa2omjUGMcUa4narZ/MSeLHA70MsOZs m0Hbz9RyNxSIziFjQ4hKD0qHaF6pQF5iQ55ybbXL72wxQQ4cm3rSrFDsaWKXlQQkDZ 83mQeRHohbBNeeBrm4UrmVjiBgdFwQt55fMeQL4E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tasos Sahanidis , Takashi Iwai Subject: [PATCH 4.14 44/61] ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() Date: Tue, 13 Sep 2022 16:07:46 +0200 Message-Id: <20220913140348.674888319@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tasos Sahanidis commit d29f59051d3a07b81281b2df2b8c9dfe4716067f upstream. The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around. This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur. This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=3DLive,DEV=3D3 -c 16 /dev/zero UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k= 1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 = 07/22/2010 Call Trace: dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Signed-off-by: Tasos Sahanidis Cc: Link: https://lore.kernel.org/r/3707dcab-320a-62ff-63c0-73fc201ef756@tasoss= ah.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/pci/emu10k1/emupcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/pci/emu10k1/emupcm.c +++ b/sound/pci/emu10k1/emupcm.c @@ -137,7 +137,7 @@ static int snd_emu10k1_pcm_channel_alloc epcm->voices[0]->epcm =3D epcm; if (voices > 1) { for (i =3D 1; i < voices; i++) { - epcm->voices[i] =3D &epcm->emu->voices[epcm->voices[0]->number + i]; + epcm->voices[i] =3D &epcm->emu->voices[(epcm->voices[0]->number + i) % = NUM_G]; epcm->voices[i]->epcm =3D epcm; } } From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF247C6FA89 for ; Tue, 13 Sep 2022 15:23:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235934AbiIMPXB (ORCPT ); Tue, 13 Sep 2022 11:23:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50510 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235899AbiIMPWR (ORCPT ); Tue, 13 Sep 2022 11:22:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1A56D7C1CD; Tue, 13 Sep 2022 07:36:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3FC89614C0; Tue, 13 Sep 2022 14:35:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50318C433B5; Tue, 13 Sep 2022 14:35:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079711; bh=c+8isZ6YTFjQhAE68z6WOk1AgkqlsJDOpn1OWpRm7yg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RBuQVhVxt5cI0/Vw2sIypmb2xpvKCM8n4Dof1BXIZwd00S/eptn8Pga4eyuyu4+H4 5Kl/0J4mukJ92YZvhZry+jYmNOPzkKehcq9rcVj82W5qu01LwEqXPEJHyVC/ojsqyp DImCPvokHwsb8JSz4EgaO282u5+0SOpSK5aG/XEk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pattara Teerapong , Takashi Iwai Subject: [PATCH 4.14 45/61] ALSA: aloop: Fix random zeros in capture data when using jiffies timer Date: Tue, 13 Sep 2022 16:07:47 +0200 Message-Id: <20220913140348.726635924@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pattara Teerapong commit 3e48940abee88b8dbbeeaf8a07e7b2b6be1271b3 upstream. In loopback_jiffies_timer_pos_update(), we are getting jiffies twice. First time for playback, second time for capture. Jiffies can be updated between these two calls and if the capture jiffies is larger, extra zeros will be filled in the capture buffer. Change to get jiffies once and use it for both playback and capture. Signed-off-by: Pattara Teerapong Cc: Link: https://lore.kernel.org/r/20220901144036.4049060-1-pteerapong@chromiu= m.org Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/drivers/aloop.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/sound/drivers/aloop.c +++ b/sound/drivers/aloop.c @@ -477,17 +477,18 @@ static unsigned int loopback_pos_update( cable->streams[SNDRV_PCM_STREAM_PLAYBACK]; struct loopback_pcm *dpcm_capt =3D cable->streams[SNDRV_PCM_STREAM_CAPTURE]; - unsigned long delta_play =3D 0, delta_capt =3D 0; + unsigned long delta_play =3D 0, delta_capt =3D 0, cur_jiffies; unsigned int running, count1, count2; =20 + cur_jiffies =3D jiffies; running =3D cable->running ^ cable->pause; if (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) { - delta_play =3D jiffies - dpcm_play->last_jiffies; + delta_play =3D cur_jiffies - dpcm_play->last_jiffies; dpcm_play->last_jiffies +=3D delta_play; } =20 if (running & (1 << SNDRV_PCM_STREAM_CAPTURE)) { - delta_capt =3D jiffies - dpcm_capt->last_jiffies; + delta_capt =3D cur_jiffies - dpcm_capt->last_jiffies; dpcm_capt->last_jiffies +=3D delta_capt; } From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F29FC54EE9 for ; Tue, 13 Sep 2022 15:20:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235932AbiIMPUJ (ORCPT ); Tue, 13 Sep 2022 11:20:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56992 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235896AbiIMPSa (ORCPT ); Tue, 13 Sep 2022 11:18:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ED094B55; Tue, 13 Sep 2022 07:35:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B061F614AA; Tue, 13 Sep 2022 14:35:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C7498C433D6; Tue, 13 Sep 2022 14:35:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079714; bh=sZQYElcGS/DOQWicjtPM/97X2vpvcYwfPlGU+gxOP9w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LmtAZTigs6ppO2dqeGd/fzazjWuriBCwRtIP2npJGJ1YvN1JSPAU0hI/UWcj80Qj4 n/hX3Xm861HxNhoeL9Nt4FCcCszNwATm8av044N8ZQqIBg2jTzgyaKElmmvvPq3xOD QpluW7p/PwPu1pdY07vXTE4hoQu/gb+ip4GwJFa8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dongxiang Ke , Takashi Iwai Subject: [PATCH 4.14 46/61] ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() Date: Tue, 13 Sep 2022 16:07:48 +0200 Message-Id: <20220913140348.774214734@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dongxiang Ke commit e53f47f6c1a56d2af728909f1cb894da6b43d9bf upstream. There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces. Signed-off-by: Dongxiang Ke Link: https://lore.kernel.org/r/20220906024928.10951-1-kdx.glider@gmail.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- sound/usb/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -502,7 +502,7 @@ int snd_usb_parse_audio_interface(struct * Dallas DS4201 workaround: It presents 5 altsettings, but the last * one misses syncpipe, and does not produce any sound. */ - if (chip->usb_id =3D=3D USB_ID(0x04fa, 0x4201)) + if (chip->usb_id =3D=3D USB_ID(0x04fa, 0x4201) && num >=3D 4) num =3D 4; =20 for (i =3D 0; i < num; i++) { From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18D78C6FA82 for ; Tue, 13 Sep 2022 15:20:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236010AbiIMPUj (ORCPT ); Tue, 13 Sep 2022 11:20:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40668 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235995AbiIMPSo (ORCPT ); Tue, 13 Sep 2022 11:18:44 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E646FBCA9; Tue, 13 Sep 2022 07:35:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 21E0C614EF; Tue, 13 Sep 2022 14:35:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3B986C433B5; Tue, 13 Sep 2022 14:35:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079716; bh=fJ2s7R/qmx6iDi3eBBxBKFqXmU+9n/80Vgd/x0Akn44=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nCygkjFilU8lYj7LhtUx4VaOxIQS3prpq8a5fiyPkI0IIl6s1KguHDaO/q02lCgeR f9d7UfQn4+Wsx0pylzhFu74qZQAtppdbQC2gCQWl7d/Il+6QJDkAfIYxGW3cQlB1YB ++iiGgOw6jwTwPbYoMl9swnXhXsgx9c6hisEQ/kA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Naveen N. Rao" , Anil S Keshavamurthy , "David S. Miller" , "Masami Hiramatsu (Google)" , "Christian A. Ehrhardt" , "Steven Rostedt (Google)" Subject: [PATCH 4.14 47/61] kprobes: Prohibit probes in gate area Date: Tue, 13 Sep 2022 16:07:49 +0200 Message-Id: <20220913140348.825093180@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christian A. Ehrhardt commit 1efda38d6f9ba26ac88b359c6277f1172db03f1e upstream. The system call gate area counts as kernel text but trying to install a kprobe in this area fails with an Oops later on. To fix this explicitly disallow the gate area for kprobes. Found by syzkaller with the following reproducer: perf_event_open$cgroup(&(0x7f00000001c0)=3D{0x6, 0x80, 0x0, 0x0, 0x0, 0x0, = 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, = 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, = 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, = @perf_config_ext=3D{0x0, 0xffffffffff600000}}, 0xffffffffffffffff, 0x0, 0xf= fffffffffffffff, 0x0) Sample report: BUG: unable to handle page fault for address: fffffbfff3ac6000 PGD 6dfcb067 P4D 6dfcb067 PUD 6df8f067 PMD 6de4d067 PTE 0 Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 21978 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c= 3e60b-dirty #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/= 2014 RIP: 0010:__insn_get_emulate_prefix arch/x86/lib/insn.c:91 [inline] RIP: 0010:insn_get_emulate_prefix arch/x86/lib/insn.c:106 [inline] RIP: 0010:insn_get_prefixes.part.0+0xa8/0x1110 arch/x86/lib/insn.c:134 Code: 49 be 00 00 00 00 00 fc ff df 48 8b 40 60 48 89 44 24 08 e9 81 00 00 = 00 e8 e5 4b 39 ff 4c 89 fa 4c 89 f9 48 c1 ea 03 83 e1 07 <42> 0f b6 14 32 3= 8 ca 7f 08 84 d2 0f 85 06 10 00 00 48 89 d8 48 89 RSP: 0018:ffffc900088bf860 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffffffff9b9bebc0 RCX: 0000000000000000 RDX: 1ffffffff3ac6000 RSI: ffffc90002d82000 RDI: ffffc900088bf9e8 RBP: ffffffff9d630001 R08: 0000000000000000 R09: ffffc900088bf9e8 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff9d630000 R14: dffffc0000000000 R15: ffffffff9d630000 FS: 00007f63eef63640(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff3ac6000 CR3: 0000000029d90005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: insn_get_prefixes arch/x86/lib/insn.c:131 [inline] insn_get_opcode arch/x86/lib/insn.c:272 [inline] insn_get_modrm+0x64a/0x7b0 arch/x86/lib/insn.c:343 insn_get_sib+0x29a/0x330 arch/x86/lib/insn.c:421 insn_get_displacement+0x350/0x6b0 arch/x86/lib/insn.c:464 insn_get_immediate arch/x86/lib/insn.c:632 [inline] insn_get_length arch/x86/lib/insn.c:707 [inline] insn_decode+0x43a/0x490 arch/x86/lib/insn.c:747 can_probe+0xfc/0x1d0 arch/x86/kernel/kprobes/core.c:282 arch_prepare_kprobe+0x79/0x1c0 arch/x86/kernel/kprobes/core.c:739 prepare_kprobe kernel/kprobes.c:1160 [inline] register_kprobe kernel/kprobes.c:1641 [inline] register_kprobe+0xb6e/0x1690 kernel/kprobes.c:1603 __register_trace_kprobe kernel/trace/trace_kprobe.c:509 [inline] __register_trace_kprobe+0x26a/0x2d0 kernel/trace/trace_kprobe.c:477 create_local_trace_kprobe+0x1f7/0x350 kernel/trace/trace_kprobe.c:1833 perf_kprobe_init+0x18c/0x280 kernel/trace/trace_event_perf.c:271 perf_kprobe_event_init+0xf8/0x1c0 kernel/events/core.c:9888 perf_try_init_event+0x12d/0x570 kernel/events/core.c:11261 perf_init_event kernel/events/core.c:11325 [inline] perf_event_alloc.part.0+0xf7f/0x36a0 kernel/events/core.c:11619 perf_event_alloc kernel/events/core.c:12059 [inline] __do_sys_perf_event_open+0x4a8/0x2a00 kernel/events/core.c:12157 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f63ef7efaed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f63eef63028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007f63ef90ff80 RCX: 00007f63ef7efaed RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 00000000200001c0 RBP: 00007f63ef86019c R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000002 R14: 00007f63ef90ff80 R15: 00007f63eef43000 Modules linked in: CR2: fffffbfff3ac6000 Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing ---[ end trace 0000000000000000 ]--- RIP: 0010:__insn_get_emulate_prefix arch/x86/lib/insn.c:91 [inline] RIP: 0010:insn_get_emulate_prefix arch/x86/lib/insn.c:106 [inline] RIP: 0010:insn_get_prefixes.part.0+0xa8/0x1110 arch/x86/lib/insn.c:134 Code: 49 be 00 00 00 00 00 fc ff df 48 8b 40 60 48 89 44 24 08 e9 81 00 00 = 00 e8 e5 4b 39 ff 4c 89 fa 4c 89 f9 48 c1 ea 03 83 e1 07 <42> 0f b6 14 32 3= 8 ca 7f 08 84 d2 0f 85 06 10 00 00 48 89 d8 48 89 RSP: 0018:ffffc900088bf860 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffffffff9b9bebc0 RCX: 0000000000000000 RDX: 1ffffffff3ac6000 RSI: ffffc90002d82000 RDI: ffffc900088bf9e8 RBP: ffffffff9d630001 R08: 0000000000000000 R09: ffffc900088bf9e8 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff9d630000 R14: dffffc0000000000 R15: ffffffff9d630000 FS: 00007f63eef63640(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff3ac6000 CR3: 0000000029d90005 CR4: 0000000000770ef0 PKRU: 55555554 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Link: https://lkml.kernel.org/r/20220907200917.654103-1-lk@c--e.de cc: "Naveen N. Rao" cc: Anil S Keshavamurthy cc: "David S. Miller" Cc: stable@vger.kernel.org Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Christian A. Ehrhardt Signed-off-by: Steven Rostedt (Google) Signed-off-by: Greg Kroah-Hartman --- kernel/kprobes.c | 1 + 1 file changed, 1 insertion(+) --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1553,6 +1553,7 @@ static int check_kprobe_address_safe(str /* Ensure it is not in reserved area nor out of text */ if (!(core_kernel_text((unsigned long) p->addr) || is_module_text_address((unsigned long) p->addr)) || + in_gate_area_no_mm((unsigned long) p->addr) || within_kprobe_blacklist((unsigned long) p->addr) || jump_label_text_reserved(p->addr, p->addr) || find_bug((unsigned long)p->addr)) { From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E33DC6FA82 for ; Tue, 13 Sep 2022 15:26:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236305AbiIMPZ7 (ORCPT ); Tue, 13 Sep 2022 11:25:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55666 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236151AbiIMPXo (ORCPT ); Tue, 13 Sep 2022 11:23:44 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5DF1B7B297; Tue, 13 Sep 2022 07:37:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7B52EB80FE7; Tue, 13 Sep 2022 14:35:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BC76BC433D6; Tue, 13 Sep 2022 14:35:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079719; bh=lMBmQCuOAROTSUMKv5nvaRUZ3Exuta+3MSNMDuwKbRg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TKEQAlBsHXDLYD+70MLm44goFsW0/BUN2LdJDJ1215ZBMGn0lzg936ME+Y8YWsrxA qnbCLLBXTdKxY8dWlBgrfbKVtJLk/8HjM4iTJynLz3BObwfka/pBYkry2zdM0Vjcvn ovJzFXnlvFy6FC7mle2DBAS8uoWivic29hQfRJkE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sreekanth Reddy , "Martin K. Petersen" Subject: [PATCH 4.14 48/61] scsi: mpt3sas: Fix use-after-free warning Date: Tue, 13 Sep 2022 16:07:50 +0200 Message-Id: <20220913140348.870320531@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sreekanth Reddy commit 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34 upstream. Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6= /0xf0 Link: https://lore.kernel.org/r/20220906134908.1039-2-sreekanth.reddy@broad= com.com Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c @@ -2804,6 +2804,7 @@ static struct fw_event_work *dequeue_nex fw_event =3D list_first_entry(&ioc->fw_event_list, struct fw_event_work, list); list_del_init(&fw_event->list); + fw_event_work_put(fw_event); } spin_unlock_irqrestore(&ioc->fw_event_lock, flags); =20 @@ -2840,7 +2841,6 @@ _scsih_fw_event_cleanup_queue(struct MPT if (cancel_work_sync(&fw_event->work)) fw_event_work_put(fw_event); =20 - fw_event_work_put(fw_event); } } From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F3B7C6FA82 for ; Tue, 13 Sep 2022 15:25:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236190AbiIMPZi (ORCPT ); Tue, 13 Sep 2022 11:25:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56804 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236061AbiIMPXO (ORCPT ); Tue, 13 Sep 2022 11:23:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA2FE6B166; Tue, 13 Sep 2022 07:37:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EB2E1B80FEF; Tue, 13 Sep 2022 14:35:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 56EDAC433C1; Tue, 13 Sep 2022 14:35:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079721; bh=zYaDdJz9diUBs1H5IFFAx43U/MSdBjIdA6RKKH+n28M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pZw4Vw0Zr4hjngWnaYgpgq/b+ubGV8bhoiEZuzpVlvTzB6bFxeXiumvVicrAb+1N1 kwhi1Zg5dyXsDyyKjMeJ1wTU/C6LCdsyojRUGr+GnictzRW4/y/+AxVCAP5nUooSmQ s6Y5CSDxDMMPFGLEi/yy9lOzO7G3LP1Mj6UI+59U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Saravana Kannan , Guenter Roeck , Linus Walleij , "Isaac J. Manjarres" Subject: [PATCH 4.14 49/61] driver core: Dont probe devices after bus_type.match() probe deferral Date: Tue, 13 Sep 2022 16:07:51 +0200 Message-Id: <20220913140348.921485984@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Isaac J. Manjarres commit 25e9fbf0fd38868a429feabc38abebfc6dbf6542 upstream. Both __device_attach_driver() and __driver_attach() check the return code of the bus_type.match() function to see if the device needs to be added to the deferred probe list. After adding the device to the list, the logic attempts to bind the device to the driver anyway, as if the device had matched with the driver, which is not correct. If __device_attach_driver() detects that the device in question is not ready to match with a driver on the bus, then it doesn't make sense for the device to attempt to bind with the current driver or continue attempting to match with any of the other drivers on the bus. So, update the logic in __device_attach_driver() to reflect this. If __driver_attach() detects that a driver tried to match with a device that is not ready to match yet, then the driver should not attempt to bind with the device. However, the driver can still attempt to match and bind with other devices on the bus, as drivers can be bound to multiple devices. So, update the logic in __driver_attach() to reflect this. Fixes: 656b8035b0ee ("ARM: 8524/1: driver cohandle -EPROBE_DEFER from bus_t= ype.match()") Cc: stable@vger.kernel.org Cc: Saravana Kannan Reported-by: Guenter Roeck Tested-by: Guenter Roeck Tested-by: Linus Walleij Reviewed-by: Saravana Kannan Signed-off-by: Isaac J. Manjarres Link: https://lore.kernel.org/r/20220817184026.3468620-1-isaacmanjarres@goo= gle.com Signed-off-by: Greg Kroah-Hartman Tested-by: Linux Kernel Functional Testing --- drivers/base/dd.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -632,6 +632,11 @@ static int __device_attach_driver(struct } else if (ret =3D=3D -EPROBE_DEFER) { dev_dbg(dev, "Device match requests probe deferral\n"); driver_deferred_probe_add(dev); + /* + * Device can't match with a driver right now, so don't attempt + * to match or bind with other drivers on the bus. + */ + return ret; } else if (ret < 0) { dev_dbg(dev, "Bus failed to match device: %d", ret); return ret; @@ -774,6 +779,11 @@ static int __driver_attach(struct device } else if (ret =3D=3D -EPROBE_DEFER) { dev_dbg(dev, "Device match requests probe deferral\n"); driver_deferred_probe_add(dev); + /* + * Driver could not match with device, but may match with + * another device on the bus. + */ + return 0; } else if (ret < 0) { dev_dbg(dev, "Bus failed to match device: %d", ret); return ret; From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 293AFC54EE9 for ; Tue, 13 Sep 2022 15:45:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236659AbiIMPpx (ORCPT ); Tue, 13 Sep 2022 11:45:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37292 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236108AbiIMPpK (ORCPT ); Tue, 13 Sep 2022 11:45:10 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CAFC4B482; Tue, 13 Sep 2022 07:48:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A418C614BF; Tue, 13 Sep 2022 14:36:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A5B4EC433C1; Tue, 13 Sep 2022 14:36:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079773; bh=+T1WKoLnNl8/qrtqE8pmscqFmOu6PhEjnp8mqxuzJ4E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KQ/nJyMLVWRyaQHv32hi1a3zXbHMFXgQUGdDOqQF063upntTEnm62/a9akrJK0lKn HRLxvvRLB/x5okR9Fy7pYPV0FOTqXvs+Nau7/H1rNRU1aMrrsqrEIotBEYPLi/nFGm 6fHTX6ozY7HsHzd4j5SqOMuJnjLiVV4fLsN2RZ4g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Harsh Modi , Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.14 50/61] netfilter: br_netfilter: Drop dst references before setting. Date: Tue, 13 Sep 2022 16:07:52 +0200 Message-Id: <20220913140348.970649967@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Harsh Modi [ Upstream commit d047283a7034140ea5da759a494fd2274affdd46 ] The IPv6 path already drops dst in the daddr changed case, but the IPv4 path does not. This change makes the two code paths consistent. Further, it is possible that there is already a metadata_dst allocated from ingress that might already be attached to skbuff->dst while following the bridge path. If it is not released before setting a new metadata_dst, it will be leaked. This is similar to what is done in bpf_set_tunnel_key() or ip6_route_input(). It is important to note that the memory being leaked is not the dst being set in the bridge code, but rather memory allocated from some other code path that is not being freed correctly before the skb dst is overwritten. An example of the leakage fixed by this commit found using kmemleak: unreferenced object 0xffff888010112b00 (size 256): comm "softirq", pid 0, jiffies 4294762496 (age 32.012s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 80 16 f1 83 ff ff ff ff ................ e1 4e f6 82 ff ff ff ff 00 00 00 00 00 00 00 00 .N.............. backtrace: [<00000000d79567ea>] metadata_dst_alloc+0x1b/0xe0 [<00000000be113e13>] udp_tun_rx_dst+0x174/0x1f0 [<00000000a36848f4>] geneve_udp_encap_recv+0x350/0x7b0 [<00000000d4afb476>] udp_queue_rcv_one_skb+0x380/0x560 [<00000000ac064aea>] udp_unicast_rcv_skb+0x75/0x90 [<000000009a8ee8c5>] ip_protocol_deliver_rcu+0xd8/0x230 [<00000000ef4980bb>] ip_local_deliver_finish+0x7a/0xa0 [<00000000d7533c8c>] __netif_receive_skb_one_core+0x89/0xa0 [<00000000a879497d>] process_backlog+0x93/0x190 [<00000000e41ade9f>] __napi_poll+0x28/0x170 [<00000000b4c0906b>] net_rx_action+0x14f/0x2a0 [<00000000b20dd5d4>] __do_softirq+0xf4/0x305 [<000000003a7d7e15>] __irq_exit_rcu+0xc3/0x140 [<00000000968d39a2>] sysvec_apic_timer_interrupt+0x9e/0xc0 [<000000009e920794>] asm_sysvec_apic_timer_interrupt+0x16/0x20 [<000000008942add0>] native_safe_halt+0x13/0x20 Florian Westphal says: "Original code was likely fine because nothing ever did set a skb->dst entry earlier than bridge in those days." Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Harsh Modi Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/bridge/br_netfilter_hooks.c | 2 ++ net/bridge/br_netfilter_ipv6.c | 1 + 2 files changed, 3 insertions(+) diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hook= s.c index ee7a03ff89f3a..d229bfaaaba72 100644 --- a/net/bridge/br_netfilter_hooks.c +++ b/net/bridge/br_netfilter_hooks.c @@ -382,6 +382,7 @@ static int br_nf_pre_routing_finish(struct net *net, st= ruct sock *sk, struct sk_ /* - Bridged-and-DNAT'ed traffic doesn't * require ip_forwarding. */ if (rt->dst.dev =3D=3D dev) { + skb_dst_drop(skb); skb_dst_set(skb, &rt->dst); goto bridged_dnat; } @@ -411,6 +412,7 @@ static int br_nf_pre_routing_finish(struct net *net, st= ruct sock *sk, struct sk_ kfree_skb(skb); return 0; } + skb_dst_drop(skb); skb_dst_set_noref(skb, &rt->dst); } =20 diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c index 09d5e0c7b3ba4..995d86777e7cb 100644 --- a/net/bridge/br_netfilter_ipv6.c +++ b/net/bridge/br_netfilter_ipv6.c @@ -201,6 +201,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *ne= t, struct sock *sk, struc kfree_skb(skb); return 0; } + skb_dst_drop(skb); skb_dst_set_noref(skb, &rt->dst); } =20 --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC421C6FA86 for ; Tue, 13 Sep 2022 15:27:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236189AbiIMP1H (ORCPT ); Tue, 13 Sep 2022 11:27:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55722 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236376AbiIMPYV (ORCPT ); Tue, 13 Sep 2022 11:24:21 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2968E7CB71; Tue, 13 Sep 2022 07:38:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2C417B81002; Tue, 13 Sep 2022 14:35:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A1771C433D6; Tue, 13 Sep 2022 14:35:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079745; bh=TLxpiS+QLk3u35ml0El4E7ff5Vr8imnfzWibFYBBCQ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sSNZlt09hcba+a/nHTNZB3Q9k2wILMtjbJAy1+AqFX90j1LLn/IKilpul3eSICEcc qhqPY62QhdVahjPBWd8fksyvG+V25PfKse6jP4UwSE5h8tB4Neb67gG12axALvM6Wl 5WcvHrLGM9FhLHAHgD2sy8bRofzN23n0CyhgWa90= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Leadbeater , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.14 51/61] netfilter: nf_conntrack_irc: Fix forged IP logic Date: Tue, 13 Sep 2022 16:07:53 +0200 Message-Id: <20220913140349.014875416@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Leadbeater [ Upstream commit 0efe125cfb99e6773a7434f3463f7c2fa28f3a43 ] Ensure the match happens in the right direction, previously the destination used was the server, not the NAT host, as the comment shows the code intended. Additionally nf_nat_irc uses port 0 as a signal and there's no valid way it can appear in a DCC message, so consider port 0 also forged. Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port= ") Signed-off-by: David Leadbeater Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/netfilter/nf_conntrack_irc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_= irc.c index 5523acce9d699..814220f7be676 100644 --- a/net/netfilter/nf_conntrack_irc.c +++ b/net/netfilter/nf_conntrack_irc.c @@ -187,8 +187,9 @@ static int help(struct sk_buff *skb, unsigned int proto= ff, =20 /* dcc_ip can be the internal OR external (NAT'ed) IP */ tuple =3D &ct->tuplehash[dir].tuple; - if (tuple->src.u3.ip !=3D dcc_ip && - tuple->dst.u3.ip !=3D dcc_ip) { + if ((tuple->src.u3.ip !=3D dcc_ip && + ct->tuplehash[!dir].tuple.dst.u3.ip !=3D dcc_ip) || + dcc_port =3D=3D 0) { net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n", &tuple->src.u3.ip, &dcc_ip, dcc_port); --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF2DEC6FA82 for ; Tue, 13 Sep 2022 15:27:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233120AbiIMP1Z (ORCPT ); Tue, 13 Sep 2022 11:27:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55316 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236167AbiIMPZH (ORCPT ); Tue, 13 Sep 2022 11:25:07 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 001C57C774; Tue, 13 Sep 2022 07:38:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EA443B81011; Tue, 13 Sep 2022 14:35:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 64CCDC433C1; Tue, 13 Sep 2022 14:35:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079752; bh=TOk6w4g1d0aPPj4nkG0hFr3f+mLeWKDO6aiVF7WjoPQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Mwy/g3sJVvoOxyPUook1ANVGXC9yjc25WYo3pKDbEGDDshfcbnsaAGxK/OytUyloZ iOuyhfytH22eGjN5P7ufZM9VIa5/0fDnaeXlinTE9JxpXXIyr3F7afHX3zd2vmAl24 MVNNR8uvfq4zJDMiPoZD4mClNYTLGXWZ3V/0qguc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , "David S. Miller" , Sasha Levin , zdi-disclosures@trendmicro.com Subject: [PATCH 4.14 52/61] sch_sfb: Dont assume the skb is still around after enqueueing to child Date: Tue, 13 Sep 2022 16:07:54 +0200 Message-Id: <20220913140349.058426942@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Toke H=C3=B8iland-J=C3=B8rgensen [ Upstream commit 9efd23297cca530bb35e1848665805d3fcdd7889 ] The sch_sfb enqueue() routine assumes the skb is still alive after it has been enqueued into a child qdisc, using the data in the skb cb field in the increment_qlen() routine after enqueue. However, the skb may in fact have been freed, causing a use-after-free in this case. In particular, this happens if sch_cake is used as a child of sfb, and the GSO splitting mode of CAKE is enabled (in which case the skb will be split into segments and the original skb freed). Fix this by copying the sfb cb data to the stack before enqueueing the skb, and using this stack copy in increment_qlen() instead of the skb pointer itself. Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18231 Fixes: e13e02a3c68d ("net_sched: SFB flow scheduler") Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sched/sch_sfb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c index 04f15e0aeaa8b..8f924defa98d0 100644 --- a/net/sched/sch_sfb.c +++ b/net/sched/sch_sfb.c @@ -139,15 +139,15 @@ static void increment_one_qlen(u32 sfbhash, u32 slot,= struct sfb_sched_data *q) } } =20 -static void increment_qlen(const struct sk_buff *skb, struct sfb_sched_dat= a *q) +static void increment_qlen(const struct sfb_skb_cb *cb, struct sfb_sched_d= ata *q) { u32 sfbhash; =20 - sfbhash =3D sfb_hash(skb, 0); + sfbhash =3D cb->hashes[0]; if (sfbhash) increment_one_qlen(sfbhash, 0, q); =20 - sfbhash =3D sfb_hash(skb, 1); + sfbhash =3D cb->hashes[1]; if (sfbhash) increment_one_qlen(sfbhash, 1, q); } @@ -286,6 +286,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, struct sfb_sched_data *q =3D qdisc_priv(sch); struct Qdisc *child =3D q->qdisc; struct tcf_proto *fl; + struct sfb_skb_cb cb; int i; u32 p_min =3D ~0; u32 minqlen =3D ~0; @@ -402,11 +403,12 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qd= isc *sch, } =20 enqueue: + memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); ret =3D qdisc_enqueue(skb, child, to_free); if (likely(ret =3D=3D NET_XMIT_SUCCESS)) { qdisc_qstats_backlog_inc(sch, skb); sch->q.qlen++; - increment_qlen(skb, q); + increment_qlen(&cb, q); } else if (net_xmit_drop_count(ret)) { q->stats.childdrop++; qdisc_qstats_drop(sch); --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8DAEC54EE9 for ; Tue, 13 Sep 2022 15:27:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236210AbiIMP1R (ORCPT ); Tue, 13 Sep 2022 11:27:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56270 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233851AbiIMPY1 (ORCPT ); Tue, 13 Sep 2022 11:24:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 482B77CB7E; Tue, 13 Sep 2022 07:38:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 80A9CB80FCD; Tue, 13 Sep 2022 14:35:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D21E9C433C1; Tue, 13 Sep 2022 14:35:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079755; bh=zqlOfWX73AmjTePBYnE+j8JGEab2NFElMuX9jcJyyMU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AhyWMiWiFKiqr5LwksiuQctP7ZUmdL8GeX01x4+o4QO0BsLQwtwjsRmNcIg4OIHJK Csn3adAcvWwnSd6ZSBViPMySmqTv5eQgCOgt5qB9LOWaWriWf4g7JNaHQowDmf9VUQ q1fzQ1d/OHOvxJ3cqL0j1/F2ZCH0PgHS72gr35jk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 53/61] tipc: fix shift wrapping bug in map_get() Date: Tue, 13 Sep 2022 16:07:55 +0200 Message-Id: <20220913140349.109992928@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit e2b224abd9bf45dcb55750479fc35970725a430b ] There is a shift wrapping bug in this code so anything thing above 31 will return false. Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/tipc/monitor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c index c6496da9392d7..cf6dd3546c53c 100644 --- a/net/tipc/monitor.c +++ b/net/tipc/monitor.c @@ -130,7 +130,7 @@ static void map_set(u64 *up_map, int i, unsigned int v) =20 static int map_get(u64 up_map, int i) { - return (up_map & (1 << i)) >> i; + return (up_map & (1ULL << i)) >> i; } =20 static struct tipc_peer *peer_prev(struct tipc_peer *peer) --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE5AFC54EE9 for ; Tue, 13 Sep 2022 15:31:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236614AbiIMPb0 (ORCPT ); Tue, 13 Sep 2022 11:31:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236653AbiIMP3S (ORCPT ); Tue, 13 Sep 2022 11:29:18 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1E5B8B846; Tue, 13 Sep 2022 07:39:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D852FB80F9C; Tue, 13 Sep 2022 14:35:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 312F7C43140; Tue, 13 Sep 2022 14:35:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079757; bh=gF/NFCBwJR+rpMhh5ZAUWokS9BviWbSmkaDiQ6eEz5Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xdxW8yCjhJVEDk7PIjrpyJNQwuFGX+TN1VUINxbp9qHzsI5fa4yGoNQNr0TN2YV0m 7LyIYRhIkTQ6vz1EcKK5WHmTXzn5TaQ9KUw/6gmiip9EnXei70ok7FKqsmZ96LEkVT OHiJgo+IxEj7Ce5/MudLW6vaue8VaM/TNJ58q1Yo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lucas Leong , David Lebrun , "David S. Miller" , Sasha Levin Subject: [PATCH 4.14 54/61] ipv6: sr: fix out-of-bounds read when setting HMAC data. Date: Tue, 13 Sep 2022 16:07:56 +0200 Message-Id: <20220913140349.162337924@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Lebrun [ Upstream commit 84a53580c5d2138c7361c7c3eea5b31827e63b35 ] The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN= and SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actu= al length of the SECRET attribute, it is possible to provide invalid combinati= ons (e.g., secret =3D "", secretlen =3D 64). This case is not checked in the co= de and with an appropriately crafted netlink message, an out-of-bounds read of up to 64 bytes (max secret length) can occur past the skb end pointer and into skb_shared_info: Breakpoint 1, seg6_genl_sethmac (skb=3D, info=3D) at net/ipv6/seg6.c:208 208 memcpy(hinfo->secret, secret, slen); (gdb) bt #0 seg6_genl_sethmac (skb=3D, info=3D) at n= et/ipv6/seg6.c:208 #1 0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=3Dskb@entry=3D0xff= ff88800b1f9f00, nlh=3Dnlh@entry=3D0xffff88800b1b7600, extack=3Dextack@entry=3D0xffffc90000ba7af0, ops=3Dops@entry=3D0xffffc90= 000ba7a80, hdrlen=3D4, net=3D0xffffffff84237580 , family=3D, family=3D) at net/netlink/genetlink.c:731 #2 0xffffffff81e01435 in genl_family_rcv_msg (extack=3D0xffffc90000ba7af0= , nlh=3D0xffff88800b1b7600, skb=3D0xffff88800b1f9f00, family=3D0xffffffff82fef6c0 ) at net/netlink/genetlin= k.c:775 #3 genl_rcv_msg (skb=3D0xffff88800b1f9f00, nlh=3D0xffff88800b1b7600, exta= ck=3D0xffffc90000ba7af0) at net/netlink/genetlink.c:792 #4 0xffffffff81dfffc3 in netlink_rcv_skb (skb=3Dskb@entry=3D0xffff88800b1= f9f00, cb=3Dcb@entry=3D0xffffffff81e01350 ) at net/netlink/af_netlink.c:2501 #5 0xffffffff81e00919 in genl_rcv (skb=3D0xffff88800b1f9f00) at net/netli= nk/genetlink.c:803 #6 0xffffffff81dff6ae in netlink_unicast_kernel (ssk=3D0xffff888010eec800= , skb=3D0xffff88800b1f9f00, sk=3D0xffff888004aed000) at net/netlink/af_netlink.c:1319 #7 netlink_unicast (ssk=3Dssk@entry=3D0xffff888010eec800, skb=3Dskb@entry= =3D0xffff88800b1f9f00, portid=3Dportid@entry=3D0, nonblock=3D) at net/netlink/af_netlink.c:1345 #8 0xffffffff81dff9a4 in netlink_sendmsg (sock=3D, msg=3D0= xffffc90000ba7e48, len=3D) at net/netlink/af_netlink.c:1921 ... (gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)->head + ((struct sk_buff *= )0xffff88800b1f9f00)->end $1 =3D 0xffff88800b1b76c0 (gdb) p/x secret $2 =3D 0xffff88800b1b76c0 (gdb) p slen $3 =3D 64 '@' The OOB data can then be read back from userspace by dumping HMAC state. Th= is commit fixes this by ensuring SECRETLEN cannot exceed the actual length of SECRET. Reported-by: Lucas Leong Tested: verified that EINVAL is correctly returned when secretlen > len(sec= ret) Fixes: 4f4853dc1c9c1 ("ipv6: sr: implement API to control SR HMAC structure= ") Signed-off-by: David Lebrun Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv6/seg6.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c index fdeb90dd1c824..9c45165fe79bb 100644 --- a/net/ipv6/seg6.c +++ b/net/ipv6/seg6.c @@ -129,6 +129,11 @@ static int seg6_genl_sethmac(struct sk_buff *skb, stru= ct genl_info *info) goto out_unlock; } =20 + if (slen > nla_len(info->attrs[SEG6_ATTR_SECRET])) { + err =3D -EINVAL; + goto out_unlock; + } + if (hinfo) { err =3D seg6_hmac_info_del(net, hmackeyid); if (err) --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7765C6FA82 for ; Tue, 13 Sep 2022 15:27:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236152AbiIMP1M (ORCPT ); Tue, 13 Sep 2022 11:27:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34102 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236389AbiIMPYX (ORCPT ); Tue, 13 Sep 2022 11:24:23 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF0447C77E; Tue, 13 Sep 2022 07:38:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4CAFDB80FE9; Tue, 13 Sep 2022 14:36:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ADB69C433D7; Tue, 13 Sep 2022 14:35:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079760; bh=B4v2k0MQDhnx5OGQ3ksnlEvQQ/YjEEZ8HW8wTgiRqb4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ogoRzYj6SkKTnDXyrAdYyM0SK6Eq4ahYsa7b/QkOSGarRNpOhpfYHKNAKqqqUwngM b340fCS1r5xbiOV6cyvyRHskCMqHt/rL2zEHFMRsveF7x6gJO+nxrXCbKAfDyN6Rcz a9qHFYTZMaazMW8WI5vNoOMIH2fO+T3GP6ixqeMY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nagaraj Arankal , Neal Cardwell , Yuchung Cheng , Eric Dumazet , Paolo Abeni , Sasha Levin Subject: [PATCH 4.14 55/61] tcp: fix early ETIMEDOUT after spurious non-SACK RTO Date: Tue, 13 Sep 2022 16:07:57 +0200 Message-Id: <20220913140349.208264349@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Neal Cardwell [ Upstream commit 686dc2db2a0fdc1d34b424ec2c0a735becd8d62b ] Fix a bug reported and analyzed by Nagaraj Arankal, where the handling of a spurious non-SACK RTO could cause a connection to fail to clear retrans_stamp, causing a later RTO to very prematurely time out the connection with ETIMEDOUT. Here is the buggy scenario, expanding upon Nagaraj Arankal's excellent report: (*1) Send one data packet on a non-SACK connection (*2) Because no ACK packet is received, the packet is retransmitted and we enter CA_Loss; but this retransmission is spurious. (*3) The ACK for the original data is received. The transmitted packet is acknowledged. The TCP timestamp is before the retrans_stamp, so tcp_may_undo() returns true, and tcp_try_undo_loss() returns true without changing state to Open (because tcp_is_sack() is false), and tcp_process_loss() returns without calling tcp_try_undo_recovery(). Normally after undoing a CA_Loss episode, tcp_fastretrans_alert() would see that the connection has returned to CA_Open and fall through and call tcp_try_to_open(), which would set retrans_stamp to 0. However, for non-SACK connections we hold the connection in CA_Loss, so do not fall through to call tcp_try_to_open() and do not set retrans_stamp to 0. So retrans_stamp is (erroneously) still non-zero. At this point the first "retransmission event" has passed and been recovered from. Any future retransmission is a completely new "event". However, retrans_stamp is erroneously still set. (And we are still in CA_Loss, which is correct.) (*4) After 16 minutes (to correspond with tcp_retries2=3D15), a new data packet is sent. Note: No data is transmitted between (*3) and (*4) and we disabled keep alives. The socket's timeout SHOULD be calculated from this point in time, but instead it's calculated from the prior "event" 16 minutes ago (step (*2)). (*5) Because no ACK packet is received, the packet is retransmitted. (*6) At the time of the 2nd retransmission, the socket returns ETIMEDOUT, prematurely, because retrans_stamp is (erroneously) too far in the past (set at the time of (*2)). This commit fixes this bug by ensuring that we reuse in tcp_try_undo_loss() the same careful logic for non-SACK connections that we have in tcp_try_undo_recovery(). To avoid duplicating logic, we factor out that logic into a new tcp_is_non_sack_preventing_reopen() helper and call that helper from both undo functions. Fixes: da34ac7626b5 ("tcp: only undo on partial ACKs in CA_Loss") Reported-by: Nagaraj Arankal Link: https://lore.kernel.org/all/SJ0PR84MB1847BE6C24D274C46A1B9B0EB27A9@SJ= 0PR84MB1847.NAMPRD84.PROD.OUTLOOK.COM/ Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220903121023.866900-1-ncardwell.kernel@gm= ail.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/ipv4/tcp_input.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 906d26794d007..c6d49ec38a56a 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -2425,6 +2425,21 @@ static inline bool tcp_may_undo(const struct tcp_soc= k *tp) return tp->undo_marker && (!tp->undo_retrans || tcp_packet_delayed(tp)); } =20 +static bool tcp_is_non_sack_preventing_reopen(struct sock *sk) +{ + struct tcp_sock *tp =3D tcp_sk(sk); + + if (tp->snd_una =3D=3D tp->high_seq && tcp_is_reno(tp)) { + /* Hold old state until something *above* high_seq + * is ACKed. For Reno it is MUST to prevent false + * fast retransmits (RFC2582). SACK TCP is safe. */ + if (!tcp_any_retrans_done(sk)) + tp->retrans_stamp =3D 0; + return true; + } + return false; +} + /* People celebrate: "We love our President!" */ static bool tcp_try_undo_recovery(struct sock *sk) { @@ -2445,14 +2460,8 @@ static bool tcp_try_undo_recovery(struct sock *sk) =20 NET_INC_STATS(sock_net(sk), mib_idx); } - if (tp->snd_una =3D=3D tp->high_seq && tcp_is_reno(tp)) { - /* Hold old state until something *above* high_seq - * is ACKed. For Reno it is MUST to prevent false - * fast retransmits (RFC2582). SACK TCP is safe. */ - if (!tcp_any_retrans_done(sk)) - tp->retrans_stamp =3D 0; + if (tcp_is_non_sack_preventing_reopen(sk)) return true; - } tcp_set_ca_state(sk, TCP_CA_Open); tp->is_sack_reneg =3D 0; return false; @@ -2486,6 +2495,8 @@ static bool tcp_try_undo_loss(struct sock *sk, bool f= rto_undo) NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSPURIOUSRTOS); inet_csk(sk)->icsk_retransmits =3D 0; + if (tcp_is_non_sack_preventing_reopen(sk)) + return true; if (frto_undo || tcp_is_sack(tp)) { tcp_set_ca_state(sk, TCP_CA_Open); tp->is_sack_reneg =3D 0; --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B428C6FA82 for ; Tue, 13 Sep 2022 15:40:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235734AbiIMPk4 (ORCPT ); Tue, 13 Sep 2022 11:40:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51332 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234219AbiIMPkG (ORCPT ); Tue, 13 Sep 2022 11:40:06 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C2B503F1FA; Tue, 13 Sep 2022 07:45:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CC7A1B81017; Tue, 13 Sep 2022 14:36:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3684CC433C1; Tue, 13 Sep 2022 14:36:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079762; bh=M73bX+LP+zY4u4erhlSkaoaIApdxC197uCSuRUq4k/A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rVU7+uIxeJLobHdFCEpbgt9kD1u6OoegvBixR1EdGucVdqEXN8HLIUhN4TP+TkDol F2bui9t5LWY2Z1qUdLXCluiLkiyRPjyoyR5NMQtGeoPw6eWbJLSCHDE0jrejG83vP2 xPLQuTZ6wJujRdIhsOuNyeTBpNQRCC7NLu1w8CNU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Cong Wang , Paolo Abeni , Sasha Levin Subject: [PATCH 4.14 56/61] sch_sfb: Also store skb len before calling child enqueue Date: Tue, 13 Sep 2022 16:07:58 +0200 Message-Id: <20220913140349.260391735@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Toke H=C3=B8iland-J=C3=B8rgensen [ Upstream commit 2f09707d0c972120bf794cfe0f0c67e2c2ddb252 ] Cong Wang noticed that the previous fix for sch_sfb accessing the queued skb after enqueueing it to a child qdisc was incomplete: the SFB enqueue function was also calling qdisc_qstats_backlog_inc() after enqueue, which reads the pkt len from the skb cb field. Fix this by also storing the skb len, and using the stored value to increment the backlog after enqueueing. Fixes: 9efd23297cca ("sch_sfb: Don't assume the skb is still around after e= nqueueing to child") Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen Acked-by: Cong Wang Link: https://lore.kernel.org/r/20220905192137.965549-1-toke@toke.dk Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sched/sch_sfb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c index 8f924defa98d0..9962a49989938 100644 --- a/net/sched/sch_sfb.c +++ b/net/sched/sch_sfb.c @@ -284,6 +284,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, { =20 struct sfb_sched_data *q =3D qdisc_priv(sch); + unsigned int len =3D qdisc_pkt_len(skb); struct Qdisc *child =3D q->qdisc; struct tcf_proto *fl; struct sfb_skb_cb cb; @@ -406,7 +407,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); ret =3D qdisc_enqueue(skb, child, to_free); if (likely(ret =3D=3D NET_XMIT_SUCCESS)) { - qdisc_qstats_backlog_inc(sch, skb); + sch->qstats.backlog +=3D len; sch->q.qlen++; increment_qlen(&cb, q); } else if (net_xmit_drop_count(ret)) { --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAEFEC54EE9 for ; Tue, 13 Sep 2022 15:27:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236227AbiIMP1U (ORCPT ); Tue, 13 Sep 2022 11:27:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58540 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236171AbiIMPZI (ORCPT ); Tue, 13 Sep 2022 11:25:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 12B077C746; Tue, 13 Sep 2022 07:38:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2E739B80F9B; Tue, 13 Sep 2022 14:36:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A4F20C433C1; Tue, 13 Sep 2022 14:36:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079765; bh=i4owNBJFPeA129+EzqzI5ObJxYWEQ7OAGlm2GLeaV2M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DB+gGqZHBTVB8RJxyyGpIC6Nkc3tIXq0Ooki0eBMirg3S3A4KWa6LetSsdjjLY7ts xnaWIhcreazjIisIlOwTZiG2QH4y320K9kCFcp/MFfFbqzD+gtCpOAHF/6tlS0vywZ IvFjNkF1/rtIcLUGkExA3ha5a9nBXu1W4m0uJrQ4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrew Halaney , Matthias Kaehlcke , Manivannan Sadhasivam , Johan Hovold Subject: [PATCH 4.14 57/61] usb: dwc3: fix PHY disable sequence Date: Tue, 13 Sep 2022 16:07:59 +0200 Message-Id: <20220913140349.314560446@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit d2ac7bef95c9ead307801ccb6cb6dfbeb14247bf upstream. Generic PHYs must be powered-off before they can be tore down. Similarly, suspending legacy PHYs after having powered them off makes no sense. Fix the dwc3_core_exit() (e.g. called during suspend) and open-coded dwc3_probe() error-path sequences that got this wrong. Note that this makes dwc3_core_exit() match the dwc3_core_init() error path with respect to powering off the PHYs. Fixes: 03c1fd622f72 ("usb: dwc3: core: add phy cleanup for probe error hand= ling") Fixes: c499ff71ff2a ("usb: dwc3: core: re-factor init and exit paths") Cc: stable@vger.kernel.org # 4.8 Reviewed-by: Andrew Halaney Reviewed-by: Matthias Kaehlcke Reviewed-by: Manivannan Sadhasivam Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-2-johan+linaro@kernel.= org [ johan: adjust context to 4.14 ] Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/dwc3/core.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -656,15 +656,15 @@ static void dwc3_core_exit(struct dwc3 * { dwc3_event_buffers_cleanup(dwc); =20 - usb_phy_shutdown(dwc->usb2_phy); - usb_phy_shutdown(dwc->usb3_phy); - phy_exit(dwc->usb2_generic_phy); - phy_exit(dwc->usb3_generic_phy); - usb_phy_set_suspend(dwc->usb2_phy, 1); usb_phy_set_suspend(dwc->usb3_phy, 1); phy_power_off(dwc->usb2_generic_phy); phy_power_off(dwc->usb3_generic_phy); + + usb_phy_shutdown(dwc->usb2_phy); + usb_phy_shutdown(dwc->usb3_phy); + phy_exit(dwc->usb2_generic_phy); + phy_exit(dwc->usb3_generic_phy); } =20 static bool dwc3_core_is_valid(struct dwc3 *dwc) @@ -1288,16 +1288,16 @@ static int dwc3_probe(struct platform_de err5: dwc3_event_buffers_cleanup(dwc); =20 - usb_phy_shutdown(dwc->usb2_phy); - usb_phy_shutdown(dwc->usb3_phy); - phy_exit(dwc->usb2_generic_phy); - phy_exit(dwc->usb3_generic_phy); - usb_phy_set_suspend(dwc->usb2_phy, 1); usb_phy_set_suspend(dwc->usb3_phy, 1); phy_power_off(dwc->usb2_generic_phy); phy_power_off(dwc->usb3_generic_phy); =20 + usb_phy_shutdown(dwc->usb2_phy); + usb_phy_shutdown(dwc->usb3_phy); + phy_exit(dwc->usb2_generic_phy); + phy_exit(dwc->usb3_generic_phy); + dwc3_ulpi_exit(dwc); =20 err4: From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C581C54EE9 for ; Tue, 13 Sep 2022 16:24:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230314AbiIMQYR (ORCPT ); Tue, 13 Sep 2022 12:24:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47382 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230350AbiIMQXl (ORCPT ); Tue, 13 Sep 2022 12:23:41 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3FE82A98FD; Tue, 13 Sep 2022 08:18:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 072C8614CE; Tue, 13 Sep 2022 14:36:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1F886C433D6; Tue, 13 Sep 2022 14:36:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079767; bh=/FD+XJlkiYnUlmeTNebsc0OZTkHSly0huwW07NOq6uY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EhD5onltNePqUP5a0vuNlXC9Zhc1iIR2UjxCjzIKll3cP1ELxFAz7dGb8luV+Ss92 AALB+j/KgVzUqyCti7fUyq4nGyXyl5ii5yeBq//dUYPXfFvKVT2IxLM206Hn/O9KwL 91S5iArkBe1e6uCLV638pzFdS6qCIRGQTSJp7Xr8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Woithe , Johan Hovold Subject: [PATCH 4.14 58/61] USB: serial: ch341: fix lost character on LCR updates Date: Tue, 13 Sep 2022 16:08:00 +0200 Message-Id: <20220913140349.360305890@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 8e83622ae7ca481c76c8fd9579877f6abae64ca2 upstream. Disable LCR updates for pre-0x30 devices which use a different (unknown) protocol for line control and where the current register write causes the next received character to be lost. Note that updating LCR using the INIT command has no effect on these devices either. Reported-by: Jonathan Woithe Tested-by: Jonathan Woithe Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au Fixes: 4e46c410e050 ("USB: serial: ch341: reinitialize chip on reconfigurat= ion") Fixes: 55fa15b5987d ("USB: serial: ch341: fix baud rate and line-control ha= ndling") Cc: stable@vger.kernel.org # 4.10 Signed-off-by: Johan Hovold [ johan: adjust context to 4.19 ] Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/ch341.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/drivers/usb/serial/ch341.c +++ b/drivers/usb/serial/ch341.c @@ -99,6 +99,8 @@ struct ch341_private { u8 mcr; u8 msr; u8 lcr; + + u8 version; }; =20 static void ch341_set_termios(struct tty_struct *tty, @@ -184,6 +186,9 @@ static int ch341_set_baudrate_lcr(struct if (r) return r; =20 + if (priv->version < 0x30) + return 0; + r =3D ch341_control_out(dev, CH341_REQ_WRITE_REG, 0x2518, lcr); if (r) return r; @@ -235,7 +240,9 @@ static int ch341_configure(struct usb_de r =3D ch341_control_in(dev, CH341_REQ_READ_VERSION, 0, 0, buffer, size); if (r < 0) goto out; - dev_dbg(&dev->dev, "Chip version: 0x%02x\n", buffer[0]); + + priv->version =3D buffer[0]; + dev_dbg(&dev->dev, "Chip version: 0x%02x\n", priv->version); =20 r =3D ch341_control_out(dev, CH341_REQ_SERIAL_INIT, 0, 0); if (r < 0) From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46960C6FA82 for ; Tue, 13 Sep 2022 15:28:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236389AbiIMP2B (ORCPT ); Tue, 13 Sep 2022 11:28:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56274 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236344AbiIMP0O (ORCPT ); Tue, 13 Sep 2022 11:26:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5041A7D7B2; Tue, 13 Sep 2022 07:38:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5AC71B80FBD; Tue, 13 Sep 2022 14:36:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97B2AC433D6; Tue, 13 Sep 2022 14:36:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079770; bh=/TwwsSZbhnBs+zIYOt3WyFteOAs2G6YYtTmToocFnig=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cYyQRtrMruymrG5kohaKjlXtsCnMdFVhwjare7Q57JUf4wA0Sn+ADqNb2zwM7JzUI iq0unDdlQ8VytS9xvajx2Dl2IlbeTOrl11WRppXXiRqgDkxbOczJxH9LNQXA1YS+Bb yN4QqRrxOZ64cNJS2yNSB57Ogok9b6UdinyXoTDo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Woithe , Johan Hovold Subject: [PATCH 4.14 59/61] USB: serial: ch341: fix disabled rx timer on older devices Date: Tue, 13 Sep 2022 16:08:01 +0200 Message-Id: <20220913140349.407381238@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 41ca302a697b64a3dab4676e01d0d11bb184737d upstream. At least one older CH341 appears to have the RX timer enable bit inverted so that setting it disables the RX timer and prevents the FIFO from emptying until it is full. Only set the RX timer enable bit for devices with version newer than 0x27 (even though this probably affects all pre-0x30 devices). Reported-by: Jonathan Woithe Tested-by: Jonathan Woithe Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au Fixes: 4e46c410e050 ("USB: serial: ch341: reinitialize chip on reconfigurat= ion") Cc: stable@vger.kernel.org # 4.10 Signed-off-by: Johan Hovold [ johan: backport to 5.4 ] Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- drivers/usb/serial/ch341.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/drivers/usb/serial/ch341.c +++ b/drivers/usb/serial/ch341.c @@ -179,8 +179,12 @@ static int ch341_set_baudrate_lcr(struct /* * CH341A buffers data until a full endpoint-size packet (32 bytes) * has been received unless bit 7 is set. + * + * At least one device with version 0x27 appears to have this bit + * inverted. */ - a |=3D BIT(7); + if (priv->version > 0x27) + a |=3D BIT(7); =20 r =3D ch341_control_out(dev, CH341_REQ_WRITE_REG, 0x1312, a); if (r) From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 674E5C6FA82 for ; Tue, 13 Sep 2022 15:46:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236701AbiIMPqC (ORCPT ); Tue, 13 Sep 2022 11:46:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41290 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234634AbiIMPpO (ORCPT ); Tue, 13 Sep 2022 11:45:14 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A547A8688F; Tue, 13 Sep 2022 07:48:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4D77E614D0; Tue, 13 Sep 2022 14:35:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 60720C433C1; Tue, 13 Sep 2022 14:35:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079747; bh=vhBPoo9+TLK9+hQbWq1b8y3SJghTY07Qom1m3j2Diu0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Z+FltSt8Utehy9wpZbmKy+qVKwelQL4Dk06HWXLvl3gTgBDmNywLGP2RFJok0oWRK EmJfLE/IVh8+lrxUOiPWNh81NNpNOkuRt78t5O/3cxtseHMtkvkxnY1tI3oudw19WQ g0v+Qlda1p/WjvRXqGJReCyGEIV0/2xlQFM6RLNg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Ling , Keguang Zhang , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.14 60/61] MIPS: loongson32: ls1c: Fix hang during startup Date: Tue, 13 Sep 2022 16:08:02 +0200 Message-Id: <20220913140349.452979631@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Ling [ Upstream commit 35508d2424097f9b6a1a17aac94f702767035616 ] The RTCCTRL reg of LS1C is obselete. Writing this reg will cause system hang. Fixes: 60219c563c9b6 ("MIPS: Add RTC support for Loongson1C board") Signed-off-by: Yang Ling Tested-by: Keguang Zhang Acked-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- arch/mips/loongson32/ls1c/board.c | 1 - 1 file changed, 1 deletion(-) diff --git a/arch/mips/loongson32/ls1c/board.c b/arch/mips/loongson32/ls1c/= board.c index eb2d913c694fd..2d9675a6782c3 100644 --- a/arch/mips/loongson32/ls1c/board.c +++ b/arch/mips/loongson32/ls1c/board.c @@ -19,7 +19,6 @@ static struct platform_device *ls1c_platform_devices[] __= initdata =3D { static int __init ls1c_platform_init(void) { ls1x_serial_set_uartclk(&ls1x_uart_pdev); - ls1x_rtc_set_extclk(&ls1x_rtc_pdev); =20 return platform_add_devices(ls1c_platform_devices, ARRAY_SIZE(ls1c_platform_devices)); --=20 2.35.1 From nobody Sun Feb 8 00:10:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7270C54EE9 for ; Tue, 13 Sep 2022 17:27:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233023AbiIMR13 (ORCPT ); Tue, 13 Sep 2022 13:27:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55122 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231384AbiIMR0z (ORCPT ); Tue, 13 Sep 2022 13:26:55 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 30D1A6457; Tue, 13 Sep 2022 09:15:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 79602B8100E; Tue, 13 Sep 2022 14:35:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E50FCC433C1; Tue, 13 Sep 2022 14:35:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079750; bh=ZyUgIjdNLSUYrx8Fp9Kntz2SmFYPsYZBQCZEtISl5IE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m8l56xHwZLceRyJMZDBoLw99MFtJXAGq5FlY1qHEleEOodrE3PNZAqFJA0z7DFHiE 3604kJyAM4hOG1e8OLV5LoQlb9mfYGe200q1zKPGbVBE4PNStLy8PNmwPU3ZveoEHA /H36PxCgkm4JfBhwWEXG+K8FtHCTN/LCzy2wRmTU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, NeilBrown , Eugeniu Rosca Subject: [PATCH 4.14 61/61] SUNRPC: use _bh spinlocking on ->transport_lock Date: Tue, 13 Sep 2022 16:08:03 +0200 Message-Id: <20220913140349.494726420@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140346.422813036@linuxfoundation.org> References: <20220913140346.422813036@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: "NeilBrown" Prior to Linux 5.3, ->transport_lock in sunrpc required the _bh style spinlocks (when not called from a bottom-half handler). When upstream 3848e96edf4788f772d83990022fa7023a233d83 was backported to stable kernels, the spin_lock/unlock calls should have been changed to the _bh version, but this wasn't noted in the patch and didn't happen. So convert these lock/unlock calls to the _bh versions. This patch is required for any stable kernel prior to 5.3 to which the above mentioned patch was backported. Namely 4.9.y, 4.14.y, 4.19.y. Signed-off-by: NeilBrown Reported-by: Eugeniu Rosca Reviewed-by: Eugeniu Rosca Tested-by: Eugeniu Rosca Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing --- net/sunrpc/xprt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/sunrpc/xprt.c +++ b/net/sunrpc/xprt.c @@ -1525,9 +1525,9 @@ static void xprt_destroy(struct rpc_xprt * is cleared. We use ->transport_lock to ensure the mod_timer() * can only run *before* del_time_sync(), never after. */ - spin_lock(&xprt->transport_lock); + spin_lock_bh(&xprt->transport_lock); del_timer_sync(&xprt->timer); - spin_unlock(&xprt->transport_lock); + spin_unlock_bh(&xprt->transport_lock); =20 /* * Destroy sockets etc from the system workqueue so they can