From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B847C54EE9 for ; Tue, 13 Sep 2022 15:06:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235296AbiIMPF6 (ORCPT ); Tue, 13 Sep 2022 11:05:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54962 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235299AbiIMPEC (ORCPT ); Tue, 13 Sep 2022 11:04:02 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 07C49696FD; Tue, 13 Sep 2022 07:30:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2E9B0B80F6F; Tue, 13 Sep 2022 14:29:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82DA2C433D7; Tue, 13 Sep 2022 14:29:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079393; bh=O22YGpNSVP/wLRaLSzlif/umKtjAznEDVhjKZHUob+w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cVQJH45tMkq1MpMnB6tnyRbdiUHJn8rZx+ExxZLKn9Oz6a+UtkNnmkcrHBPaOCOCe 9AJWYZfVow59cxd95grY7njHMXw4axmaZPoaGXMfTUfX6EW+1dUpayV/YZtag6Jb+C qhhkRAxqX3k5iJqthCuoBRObjBo32xauukBaVsnE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Saravana Kannan , Guenter Roeck , Linus Walleij , "Isaac J. Manjarres" Subject: [PATCH 4.19 01/79] driver core: Dont probe devices after bus_type.match() probe deferral Date: Tue, 13 Sep 2022 16:06:19 +0200 Message-Id: <20220913140348.910218279@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Isaac J. Manjarres commit 25e9fbf0fd38868a429feabc38abebfc6dbf6542 upstream. Both __device_attach_driver() and __driver_attach() check the return code of the bus_type.match() function to see if the device needs to be added to the deferred probe list. After adding the device to the list, the logic attempts to bind the device to the driver anyway, as if the device had matched with the driver, which is not correct. If __device_attach_driver() detects that the device in question is not ready to match with a driver on the bus, then it doesn't make sense for the device to attempt to bind with the current driver or continue attempting to match with any of the other drivers on the bus. So, update the logic in __device_attach_driver() to reflect this. If __driver_attach() detects that a driver tried to match with a device that is not ready to match yet, then the driver should not attempt to bind with the device. However, the driver can still attempt to match and bind with other devices on the bus, as drivers can be bound to multiple devices. So, update the logic in __driver_attach() to reflect this. Fixes: 656b8035b0ee ("ARM: 8524/1: driver cohandle -EPROBE_DEFER from bus_t= ype.match()") Cc: stable@vger.kernel.org Cc: Saravana Kannan Reported-by: Guenter Roeck Tested-by: Guenter Roeck Tested-by: Linus Walleij Reviewed-by: Saravana Kannan Signed-off-by: Isaac J. Manjarres Link: https://lore.kernel.org/r/20220817184026.3468620-1-isaacmanjarres@goo= gle.com Signed-off-by: Greg Kroah-Hartman Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/base/dd.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -738,6 +738,11 @@ static int __device_attach_driver(struct } else if (ret =3D=3D -EPROBE_DEFER) { dev_dbg(dev, "Device match requests probe deferral\n"); driver_deferred_probe_add(dev); + /* + * Device can't match with a driver right now, so don't attempt + * to match or bind with other drivers on the bus. + */ + return ret; } else if (ret < 0) { dev_dbg(dev, "Bus failed to match device: %d", ret); return ret; @@ -891,6 +896,11 @@ static int __driver_attach(struct device } else if (ret =3D=3D -EPROBE_DEFER) { dev_dbg(dev, "Device match requests probe deferral\n"); driver_deferred_probe_add(dev); + /* + * Driver could not match with device, but may match with + * another device on the bus. + */ + return 0; } else if (ret < 0) { dev_dbg(dev, "Bus failed to match device: %d", ret); return ret; From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81A5AC54EE9 for ; Tue, 13 Sep 2022 15:07:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235212AbiIMPHb (ORCPT ); Tue, 13 Sep 2022 11:07:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58324 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234975AbiIMPEz (ORCPT ); Tue, 13 Sep 2022 11:04:55 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 860B274DCC; Tue, 13 Sep 2022 07:30:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3907A614DA; Tue, 13 Sep 2022 14:30:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4CDC8C433D6; Tue, 13 Sep 2022 14:30:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079421; bh=d8/BjMjVzY/n7XeMlWP1JgbELelWC0FaNED4myX5wmQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mXn7Y6D+9rkxH8csv3hoX2Z+CwRkIyLKxsLLvfuH4khgryIXTSqEXTOgCFz139zPt eoa2Q7sbcxA72S2X4hpM7MEsMf24Khhd0/SjWyd1ttG/XP3SUX2142YbsHwcEZZJ7P ZJckrO8ArdEF7JQKzi/h+iAcLG4HlAhDhVu+SNYE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hyunwoo Kim , Ard Biesheuvel Subject: [PATCH 4.19 02/79] efi: capsule-loader: Fix use-after-free in efi_capsule_write Date: Tue, 13 Sep 2022 16:06:20 +0200 Message-Id: <20220913140348.959636664@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hyunwoo Kim commit 9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95 upstream. A race condition may occur if the user calls close() on another thread during a write() operation on the device node of the efi capsule. This is a race condition that occurs between the efi_capsule_write() and efi_capsule_flush() functions of efi_capsule_fops, which ultimately results in UAF. So, the page freeing process is modified to be done in efi_capsule_release() instead of efi_capsule_flush(). Cc: # v4.9+ Signed-off-by: Hyunwoo Kim Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/ Signed-off-by: Ard Biesheuvel Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/firmware/efi/capsule-loader.c | 31 +++++++----------------------= -- 1 file changed, 7 insertions(+), 24 deletions(-) --- a/drivers/firmware/efi/capsule-loader.c +++ b/drivers/firmware/efi/capsule-loader.c @@ -244,29 +244,6 @@ failed: } =20 /** - * efi_capsule_flush - called by file close or file flush - * @file: file pointer - * @id: not used - * - * If a capsule is being partially uploaded then calling this function - * will be treated as upload termination and will free those completed - * buffer pages and -ECANCELED will be returned. - **/ -static int efi_capsule_flush(struct file *file, fl_owner_t id) -{ - int ret =3D 0; - struct capsule_info *cap_info =3D file->private_data; - - if (cap_info->index > 0) { - pr_err("capsule upload not complete\n"); - efi_free_all_buff_pages(cap_info); - ret =3D -ECANCELED; - } - - return ret; -} - -/** * efi_capsule_release - called by file close * @inode: not used * @file: file pointer @@ -278,6 +255,13 @@ static int efi_capsule_release(struct in { struct capsule_info *cap_info =3D file->private_data; =20 + if (cap_info->index > 0 && + (cap_info->header.headersize =3D=3D 0 || + cap_info->count < cap_info->total_size)) { + pr_err("capsule upload not complete\n"); + efi_free_all_buff_pages(cap_info); + } + kfree(cap_info->pages); kfree(cap_info->phys); kfree(file->private_data); @@ -325,7 +309,6 @@ static const struct file_operations efi_ .owner =3D THIS_MODULE, .open =3D efi_capsule_open, .write =3D efi_capsule_write, - .flush =3D efi_capsule_flush, .release =3D efi_capsule_release, .llseek =3D no_llseek, }; From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1CE51C54EE9 for ; Tue, 13 Sep 2022 15:11:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235521AbiIMPLT (ORCPT ); Tue, 13 Sep 2022 11:11:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32940 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235820AbiIMPJ1 (ORCPT ); Tue, 13 Sep 2022 11:09:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B8E9E6A4B4; Tue, 13 Sep 2022 07:32:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9E337614CF; Tue, 13 Sep 2022 14:30:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AAFB6C433C1; Tue, 13 Sep 2022 14:30:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079446; bh=LEpUZMkV6Ilyrdm2GkdaMsTLhpVpLArKf32CrezfHIY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Pt90J1PMcWbrj1QS54+j8PurYxVPuWqCM4oUpv21QFfuqVWWDDr0GW0iA1H6dZ0q7 zxDgqJtVYGokXpJ1NS7B2XjDUHqOWVzItfGnTUqMwcExXUMircPwCtk0O9POqSU/Gd eeW5SNBHyQEM+GPLWN+C1cgt+PJlPYyReg+kJd7E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stanislaw Gruszka , Kalle Valo Subject: [PATCH 4.19 03/79] wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd() Date: Tue, 13 Sep 2022 16:06:21 +0200 Message-Id: <20220913140349.014608159@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Stanislaw Gruszka commit 6d0ef7241553f3553a0a2764c69b07892705924c upstream. This reverts commit a8eb8e6f7159c7c20c0ddac428bde3d110890aa7 as it can cause invalid link quality command sent to the firmware and address the off-by-one issue by fixing condition of while loop. Cc: stable@vger.kernel.org Fixes: a8eb8e6f7159 ("wifi: iwlegacy: 4965: fix potential off-by-one overfl= ow in il4965_rs_fill_link_cmd()") Signed-off-by: Stanislaw Gruszka Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220815073737.GA999388@wp.pl Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/net/wireless/intel/iwlegacy/4965-rs.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) --- a/drivers/net/wireless/intel/iwlegacy/4965-rs.c +++ b/drivers/net/wireless/intel/iwlegacy/4965-rs.c @@ -2422,7 +2422,7 @@ il4965_rs_fill_link_cmd(struct il_priv * /* Repeat initial/next rate. * For legacy IL_NUMBER_TRY =3D=3D 1, this loop will not execute. * For HT IL_HT_NUMBER_TRY =3D=3D 3, this executes twice. */ - while (repeat_rate > 0) { + while (repeat_rate > 0 && idx < (LINK_QUAL_MAX_RETRY_NUM - 1)) { if (is_legacy(tbl_type.lq_type)) { if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE) ant_toggle_cnt++; @@ -2441,8 +2441,6 @@ il4965_rs_fill_link_cmd(struct il_priv * cpu_to_le32(new_rate); repeat_rate--; idx++; - if (idx >=3D LINK_QUAL_MAX_RETRY_NUM) - goto out; } =20 il4965_rs_get_tbl_info_from_mcs(new_rate, lq_sta->band, @@ -2487,7 +2485,6 @@ il4965_rs_fill_link_cmd(struct il_priv * repeat_rate--; } =20 -out: lq_cmd->agg_params.agg_frame_cnt_limit =3D LINK_QUAL_AGG_FRAME_LIMIT_DEF; lq_cmd->agg_params.agg_dis_start_th =3D LINK_QUAL_AGG_DISABLE_START_DEF; From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65193C6FA82 for ; Tue, 13 Sep 2022 15:09:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235180AbiIMPJc (ORCPT ); Tue, 13 Sep 2022 11:09:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33888 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233340AbiIMPHn (ORCPT ); Tue, 13 Sep 2022 11:07:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D1DB75CEB; Tue, 13 Sep 2022 07:30:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 32835614DD; Tue, 13 Sep 2022 14:30:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1CE8EC433C1; Tue, 13 Sep 2022 14:30:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079448; bh=eGNzvcJW9a3VCM96k2fbhRyyeCBUvL/2LzhxbbtcIik=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DfVDiveMeYB4fMjSuEqyiiiy20pn9I5K28LZWrP/jI8b8V7uppwoZfFIDFvFDkrqA abMvRUN+A4+Sok39pL31Fm7Uqw6zUefDcguPBwLm4QGbkj7IZMi5D8bk+SfHc4nuWo CcylIWnD7bFy7JL3GWU3s4ImJ8bKUBTLZg9WiYgQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marcin Wojtas , Russell King , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, stable Subject: [PATCH 4.19 04/79] net: mvpp2: debugfs: fix memory leak when using debugfs_lookup() Date: Tue, 13 Sep 2022 16:06:22 +0200 Message-Id: <20220913140349.063571382@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Greg Kroah-Hartman commit fe2c9c61f668cde28dac2b188028c5299cedcc1e upstream. When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. Fix this up to be much simpler logic and only create the root debugfs directory once when the driver is first accessed. That resolves the memory leak and makes things more obvious as to what the intent is. Cc: Marcin Wojtas Cc: Russell King Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: netdev@vger.kernel.org Cc: stable Fixes: 21da57a23125 ("net: mvpp2: add a debugfs interface for the Header Pa= rser") Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c @@ -667,10 +667,10 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *p =20 void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name) { - struct dentry *mvpp2_dir, *mvpp2_root; + static struct dentry *mvpp2_root; + struct dentry *mvpp2_dir; int ret, i; =20 - mvpp2_root =3D debugfs_lookup(MVPP2_DRIVER_NAME, NULL); if (!mvpp2_root) { mvpp2_root =3D debugfs_create_dir(MVPP2_DRIVER_NAME, NULL); if (IS_ERR(mvpp2_root)) From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE8C4C6FA82 for ; Tue, 13 Sep 2022 15:09:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235478AbiIMPIa (ORCPT ); Tue, 13 Sep 2022 11:08:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54930 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235175AbiIMPHI (ORCPT ); Tue, 13 Sep 2022 11:07:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F422E696FF; Tue, 13 Sep 2022 07:30:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 95309614E9; Tue, 13 Sep 2022 14:30:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AE9A0C433D7; Tue, 13 Sep 2022 14:30:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079451; bh=4q8krE1FsncwNTfSC0uky0pPAGgOhmkWebSZonlFBbA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GaafyqCvDfx5/Ji7aBxIN32Cdx4ZD+ILGnHsShYenW/Uw+eGnArBZgT2S6EB27z+Y B8yETRyUMu3egwJ3W1NNXkichgzZXAfqOn2J99qJWR7td+J6IrOIePSE+NJwdqGpiv JGfmusZkaduh9tBM8xWo/HrDSH8Z9Mw7gwbwZ8b0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Fengwei Yin , Mikulas Patocka , "Matthew Wilcox (Oracle)" , stable@kernel.org, Linus Torvalds Subject: [PATCH 4.19 05/79] fs: only do a memory barrier for the first set_buffer_uptodate() Date: Tue, 13 Sep 2022 16:06:23 +0200 Message-Id: <20220913140349.115062208@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Torvalds commit 2f79cdfe58c13949bbbb65ba5926abfe9561d0ec upstream. Commit d4252071b97d ("add barriers to buffer_uptodate and set_buffer_uptodate") added proper memory barriers to the buffer head BH_Uptodate bit, so that anybody who tests a buffer for being up-to-date will be guaranteed to actually see initialized state. However, that commit didn't _just_ add the memory barrier, it also ended up dropping the "was it already set" logic that the BUFFER_FNS() macro had. That's conceptually the right thing for a generic "this is a memory barrier" operation, but in the case of the buffer contents, we really only care about the memory barrier for the _first_ time we set the bit, in that the only memory ordering protection we need is to avoid anybody seeing uninitialized memory contents. Any other access ordering wouldn't be about the BH_Uptodate bit anyway, and would require some other proper lock (typically BH_Lock or the folio lock). A reader that races with somebody invalidating the buffer head isn't an issue wrt the memory ordering, it's a serialization issue. Now, you'd think that the buffer head operations don't matter in this day and age (and I certainly thought so), but apparently some loads still end up being heavy users of buffer heads. In particular, the kernel test robot reported that not having this bit access optimization in place caused a noticeable direct IO performance regression on ext4: fxmark.ssd_ext4_no_jnl_DWTL_54_directio.works/sec -26.5% regression although you presumably need a fast disk and a lot of cores to actually notice. Link: https://lore.kernel.org/all/Yw8L7HTZ%2FdE2%2Fo9C@xsang-OptiPlex-9020/ Reported-by: kernel test robot Tested-by: Fengwei Yin Cc: Mikulas Patocka Cc: Matthew Wilcox (Oracle) Cc: stable@kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- include/linux/buffer_head.h | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@ -137,6 +137,17 @@ BUFFER_FNS(Defer_Completion, defer_compl static __always_inline void set_buffer_uptodate(struct buffer_head *bh) { /* + * If somebody else already set this uptodate, they will + * have done the memory barrier, and a reader will thus + * see *some* valid buffer state. + * + * Any other serialization (with IO errors or whatever that + * might clear the bit) has to come from other state (eg BH_Lock). + */ + if (test_bit(BH_Uptodate, &bh->b_state)) + return; + + /* * make it consistent with folio_mark_uptodate * pairs with smp_load_acquire in buffer_uptodate */ From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E55FBC54EE9 for ; Tue, 13 Sep 2022 15:26:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236123AbiIMP0r (ORCPT ); Tue, 13 Sep 2022 11:26:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33880 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236341AbiIMPYR (ORCPT ); Tue, 13 Sep 2022 11:24:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A84187CB74; Tue, 13 Sep 2022 07:38:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 070D661499; Tue, 13 Sep 2022 14:30:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1FDD0C433C1; Tue, 13 Sep 2022 14:30:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079453; bh=DBrIEbZ08PykeYVDRd7IDsKXel4vsHps2O+RSCF079U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iU3q8pVmHmwKUODwXAI7iINElhE5oqr9Fg4QW/ngpe4T65LhFi1iQofLhewp7Y33F bxiYW0dErEITmfKZQB1wJ+hzjspEVIalFlDWEZ/HQI30gerH9JXedQH4ANyjLUuR4/ Qcyx9qaGaLLF/mQuhd559uOkG9JZafjK5Xzkr20Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yee Lee Subject: [PATCH 4.19 06/79] Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" Date: Tue, 13 Sep 2022 16:06:24 +0200 Message-Id: <20220913140349.159709474@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yee Lee This reverts commit 23c2d497de21f25898fbea70aeb292ab8acc8c94. Commit 23c2d497de21 ("mm: kmemleak: take a full lowmem check in kmemleak_*_phys()") brought false leak alarms on some archs like arm64 that does not init pfn boundary in early booting. The final solution lands on linux-6.0: commit 0c24e061196c ("mm: kmemleak: add rbtree and store physical address for objects allocated with PA"). Revert this commit before linux-6.0. The original issue of invalid PA can be mitigated by additional check in devicetree. The false alarm report is as following: Kmemleak output: (Qemu/arm64) unreferenced object 0xffff0000c0170a00 (size 128): comm "swapper/0", pid 1, jiffies 4294892404 (age 126.208s) hex dump (first 32 bytes): 62 61 73 65 00 00 00 00 00 00 00 00 00 00 00 00 base............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<(____ptrval____)>] __kmalloc_track_caller+0x1b0/0x2e4 [<(____ptrval____)>] kstrdup_const+0x8c/0xc4 [<(____ptrval____)>] kvasprintf_const+0xbc/0xec [<(____ptrval____)>] kobject_set_name_vargs+0x58/0xe4 [<(____ptrval____)>] kobject_add+0x84/0x100 [<(____ptrval____)>] __of_attach_node_sysfs+0x78/0xec [<(____ptrval____)>] of_core_init+0x68/0x104 [<(____ptrval____)>] driver_init+0x28/0x48 [<(____ptrval____)>] do_basic_setup+0x14/0x28 [<(____ptrval____)>] kernel_init_freeable+0x110/0x178 [<(____ptrval____)>] kernel_init+0x20/0x1a0 [<(____ptrval____)>] ret_from_fork+0x10/0x20 This pacth is also applicable to linux-5.17.y/linux-5.18.y/linux-5.19.y Cc: Signed-off-by: Yee Lee Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- mm/kmemleak.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/mm/kmemleak.c +++ b/mm/kmemleak.c @@ -1196,7 +1196,7 @@ EXPORT_SYMBOL(kmemleak_no_scan); void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_coun= t, gfp_t gfp) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_alloc(__va(phys), size, min_count, gfp); } EXPORT_SYMBOL(kmemleak_alloc_phys); @@ -1210,7 +1210,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys); */ void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_free_part(__va(phys), size); } EXPORT_SYMBOL(kmemleak_free_part_phys); @@ -1222,7 +1222,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys); */ void __ref kmemleak_not_leak_phys(phys_addr_t phys) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_not_leak(__va(phys)); } EXPORT_SYMBOL(kmemleak_not_leak_phys); @@ -1234,7 +1234,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys); */ void __ref kmemleak_ignore_phys(phys_addr_t phys) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_ignore(__va(phys)); } EXPORT_SYMBOL(kmemleak_ignore_phys); From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5DB9CC6FA82 for ; Tue, 13 Sep 2022 15:15:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235671AbiIMPPU (ORCPT ); Tue, 13 Sep 2022 11:15:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42358 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235628AbiIMPMu (ORCPT ); Tue, 13 Sep 2022 11:12:50 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BA554785A6; Tue, 13 Sep 2022 07:32:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 21A0AB80F1A; Tue, 13 Sep 2022 14:30:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7B7ADC43147; Tue, 13 Sep 2022 14:30:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079455; bh=byZiY4GVwHFWvBA3Mo8AblOqT8dGZGcsnGwD6OC1F5g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Er3MWGcaQTrXIA5UU/M4zBwRdTuRMqh/x4AAvlzDMsu+6S8VTiUdsG5oMODeF/DVd 3pfmuRYWRo1KJKWeNVnhlpdvqnIxpvA3rrveok+AKSmNJpYgU972NFkY8XWsB9EpQZ XVQyibfvdHoU6hup3dODAHC9W2OdlsgmkvLsindE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Enguerrand de Ribaucourt , Andrew Lunn , Jakub Kicinski Subject: [PATCH 4.19 07/79] net: dp83822: disable false carrier interrupt Date: Tue, 13 Sep 2022 16:06:25 +0200 Message-Id: <20220913140349.214011981@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Enguerrand de Ribaucourt commit c96614eeab663646f57f67aa591e015abd8bd0ba upstream. When unplugging an Ethernet cable, false carrier events were produced by the PHY at a very high rate. Once the false carrier counter full, an interrupt was triggered every few clock cycles until the cable was replugged. This resulted in approximately 10k/s interrupts. Since the false carrier counter (FCSCR) is never used, we can safely disable this interrupt. In addition to improving performance, this also solved MDIO read timeouts I was randomly encountering with an i.MX8 fec MAC because of the interrupt flood. The interrupt count and MDIO timeout fix were tested on a v5.4.110 kernel. Fixes: 87461f7a58ab ("net: phy: DP83822 initial driver submission") Signed-off-by: Enguerrand de Ribaucourt Reviewed-by: Andrew Lunn Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/net/phy/dp83822.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/net/phy/dp83822.c +++ b/drivers/net/phy/dp83822.c @@ -204,7 +204,6 @@ static int dp83822_config_intr(struct ph return misr_status; =20 misr_status |=3D (DP83822_RX_ERR_HF_INT_EN | - DP83822_FALSE_CARRIER_HF_INT_EN | DP83822_ANEG_COMPLETE_INT_EN | DP83822_DUP_MODE_CHANGE_INT_EN | DP83822_SPEED_CHANGED_INT_EN | From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83884C6FA82 for ; Tue, 13 Sep 2022 15:41:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232208AbiIMPlY (ORCPT ); Tue, 13 Sep 2022 11:41:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51174 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234230AbiIMPkl (ORCPT ); Tue, 13 Sep 2022 11:40:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 31ED082849; Tue, 13 Sep 2022 07:45:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9DCE4B80E22; Tue, 13 Sep 2022 14:30:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 05ACDC433D6; Tue, 13 Sep 2022 14:30:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079458; bh=yzjzRzpXVTVGDh0KFDX8Y1sN50cPYyuPFLTk1ZirTPo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R8LMZXoIaJ/HmsFZzEoI4Gx5EQEHlex4IkvcyfxuA18APFYt4CmrBLcyIXzMkgalV 43lJnsv4CIA274AFqSxIRgaclpR4K7rlFlA2YDTd++EdUeL8ZyHmLTEbV/bdbhtoWv pJSPXB/Ns3UU2etfMJE04faYteELFH2VF7qw4XhA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , sunliming , Abhinav Kumar , Sasha Levin Subject: [PATCH 4.19 08/79] drm/msm/dsi: fix the inconsistent indenting Date: Tue, 13 Sep 2022 16:06:26 +0200 Message-Id: <20220913140349.257116582@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: sunliming [ Upstream commit 2f25a1fb4ec516c5ad67afd754334b491b9f09a5 ] Fix the inconsistent indenting in function msm_dsi_dphy_timing_calc_v3(). Fix the following smatch warnings: drivers/gpu/drm/msm/dsi/phy/dsi_phy.c:350 msm_dsi_dphy_timing_calc_v3() war= n: inconsistent indenting Fixes: f1fa7ff44056 ("drm/msm/dsi: implement auto PHY timing calculator for= 10nm PHY") Reported-by: kernel test robot Signed-off-by: sunliming Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/494662/ Link: https://lore.kernel.org/r/20220719015622.646718-1-sunliming@kylinos.cn Signed-off-by: Abhinav Kumar Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/ds= i/phy/dsi_phy.c index f01e245cd0eee..bed0cd72e3ebd 100644 --- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c +++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c @@ -355,7 +355,7 @@ int msm_dsi_dphy_timing_calc_v3(struct msm_dsi_dphy_tim= ing *timing, } else { timing->shared_timings.clk_pre =3D linear_inter(tmax, tmin, pcnt2, 0, false); - timing->shared_timings.clk_pre_inc_by_2 =3D 0; + timing->shared_timings.clk_pre_inc_by_2 =3D 0; } =20 timing->ta_go =3D 3; --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BDF43C6FA82 for ; Tue, 13 Sep 2022 15:32:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236498AbiIMPcj (ORCPT ); Tue, 13 Sep 2022 11:32:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45680 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236481AbiIMPb4 (ORCPT ); Tue, 13 Sep 2022 11:31:56 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6734A7F080; Tue, 13 Sep 2022 07:40:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F2D80B80F97; Tue, 13 Sep 2022 14:31:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 537B2C433D6; Tue, 13 Sep 2022 14:31:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079461; bh=z/4OajzXr8eyN5S2M6vL5lUjbQZx7fjTRGZO8rDsHGM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xM53KTeyvrGOMfW5gcT8PdsXXCypgVF4EosDEV4Tn1NIwA+7WVw/zR40jXbNapDbZ FQ1b+Zt8NLv7cT6GWxkrpymjsfOE4px3WZFef4JHO0Z/HHwQO0YVNepvFpPUg1gBEi ojHRuZC0aQhjm/jV/bnfZHa3hz7YkFKkUmUfKt9g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Douglas Anderson , Dmitry Baryshkov , Abhinav Kumar , Sasha Levin Subject: [PATCH 4.19 09/79] drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg Date: Tue, 13 Sep 2022 16:06:27 +0200 Message-Id: <20220913140349.301347205@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Douglas Anderson [ Upstream commit 1e00d6ac8a3422765bae37aeac2002dfd3c0bda6 ] 3 regulators are listed but the number 2 is specified. Fix it. Fixes: 3a3ff88a0fc1 ("drm/msm/dsi: Add 8x96 info in dsi_cfg") Signed-off-by: Douglas Anderson Reviewed-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Patchwork: https://patchwork.freedesktop.org/patch/496318/ Link: https://lore.kernel.org/r/20220804073608.v4.1.I1056ee3f77f71287f33327= 9efe4c85f88d403f65@changeid Signed-off-by: Abhinav Kumar Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/gpu/drm/msm/dsi/dsi_cfg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/ds= i_cfg.c index dcdfb1bb54f98..ad9d693e11da7 100644 --- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c +++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c @@ -105,7 +105,7 @@ static const char * const dsi_8996_bus_clk_names[] =3D { static const struct msm_dsi_config msm8996_dsi_cfg =3D { .io_offset =3D DSI_6G_REG_SHIFT, .reg_cfg =3D { - .num =3D 2, + .num =3D 3, .regs =3D { {"vdda", 18160, 1 }, /* 1.25 V */ {"vcca", 17000, 32 }, /* 0.925 V */ --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26AAFC54EE9 for ; Tue, 13 Sep 2022 15:06:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235332AbiIMPGL (ORCPT ); Tue, 13 Sep 2022 11:06:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54192 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235371AbiIMPEP (ORCPT ); Tue, 13 Sep 2022 11:04:15 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B05196B8E6; Tue, 13 Sep 2022 07:30:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BC565B80FAF; Tue, 13 Sep 2022 14:29:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12C6BC433C1; Tue, 13 Sep 2022 14:29:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079396; bh=fJYGu+vGBXDNVN3bkHSfbhFb/RFNCdKrSdC1GIKks3I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KuU3su4uyPuCY092W4/QjQIHxb24vh6rUVKkNT4z8N+1XZFPVUoQ0pWnJBrLcI9+A doZxO03vOcxGKg/FkHgcXT2bHWUHoJbnuzZ5qBPgbW/GaI3mACAoQOpfqk0w80NhTR W3EUWyJngTpY8PGjJ6913wYaJv7CjnryDku7IOkw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Shevchenko , Hans de Goede , Sasha Levin Subject: [PATCH 4.19 10/79] platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask Date: Tue, 13 Sep 2022 16:06:28 +0200 Message-Id: <20220913140349.348078286@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andy Shevchenko [ Upstream commit 0a90ed8d0cfa29735a221eba14d9cb6c735d35b6 ] On Intel hardware the SLP_TYPx bitfield occupies bits 10-12 as per ACPI specification (see Table 4.13 "PM1 Control Registers Fixed Hardware Feature Control Bits" for the details). Fix the mask and other related definitions accordingly. Fixes: 93e5eadd1f6e ("x86/platform: New Intel Atom SOC power management con= troller driver") Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220801113734.36131-1-andriy.shevchenko@li= nux.intel.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/platform/x86/pmc_atom.c | 2 +- include/linux/platform_data/x86/pmc_atom.h | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_ato= m.c index 682fc49d172cb..e8440850b73ac 100644 --- a/drivers/platform/x86/pmc_atom.c +++ b/drivers/platform/x86/pmc_atom.c @@ -253,7 +253,7 @@ static void pmc_power_off(void) pm1_cnt_port =3D acpi_base_addr + PM1_CNT; =20 pm1_cnt_value =3D inl(pm1_cnt_port); - pm1_cnt_value &=3D SLEEP_TYPE_MASK; + pm1_cnt_value &=3D ~SLEEP_TYPE_MASK; pm1_cnt_value |=3D SLEEP_TYPE_S5; pm1_cnt_value |=3D SLEEP_ENABLE; =20 diff --git a/include/linux/platform_data/x86/pmc_atom.h b/include/linux/pla= tform_data/x86/pmc_atom.h index e4905fe69c381..e4cfcb6f16633 100644 --- a/include/linux/platform_data/x86/pmc_atom.h +++ b/include/linux/platform_data/x86/pmc_atom.h @@ -16,6 +16,8 @@ #ifndef PMC_ATOM_H #define PMC_ATOM_H =20 +#include + /* ValleyView Power Control Unit PCI Device ID */ #define PCI_DEVICE_ID_VLV_PMC 0x0F1C /* CherryTrail Power Control Unit PCI Device ID */ @@ -148,9 +150,9 @@ #define ACPI_MMIO_REG_LEN 0x100 =20 #define PM1_CNT 0x4 -#define SLEEP_TYPE_MASK 0xFFFFECFF +#define SLEEP_TYPE_MASK GENMASK(12, 10) #define SLEEP_TYPE_S5 0x1C00 -#define SLEEP_ENABLE 0x2000 +#define SLEEP_ENABLE BIT(13) =20 extern int pmc_atom_read(int offset, u32 *value); extern int pmc_atom_write(int offset, u32 value); --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95D7FC54EE9 for ; Tue, 13 Sep 2022 15:07:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235221AbiIMPHT (ORCPT ); Tue, 13 Sep 2022 11:07:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54218 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234769AbiIMPEx (ORCPT ); Tue, 13 Sep 2022 11:04:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1BA316C114; Tue, 13 Sep 2022 07:30:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4AA8FB80F88; Tue, 13 Sep 2022 14:30:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A190FC433C1; Tue, 13 Sep 2022 14:29:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079399; bh=kJnMTM4ch+C5OZcgzioPZy99krNqCRBxoSYBe+BzVks=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=c6dDT8CwM6JfjNWfEvsSuKkF8ZO1So7cZmjWBx169iZGudgZbb/AdpJ6P2EetOgTB 95eXjuo8zYYOjv8gKmdLaEWwnMo1Udaw0W83chzRHQk2jRLTYWtgnziSawUGFe72+h CfB4iONCsNx0ocJ+RiYE35tUw3KQ8kMWI2JeCRC8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Ma , Michael Hennerich , Stefan Schmidt , Sasha Levin Subject: [PATCH 4.19 11/79] ieee802154/adf7242: defer destroy_workqueue call Date: Tue, 13 Sep 2022 16:06:29 +0200 Message-Id: <20220913140349.397572900@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lin Ma [ Upstream commit afe7116f6d3b888778ed6d95e3cf724767b9aedf ] There is a possible race condition (use-after-free) like below (FREE) | (USE) adf7242_remove | adf7242_channel cancel_delayed_work_sync | destroy_workqueue (1) | adf7242_cmd_rx | mod_delayed_work (2) | The root cause for this race is that the upper layer (ieee802154) is unaware of this detaching event and the function adf7242_channel can be called without any checks. To fix this, we can add a flag write at the beginning of adf7242_remove and add flag check in adf7242_channel. Or we can just defer the destructive operation like other commit 3e0588c291d6 ("hamradio: defer ax25 kfree after unregister_netdev") which let the ieee802154_unregister_hw() to handle the synchronization. This patch takes the second option. Fixes: 58e9683d1475 ("net: ieee802154: adf7242: Fix OCL calibration runs") Signed-off-by: Lin Ma Acked-by: Michael Hennerich Link: https://lore.kernel.org/r/20220808034224.12642-1-linma@zju.edu.cn Signed-off-by: Stefan Schmidt Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/net/ieee802154/adf7242.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7= 242.c index a686926bba71e..6ef5523f4e717 100644 --- a/drivers/net/ieee802154/adf7242.c +++ b/drivers/net/ieee802154/adf7242.c @@ -1318,10 +1318,11 @@ static int adf7242_remove(struct spi_device *spi) =20 debugfs_remove_recursive(lp->debugfs_root); =20 + ieee802154_unregister_hw(lp->hw); + cancel_delayed_work_sync(&lp->work); destroy_workqueue(lp->wqueue); =20 - ieee802154_unregister_hw(lp->hw); mutex_destroy(&lp->bmux); ieee802154_free_hw(lp->hw); =20 --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7FFD0C6FA82 for ; Tue, 13 Sep 2022 15:30:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236452AbiIMPaY (ORCPT ); Tue, 13 Sep 2022 11:30:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60764 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236415AbiIMP21 (ORCPT ); Tue, 13 Sep 2022 11:28:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ED9147DF7D; Tue, 13 Sep 2022 07:39:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 49B14614B7; Tue, 13 Sep 2022 14:30:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 48D2FC433D6; Tue, 13 Sep 2022 14:30:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079401; bh=+JRUnhSsb3qZnjCJWE7V6Qy4eCV8rMWMOG6/1fnFw8Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XyIgdVgdKCdGCqy10r83g3KtLn6NJP9VZzHYw6jv35tZWPb4sLuvkYr4xQidUt5eg mSSZ022arcuKlkSo2nqN3ElOkT3/HFDjyqlT6A5deJl4WTFWFgZ5vlvSG/9JJAHweI u1b3+hD4HyCdfxNZN/DZCLnsC47gaZGLz16ndcwQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Johannes Berg , Sasha Levin Subject: [PATCH 4.19 12/79] wifi: cfg80211: debugfs: fix return type in ht40allow_map_read() Date: Tue, 13 Sep 2022 16:06:30 +0200 Message-Id: <20220913140349.443475434@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit d776763f48084926b5d9e25507a3ddb7c9243d5e ] The return type is supposed to be ssize_t, which is signed long, but "r" was declared as unsigned int. This means that on 64 bit systems we return positive values instead of negative error codes. Fixes: 80a3511d70e8 ("cfg80211: add debugfs HT40 allow map") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/YutvOQeJm0UjLhwU@kili Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/wireless/debugfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c index 30fc6eb352bcc..e6410487e25da 100644 --- a/net/wireless/debugfs.c +++ b/net/wireless/debugfs.c @@ -68,9 +68,10 @@ static ssize_t ht40allow_map_read(struct file *file, { struct wiphy *wiphy =3D file->private_data; char *buf; - unsigned int offset =3D 0, buf_size =3D PAGE_SIZE, i, r; + unsigned int offset =3D 0, buf_size =3D PAGE_SIZE, i; enum nl80211_band band; struct ieee80211_supported_band *sband; + ssize_t r; =20 buf =3D kzalloc(buf_size, GFP_KERNEL); if (!buf) --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03B72C6FA82 for ; Tue, 13 Sep 2022 15:25:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236207AbiIMPZW (ORCPT ); Tue, 13 Sep 2022 11:25:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45454 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233238AbiIMPXL (ORCPT ); Tue, 13 Sep 2022 11:23:11 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F31B76B155; Tue, 13 Sep 2022 07:37:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CD594614DF; Tue, 13 Sep 2022 14:30:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D5178C433B5; Tue, 13 Sep 2022 14:30:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079404; bh=ULT3UulllkD6PnR0q3ChBNmifBLJcxOxva0bCFFsHCI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nt6KT6mAYlrt4vYWy3FEQd0jt7RjULMxlca5tf+BRdgWrjELrkHWXpzoLx91idrbh O8TQqGmY4WKxC0euhRmwUZUP/6e75Kk/TW6LvIRAjIf+C3JUudwwFWButhjRjiEp86 budejYEiY4ZWEYnuoRpN1XQw1JKn5HqOYAR8PP1w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mathias Nyman , Sasha Levin Subject: [PATCH 4.19 13/79] Revert "xhci: turn off port power in shutdown" Date: Tue, 13 Sep 2022 16:06:31 +0200 Message-Id: <20220913140349.496982808@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mathias Nyman [ Upstream commit 8531aa1659f7278d4f2ec7408cc000eaa8d85217 ] This reverts commit 83810f84ecf11dfc5a9414a8b762c3501b328185. Turning off port power in shutdown did cause issues such as a laptop not proprly powering off, and some specific usb devies failing to enumerate the subsequent boot after a warm reset. So revert this. Fixes: 83810f84ecf1 ("xhci: turn off port power in shutdown") Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220825150840.132216-4-mathias.nyman@linux= .intel.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci.c | 15 ++------------- drivers/usb/host/xhci.h | 2 -- 3 files changed, 3 insertions(+), 16 deletions(-) diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c index e40370ed7d8a5..1bb48e53449e6 100644 --- a/drivers/usb/host/xhci-hub.c +++ b/drivers/usb/host/xhci-hub.c @@ -565,7 +565,7 @@ struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd) * It will release and re-aquire the lock while calling ACPI * method. */ -void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd, +static void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd, u16 index, bool on, unsigned long *flags) { struct xhci_hub *rhub; diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index 677587479d260..a9e72fee87a77 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -774,8 +774,6 @@ static void xhci_stop(struct usb_hcd *hcd) void xhci_shutdown(struct usb_hcd *hcd) { struct xhci_hcd *xhci =3D hcd_to_xhci(hcd); - unsigned long flags; - int i; =20 if (xhci->quirks & XHCI_SPURIOUS_REBOOT) usb_disable_xhci_ports(to_pci_dev(hcd->self.sysdev)); @@ -791,21 +789,12 @@ void xhci_shutdown(struct usb_hcd *hcd) del_timer_sync(&xhci->shared_hcd->rh_timer); } =20 - spin_lock_irqsave(&xhci->lock, flags); + spin_lock_irq(&xhci->lock); xhci_halt(xhci); - - /* Power off USB2 ports*/ - for (i =3D 0; i < xhci->usb2_rhub.num_ports; i++) - xhci_set_port_power(xhci, xhci->main_hcd, i, false, &flags); - - /* Power off USB3 ports*/ - for (i =3D 0; i < xhci->usb3_rhub.num_ports; i++) - xhci_set_port_power(xhci, xhci->shared_hcd, i, false, &flags); - /* Workaround for spurious wakeups at shutdown with HSW */ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) xhci_reset(xhci, XHCI_RESET_SHORT_USEC); - spin_unlock_irqrestore(&xhci->lock, flags); + spin_unlock_irq(&xhci->lock); =20 xhci_cleanup_msix(xhci); =20 diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h index 3b29dfc6f79e3..3e6cb257fde5a 100644 --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -2145,8 +2145,6 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq= , u16 wValue, u16 wIndex, int xhci_hub_status_data(struct usb_hcd *hcd, char *buf); int xhci_find_raw_port_number(struct usb_hcd *hcd, int port1); struct xhci_hub *xhci_get_rhub(struct usb_hcd *hcd); -void xhci_set_port_power(struct xhci_hcd *xhci, struct usb_hcd *hcd, u16 i= ndex, - bool on, unsigned long *flags); =20 void xhci_hc_died(struct xhci_hcd *xhci); =20 --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BFE96C54EE9 for ; Tue, 13 Sep 2022 15:10:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235510AbiIMPKK (ORCPT ); Tue, 13 Sep 2022 11:10:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54930 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235586AbiIMPIr (ORCPT ); Tue, 13 Sep 2022 11:08:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 10C4676749; Tue, 13 Sep 2022 07:31:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 76AA1614E7; Tue, 13 Sep 2022 14:30:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 86388C433D6; Tue, 13 Sep 2022 14:30:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079406; bh=F7eNZoNKrqXsRar6frmRBa5KEyH/yBkWG+Jmxl7oVps=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rlkPbHByglUcvZq96wHSfAFn9AUedsLUDLcfk1j82HMoTlYyW0i2j/bGa4OkjxrKw 2AK8nVP6qblVOzkwoLRblkbHT2qulXw9E6zutlie+MwyxODRqsHjKfwQW7R2Q9UT4L 6jsRlXxSYrmfLFPYD0YV5o5J6z4Zvv2IC34QXVrA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 14/79] ethernet: rocker: fix sleep in atomic context bug in neigh_timer_handler Date: Tue, 13 Sep 2022 16:06:32 +0200 Message-Id: <20220913140349.548343910@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou [ Upstream commit c0955bf957be4bead01fae1d791476260da7325d ] The function neigh_timer_handler() is a timer handler that runs in an atomic context. When used by rocker, neigh_timer_handler() calls "kzalloc(.., GFP_KERNEL)" that may sleep. As a result, the sleep in atomic context bug will happen. One of the processes is shown below: ofdpa_fib4_add() ... neigh_add_timer() (wait a timer) neigh_timer_handler() neigh_release() neigh_destroy() rocker_port_neigh_destroy() rocker_world_port_neigh_destroy() ofdpa_port_neigh_destroy() ofdpa_port_ipv4_neigh() kzalloc(sizeof(.., GFP_KERNEL) //may sleep This patch changes the gfp_t parameter of kzalloc() from GFP_KERNEL to GFP_ATOMIC in order to mitigate the bug. Fixes: 00fc0c51e35b ("rocker: Change world_ops API and implementation to be= switchdev independant") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/net/ethernet/rocker/rocker_ofdpa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ether= net/rocker/rocker_ofdpa.c index 6473cc68c2d5c..4039e1fc6e92a 100644 --- a/drivers/net/ethernet/rocker/rocker_ofdpa.c +++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c @@ -1276,7 +1276,7 @@ static int ofdpa_port_ipv4_neigh(struct ofdpa_port *o= fdpa_port, bool removing; int err =3D 0; =20 - entry =3D kzalloc(sizeof(*entry), GFP_KERNEL); + entry =3D kzalloc(sizeof(*entry), GFP_ATOMIC); if (!entry) return -ENOMEM; =20 --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2AD2C6FA89 for ; Tue, 13 Sep 2022 15:11:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235413AbiIMPLW (ORCPT ); Tue, 13 Sep 2022 11:11:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42014 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235818AbiIMPJ1 (ORCPT ); Tue, 13 Sep 2022 11:09:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9B27B7675D; Tue, 13 Sep 2022 07:32:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 13DD1614E4; Tue, 13 Sep 2022 14:30:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23E2BC433D7; Tue, 13 Sep 2022 14:30:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079409; bh=Qd9969KoNnkbTMb5ceNyswXbNKwxQESb7HfOPM1t9yI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GYcpsqFPNckEP8zb2Jb1Qdc3tRRLUcM2l9Zjza8KCHc5bV6wc6puCH54urK3wVYTX 6o3pc0EWmn4C5ZVZHnFExmlEbZDAYk3TyplzJwVUPYhk8fQsJag0VUU97RFB9kOK+2 q2BYYbBp3Pbj6i8vXBXGmrDohI6xRWeLjJRKtEzg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+e696806ef96cdd2d87cd@syzkaller.appspotmail.com, Tom Herbert , Cong Wang , Jakub Kicinski , Sasha Levin , syzbot+9fc084a4348493ef65d2@syzkaller.appspotmail.com Subject: [PATCH 4.19 15/79] kcm: fix strp_init() order and cleanup Date: Tue, 13 Sep 2022 16:06:33 +0200 Message-Id: <20220913140349.595770855@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Cong Wang [ Upstream commit 8fc29ff3910f3af08a7c40a75d436b5720efe2bf ] strp_init() is called just a few lines above this csk->sk_user_data check, it also initializes strp->work etc., therefore, it is unnecessary to call strp_done() to cancel the freshly initialized work. And if sk_user_data is already used by KCM, psock->strp should not be touched, particularly strp->work state, so we need to move strp_init() after the csk->sk_user_data check. This also makes a lockdep warning reported by syzbot go away. Reported-and-tested-by: syzbot+9fc084a4348493ef65d2@syzkaller.appspotmail.c= om Reported-by: syzbot+e696806ef96cdd2d87cd@syzkaller.appspotmail.com Fixes: e5571240236c ("kcm: Check if sk_user_data already set in kcm_attach") Fixes: dff8baa26117 ("kcm: Call strp_stop before strp_done in kcm_attach") Cc: Tom Herbert Signed-off-by: Cong Wang Link: https://lore.kernel.org/r/20220827181314.193710-1-xiyou.wangcong@gmai= l.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/kcm/kcmsock.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index b919db02c7f9e..ef2543a4c1fc5 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1412,12 +1412,6 @@ static int kcm_attach(struct socket *sock, struct so= cket *csock, psock->sk =3D csk; psock->bpf_prog =3D prog; =20 - err =3D strp_init(&psock->strp, csk, &cb); - if (err) { - kmem_cache_free(kcm_psockp, psock); - goto out; - } - write_lock_bh(&csk->sk_callback_lock); =20 /* Check if sk_user_data is aready by KCM or someone else. @@ -1425,13 +1419,18 @@ static int kcm_attach(struct socket *sock, struct s= ocket *csock, */ if (csk->sk_user_data) { write_unlock_bh(&csk->sk_callback_lock); - strp_stop(&psock->strp); - strp_done(&psock->strp); kmem_cache_free(kcm_psockp, psock); err =3D -EALREADY; goto out; } =20 + err =3D strp_init(&psock->strp, csk, &cb); + if (err) { + write_unlock_bh(&csk->sk_callback_lock); + kmem_cache_free(kcm_psockp, psock); + goto out; + } + psock->save_data_ready =3D csk->sk_data_ready; psock->save_write_space =3D csk->sk_write_space; psock->save_state_change =3D csk->sk_state_change; --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 91656C54EE9 for ; Tue, 13 Sep 2022 15:10:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235569AbiIMPKe (ORCPT ); Tue, 13 Sep 2022 11:10:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36612 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235665AbiIMPI7 (ORCPT ); Tue, 13 Sep 2022 11:08:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ACE2175FEC; Tue, 13 Sep 2022 07:31:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1E3B1B80F10; Tue, 13 Sep 2022 14:30:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 813E7C433D6; Tue, 13 Sep 2022 14:30:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079411; bh=Skxu6Kv5ssBQyZSPlWI5KDMZ8WTZbUPGO4+ITBNnGfo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wTwo6VA+9SQ/Il+r0qqixblJBIDDY9fykAjOI87MP5aSIM0MOxgbSJi1t/oXkfUef ssyOlw5SsZwH/vPqn739CrFlQ8ZAO9xB61kzjLN7Fk6gH3Cp5BQuapicFsZ8b5lbr+ Bbt+YK2OXjbzAYkYl4+AH563cM5EiUBjuzneaD48= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Jakub Kicinski , Sasha Levin , zdi-disclosures@trendmicro.com Subject: [PATCH 4.19 16/79] sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb Date: Tue, 13 Sep 2022 16:06:34 +0200 Message-Id: <20220913140349.652764189@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Toke H=C3=B8iland-J=C3=B8rgensen [ Upstream commit 90fabae8a2c225c4e4936723c38857887edde5cc ] When the GSO splitting feature of sch_cake is enabled, GSO superpackets will be broken up and the resulting segments enqueued in place of the original skb. In this case, CAKE calls consume_skb() on the original skb, but still returns NET_XMIT_SUCCESS. This can confuse parent qdiscs into assuming the original skb still exists, when it really has been freed. Fix this by adding the __NET_XMIT_STOLEN flag to the return value in this case. Fixes: 0c850344d388 ("sch_cake: Conditionally split GSO segments") Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18231 Link: https://lore.kernel.org/r/20220831092103.442868-1-toke@toke.dk Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/sched/sch_cake.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index 18c207b85d513..c0a6947545280 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -1666,6 +1666,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Q= disc *sch, } idx--; flow =3D &b->flows[idx]; + ret =3D NET_XMIT_SUCCESS; =20 /* ensure shaper state isn't stale */ if (!b->tin_backlog) { @@ -1726,6 +1727,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Q= disc *sch, =20 qdisc_tree_reduce_backlog(sch, 1-numsegs, len-slen); consume_skb(skb); + ret |=3D __NET_XMIT_STOLEN; } else { /* not splitting */ cobalt_set_enqueue_time(skb, now); @@ -1849,7 +1851,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Q= disc *sch, } b->drop_overlimit +=3D dropped; } - return NET_XMIT_SUCCESS; + return ret; } =20 static struct sk_buff *cake_dequeue_one(struct Qdisc *sch) --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 179C8C54EE9 for ; Tue, 13 Sep 2022 15:24:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236136AbiIMPY4 (ORCPT ); Tue, 13 Sep 2022 11:24:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55710 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236017AbiIMPW4 (ORCPT ); Tue, 13 Sep 2022 11:22:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E4B487C31F; Tue, 13 Sep 2022 07:37:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C6294614E3; Tue, 13 Sep 2022 14:30:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E34DDC433D6; Tue, 13 Sep 2022 14:30:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079414; bh=hTIDCkkY+yz035+KYOS7FOKTLAS//Yd9joPVGfX1drQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d2IRC1V7f1pivTex3EnKzJRgFe1PXdvdXkS64xWUhJT6C5HRzEzj7evITpYrAld/L CyqQjQfamrcQNX1JdcTvU77JonM2zDBRbavv6YATXsKORThONK7nO/Sv/PRFbwP1A0 wwI/Rq8ryBVDPEmaj7kTlcJLMBMVlBv2qU8VHHGE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Eric Dumazet , Neal Cardwell , Jakub Kicinski , Sasha Levin Subject: [PATCH 4.19 17/79] tcp: annotate data-race around challenge_timestamp Date: Tue, 13 Sep 2022 16:06:35 +0200 Message-Id: <20220913140349.707980737@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet [ Upstream commit 8c70521238b7863c2af607e20bcba20f974c969b ] challenge_timestamp can be read an written by concurrent threads. This was expected, but we need to annotate the race to avoid potential issu= es. Following patch moves challenge_timestamp and challenge_count to per-netns storage to provide better isolation. Fixes: 354e4aa391ed ("tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigat= ion") Reported-by: syzbot Signed-off-by: Eric Dumazet Acked-by: Neal Cardwell Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/ipv4/tcp_input.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index e1d065ea5a158..0be9d5d3c032f 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3468,11 +3468,11 @@ static void tcp_send_challenge_ack(struct sock *sk,= const struct sk_buff *skb) =20 /* Then check host-wide RFC 5961 rate limit. */ now =3D jiffies / HZ; - if (now !=3D challenge_timestamp) { + if (now !=3D READ_ONCE(challenge_timestamp)) { u32 ack_limit =3D READ_ONCE(net->ipv4.sysctl_tcp_challenge_ack_limit); u32 half =3D (ack_limit + 1) >> 1; =20 - challenge_timestamp =3D now; + WRITE_ONCE(challenge_timestamp, now); WRITE_ONCE(challenge_count, half + prandom_u32_max(ack_limit)); } count =3D READ_ONCE(challenge_count); --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7777EC54EE9 for ; Tue, 13 Sep 2022 15:07:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235360AbiIMPHB (ORCPT ); Tue, 13 Sep 2022 11:07:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40428 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235471AbiIMPEf (ORCPT ); Tue, 13 Sep 2022 11:04:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3EBBA74DCF; Tue, 13 Sep 2022 07:30:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6AF13614E8; Tue, 13 Sep 2022 14:30:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7DDC1C433C1; Tue, 13 Sep 2022 14:30:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079416; bh=zFhS6/exjr48cT/0kwF6TaWpwzaS/3ugMhrpIQzLnLg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xvlogJ5qmYywE302RZS3sH1pTORmNA2UMpqyjVAKZ7EO9IXmvfrSDpW2VaFqbGOA6 2SfnuMMg5r8S7sUwfYob1ux7Z/mkiteXH3TzY7wUn6pUvjNEXdOV9MoomFcQOEPB4m Tupr7etohgoBqdj3oCrnGEjYI0YPol7v0KUkwpOg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jakub Kicinski , Sasha Levin Subject: [PATCH 4.19 18/79] Revert "sch_cake: Return __NET_XMIT_STOLEN when consuming enqueued skb" Date: Tue, 13 Sep 2022 16:06:36 +0200 Message-Id: <20220913140349.753256086@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jakub Kicinski [ Upstream commit 0b4f688d53fdc2a731b9d9cdf0c96255bc024ea6 ] This reverts commit 90fabae8a2c225c4e4936723c38857887edde5cc. Patch was applied hastily, revert and let the v2 be reviewed. Fixes: 90fabae8a2c2 ("sch_cake: Return __NET_XMIT_STOLEN when consuming enq= ueued skb") Link: https://lore.kernel.org/all/87wnao2ha3.fsf@toke.dk/ Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/sched/sch_cake.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c index c0a6947545280..18c207b85d513 100644 --- a/net/sched/sch_cake.c +++ b/net/sched/sch_cake.c @@ -1666,7 +1666,6 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Q= disc *sch, } idx--; flow =3D &b->flows[idx]; - ret =3D NET_XMIT_SUCCESS; =20 /* ensure shaper state isn't stale */ if (!b->tin_backlog) { @@ -1727,7 +1726,6 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Q= disc *sch, =20 qdisc_tree_reduce_backlog(sch, 1-numsegs, len-slen); consume_skb(skb); - ret |=3D __NET_XMIT_STOLEN; } else { /* not splitting */ cobalt_set_enqueue_time(skb, now); @@ -1851,7 +1849,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Q= disc *sch, } b->drop_overlimit +=3D dropped; } - return ret; + return NET_XMIT_SUCCESS; } =20 static struct sk_buff *cake_dequeue_one(struct Qdisc *sch) --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A54C6C54EE9 for ; Tue, 13 Sep 2022 15:07:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235177AbiIMPHN (ORCPT ); Tue, 13 Sep 2022 11:07:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57252 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232382AbiIMPEm (ORCPT ); Tue, 13 Sep 2022 11:04:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E9E3C74E35; Tue, 13 Sep 2022 07:30:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6CD34B80EFA; Tue, 13 Sep 2022 14:30:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E15CAC433D6; Tue, 13 Sep 2022 14:30:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079419; bh=Ts001EFLg14UM0gR5+RoL0k7mn87CWbDBOrEQf6oIpY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=snbkce+uwY5mBG/pPr1w6hFjDfRlS0sDDn6cIvJKh6AJEBofnwFUSOKR9n+Dt86bO FSendZynmSVkF+jQ8jEmeZQ0TGVP5LNpZbGMgVgjvFXIeIroXLj1d3WCMf/JrVdGo1 7gU06SKIMw4JS5AiVmlG+QD6zJ+1EnddVDJtcYoI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yacan Liu , Tony Lu , Paolo Abeni , Sasha Levin Subject: [PATCH 4.19 19/79] net/smc: Remove redundant refcount increase Date: Tue, 13 Sep 2022 16:06:37 +0200 Message-Id: <20220913140349.806693128@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yacan Liu [ Upstream commit a8424a9b4522a3ab9f32175ad6d848739079071f ] For passive connections, the refcount increment has been done in smc_clcsock_accept()-->smc_sock_alloc(). Fixes: 3b2dec2603d5 ("net/smc: restructure client and server code in af_smc= ") Signed-off-by: Yacan Liu Reviewed-by: Tony Lu Link: https://lore.kernel.org/r/20220830152314.838736-1-liuyacan@corp.netea= se.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/smc/af_smc.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 4c904ab29e0e6..dcd00b514c3f9 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -1031,7 +1031,6 @@ static void smc_listen_out_connected(struct smc_sock = *new_smc) { struct sock *newsmcsk =3D &new_smc->sk; =20 - sk_refcnt_debug_inc(newsmcsk); if (newsmcsk->sk_state =3D=3D SMC_INIT) newsmcsk->sk_state =3D SMC_ACTIVE; =20 --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6066AC6FA82 for ; Tue, 13 Sep 2022 15:39:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234154AbiIMPjr (ORCPT ); Tue, 13 Sep 2022 11:39:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52262 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236723AbiIMPis (ORCPT ); Tue, 13 Sep 2022 11:38:48 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA84D186F3; Tue, 13 Sep 2022 07:44:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 95253614EA; Tue, 13 Sep 2022 14:30:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AEC43C433C1; Tue, 13 Sep 2022 14:30:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079424; bh=qUDf5XTkMr1y3mYRDLD8wyQJgOaBBW1W3YD8wCMg+Ko=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SopX2Q+5zCHd5dLoPS+tM5a9R8mVjATtkEon8LRpKvdCSnozkCohW0MqYoSt8GhNO Xd7c1NjiBaa8IWGa9+FYFb90ZLm3sD3HflphxFpInUJZbPgJ1bXR+NgIxt4kHnMLGA bg7E7ARHYUhcczaQ72H/sr+Dyr9Hr6AJTri/pgug= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Nicolas Diaz , Shenwei Wang Subject: [PATCH 4.19 20/79] serial: fsl_lpuart: RS485 RTS polariy is inverse Date: Tue, 13 Sep 2022 16:06:38 +0200 Message-Id: <20220913140349.855097989@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Shenwei Wang commit 846651eca073e2e02e37490a4a52752415d84781 upstream. The setting of RS485 RTS polarity is inverse in the current driver. When the property of 'rs485-rts-active-low' is enabled in the dts node, the RTS signal should be LOW during sending. Otherwise, if there is no such a property, the RTS should be HIGH during sending. Fixes: 03895cf41d18 ("tty: serial: fsl_lpuart: Add support for RS-485") Cc: stable Signed-off-by: Nicolas Diaz Signed-off-by: Shenwei Wang Link: https://lore.kernel.org/r/20220805144529.604856-1-shenwei.wang@nxp.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/tty/serial/fsl_lpuart.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -1102,9 +1102,9 @@ static int lpuart_config_rs485(struct ua * Note: UART is assumed to be active high. */ if (rs485->flags & SER_RS485_RTS_ON_SEND) - modem &=3D ~UARTMODEM_TXRTSPOL; - else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) modem |=3D UARTMODEM_TXRTSPOL; + else if (rs485->flags & SER_RS485_RTS_AFTER_SEND) + modem &=3D ~UARTMODEM_TXRTSPOL; } =20 /* Store the new configuration */ From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39F3EC54EE9 for ; Tue, 13 Sep 2022 15:07:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235417AbiIMPHx (ORCPT ); Tue, 13 Sep 2022 11:07:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55252 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235287AbiIMPFz (ORCPT ); Tue, 13 Sep 2022 11:05:55 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 69F25753A9; Tue, 13 Sep 2022 07:30:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CAA09B80FA1; Tue, 13 Sep 2022 14:30:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2DCFBC433D7; Tue, 13 Sep 2022 14:30:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079426; bh=6QeIICB9afA+06gQQvIaQmzK9vuCVqdguqf5PTujeGk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mNDAyuMP1/TcLT2kSWwQTleQ42cN4XY84n4hI6vb83aEvNV5bNFDIboO9ynttSekq 3ssdfPftON6V9rEqD749E2Y7zEJ/yRkGtKju0l8GxHefTECkcLRTqazf0umdo7canQ HwVQONHa6Bep1U+ParpXfh0IWaeHLCadwwEepgsQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Zheng Wang , Dan Carpenter Subject: [PATCH 4.19 21/79] staging: rtl8712: fix use after free bugs Date: Tue, 13 Sep 2022 16:06:39 +0200 Message-Id: <20220913140349.912122205@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit e230a4455ac3e9b112f0367d1b8e255e141afae0 upstream. _Read/Write_MACREG callbacks are NULL so the read/write_macreg_hdl() functions don't do anything except free the "pcmd" pointer. It results in a use after free. Delete them. Fixes: 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline k= ernel") Cc: stable Reported-by: Zheng Wang Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/Yw4ASqkYcUhUfoY2@kili Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/staging/rtl8712/rtl8712_cmd.c | 36 -----------------------------= ----- 1 file changed, 36 deletions(-) --- a/drivers/staging/rtl8712/rtl8712_cmd.c +++ b/drivers/staging/rtl8712/rtl8712_cmd.c @@ -129,34 +129,6 @@ static void r871x_internal_cmd_hdl(struc kfree(pdrvcmd->pbuf); } =20 -static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf) -{ - void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); - struct cmd_obj *pcmd =3D (struct cmd_obj *)pbuf; - - /* invoke cmd->callback function */ - pcmd_callback =3D cmd_callback[pcmd->cmdcode].callback; - if (!pcmd_callback) - r8712_free_cmd_obj(pcmd); - else - pcmd_callback(padapter, pcmd); - return H2C_SUCCESS; -} - -static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf) -{ - void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj *pcmd); - struct cmd_obj *pcmd =3D (struct cmd_obj *)pbuf; - - /* invoke cmd->callback function */ - pcmd_callback =3D cmd_callback[pcmd->cmdcode].callback; - if (!pcmd_callback) - r8712_free_cmd_obj(pcmd); - else - pcmd_callback(padapter, pcmd); - return H2C_SUCCESS; -} - static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf) { struct cmd_obj *pcmd =3D (struct cmd_obj *)pbuf; @@ -225,14 +197,6 @@ static struct cmd_obj *cmd_hdl_filter(st pcmd_r =3D NULL; =20 switch (pcmd->cmdcode) { - case GEN_CMD_CODE(_Read_MACREG): - read_macreg_hdl(padapter, (u8 *)pcmd); - pcmd_r =3D pcmd; - break; - case GEN_CMD_CODE(_Write_MACREG): - write_macreg_hdl(padapter, (u8 *)pcmd); - pcmd_r =3D pcmd; - break; case GEN_CMD_CODE(_Read_BBREG): read_bbreg_hdl(padapter, (u8 *)pcmd); break; From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7E5EC54EE9 for ; Tue, 13 Sep 2022 15:08:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235433AbiIMPIG (ORCPT ); Tue, 13 Sep 2022 11:08:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35494 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235361AbiIMPGT (ORCPT ); Tue, 13 Sep 2022 11:06:19 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 672A974DC9; Tue, 13 Sep 2022 07:30:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2333BB80F1A; Tue, 13 Sep 2022 14:30:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8835AC433D6; Tue, 13 Sep 2022 14:30:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079428; bh=fVTPf3kZWUEOzXkJeJsw7Qw1cjNO7q4MAtA0lzT95Qs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PD7QvzD3rywL1xBJ6C/lWaOkPluZhga8Qb/eDJOHp7dpLj8BEujG229zZZ0zq/by5 di5pU4knr7CX5NZQ9ORSbk683iJ3Z21EDOWcphcrp7JQXM0insykqolmi3WdUSEFGO Qp+JpxzY6kWe6pmuQyv4XMLOcdoFuERAoTyxSKQ0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com, stable , Khalid Masum , Helge Deller Subject: [PATCH 4.19 22/79] vt: Clear selection before changing the font Date: Tue, 13 Sep 2022 16:06:40 +0200 Message-Id: <20220913140349.970511449@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller commit 566f9c9f89337792070b5a6062dff448b3e7977f upstream. When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-memory accesses by dropping the selection before the various con_font_set() console handlers are called. Reported-by: syzbot+14b0e8f3fd1612e35350@syzkaller.appspotmail.com Cc: stable Tested-by: Khalid Masum Signed-off-by: Helge Deller Link: https://lore.kernel.org/r/YuV9apZGNmGfjcor@p100 Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/tty/vt/vt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4518,9 +4518,11 @@ static int con_font_set(struct vc_data * console_lock(); if (vc->vc_mode !=3D KD_TEXT) rc =3D -EINVAL; - else if (vc->vc_sw->con_font_set) + else if (vc->vc_sw->con_font_set) { + if (vc_is_sel(vc)) + clear_selection(); rc =3D vc->vc_sw->con_font_set(vc, &font, op->flags); - else + } else rc =3D -ENOSYS; console_unlock(); kfree(font.data); @@ -4547,9 +4549,11 @@ static int con_font_default(struct vc_da console_unlock(); return -EINVAL; } - if (vc->vc_sw->con_font_default) + if (vc->vc_sw->con_font_default) { + if (vc_is_sel(vc)) + clear_selection(); rc =3D vc->vc_sw->con_font_default(vc, &font, s); - else + } else rc =3D -ENOSYS; console_unlock(); if (!rc) { From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5AB94C6FA8B for ; Tue, 13 Sep 2022 15:08:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235449AbiIMPIP (ORCPT ); Tue, 13 Sep 2022 11:08:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59116 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235275AbiIMPGv (ORCPT ); Tue, 13 Sep 2022 11:06:51 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5633E7538E; Tue, 13 Sep 2022 07:30:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DF79261414; Tue, 13 Sep 2022 14:30:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0414DC433D6; Tue, 13 Sep 2022 14:30:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079431; bh=7mreMoNMe2y+I+bp3VFWad5be6urVBI6OeKSwayGzSU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VQYaoe+SB1g8Mpqi8ej28t7eh8NXpeKfB+GvBxpKYURLJRrA41SabZ4ZLcnEsF5fr CPfIbFdwsyELsFobEy4PELOFXsQkWep1v3PgnMYgzN5+CZ/jcPKbP33Jxc52dXodrz xQLtiekB/pMy84B7+/Te/mdPIEDsoeJ+ltcxVSP0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Niek Nooijens , Johan Hovold Subject: [PATCH 4.19 23/79] USB: serial: ftdi_sio: add Omron CS1W-CIF31 device id Date: Tue, 13 Sep 2022 16:06:41 +0200 Message-Id: <20220913140350.027454959@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Niek Nooijens commit 001047ea241a9646010b2744451dfbc7289542f3 upstream. works perfectly with: modprobe ftdi_sio echo "0590 00b2" | tee /sys/module/ftdi_sio/drivers/usb-serial\:ftdi_sio/new_id > /dev/null but doing this every reboot is a pain in the ass. Signed-off-by: Niek Nooijens Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 8 insertions(+) --- a/drivers/usb/serial/ftdi_sio.c +++ b/drivers/usb/serial/ftdi_sio.c @@ -1035,6 +1035,8 @@ static const struct usb_device_id id_tab /* IDS GmbH devices */ { USB_DEVICE(IDS_VID, IDS_SI31A_PID) }, { USB_DEVICE(IDS_VID, IDS_CM31A_PID) }, + /* Omron devices */ + { USB_DEVICE(OMRON_VID, OMRON_CS1W_CIF31_PID) }, /* U-Blox devices */ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, --- a/drivers/usb/serial/ftdi_sio_ids.h +++ b/drivers/usb/serial/ftdi_sio_ids.h @@ -662,6 +662,12 @@ #define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0= */ =20 /* + * Omron corporation (https://www.omron.com) + */ + #define OMRON_VID 0x0590 + #define OMRON_CS1W_CIF31_PID 0x00b2 + +/* * Acton Research Corp. */ #define ACTON_VID 0x0647 /* Vendor ID */ From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D007C54EE9 for ; Tue, 13 Sep 2022 15:08:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235412AbiIMPH7 (ORCPT ); Tue, 13 Sep 2022 11:07:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35246 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235335AbiIMPGO (ORCPT ); Tue, 13 Sep 2022 11:06:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6704661D9F; Tue, 13 Sep 2022 07:30:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 14298B80F62; Tue, 13 Sep 2022 14:30:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7252BC433C1; Tue, 13 Sep 2022 14:30:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079433; bh=aSxfqKGjQO+5c6akFCLE8NVkkykJwaij65nDX3ATclQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tKlXwZ3WxE/5gwuclV+hzramvLyIbQFKijjed/HrbK9SX7oA1vFngDhmxoeQjpWGh e7ArCJrGfIvWP/PnU5NtnRMz8PSbp+tlHd7BfHZi1d6cT0UXIEGKBuS7c295qDeZ25 uv6+nLDk99d3HA/03etgRVJNE5UXSiEM4FoxndQQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Christian Brauner (Microsoft)" , Carlos Llamas , stable Subject: [PATCH 4.19 24/79] binder: fix UAF of ref->proc caused by race condition Date: Tue, 13 Sep 2022 16:06:42 +0200 Message-Id: <20220913140350.076872457@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Carlos Llamas commit a0e44c64b6061dda7e00b7c458e4523e2331b739 upstream. A transaction of type BINDER_TYPE_WEAK_HANDLE can fail to increment the reference for a node. In this case, the target proc normally releases the failed reference upon close as expected. However, if the target is dying in parallel the call will race with binder_deferred_release(), so the target could have released all of its references by now leaving the cleanup of the new failed reference unhandled. The transaction then ends and the target proc gets released making the ref->proc now a dangling pointer. Later on, ref->node is closed and we attempt to take spin_lock(&ref->proc->inner_lock), which leads to the use-after-free bug reported below. Let's fix this by cleaning up the failed reference on the spot instead of relying on the target to do so. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in _raw_spin_lock+0xa8/0x150 Write of size 4 at addr ffff5ca207094238 by task kworker/1:0/590 CPU: 1 PID: 590 Comm: kworker/1:0 Not tainted 5.19.0-rc8 #10 Hardware name: linux,dummy-virt (DT) Workqueue: events binder_deferred_func Call trace: dump_backtrace.part.0+0x1d0/0x1e0 show_stack+0x18/0x70 dump_stack_lvl+0x68/0x84 print_report+0x2e4/0x61c kasan_report+0xa4/0x110 kasan_check_range+0xfc/0x1a4 __kasan_check_write+0x3c/0x50 _raw_spin_lock+0xa8/0x150 binder_deferred_func+0x5e0/0x9b0 process_one_work+0x38c/0x5f0 worker_thread+0x9c/0x694 kthread+0x188/0x190 ret_from_fork+0x10/0x20 Acked-by: Christian Brauner (Microsoft) Signed-off-by: Carlos Llamas Cc: stable # 4.14+ Link: https://lore.kernel.org/r/20220801182511.3371447-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/android/binder.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -1809,6 +1809,18 @@ static int binder_inc_ref_for_node(struc } ret =3D binder_inc_ref_olocked(ref, strong, target_list); *rdata =3D ref->data; + if (ret && ref =3D=3D new_ref) { + /* + * Cleanup the failed reference here as the target + * could now be dead and have already released its + * references by now. Calling on the new reference + * with strong=3D0 and a tmp_refs will not decrement + * the node. The new_ref gets kfree'd below. + */ + binder_cleanup_ref_olocked(new_ref); + ref =3D NULL; + } + binder_proc_unlock(proc); if (new_ref && ref !=3D new_ref) /* From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD75BC54EE9 for ; Tue, 13 Sep 2022 15:08:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235438AbiIMPIJ (ORCPT ); Tue, 13 Sep 2022 11:08:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235362AbiIMPGT (ORCPT ); Tue, 13 Sep 2022 11:06:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EEACD753BF; Tue, 13 Sep 2022 07:30:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B0D78614CE; Tue, 13 Sep 2022 14:30:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9F73C433D6; Tue, 13 Sep 2022 14:30:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079436; bh=eZJOThYP4wm6xfAkQVHsDsG7KU0Di8nivbUXO/0Bf+E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EWJHd2RJxGuW7nBTHpRAdzWDUPBpETufbXu8ZqnQSwySTaoLTEVd6Mux4o3Q0MyWg TZS+PbNc2XfwDOXK8RO4p7hea0e4JTc1SXwX9HvnSU21o8EJGDGKHzKGIXAO4VSlrx FrSZJ2B/QJyyMz92W/+atTRyGFWOhKITvcxx4q5s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Colin Ian King , Zhi Wang , Zhenyu Wang , Sasha Levin Subject: [PATCH 4.19 25/79] drm/i915/reg: Fix spelling mistake "Unsupport" -> "Unsupported" Date: Tue, 13 Sep 2022 16:06:43 +0200 Message-Id: <20220913140350.119463132@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Colin Ian King [ Upstream commit 233f56745be446b289edac2ba8184c09365c005e ] There is a spelling mistake in a gvt_vgpu_err error message. Fix it. Fixes: 695fbc08d80f ("drm/i915/gvt: replace the gvt_err with gvt_vgpu_err") Signed-off-by: Colin Ian King Signed-off-by: Zhi Wang Link: http://patchwork.freedesktop.org/patch/msgid/20220315202449.2952845-1= -colin.i.king@gmail.com Reviewed-by: Zhi Wang Signed-off-by: Zhenyu Wang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/gpu/drm/i915/gvt/handlers.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt= /handlers.c index 94c1089ecf59e..1bde4b618d151 100644 --- a/drivers/gpu/drm/i915/gvt/handlers.c +++ b/drivers/gpu/drm/i915/gvt/handlers.c @@ -651,7 +651,7 @@ static int update_fdi_rx_iir_status(struct intel_vgpu *= vgpu, else if (FDI_RX_IMR_TO_PIPE(offset) !=3D INVALID_INDEX) index =3D FDI_RX_IMR_TO_PIPE(offset); else { - gvt_vgpu_err("Unsupport registers %x\n", offset); + gvt_vgpu_err("Unsupported registers %x\n", offset); return -EINVAL; } =20 --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B0831C54EE9 for ; Tue, 13 Sep 2022 15:13:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235492AbiIMPNE (ORCPT ); Tue, 13 Sep 2022 11:13:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50540 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235295AbiIMPLU (ORCPT ); Tue, 13 Sep 2022 11:11:20 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B785878219; Tue, 13 Sep 2022 07:32:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 17F68614D0; Tue, 13 Sep 2022 14:30:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31E7FC433D6; Tue, 13 Sep 2022 14:30:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079438; bh=0ZEUTEcxjqvEWn9z7YBSmi0n2DUPV8TRQltQwOP9TYE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dA2qPHa/fUTd5CyNSWaT2BIcfJUKufV0wwBxRUI7+cEEJnsi8GrUswBv6VnxstLfo KHUSs6Ohgax6/QFwFMJYgFNYpRlQI87utSLWFHKieUgQAdMASSPtTjisWmVsnLXOLb WzOmyVG6qtpV0PzFRzfOslFr8XC1T9cNIxr6dBtE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chen-Yu Tsai , "=?UTF-8?q?N=C3=ADcolas=20F . =20R . =20A . =20Prado?=" , Stephen Boyd , Sasha Levin Subject: [PATCH 4.19 26/79] clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops Date: Tue, 13 Sep 2022 16:06:44 +0200 Message-Id: <20220913140350.166493861@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Chen-Yu Tsai [ Upstream commit 35b0fac808b95eea1212f8860baf6ad25b88b087 ] In the previous commits that added CLK_OPS_PARENT_ENABLE, support for this flag was only added to rate change operations (rate setting and reparent) and disabling unused subtree. It was not added to the clock gate related operations. Any hardware driver that needs it for these operations will either see bogus results, or worse, hang. This has been seen on MT8192 and MT8195, where the imp_ii2_* clk drivers set this, but dumping debugfs clk_summary would cause it to hang. Fixes: fc8726a2c021 ("clk: core: support clocks which requires parents enab= le (part 2)") Fixes: a4b3518d146f ("clk: core: support clocks which requires parents enab= le (part 1)") Signed-off-by: Chen-Yu Tsai Reviewed-by: N=C3=ADcolas F. R. A. Prado Tested-by: N=C3=ADcolas F. R. A. Prado Link: https://lore.kernel.org/r/20220822081424.1310926-2-wenst@chromium.org Signed-off-by: Stephen Boyd Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/clk/clk.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c index 32606d1094fe4..4021c7c10c8d9 100644 --- a/drivers/clk/clk.c +++ b/drivers/clk/clk.c @@ -196,6 +196,9 @@ static bool clk_core_rate_is_protected(struct clk_core = *core) return core->protect_count; } =20 +static int clk_core_prepare_enable(struct clk_core *core); +static void clk_core_disable_unprepare(struct clk_core *core); + static bool clk_core_is_prepared(struct clk_core *core) { bool ret =3D false; @@ -208,7 +211,11 @@ static bool clk_core_is_prepared(struct clk_core *core) return core->prepare_count; =20 if (!clk_pm_runtime_get(core)) { + if (core->flags & CLK_OPS_PARENT_ENABLE) + clk_core_prepare_enable(core->parent); ret =3D core->ops->is_prepared(core->hw); + if (core->flags & CLK_OPS_PARENT_ENABLE) + clk_core_disable_unprepare(core->parent); clk_pm_runtime_put(core); } =20 @@ -244,7 +251,13 @@ static bool clk_core_is_enabled(struct clk_core *core) } } =20 + if (core->flags & CLK_OPS_PARENT_ENABLE) + clk_core_prepare_enable(core->parent); + ret =3D core->ops->is_enabled(core->hw); + + if (core->flags & CLK_OPS_PARENT_ENABLE) + clk_core_disable_unprepare(core->parent); done: if (core->dev) pm_runtime_put(core->dev); @@ -704,6 +717,9 @@ int clk_rate_exclusive_get(struct clk *clk) } EXPORT_SYMBOL_GPL(clk_rate_exclusive_get); =20 +static int clk_core_enable_lock(struct clk_core *core); +static void clk_core_disable_lock(struct clk_core *core); + static void clk_core_unprepare(struct clk_core *core) { lockdep_assert_held(&prepare_lock); @@ -727,6 +743,9 @@ static void clk_core_unprepare(struct clk_core *core) =20 WARN(core->enable_count > 0, "Unpreparing enabled %s\n", core->name); =20 + if (core->flags & CLK_OPS_PARENT_ENABLE) + clk_core_enable_lock(core->parent); + trace_clk_unprepare(core); =20 if (core->ops->unprepare) @@ -735,6 +754,9 @@ static void clk_core_unprepare(struct clk_core *core) clk_pm_runtime_put(core); =20 trace_clk_unprepare_complete(core); + + if (core->flags & CLK_OPS_PARENT_ENABLE) + clk_core_disable_lock(core->parent); clk_core_unprepare(core->parent); } =20 @@ -783,6 +805,9 @@ static int clk_core_prepare(struct clk_core *core) if (ret) goto runtime_put; =20 + if (core->flags & CLK_OPS_PARENT_ENABLE) + clk_core_enable_lock(core->parent); + trace_clk_prepare(core); =20 if (core->ops->prepare) @@ -790,6 +815,9 @@ static int clk_core_prepare(struct clk_core *core) =20 trace_clk_prepare_complete(core); =20 + if (core->flags & CLK_OPS_PARENT_ENABLE) + clk_core_disable_lock(core->parent); + if (ret) goto unprepare; } --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 74EBFECAAD8 for ; Tue, 13 Sep 2022 17:21:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232871AbiIMRU6 (ORCPT ); Tue, 13 Sep 2022 13:20:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38732 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232676AbiIMRUa (ORCPT ); Tue, 13 Sep 2022 13:20:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AE8BC98751; Tue, 13 Sep 2022 09:06:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8DC39614AC; Tue, 13 Sep 2022 14:30:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 95564C433D6; Tue, 13 Sep 2022 14:30:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079440; bh=Nn3NzBaLXCqk2lY74BYrmbT2Hb8IDW52XsaI+OQO+8w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DCoWU42+TDvivWQS8u6ZUpD8Qzt/o2thVNlyCY4Zs3X77nBB21VyqGRLB+iyHx8io iaNSabtmIh+QYB9/AvZxWPGTm1jyrLgq8bzoogovUpd2DyceYDMuJW/x7/9D4PgMIO YgR3L2tKcKXnb4cHGmh3OCrtzLdkkx0EDsZJoOro= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Stein , Chen-Yu Tsai , Stephen Boyd , Sasha Levin Subject: [PATCH 4.19 27/79] Revert "clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate ops" Date: Tue, 13 Sep 2022 16:06:45 +0200 Message-Id: <20220913140350.207594033@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Stephen Boyd [ Upstream commit abb5f3f4b1f5f0ad50eb067a00051d3587dec9fb ] This reverts commit 35b0fac808b95eea1212f8860baf6ad25b88b087. Alexander reports that it causes boot failures on i.MX8M Plus based boards (specifically imx8mp-tqma8mpql-mba8mpxl.dts). Reported-by: Alexander Stein Cc: Chen-Yu Tsai Fixes: 35b0fac808b9 ("clk: core: Honor CLK_OPS_PARENT_ENABLE for clk gate o= ps") Link: https://lore.kernel.org/r/12115951.O9o76ZdvQC@steina-w Signed-off-by: Stephen Boyd Link: https://lore.kernel.org/r/20220831175326.2523912-1-sboyd@kernel.org Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/clk/clk.c | 28 ---------------------------- 1 file changed, 28 deletions(-) diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c index 4021c7c10c8d9..32606d1094fe4 100644 --- a/drivers/clk/clk.c +++ b/drivers/clk/clk.c @@ -196,9 +196,6 @@ static bool clk_core_rate_is_protected(struct clk_core = *core) return core->protect_count; } =20 -static int clk_core_prepare_enable(struct clk_core *core); -static void clk_core_disable_unprepare(struct clk_core *core); - static bool clk_core_is_prepared(struct clk_core *core) { bool ret =3D false; @@ -211,11 +208,7 @@ static bool clk_core_is_prepared(struct clk_core *core) return core->prepare_count; =20 if (!clk_pm_runtime_get(core)) { - if (core->flags & CLK_OPS_PARENT_ENABLE) - clk_core_prepare_enable(core->parent); ret =3D core->ops->is_prepared(core->hw); - if (core->flags & CLK_OPS_PARENT_ENABLE) - clk_core_disable_unprepare(core->parent); clk_pm_runtime_put(core); } =20 @@ -251,13 +244,7 @@ static bool clk_core_is_enabled(struct clk_core *core) } } =20 - if (core->flags & CLK_OPS_PARENT_ENABLE) - clk_core_prepare_enable(core->parent); - ret =3D core->ops->is_enabled(core->hw); - - if (core->flags & CLK_OPS_PARENT_ENABLE) - clk_core_disable_unprepare(core->parent); done: if (core->dev) pm_runtime_put(core->dev); @@ -717,9 +704,6 @@ int clk_rate_exclusive_get(struct clk *clk) } EXPORT_SYMBOL_GPL(clk_rate_exclusive_get); =20 -static int clk_core_enable_lock(struct clk_core *core); -static void clk_core_disable_lock(struct clk_core *core); - static void clk_core_unprepare(struct clk_core *core) { lockdep_assert_held(&prepare_lock); @@ -743,9 +727,6 @@ static void clk_core_unprepare(struct clk_core *core) =20 WARN(core->enable_count > 0, "Unpreparing enabled %s\n", core->name); =20 - if (core->flags & CLK_OPS_PARENT_ENABLE) - clk_core_enable_lock(core->parent); - trace_clk_unprepare(core); =20 if (core->ops->unprepare) @@ -754,9 +735,6 @@ static void clk_core_unprepare(struct clk_core *core) clk_pm_runtime_put(core); =20 trace_clk_unprepare_complete(core); - - if (core->flags & CLK_OPS_PARENT_ENABLE) - clk_core_disable_lock(core->parent); clk_core_unprepare(core->parent); } =20 @@ -805,9 +783,6 @@ static int clk_core_prepare(struct clk_core *core) if (ret) goto runtime_put; =20 - if (core->flags & CLK_OPS_PARENT_ENABLE) - clk_core_enable_lock(core->parent); - trace_clk_prepare(core); =20 if (core->ops->prepare) @@ -815,9 +790,6 @@ static int clk_core_prepare(struct clk_core *core) =20 trace_clk_prepare_complete(core); =20 - if (core->flags & CLK_OPS_PARENT_ENABLE) - clk_core_disable_lock(core->parent); - if (ret) goto unprepare; } --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23C00C6FA82 for ; Tue, 13 Sep 2022 15:25:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236157AbiIMPY7 (ORCPT ); Tue, 13 Sep 2022 11:24:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57458 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235961AbiIMPW7 (ORCPT ); Tue, 13 Sep 2022 11:22:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3769F7C33A; Tue, 13 Sep 2022 07:37:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1CF44614DA; Tue, 13 Sep 2022 14:30:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2E94EC433C1; Tue, 13 Sep 2022 14:30:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079443; bh=tKxw0dJfvnSIpFKyNH3860YFtpR7E+jWI+k3mV1W6K4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Jja9b6hSoq2fHCept0+XW74cg+DO0yioyOqHalM0HU9WWKB89UJhy6o5aRV4q8yTI B9pePTFzINFs+NZdvHzthpkPNm7DWvB6WQgfXJGaYDtyzGo4TrGP/8V7mGaGwlFKoH YHqJnUQ7rngSnyTGXMV0q5VRJx0N6BqYDzlTYVAY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chen-Yu Tsai , "=?UTF-8?q?N=C3=ADcolas=20F . =20R . =20A . =20Prado?=" , Stephen Boyd , Sasha Levin Subject: [PATCH 4.19 28/79] clk: core: Fix runtime PM sequence in clk_core_unprepare() Date: Tue, 13 Sep 2022 16:06:46 +0200 Message-Id: <20220913140350.251932830@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Chen-Yu Tsai [ Upstream commit 4b592061f7b3971c70e8b72fc42aaead47c24701 ] In the original commit 9a34b45397e5 ("clk: Add support for runtime PM"), the commit message mentioned that pm_runtime_put_sync() would be done at the end of clk_core_unprepare(). This mirrors the operations in clk_core_prepare() in the opposite order. However, the actual code that was added wasn't in the order the commit message described. Move clk_pm_runtime_put() to the end of clk_core_unprepare() so that it is in the correct order. Fixes: 9a34b45397e5 ("clk: Add support for runtime PM") Signed-off-by: Chen-Yu Tsai Reviewed-by: N=C3=ADcolas F. R. A. Prado Link: https://lore.kernel.org/r/20220822081424.1310926-3-wenst@chromium.org Signed-off-by: Stephen Boyd Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/clk/clk.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c index 32606d1094fe4..53ac3a0e741d7 100644 --- a/drivers/clk/clk.c +++ b/drivers/clk/clk.c @@ -732,10 +732,9 @@ static void clk_core_unprepare(struct clk_core *core) if (core->ops->unprepare) core->ops->unprepare(core->hw); =20 - clk_pm_runtime_put(core); - trace_clk_unprepare_complete(core); clk_core_unprepare(core->parent); + clk_pm_runtime_put(core); } =20 static void clk_core_unprepare_lock(struct clk_core *core) --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8D208C6FA82 for ; Tue, 13 Sep 2022 15:19:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235903AbiIMPTx (ORCPT ); Tue, 13 Sep 2022 11:19:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39526 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235884AbiIMPSM (ORCPT ); Tue, 13 Sep 2022 11:18:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4BF80642D8; Tue, 13 Sep 2022 07:35:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1125E614D0; Tue, 13 Sep 2022 14:32:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3128FC433D6; Tue, 13 Sep 2022 14:32:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079561; bh=XXC+a3xq5qAP/usGFnXD3rfC/OQss3BaSL/hh1UlkMY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jTmw7hojEnEuCGUYz8tYGEwWefBmR7pPywRe75R1mp9DFEZI75rHj138yiFu6i4Aq i+avYeuQSSt8aF0AzB51v0mpvsybN8gECReR5eWxZpen/I32RfkstnMfD4Um0+kJgv i8dyMDeBQAAQNbBCgmKJmE3614d4Uhfzk33hUgNM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peter Robinson , Javier Martinez Canillas , Dmitry Torokhov , Sasha Levin Subject: [PATCH 4.19 29/79] Input: rk805-pwrkey - fix module autoloading Date: Tue, 13 Sep 2022 16:06:47 +0200 Message-Id: <20220913140350.294948164@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peter Robinson [ Upstream commit 99077ad668ddd9b4823cc8ce3f3c7a3fc56f6fd9 ] Add the module alias so the rk805-pwrkey driver will autoload when built as a module. Fixes: 5a35b85c2d92 ("Input: add power key driver for Rockchip RK805 PMIC") Signed-off-by: Peter Robinson Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20220612225437.3628788-1-pbrobinson@gmail.c= om Signed-off-by: Dmitry Torokhov Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/input/misc/rk805-pwrkey.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/input/misc/rk805-pwrkey.c b/drivers/input/misc/rk805-p= wrkey.c index 921003963a53c..cdcad5c01e3c0 100644 --- a/drivers/input/misc/rk805-pwrkey.c +++ b/drivers/input/misc/rk805-pwrkey.c @@ -106,6 +106,7 @@ static struct platform_driver rk805_pwrkey_driver =3D { }; module_platform_driver(rk805_pwrkey_driver); =20 +MODULE_ALIAS("platform:rk805-pwrkey"); MODULE_AUTHOR("Joseph Chen "); MODULE_DESCRIPTION("RK805 PMIC Power Key driver"); MODULE_LICENSE("GPL"); --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7123CC54EE9 for ; Tue, 13 Sep 2022 15:37:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236644AbiIMPhq (ORCPT ); Tue, 13 Sep 2022 11:37:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46380 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236545AbiIMPhU (ORCPT ); Tue, 13 Sep 2022 11:37:20 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9DB4F80033; Tue, 13 Sep 2022 07:43:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 24F3361494; Tue, 13 Sep 2022 14:31:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3EFA9C433C1; Tue, 13 Sep 2022 14:31:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079466; bh=uNSfD+YJSHbwEa+qX173I2UYx9SbLW3ewT0J92EAxuE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d9UyOyLmD6S+iIX4l39b1GtgqVWtcbNQUrRay+pAWyP2NRDrCpXIYEXQB/UiOePaj X4hw96eIQLMRZCwpJ77FJL8VYniiZPgLsFojzFTgYX7wsKe1xiXOQC39+frtFtvdTx JtjILM/HmwIZtXIUoufT3PLpAm6HFczYBmVN4u+I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Armin Wolf , Guenter Roeck , Sasha Levin Subject: [PATCH 4.19 30/79] hwmon: (gpio-fan) Fix array out of bounds access Date: Tue, 13 Sep 2022 16:06:48 +0200 Message-Id: <20220913140350.348204695@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Armin Wolf [ Upstream commit f233d2be38dbbb22299192292983037f01ab363c ] The driver does not check if the cooling state passed to gpio_fan_set_cur_state() exceeds the maximum cooling state as stored in fan_data->num_speeds. Since the cooling state is later used as an array index in set_fan_speed(), an array out of bounds access can occur. This can be exploited by setting the state of the thermal cooling device to arbitrary values, causing for example a kernel oops when unavailable memory is accessed this way. Example kernel oops: [ 807.987276] Unable to handle kernel paging request at virtual address ff= ffff80d0588064 [ 807.987369] Mem abort info: [ 807.987398] ESR =3D 0x96000005 [ 807.987428] EC =3D 0x25: DABT (current EL), IL =3D 32 bits [ 807.987477] SET =3D 0, FnV =3D 0 [ 807.987507] EA =3D 0, S1PTW =3D 0 [ 807.987536] FSC =3D 0x05: level 1 translation fault [ 807.987570] Data abort info: [ 807.987763] ISV =3D 0, ISS =3D 0x00000005 [ 807.987801] CM =3D 0, WnR =3D 0 [ 807.987832] swapper pgtable: 4k pages, 39-bit VAs, pgdp=3D00000000011650= 00 [ 807.987872] [ffffff80d0588064] pgd=3D0000000000000000, p4d=3D00000000000= 00000, pud=3D0000000000000000 [ 807.987961] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 807.987992] Modules linked in: cmac algif_hash aes_arm64 algif_skcipher = af_alg bnep hci_uart btbcm bluetooth ecdh_generic ecc 8021q garp stp llc sn= d_soc_hdmi_codec brcmfmac vc4 brcmutil cec drm_kms_helper snd_soc_core cfg8= 0211 snd_compress bcm2835_codec(C) snd_pcm_dmaengine syscopyarea bcm2835_is= p(C) bcm2835_v4l2(C) sysfillrect v4l2_mem2mem bcm2835_mmal_vchiq(C) raspber= rypi_hwmon sysimgblt videobuf2_dma_contig videobuf2_vmalloc fb_sys_fops vid= eobuf2_memops rfkill videobuf2_v4l2 videobuf2_common i2c_bcm2835 snd_bcm283= 5(C) videodev snd_pcm snd_timer snd mc vc_sm_cma(C) gpio_fan uio_pdrv_genir= q uio drm fuse drm_panel_orientation_quirks backlight ip_tables x_tables ip= v6 [ 807.988508] CPU: 0 PID: 1321 Comm: bash Tainted: G C 5.15= .56-v8+ #1575 [ 807.988548] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) [ 807.988574] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE= =3D--) [ 807.988608] pc : set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.988654] lr : gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.988691] sp : ffffffc008cf3bd0 [ 807.988710] x29: ffffffc008cf3bd0 x28: ffffff80019edac0 x27: 00000000000= 00000 [ 807.988762] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff80074= 7c920 [ 807.988787] x23: 000000000000000a x22: ffffff800369f000 x21: 00000000199= 9997c [ 807.988854] x20: ffffff800369f2e8 x19: ffffff8002ae8080 x18: 00000000000= 00000 [ 807.988877] x17: 0000000000000000 x16: 0000000000000000 x15: 000000559e2= 71b70 [ 807.988938] x14: 0000000000000000 x13: 0000000000000000 x12: 00000000000= 00000 [ 807.988960] x11: 0000000000000000 x10: ffffffc008cf3c20 x9 : ffffffcfb60= c741c [ 807.989018] x8 : 000000000000000a x7 : 00000000ffffffc9 x6 : 00000000000= 00009 [ 807.989040] x5 : 000000000000002a x4 : 0000000000000000 x3 : ffffff80036= 9f2e8 [ 807.989062] x2 : 000000000000e780 x1 : 0000000000000001 x0 : ffffff80d05= 88060 [ 807.989084] Call trace: [ 807.989091] set_fan_speed.part.5+0x34/0x80 [gpio_fan] [ 807.989113] gpio_fan_set_cur_state+0x34/0x50 [gpio_fan] [ 807.989199] cur_state_store+0x84/0xd0 [ 807.989221] dev_attr_store+0x20/0x38 [ 807.989262] sysfs_kf_write+0x4c/0x60 [ 807.989282] kernfs_fop_write_iter+0x130/0x1c0 [ 807.989298] new_sync_write+0x10c/0x190 [ 807.989315] vfs_write+0x254/0x378 [ 807.989362] ksys_write+0x70/0xf8 [ 807.989379] __arm64_sys_write+0x24/0x30 [ 807.989424] invoke_syscall+0x4c/0x110 [ 807.989442] el0_svc_common.constprop.3+0xfc/0x120 [ 807.989458] do_el0_svc+0x2c/0x90 [ 807.989473] el0_svc+0x24/0x60 [ 807.989544] el0t_64_sync_handler+0x90/0xb8 [ 807.989558] el0t_64_sync+0x1a0/0x1a4 [ 807.989579] Code: b9403801 f9402800 7100003f 8b35cc00 (b9400416) [ 807.989627] ---[ end trace 8ded4c918658445b ]--- Fix this by checking the cooling state and return an error if it exceeds the maximum cooling state. Tested on a Raspberry Pi 3. Fixes: b5cf88e46bad ("(gpio-fan): Add thermal control hooks") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20220830011101.178843-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/hwmon/gpio-fan.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c index a3974cddef079..534a175a6e4cf 100644 --- a/drivers/hwmon/gpio-fan.c +++ b/drivers/hwmon/gpio-fan.c @@ -404,6 +404,9 @@ static int gpio_fan_set_cur_state(struct thermal_coolin= g_device *cdev, if (!fan_data) return -EINVAL; =20 + if (state >=3D fan_data->num_speed) + return -EINVAL; + set_fan_speed(fan_data, state); return 0; } --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1780CC54EE9 for ; Tue, 13 Sep 2022 15:41:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236596AbiIMPle (ORCPT ); Tue, 13 Sep 2022 11:41:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51184 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236697AbiIMPkl (ORCPT ); Tue, 13 Sep 2022 11:40:41 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 333828284E; Tue, 13 Sep 2022 07:45:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 18E84614ED; Tue, 13 Sep 2022 14:31:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2CBDAC433D6; Tue, 13 Sep 2022 14:31:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079494; bh=fI2yfiNqV2oq5W4XyxDiisIz2YmEE/wdZyR8M0aqJwU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yynort38fYMPA+dACnaHN5HNwUsVEj8WO4hmYKQbUcAM5oU+h1Jtp6j7fI+UzyNNH qb16XpxXCazG0AOJTTfw0DGDYhiLf3iREuyQncdw99F+i8xsXBzgMUvrswkyaByyDz RAJXzZyvmO0qSZKBgP8Ct5eD/2Kq138Ydr30Z5iI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mika Westerberg Subject: [PATCH 4.19 31/79] thunderbolt: Use the actual buffer in tb_async_error() Date: Tue, 13 Sep 2022 16:06:49 +0200 Message-Id: <20220913140350.401482524@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mika Westerberg commit eb100b8fa8e8b59eb3e5fc7a5fd4a1e3c5950f64 upstream. The received notification packet is held in pkg->buffer and not in pkg itself. Fix this by using the correct buffer. Fixes: 81a54b5e1986 ("thunderbolt: Let the connection manager handle all no= tifications") Cc: stable@vger.kernel.org Signed-off-by: Mika Westerberg Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/thunderbolt/ctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/thunderbolt/ctl.c +++ b/drivers/thunderbolt/ctl.c @@ -387,7 +387,7 @@ static void tb_ctl_rx_submit(struct ctl_ =20 static int tb_async_error(const struct ctl_pkg *pkg) { - const struct cfg_error_pkg *error =3D (const struct cfg_error_pkg *)pkg; + const struct cfg_error_pkg *error =3D pkg->buffer; =20 if (pkg->frame.eof !=3D TB_CFG_PKG_ERROR) return false; From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B7A6C54EE9 for ; Tue, 13 Sep 2022 15:17:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235725AbiIMPRl (ORCPT ); Tue, 13 Sep 2022 11:17:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57234 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235705AbiIMPQn (ORCPT ); Tue, 13 Sep 2022 11:16:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C145D1A3BB; Tue, 13 Sep 2022 07:34:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 71D8B614E5; Tue, 13 Sep 2022 14:32:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 864ADC433B5; Tue, 13 Sep 2022 14:32:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079543; bh=CuFPnUVGuG9hBco8DptOgD2OQllpbhmCOy7iqqU/xjU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mg86VHa4PMxj1/YBxuMCtp7KY4ooDJoyrdvU6sm7So1XmMgZqkDbNZdLr3O7vWbPP PgKc2xJ58Fj9FNxuGDj5yz7wDA4TUAlyEjS5HcJ0caEFIwld+yTSwUpg9PZWI7SVaL 2PQVWmFzmxuP1cXZTfZtGl74bwck3p79tXgtwQ24= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mathias Nyman Subject: [PATCH 4.19 32/79] xhci: Add grace period after xHC start to prevent premature runtime suspend. Date: Tue, 13 Sep 2022 16:06:50 +0200 Message-Id: <20220913140350.455005240@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mathias Nyman commit 33e321586e37b642ad10594b9ef25a613555cd08 upstream. After xHC controller is started, either in probe or resume, it can take a while before any of the connected usb devices are visible to the roothub due to link training. It's possible xhci driver loads, sees no acivity and suspends the host before the USB device is visible. In one testcase with a hotplugged xHC controller the host finally detected the connected USB device and generated a wake 500ms after host initial start. If hosts didn't suspend the device duringe training it probablty wouldn't take up to 500ms to detect it, but looking at specs reveal USB3 link training has a couple long timeout values, such as 120ms RxDetectQuietTimeout, and 360ms PollingLFPSTimeout. So Add a 500ms grace period that keeps polling the roothub for 500ms after start, preventing runtime suspend until USB devices are detected. Cc: stable@vger.kernel.org Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220825150840.132216-3-mathias.nyman@linux= .intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/host/xhci-hub.c | 11 +++++++++++ drivers/usb/host/xhci.c | 4 +++- drivers/usb/host/xhci.h | 2 +- 3 files changed, 15 insertions(+), 2 deletions(-) --- a/drivers/usb/host/xhci-hub.c +++ b/drivers/usb/host/xhci-hub.c @@ -1464,6 +1464,17 @@ int xhci_hub_status_data(struct usb_hcd =20 status =3D bus_state->resuming_ports; =20 + /* + * SS devices are only visible to roothub after link training completes. + * Keep polling roothubs for a grace period after xHC start + */ + if (xhci->run_graceperiod) { + if (time_before(jiffies, xhci->run_graceperiod)) + status =3D 1; + else + xhci->run_graceperiod =3D 0; + } + mask =3D PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC; =20 /* For each port, did anything change? If so, set that bit in buf. */ --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -149,9 +149,11 @@ int xhci_start(struct xhci_hcd *xhci) xhci_err(xhci, "Host took too long to start, " "waited %u microseconds.\n", XHCI_MAX_HALT_USEC); - if (!ret) + if (!ret) { /* clear state flags. Including dying, halted or removing */ xhci->xhc_state =3D 0; + xhci->run_graceperiod =3D jiffies + msecs_to_jiffies(500); + } =20 return ret; } --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -1811,7 +1811,7 @@ struct xhci_hcd { =20 /* Host controller watchdog timer structures */ unsigned int xhc_state; - + unsigned long run_graceperiod; u32 command; struct s3_save s3; /* Host controller is dying - not responding to commands. "I'm not dead ye= t!" From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A669C54EE9 for ; Tue, 13 Sep 2022 15:16:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235748AbiIMPQD (ORCPT ); Tue, 13 Sep 2022 11:16:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50154 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235697AbiIMPNd (ORCPT ); Tue, 13 Sep 2022 11:13:33 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E042B78238; Tue, 13 Sep 2022 07:33:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4ED5D614D9; Tue, 13 Sep 2022 14:32:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5CB85C433C1; Tue, 13 Sep 2022 14:32:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079546; bh=eCwaN/21W5acu4yeA53pjjrhreev07+tX5OCyrtfXOM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XvrnHWgsqD+YJJGN+CE1nsaz2VA+j+CXkr1nCDVHssjeGm6imlpXRpiju4zBCjHD3 fF6FbYALD8jQNXA2Dg1bd9U5PYRfA80gKGhtb9M7jYdQcHsecLf+tWr8GsZvCP2lzR D6/AGnCvzDT8n+XdaAHPMy0drpb6D49u3+susOZU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold Subject: [PATCH 4.19 33/79] USB: serial: cp210x: add Decagon UCA device id Date: Tue, 13 Sep 2022 16:06:51 +0200 Message-Id: <20220913140350.508008181@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit ceb4038472a4803e7046ed488b03d11551991514 upstream. Add the device id for Decagon Devices USB Cable Adapter. Link: https://lore.kernel.org/r/trinity-819f9db2-d3e1-40e9-a669-9c245817c04= 6-1661523546680@msvc-mesg-web108 Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/serial/cp210x.c +++ b/drivers/usb/serial/cp210x.c @@ -131,6 +131,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */ { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenu= ator */ { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */ + { USB_DEVICE(0x10C4, 0x8414) }, /* Decagon USB Cable Adapter */ { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS= Modem */ { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */ { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Cons= ole */ From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 061DFC6FA82 for ; Tue, 13 Sep 2022 15:13:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233390AbiIMPNP (ORCPT ); Tue, 13 Sep 2022 11:13:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42382 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231210AbiIMPLV (ORCPT ); Tue, 13 Sep 2022 11:11:21 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 71BF078580; Tue, 13 Sep 2022 07:32:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5983CB80ECE; Tue, 13 Sep 2022 14:32:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C7D5FC433D6; Tue, 13 Sep 2022 14:32:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079549; bh=qOPfv6rN3G08Au0xWngt92uuyIDREJjHLEVh3jzqV5I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tUPt5L2k8dhCn8a2xUEJHhdeaNek9IZRmKNvtc8AILhxRBVqyFcjJGJkJTTqNfnuD OK8lWRZJjNq42ue9zBM+I46rB+ifV7PadJ5s9PM76aaw0cGhnnyv6t1I9FZfBdE+Fl wo9Y+ecFpleHxn9ccVFAhvLQdp7L7SaFj3nnxOyU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yan Xinyu , Johan Hovold Subject: [PATCH 4.19 34/79] USB: serial: option: add support for OPPO R11 diag port Date: Tue, 13 Sep 2022 16:06:52 +0200 Message-Id: <20220913140350.554841999@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yan Xinyu commit 8d5fc280392735e4441b35de14f2f4860fa8d83c upstream. Add support for OPPO R11 USB diag serial port to option driver. This phone uses Qualcomm Snapdragon 660 SoC. usb-devices output: T: Bus=3D03 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 10 Spd=3D480 MxC= h=3D 0 D: Ver=3D 2.00 Cls=3D00(>ifc ) Sub=3D00 Prot=3D00 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D22d9 ProdID=3D276c Rev=3D04.04 S: Manufacturer=3DOPPO S: Product=3DSDM660-MTP _SN:09C6BCA7 S: SerialNumber=3Dbeb2c403 C: #Ifs=3D 2 Cfg#=3D 1 Atr=3D80 MxPwr=3D500mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption I: If#=3D0x1 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3D42 Prot=3D01 Driver= =3Dusbfs Signed-off-by: Yan Xinyu Link: https://lore.kernel.org/r/20220714102037.4113889-1-sdlyyxy@bupt.edu.cn Link: https://lore.kernel.org/r/Yt1WfSZk03Plpnan@hovoldconsulting.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/serial/option.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -573,6 +573,10 @@ static void option_instat_callback(struc #define WETELECOM_PRODUCT_6802 0x6802 #define WETELECOM_PRODUCT_WMD300 0x6803 =20 +/* OPPO products */ +#define OPPO_VENDOR_ID 0x22d9 +#define OPPO_PRODUCT_R11 0x276c + =20 /* Device flags */ =20 @@ -2155,6 +2159,7 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 = RNDIS */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 = MBIM */ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 = ECM/NCM */ + { USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0= xff, 0x30) }, { } /* Terminating entry */ }; MODULE_DEVICE_TABLE(usb, option_ids); From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1147EC6FA82 for ; Tue, 13 Sep 2022 15:51:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234348AbiIMPvF (ORCPT ); Tue, 13 Sep 2022 11:51:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57916 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233578AbiIMPum (ORCPT ); Tue, 13 Sep 2022 11:50:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D5AFC8A1FD; Tue, 13 Sep 2022 07:52:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DBD6FB80EB7; Tue, 13 Sep 2022 14:32:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 532E9C433D6; Tue, 13 Sep 2022 14:32:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079551; bh=8x86kb3UCsPU4xUj131z4xdrX7ebEKME9z7ELKz3Ox4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rI+Du0Kis3koGJI7e4DV/2i5NFiy+BloHpXRmsGDPz3MpAlERcxZKVloClwS358MF bTdrGyxn0sHM3Q/MPjdV+225/2Ns4ZSuDirb5LO+zXUn7iwN94IrFtheaJoYG50FaI O3IcHBTsEw+SMAyLEYuvLt2oW45AYtCFC78UFUjA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yonglin Tan , Johan Hovold Subject: [PATCH 4.19 35/79] USB: serial: option: add Quectel EM060K modem Date: Tue, 13 Sep 2022 16:06:53 +0200 Message-Id: <20220913140350.599157629@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yonglin Tan commit f766f3abe6dbc9bf8b56a5d53c87e5a17942c154 upstream. Add usb product id entry for the Quectel EM060K module. "MBIM mode": DIAG + NMEA + AT + MODEM + MBIM + QDSS T: Bus=3D01 Lev=3D01 Prnt=3D01 Port=3D00 Cnt=3D01 Dev#=3D 8 Spd=3D480 Mx= Ch=3D 0 D: Ver=3D 2.00 Cls=3D00(>ifc ) Sub=3D00 Prot=3D00 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D2c7c ProdID=3D030b Rev=3D 5.04 S: Manufacturer=3DQuectel S: Product=3DEM060K-GL S: SerialNumber=3D89fb57db C:* #Ifs=3D 7 Cfg#=3D 1 Atr=3Da0 MxPwr=3D500mA A: FirstIf#=3D 8 IfCount=3D 2 Cls=3D02(comm.) Sub=3D0e Prot=3D00 I:* If#=3D 0 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption E: Ad=3D01(O) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms E: Ad=3D81(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms I:* If#=3D 1 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D40 Driver= =3Doption E: Ad=3D83(I) Atr=3D03(Int.) MxPS=3D 10 Ivl=3D32ms E: Ad=3D82(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms E: Ad=3D02(O) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms I:* If#=3D 2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption E: Ad=3D85(I) Atr=3D03(Int.) MxPS=3D 10 Ivl=3D32ms E: Ad=3D84(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms E: Ad=3D03(O) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms I:* If#=3D 3 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption E: Ad=3D87(I) Atr=3D03(Int.) MxPS=3D 10 Ivl=3D32ms E: Ad=3D86(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms E: Ad=3D04(O) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms I:* If#=3D 8 Alt=3D 0 #EPs=3D 1 Cls=3D02(comm.) Sub=3D0e Prot=3D00 Driver= =3Dcdc_mbim E: Ad=3D88(I) Atr=3D03(Int.) MxPS=3D 64 Ivl=3D32ms I: If#=3D 9 Alt=3D 0 #EPs=3D 0 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim I:* If#=3D 9 Alt=3D 1 #EPs=3D 2 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim E: Ad=3D8e(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms E: Ad=3D0f(O) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms I:* If#=3D12 Alt=3D 0 #EPs=3D 1 Cls=3Dff(vend.) Sub=3Dff Prot=3D70 Driver= =3D(none) E: Ad=3D89(I) Atr=3D02(Bulk) MxPS=3D 512 Ivl=3D0ms Signed-off-by: Yonglin Tan [ johan: mention QDSS port and sort entries ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -253,6 +253,7 @@ static void option_instat_callback(struc #define QUECTEL_PRODUCT_BG96 0x0296 #define QUECTEL_PRODUCT_EP06 0x0306 #define QUECTEL_PRODUCT_EM05G 0x030a +#define QUECTEL_PRODUCT_EM060K 0x030b #define QUECTEL_PRODUCT_EM12 0x0512 #define QUECTEL_PRODUCT_RM500Q 0x0800 #define QUECTEL_PRODUCT_EC200S_CN 0x6002 @@ -1142,6 +1143,9 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, = 0xff, 0, 0) }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0x= ff), .driver_info =3D RSVD(6) | ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K= , 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K= , 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K= , 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, = 0xff, 0xff, 0xff), .driver_info =3D RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, = 0xff, 0, 0) }, From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40059C6FA82 for ; Tue, 13 Sep 2022 15:16:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235716AbiIMPQq (ORCPT ); Tue, 13 Sep 2022 11:16:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50450 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235853AbiIMPOA (ORCPT ); Tue, 13 Sep 2022 11:14:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 46C14786F5; Tue, 13 Sep 2022 07:33:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 92834614A8; Tue, 13 Sep 2022 14:32:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AEED3C433C1; Tue, 13 Sep 2022 14:32:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079554; bh=P5KZ4SEKenppi05pZNL2xcmJ5xEzMJ2gickfOv9JeA8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dJksnpUiCizS3zQZ00qjdBUcEHQYtbkhDh/UezrFi+9+3b+IzKc5YZfhfc7I3B1zJ 4LcrdIQm3QCFil6oWQ3AZ0YPV/hhRCbrWIUkLdxtqRVTjLNNnrwUTaSgtUhc90LXx3 824z/d0g8xDbPxU4O4fyU8SGeSocYk5wAD3GX2Yo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Slark Xiao , Johan Hovold Subject: [PATCH 4.19 36/79] USB: serial: option: add support for Cinterion MV32-WA/WB RmNet mode Date: Tue, 13 Sep 2022 16:06:54 +0200 Message-Id: <20220913140350.650422492@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Slark Xiao commit 8ffe20d08f2c95d702c453020d03a4c568a988f0 upstream. We added PIDs for MV32-WA/WB MBIM mode before, now we need to add support for RmNet mode. Test evidence as below: T: Bus=3D03 Lev=3D01 Prnt=3D01 Port=3D02 Cnt=3D03 Dev#=3D 3 Spd=3D480 MxC= h=3D 0 D: Ver=3D 2.10 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f3 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F3 USB Mobile Broadband S: SerialNumber=3Dd7b4be8d C: #Ifs=3D 4 Cfg#=3D 1 Atr=3Da0 MxPwr=3D500mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D50 Driver= =3Dqmi_wwan I: If#=3D0x1 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption T: Bus=3D03 Lev=3D01 Prnt=3D01 Port=3D02 Cnt=3D03 Dev#=3D 10 Spd=3D480 MxC= h=3D 0 D: Ver=3D 2.10 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D64 #Cfgs=3D 1 P: Vendor=3D1e2d ProdID=3D00f4 Rev=3D05.04 S: Manufacturer=3DCinterion S: Product=3DCinterion PID 0x00F4 USB Mobile Broadband S: SerialNumber=3Dd095087d C: #Ifs=3D 4 Cfg#=3D 1 Atr=3Da0 MxPwr=3D500mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D50 Driver= =3Dqmi_wwan I: If#=3D0x1 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3D40 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3D30 Driver= =3Doption Signed-off-by: Slark Xiao [ johan: sort entries ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -439,6 +439,8 @@ static void option_instat_callback(struc #define CINTERION_PRODUCT_MV31_2_RMNET 0x00b9 #define CINTERION_PRODUCT_MV32_WA 0x00f1 #define CINTERION_PRODUCT_MV32_WB 0x00f2 +#define CINTERION_PRODUCT_MV32_WA_RMNET 0x00f3 +#define CINTERION_PRODUCT_MV32_WB_RMNET 0x00f4 =20 /* Olivetti products */ #define OLIVETTI_VENDOR_ID 0x0b3c @@ -2001,8 +2003,12 @@ static const struct usb_device_id option .driver_info =3D RSVD(0)}, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WA, 0xff), .driver_info =3D RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WA_RMNET, 0xff), + .driver_info =3D RSVD(0) }, { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WB, 0xff), .driver_info =3D RSVD(3)}, + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_MV32_= WB_RMNET, 0xff), + .driver_info =3D RSVD(0) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100), .driver_info =3D RSVD(4) }, { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120), From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 68DE6C54EE9 for ; Tue, 13 Sep 2022 15:16:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233412AbiIMPQH (ORCPT ); Tue, 13 Sep 2022 11:16:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50104 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235692AbiIMPNc (ORCPT ); Tue, 13 Sep 2022 11:13:32 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BD649786F9; Tue, 13 Sep 2022 07:33:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1852A614D6; Tue, 13 Sep 2022 14:32:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 30053C433D6; Tue, 13 Sep 2022 14:32:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079556; bh=ywg4X3ww0hbVDWBYpXvULTqy1piXGikF37PiF8yD7tc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HM3Ird5/PL17B3781Fb2abu1ZXHS2G15GvY6Aw1qUm9guwpsFhVsZhXxJKihhfhTG pPAZh0wRYjPViN937gxRDD9nsCDt25YYbNEXfzb+xxauHtMjl/K4IRCKk3C18D8Y4M pveRenHi7QHfSy9RmxrNTKEIdZuVeLPtv5qnWEkU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guillaume Ranquet , Heikki Krogerus , Pablo Sun , Macpaul Lin Subject: [PATCH 4.19 37/79] usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles Date: Tue, 13 Sep 2022 16:06:55 +0200 Message-Id: <20220913140350.703108730@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pablo Sun commit c1e5c2f0cb8a22ec2e14af92afc7006491bebabb upstream. Fix incorrect pin assignment values when connecting to a monitor with Type-C receptacle instead of a plug. According to specification, an UFP_D receptacle's pin assignment should came from the UFP_D pin assignments field (bit 23:16), while an UFP_D plug's assignments are described in the DFP_D pin assignments (bit 15:8) during Mode Discovery. For example the LG 27 UL850-W is a monitor with Type-C receptacle. The monitor responds to MODE DISCOVERY command with following DisplayPort Capability flag: dp->alt->vdo=3D0x140045 The existing logic only take cares of UPF_D plug case, and would take the bit 15:8 for this 0x140045 case. This results in an non-existing pin assignment 0x0 in dp_altmode_configure. To fix this problem a new set of macros are introduced to take plug/receptacle differences into consideration. Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode= ") Cc: stable@vger.kernel.org Co-developed-by: Pablo Sun Co-developed-by: Macpaul Lin Reviewed-by: Guillaume Ranquet Reviewed-by: Heikki Krogerus Signed-off-by: Pablo Sun Signed-off-by: Macpaul Lin Link: https://lore.kernel.org/r/20220804034803.19486-1-macpaul.lin@mediatek= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/typec/altmodes/displayport.c | 4 ++-- include/linux/usb/typec_dp.h | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) --- a/drivers/usb/typec/altmodes/displayport.c +++ b/drivers/usb/typec/altmodes/displayport.c @@ -91,8 +91,8 @@ static int dp_altmode_configure(struct d case DP_STATUS_CON_UFP_D: case DP_STATUS_CON_BOTH: /* NOTE: First acting as DP source */ conf |=3D DP_CONF_UFP_U_AS_UFP_D; - pin_assign =3D DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo) & - DP_CAP_UFP_D_PIN_ASSIGN(dp->port->vdo); + pin_assign =3D DP_CAP_PIN_ASSIGN_UFP_D(dp->alt->vdo) & + DP_CAP_PIN_ASSIGN_DFP_D(dp->port->vdo); break; default: break; --- a/include/linux/usb/typec_dp.h +++ b/include/linux/usb/typec_dp.h @@ -68,6 +68,11 @@ enum { #define DP_CAP_USB BIT(7) #define DP_CAP_DFP_D_PIN_ASSIGN(_cap_) (((_cap_) & GENMASK(15, 8)) >> 8) #define DP_CAP_UFP_D_PIN_ASSIGN(_cap_) (((_cap_) & GENMASK(23, 16)) >> 16) +/* Get pin assignment taking plug & receptacle into consideration */ +#define DP_CAP_PIN_ASSIGN_UFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \ + DP_CAP_UFP_D_PIN_ASSIGN(_cap_) : DP_CAP_DFP_D_PIN_ASSIGN(_cap_)) +#define DP_CAP_PIN_ASSIGN_DFP_D(_cap_) ((_cap_ & DP_CAP_RECEPTACLE) ? \ + DP_CAP_DFP_D_PIN_ASSIGN(_cap_) : DP_CAP_UFP_D_PIN_ASSIGN(_cap_)) =20 /* DisplayPort Status Update VDO bits */ #define DP_STATUS_CONNECTION(_status_) ((_status_) & 3) From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5BE34C6FA82 for ; Tue, 13 Sep 2022 15:34:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234097AbiIMPeq (ORCPT ); Tue, 13 Sep 2022 11:34:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45792 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236565AbiIMPck (ORCPT ); Tue, 13 Sep 2022 11:32:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 91D357F119; Tue, 13 Sep 2022 07:40:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2F75FB80EF8; Tue, 13 Sep 2022 14:32:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97E54C433D6; Tue, 13 Sep 2022 14:32:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079558; bh=5K8DzZTsQj7cIxa+vXjg400bLfv/wfBb5vcW/s+sH4A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DbcE7bWkR0PLVNWgToyZ20oNxRkHhfNUSW0xyAAP5Xu76AjXGbtwvGq7CigiZTvc2 nw5UUbaTfcVOxPHDyHoXvWZ9EtNC/p3opfUecuLEMQcNYUCFurkeycuPEo7mxWcCp4 SsCEJI0yGl6pFbjgWcySfSod1LoWNuJ1q8XjL230= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Minas Harutyunyan , Marek Szyprowski , Heiner Kallweit Subject: [PATCH 4.19 38/79] usb: dwc2: fix wrong order of phy_power_on and phy_init Date: Tue, 13 Sep 2022 16:06:56 +0200 Message-Id: <20220913140350.748903402@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Heiner Kallweit commit f9b995b49a07bd0d43b0e490f59be84415c745ae upstream. Since 1599069a62c6 ("phy: core: Warn when phy_power_on is called before phy_init") the driver complains. In my case (Amlogic SoC) the warning is: phy phy-fe03e000.phy.2: phy_power_on was called before phy_init So change the order of the two calls. The same change has to be done to the order of phy_exit() and phy_power_off(). Fixes: 09a75e857790 ("usb: dwc2: refactor common low-level hw code to platf= orm.c") Cc: stable@vger.kernel.org Acked-by: Minas Harutyunyan Acked-by: Marek Szyprowski Signed-off-by: Heiner Kallweit Link: https://lore.kernel.org/r/dfcc6b40-2274-4e86-e73c-5c5e6aa3e046@gmail.= com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/dwc2/platform.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/usb/dwc2/platform.c +++ b/drivers/usb/dwc2/platform.c @@ -142,9 +142,9 @@ static int __dwc2_lowlevel_hw_enable(str } else if (hsotg->plat && hsotg->plat->phy_init) { ret =3D hsotg->plat->phy_init(pdev, hsotg->plat->phy_type); } else { - ret =3D phy_power_on(hsotg->phy); + ret =3D phy_init(hsotg->phy); if (ret =3D=3D 0) - ret =3D phy_init(hsotg->phy); + ret =3D phy_power_on(hsotg->phy); } =20 return ret; @@ -176,9 +176,9 @@ static int __dwc2_lowlevel_hw_disable(st } else if (hsotg->plat && hsotg->plat->phy_exit) { ret =3D hsotg->plat->phy_exit(pdev, hsotg->plat->phy_type); } else { - ret =3D phy_exit(hsotg->phy); + ret =3D phy_power_off(hsotg->phy); if (ret =3D=3D 0) - ret =3D phy_power_off(hsotg->phy); + ret =3D phy_exit(hsotg->phy); } if (ret) return ret; From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 12055C54EE9 for ; Tue, 13 Sep 2022 15:09:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235439AbiIMPJ4 (ORCPT ); Tue, 13 Sep 2022 11:09:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36034 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235542AbiIMPIl (ORCPT ); Tue, 13 Sep 2022 11:08:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0EFC6760C2; Tue, 13 Sep 2022 07:31:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 45F7BB80F9E; Tue, 13 Sep 2022 14:31:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B7855C433C1; Tue, 13 Sep 2022 14:31:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079469; bh=w2kk4NEtj+ED2jZgG2s7kSx8JqH+LVEsFUnQoHNqwWY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q6Vt86ZKX/j2zQ43vkJwRC8IZCpZ2GANhFvw+C47iZ0mHw2R42OWuJDkJKVgtCO64 Mkwn1cyd6zuy/JySvHv6RYy318XxZcQTwFD0un6FX12D+DhkOAdBm3BWWOD8ZTMrXc ovnTpAkhm+3erx/JjfXhG1sRBuFt4l7cM89vtvy4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thierry GUIBERT , stable Subject: [PATCH 4.19 39/79] USB: cdc-acm: Add Icom PMR F3400 support (0c26:0020) Date: Tue, 13 Sep 2022 16:06:57 +0200 Message-Id: <20220913140350.794307293@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thierry GUIBERT commit a10bc71729b236fe36de0d8e4d35c959fd8dec3a upstream. Supports for ICOM F3400 and ICOM F4400 PMR radios in CDC-ACM driver enabling the AT serial port. The Vendor Id is 0x0C26 The Product ID is 0x0020 Output of lsusb : Bus 001 Device 009: ID 0c26:0020 Prolific Technology Inc. ICOM Radio Couldn't open device, some information will be missing Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 2 Communications bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x0c26 Prolific Technology Inc. idProduct 0x0020 bcdDevice 0.00 iManufacturer 1 ICOM Inc. iProduct 2 ICOM Radio iSerial 3 *obfuscated* bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 0x0030 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 0 bmAttributes 0xc0 Self Powered MaxPower 0mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 2 Communications bInterfaceSubClass 2 Abstract (modem) bInterfaceProtocol 1 AT-commands (v.25ter) iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 12 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 10 CDC Data bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Signed-off-by: Thierry GUIBERT Cc: stable Link: https://lore.kernel.org/r/20220819081702.84118-1-thierry.guibert@croi= x-rouge.fr Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/class/cdc-acm.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -1883,6 +1883,9 @@ static const struct usb_device_id acm_id { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */ .driver_info =3D NO_UNION_NORMAL, /* has misplaced union descriptor */ }, + { USB_DEVICE(0x0c26, 0x0020), /* Icom ICF3400 Serie */ + .driver_info =3D NO_UNION_NORMAL, /* reports zero length descriptor */ + }, { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */ .driver_info =3D NO_UNION_NORMAL, /* reports zero length descriptor */ }, From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1533FC54EE9 for ; Tue, 13 Sep 2022 15:16:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235758AbiIMPQL (ORCPT ); Tue, 13 Sep 2022 11:16:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51830 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235760AbiIMPNo (ORCPT ); Tue, 13 Sep 2022 11:13:44 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6AE8A78BC1; Tue, 13 Sep 2022 07:33:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0FB18614DD; Tue, 13 Sep 2022 14:31:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2973CC433D6; Tue, 13 Sep 2022 14:31:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079471; bh=0IlhPDcg+N1l9IGYJ4pYlrDwi/O4Kivf2evnYygpIEQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=V5V/ciNKGKWjWg0ZV9iZMoFFs5uetJh4iRTHFCORphlwQpA6Lm3OVSVRLP5BxPsNs Od/STPeO4MQtoR9ThKciHGiBgiAAxuMqjmqx8RuRnyX4/XDxFO06q3UanNSiyDOv3u /9yoUk/yiObWYuSYc0/Il/1x7vxEeV33Ldn7A7YE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , stable , Witold Lipieta Subject: [PATCH 4.19 40/79] usb-storage: Add ignore-residue quirk for NXP PN7462AU Date: Tue, 13 Sep 2022 16:06:58 +0200 Message-Id: <20220913140350.845038185@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Witold Lipieta commit 2aa48857ad52236a9564c71183d6cc8893becd41 upstream. This is USB mass storage primary boot loader for code download on NXP PN7462AU. Without the quirk it is impossible to write whole memory at once as device restarts during the write due to bogus residue values reported. Acked-by: Alan Stern Cc: stable Signed-off-by: Witold Lipieta Link: https://lore.kernel.org/r/20220809112911.462776-1-witold.lipieta@thau= matec.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/usb/storage/unusual_devs.h +++ b/drivers/usb/storage/unusual_devs.h @@ -2294,6 +2294,13 @@ UNUSUAL_DEV( 0x1e74, 0x4621, 0x0000, 0x0 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ), =20 +/* Reported by Witold Lipieta */ +UNUSUAL_DEV( 0x1fc9, 0x0117, 0x0100, 0x0100, + "NXP Semiconductors", + "PN7462AU", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_IGNORE_RESIDUE ), + /* Supplied with some Castlewood ORB removable drives */ UNUSUAL_DEV( 0x2027, 0xa001, 0x0000, 0x9999, "Double-H Technology", From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2D39FC6FA82 for ; Tue, 13 Sep 2022 15:15:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235686AbiIMPPK (ORCPT ); Tue, 13 Sep 2022 11:15:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50458 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232990AbiIMPMi (ORCPT ); Tue, 13 Sep 2022 11:12:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8912577E9E; Tue, 13 Sep 2022 07:32:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5D388B80F6F; Tue, 13 Sep 2022 14:31:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B4325C433C1; Tue, 13 Sep 2022 14:31:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079474; bh=wbhwPkgVfB0u/ecYJDpzWyQrjPmGXlonw19X6uHaZ7w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rgLM9NhKeX+VytBn9hvXyrS60sgEYWbM48/c68WFliCbtUHgSLILscCoJ4H4t5XII Gx/boem3nJB0rZwabTKTG+VU7KsOCgQtGfNAwKka8pLlxX+uMv4FHP5mIovCyclYv/ F1KNbBvrzIgEykfmEQc/REMi1lWl+wamWeyT2Z6I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Gordeev , Gerald Schaefer , Vasily Gorbik Subject: [PATCH 4.19 41/79] s390/hugetlb: fix prepare_hugepage_range() check for 2 GB hugepages Date: Tue, 13 Sep 2022 16:06:59 +0200 Message-Id: <20220913140350.893428702@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Gerald Schaefer commit 7c8d42fdf1a84b1a0dd60d6528309c8ec127e87c upstream. The alignment check in prepare_hugepage_range() is wrong for 2 GB hugepages, it only checks for 1 MB hugepage alignment. This can result in kernel crash in __unmap_hugepage_range() at the BUG_ON(start & ~huge_page_mask(h)) alignment check, for mappings created with MAP_FIXED at unaligned address. Fix this by correctly handling multiple hugepage sizes, similar to the generic version of prepare_hugepage_range(). Fixes: d08de8e2d867 ("s390/mm: add support for 2GB hugepages") Cc: # 4.8+ Acked-by: Alexander Gordeev Signed-off-by: Gerald Schaefer Signed-off-by: Vasily Gorbik Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- arch/s390/include/asm/hugetlb.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/arch/s390/include/asm/hugetlb.h +++ b/arch/s390/include/asm/hugetlb.h @@ -30,9 +30,11 @@ pte_t huge_ptep_get_and_clear(struct mm_ static inline int prepare_hugepage_range(struct file *file, unsigned long addr, unsigned long len) { - if (len & ~HPAGE_MASK) + struct hstate *h =3D hstate_file(file); + + if (len & ~huge_page_mask(h)) return -EINVAL; - if (addr & ~HPAGE_MASK) + if (addr & ~huge_page_mask(h)) return -EINVAL; return 0; } From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5464EC54EE9 for ; Tue, 13 Sep 2022 15:27:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236295AbiIMP1i (ORCPT ); Tue, 13 Sep 2022 11:27:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34030 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236282AbiIMPZt (ORCPT ); Tue, 13 Sep 2022 11:25:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1EEA37DF46; Tue, 13 Sep 2022 07:38:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2F3B2614D4; Tue, 13 Sep 2022 14:31:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 41FB8C433D6; Tue, 13 Sep 2022 14:31:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079476; bh=Sd0dpX/2W+jDhqDyoYomDpBo+orj3hzg0AEtI3Yg6fo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nhefyjd9nIlhtY09S2hpECXe683RUU4VgGX72lInkLl7cjd5JTTr+BDaikKHe26wG P+HyAVYEO9CWAxdl3X4M95LYfK8MuuH3BXHEntm16eOUMQ4CldpKaikmKQsGFn0HwH WiQDkB+WWSxDch64wZHhfbyyWJTi8oxg4WQiCae8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josh Poimboeuf , Heiko Carstens , Vasily Gorbik Subject: [PATCH 4.19 42/79] s390: fix nospec table alignments Date: Tue, 13 Sep 2022 16:07:00 +0200 Message-Id: <20220913140350.942768586@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Josh Poimboeuf commit c9305b6c1f52060377c72aebe3a701389e9f3172 upstream. Add proper alignment for .nospec_call_table and .nospec_return_table in vmlinux. [hca@linux.ibm.com]: The problem with the missing alignment of the nospec tables exist since a long time, however only since commit e6ed91fd0768 ("s390/alternatives: remove padding generation code") and with CONFIG_RELOCATABLE=3Dn the kernel may also crash at boot time. The above named commit reduced the size of struct alt_instr by one byte, so its new size is 11 bytes. Therefore depending on the number of cpu alternatives the size of the __alt_instructions array maybe odd, which again also causes that the addresses of the nospec tables will be odd. If the address of __nospec_call_start is odd and the kernel is compiled With CONFIG_RELOCATABLE=3Dn the compiler may generate code that loads the address of __nospec_call_start with a 'larl' instruction. This will generate incorrect code since the 'larl' instruction only works with even addresses. In result the members of the nospec tables will be accessed with an off-by-one offset, which subsequently may lead to addressing exceptions within __nospec_revert(). Fixes: f19fbd5ed642 ("s390: introduce execute-trampolines for branches") Signed-off-by: Josh Poimboeuf Link: https://lore.kernel.org/r/8719bf1ce4a72ebdeb575200290094e9ce047bcc.16= 61557333.git.jpoimboe@kernel.org Cc: # 4.16 Reviewed-by: Heiko Carstens Signed-off-by: Heiko Carstens Signed-off-by: Vasily Gorbik Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- arch/s390/kernel/vmlinux.lds.S | 1 + 1 file changed, 1 insertion(+) --- a/arch/s390/kernel/vmlinux.lds.S +++ b/arch/s390/kernel/vmlinux.lds.S @@ -121,6 +121,7 @@ SECTIONS /* * Table with the patch locations to undo expolines */ + . =3D ALIGN(4); .nospec_call_table : { __nospec_call_start =3D . ; *(.s390_indirect*) From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 306B2C54EE9 for ; Tue, 13 Sep 2022 15:14:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235623AbiIMPOi (ORCPT ); Tue, 13 Sep 2022 11:14:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49966 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235549AbiIMPMA (ORCPT ); Tue, 13 Sep 2022 11:12:00 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A4E121C11A; Tue, 13 Sep 2022 07:32:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5A1BAB80F88; Tue, 13 Sep 2022 14:31:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6B45C433C1; Tue, 13 Sep 2022 14:31:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079479; bh=8S5RKtHTTDPWGeVR4LZwgHPOe71w51OawdHeFyszY7g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jmx1E1gZsJvNht9SpYiHhZSK+qiit4AIOj51P0mRWlg9/lKDoaXjA4T7m/LBX9hiq BmxR4ofHawQkBCH+XWFyGjw8k3yCJJM4iKdksvmHU+3xceUXuDJ2Pl0PBRzXksxR4A dKOzi60UpaP4iOIShOOk7aMNV+g/QNNYuLMNgkk4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Rondreis Subject: [PATCH 4.19 43/79] USB: core: Prevent nested device-reset calls Date: Tue, 13 Sep 2022 16:07:01 +0200 Message-Id: <20220913140350.994589719@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 9c6d778800b921bde3bff3cff5003d1650f942d1 upstream. Automatic kernel fuzzing revealed a recursive locking violation in usb-storage: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D WARNING: possible recursive locking detected 5.18.0 #3 Not tainted Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee -------------------------------------------- kworker/1:3/1205 is trying to acquire lock: ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 but task is already holding lock: ffff888018638db8 (&us_interface_key[i]){+.+.}-{3:3}, at: usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 ... stack backtrace: CPU: 1 PID: 1205 Comm: kworker/1:3 Not tainted 5.18.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_deadlock_bug kernel/locking/lockdep.c:2988 [inline] check_deadlock kernel/locking/lockdep.c:3031 [inline] validate_chain kernel/locking/lockdep.c:3816 [inline] __lock_acquire.cold+0x152/0x3ca kernel/locking/lockdep.c:5053 lock_acquire kernel/locking/lockdep.c:5665 [inline] lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5630 __mutex_lock_common kernel/locking/mutex.c:603 [inline] __mutex_lock+0x14f/0x1610 kernel/locking/mutex.c:747 usb_stor_pre_reset+0x35/0x40 drivers/usb/storage/usb.c:230 usb_reset_device+0x37d/0x9a0 drivers/usb/core/hub.c:6109 r871xu_dev_remove+0x21a/0x270 drivers/staging/rtl8712/usb_intf.c:622 usb_unbind_interface+0x1bd/0x890 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:545 [inline] device_remove+0x11f/0x170 drivers/base/dd.c:537 __device_release_driver drivers/base/dd.c:1222 [inline] device_release_driver_internal+0x1a7/0x2f0 drivers/base/dd.c:1248 usb_driver_release_interface+0x102/0x180 drivers/usb/core/driver.c:627 usb_forced_unbind_intf+0x4d/0xa0 drivers/usb/core/driver.c:1118 usb_reset_device+0x39b/0x9a0 drivers/usb/core/hub.c:6114 This turned out not to be an error in usb-storage but rather a nested device reset attempt. That is, as the rtl8712 driver was being unbound from a composite device in preparation for an unrelated USB reset (that driver does not have pre_reset or post_reset callbacks), its ->remove routine called usb_reset_device() -- thus nesting one reset call within another. Performing a reset as part of disconnect processing is a questionable practice at best. However, the bug report points out that the USB core does not have any protection against nested resets. Adding a reset_in_progress flag and testing it will prevent such errors in the future. Link: https://lore.kernel.org/all/CAB7eexKUpvX-JNiLzhXBDWgfg2T9e9_0Tw4HQ6ke= N=3D=3DvoRbP0g@mail.gmail.com/ Cc: stable@vger.kernel.org Reported-and-tested-by: Rondreis Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YwkflDxvg0KWqyZK@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/hub.c | 10 ++++++++++ include/linux/usb.h | 2 ++ 2 files changed, 12 insertions(+) --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -5851,6 +5851,11 @@ re_enumerate_no_bos: * the reset is over (using their post_reset method). * * Return: The same as for usb_reset_and_verify_device(). + * However, if a reset is already in progress (for instance, if a + * driver doesn't have pre_ or post_reset() callbacks, and while + * being unbound or re-bound during the ongoing reset its disconnect() + * or probe() routine tries to perform a second, nested reset), the + * routine returns -EINPROGRESS. * * Note: * The caller must own the device lock. For example, it's safe to use @@ -5884,6 +5889,10 @@ int usb_reset_device(struct usb_device * return -EISDIR; } =20 + if (udev->reset_in_progress) + return -EINPROGRESS; + udev->reset_in_progress =3D 1; + port_dev =3D hub->ports[udev->portnum - 1]; =20 /* @@ -5948,6 +5957,7 @@ int usb_reset_device(struct usb_device * =20 usb_autosuspend_device(udev); memalloc_noio_restore(noio_flag); + udev->reset_in_progress =3D 0; return ret; } EXPORT_SYMBOL_GPL(usb_reset_device); --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -580,6 +580,7 @@ struct usb3_lpm_parameters { * @level: number of USB hub ancestors * @can_submit: URBs may be submitted * @persist_enabled: USB_PERSIST enabled for this device + * @reset_in_progress: the device is being reset * @have_langid: whether string_langid is valid * @authorized: policy has said we can use it; * (user space) policy determines if we authorize this device to be @@ -664,6 +665,7 @@ struct usb_device { =20 unsigned can_submit:1; unsigned persist_enabled:1; + unsigned reset_in_progress:1; unsigned have_langid:1; unsigned authorized:1; unsigned authenticated:1; From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78100C6FA82 for ; Tue, 13 Sep 2022 15:10:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235527AbiIMPKR (ORCPT ); Tue, 13 Sep 2022 11:10:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55036 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235603AbiIMPIu (ORCPT ); Tue, 13 Sep 2022 11:08:50 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ED4792C663; Tue, 13 Sep 2022 07:31:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D8CDEB80EFA; Tue, 13 Sep 2022 14:31:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 44CEDC433C1; Tue, 13 Sep 2022 14:31:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079481; bh=g4OSy4eiWzd4GXoIulDPPUyvFbwo6gtuf8PChh14Lrc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CjfGvGPeOJdJSQQ8iefAka/A6wmTLjNItdP95Z/vd5dqeOGNhYMTVoplUEAJzGF+B +OtAKBMBHfGsSKdtbWAV/Q/NntCY1TjamMwV6s8kMWAI7WEpinwIXbBKl3puDVgIX3 ul3PbdnYaHUKJw00u3dsPGA8iX0XBUd+EGYkus/M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Krishna Kurapati Subject: [PATCH 4.19 44/79] usb: gadget: mass_storage: Fix cdrom data transfers on MAC-OS Date: Tue, 13 Sep 2022 16:07:02 +0200 Message-Id: <20220913140351.046519972@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krishna Kurapati commit 9d4dc16ec71bd6368548e9743223e449b4377fc7 upstream. During cdrom emulation, the response to read_toc command must contain the cdrom address as the number of sectors (2048 byte sized blocks) represented either as an absolute value (when MSF bit is '0') or in terms of PMin/PSec/PFrame (when MSF bit is set to '1'). Incase of cdrom, the fsg_lun_open call sets the sector size to 2048 bytes. When MAC OS sends a read_toc request with MSF set to '1', the store_cdrom_address assumes that the address being provided is the LUN size represented in 512 byte sized blocks instead of 2048. It tries to modify the address further to convert it to 2048 byte sized blocks and store it in MSF format. This results in data transfer failures as the cdrom address being provided in the read_toc response is incorrect. Fixes: 3f565a363cee ("usb: gadget: storage: adapt logic block size to bound= block devices") Cc: stable@vger.kernel.org Acked-by: Alan Stern Signed-off-by: Krishna Kurapati Link: https://lore.kernel.org/r/1661570110-19127-1-git-send-email-quic_kris= kura@quicinc.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/gadget/function/storage_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/usb/gadget/function/storage_common.c +++ b/drivers/usb/gadget/function/storage_common.c @@ -294,8 +294,10 @@ EXPORT_SYMBOL_GPL(fsg_lun_fsync_sub); void store_cdrom_address(u8 *dest, int msf, u32 addr) { if (msf) { - /* Convert to Minutes-Seconds-Frames */ - addr >>=3D 2; /* Convert to 2048-byte frames */ + /* + * Convert to Minutes-Seconds-Frames. + * Sector size is already set to 2048 bytes. + */ addr +=3D 2*75; /* Lead-in occupies 2 seconds */ dest[3] =3D addr % 75; /* Frames */ addr /=3D 75; From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A3B2C54EE9 for ; Tue, 13 Sep 2022 15:40:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232177AbiIMPkU (ORCPT ); Tue, 13 Sep 2022 11:40:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46254 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236852AbiIMPjM (ORCPT ); Tue, 13 Sep 2022 11:39:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6093651A12; Tue, 13 Sep 2022 07:45:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A491E61414; Tue, 13 Sep 2022 14:31:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BC139C433D6; Tue, 13 Sep 2022 14:31:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079484; bh=exZdNZWzP0dOHve55ZJWQ3kh4qj940fegArBrUQhtkE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yewirD50/S39mrY2EGyJ8Yu1IQM3TjS1Hm8sXKelEN4kvu+v9sreiYDOqb3+a1CjB 7sy99+7I8TPa05tEVgcvzalYmVUg6u6ust7A/G6lCO1BGXXHGGwITt9EdCkDgTkqef MCLYLS5cLc7hwViyyJ61KhIZN1Mta20aCMvxkI2c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com, Siddh Raman Pant , Johannes Berg Subject: [PATCH 4.19 45/79] wifi: mac80211: Dont finalize CSA in IBSS mode if state is disconnected Date: Tue, 13 Sep 2022 16:07:03 +0200 Message-Id: <20220913140351.090213867@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Siddh Raman Pant commit 15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0 upstream. When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa(). Cc: stable@vger.kernel.org Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode") Link: https://syzkaller.appspot.com/bug?id=3D05603ef4ae8926761b678d2939a3b2= ad28ab9ca6 Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com Signed-off-by: Siddh Raman Pant Tested-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220814151512.9985-1-code@siddh.me Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/mac80211/ibss.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/net/mac80211/ibss.c +++ b/net/mac80211/ibss.c @@ -544,6 +544,10 @@ int ieee80211_ibss_finish_csa(struct iee =20 sdata_assert_lock(sdata); =20 + /* When not connected/joined, sending CSA doesn't make sense. */ + if (ifibss->state !=3D IEEE80211_IBSS_MLME_JOINED) + return -ENOLINK; + /* update cfg80211 bss information with the new channel */ if (!is_zero_ether_addr(ifibss->bssid)) { cbss =3D cfg80211_get_bss(sdata->local->hw.wiphy, From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B3F6C6FA82 for ; Tue, 13 Sep 2022 15:10:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235561AbiIMPKa (ORCPT ); Tue, 13 Sep 2022 11:10:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58302 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235673AbiIMPJA (ORCPT ); Tue, 13 Sep 2022 11:09:00 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7932B76964; Tue, 13 Sep 2022 07:31:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BFCEFB80F4B; Tue, 13 Sep 2022 14:31:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3B876C433C1; Tue, 13 Sep 2022 14:31:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079486; bh=JYuxi9O3FdJnifusqhvtJkC+4XphOyrht8mntGp0LCI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gQKkMxMjFanNmmbspJfEYpuJnxKKa+tpRhqJofeuY1LBcJiK2URfieXqtbXLcTvPo hT5lNyxqxdm8Goye7WmrnII2Vo6sPktLfes6L/clXGFQOGs7VbFC4xm2Cl+3TQSJLK 5YvOKzjTcXTs6dCJUfM+CrMZPwinsFD/As1cawII= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miquel Raynal , Stefan Schmidt Subject: [PATCH 4.19 46/79] net: mac802154: Fix a condition in the receive path Date: Tue, 13 Sep 2022 16:07:04 +0200 Message-Id: <20220913140351.133713162@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miquel Raynal commit f0da47118c7e93cdbbc6fb403dd729a5f2c90ee3 upstream. Upon reception, a packet must be categorized, either it's destination is the host, or it is another host. A packet with no destination addressing fields may be valid in two situations: - the packet has no source field: only ACKs are built like that, we consider the host as the destination. - the packet has a valid source field: it is directed to the PAN coordinator, as for know we don't have this information we consider we are not the PAN coordinator. There was likely a copy/paste error made during a previous cleanup because the if clause is now containing exactly the same condition as in the switch case, which can never be true. In the past the destination address was used in the switch and the source address was used in the if, which matches what the spec says. Cc: stable@vger.kernel.org Fixes: ae531b9475f6 ("ieee802154: use ieee802154_addr instead of *_sa varia= nts") Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20220826142954.254853-1-miquel.raynal@bootl= in.com Signed-off-by: Stefan Schmidt Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/mac802154/rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/mac802154/rx.c +++ b/net/mac802154/rx.c @@ -52,7 +52,7 @@ ieee802154_subif_frame(struct ieee802154 =20 switch (mac_cb(skb)->dest.mode) { case IEEE802154_ADDR_NONE: - if (mac_cb(skb)->dest.mode !=3D IEEE802154_ADDR_NONE) + if (hdr->source.mode !=3D IEEE802154_ADDR_NONE) /* FIXME: check if we are PAN coordinator */ skb->pkt_type =3D PACKET_OTHERHOST; else From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1D16DC6FA82 for ; Tue, 13 Sep 2022 15:17:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235827AbiIMPRB (ORCPT ); Tue, 13 Sep 2022 11:17:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47156 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235899AbiIMPOH (ORCPT ); Tue, 13 Sep 2022 11:14:07 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 447146AA0A; Tue, 13 Sep 2022 07:33:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id ADF8A614E6; Tue, 13 Sep 2022 14:31:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C19A8C433D6; Tue, 13 Sep 2022 14:31:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079489; bh=+XPBrIOIZ3AEbHVdiyGfUYR8D1RWCPPH5kCaPunTPDE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1vWE/v4rnkK0El4K3kRsc7EW8Jjx+pXFLh3DsiZlfQYYj/6CgThcRwpSsQbXtz2TO C+4KteKGfbVxpdrnIQVE5tCysCQjIN8gyl17XYLdS4hO7gLi9/nxsQ7xIUTSMrCGHI pWyUYoHJBXwu14RGJqOuB6Kpaj915O/dERhP8Jnk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Abhishek Shah , Takashi Iwai Subject: [PATCH 4.19 47/79] ALSA: seq: oss: Fix data-race for max_midi_devs access Date: Tue, 13 Sep 2022 16:07:05 +0200 Message-Id: <20220913140351.181229954@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 22dec134dbfa825b963f8a1807ad19b943e46a56 upstream. ALSA OSS sequencer refers to a global variable max_midi_devs at creating a new port, storing it to its own field. Meanwhile this variable may be changed by other sequencer events at snd_seq_oss_midi_check_exit_port() in parallel, which may cause a data race. OTOH, this data race itself is almost harmless, as the access to the MIDI device is done via get_mdev() and it's protected with a refcount, hence its presence is guaranteed. Though, it's sill better to address the data-race from the code sanity POV, and this patch adds the proper spinlock for the protection. Reported-by: Abhishek Shah Cc: Link: https://lore.kernel.org/r/CAEHB2493pZRXs863w58QWnUTtv3HHfg85aYhLn5HJH= CwxqtHQg@mail.gmail.com Link: https://lore.kernel.org/r/20220823072717.1706-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- sound/core/seq/oss/seq_oss_midi.c | 2 ++ 1 file changed, 2 insertions(+) --- a/sound/core/seq/oss/seq_oss_midi.c +++ b/sound/core/seq/oss/seq_oss_midi.c @@ -280,7 +280,9 @@ snd_seq_oss_midi_clear_all(void) void snd_seq_oss_midi_setup(struct seq_oss_devinfo *dp) { + spin_lock_irq(®ister_lock); dp->max_mididev =3D max_midi_devs; + spin_unlock_irq(®ister_lock); } =20 /* From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1709C54EE9 for ; Tue, 13 Sep 2022 15:39:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235869AbiIMPjz (ORCPT ); Tue, 13 Sep 2022 11:39:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52556 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236753AbiIMPiz (ORCPT ); Tue, 13 Sep 2022 11:38:55 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 82EF71AF2D; Tue, 13 Sep 2022 07:44:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8079E614B4; Tue, 13 Sep 2022 14:31:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F9AAC433D6; Tue, 13 Sep 2022 14:31:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079491; bh=2jMSUEghuLlu/1D6x2idR7tJj/F/ZgljozPqFgP5Eq4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HieWeZp0RAec1A4LZa3ab0HdyiWN8yKznt6K3fM/SijUvxGzV1NzILBkqyfo8XTF/ qOClnQgBebCDkW1h9IC87J0HvyOmVwBWMp/1z6KyNQu/+mD6sSQZpgRpZJhTblH5TA fv12aIzGjQag+h6pSRMUbTF4EraYlxCLpaCVdObM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Abhishek Shah , Takashi Iwai Subject: [PATCH 4.19 48/79] ALSA: seq: Fix data-race at module auto-loading Date: Tue, 13 Sep 2022 16:07:06 +0200 Message-Id: <20220913140351.223767914@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 3e7e04b747adea36f349715d9f0998eeebf15d72 upstream. It's been reported that there is a possible data-race accessing to the global card_requested[] array at ALSA sequencer core, which is used for determining whether to call request_module() for the card or not. This data race itself is almost harmless, as it might end up with one extra request_module() call for the already loaded module at most. But it's still better to fix. This patch addresses the possible data race of card_requested[] and client_requested[] arrays by replacing them with bitmask. It's an atomic operation and can work without locks. Reported-by: Abhishek Shah Cc: Link: https://lore.kernel.org/r/CAEHB24_ay6YzARpA1zgCsE7=3DH9CSJJzux618E=3D= Ka4h0YdKn=3DqA@mail.gmail.com Link: https://lore.kernel.org/r/20220823072717.1706-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- sound/core/seq/seq_clientmgr.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) --- a/sound/core/seq/seq_clientmgr.c +++ b/sound/core/seq/seq_clientmgr.c @@ -136,13 +136,13 @@ struct snd_seq_client *snd_seq_client_us spin_unlock_irqrestore(&clients_lock, flags); #ifdef CONFIG_MODULES if (!in_interrupt()) { - static char client_requested[SNDRV_SEQ_GLOBAL_CLIENTS]; - static char card_requested[SNDRV_CARDS]; + static DECLARE_BITMAP(client_requested, SNDRV_SEQ_GLOBAL_CLIENTS); + static DECLARE_BITMAP(card_requested, SNDRV_CARDS); + if (clientid < SNDRV_SEQ_GLOBAL_CLIENTS) { int idx; =09 - if (!client_requested[clientid]) { - client_requested[clientid] =3D 1; + if (!test_and_set_bit(clientid, client_requested)) { for (idx =3D 0; idx < 15; idx++) { if (seq_client_load[idx] < 0) break; @@ -157,10 +157,8 @@ struct snd_seq_client *snd_seq_client_us int card =3D (clientid - SNDRV_SEQ_GLOBAL_CLIENTS) / SNDRV_SEQ_CLIENTS_PER_CARD; if (card < snd_ecards_limit) { - if (! card_requested[card]) { - card_requested[card] =3D 1; + if (!test_and_set_bit(card, card_requested)) snd_request_card(card); - } snd_seq_device_load_drivers(); } } From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A260C6FA89 for ; Tue, 13 Sep 2022 15:12:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235517AbiIMPME (ORCPT ); Tue, 13 Sep 2022 11:12:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47190 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235537AbiIMPKX (ORCPT ); Tue, 13 Sep 2022 11:10:23 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 824B477EBE; Tue, 13 Sep 2022 07:32:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7F785614D9; Tue, 13 Sep 2022 14:31:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 99971C433D6; Tue, 13 Sep 2022 14:31:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079496; bh=57IC6E6AX7usppRwB0rZ/Wdn5wt79iBpTKmZzSEOBwM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GrhttD+ujXMO/0HjDr6Fh3dHyG1UGQlYhNPV0RYhCvl8w/OBai9WlcM2nbr7trlDd R6EY2clj4ccs+iDEjR7OKX4QoBoxFpOfLvy3DfG0+9G4ENYQL8w3UQqUqU5+yIcbn+ Tj7q1Q/vnbfYTw/i2DGjsag4t1uz5jgS2aOc0J64= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Candice Li , Hawking Zhang , Alex Deucher , Sasha Levin Subject: [PATCH 4.19 49/79] drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup. Date: Tue, 13 Sep 2022 16:07:07 +0200 Message-Id: <20220913140351.265139694@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Candice Li [ Upstream commit c351938350ab9b5e978dede2c321da43de7eb70c ] No need to set up rb when no gfx rings. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/am= dgpu/gfx_v9_0.c index d8ae6a23e6133..d36bea68a67e1 100644 --- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c @@ -1771,7 +1771,8 @@ static void gfx_v9_0_gpu_init(struct amdgpu_device *a= dev) =20 gfx_v9_0_tiling_mode_table_init(adev); =20 - gfx_v9_0_setup_rb(adev); + if (adev->gfx.num_gfx_rings) + gfx_v9_0_setup_rb(adev); gfx_v9_0_get_cu_info(adev, &adev->gfx.cu_info); adev->gfx.config.db_debug2 =3D RREG32_SOC15(GC, 0, mmDB_DEBUG2); =20 --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9CEEC54EE9 for ; Tue, 13 Sep 2022 15:10:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235583AbiIMPKk (ORCPT ); Tue, 13 Sep 2022 11:10:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37550 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235683AbiIMPJD (ORCPT ); Tue, 13 Sep 2022 11:09:03 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0AEEB5F119; Tue, 13 Sep 2022 07:31:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B41F1B80D87; Tue, 13 Sep 2022 14:31:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2D281C43146; Tue, 13 Sep 2022 14:31:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079499; bh=HQHYkKIuu2m483r8bXGwDp3s7/RFPN6AGKU9oMAMuI0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SYTUjjVLZbFYBgX3qaytNrKGYW886JEcdcdWX97PVaJtkUjfpkrb6TpNn25OnWs0q 6BY56dkH2ErBJR6z7isR+Mq8UYPea4klIbtIdtwcgASN/28SC/gco8thlNQdxtTeqR mIIDi9rmZ2zeC9ATq8FjmknLxdjYYaPmrIRm9mgE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Christian=20K=C3=B6nig?= , Zhenneng Li , Alex Deucher , Sasha Levin Subject: [PATCH 4.19 50/79] drm/radeon: add a force flush to delay work when radeon Date: Tue, 13 Sep 2022 16:07:08 +0200 Message-Id: <20220913140351.317693720@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Zhenneng Li [ Upstream commit f461950fdc374a3ada5a63c669d997de4600dffe ] Although radeon card fence and wait for gpu to finish processing current ba= tch rings, there is still a corner case that radeon lockup work queue may not be fully= flushed, and meanwhile the radeon_suspend_kms() function has called pci_set_power_st= ate() to put device in D3hot state. Per PCI spec rev 4.0 on 5.3.1.4.1 D3hot State. > Configuration and Message requests are the only TLPs accepted by a Functi= on in > the D3hot state. All other received Requests must be handled as Unsupport= ed Requests, > and all received Completions may optionally be handled as Unexpected Comp= letions. This issue will happen in following logs: Unable to handle kernel paging request at virtual address 00008800e0008010 CPU 0 kworker/0:3(131): Oops 0 pc =3D [] ra =3D [] ps =3D 0000 Taint= ed: G W pc is at si_gpu_check_soft_reset+0x3c/0x240 ra is at si_dma_is_lockup+0x34/0xd0 v0 =3D 0000000000000000 t0 =3D fff08800e0008010 t1 =3D 0000000000010000 t2 =3D 0000000000008010 t3 =3D fff00007e3c00000 t4 =3D fff00007e3c00258 t5 =3D 000000000000ffff t6 =3D 0000000000000001 t7 =3D fff00007ef078000 s0 =3D fff00007e3c016e8 s1 =3D fff00007e3c00000 s2 =3D fff00007e3c00018 s3 =3D fff00007e3c00000 s4 =3D fff00007fff59d80 s5 =3D 0000000000000000 s6 =3D fff00007ef07bd98 a0 =3D fff00007e3c00000 a1 =3D fff00007e3c016e8 a2 =3D 0000000000000008 a3 =3D 0000000000000001 a4 =3D 8f5c28f5c28f5c29 a5 =3D ffffffff810f4338 t8 =3D 0000000000000275 t9 =3D ffffffff809b66f8 t10 =3D ff6769c5d964b800 t11=3D 000000000000b886 pv =3D ffffffff811bea20 at =3D 0000000000000000 gp =3D ffffffff81d89690 sp =3D 00000000aa814126 Disabling lock debugging due to kernel taint Trace: [] si_dma_is_lockup+0x34/0xd0 [] radeon_fence_check_lockup+0xd0/0x290 [] process_one_work+0x280/0x550 [] worker_thread+0x70/0x7c0 [] worker_thread+0x130/0x7c0 [] kthread+0x200/0x210 [] worker_thread+0x0/0x7c0 [] kthread+0x14c/0x210 [] ret_from_kernel_thread+0x18/0x20 [] kthread+0x0/0x210 Code: ad3e0008 43f0074a ad7e0018 ad9e0020 8c3001e8 40230101 <88210000> 4821ed21 So force lockup work queue flush to fix this problem. Acked-by: Christian K=C3=B6nig Signed-off-by: Zhenneng Li Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/gpu/drm/radeon/radeon_device.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeo= n/radeon_device.c index 59c8a6647ff21..cc1c07963116c 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c @@ -1625,6 +1625,9 @@ int radeon_suspend_kms(struct drm_device *dev, bool s= uspend, if (r) { /* delay GPU reset to resume */ radeon_fence_driver_force_completion(rdev, i); + } else { + /* finish executing delayed work */ + flush_delayed_work(&rdev->fence_drv[i].lockup_work); } } =20 --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 075CAC54EE9 for ; Tue, 13 Sep 2022 15:39:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232066AbiIMPjd (ORCPT ); Tue, 13 Sep 2022 11:39:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47426 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232060AbiIMPiT (ORCPT ); Tue, 13 Sep 2022 11:38:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D48B16F249; Tue, 13 Sep 2022 07:44:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B480B614B5; Tue, 13 Sep 2022 14:31:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0DA3C433D6; Tue, 13 Sep 2022 14:31:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079502; bh=AMvkWcumkyw9/k0EQQQuY6LBmsfboRqftOvewoCknF0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YRW6twSggyTVCRhUYEtRCqVrgl5CpXYQ3nN5JJ8Ux/shAc3N3RKcJlv08QrXyFA0t 6U1s0l/9ormHJnS9vw6SqDhnsaaLhcGK35xAN9UzhRpE3rMc+s9fsks6GTarlvNvSa TQV11e+S539qqxuZbhUgccm9Y6dlllvXtDDwV1PE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Li Qiong , Helge Deller , Sasha Levin Subject: [PATCH 4.19 51/79] parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources() Date: Tue, 13 Sep 2022 16:07:09 +0200 Message-Id: <20220913140351.370430390@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Li Qiong [ Upstream commit d46c742f827fa2326ab1f4faa1cccadb56912341 ] As the possible failure of the kmalloc(), it should be better to fix this error path, check and return '-ENOMEM' error code. Signed-off-by: Li Qiong Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/parisc/ccio-dma.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c index 6efab7a06c5fc..73ee74d6e7a3d 100644 --- a/drivers/parisc/ccio-dma.c +++ b/drivers/parisc/ccio-dma.c @@ -1390,15 +1390,17 @@ ccio_init_resource(struct resource *res, char *name= , void __iomem *ioaddr) } } =20 -static void __init ccio_init_resources(struct ioc *ioc) +static int __init ccio_init_resources(struct ioc *ioc) { struct resource *res =3D ioc->mmio_region; char *name =3D kmalloc(14, GFP_KERNEL); - + if (unlikely(!name)) + return -ENOMEM; snprintf(name, 14, "GSC Bus [%d/]", ioc->hw_path); =20 ccio_init_resource(res, name, &ioc->ioc_regs->io_io_low); ccio_init_resource(res + 1, name, &ioc->ioc_regs->io_io_low_hv); + return 0; } =20 static int new_ioc_area(struct resource *res, unsigned long size, @@ -1552,7 +1554,10 @@ static int __init ccio_probe(struct parisc_device *d= ev) return -ENOMEM; } ccio_ioc_init(ioc); - ccio_init_resources(ioc); + if (ccio_init_resources(ioc)) { + kfree(ioc); + return -ENOMEM; + } hppa_dma_ops =3D &ccio_ops; dev->dev.platform_data =3D kzalloc(sizeof(struct pci_hba_data), GFP_KERNE= L); =20 --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2EB6C54EE9 for ; Tue, 13 Sep 2022 15:17:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235859AbiIMPR0 (ORCPT ); Tue, 13 Sep 2022 11:17:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51832 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231932AbiIMPQP (ORCPT ); Tue, 13 Sep 2022 11:16:15 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9FC9A11466; Tue, 13 Sep 2022 07:34:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 94845614EE; Tue, 13 Sep 2022 14:32:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A0785C433C1; Tue, 13 Sep 2022 14:32:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079525; bh=liXSGOfA48KdGblo1/n4YmJw3QleA2+6wHOtnX37PqI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2nqRKvzG2JASxArhXIlzcRjT8jvgIchgPeHjYFobHaig6jfwfMCNLbeUGMcGEUTDl sywDkHN91Ba2bM1ZmE0UJ4CCumQl9cG9zGvcE0A9/FQZQe6RUdinsxZ0o7hbDGO92c O0XHwp9mSz6NRXVruLphXoAWjV8zIuQ4JHf3DXls= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller , Sasha Levin Subject: [PATCH 4.19 52/79] parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines Date: Tue, 13 Sep 2022 16:07:10 +0200 Message-Id: <20220913140351.418026863@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller [ Upstream commit 591d2108f3abc4db9f9073cae37cf3591fd250d6 ] If a 32-bit kernel was compiled for PA2.0 CPUs, it won't be able to run on machines with PA1.x CPUs. Add a check and bail out early if a PA1.x machine is detected. Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- arch/parisc/kernel/head.S | 43 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-) diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S index f56cbab64ac10..92bc2fa7e6929 100644 --- a/arch/parisc/kernel/head.S +++ b/arch/parisc/kernel/head.S @@ -22,7 +22,7 @@ #include #include =20 - .level PA_ASM_LEVEL + .level 1.1 =20 __INITDATA ENTRY(boot_args) @@ -69,6 +69,47 @@ $bss_loop: stw,ma %arg2,4(%r1) stw,ma %arg3,4(%r1) =20 +#if !defined(CONFIG_64BIT) && defined(CONFIG_PA20) + /* This 32-bit kernel was compiled for PA2.0 CPUs. Check current CPU + * and halt kernel if we detect a PA1.x CPU. */ + ldi 32,%r10 + mtctl %r10,%cr11 + .level 2.0 + mfctl,w %cr11,%r10 + .level 1.1 + comib,<>,n 0,%r10,$cpu_ok + + load32 PA(msg1),%arg0 + ldi msg1_end-msg1,%arg1 +$iodc_panic: + copy %arg0, %r10 + copy %arg1, %r11 + load32 PA(init_stack),%sp +#define MEM_CONS 0x3A0 + ldw MEM_CONS+32(%r0),%arg0 // HPA + ldi ENTRY_IO_COUT,%arg1 + ldw MEM_CONS+36(%r0),%arg2 // SPA + ldw MEM_CONS+8(%r0),%arg3 // layers + load32 PA(__bss_start),%r1 + stw %r1,-52(%sp) // arg4 + stw %r0,-56(%sp) // arg5 + stw %r10,-60(%sp) // arg6 =3D ptr to text + stw %r11,-64(%sp) // arg7 =3D len + stw %r0,-68(%sp) // arg8 + load32 PA(.iodc_panic_ret), %rp + ldw MEM_CONS+40(%r0),%r1 // ENTRY_IODC + bv,n (%r1) +.iodc_panic_ret: + b . /* wait endless with ... */ + or %r10,%r10,%r10 /* qemu idle sleep */ +msg1: .ascii "Can't boot kernel which was built for PA8x00 CPUs on this ma= chine.\r\n" +msg1_end: + +$cpu_ok: +#endif + + .level PA_ASM_LEVEL + /* Initialize startup VM. Just map first 16/32 MB of memory */ load32 PA(swapper_pg_dir),%r4 mtctl %r4,%cr24 /* Initialize kernel root pointer */ --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D921EC6FA89 for ; Tue, 13 Sep 2022 15:15:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235712AbiIMPPi (ORCPT ); Tue, 13 Sep 2022 11:15:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42638 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235669AbiIMPN2 (ORCPT ); Tue, 13 Sep 2022 11:13:28 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4DA43786D6; Tue, 13 Sep 2022 07:33:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A5803614EC; Tue, 13 Sep 2022 14:32:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AF472C433B5; Tue, 13 Sep 2022 14:32:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079528; bh=+BWtEheS0cucPhtYcwHqN0Ms/BuehtDS9BrPRX2Kow0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p/7C/dxmZ7royD5lsyuQ3T6+/Vr3XpyW6X8H+smSkt4q2L4+S4+EnUiKtCN1xbKMW 34AB5QEYkDVOAxx/j+joNWQ5jwXOdEBHkyB0gW3Tulrm88tE43Uwg/878KZYTEgGvI MPtQrNNp82WcJV4dT//MGBIi2ATT3fGu/1GCuNy8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sudeep Holla , Will Deacon , Sasha Levin , Bruno Goncalves Subject: [PATCH 4.19 53/79] arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level Date: Tue, 13 Sep 2022 16:07:11 +0200 Message-Id: <20220913140351.469490864@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sudeep Holla [ Upstream commit e75d18cecbb3805895d8ed64da4f78575ec96043 ] Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime us= age") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #= 73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=3D--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves Signed-off-by: Sudeep Holla Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.c= om Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- arch/arm64/kernel/cacheinfo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index d17414cbb89a8..473935695efb7 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -47,7 +47,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, =20 int init_cache_level(unsigned int cpu) { - unsigned int ctype, level, leaves, fw_level; + unsigned int ctype, level, leaves; + int fw_level; struct cpu_cacheinfo *this_cpu_ci =3D get_cpu_cacheinfo(cpu); =20 for (level =3D 1, leaves =3D 0; level <=3D MAX_CACHE_LEVEL; level++) { @@ -65,6 +66,9 @@ int init_cache_level(unsigned int cpu) else fw_level =3D acpi_find_last_cache_level(cpu); =20 + if (fw_level < 0) + return fw_level; + if (level < fw_level) { /* * some external caches not specified in CLIDR_EL1 --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08FEFC6FA89 for ; Tue, 13 Sep 2022 15:12:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235635AbiIMPMW (ORCPT ); Tue, 13 Sep 2022 11:12:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49970 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235531AbiIMPLI (ORCPT ); Tue, 13 Sep 2022 11:11:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A037377E8A; Tue, 13 Sep 2022 07:32:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CD9EAB80D87; Tue, 13 Sep 2022 14:32:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4DD3EC433C1; Tue, 13 Sep 2022 14:32:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079530; bh=gU0OH3XIhcADfT31F2l53Sglvesw+5FFs/Nss/7JBTg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SZlxiioVjxr44+BE9hOEzGQJPIIrRqc3pDOVw2gI3bfaXieM6pnhPC/PnHBA+ceRi PUjCBoBBdvre1AlHaGsW3xMGbgGrJHTZihN4i+PyV2OXrFlz6yGg10xt3fDyMh5Owa JDUiMxYZyomaoaWVQHdKgF+6JvFTMLdnXs8ajmIs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Brown , Catalin Marinas , Will Deacon , Sasha Levin Subject: [PATCH 4.19 54/79] arm64/signal: Raise limit on stack frames Date: Tue, 13 Sep 2022 16:07:12 +0200 Message-Id: <20220913140351.514320304@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mark Brown [ Upstream commit 7ddcaf78e93c9282b4d92184f511b4d5bee75355 ] The signal code has a limit of 64K on the size of a stack frame that it will generate, if this limit is exceeded then a process will be killed if it receives a signal. Unfortunately with the advent of SME this limit is too small - the maximum possible size of the ZA register alone is 64K. This is not an issue for practical systems at present but is easily seen using virtual platforms. Raise the limit to 256K, this is substantially more than could be used by any current architecture extension. Signed-off-by: Mark Brown Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20220817182324.638214-2-broonie@kernel.org Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- arch/arm64/kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index ca565853dea64..bd9b36ab35f0f 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -101,7 +101,7 @@ static size_t sigframe_size(struct rt_sigframe_user_lay= out const *user) * not taken into account. This limit is not a guarantee and is * NOT ABI. */ -#define SIGFRAME_MAXSZ SZ_64K +#define SIGFRAME_MAXSZ SZ_256K =20 static int __sigframe_alloc(struct rt_sigframe_user_layout *user, unsigned long *offset, size_t size, bool extend) --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B033C6FA86 for ; Tue, 13 Sep 2022 15:36:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231994AbiIMPgQ (ORCPT ); Tue, 13 Sep 2022 11:36:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58802 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236527AbiIMPfj (ORCPT ); Tue, 13 Sep 2022 11:35:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D24158037F; Tue, 13 Sep 2022 07:42:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 56278B80F10; Tue, 13 Sep 2022 14:32:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B03A6C433D6; Tue, 13 Sep 2022 14:32:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079533; bh=DnYQUcsVH32s4uZbj997262p3sc1ImMPNTeT3izOTnk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bAZCl8CTZkujAa5vd4zoXHmqh6Et865TazwJp5iiUmBnBe4ms5fAWH/TR/TwNpUO+ QmkPFYr+pVKyM6GASceY4/1XFbEPxBUc7FUNDQGKeCe6F0iqT3yU6kgcdJN2cY7MA5 fY0FZJb/Sm4Bc7apGecXLxXAx07cT5Z3JId0SN3o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Yingliang , Helge Deller , Sasha Levin Subject: [PATCH 4.19 55/79] fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() Date: Tue, 13 Sep 2022 16:07:13 +0200 Message-Id: <20220913140351.564387648@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang [ Upstream commit 07c55c9803dea748d17a054000cbf1913ce06399 ] Add missing pci_disable_device() in error path in chipsfb_pci_init(). Signed-off-by: Yang Yingliang Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/video/fbdev/chipsfb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c index 413b465e69d8e..7ca149ab86d20 100644 --- a/drivers/video/fbdev/chipsfb.c +++ b/drivers/video/fbdev/chipsfb.c @@ -432,6 +432,7 @@ static int chipsfb_pci_init(struct pci_dev *dp, const s= truct pci_device_id *ent) err_release_fb: framebuffer_release(p); err_disable: + pci_disable_device(dp); err_out: return rc; } --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8CC90C54EE9 for ; Tue, 13 Sep 2022 15:19:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235793AbiIMPTW (ORCPT ); Tue, 13 Sep 2022 11:19:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38496 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235483AbiIMPSC (ORCPT ); Tue, 13 Sep 2022 11:18:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 184C1520A7; Tue, 13 Sep 2022 07:34:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 832B6614E4; Tue, 13 Sep 2022 14:32:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 86D05C433D6; Tue, 13 Sep 2022 14:32:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079535; bh=JArKBCEL/uMuvvvG5tPJeSOSfdRI7vlyp45mKEbpU+U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1b/XFUeUz67O8jepwEI+4janJf1pIuI0u/HNmYm9ro6Q0ocLwNu1xxeY5oP5nZR3l DH0WP1CynUakCvZVQiyGVEM779gDK7cbUeMUqXIAQJdoireFxn+8WVbUo7qR6J06Gg lI5BlKNFCPrVWA8uwXAdJlicrAbS7sOaAwQORLRQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qu Huang , Alex Deucher , Sasha Levin Subject: [PATCH 4.19 56/79] drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly Date: Tue, 13 Sep 2022 16:07:14 +0200 Message-Id: <20220913140351.610246119@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Qu Huang [ Upstream commit b8983d42524f10ac6bf35bbce6a7cc8e45f61e04 ] The mmVM_L2_CNTL3 register is not assigned an initial value Signed-off-by: Qu Huang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/= amdgpu/mmhub_v1_0.c index c963eec58c702..923bc097a00b2 100644 --- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c +++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c @@ -155,6 +155,7 @@ static void mmhub_v1_0_init_cache_regs(struct amdgpu_de= vice *adev) tmp =3D REG_SET_FIELD(tmp, VM_L2_CNTL2, INVALIDATE_L2_CACHE, 1); WREG32_SOC15(MMHUB, 0, mmVM_L2_CNTL2, tmp); =20 + tmp =3D mmVM_L2_CNTL3_DEFAULT; if (adev->gmc.translate_further) { tmp =3D REG_SET_FIELD(tmp, VM_L2_CNTL3, BANK_SELECT, 12); tmp =3D REG_SET_FIELD(tmp, VM_L2_CNTL3, --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43244C54EE9 for ; Tue, 13 Sep 2022 15:42:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233118AbiIMPmH (ORCPT ); Tue, 13 Sep 2022 11:42:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48556 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236705AbiIMPlX (ORCPT ); Tue, 13 Sep 2022 11:41:23 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C2F618305C; Tue, 13 Sep 2022 07:45:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1F5BAB80F02; Tue, 13 Sep 2022 14:32:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 772ABC433D6; Tue, 13 Sep 2022 14:32:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079538; bh=9BgiPP6OCpWvSkGqFHD61EJ8AiegDO/o1o7/clXSep4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MgUt1iH0o/WJY6acfyaRQ4IIVV9dknx64giRZU7i4HjQEJCMHXlgp6JlD1p4HKNOI q2fyvcNJV61RKNkQ+YzN7rZxcOeYoL4heikiT/cuW1H1CsQSOmOQP/wDrwZ5wVhcCk OvZJU1gEWIH0Lg6UF0x/gyXbmhGHGpmNcSPlHR4I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tasos Sahanidis , Takashi Iwai Subject: [PATCH 4.19 57/79] ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() Date: Tue, 13 Sep 2022 16:07:15 +0200 Message-Id: <20220913140351.660224693@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tasos Sahanidis commit d29f59051d3a07b81281b2df2b8c9dfe4716067f upstream. The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around. This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur. This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=3DLive,DEV=3D3 -c 16 /dev/zero UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k= 1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 = 07/22/2010 Call Trace: dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Signed-off-by: Tasos Sahanidis Cc: Link: https://lore.kernel.org/r/3707dcab-320a-62ff-63c0-73fc201ef756@tasoss= ah.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- sound/pci/emu10k1/emupcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/pci/emu10k1/emupcm.c +++ b/sound/pci/emu10k1/emupcm.c @@ -137,7 +137,7 @@ static int snd_emu10k1_pcm_channel_alloc epcm->voices[0]->epcm =3D epcm; if (voices > 1) { for (i =3D 1; i < voices; i++) { - epcm->voices[i] =3D &epcm->emu->voices[epcm->voices[0]->number + i]; + epcm->voices[i] =3D &epcm->emu->voices[(epcm->voices[0]->number + i) % = NUM_G]; epcm->voices[i]->epcm =3D epcm; } } From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9876C6FA82 for ; Tue, 13 Sep 2022 17:45:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231993AbiIMRo7 (ORCPT ); Tue, 13 Sep 2022 13:44:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36836 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233243AbiIMRob (ORCPT ); Tue, 13 Sep 2022 13:44:31 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9AE516051F; Tue, 13 Sep 2022 09:40:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A3AE2B80F99; Tue, 13 Sep 2022 14:32:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0C0F9C433D7; Tue, 13 Sep 2022 14:32:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079541; bh=c+8isZ6YTFjQhAE68z6WOk1AgkqlsJDOpn1OWpRm7yg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=W99WdIhYvFC1pj8DN7pr794u/7gXwNwCuLrfVwmqJ3+a/RIB6SwO740jrcTvVqBHL fcT3ReBAH0+OfL8+UarSGBUEASqPNgOeJG7qUcH7PdEdspzVDRvUtf2x5H7Fqc15qz QpL17lXibmyfTezzeNZ3DvTfJTzJLacSYtFMfZ2k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pattara Teerapong , Takashi Iwai Subject: [PATCH 4.19 58/79] ALSA: aloop: Fix random zeros in capture data when using jiffies timer Date: Tue, 13 Sep 2022 16:07:16 +0200 Message-Id: <20220913140351.706136135@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pattara Teerapong commit 3e48940abee88b8dbbeeaf8a07e7b2b6be1271b3 upstream. In loopback_jiffies_timer_pos_update(), we are getting jiffies twice. First time for playback, second time for capture. Jiffies can be updated between these two calls and if the capture jiffies is larger, extra zeros will be filled in the capture buffer. Change to get jiffies once and use it for both playback and capture. Signed-off-by: Pattara Teerapong Cc: Link: https://lore.kernel.org/r/20220901144036.4049060-1-pteerapong@chromiu= m.org Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- sound/drivers/aloop.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/sound/drivers/aloop.c +++ b/sound/drivers/aloop.c @@ -477,17 +477,18 @@ static unsigned int loopback_pos_update( cable->streams[SNDRV_PCM_STREAM_PLAYBACK]; struct loopback_pcm *dpcm_capt =3D cable->streams[SNDRV_PCM_STREAM_CAPTURE]; - unsigned long delta_play =3D 0, delta_capt =3D 0; + unsigned long delta_play =3D 0, delta_capt =3D 0, cur_jiffies; unsigned int running, count1, count2; =20 + cur_jiffies =3D jiffies; running =3D cable->running ^ cable->pause; if (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) { - delta_play =3D jiffies - dpcm_play->last_jiffies; + delta_play =3D cur_jiffies - dpcm_play->last_jiffies; dpcm_play->last_jiffies +=3D delta_play; } =20 if (running & (1 << SNDRV_PCM_STREAM_CAPTURE)) { - delta_capt =3D jiffies - dpcm_capt->last_jiffies; + delta_capt =3D cur_jiffies - dpcm_capt->last_jiffies; dpcm_capt->last_jiffies +=3D delta_capt; } From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DB75AC54EE9 for ; Tue, 13 Sep 2022 15:16:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235731AbiIMPQv (ORCPT ); Tue, 13 Sep 2022 11:16:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50550 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235875AbiIMPOE (ORCPT ); Tue, 13 Sep 2022 11:14:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C8B0BF64; Tue, 13 Sep 2022 07:33:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 26578614D3; Tue, 13 Sep 2022 14:33:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 343B1C433D6; Tue, 13 Sep 2022 14:33:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079616; bh=hpwTWqXXcPvP50paH3J/qzE6vS5vOWzr2EqlAbwu1Fw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=crKdKU+CXzlF6FsbOVyWMEshTlt7L5OCMD/p89vPqxljpTCMCa6dpt0kvKPqz3tcE CXRMGmyu/nH8sQB6gCqbMsZSmsU0v7n1F/8xFF42vTifLDNhTdKXCLq+SywYSp//v6 kwjPRwp07afWYr1c+UaY9JG/krfvQ97pVvaR35Us= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dongxiang Ke , Takashi Iwai Subject: [PATCH 4.19 59/79] ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() Date: Tue, 13 Sep 2022 16:07:17 +0200 Message-Id: <20220913140351.747330421@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dongxiang Ke commit e53f47f6c1a56d2af728909f1cb894da6b43d9bf upstream. There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces. Signed-off-by: Dongxiang Ke Link: https://lore.kernel.org/r/20220906024928.10951-1-kdx.glider@gmail.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- sound/usb/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -1111,7 +1111,7 @@ int snd_usb_parse_audio_interface(struct * Dallas DS4201 workaround: It presents 5 altsettings, but the last * one misses syncpipe, and does not produce any sound. */ - if (chip->usb_id =3D=3D USB_ID(0x04fa, 0x4201)) + if (chip->usb_id =3D=3D USB_ID(0x04fa, 0x4201) && num >=3D 4) num =3D 4; =20 for (i =3D 0; i < num; i++) { From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B271C6FA82 for ; Tue, 13 Sep 2022 15:16:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235663AbiIMPQd (ORCPT ); Tue, 13 Sep 2022 11:16:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50104 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235820AbiIMPN4 (ORCPT ); Tue, 13 Sep 2022 11:13:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0008E17045; Tue, 13 Sep 2022 07:33:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 75187614E0; Tue, 13 Sep 2022 14:32:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91995C433D7; Tue, 13 Sep 2022 14:32:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079563; bh=71ccEzCZlCVf3U6aqIjBcQvMZRJuhWUPUhP+Js1jsgU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t5ImDbfM8BWOEoDhcqCf/lgUB/dAznk2SAxnWXJKLuCeAbRy2gqbx56cD+kGuN39D ODonWJIMtxApbsi/ihlTeQDjVW0ZGswgx+GWnA6fkcFNEMXAYx2PNnQmyb2YbLYLKi b0F9Xbs7PfYbmaPpqlNu2GdSgZoMYtREAUUcbJAQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Naveen N. Rao" , Anil S Keshavamurthy , "David S. Miller" , "Masami Hiramatsu (Google)" , "Christian A. Ehrhardt" , "Steven Rostedt (Google)" Subject: [PATCH 4.19 60/79] kprobes: Prohibit probes in gate area Date: Tue, 13 Sep 2022 16:07:18 +0200 Message-Id: <20220913140351.797598051@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christian A. Ehrhardt commit 1efda38d6f9ba26ac88b359c6277f1172db03f1e upstream. The system call gate area counts as kernel text but trying to install a kprobe in this area fails with an Oops later on. To fix this explicitly disallow the gate area for kprobes. Found by syzkaller with the following reproducer: perf_event_open$cgroup(&(0x7f00000001c0)=3D{0x6, 0x80, 0x0, 0x0, 0x0, 0x0, = 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, = 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, = 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, = @perf_config_ext=3D{0x0, 0xffffffffff600000}}, 0xffffffffffffffff, 0x0, 0xf= fffffffffffffff, 0x0) Sample report: BUG: unable to handle page fault for address: fffffbfff3ac6000 PGD 6dfcb067 P4D 6dfcb067 PUD 6df8f067 PMD 6de4d067 PTE 0 Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 21978 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c= 3e60b-dirty #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/= 2014 RIP: 0010:__insn_get_emulate_prefix arch/x86/lib/insn.c:91 [inline] RIP: 0010:insn_get_emulate_prefix arch/x86/lib/insn.c:106 [inline] RIP: 0010:insn_get_prefixes.part.0+0xa8/0x1110 arch/x86/lib/insn.c:134 Code: 49 be 00 00 00 00 00 fc ff df 48 8b 40 60 48 89 44 24 08 e9 81 00 00 = 00 e8 e5 4b 39 ff 4c 89 fa 4c 89 f9 48 c1 ea 03 83 e1 07 <42> 0f b6 14 32 3= 8 ca 7f 08 84 d2 0f 85 06 10 00 00 48 89 d8 48 89 RSP: 0018:ffffc900088bf860 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffffffff9b9bebc0 RCX: 0000000000000000 RDX: 1ffffffff3ac6000 RSI: ffffc90002d82000 RDI: ffffc900088bf9e8 RBP: ffffffff9d630001 R08: 0000000000000000 R09: ffffc900088bf9e8 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff9d630000 R14: dffffc0000000000 R15: ffffffff9d630000 FS: 00007f63eef63640(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff3ac6000 CR3: 0000000029d90005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: insn_get_prefixes arch/x86/lib/insn.c:131 [inline] insn_get_opcode arch/x86/lib/insn.c:272 [inline] insn_get_modrm+0x64a/0x7b0 arch/x86/lib/insn.c:343 insn_get_sib+0x29a/0x330 arch/x86/lib/insn.c:421 insn_get_displacement+0x350/0x6b0 arch/x86/lib/insn.c:464 insn_get_immediate arch/x86/lib/insn.c:632 [inline] insn_get_length arch/x86/lib/insn.c:707 [inline] insn_decode+0x43a/0x490 arch/x86/lib/insn.c:747 can_probe+0xfc/0x1d0 arch/x86/kernel/kprobes/core.c:282 arch_prepare_kprobe+0x79/0x1c0 arch/x86/kernel/kprobes/core.c:739 prepare_kprobe kernel/kprobes.c:1160 [inline] register_kprobe kernel/kprobes.c:1641 [inline] register_kprobe+0xb6e/0x1690 kernel/kprobes.c:1603 __register_trace_kprobe kernel/trace/trace_kprobe.c:509 [inline] __register_trace_kprobe+0x26a/0x2d0 kernel/trace/trace_kprobe.c:477 create_local_trace_kprobe+0x1f7/0x350 kernel/trace/trace_kprobe.c:1833 perf_kprobe_init+0x18c/0x280 kernel/trace/trace_event_perf.c:271 perf_kprobe_event_init+0xf8/0x1c0 kernel/events/core.c:9888 perf_try_init_event+0x12d/0x570 kernel/events/core.c:11261 perf_init_event kernel/events/core.c:11325 [inline] perf_event_alloc.part.0+0xf7f/0x36a0 kernel/events/core.c:11619 perf_event_alloc kernel/events/core.c:12059 [inline] __do_sys_perf_event_open+0x4a8/0x2a00 kernel/events/core.c:12157 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f63ef7efaed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f63eef63028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007f63ef90ff80 RCX: 00007f63ef7efaed RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 00000000200001c0 RBP: 00007f63ef86019c R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000002 R14: 00007f63ef90ff80 R15: 00007f63eef43000 Modules linked in: CR2: fffffbfff3ac6000 Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee ---[ end trace 0000000000000000 ]--- RIP: 0010:__insn_get_emulate_prefix arch/x86/lib/insn.c:91 [inline] RIP: 0010:insn_get_emulate_prefix arch/x86/lib/insn.c:106 [inline] RIP: 0010:insn_get_prefixes.part.0+0xa8/0x1110 arch/x86/lib/insn.c:134 Code: 49 be 00 00 00 00 00 fc ff df 48 8b 40 60 48 89 44 24 08 e9 81 00 00 = 00 e8 e5 4b 39 ff 4c 89 fa 4c 89 f9 48 c1 ea 03 83 e1 07 <42> 0f b6 14 32 3= 8 ca 7f 08 84 d2 0f 85 06 10 00 00 48 89 d8 48 89 RSP: 0018:ffffc900088bf860 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffffffff9b9bebc0 RCX: 0000000000000000 RDX: 1ffffffff3ac6000 RSI: ffffc90002d82000 RDI: ffffc900088bf9e8 RBP: ffffffff9d630001 R08: 0000000000000000 R09: ffffc900088bf9e8 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff9d630000 R14: dffffc0000000000 R15: ffffffff9d630000 FS: 00007f63eef63640(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff3ac6000 CR3: 0000000029d90005 CR4: 0000000000770ef0 PKRU: 55555554 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Link: https://lkml.kernel.org/r/20220907200917.654103-1-lk@c--e.de cc: "Naveen N. Rao" cc: Anil S Keshavamurthy cc: "David S. Miller" Cc: stable@vger.kernel.org Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Christian A. Ehrhardt Signed-off-by: Steven Rostedt (Google) Signed-off-by: Greg Kroah-Hartman --- kernel/kprobes.c | 1 + 1 file changed, 1 insertion(+) --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1568,6 +1568,7 @@ static int check_kprobe_address_safe(str /* Ensure it is not in reserved area nor out of text */ if (!(core_kernel_text((unsigned long) p->addr) || is_module_text_address((unsigned long) p->addr)) || + in_gate_area_no_mm((unsigned long) p->addr) || within_kprobe_blacklist((unsigned long) p->addr) || jump_label_text_reserved(p->addr, p->addr) || find_bug((unsigned long)p->addr)) { From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6326BC6FA82 for ; Tue, 13 Sep 2022 16:00:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234010AbiIMQA4 (ORCPT ); Tue, 13 Sep 2022 12:00:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54942 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235573AbiIMQAI (ORCPT ); Tue, 13 Sep 2022 12:00:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5854D956BC; Tue, 13 Sep 2022 07:58:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 914FC614EB; Tue, 13 Sep 2022 14:33:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 86939C433D6; Tue, 13 Sep 2022 14:33:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079593; bh=JBXl8o5PzldYcwYjx7aTRdDFZwXaECqL96GgEg8CeJY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=muZ/cOFDI7NSa9PYHpAgvLvt/eQV1jg5szRSoGMHJXrJXDYPMTwU3gmq6BkRbcgG9 U6QgjoZXr/laKwXy4wHKcyrnowKwHqLY/fzEYoyMcGYAiJPtAf397CP7v0ji0gsd/l tnQ6ER2SN9fhu6Sf8S9DiWPacxFswdV8yX1t7TLE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Kuyo Chang Subject: [PATCH 4.19 61/79] debugfs: add debugfs_lookup_and_remove() Date: Tue, 13 Sep 2022 16:07:19 +0200 Message-Id: <20220913140351.839626204@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Greg Kroah-Hartman commit dec9b2f1e0455a151a7293c367da22ab973f713e upstream. There is a very common pattern of using debugfs_remove(debufs_lookup(..)) which results in a dentry leak of the dentry that was looked up. Instead of having to open-code the correct pattern of calling dput() on the dentry, create debugfs_lookup_and_remove() to handle this pattern automatically and properly without any memory leaks. Cc: stable Reported-by: Kuyo Chang Tested-by: Kuyo Chang Link: https://lore.kernel.org/r/YxIaQ8cSinDR881k@kroah.com Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- fs/debugfs/inode.c | 22 ++++++++++++++++++++++ include/linux/debugfs.h | 6 ++++++ 2 files changed, 28 insertions(+) --- a/fs/debugfs/inode.c +++ b/fs/debugfs/inode.c @@ -767,6 +767,28 @@ void debugfs_remove_recursive(struct den EXPORT_SYMBOL_GPL(debugfs_remove_recursive); =20 /** + * debugfs_lookup_and_remove - lookup a directory or file and recursively = remove it + * @name: a pointer to a string containing the name of the item to look up. + * @parent: a pointer to the parent dentry of the item. + * + * This is the equlivant of doing something like + * debugfs_remove(debugfs_lookup(..)) but with the proper reference counti= ng + * handled for the directory being looked up. + */ +void debugfs_lookup_and_remove(const char *name, struct dentry *parent) +{ + struct dentry *dentry; + + dentry =3D debugfs_lookup(name, parent); + if (!dentry) + return; + + debugfs_remove(dentry); + dput(dentry); +} +EXPORT_SYMBOL_GPL(debugfs_lookup_and_remove); + +/** * debugfs_rename - rename a file/directory in the debugfs filesystem * @old_dir: a pointer to the parent dentry for the renamed object. This * should be a directory dentry. --- a/include/linux/debugfs.h +++ b/include/linux/debugfs.h @@ -85,6 +85,8 @@ struct dentry *debugfs_create_automount( void debugfs_remove(struct dentry *dentry); void debugfs_remove_recursive(struct dentry *dentry); =20 +void debugfs_lookup_and_remove(const char *name, struct dentry *parent); + const struct file_operations *debugfs_real_fops(const struct file *filp); =20 int debugfs_file_get(struct dentry *dentry); @@ -217,6 +219,10 @@ static inline void debugfs_remove(struct static inline void debugfs_remove_recursive(struct dentry *dentry) { } =20 +static inline void debugfs_lookup_and_remove(const char *name, + struct dentry *parent) +{ } + const struct file_operations *debugfs_real_fops(const struct file *filp); =20 static inline int debugfs_file_get(struct dentry *dentry) From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE18FC54EE9 for ; Tue, 13 Sep 2022 15:35:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236531AbiIMPfD (ORCPT ); Tue, 13 Sep 2022 11:35:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50526 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236586AbiIMPc6 (ORCPT ); Tue, 13 Sep 2022 11:32:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 002A47F0B6; Tue, 13 Sep 2022 07:40:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6FECBB80F62; Tue, 13 Sep 2022 14:33:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA006C433D7; Tue, 13 Sep 2022 14:33:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079598; bh=pBxHjKhIi1YaSc2ADH48gtnCcI/1AeG6qf+74fj2XYU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VZ+x/+uaJV2jZTLvJ0SG5/RB/XnL2vyRYFtqrX1o+KnsHEaf0RR/8stO1zKBb6emL p84xzLPml3jdyd3LSyKhSZaiuIafAL4TXb0RPBvnaaxI/6c1uS1m8u5jWsvufuXL4c IqYw0EKPE20/bvcTtoQ56JH/h2TX/QRpEFoy0+ZI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sreekanth Reddy , "Martin K. Petersen" Subject: [PATCH 4.19 62/79] scsi: mpt3sas: Fix use-after-free warning Date: Tue, 13 Sep 2022 16:07:20 +0200 Message-Id: <20220913140351.882525191@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sreekanth Reddy commit 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34 upstream. Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6= /0xf0 Link: https://lore.kernel.org/r/20220906134908.1039-2-sreekanth.reddy@broad= com.com Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c @@ -3215,6 +3215,7 @@ static struct fw_event_work *dequeue_nex fw_event =3D list_first_entry(&ioc->fw_event_list, struct fw_event_work, list); list_del_init(&fw_event->list); + fw_event_work_put(fw_event); } spin_unlock_irqrestore(&ioc->fw_event_lock, flags); =20 @@ -3249,7 +3250,6 @@ _scsih_fw_event_cleanup_queue(struct MPT if (cancel_work_sync(&fw_event->work)) fw_event_work_put(fw_event); =20 - fw_event_work_put(fw_event); } } From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A0C0C6FA82 for ; Tue, 13 Sep 2022 17:45:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229961AbiIMRpC (ORCPT ); Tue, 13 Sep 2022 13:45:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233455AbiIMRoc (ORCPT ); Tue, 13 Sep 2022 13:44:32 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9ADE45FF7D; Tue, 13 Sep 2022 09:40:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 18FF3B80FAC; Tue, 13 Sep 2022 14:33:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82F0AC4314E; Tue, 13 Sep 2022 14:33:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079600; bh=5zgtdzP6Uj3MhmAN1sLcUUmjwImUtlCWT3xicPNs8Vo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MC6WB++Thc4O4SQzcvZt5YctE/OgsFtSy3DAm9wNWVKttCj/3IFZCf8DEtLaR+HDC ClSxgCD2n1k8dxLOL6dcGpnZ7gxYmGabcZc/RFwGWkCdPkCN3sWNxNwYOr+0YVm5yt rq5459ncGX04u1ZUVhok/UvW/hz4bJ8OaLTFBR7s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Florian Fainelli , Sasha Levin Subject: [PATCH 4.19 63/79] soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs Date: Tue, 13 Sep 2022 16:07:21 +0200 Message-Id: <20220913140351.938232316@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 1085f5080647f0c9f357c270a537869191f7f2a1 ] In brcmstb_pm_probe(), there are two kinds of leak bugs: (1) we need to add of_node_put() when for_each__matching_node() breaks (2) we need to add iounmap() for each iomap in fail path Fixes: 0b741b8234c8 ("soc: bcm: brcmstb: Add support for S2/S3/S5 suspend s= tates (ARM)") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220707015620.306468-1-windhl@126.com Signed-off-by: Florian Fainelli Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/soc/bcm/brcmstb/pm/pm-arm.c | 50 ++++++++++++++++++++++------- 1 file changed, 39 insertions(+), 11 deletions(-) diff --git a/drivers/soc/bcm/brcmstb/pm/pm-arm.c b/drivers/soc/bcm/brcmstb/= pm/pm-arm.c index f4ad45a1efabe..fd124e0850207 100644 --- a/drivers/soc/bcm/brcmstb/pm/pm-arm.c +++ b/drivers/soc/bcm/brcmstb/pm/pm-arm.c @@ -689,13 +689,14 @@ static int brcmstb_pm_probe(struct platform_device *p= dev) const struct of_device_id *of_id =3D NULL; struct device_node *dn; void __iomem *base; - int ret, i; + int ret, i, s; =20 /* AON ctrl registers */ base =3D brcmstb_ioremap_match(aon_ctrl_dt_ids, 0, NULL); if (IS_ERR(base)) { pr_err("error mapping AON_CTRL\n"); - return PTR_ERR(base); + ret =3D PTR_ERR(base); + goto aon_err; } ctrl.aon_ctrl_base =3D base; =20 @@ -705,8 +706,10 @@ static int brcmstb_pm_probe(struct platform_device *pd= ev) /* Assume standard offset */ ctrl.aon_sram =3D ctrl.aon_ctrl_base + AON_CTRL_SYSTEM_DATA_RAM_OFS; + s =3D 0; } else { ctrl.aon_sram =3D base; + s =3D 1; } =20 writel_relaxed(0, ctrl.aon_sram + AON_REG_PANIC); @@ -716,7 +719,8 @@ static int brcmstb_pm_probe(struct platform_device *pde= v) (const void **)&ddr_phy_data); if (IS_ERR(base)) { pr_err("error mapping DDR PHY\n"); - return PTR_ERR(base); + ret =3D PTR_ERR(base); + goto ddr_phy_err; } ctrl.support_warm_boot =3D ddr_phy_data->supports_warm_boot; ctrl.pll_status_offset =3D ddr_phy_data->pll_status_offset; @@ -736,17 +740,20 @@ static int brcmstb_pm_probe(struct platform_device *p= dev) for_each_matching_node(dn, ddr_shimphy_dt_ids) { i =3D ctrl.num_memc; if (i >=3D MAX_NUM_MEMC) { + of_node_put(dn); pr_warn("too many MEMCs (max %d)\n", MAX_NUM_MEMC); break; } =20 base =3D of_io_request_and_map(dn, 0, dn->full_name); if (IS_ERR(base)) { + of_node_put(dn); if (!ctrl.support_warm_boot) break; =20 pr_err("error mapping DDR SHIMPHY %d\n", i); - return PTR_ERR(base); + ret =3D PTR_ERR(base); + goto ddr_shimphy_err; } ctrl.memcs[i].ddr_shimphy_base =3D base; ctrl.num_memc++; @@ -757,14 +764,18 @@ static int brcmstb_pm_probe(struct platform_device *p= dev) for_each_matching_node(dn, brcmstb_memc_of_match) { base =3D of_iomap(dn, 0); if (!base) { + of_node_put(dn); pr_err("error mapping DDR Sequencer %d\n", i); - return -ENOMEM; + ret =3D -ENOMEM; + goto brcmstb_memc_err; } =20 of_id =3D of_match_node(brcmstb_memc_of_match, dn); if (!of_id) { iounmap(base); - return -EINVAL; + of_node_put(dn); + ret =3D -EINVAL; + goto brcmstb_memc_err; } =20 ddr_seq_data =3D of_id->data; @@ -784,21 +795,24 @@ static int brcmstb_pm_probe(struct platform_device *p= dev) dn =3D of_find_matching_node(NULL, sram_dt_ids); if (!dn) { pr_err("SRAM not found\n"); - return -EINVAL; + ret =3D -EINVAL; + goto brcmstb_memc_err; } =20 ret =3D brcmstb_init_sram(dn); of_node_put(dn); if (ret) { pr_err("error setting up SRAM for PM\n"); - return ret; + goto brcmstb_memc_err; } =20 ctrl.pdev =3D pdev; =20 ctrl.s3_params =3D kmalloc(sizeof(*ctrl.s3_params), GFP_KERNEL); - if (!ctrl.s3_params) - return -ENOMEM; + if (!ctrl.s3_params) { + ret =3D -ENOMEM; + goto s3_params_err; + } ctrl.s3_params_pa =3D dma_map_single(&pdev->dev, ctrl.s3_params, sizeof(*ctrl.s3_params), DMA_TO_DEVICE); @@ -818,7 +832,21 @@ static int brcmstb_pm_probe(struct platform_device *pd= ev) =20 out: kfree(ctrl.s3_params); - +s3_params_err: + iounmap(ctrl.boot_sram); +brcmstb_memc_err: + for (i--; i >=3D 0; i--) + iounmap(ctrl.memcs[i].ddr_ctrl); +ddr_shimphy_err: + for (i =3D 0; i < ctrl.num_memc; i++) + iounmap(ctrl.memcs[i].ddr_shimphy_base); + + iounmap(ctrl.memcs[0].ddr_phy_base); +ddr_phy_err: + iounmap(ctrl.aon_ctrl_base); + if (s) + iounmap(ctrl.aon_sram); +aon_err: pr_warn("PM: initialization failed with code %d\n", ret); =20 return ret; --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22D96C54EE9 for ; Tue, 13 Sep 2022 15:20:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235976AbiIMPUe (ORCPT ); Tue, 13 Sep 2022 11:20:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39362 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235952AbiIMPSi (ORCPT ); Tue, 13 Sep 2022 11:18:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0759F79A4F; Tue, 13 Sep 2022 07:35:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DEDD1B80EFA; Tue, 13 Sep 2022 14:33:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4C34CC433C1; Tue, 13 Sep 2022 14:33:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079603; bh=eHBm7y0fVUA8Gl2U1lMAhWBmoOpB3KW/PvPqGbc644w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=isfCVlHHCLptsnpQn6+G2ZvWF6dzHViE9Vkn21hauyCRSVX34HgoMpOodPWlfo1Al 1fd6Zq6y7XgfmalUTx/YM/h0MySisbShUss7zOVwYiHKJwdBT6v5Fch7EVZSp+qOQ/ OmQeoicTIXH2Cj4QTaVfZ0jJ9G+ShWhkBroCQHUQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Harsh Modi , Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.19 64/79] netfilter: br_netfilter: Drop dst references before setting. Date: Tue, 13 Sep 2022 16:07:22 +0200 Message-Id: <20220913140351.979662545@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Harsh Modi [ Upstream commit d047283a7034140ea5da759a494fd2274affdd46 ] The IPv6 path already drops dst in the daddr changed case, but the IPv4 path does not. This change makes the two code paths consistent. Further, it is possible that there is already a metadata_dst allocated from ingress that might already be attached to skbuff->dst while following the bridge path. If it is not released before setting a new metadata_dst, it will be leaked. This is similar to what is done in bpf_set_tunnel_key() or ip6_route_input(). It is important to note that the memory being leaked is not the dst being set in the bridge code, but rather memory allocated from some other code path that is not being freed correctly before the skb dst is overwritten. An example of the leakage fixed by this commit found using kmemleak: unreferenced object 0xffff888010112b00 (size 256): comm "softirq", pid 0, jiffies 4294762496 (age 32.012s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 80 16 f1 83 ff ff ff ff ................ e1 4e f6 82 ff ff ff ff 00 00 00 00 00 00 00 00 .N.............. backtrace: [<00000000d79567ea>] metadata_dst_alloc+0x1b/0xe0 [<00000000be113e13>] udp_tun_rx_dst+0x174/0x1f0 [<00000000a36848f4>] geneve_udp_encap_recv+0x350/0x7b0 [<00000000d4afb476>] udp_queue_rcv_one_skb+0x380/0x560 [<00000000ac064aea>] udp_unicast_rcv_skb+0x75/0x90 [<000000009a8ee8c5>] ip_protocol_deliver_rcu+0xd8/0x230 [<00000000ef4980bb>] ip_local_deliver_finish+0x7a/0xa0 [<00000000d7533c8c>] __netif_receive_skb_one_core+0x89/0xa0 [<00000000a879497d>] process_backlog+0x93/0x190 [<00000000e41ade9f>] __napi_poll+0x28/0x170 [<00000000b4c0906b>] net_rx_action+0x14f/0x2a0 [<00000000b20dd5d4>] __do_softirq+0xf4/0x305 [<000000003a7d7e15>] __irq_exit_rcu+0xc3/0x140 [<00000000968d39a2>] sysvec_apic_timer_interrupt+0x9e/0xc0 [<000000009e920794>] asm_sysvec_apic_timer_interrupt+0x16/0x20 [<000000008942add0>] native_safe_halt+0x13/0x20 Florian Westphal says: "Original code was likely fine because nothing ever did set a skb->dst entry earlier than bridge in those days." Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Harsh Modi Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/bridge/br_netfilter_hooks.c | 2 ++ net/bridge/br_netfilter_ipv6.c | 1 + 2 files changed, 3 insertions(+) diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hook= s.c index 55c7cdf5e7b83..35642dc96852a 100644 --- a/net/bridge/br_netfilter_hooks.c +++ b/net/bridge/br_netfilter_hooks.c @@ -385,6 +385,7 @@ static int br_nf_pre_routing_finish(struct net *net, st= ruct sock *sk, struct sk_ /* - Bridged-and-DNAT'ed traffic doesn't * require ip_forwarding. */ if (rt->dst.dev =3D=3D dev) { + skb_dst_drop(skb); skb_dst_set(skb, &rt->dst); goto bridged_dnat; } @@ -414,6 +415,7 @@ static int br_nf_pre_routing_finish(struct net *net, st= ruct sock *sk, struct sk_ kfree_skb(skb); return 0; } + skb_dst_drop(skb); skb_dst_set_noref(skb, &rt->dst); } =20 diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c index 09d5e0c7b3ba4..995d86777e7cb 100644 --- a/net/bridge/br_netfilter_ipv6.c +++ b/net/bridge/br_netfilter_ipv6.c @@ -201,6 +201,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *ne= t, struct sock *sk, struc kfree_skb(skb); return 0; } + skb_dst_drop(skb); skb_dst_set_noref(skb, &rt->dst); } =20 --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA11BC6FA82 for ; Tue, 13 Sep 2022 15:16:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235786AbiIMPQ1 (ORCPT ); Tue, 13 Sep 2022 11:16:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42638 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235798AbiIMPNx (ORCPT ); Tue, 13 Sep 2022 11:13:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6F4CE786D4; Tue, 13 Sep 2022 07:33:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 63E5EB80ECE; Tue, 13 Sep 2022 14:33:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CAA77C433D6; Tue, 13 Sep 2022 14:33:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079606; bh=ELc75oE5bzpmDnbQtxYYX875CwBCIPaZsO8BHKttdkI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U+mLwYGDvG6bTUHQcfs6/7QwTd6iZVWBatQchylODAJiit1ieLpfRL4YoDALLv2L1 G0jj7MGx/ZfdiaSpbXKOHWwV6RtUFUAe2RxZBBKqPVndPIvlCM8qsbjH8cZZnExP4N KWIzNH36IDg7Wq6WAZNYJbiBCNK2fRp7hnQuTRBg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Leadbeater , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 4.19 65/79] netfilter: nf_conntrack_irc: Fix forged IP logic Date: Tue, 13 Sep 2022 16:07:23 +0200 Message-Id: <20220913140352.023847282@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Leadbeater [ Upstream commit 0efe125cfb99e6773a7434f3463f7c2fa28f3a43 ] Ensure the match happens in the right direction, previously the destination used was the server, not the NAT host, as the comment shows the code intended. Additionally nf_nat_irc uses port 0 as a signal and there's no valid way it can appear in a DCC message, so consider port 0 also forged. Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port= ") Signed-off-by: David Leadbeater Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/netfilter/nf_conntrack_irc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_= irc.c index 4099f4d79bae7..b7436935b57d0 100644 --- a/net/netfilter/nf_conntrack_irc.c +++ b/net/netfilter/nf_conntrack_irc.c @@ -187,8 +187,9 @@ static int help(struct sk_buff *skb, unsigned int proto= ff, =20 /* dcc_ip can be the internal OR external (NAT'ed) IP */ tuple =3D &ct->tuplehash[dir].tuple; - if (tuple->src.u3.ip !=3D dcc_ip && - tuple->dst.u3.ip !=3D dcc_ip) { + if ((tuple->src.u3.ip !=3D dcc_ip && + ct->tuplehash[!dir].tuple.dst.u3.ip !=3D dcc_ip) || + dcc_port =3D=3D 0) { net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n", &tuple->src.u3.ip, &dcc_ip, dcc_port); --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A04BC54EE9 for ; Tue, 13 Sep 2022 15:17:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235834AbiIMPRK (ORCPT ); Tue, 13 Sep 2022 11:17:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51968 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235909AbiIMPOJ (ORCPT ); Tue, 13 Sep 2022 11:14:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E7756AA18; Tue, 13 Sep 2022 07:33:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AA696614C1; Tue, 13 Sep 2022 14:33:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 86F28C433D6; Tue, 13 Sep 2022 14:33:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079609; bh=H1D+QZ2N+wLEuEAv5V5d0q1lZVLlwm/5xn6mWBLYCTw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ke9zG8riVLmOdE9+1U4yXHn70KFEXeNQ3e1IyY5b1GIrOHvbTsY47lcsVO3nriwYC zuozjld4Y8mr9J2/RJNvPZ745N9rRdxQ1LwOVTHsODS7bd/0tDwxU5cU80902Vkn7X wkWf/Ba5n6LAVVXVb84QLFEadrvkwuFUjuihNoiI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , "David S. Miller" , Sasha Levin , zdi-disclosures@trendmicro.com Subject: [PATCH 4.19 66/79] sch_sfb: Dont assume the skb is still around after enqueueing to child Date: Tue, 13 Sep 2022 16:07:24 +0200 Message-Id: <20220913140352.078322905@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Toke H=C3=B8iland-J=C3=B8rgensen [ Upstream commit 9efd23297cca530bb35e1848665805d3fcdd7889 ] The sch_sfb enqueue() routine assumes the skb is still alive after it has been enqueued into a child qdisc, using the data in the skb cb field in the increment_qlen() routine after enqueue. However, the skb may in fact have been freed, causing a use-after-free in this case. In particular, this happens if sch_cake is used as a child of sfb, and the GSO splitting mode of CAKE is enabled (in which case the skb will be split into segments and the original skb freed). Fix this by copying the sfb cb data to the stack before enqueueing the skb, and using this stack copy in increment_qlen() instead of the skb pointer itself. Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18231 Fixes: e13e02a3c68d ("net_sched: SFB flow scheduler") Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/sched/sch_sfb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c index 81d205acb1b6a..38cf065156951 100644 --- a/net/sched/sch_sfb.c +++ b/net/sched/sch_sfb.c @@ -139,15 +139,15 @@ static void increment_one_qlen(u32 sfbhash, u32 slot,= struct sfb_sched_data *q) } } =20 -static void increment_qlen(const struct sk_buff *skb, struct sfb_sched_dat= a *q) +static void increment_qlen(const struct sfb_skb_cb *cb, struct sfb_sched_d= ata *q) { u32 sfbhash; =20 - sfbhash =3D sfb_hash(skb, 0); + sfbhash =3D cb->hashes[0]; if (sfbhash) increment_one_qlen(sfbhash, 0, q); =20 - sfbhash =3D sfb_hash(skb, 1); + sfbhash =3D cb->hashes[1]; if (sfbhash) increment_one_qlen(sfbhash, 1, q); } @@ -287,6 +287,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, struct sfb_sched_data *q =3D qdisc_priv(sch); struct Qdisc *child =3D q->qdisc; struct tcf_proto *fl; + struct sfb_skb_cb cb; int i; u32 p_min =3D ~0; u32 minqlen =3D ~0; @@ -403,11 +404,12 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qd= isc *sch, } =20 enqueue: + memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); ret =3D qdisc_enqueue(skb, child, to_free); if (likely(ret =3D=3D NET_XMIT_SUCCESS)) { qdisc_qstats_backlog_inc(sch, skb); sch->q.qlen++; - increment_qlen(skb, q); + increment_qlen(&cb, q); } else if (net_xmit_drop_count(ret)) { q->stats.childdrop++; qdisc_qstats_drop(sch); --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 041A8C6FA82 for ; Tue, 13 Sep 2022 15:17:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235840AbiIMPRO (ORCPT ); Tue, 13 Sep 2022 11:17:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48260 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235910AbiIMPOJ (ORCPT ); Tue, 13 Sep 2022 11:14:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4AC4B78BC7; Tue, 13 Sep 2022 07:33:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 25A89614AD; Tue, 13 Sep 2022 14:33:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D609C433C1; Tue, 13 Sep 2022 14:33:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079611; bh=MTcVN1WOatZFsoYttHT+VVPnuXzejU8/DkpUg8VI4rw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lIMfAsaiHhudJzGpUKLyB//z4xgnikBEoVJd3DrxNCLO7HDo/E5TVAXpTeneoPU/a 9BMsKgURwRKfj8xXdNaGP2GZnCbfoi7h4QjwtVWNCwTYCKqvyj8WDSZjGhUW8HM0Ij lCfQS8nsH683WTzsPx0kA/k2Rj8IUAZzlCjYP2uU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 67/79] tipc: fix shift wrapping bug in map_get() Date: Tue, 13 Sep 2022 16:07:25 +0200 Message-Id: <20220913140352.132312070@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit e2b224abd9bf45dcb55750479fc35970725a430b ] There is a shift wrapping bug in this code so anything thing above 31 will return false. Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/tipc/monitor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c index 7b6c1c5c30dc8..0268857a3cfed 100644 --- a/net/tipc/monitor.c +++ b/net/tipc/monitor.c @@ -130,7 +130,7 @@ static void map_set(u64 *up_map, int i, unsigned int v) =20 static int map_get(u64 up_map, int i) { - return (up_map & (1 << i)) >> i; + return (up_map & (1ULL << i)) >> i; } =20 static struct tipc_peer *peer_prev(struct tipc_peer *peer) --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC8CDECAAD8 for ; Tue, 13 Sep 2022 17:53:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233638AbiIMRxF (ORCPT ); Tue, 13 Sep 2022 13:53:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56490 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233588AbiIMRwe (ORCPT ); Tue, 13 Sep 2022 13:52:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 07A6E5AA03; Tue, 13 Sep 2022 09:51:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7D4D7614C5; Tue, 13 Sep 2022 14:33:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9AB01C433D6; Tue, 13 Sep 2022 14:33:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079613; bh=k9WCsg3F8LwS5mT0NnuRtzGO5Gc6EwZAzisR2SzGoaA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FUatB5yl4s1tvPLvS/ziAAvo957JZ7BlB56a8AGxxUZD/pU5irD5ZfCs0Y2J5FvXZ asiGO0UylWGQgdYxfiFT3OsT0+XAlXy5dlEyKz+UzWJreiyksbQf1EJXp1KUqatBPP YpVj6DlTJ7wcyk0SkahVXEzqIBoXQ/t4yy0B3uZc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ivan Vecera , Helena Anna Dubel , Tony Nguyen , Sasha Levin Subject: [PATCH 4.19 68/79] i40e: Fix kernel crash during module removal Date: Tue, 13 Sep 2022 16:07:26 +0200 Message-Id: <20220913140352.179891540@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ivan Vecera [ Upstream commit fb8396aeda5872369a8ed6d2301e2c86e303c520 ] The driver incorrectly frees client instance and subsequent i40e module removal leads to kernel crash. Reproducer: 1. Do ethtool offline test followed immediately by another one host# ethtool -t eth0 offline; ethtool -t eth0 offline 2. Remove recursively irdma module that also removes i40e module host# modprobe -r irdma Result: [ 8675.035651] i40e 0000:3d:00.0 eno1: offline testing starting [ 8675.193774] i40e 0000:3d:00.0 eno1: testing finished [ 8675.201316] i40e 0000:3d:00.0 eno1: offline testing starting [ 8675.358921] i40e 0000:3d:00.0 eno1: testing finished [ 8675.496921] i40e 0000:3d:00.0: IRDMA hardware initialization FAILED init= _state=3D2 status=3D-110 [ 8686.188955] i40e 0000:3d:00.1: i40e_ptp_stop: removed PHC on eno2 [ 8686.943890] i40e 0000:3d:00.1: Deleted LAN device PF1 bus=3D0x3d dev=3D0= x00 func=3D0x01 [ 8686.952669] i40e 0000:3d:00.0: i40e_ptp_stop: removed PHC on eno1 [ 8687.761787] BUG: kernel NULL pointer dereference, address: 0000000000000= 030 [ 8687.768755] #PF: supervisor read access in kernel mode [ 8687.773895] #PF: error_code(0x0000) - not-present page [ 8687.779034] PGD 0 P4D 0 [ 8687.781575] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 8687.785935] CPU: 51 PID: 172891 Comm: rmmod Kdump: loaded Tainted: G = W I 5.19.0+ #2 [ 8687.794800] Hardware name: Intel Corporation S2600WFD/S2600WFD, BIOS SE5= C620.86B.0X.02.0001.051420190324 05/14/2019 [ 8687.805222] RIP: 0010:i40e_lan_del_device+0x13/0xb0 [i40e] [ 8687.810719] Code: d4 84 c0 0f 84 b8 25 01 00 e9 9c 25 01 00 41 bc f4 ff = ff ff eb 91 90 0f 1f 44 00 00 41 54 55 53 48 8b 87 58 08 00 00 48 89 fb <48= > 8b 68 30 48 89 ef e8 21 8a 0f d5 48 89 ef e8 a9 78 0f d5 48 8b [ 8687.829462] RSP: 0018:ffffa604072efce0 EFLAGS: 00010202 [ 8687.834689] RAX: 0000000000000000 RBX: ffff8f43833b2000 RCX: 00000000000= 00000 [ 8687.841821] RDX: 0000000000000000 RSI: ffff8f4b0545b298 RDI: ffff8f43833= b2000 [ 8687.848955] RBP: ffff8f43833b2000 R08: 0000000000000001 R09: 00000000000= 00000 [ 8687.856086] R10: 0000000000000000 R11: 000ffffffffff000 R12: ffff8f43833= b2ef0 [ 8687.863218] R13: ffff8f43833b2ef0 R14: ffff915103966000 R15: ffff8f43833= b2008 [ 8687.870342] FS: 00007f79501c3740(0000) GS:ffff8f4adffc0000(0000) knlGS:= 0000000000000000 [ 8687.878427] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8687.884174] CR2: 0000000000000030 CR3: 000000014276e004 CR4: 00000000007= 706e0 [ 8687.891306] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000= 00000 [ 8687.898441] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000= 00400 [ 8687.905572] PKRU: 55555554 [ 8687.908286] Call Trace: [ 8687.910737] [ 8687.912843] i40e_remove+0x2c0/0x330 [i40e] [ 8687.917040] pci_device_remove+0x33/0xa0 [ 8687.920962] device_release_driver_internal+0x1aa/0x230 [ 8687.926188] driver_detach+0x44/0x90 [ 8687.929770] bus_remove_driver+0x55/0xe0 [ 8687.933693] pci_unregister_driver+0x2a/0xb0 [ 8687.937967] i40e_exit_module+0xc/0xf48 [i40e] Two offline tests cause IRDMA driver failure (ETIMEDOUT) and this failure is indicated back to i40e_client_subtask() that calls i40e_client_del_instance() to free client instance referenced by pf->cinst and sets this pointer to NULL. During the module removal i40e_remove() calls i40e_lan_del_device() that dereferences pf->cinst that is NULL -> crash. Do not remove client instance when client open callbacks fails and just clear __I40E_CLIENT_INSTANCE_OPENED bit. The driver also needs to take care about this situation (when netdev is up and client is NOT opened) in i40e_notify_client_of_netdev_close() and calls client close callback only when __I40E_CLIENT_INSTANCE_OPENED is set. Fixes: 0ef2d5afb12d ("i40e: KISS the client interface") Signed-off-by: Ivan Vecera Tested-by: Helena Anna Dubel Signed-off-by: Tony Nguyen Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/i40e/i40e_client.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/et= hernet/intel/i40e/i40e_client.c index c1832a8487140..2fa4becdaee92 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_client.c +++ b/drivers/net/ethernet/intel/i40e/i40e_client.c @@ -178,6 +178,10 @@ void i40e_notify_client_of_netdev_close(struct i40e_vs= i *vsi, bool reset) "Cannot locate client instance close routine\n"); return; } + if (!test_bit(__I40E_CLIENT_INSTANCE_OPENED, &cdev->state)) { + dev_dbg(&pf->pdev->dev, "Client is not open, abort close\n"); + return; + } cdev->client->ops->close(&cdev->lan_info, cdev->client, reset); clear_bit(__I40E_CLIENT_INSTANCE_OPENED, &cdev->state); i40e_client_release_qvlist(&cdev->lan_info); @@ -376,7 +380,6 @@ void i40e_client_subtask(struct i40e_pf *pf) /* Remove failed client instance */ clear_bit(__I40E_CLIENT_INSTANCE_OPENED, &cdev->state); - i40e_client_del_instance(pf); return; } } --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5AF1C6FA82 for ; Tue, 13 Sep 2022 15:39:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234918AbiIMPjv (ORCPT ); Tue, 13 Sep 2022 11:39:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52554 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236751AbiIMPiz (ORCPT ); Tue, 13 Sep 2022 11:38:55 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 38C061D312; Tue, 13 Sep 2022 07:44:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 301ED614E8; Tue, 13 Sep 2022 14:32:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 37A84C433D6; Tue, 13 Sep 2022 14:32:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079566; bh=tX03YbG5xQzb4/Y3x2p/k5J6xQjGknZ9Qh7bB8dvKcY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=inyzrq5z1xoGVXK/ketVINcy5lTh+6DmimwNH+S1Xf0+UQDcldb5mdeXdhuSuYzw5 2wQbWkk/wCUStxWJ77UGW2lD3oZHTNY4dph/muZ36PvGfuCdneaixwKHdscsDI5h+6 HQFg8OvLRM9kK1GZ1AF7BaMOjNMiKwc8f5fwYqLU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lucas Leong , David Lebrun , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 69/79] ipv6: sr: fix out-of-bounds read when setting HMAC data. Date: Tue, 13 Sep 2022 16:07:27 +0200 Message-Id: <20220913140352.232989050@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Lebrun [ Upstream commit 84a53580c5d2138c7361c7c3eea5b31827e63b35 ] The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN= and SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actu= al length of the SECRET attribute, it is possible to provide invalid combinati= ons (e.g., secret =3D "", secretlen =3D 64). This case is not checked in the co= de and with an appropriately crafted netlink message, an out-of-bounds read of up to 64 bytes (max secret length) can occur past the skb end pointer and into skb_shared_info: Breakpoint 1, seg6_genl_sethmac (skb=3D, info=3D) at net/ipv6/seg6.c:208 208 memcpy(hinfo->secret, secret, slen); (gdb) bt #0 seg6_genl_sethmac (skb=3D, info=3D) at n= et/ipv6/seg6.c:208 #1 0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=3Dskb@entry=3D0xff= ff88800b1f9f00, nlh=3Dnlh@entry=3D0xffff88800b1b7600, extack=3Dextack@entry=3D0xffffc90000ba7af0, ops=3Dops@entry=3D0xffffc90= 000ba7a80, hdrlen=3D4, net=3D0xffffffff84237580 , family=3D, family=3D) at net/netlink/genetlink.c:731 #2 0xffffffff81e01435 in genl_family_rcv_msg (extack=3D0xffffc90000ba7af0= , nlh=3D0xffff88800b1b7600, skb=3D0xffff88800b1f9f00, family=3D0xffffffff82fef6c0 ) at net/netlink/genetlin= k.c:775 #3 genl_rcv_msg (skb=3D0xffff88800b1f9f00, nlh=3D0xffff88800b1b7600, exta= ck=3D0xffffc90000ba7af0) at net/netlink/genetlink.c:792 #4 0xffffffff81dfffc3 in netlink_rcv_skb (skb=3Dskb@entry=3D0xffff88800b1= f9f00, cb=3Dcb@entry=3D0xffffffff81e01350 ) at net/netlink/af_netlink.c:2501 #5 0xffffffff81e00919 in genl_rcv (skb=3D0xffff88800b1f9f00) at net/netli= nk/genetlink.c:803 #6 0xffffffff81dff6ae in netlink_unicast_kernel (ssk=3D0xffff888010eec800= , skb=3D0xffff88800b1f9f00, sk=3D0xffff888004aed000) at net/netlink/af_netlink.c:1319 #7 netlink_unicast (ssk=3Dssk@entry=3D0xffff888010eec800, skb=3Dskb@entry= =3D0xffff88800b1f9f00, portid=3Dportid@entry=3D0, nonblock=3D) at net/netlink/af_netlink.c:1345 #8 0xffffffff81dff9a4 in netlink_sendmsg (sock=3D, msg=3D0= xffffc90000ba7e48, len=3D) at net/netlink/af_netlink.c:1921 ... (gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)->head + ((struct sk_buff *= )0xffff88800b1f9f00)->end $1 =3D 0xffff88800b1b76c0 (gdb) p/x secret $2 =3D 0xffff88800b1b76c0 (gdb) p slen $3 =3D 64 '@' The OOB data can then be read back from userspace by dumping HMAC state. Th= is commit fixes this by ensuring SECRETLEN cannot exceed the actual length of SECRET. Reported-by: Lucas Leong Tested: verified that EINVAL is correctly returned when secretlen > len(sec= ret) Fixes: 4f4853dc1c9c1 ("ipv6: sr: implement API to control SR HMAC structure= ") Signed-off-by: David Lebrun Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/ipv6/seg6.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c index 9b2f272ca1649..89d55770ac74b 100644 --- a/net/ipv6/seg6.c +++ b/net/ipv6/seg6.c @@ -130,6 +130,11 @@ static int seg6_genl_sethmac(struct sk_buff *skb, stru= ct genl_info *info) goto out_unlock; } =20 + if (slen > nla_len(info->attrs[SEG6_ATTR_SECRET])) { + err =3D -EINVAL; + goto out_unlock; + } + if (hinfo) { err =3D seg6_hmac_info_del(net, hmackeyid); if (err) --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0993C6FA82 for ; Tue, 13 Sep 2022 15:33:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233552AbiIMPdA (ORCPT ); Tue, 13 Sep 2022 11:33:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57554 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236591AbiIMPcD (ORCPT ); Tue, 13 Sep 2022 11:32:03 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A99817F0A4; Tue, 13 Sep 2022 07:40:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 61D5DB80F4B; Tue, 13 Sep 2022 14:32:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2709C433C1; Tue, 13 Sep 2022 14:32:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079569; bh=VvSTHLgcd1Hfj+ta/4Id3kr+s9ZO/nWJjkvzyQW4gPE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jXqZyGs21V6IQ4vx+x45bP80LrCKUBZjVy3eoJaCenWMVJ9TlIHS4+tGvq4e6U7t2 v/nno8T+yKSJfDddImdPu1sX2XMEr9UU9t56amE/6f0d1dAX4jvVhQgH/Fy33Uc72z TaCsAartNHGM7TrPdZ0facTunPhAcpR7+gmcS2HU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Bloch , Chris Mi , Leon Romanovsky , Sasha Levin Subject: [PATCH 4.19 70/79] RDMA/mlx5: Set local port to one when accessing counters Date: Tue, 13 Sep 2022 16:07:28 +0200 Message-Id: <20220913140352.284380067@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chris Mi [ Upstream commit 74b30b3ad5cec95d2647e796d10137438a098bc1 ] When accessing Ports Performance Counters Register (PPCNT), local port must be one if it is Function-Per-Port HCA that HCA_CAP.num_ports is 1. The offending patch can change the local port to other values when accessing PPCNT after enabling switchdev mode. The following syndrome will be printed: # cat /sys/class/infiniband/rdmap4s0f0/ports/2/counters/* # dmesg mlx5_core 0000:04:00.0: mlx5_cmd_check:756:(pid 12450): ACCESS_REG(0x805) = op_mod(0x1) failed, status bad parameter(0x3), syndrome (0x1e5585) Fix it by setting local port to one for Function-Per-Port HCA. Fixes: 210b1f78076f ("IB/mlx5: When not in dual port RoCE mode, use provide= d port as native") Reviewed-by: Mark Bloch Signed-off-by: Chris Mi Link: https://lore.kernel.org/r/6c5086c295c76211169e58dbd610fb0402360bab.16= 61763459.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/infiniband/hw/mlx5/mad.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/= mad.c index cdf6e26ebc87d..fb6dcd12db254 100644 --- a/drivers/infiniband/hw/mlx5/mad.c +++ b/drivers/infiniband/hw/mlx5/mad.c @@ -216,6 +216,12 @@ static int process_pma_cmd(struct mlx5_ib_dev *dev, u8= port_num, mdev =3D dev->mdev; mdev_port_num =3D 1; } + if (MLX5_CAP_GEN(dev->mdev, num_ports) =3D=3D 1) { + /* set local port to one for Function-Per-Port HCA. */ + mdev =3D dev->mdev; + mdev_port_num =3D 1; + } + /* Declaring support of extended counters */ if (in_mad->mad_hdr.attr_id =3D=3D IB_PMA_CLASS_PORT_INFO) { struct ib_class_port_info cpi =3D {}; --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 119A8C6FA82 for ; Tue, 13 Sep 2022 15:44:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235719AbiIMPof (ORCPT ); Tue, 13 Sep 2022 11:44:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56330 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234280AbiIMPn6 (ORCPT ); Tue, 13 Sep 2022 11:43:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0EA485ABD; Tue, 13 Sep 2022 07:48:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2F9F1B80D87; Tue, 13 Sep 2022 14:32:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8A533C433D6; Tue, 13 Sep 2022 14:32:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079571; bh=ilTAr5nPNvI1E5aLl32zYpZw9kchp8GWq3gidlQZdjk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Fgru0b1sDAfpfoR72OxUM5oyNNbRVabnRAQM2IFubRybSrWknQtJ/n+L38W2oHQTF rX7IsKqpGdXuwsFQ4W10UmSk0tvMuwepfV9q5PRJ1CelNdfnZlrhloOYFD/b3puJJm ZD0MdvxLtnq6SBnXeEOH4alvALX20OjtvFihifhI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nagaraj Arankal , Neal Cardwell , Yuchung Cheng , Eric Dumazet , Paolo Abeni , Sasha Levin Subject: [PATCH 4.19 71/79] tcp: fix early ETIMEDOUT after spurious non-SACK RTO Date: Tue, 13 Sep 2022 16:07:29 +0200 Message-Id: <20220913140352.333113786@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Neal Cardwell [ Upstream commit 686dc2db2a0fdc1d34b424ec2c0a735becd8d62b ] Fix a bug reported and analyzed by Nagaraj Arankal, where the handling of a spurious non-SACK RTO could cause a connection to fail to clear retrans_stamp, causing a later RTO to very prematurely time out the connection with ETIMEDOUT. Here is the buggy scenario, expanding upon Nagaraj Arankal's excellent report: (*1) Send one data packet on a non-SACK connection (*2) Because no ACK packet is received, the packet is retransmitted and we enter CA_Loss; but this retransmission is spurious. (*3) The ACK for the original data is received. The transmitted packet is acknowledged. The TCP timestamp is before the retrans_stamp, so tcp_may_undo() returns true, and tcp_try_undo_loss() returns true without changing state to Open (because tcp_is_sack() is false), and tcp_process_loss() returns without calling tcp_try_undo_recovery(). Normally after undoing a CA_Loss episode, tcp_fastretrans_alert() would see that the connection has returned to CA_Open and fall through and call tcp_try_to_open(), which would set retrans_stamp to 0. However, for non-SACK connections we hold the connection in CA_Loss, so do not fall through to call tcp_try_to_open() and do not set retrans_stamp to 0. So retrans_stamp is (erroneously) still non-zero. At this point the first "retransmission event" has passed and been recovered from. Any future retransmission is a completely new "event". However, retrans_stamp is erroneously still set. (And we are still in CA_Loss, which is correct.) (*4) After 16 minutes (to correspond with tcp_retries2=3D15), a new data packet is sent. Note: No data is transmitted between (*3) and (*4) and we disabled keep alives. The socket's timeout SHOULD be calculated from this point in time, but instead it's calculated from the prior "event" 16 minutes ago (step (*2)). (*5) Because no ACK packet is received, the packet is retransmitted. (*6) At the time of the 2nd retransmission, the socket returns ETIMEDOUT, prematurely, because retrans_stamp is (erroneously) too far in the past (set at the time of (*2)). This commit fixes this bug by ensuring that we reuse in tcp_try_undo_loss() the same careful logic for non-SACK connections that we have in tcp_try_undo_recovery(). To avoid duplicating logic, we factor out that logic into a new tcp_is_non_sack_preventing_reopen() helper and call that helper from both undo functions. Fixes: da34ac7626b5 ("tcp: only undo on partial ACKs in CA_Loss") Reported-by: Nagaraj Arankal Link: https://lore.kernel.org/all/SJ0PR84MB1847BE6C24D274C46A1B9B0EB27A9@SJ= 0PR84MB1847.NAMPRD84.PROD.OUTLOOK.COM/ Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220903121023.866900-1-ncardwell.kernel@gm= ail.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/ipv4/tcp_input.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 0be9d5d3c032f..aac5d5b739268 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -2372,6 +2372,21 @@ static inline bool tcp_may_undo(const struct tcp_soc= k *tp) return tp->undo_marker && (!tp->undo_retrans || tcp_packet_delayed(tp)); } =20 +static bool tcp_is_non_sack_preventing_reopen(struct sock *sk) +{ + struct tcp_sock *tp =3D tcp_sk(sk); + + if (tp->snd_una =3D=3D tp->high_seq && tcp_is_reno(tp)) { + /* Hold old state until something *above* high_seq + * is ACKed. For Reno it is MUST to prevent false + * fast retransmits (RFC2582). SACK TCP is safe. */ + if (!tcp_any_retrans_done(sk)) + tp->retrans_stamp =3D 0; + return true; + } + return false; +} + /* People celebrate: "We love our President!" */ static bool tcp_try_undo_recovery(struct sock *sk) { @@ -2394,14 +2409,8 @@ static bool tcp_try_undo_recovery(struct sock *sk) } else if (tp->rack.reo_wnd_persist) { tp->rack.reo_wnd_persist--; } - if (tp->snd_una =3D=3D tp->high_seq && tcp_is_reno(tp)) { - /* Hold old state until something *above* high_seq - * is ACKed. For Reno it is MUST to prevent false - * fast retransmits (RFC2582). SACK TCP is safe. */ - if (!tcp_any_retrans_done(sk)) - tp->retrans_stamp =3D 0; + if (tcp_is_non_sack_preventing_reopen(sk)) return true; - } tcp_set_ca_state(sk, TCP_CA_Open); tp->is_sack_reneg =3D 0; return false; @@ -2437,6 +2446,8 @@ static bool tcp_try_undo_loss(struct sock *sk, bool f= rto_undo) NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSPURIOUSRTOS); inet_csk(sk)->icsk_retransmits =3D 0; + if (tcp_is_non_sack_preventing_reopen(sk)) + return true; if (frto_undo || tcp_is_sack(tp)) { tcp_set_ca_state(sk, TCP_CA_Open); tp->is_sack_reneg =3D 0; --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3968BC6FA82 for ; Tue, 13 Sep 2022 15:15:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235723AbiIMPPn (ORCPT ); Tue, 13 Sep 2022 11:15:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49130 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235533AbiIMPN1 (ORCPT ); Tue, 13 Sep 2022 11:13:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 76828785AB; Tue, 13 Sep 2022 07:32:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 99779B80EFA; Tue, 13 Sep 2022 14:32:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 16E95C433D6; Tue, 13 Sep 2022 14:32:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079574; bh=TIzN04pQkyRKLFiVtmEGywdFPVpYhSho/zPXVRszR1w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nc0EWZDdSRfP/uhfXq6icSu2gRJ/Miecm+M/gu1TcgcpyrGM3RcCPp2TvZBjo+f+e /HJ3fZfCZicqcdPlznyxc0vMgK1D6lT9/ZYoVADnjW4DowJy7uTeO6E+CLLoKFQl5i 2JCCvt/V6NF/k+P6qFKnPV1r3JVKzT3yzsi9T0KY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Cong Wang , Paolo Abeni , Sasha Levin Subject: [PATCH 4.19 72/79] sch_sfb: Also store skb len before calling child enqueue Date: Tue, 13 Sep 2022 16:07:30 +0200 Message-Id: <20220913140352.375955393@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Toke H=C3=B8iland-J=C3=B8rgensen [ Upstream commit 2f09707d0c972120bf794cfe0f0c67e2c2ddb252 ] Cong Wang noticed that the previous fix for sch_sfb accessing the queued skb after enqueueing it to a child qdisc was incomplete: the SFB enqueue function was also calling qdisc_qstats_backlog_inc() after enqueue, which reads the pkt len from the skb cb field. Fix this by also storing the skb len, and using the stored value to increment the backlog after enqueueing. Fixes: 9efd23297cca ("sch_sfb: Don't assume the skb is still around after e= nqueueing to child") Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen Acked-by: Cong Wang Link: https://lore.kernel.org/r/20220905192137.965549-1-toke@toke.dk Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/sched/sch_sfb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c index 38cf065156951..a8ef8efa62fc0 100644 --- a/net/sched/sch_sfb.c +++ b/net/sched/sch_sfb.c @@ -285,6 +285,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, { =20 struct sfb_sched_data *q =3D qdisc_priv(sch); + unsigned int len =3D qdisc_pkt_len(skb); struct Qdisc *child =3D q->qdisc; struct tcf_proto *fl; struct sfb_skb_cb cb; @@ -407,7 +408,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); ret =3D qdisc_enqueue(skb, child, to_free); if (likely(ret =3D=3D NET_XMIT_SUCCESS)) { - qdisc_qstats_backlog_inc(sch, skb); + sch->qstats.backlog +=3D len; sch->q.qlen++; increment_qlen(&cb, q); } else if (net_xmit_drop_count(ret)) { --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3950C54EE9 for ; Tue, 13 Sep 2022 15:16:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235766AbiIMPQN (ORCPT ); Tue, 13 Sep 2022 11:16:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51832 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235762AbiIMPNo (ORCPT ); Tue, 13 Sep 2022 11:13:44 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 002C4786DF; Tue, 13 Sep 2022 07:33:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C93B7614E9; Tue, 13 Sep 2022 14:32:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CAEF3C433D6; Tue, 13 Sep 2022 14:32:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079577; bh=03FPAWqRDDXD6zO7/j4hVdm8z2IOL/rQTzpJQKo/Wag=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nQcRgui6jv7xJry5vj/D/1FYgreMoz3sqbHv/oDBDun4tV1W2gUteznJUwyGeZEFO 1eCmQr/Cbq8j71J8pheo3+mtc2QLbsyitHu+4uVMXbz2pQi9U6tD2hCEGrt+SJ8Apc XhXC8qEtGwv974t3wfzoW3kzvGM3B70C4bOisug8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrew Halaney , Matthias Kaehlcke , Manivannan Sadhasivam , Johan Hovold , Johan Hovold Subject: [PATCH 4.19 73/79] usb: dwc3: fix PHY disable sequence Date: Tue, 13 Sep 2022 16:07:31 +0200 Message-Id: <20220913140352.419102957@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold From: Johan Hovold commit d2ac7bef95c9ead307801ccb6cb6dfbeb14247bf upstream. Generic PHYs must be powered-off before they can be tore down. Similarly, suspending legacy PHYs after having powered them off makes no sense. Fix the dwc3_core_exit() (e.g. called during suspend) and open-coded dwc3_probe() error-path sequences that got this wrong. Note that this makes dwc3_core_exit() match the dwc3_core_init() error path with respect to powering off the PHYs. Fixes: 03c1fd622f72 ("usb: dwc3: core: add phy cleanup for probe error hand= ling") Fixes: c499ff71ff2a ("usb: dwc3: core: re-factor init and exit paths") Cc: stable@vger.kernel.org # 4.8 Reviewed-by: Andrew Halaney Reviewed-by: Matthias Kaehlcke Reviewed-by: Manivannan Sadhasivam Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-2-johan+linaro@kernel.= org Signed-off-by: Greg Kroah-Hartman [ johan: adjust context to 4.19 ] Signed-off-by: Johan Hovold Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/dwc3/core.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -673,15 +673,16 @@ static void dwc3_core_exit(struct dwc3 * { dwc3_event_buffers_cleanup(dwc); =20 + usb_phy_set_suspend(dwc->usb2_phy, 1); + usb_phy_set_suspend(dwc->usb3_phy, 1); + phy_power_off(dwc->usb2_generic_phy); + phy_power_off(dwc->usb3_generic_phy); + usb_phy_shutdown(dwc->usb2_phy); usb_phy_shutdown(dwc->usb3_phy); phy_exit(dwc->usb2_generic_phy); phy_exit(dwc->usb3_generic_phy); =20 - usb_phy_set_suspend(dwc->usb2_phy, 1); - usb_phy_set_suspend(dwc->usb3_phy, 1); - phy_power_off(dwc->usb2_generic_phy); - phy_power_off(dwc->usb3_generic_phy); clk_bulk_disable(dwc->num_clks, dwc->clks); clk_bulk_unprepare(dwc->num_clks, dwc->clks); reset_control_assert(dwc->reset); @@ -1509,16 +1510,16 @@ err5: dwc3_debugfs_exit(dwc); dwc3_event_buffers_cleanup(dwc); =20 - usb_phy_shutdown(dwc->usb2_phy); - usb_phy_shutdown(dwc->usb3_phy); - phy_exit(dwc->usb2_generic_phy); - phy_exit(dwc->usb3_generic_phy); - usb_phy_set_suspend(dwc->usb2_phy, 1); usb_phy_set_suspend(dwc->usb3_phy, 1); phy_power_off(dwc->usb2_generic_phy); phy_power_off(dwc->usb3_generic_phy); =20 + usb_phy_shutdown(dwc->usb2_phy); + usb_phy_shutdown(dwc->usb3_phy); + phy_exit(dwc->usb2_generic_phy); + phy_exit(dwc->usb3_generic_phy); + dwc3_ulpi_exit(dwc); =20 err4: From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C296C54EE9 for ; Tue, 13 Sep 2022 17:06:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232384AbiIMRG1 (ORCPT ); Tue, 13 Sep 2022 13:06:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36568 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232367AbiIMRGB (ORCPT ); Tue, 13 Sep 2022 13:06:01 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2ECA383F37; Tue, 13 Sep 2022 08:55:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D4FE5B80F93; Tue, 13 Sep 2022 14:33:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 48C47C433B5; Tue, 13 Sep 2022 14:32:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079579; bh=HwcKgcx3YUW4O5fZ2Dy56K8an7bFPB5SAM8Cc7hYdjM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JycDiVG3WxZgYxXeB8FI3lh/mBbcrIkej/L1cQ9DOVYTHw4lgT9xRyZp+rRWZpkit cU9f3Wk8215O6D1+EC9gCACSzuJMeogxTi3lBm6yrUp5U94Zk9tCvo3jgwdrMFnV8w tgpm4TvyLu14tg2skmk7Vz0D5tPr1Me3a/60kDLM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Woithe , Johan Hovold Subject: [PATCH 4.19 74/79] USB: serial: ch341: fix lost character on LCR updates Date: Tue, 13 Sep 2022 16:07:32 +0200 Message-Id: <20220913140352.462146395@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 8e83622ae7ca481c76c8fd9579877f6abae64ca2 upstream. Disable LCR updates for pre-0x30 devices which use a different (unknown) protocol for line control and where the current register write causes the next received character to be lost. Note that updating LCR using the INIT command has no effect on these devices either. Reported-by: Jonathan Woithe Tested-by: Jonathan Woithe Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au Fixes: 4e46c410e050 ("USB: serial: ch341: reinitialize chip on reconfigurat= ion") Fixes: 55fa15b5987d ("USB: serial: ch341: fix baud rate and line-control ha= ndling") Cc: stable@vger.kernel.org # 4.10 Signed-off-by: Johan Hovold [ johan: adjust context to 4.19 ] Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/serial/ch341.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/drivers/usb/serial/ch341.c +++ b/drivers/usb/serial/ch341.c @@ -96,6 +96,8 @@ struct ch341_private { u8 mcr; u8 msr; u8 lcr; + + u8 version; }; =20 static void ch341_set_termios(struct tty_struct *tty, @@ -181,6 +183,9 @@ static int ch341_set_baudrate_lcr(struct if (r) return r; =20 + if (priv->version < 0x30) + return 0; + r =3D ch341_control_out(dev, CH341_REQ_WRITE_REG, 0x2518, lcr); if (r) return r; @@ -232,7 +237,9 @@ static int ch341_configure(struct usb_de r =3D ch341_control_in(dev, CH341_REQ_READ_VERSION, 0, 0, buffer, size); if (r < 0) goto out; - dev_dbg(&dev->dev, "Chip version: 0x%02x\n", buffer[0]); + + priv->version =3D buffer[0]; + dev_dbg(&dev->dev, "Chip version: 0x%02x\n", priv->version); =20 r =3D ch341_control_out(dev, CH341_REQ_SERIAL_INIT, 0, 0); if (r < 0) From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1B9FC54EE9 for ; Tue, 13 Sep 2022 15:16:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234449AbiIMPQh (ORCPT ); Tue, 13 Sep 2022 11:16:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56616 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235838AbiIMPN7 (ORCPT ); Tue, 13 Sep 2022 11:13:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EF761786F8; Tue, 13 Sep 2022 07:33:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2EB15614D8; Tue, 13 Sep 2022 14:33:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2908AC433C1; Tue, 13 Sep 2022 14:33:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079582; bh=tFKe29vBsrtAsOOzBfGmnkFi9oNi877R8GhDW+yP4ow=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DBiXmeFvs9mWKBEUNxWdz5v8QlX0WkzXNdNveAHfuOxm2MosOERBlgT3whtLX9jMr Fa1K2mzP0D0D+zd+bUulAN1GuZDiKAtb6KHn1rHu/cAlN1hjM4TpejHoe2XWrF2V45 eiEpnZDFzOCb9XO5SryzUr6nXLN6rRHeQGxDCTIw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Woithe , Johan Hovold Subject: [PATCH 4.19 75/79] USB: serial: ch341: fix disabled rx timer on older devices Date: Tue, 13 Sep 2022 16:07:33 +0200 Message-Id: <20220913140352.508538258@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 41ca302a697b64a3dab4676e01d0d11bb184737d upstream. At least one older CH341 appears to have the RX timer enable bit inverted so that setting it disables the RX timer and prevents the FIFO from emptying until it is full. Only set the RX timer enable bit for devices with version newer than 0x27 (even though this probably affects all pre-0x30 devices). Reported-by: Jonathan Woithe Tested-by: Jonathan Woithe Link: https://lore.kernel.org/r/Ys1iPTfiZRWj2gXs@marvin.atrad.com.au Fixes: 4e46c410e050 ("USB: serial: ch341: reinitialize chip on reconfigurat= ion") Cc: stable@vger.kernel.org # 4.10 Signed-off-by: Johan Hovold [ johan: backport to 5.4 ] Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/serial/ch341.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/drivers/usb/serial/ch341.c +++ b/drivers/usb/serial/ch341.c @@ -176,8 +176,12 @@ static int ch341_set_baudrate_lcr(struct /* * CH341A buffers data until a full endpoint-size packet (32 bytes) * has been received unless bit 7 is set. + * + * At least one device with version 0x27 appears to have this bit + * inverted. */ - a |=3D BIT(7); + if (priv->version > 0x27) + a |=3D BIT(7); =20 r =3D ch341_control_out(dev, CH341_REQ_WRITE_REG, 0x1312, a); if (r) From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE4E0C6FA82 for ; Tue, 13 Sep 2022 15:32:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232853AbiIMPcp (ORCPT ); Tue, 13 Sep 2022 11:32:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45792 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236508AbiIMPb6 (ORCPT ); Tue, 13 Sep 2022 11:31:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 98B687E820; Tue, 13 Sep 2022 07:40:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 93BE3B80F6F; Tue, 13 Sep 2022 14:33:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C465FC433C1; Tue, 13 Sep 2022 14:33:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079585; bh=QVUIIIchCxxeuUgwWdiExksNAQBR6e7xgJ2M8dTQg50=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hEGcNpHHRuXatl3hTBnqi53B16yleG8ua70/oD1toP4s3qBTu+ZEiZjHHDaBlZOY/ 4epYEqPRWho0Tsjtm8XiZS7xxCSrCm6OlFztT1UHe6objRyM2cPkSwFtIJdj65Lcj8 DBhZm/HEmr6KgAmMYQI9hfZIIvsVDJUuwJWd7izU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Matthias Kaehlcke , Manivannan Sadhasivam , Johan Hovold , Johan Hovold Subject: [PATCH 4.19 76/79] usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup Date: Tue, 13 Sep 2022 16:07:34 +0200 Message-Id: <20220913140352.554689442@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold From: Johan Hovold commit a872ab303d5ddd4c965f9cd868677781a33ce35a upstream. The Qualcomm dwc3 runtime-PM implementation checks the xhci platform-device pointer in the wakeup-interrupt handler to determine whether the controller is in host mode and if so triggers a resume. After a role switch in OTG mode the xhci platform-device would have been freed and the next wakeup from runtime suspend would access the freed memory. Note that role switching is executed from a freezable workqueue, which guarantees that the pointer is stable during suspend. Also note that runtime PM has been broken since commit 2664deb09306 ("usb: dwc3: qcom: Honor wakeup enabled/disabled state"), which incidentally also prevents this issue from being triggered. Fixes: a4333c3a6ba9 ("usb: dwc3: Add Qualcomm DWC3 glue driver") Cc: stable@vger.kernel.org # 4.18 Reviewed-by: Matthias Kaehlcke Reviewed-by: Manivannan Sadhasivam Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220804151001.23612-5-johan+linaro@kernel.= org Signed-off-by: Greg Kroah-Hartman [ johan: adjust context for 5.4 ] Signed-off-by: Johan Hovold Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- drivers/usb/dwc3/dwc3-qcom.c | 14 +++++++++++++- drivers/usb/dwc3/host.c | 1 + 2 files changed, 14 insertions(+), 1 deletion(-) --- a/drivers/usb/dwc3/dwc3-qcom.c +++ b/drivers/usb/dwc3/dwc3-qcom.c @@ -173,6 +173,14 @@ static int dwc3_qcom_register_extcon(str return 0; } =20 +/* Only usable in contexts where the role can not change. */ +static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom) +{ + struct dwc3 *dwc =3D platform_get_drvdata(qcom->dwc3); + + return dwc->xhci; +} + static void dwc3_qcom_disable_interrupts(struct dwc3_qcom *qcom) { if (qcom->hs_phy_irq) { @@ -280,7 +288,11 @@ static irqreturn_t qcom_dwc3_resume_irq( if (qcom->pm_suspended) return IRQ_HANDLED; =20 - if (dwc->xhci) + /* + * This is safe as role switching is done from a freezable workqueue + * and the wakeup interrupts are disabled as part of resume. + */ + if (dwc3_qcom_is_host(qcom)) pm_runtime_resume(&dwc->xhci->dev); =20 return IRQ_HANDLED; --- a/drivers/usb/dwc3/host.c +++ b/drivers/usb/dwc3/host.c @@ -142,4 +142,5 @@ void dwc3_host_exit(struct dwc3 *dwc) phy_remove_lookup(dwc->usb3_generic_phy, "usb3-phy", dev_name(dwc->dev)); platform_device_unregister(dwc->xhci); + dwc->xhci =3D NULL; } From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 592D4C54EE9 for ; Tue, 13 Sep 2022 15:33:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234068AbiIMPdL (ORCPT ); Tue, 13 Sep 2022 11:33:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44660 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233990AbiIMPcK (ORCPT ); Tue, 13 Sep 2022 11:32:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 91B5F7F118; Tue, 13 Sep 2022 07:40:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0142EB80F1A; Tue, 13 Sep 2022 14:33:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 575FFC433D6; Tue, 13 Sep 2022 14:33:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079587; bh=reUpS03sK+iOiluB79gKV2t+j7afT4DYT/IaDQx99M4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qfzVSm8ObK5D7Y47ziVTNV9v7qgN0xr4MRZTThplWPF182mTfD7CYEvggqrTvKh9v ZJUenPFB1qD/dYUcZA0sgwT85RRlMcws0hrNRk6tT9Kkil7jNLUBVhJmqSobT4kYMa bGrLglAME3x4QbpfkdUr7cTKnTYGaMUUv+zFknXc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ben Hutchings , "Peter Zijlstra (Intel)" , Pawan Gupta Subject: [PATCH 4.19 77/79] x86/nospec: Fix i386 RSB stuffing Date: Tue, 13 Sep 2022 16:07:35 +0200 Message-Id: <20220913140352.600717282@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pawan Gupta From: Peter Zijlstra commit 332924973725e8cdcc783c175f68cf7e162cb9e5 upstream. Turns out that i386 doesn't unconditionally have LFENCE, as such the loop in __FILL_RETURN_BUFFER isn't actually speculation safe on such chips. Fixes: ba6e31af2be9 ("x86/speculation: Add LFENCE to RSB fill sequence") Reported-by: Ben Hutchings Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/Yv9tj9vbQ9nNlXoY@worktop.programming.kicks-= ass.net [bwh: Backported to 4.19/5.4: - __FILL_RETURN_BUFFER takes an sp parameter - Open-code __FILL_RETURN_SLOT] Signed-off-by: Ben Hutchings Signed-off-by: Pawan Gupta Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- arch/x86/include/asm/nospec-branch.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -35,6 +35,7 @@ * the optimal version =E2=80=94 two calls, each with their own speculation * trap should their return address end up getting used, in a loop. */ +#ifdef CONFIG_X86_64 #define __FILL_RETURN_BUFFER(reg, nr, sp) \ mov $(nr/2), reg; \ 771: \ @@ -55,6 +56,19 @@ add $(BITS_PER_LONG/8) * nr, sp; \ /* barrier for jnz misprediction */ \ lfence; +#else +/* + * i386 doesn't unconditionally have LFENCE, as such it can't + * do a loop. + */ +#define __FILL_RETURN_BUFFER(reg, nr, sp) \ + .rept nr; \ + call 772f; \ + int3; \ +772:; \ + .endr; \ + add $(BITS_PER_LONG/8) * nr, sp; +#endif =20 /* Sequence to mitigate PBRSB on eIBRS CPUs */ #define __ISSUE_UNBALANCED_RET_GUARD(sp) \ From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38A00C6FA82 for ; Tue, 13 Sep 2022 15:16:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235551AbiIMPQm (ORCPT ); Tue, 13 Sep 2022 11:16:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42882 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235844AbiIMPN7 (ORCPT ); Tue, 13 Sep 2022 11:13:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CDFD278BEF; Tue, 13 Sep 2022 07:33:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 04B92614E2; Tue, 13 Sep 2022 14:33:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0AFC5C433C1; Tue, 13 Sep 2022 14:33:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079590; bh=vhBPoo9+TLK9+hQbWq1b8y3SJghTY07Qom1m3j2Diu0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wqQgsaPTnZYVUakymKyWY8a2i+pV+IGB9oj5NAiYmsYY0uSUckJ9kn1sQPInI8wYJ owtrI4OoscEql7sVHfgwC4PN2nzkkTozkYvxpdDWOs3VmohGEpAIAUDIFiD60vIH3L yVxyXKR75owa/1eC89Oe5U4YLwH6Z+me7oxHJVZ4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Ling , Keguang Zhang , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 4.19 78/79] MIPS: loongson32: ls1c: Fix hang during startup Date: Tue, 13 Sep 2022 16:07:36 +0200 Message-Id: <20220913140352.641002229@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Ling [ Upstream commit 35508d2424097f9b6a1a17aac94f702767035616 ] The RTCCTRL reg of LS1C is obselete. Writing this reg will cause system hang. Fixes: 60219c563c9b6 ("MIPS: Add RTC support for Loongson1C board") Signed-off-by: Yang Ling Tested-by: Keguang Zhang Acked-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- arch/mips/loongson32/ls1c/board.c | 1 - 1 file changed, 1 deletion(-) diff --git a/arch/mips/loongson32/ls1c/board.c b/arch/mips/loongson32/ls1c/= board.c index eb2d913c694fd..2d9675a6782c3 100644 --- a/arch/mips/loongson32/ls1c/board.c +++ b/arch/mips/loongson32/ls1c/board.c @@ -19,7 +19,6 @@ static struct platform_device *ls1c_platform_devices[] __= initdata =3D { static int __init ls1c_platform_init(void) { ls1x_serial_set_uartclk(&ls1x_uart_pdev); - ls1x_rtc_set_extclk(&ls1x_rtc_pdev); =20 return platform_add_devices(ls1c_platform_devices, ARRAY_SIZE(ls1c_platform_devices)); --=20 2.35.1 From nobody Wed Sep 3 01:54:03 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21B00C6FA82 for ; Tue, 13 Sep 2022 15:16:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235750AbiIMPQz (ORCPT ); Tue, 13 Sep 2022 11:16:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51832 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235892AbiIMPOG (ORCPT ); Tue, 13 Sep 2022 11:14:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 034B45C9D8; Tue, 13 Sep 2022 07:33:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1E8C7614F6; Tue, 13 Sep 2022 14:33:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34043C433C1; Tue, 13 Sep 2022 14:33:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079595; bh=VNkiXlupSnUv/zFQJS9XA2oRdoEVAlkzh7X/DSkhBZU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M5PYit+6t/80U6/FCiVgULOJ5nMvT7QssOxikvoBA3qcfJj3jCmJ8Sa9h9L8ZNpm5 UwA65welr4zU1jOQ/lSIbVide8WMHjPQf/GS3mxPJqj4tCdljGcoFV5ZP1vniA3cTF fnwnWrDjEka2l4Tvb6mHczYLlgx628Q6qdCvB/r8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, NeilBrown , Eugeniu Rosca Subject: [PATCH 4.19 79/79] SUNRPC: use _bh spinlocking on ->transport_lock Date: Tue, 13 Sep 2022 16:07:37 +0200 Message-Id: <20220913140352.684003075@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140348.835121645@linuxfoundation.org> References: <20220913140348.835121645@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: "NeilBrown" Prior to Linux 5.3, ->transport_lock in sunrpc required the _bh style spinlocks (when not called from a bottom-half handler). When upstream 3848e96edf4788f772d83990022fa7023a233d83 was backported to stable kernels, the spin_lock/unlock calls should have been changed to the _bh version, but this wasn't noted in the patch and didn't happen. So convert these lock/unlock calls to the _bh versions. This patch is required for any stable kernel prior to 5.3 to which the above mentioned patch was backported. Namely 4.9.y, 4.14.y, 4.19.y. Signed-off-by: NeilBrown Reported-by: Eugeniu Rosca Reviewed-by: Eugeniu Rosca Tested-by: Eugeniu Rosca Tested-by: Guenter Roeck Tested-by: Jon Hunter Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Sudip Mukherjee --- net/sunrpc/xprt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/sunrpc/xprt.c +++ b/net/sunrpc/xprt.c @@ -1550,9 +1550,9 @@ static void xprt_destroy(struct rpc_xprt * is cleared. We use ->transport_lock to ensure the mod_timer() * can only run *before* del_time_sync(), never after. */ - spin_lock(&xprt->transport_lock); + spin_lock_bh(&xprt->transport_lock); del_timer_sync(&xprt->timer); - spin_unlock(&xprt->transport_lock); + spin_unlock_bh(&xprt->transport_lock); =20 /* * Destroy sockets etc from the system workqueue so they can